tenantguard-cli 0.1.1__py3-none-any.whl

tenantguard_cli/__init__.py

@@ -0,0 +1,17 @@
+"""tenantguard-cli: a thin PyPI wrapper around the TenantGuard Go binary.
+
+This package does not reimplement TenantGuard in Python. It resolves the
+correct prebuilt binary for the running platform from TenantGuard's GitHub
+Releases (published by goreleaser), caches it locally, and execs it,
+forwarding argv/stdio/exit-code unchanged. See ``tenantguard_cli.cli`` and
+``tenantguard_cli.platforms`` for the implementation.
+"""
+
+__version__ = "0.1.1"
+
+# The GitHub release tag this package version is pinned to. Kept in lockstep
+# with __version__ (and with the npm wrapper's RELEASE_TAG in
+# npm/scripts/fetch-binary.js) -- a new TenantGuard release means a new
+# tenantguard-cli release pinned to the matching tag, never a silent
+# "latest" resolution at install or run time.
+RELEASE_TAG = f"v{__version__}"

tenantguard_cli/cli.py

@@ -0,0 +1,315 @@
+"""Runtime entry point for the `tenantguard` console script.
+
+On first invocation for a given (package version, platform, arch), this
+downloads the matching TenantGuard release archive from GitHub Releases,
+verifies checksums.txt's Sigstore signature (keyless, GitHub Actions OIDC)
+before trusting any digest inside it, verifies the archive against that
+digest (SHA-256), extracts the binary into a local cache directory, then
+execs it -- forwarding argv, stdio, and exit code unchanged. Subsequent
+invocations reuse the cached binary; no network access happens once it's
+cached.
+
+Signature verification uses the `sigstore` PyPI package (a pure-Python
+Sigstore client, see https://pypi.org/project/sigstore/), not the `cosign`
+CLI binary that npm/scripts/fetch-binary.js shells out to. That script runs
+only at *publish* time, on the maintainer's own CI runner, where installing
+an extra CLI binary is a reasonable ask. This package's download happens on
+the *end user's* machine at first run instead -- a single pure-Python wheel
+can't embed all platform binaries the way npm's per-platform packages can --
+so requiring end users to separately install `cosign` would be a real
+usability regression. sigstore-python avoids that tradeoff: the same
+verification guarantee (checksums.txt must carry a valid Sigstore signature
+from this repo's own release workflow, keyless via GitHub Actions OIDC, with
+certificate identity and issuer checked against the pinned RELEASE_TAG) with
+no extra binary for the end user to install.
+
+checksums.txt.sig and checksums.txt.pem (the same release assets the npm
+script already consumes) are fetched alongside checksums.txt and verified
+BEFORE any digest is parsed out of it. That ordering is what actually closes
+the gap SHA-256-over-HTTPS alone leaves open: if checksums.txt and a
+malicious archive were served together from a single compromised source,
+they'd still agree with each other and pass a bare digest check. Requiring a
+valid signature from the real release workflow first means an attacker would
+also need to forge that signature, not just serve consistent bytes.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import io
+import os
+import stat
+import subprocess
+import sys
+import tarfile
+import urllib.error
+import urllib.request
+import zipfile
+from pathlib import Path
+
+from cryptography.x509 import load_pem_x509_certificate
+from sigstore._internal.rekor import _hashedrekord_from_parts
+from sigstore.hashes import HashAlgorithm, Hashed
+from sigstore.models import Bundle
+from sigstore.verify import Verifier
+from sigstore.verify import policy as sigstore_policy
+
+from . import RELEASE_TAG, __version__
+from .platforms import (
+    UnsupportedPlatformError,
+    archive_ext,
+    archive_name,
+    binary_name,
+    resolve_goarch,
+    resolve_goos,
+)
+
+REPO = "RudrenduPaul/TenantGuard"
+PROJECT_NAME = "tenantguard"
+RELEASE_BASE = f"https://github.com/{REPO}/releases/download/{RELEASE_TAG}"
+USER_AGENT = "tenantguard-cli-pypi-wrapper"
+REQUEST_TIMEOUT_SECONDS = 30
+
+# Same identity/issuer the release workflow (.github/workflows/release.yml)
+# signs checksums.txt with, and that npm/scripts/fetch-binary.js's cosign
+# check already verifies against -- keyless Sigstore signing via GitHub
+# Actions OIDC, scoped to this exact release workflow run for this exact tag.
+SIGSTORE_OIDC_ISSUER = "https://token.actions.githubusercontent.com"
+
+
+def _sigstore_certificate_identity() -> str:
+    return f"https://github.com/{REPO}/.github/workflows/release.yml@refs/tags/{RELEASE_TAG}"
+
+
+def _cache_dir() -> Path:
+    """Version-scoped cache directory. A new pinned RELEASE_TAG (i.e. a new
+    tenantguard-cli release) gets its own subdirectory, so upgrading this
+    package always re-downloads rather than silently reusing a stale binary.
+    """
+    base = os.environ.get("TENANTGUARD_CLI_CACHE_DIR")
+    if base:
+        root = Path(base)
+    elif sys.platform == "win32":
+        root = Path(os.environ.get("LOCALAPPDATA", Path.home() / "AppData" / "Local")) / "tenantguard-cli"
+    elif sys.platform == "darwin":
+        root = Path.home() / "Library" / "Caches" / "tenantguard-cli"
+    else:
+        xdg = os.environ.get("XDG_CACHE_HOME")
+        root = Path(xdg) / "tenantguard-cli" if xdg else Path.home() / ".cache" / "tenantguard-cli"
+    return root / __version__
+
+
+def _fetch(url: str) -> bytes:
+    request = urllib.request.Request(url, headers={"User-Agent": USER_AGENT})
+    try:
+        with urllib.request.urlopen(request, timeout=REQUEST_TIMEOUT_SECONDS) as response:
+            return response.read()
+    except urllib.error.HTTPError as exc:
+        raise RuntimeError(f"tenantguard-cli: GET {url} failed: HTTP {exc.code}") from exc
+    except urllib.error.URLError as exc:
+        raise RuntimeError(f"tenantguard-cli: GET {url} failed: {exc.reason}") from exc
+
+
+def _sha256_hex(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def _build_sigstore_verifier() -> Verifier:
+    """Split out so tests can monkeypatch it instead of hitting the real
+    Sigstore trust root / TUF refresh."""
+    return Verifier.production()
+
+
+def _retrieve_sigstore_log_entry(verifier: Verifier, certificate, signature: bytes, hashed: Hashed):
+    """Looks up the Rekor transparency-log entry matching a *detached*
+    signature + certificate pair (i.e. separate .sig/.pem files, the same
+    shape cosign produces and that checksums.txt.sig/.pem already are) --
+    mirrors what sigstore-python's own CLI does internally for this exact
+    "detached materials" case (see sigstore.verify.Verifier's `_rekor`
+    attribute and its "ugly hack needed for verifying detached materials"
+    comment). A `Bundle` built via `Bundle.from_parts` requires this log
+    entry, so it has to be fetched before verification can proceed. Split out
+    so tests can monkeypatch it instead of hitting the real transparency log.
+    """
+    return verifier._rekor.log.entries.retrieve.post(  # noqa: SLF001
+        _hashedrekord_from_parts(certificate, signature, hashed)
+    )
+
+
+def _verify_checksums_signature(checksums_bytes: bytes, cert_pem_bytes: bytes, sig_bytes: bytes) -> None:
+    """Verifies checksums.txt was signed by this repo's own release workflow
+    via Sigstore keyless signing (GitHub Actions OIDC), using the pure-Python
+    `sigstore` library. `cert_pem_bytes`/`sig_bytes` are the raw bytes
+    downloaded from checksums.txt.pem / checksums.txt.sig -- the same release
+    assets npm/scripts/fetch-binary.js's cosign check already consumes.
+
+    Raises RuntimeError on any failure: a certificate that doesn't parse, no
+    matching transparency-log entry, a signature that doesn't verify, or a
+    certificate identity/issuer that doesn't match this exact release
+    workflow run. Must be called, and must succeed, before any digest parsed
+    out of checksums.txt is trusted.
+    """
+    try:
+        certificate = load_pem_x509_certificate(cert_pem_bytes)
+    except ValueError as exc:
+        raise RuntimeError(
+            f"tenantguard-cli: could not parse checksums.txt.pem as a PEM certificate: {exc}"
+        ) from exc
+
+    hashed = Hashed(algorithm=HashAlgorithm.SHA2_256, digest=hashlib.sha256(checksums_bytes).digest())
+    verifier = _build_sigstore_verifier()
+
+    try:
+        log_entry = _retrieve_sigstore_log_entry(verifier, certificate, sig_bytes, hashed)
+    except Exception as exc:
+        raise RuntimeError(
+            "tenantguard-cli: failed to look up checksums.txt's signature in the Sigstore "
+            f"transparency log: {exc}"
+        ) from exc
+
+    if log_entry is None:
+        raise RuntimeError(
+            "tenantguard-cli: no matching Sigstore transparency log entry found for "
+            "checksums.txt.sig/checksums.txt.pem -- refusing to trust checksums.txt."
+        )
+
+    try:
+        bundle = Bundle.from_parts(certificate, sig_bytes, log_entry)
+    except Exception as exc:
+        raise RuntimeError(
+            f"tenantguard-cli: could not assemble a Sigstore bundle for checksums.txt: {exc}"
+        ) from exc
+
+    verification_policy = sigstore_policy.Identity(
+        identity=_sigstore_certificate_identity(),
+        issuer=SIGSTORE_OIDC_ISSUER,
+    )
+
+    try:
+        verifier.verify_artifact(checksums_bytes, bundle, verification_policy)
+    except Exception as exc:
+        raise RuntimeError(
+            f"tenantguard-cli: Sigstore signature verification failed for checksums.txt: {exc}"
+        ) from exc
+
+    print(
+        "tenantguard-cli: sigstore signature verified for checksums.txt "
+        "(keyless, GitHub Actions OIDC)",
+        file=sys.stderr,
+    )
+
+
+def _parse_checksums(text: str) -> dict[str, str]:
+    """checksums.txt lines look like "<64 hex chars>  <filename>" (goreleaser's
+    default sha256sum-compatible format; tolerate an optional leading "*")."""
+    checksums: dict[str, str] = {}
+    for raw_line in text.splitlines():
+        line = raw_line.strip()
+        if not line:
+            continue
+        parts = line.split(None, 1)
+        if len(parts) != 2:
+            continue
+        digest, filename = parts
+        digest = digest.strip().lower()
+        filename = filename.lstrip("*").strip()
+        if len(digest) == 64:
+            checksums[filename] = digest
+    return checksums
+
+
+def _extract_binary(archive_bytes: bytes, ext: str, target_basename: str) -> bytes:
+    if ext == "zip":
+        with zipfile.ZipFile(io.BytesIO(archive_bytes)) as zf:
+            for name in zf.namelist():
+                if os.path.basename(name) == target_basename:
+                    return zf.read(name)
+    else:
+        with tarfile.open(fileobj=io.BytesIO(archive_bytes), mode="r:gz") as tf:
+            for member in tf.getmembers():
+                if os.path.basename(member.name) == target_basename:
+                    extracted = tf.extractfile(member)
+                    if extracted is None:
+                        break
+                    return extracted.read()
+    raise RuntimeError(
+        f"tenantguard-cli: could not find '{target_basename}' inside the downloaded archive."
+    )
+
+
+def ensure_binary() -> Path:
+    """Returns the path to a verified, cached tenantguard binary for the
+    current platform, downloading and extracting it first if needed.
+    """
+    goos = resolve_goos()
+    goarch = resolve_goarch()
+    bin_name = binary_name(goos)
+
+    cache_dir = _cache_dir()
+    cached_path = cache_dir / bin_name
+    if cached_path.is_file() and os.access(cached_path, os.X_OK):
+        return cached_path
+
+    asset_name = archive_name(PROJECT_NAME, goos, goarch)
+    archive_url = f"{RELEASE_BASE}/{asset_name}"
+    checksums_url = f"{RELEASE_BASE}/checksums.txt"
+    checksums_sig_url = f"{checksums_url}.sig"
+    checksums_cert_url = f"{checksums_url}.pem"
+
+    print(f"tenantguard-cli: downloading {archive_url}", file=sys.stderr)
+    archive_bytes = _fetch(archive_url)
+    checksums_bytes = _fetch(checksums_url)
+    checksums_sig_bytes = _fetch(checksums_sig_url)
+    checksums_cert_bytes = _fetch(checksums_cert_url)
+
+    _verify_checksums_signature(checksums_bytes, checksums_cert_bytes, checksums_sig_bytes)
+
+    checksums = _parse_checksums(checksums_bytes.decode("utf-8", errors="replace"))
+    expected_digest = checksums.get(asset_name)
+    if not expected_digest:
+        raise RuntimeError(
+            f"tenantguard-cli: no checksum entry for '{asset_name}' in {RELEASE_TAG}'s "
+            "checksums.txt -- refusing to proceed."
+        )
+
+    actual_digest = _sha256_hex(archive_bytes)
+    if actual_digest != expected_digest:
+        raise RuntimeError(
+            f"tenantguard-cli: checksum mismatch for {asset_name}: "
+            f"expected {expected_digest}, got {actual_digest}. Refusing to extract."
+        )
+    print(f"tenantguard-cli: checksum verified for {asset_name}", file=sys.stderr)
+
+    binary_data = _extract_binary(archive_bytes, ext=archive_ext(goos), target_basename=bin_name)
+    if not binary_data:
+        raise RuntimeError(f"tenantguard-cli: extracted an empty '{bin_name}' from {asset_name}.")
+
+    cache_dir.mkdir(parents=True, exist_ok=True)
+    tmp_path = cached_path.with_suffix(cached_path.suffix + ".tmp")
+    tmp_path.write_bytes(binary_data)
+    if sys.platform != "win32":
+        current_mode = tmp_path.stat().st_mode
+        tmp_path.chmod(current_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
+    tmp_path.replace(cached_path)
+
+    print(f"tenantguard-cli: cached verified binary at {cached_path}", file=sys.stderr)
+    return cached_path
+
+
+def main(argv: list[str] | None = None) -> int:
+    argv = sys.argv[1:] if argv is None else argv
+    try:
+        binary_path = ensure_binary()
+    except UnsupportedPlatformError as exc:
+        print(str(exc), file=sys.stderr)
+        return 1
+    except RuntimeError as exc:
+        print(str(exc), file=sys.stderr)
+        return 1
+
+    result = subprocess.run([str(binary_path), *argv])
+    return result.returncode
+
+
+if __name__ == "__main__":
+    sys.exit(main())

tenantguard_cli/platforms.py

@@ -0,0 +1,70 @@
+"""Pure platform/arch resolution logic, kept separate from cli.py so it can
+be unit tested without touching the network or the filesystem.
+
+Mirrors the goreleaser build matrix in .goreleaser.yml (goos: linux, darwin,
+windows / goarch: amd64, arm64) and the archive naming template
+"{{ .ProjectName }}_{{ .Os }}_{{ .Arch }}" -- the same convention the npm
+wrapper's optionalDependency package names / npm/scripts/fetch-binary.js
+already rely on for this exact repo.
+"""
+
+from __future__ import annotations
+
+import platform
+import sys
+
+# sys.platform -> goreleaser GOOS
+_GOOS_MAP = {
+    "linux": "linux",
+    "darwin": "darwin",
+    "win32": "windows",
+    "cygwin": "windows",
+}
+
+# platform.machine() (lowercased) -> goreleaser GOARCH
+_GOARCH_MAP = {
+    "x86_64": "amd64",
+    "amd64": "amd64",
+    "arm64": "arm64",
+    "aarch64": "arm64",
+}
+
+
+class UnsupportedPlatformError(RuntimeError):
+    """Raised when the running machine has no matching TenantGuard release asset."""
+
+
+def resolve_goos(sys_platform: str = sys.platform) -> str:
+    goos = _GOOS_MAP.get(sys_platform)
+    if goos is None:
+        raise UnsupportedPlatformError(
+            f"tenantguard-cli: unsupported platform '{sys_platform}'. "
+            f"Supported: {sorted(set(_GOOS_MAP.values()))}."
+        )
+    return goos
+
+
+def resolve_goarch(machine: str | None = None) -> str:
+    machine = (machine if machine is not None else platform.machine()).lower()
+    goarch = _GOARCH_MAP.get(machine)
+    if goarch is None:
+        raise UnsupportedPlatformError(
+            f"tenantguard-cli: unsupported CPU architecture '{machine}'. "
+            f"Supported: {sorted(set(_GOARCH_MAP.values()))}."
+        )
+    return goarch
+
+
+def archive_ext(goos: str) -> str:
+    return "zip" if goos == "windows" else "tar.gz"
+
+
+def binary_name(goos: str, base_name: str = "tenantguard") -> str:
+    return f"{base_name}.exe" if goos == "windows" else base_name
+
+
+def archive_name(project_name: str, goos: str, goarch: str) -> str:
+    """Matches the .goreleaser.yml archive name_template:
+    "{{ .ProjectName }}_{{ .Os }}_{{ .Arch }}" plus the format extension.
+    """
+    return f"{project_name}_{goos}_{goarch}.{archive_ext(goos)}"

tenantguard_cli-0.1.1.dist-info/METADATA

@@ -0,0 +1,86 @@
+Metadata-Version: 2.4
+Name: tenantguard-cli
+Version: 0.1.1
+Summary: PyPI wrapper for TenantGuard, a tenant-isolation security-audit CLI for self-hosted multi-tenant AI-agent platforms. Downloads and runs the official prebuilt Go binary from GitHub Releases.
+Project-URL: Homepage, https://github.com/RudrenduPaul/TenantGuard
+Project-URL: Repository, https://github.com/RudrenduPaul/TenantGuard
+Project-URL: Bug Tracker, https://github.com/RudrenduPaul/TenantGuard/issues
+Project-URL: Changelog, https://github.com/RudrenduPaul/TenantGuard/blob/main/CHANGELOG.md
+Project-URL: Author - Rudrendu Paul, https://github.com/RudrenduPaul
+Author: Rudrendu Paul
+License-Expression: Apache-2.0
+License-File: LICENSE
+Keywords: ai-agent,cli,hipaa,multi-tenant,opa,rego,sarif,security,tenant-isolation
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Utilities
+Requires-Python: >=3.9
+Requires-Dist: sigstore<5,>=4.0
+Provides-Extra: dev
+Requires-Dist: build<2,>=1.0; extra == 'dev'
+Requires-Dist: pytest<9,>=7.0; extra == 'dev'
+Requires-Dist: twine<7,>=5.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# tenantguard-cli (PyPI)
+
+PyPI wrapper for [TenantGuard](https://github.com/RudrenduPaul/TenantGuard),
+a tenant-isolation security-audit CLI for self-hosted multi-tenant AI-agent
+platforms. This package does not reimplement TenantGuard in Python -- it
+downloads the official prebuilt `tenantguard` binary for your platform from
+TenantGuard's [GitHub Releases](https://github.com/RudrenduPaul/TenantGuard/releases)
+(published by goreleaser), verifies its SHA-256 checksum, caches it locally,
+and execs it.
+
+## Install
+
+```bash
+pip install tenantguard-cli
+```
+
+or run without installing:
+
+```bash
+uvx tenantguard-cli scan --demo
+```
+
+## Usage
+
+```bash
+tenantguard scan --demo
+tenantguard scan --format sarif
+tenantguard scan --format json
+```
+
+See the main [TenantGuard README](https://github.com/RudrenduPaul/TenantGuard#readme)
+for the full rule reference (TA01-TA16), SARIF/JSON output schema, and the
+GitHub Action.
+
+## How this differs from the npm package
+
+The `tenantguard-cli` npm package ships six platform-specific
+`optionalDependencies`, each embedding a cosign-verified binary at publish
+time -- no network access happens on an end user's `npm install`. A single
+pure-Python wheel can't embed six platform binaries the same way, so this
+package instead downloads the matching release archive the first time you
+run `tenantguard`, verifies its SHA-256 against the release's
+`checksums.txt`, and caches the verified binary locally (per package
+version) -- every run after that is offline. See `src/tenantguard_cli/cli.py`
+for the exact verification logic.
+
+Other distribution channels for TenantGuard: Homebrew, `go install`, and
+GitHub Releases directly -- see the main README for details.
+
+## License
+
+Apache-2.0, matching the main TenantGuard repository.

tenantguard_cli-0.1.1.dist-info/RECORD

@@ -0,0 +1,8 @@
+tenantguard_cli/__init__.py,sha256=kPH2pIAMAYStZOtq828bQeJRkECbkQs-2cER2JSBvqM,807
+tenantguard_cli/cli.py,sha256=7E5Q5KlWkqn9PclTtGuCe2JyuIBJwR6C1WA2P4xr9MY,12982
+tenantguard_cli/platforms.py,sha256=fRBL4Zi_bBS3E0yVJl59Z_ddk_RAS9U9qX91DkxyqYo,2199
+tenantguard_cli-0.1.1.dist-info/METADATA,sha256=T1V5_ck9oxCIs3xIHONodghiHR1L1z0V7CErARHdF24,3402
+tenantguard_cli-0.1.1.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
+tenantguard_cli-0.1.1.dist-info/entry_points.txt,sha256=UTM8y0YFF_lO4JnnfY-7rTcIzThiADlLb9ZlTZHjiIs,57
+tenantguard_cli-0.1.1.dist-info/licenses/LICENSE,sha256=vWCQIFSDq8K7yxYvTAwPAT7d5PG2Czswa2NQnJbNw74,10758
+tenantguard_cli-0.1.1.dist-info/RECORD,,

tenantguard_cli-0.1.1.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.31.0
+Root-Is-Purelib: true
+Tag: py3-none-any

tenantguard_cli-0.1.1.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+tenantguard = tenantguard_cli.cli:main

tenantguard_cli-0.1.1.dist-info/licenses/LICENSE

@@ -0,0 +1,190 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the
+      purposes of this License, Derivative Works shall not include works
+      that remain separable from, or merely link (or bind by name) to the
+      interfaces of, the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including the
+      original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing
+      the origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 Rudrendu Paul
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.