cmpnd 0.8.1__tar.gz → 0.8.2__tar.gz

{cmpnd-0.8.1 → cmpnd-0.8.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cmpnd
-Version: 0.8.1
+Version: 0.8.2
 Summary: DSPy observability and deployment SDK for cmpnd
 Project-URL: Homepage, https://cmpnd.ai
 Author-email: cmpnd <hello@cmpnd.ai>

{cmpnd-0.8.1 → cmpnd-0.8.2}/cmpnd/cli/commands/top.py

@@ -622,10 +622,9 @@ def _parse_deploy_metadata(raw: str | None) -> dict[str, Any] | None:
     from ... import deployment
 
     try:
-        deployment._validate_deploy_metadata(value)
+        return deployment._prepare_deploy_metadata(value)
     except (TypeError, ValueError) as exc:
         raise api_client.CliError(f"--metadata is invalid: {exc}")
-    return value
 
 
 def cmd_deploy(client: api_client.ApiClient, args: Any) -> None:

{cmpnd-0.8.1 → cmpnd-0.8.2}/cmpnd/dataset_sync.py

@@ -12,7 +12,7 @@ from typing import Any
 
 import httpx
 
-from . import configuration, identity
+from . import configuration, identity, models
 
 logger = logging.getLogger(__name__)
 
@@ -113,12 +113,20 @@ def build_dataset_payload(
         inputs = {k: v for k, v in d.items() if k in input_fields}
         expected_outputs = {k: v for k, v in d.items() if k not in input_fields}
 
+        # Hashed from the example as given, deliberately: this hash keys dataset
+        # dedup and the per-run split-membership join (train/val_example_hashes,
+        # computed elsewhere from the same unscrubbed example), so it is the
+        # example's identity and must not move with a storage concern.
         example_hash = identity.compute_example_hash(inputs) if inputs else ""
 
         examples.append(
             {
-                "inputs": inputs,
-                "expected_outputs": expected_outputs,
+                # Both land in jsonb columns, so they go through the same
+                # serializer the trace path uses — which also makes a
+                # non-JSON-native field value (a Pydantic model, an image) exportable
+                # instead of failing the encode at send time.
+                "inputs": models._safe_serialize(inputs),
+                "expected_outputs": models._safe_serialize(expected_outputs),
                 "example_hash": example_hash,
             }
         )

{cmpnd-0.8.1 → cmpnd-0.8.2}/cmpnd/deployment.py

@@ -16,7 +16,7 @@ from typing import Any
 
 import httpx
 
-from . import configuration, execution, identity, packaging
+from . import configuration, execution, identity, models, packaging
 
 logger = logging.getLogger(__name__)
 
@@ -27,9 +27,19 @@ logger = logging.getLogger(__name__)
 _MAX_DEPLOY_METADATA_BYTES = 64 * 1024
 
 
-def _validate_deploy_metadata(metadata: Any) -> None:
-    """Validate the deploy metadata blob, raising at the call site on a bad
-    value so the user sees a clear message instead of a server 422/413."""
+def _prepare_deploy_metadata(metadata: Any) -> dict[str, Any]:
+    """Validate the deploy metadata blob and return it in storable form.
+
+    Raises at the call site on a bad value so the user sees a clear message
+    instead of a server 422/413. Validation and scrubbing are one step on
+    purpose: the returned blob lands in a jsonb column, so a caller that
+    validated without scrubbing would still be able to ship a payload the
+    column must reject.
+
+    The size cap is measured on the value as given — scrubbing only ever
+    shortens it, so the check stays the conservative one the server's own
+    limit is stated against.
+    """
     if not isinstance(metadata, dict):
         raise TypeError(f"deploy(metadata=...) must be a dict, got {type(metadata).__name__}")
     if not all(isinstance(k, str) for k in metadata):
@@ -40,6 +50,7 @@ def _validate_deploy_metadata(metadata: Any) -> None:
         raise TypeError(f"deploy(metadata=...) must be JSON-serializable: {exc}") from exc
     if len(encoded.encode("utf-8")) > _MAX_DEPLOY_METADATA_BYTES:
         raise ValueError(f"deploy(metadata=...) exceeds the {_MAX_DEPLOY_METADATA_BYTES}-byte limit")
+    return models._safe_serialize(metadata)
 
 
 def _raise_http_error(response: httpx.Response, action: str) -> None:
@@ -155,11 +166,11 @@ def deploy(module, metric=None, timeout=300, metadata=None):
         # slot and reject an oversized deploy before signing it (Slice E).
         "declared_content_length": len(zip_bytes),
     }
-    # Carry the caller's metadata blob (validated at the call site) as a
-    # reserved top-level body key, committed with the deployment record server-side.
+    # Carry the caller's metadata blob (validated and made jsonb-storable at the
+    # call site) as a reserved top-level body key, committed with the deployment
+    # record server-side.
     if metadata is not None:
-        _validate_deploy_metadata(metadata)
-        deploy_body["metadata"] = metadata
+        deploy_body["metadata"] = _prepare_deploy_metadata(metadata)
     if sig is not None:
         deploy_body["signature_name"] = packaging._signature_to_string(sig)
         deploy_body["module_class"] = type(module).__name__

{cmpnd-0.8.1 → cmpnd-0.8.2}/cmpnd/models.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+import re
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
 from enum import Enum
@@ -11,6 +12,50 @@ from uuid import UUID
 
 from . import identity, imaging
 
+# U+0000 (NUL) and lone UTF-16 surrogates are valid JSON, and valid in a Python
+# str, but the server cannot store either: a JSON column rejects both, and a NUL
+# is rejected by a plain text column too (it is valid UTF-8, but PostgreSQL text
+# cannot hold it). A captured input/output/attribute string, and the text of an
+# exception quoting that data, can all legitimately contain them — so we strip
+# them here rather than shipping a payload the server must reject. On a UTF-8
+# database these are the only such code points, so this is the complete set.
+#
+# "Chokepoint" is load-bearing and is a property of the callers, not just of
+# this function: every payload field bound for a JSON *or* text column goes
+# through _safe_serialize (or _strip_unstorable / _strip_unstorable_opt for a
+# value already known to be a string). Anything that hand-rolls its own
+# serializer instead reopens the hole — the optimizer tracker and the
+# dataset/deploy payload builders therefore route through here too.
+_UNSTORABLE_CODEPOINTS = re.compile("[\x00\ud800-\udfff]")
+
+
+def _strip_unstorable(s: str) -> str:
+    """Drop un-storable code points (U+0000, lone surrogates) from ``s``.
+
+    Fast path: the C-level search returns ``None`` for the ~always-clean case,
+    so no replacement string is built.
+    """
+    return _UNSTORABLE_CODEPOINTS.sub("", s) if _UNSTORABLE_CODEPOINTS.search(s) else s
+
+
+def _strip_unstorable_opt(s: str | None) -> str | None:
+    """``_strip_unstorable`` for an optional string, preserving ``None``.
+
+    For the top-level payload fields that are plain strings on the wire and land
+    in text columns (notably ``error_message``, which is ``str(exception)`` and
+    so routinely quotes the very captured data the code point came from) — they
+    never pass through ``_safe_serialize``.
+    """
+    return None if s is None else _strip_unstorable(s)
+
+
+def _type_name(value: Any) -> str:
+    """Scrubbed class name of ``value``, for the type tags and marker strings
+    below. CPython refuses an un-storable code point in a real class name, so
+    this is defensive: a metaclass answering ``__name__`` itself is the only way
+    one arrives, and the scrub costs one call at each interpolation site."""
+    return _strip_unstorable(type(value).__name__)
+
 
 def _safe_serialize(value: Any, _stack: set[int] | None = None) -> Any:
     """Recursively serialize a value to JSON-safe types.
@@ -28,8 +73,11 @@ def _safe_serialize(value: Any, _stack: set[int] | None = None) -> Any:
     if value is None:
         return None
 
-    # Primitives - JSON safe (no need to track these)
-    if isinstance(value, (str, int, float, bool)):
+    # Primitives - JSON safe (no need to track these). Strings are scrubbed of
+    # jsonb-un-storable code points; numerics/bools can't carry any.
+    if isinstance(value, str):
+        return _strip_unstorable(value)
+    if isinstance(value, (int, float, bool)):
         return value
 
     # UUID
@@ -43,23 +91,27 @@ def _safe_serialize(value: Any, _stack: set[int] | None = None) -> Any:
     # Bytes
     if isinstance(value, bytes):
         try:
-            return value.decode("utf-8")
+            return _strip_unstorable(value.decode("utf-8"))
         except Exception:
             return f"<bytes: {len(value)} bytes>"
 
-    # Enums
+    # Enums — recurse so a string-backed member value is scrubbed (real enums
+    # like SpanType have clean values, so this is a no-op for them; it only
+    # strips a pathological NUL/lone-surrogate value).
     if isinstance(value, Enum):
-        return value.value
+        return _safe_serialize(value.value, _stack)
 
-    # Types/classes (like SignatureMeta)
+    # Types/classes (like SignatureMeta). repr() of a class is whatever its
+    # metaclass says — DSPy's interpolates the signature's instructions and field
+    # metadata — so it is captured text, not a bounded label.
     if isinstance(value, type):
-        return repr(value)
+        return _strip_unstorable(repr(value))
 
     # For compound types, check for cycles using object identity
     obj_id = id(value)
     if obj_id in _stack:
         # True cycle detected - we're currently serializing this object
-        return f"<circular ref: {type(value).__name__}>"
+        return f"<circular ref: {_type_name(value)}>"
 
     # Add to stack before recursing into compound types
     _stack.add(obj_id)
@@ -73,9 +125,9 @@ def _safe_serialize(value: Any, _stack: set[int] | None = None) -> Any:
         if isinstance(value, (list, tuple)):
             return [_safe_serialize(v, _stack) for v in value]
 
-        # Dicts
+        # Dicts (keys become jsonb object keys, so scrub them too)
         if isinstance(value, dict):
-            return {str(k): _safe_serialize(v, _stack) for k, v in value.items()}
+            return {_strip_unstorable(str(k)): _safe_serialize(v, _stack) for k, v in value.items()}
 
         # DSPy Prediction and similar - has toDict method
         if hasattr(value, "toDict") and callable(value.toDict):
@@ -107,12 +159,17 @@ def _safe_serialize(value: Any, _stack: set[int] | None = None) -> Any:
             except Exception:
                 pass
 
-        # Objects with __dict__ (general objects, custom classes)
+        # Objects with __dict__ (general objects, custom classes). Attribute
+        # names become jsonb object keys, so scrub them like dict keys.
         if hasattr(value, "__dict__"):
             try:
-                obj_dict = {k: _safe_serialize(v, _stack) for k, v in value.__dict__.items() if not k.startswith("_")}
+                obj_dict = {
+                    _strip_unstorable(k): _safe_serialize(v, _stack)
+                    for k, v in value.__dict__.items()
+                    if not k.startswith("_")
+                }
                 # Add type info for clarity
-                obj_dict["__type__"] = type(value).__name__
+                obj_dict["__type__"] = _type_name(value)
                 return obj_dict
             except Exception:
                 pass
@@ -123,17 +180,17 @@ def _safe_serialize(value: Any, _stack: set[int] | None = None) -> Any:
                 obj_dict = {}
                 for slot in value.__slots__:  # pyright: ignore[reportAttributeAccessIssue]
                     if not slot.startswith("_") and hasattr(value, slot):
-                        obj_dict[slot] = _safe_serialize(getattr(value, slot), _stack)
-                obj_dict["__type__"] = type(value).__name__
+                        obj_dict[_strip_unstorable(slot)] = _safe_serialize(getattr(value, slot), _stack)
+                obj_dict["__type__"] = _type_name(value)
                 return obj_dict
             except Exception:
                 pass
 
         # Final fallback - convert to string
         try:
-            return str(value)
+            return _strip_unstorable(str(value))
         except Exception:
-            return f"<unserializable: {type(value).__name__}>"
+            return f"<unserializable: {_type_name(value)}>"
 
     finally:
         # Remove from stack after we're done serializing this object
@@ -455,7 +512,13 @@ class SpanBuilder:
         )
 
     def _build_attributes(self) -> dict[str, str]:
-        """Build attributes dict, injecting repl_history if present."""
+        """Build attributes dict, injecting repl_history if present.
+
+        The nested JSON rides as an attribute *value*, so it reaches the wire
+        through the same scrub as every other attribute string (``to_api_dict``
+        passes the result to ``_safe_serialize``) — the jsonb-storability of the
+        column does not rest on ``json.dumps``' ``ensure_ascii`` escaping here.
+        """
         attrs = dict(self.attributes)
         if self.repl_history:
             attrs["repl_history"] = json.dumps(self.repl_history)
@@ -472,7 +535,7 @@ class SpanBuilder:
             "start_time": self.start_time.isoformat() if self.start_time else None,
             "end_time": self.end_time.isoformat() if self.end_time else None,
             "status": self.status.value,
-            "error_message": self.error_message,
+            "error_message": _strip_unstorable_opt(self.error_message),
             "error_type": self.error_type,
             "signature_name": self.signature_name,
             "signature_instructions": self.signature_instructions,
@@ -577,7 +640,7 @@ class TraceBuilder:
             "start_time": self.start_time.isoformat() if self.start_time else None,
             "end_time": self.end_time.isoformat() if self.end_time else None,
             "status": self.status.value,
-            "error_message": self.error_message,
+            "error_message": _strip_unstorable_opt(self.error_message),
             "program_name": self.program_name,
             "program_version": self.program_version,
             "signature_name": self.signature_name,
@@ -589,7 +652,11 @@ class TraceBuilder:
             "signature_output_field_schemas": self.signature_output_field_schemas,
             "program_signature_hash": identity.format_signature_hash(self.program_signature_hash),
             "signature_summary": self.signature_summary,
-            "component_signatures": self.component_signatures,
+            # The server forwards this blob verbatim into a jsonb column, and its
+            # program registration is best-effort (a rejection is only logged), so
+            # an un-storable code point here would silently lose the whole
+            # component list. Scrub at the source — the only place that can.
+            "component_signatures": _safe_serialize(self.component_signatures),
             "compiled_from_run_id": self.compiled_from_run_id,
             "demo_ids": self.demo_ids,
             "request_preview": (self.request_preview or "")[:500],
@@ -597,8 +664,8 @@ class TraceBuilder:
             "eval_run_id": str(self.eval_run_id) if self.eval_run_id else None,
             "optimization_run_id": (str(self.optimization_run_id) if self.optimization_run_id else None),
             "adapter_type": self.adapter_type,
-            "tags": self.tags,
-            "metadata": self.metadata,
+            "tags": _safe_serialize(self.tags),
+            "metadata": _safe_serialize(self.metadata),
             "project": self.project_tags[0] if self.project_tags else None,
             "project_tags": self.project_tags if self.project_tags else [],
             "spans": [s.to_api_dict() for s in self._batch_spans] if self._batch_spans else [],
@@ -617,7 +684,7 @@ class TraceBuilder:
             "signature_output_field_types": self.signature_output_field_types,
             "program_signature_hash": identity.format_signature_hash(self.program_signature_hash),
             "signature_summary": self.signature_summary,
-            "component_signatures": self.component_signatures,
+            "component_signatures": _safe_serialize(self.component_signatures),
             "root_span_type": self.root_span_type,
             "project": self.project_tags[0] if self.project_tags else None,
             "project_tags": self.project_tags if self.project_tags else [],
@@ -629,7 +696,7 @@ class TraceBuilder:
             "start_time": self.start_time.isoformat() if self.start_time else None,
             "end_time": self.end_time.isoformat() if self.end_time else None,
             "status": self.status.value,
-            "error_message": self.error_message,
+            "error_message": _strip_unstorable_opt(self.error_message),
             "request_preview": (self.request_preview or "")[:500],
             "response_preview": (self.response_preview or "")[:500],
             "total_tokens": self.total_tokens,
@@ -642,8 +709,8 @@ class TraceBuilder:
             "demo_ids": self.demo_ids,
             "eval_run_id": str(self.eval_run_id) if self.eval_run_id else None,
             "optimization_run_id": (str(self.optimization_run_id) if self.optimization_run_id else None),
-            "tags": self.tags,
-            "metadata": self.metadata,
+            "tags": _safe_serialize(self.tags),
+            "metadata": _safe_serialize(self.metadata),
             "project": self.project_tags[0] if self.project_tags else None,
             "project_tags": self.project_tags if self.project_tags else [],
         }
@@ -757,7 +824,7 @@ class EvalExampleBuilder:
             "total_tokens": self.total_tokens,
             "cost": self.cost,
             "status": self.status.value,
-            "error_message": self.error_message,
+            "error_message": _strip_unstorable_opt(self.error_message),
         }
 
 
@@ -922,7 +989,7 @@ class EvalRunBuilder:
             "end_time": self.end_time.isoformat() if self.end_time else None,
             "duration_ms": self.duration_ms,
             "status": self.status.value,
-            "error_message": self.error_message,
+            "error_message": _strip_unstorable_opt(self.error_message),
             "score": self.score,
             "total_examples": self.total_examples,
             "passed_examples": self.passed_examples,
@@ -935,8 +1002,8 @@ class EvalRunBuilder:
             "total_cost": self.total_cost,
             "avg_tokens_per_example": self.avg_tokens_per_example,
             "avg_cost_per_example": self.avg_cost_per_example,
-            "tags": self.tags,
-            "metadata": self.metadata,
+            "tags": _safe_serialize(self.tags),
+            "metadata": _safe_serialize(self.metadata),
             "examples": [ex.to_api_dict() for ex in self._examples],
             "optimization_run_id": (str(self.optimization_run_id) if self.optimization_run_id else None),
             "project": self.project_tags[0] if self.project_tags else None,

{cmpnd-0.8.1 → cmpnd-0.8.2}/cmpnd/optimizers/gepa_callback.py

@@ -12,13 +12,12 @@ Usage:
 
 from __future__ import annotations
 
-import json
 import logging
 import time
 from typing import Any
 from uuid import UUID
 
-from .. import context
+from .. import context, models
 from . import tracker
 
 logger = logging.getLogger(__name__)
@@ -191,8 +190,10 @@ class CmpndGEPACallback:
             components = event.get("components", [])
             dataset = event.get("dataset", {})
 
-            # Deep copy to avoid mutation (matches tracker.py pattern)
-            dataset_copy = json.loads(json.dumps(dataset, default=str))
+            # Deep copy to avoid mutation (matches tracker.py pattern), and the
+            # copy is jsonb-storable: the dataset is raw captured LM text bound
+            # for a jsonb column.
+            dataset_copy = models._safe_serialize(dataset)
 
             self._tracker.capture_reflective_dataset(
                 iteration=iteration,

{cmpnd-0.8.1 → cmpnd-0.8.2}/cmpnd/optimizers/tracker.py

@@ -11,7 +11,7 @@ from datetime import datetime, timezone
 from typing import Any
 from uuid import UUID
 
-from .. import configuration, identity
+from .. import configuration, identity, models
 
 logger = logging.getLogger(__name__)
 
@@ -45,6 +45,13 @@ def _sanitize_for_json(obj: Any) -> Any:
     """Recursively sanitize an object for JSON serialization.
 
     Handles numpy types, datetimes, UUIDs, and other common non-serializable types.
+
+    Every string this produces — value, dict key, or stringified fallback — is
+    scrubbed of code points a Postgres jsonb column cannot store, because the
+    fields it feeds (reflective datasets, instructions, run config, compiled
+    program state) are jsonb columns holding raw captured LM text and user
+    datasets. It shares ``models._strip_unstorable`` with the trace path rather
+    than re-deriving the rule.
     """
     if obj is None:
         return None
@@ -62,22 +69,24 @@ def _sanitize_for_json(obj: Any) -> Any:
         if "bool" in obj_type.lower():
             return bool(obj)
         if "str" in obj_type.lower():
-            return str(obj)
+            return models._strip_unstorable(str(obj))
         # numpy arrays
         if hasattr(obj, "tolist"):
             return _sanitize_for_json(obj.tolist())
         # Fallback for other numpy types
-        return str(obj)
+        return models._strip_unstorable(str(obj))
 
     # Handle standard types
-    if isinstance(obj, (str, int, float, bool)):
+    if isinstance(obj, str):
+        return models._strip_unstorable(obj)
+    if isinstance(obj, (int, float, bool)):
         return obj
     if isinstance(obj, (datetime,)):
         return obj.isoformat()
     if isinstance(obj, UUID):
         return str(obj)
     if isinstance(obj, dict):
-        return {str(k): _sanitize_for_json(v) for k, v in obj.items()}
+        return {models._strip_unstorable(str(k)): _sanitize_for_json(v) for k, v in obj.items()}
     if isinstance(obj, (list, tuple)):
         return [_sanitize_for_json(item) for item in obj]
     if isinstance(obj, set):
@@ -85,7 +94,7 @@ def _sanitize_for_json(obj: Any) -> Any:
 
     # For unknown types, try to convert to string
     try:
-        return str(obj)
+        return models._strip_unstorable(str(obj))
     except Exception:
         return None
 
@@ -414,8 +423,11 @@ class OptimizationTracker:
         Called when DspyAdapter.make_reflective_dataset() completes.
         """
         if self._current_iteration and self._current_iteration.iteration == iteration:
-            # Deep copy to avoid mutation
-            self._current_iteration.reflective_dataset = json.loads(json.dumps(dataset, default=str))
+            # Deep copy to avoid mutation, via the serializer the trace path
+            # uses: it detaches the structure as a json round-trip does, keeps the
+            # jsonb-un-storable code points out of what we hold (this is raw
+            # captured LM text), and needs no encode/decode pass to do it.
+            self._current_iteration.reflective_dataset = models._safe_serialize(dataset)
             self._current_iteration.components_updated = components
 
             # Count examples

{cmpnd-0.8.1 → cmpnd-0.8.2}/docs/sdk-instrumentation.md

@@ -261,6 +261,22 @@ Dict handling: **value-aware allocation** keeps every key (small values whole, t
 
 This structural form replaced an older flat `{_truncated, _size, _preview}` envelope that sliced the serialized string mid-object; serve's JSON inspector renders these envelopes as a legible warn band over the surviving tree (`serve/internal/web/views/format.go` + `traces.templ`).
 
+## Storability: what the SDK guarantees about the payloads it emits
+
+U+0000 and lone UTF-16 surrogates are valid JSON, and valid in a Python `str`, but the server can store neither: a `jsonb` column rejects both, and a NUL is rejected by a plain `text` column too (it is valid UTF-8, but PostgreSQL `text` cannot hold it). Captured LM text can legitimately carry either, and so can the text of an exception quoting that data. The SDK is the producer, so it strips them rather than shipping a payload the server has to reject: `_strip_unstorable` in `python-sdk/cmpnd/models.py` is the single rule, `_safe_serialize` is the chokepoint that applies it to values, dict keys, object attribute names, class reprs and every stringified fallback, and `_strip_unstorable_opt` covers the top-level optional strings that never pass through `_safe_serialize`.
+
+"Chokepoint" is a property of the callers, so it holds only as long as **every payload field bound for a `jsonb` or `text` column goes through it**. The ones that do, beyond span `inputs`/`outputs`/`attributes`/`events`:
+
+- `error_message` on spans, traces, eval runs and eval examples — a plain string on the wire bound for a `text` column, so it is scrubbed at each `to_api_dict`/`to_finalize_dict` rather than by `_safe_serialize`. It is the field most likely to carry one, since it is `str(exception)` and an exception message routinely quotes the captured data the code point came from. `None` is preserved, so "no error" stays distinct from an empty message;
+
+- trace `tags`, `metadata`, and `component_signatures` (the last is forwarded verbatim by the server, whose program registration is best-effort — a rejection there is only logged, so the SDK is the only place it can be prevented);
+- the optimizer tracker's own serializer, `_sanitize_for_json` in `python-sdk/cmpnd/optimizers/tracker.py`, which feeds reflective datasets, parent/proposed instructions, candidate instructions and val scores, run config, and the compiled program state;
+- the reflective-dataset capture boundary in that tracker and in `optimizers/gepa_callback.py`, which deep-copy through `_safe_serialize` so what the tracker holds is already storable;
+- dataset example `inputs`/`expected_outputs` (`dataset_sync.build_dataset_payload`) — the per-example `example_hash` stays derived from the example **as given**, since it keys dataset dedup and the per-run split-membership join;
+- the `deploy(metadata=...)` blob (`deployment._prepare_deploy_metadata`, which validates and scrubs in one step).
+
+A new hand-rolled serializer on any of those paths reopens the hole. `tests/test_models.py` pins the invariant end to end — asserting on the decoded wire body, not on the raw escape text, so a nested JSON document (`repl_history`) isn't mistaken for a violation.
+
 ---
 
 ## See also

{cmpnd-0.8.1 → cmpnd-0.8.2}/pyproject.toml

@@ -5,7 +5,7 @@ name = "cmpnd"
 # it's new) — no git tags. Bump with `uv version --bump {minor,patch}` or by
 # hand. Runtime `cmpnd.__version__` reads installed metadata, so it tracks
 # this automatically. See docs/plans/2026-07-02-sdk-pypi-tag-free-publish.md.
-version = "0.8.1"
+version = "0.8.2"
 description = "DSPy observability and deployment SDK for cmpnd"
 readme = "README.md"
 requires-python = ">=3.10"

{cmpnd-0.8.1 → cmpnd-0.8.2}/tests/test_deploy.py

@@ -151,21 +151,37 @@ class TestDeploy:
         body = client.post.call_args_list[0].kwargs["json"]
         assert "metadata" not in body
 
+    def test_metadata_scrubbed_of_unstorable_code_points(self, mock_httpx):
+        # The blob lands in a jsonb column, which cannot hold U+0000 or a lone
+        # surrogate — so a caller's checkpoint label carrying one must not turn
+        # the whole deploy into a server rejection. Built with chr(...) so the
+        # code points are real rather than escape text.
+        client = self._setup_mocks(mock_httpx)
+        with mock.patch.object(deployment, "time") as mock_time:
+            mock_time.time.side_effect = [0, 0, 2]
+            mock_time.sleep = mock.MagicMock()
+            deployment.deploy(
+                dspy.Predict("question -> answer"),
+                metadata={"ckpt" + chr(0): "step" + chr(0xD800), "step": 7},
+            )
+        body = client.post.call_args_list[0].kwargs["json"]
+        assert body["metadata"] == {"ckpt": "step", "step": 7}
+
     def test_metadata_rejects_non_dict(self):
         with pytest.raises(TypeError):
-            deployment._validate_deploy_metadata([1, 2, 3])
+            deployment._prepare_deploy_metadata([1, 2, 3])
 
     def test_metadata_rejects_non_string_keys(self):
         with pytest.raises(TypeError):
-            deployment._validate_deploy_metadata({1: "a"})
+            deployment._prepare_deploy_metadata({1: "a"})
 
     def test_metadata_rejects_non_serializable(self):
         with pytest.raises(TypeError):
-            deployment._validate_deploy_metadata({"f": object()})
+            deployment._prepare_deploy_metadata({"f": object()})
 
     def test_metadata_rejects_oversized(self):
         with pytest.raises(ValueError):
-            deployment._validate_deploy_metadata({"blob": "x" * (64 * 1024)})
+            deployment._prepare_deploy_metadata({"blob": "x" * (64 * 1024)})
 
     def test_polls_until_ready(self, mock_httpx):
         client = self._setup_mocks(