metergraph 0.6.6__tar.gz → 0.6.7__tar.gz

{metergraph-0.6.6/src/metergraph.egg-info → metergraph-0.6.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: metergraph
-Version: 0.6.6
+Version: 0.6.7
 Summary: Fire-and-forget LLM spend capture for Metergraph
 Author: Pioneer Square Labs
 License-Expression: Apache-2.0

{metergraph-0.6.6 → metergraph-0.6.7}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "metergraph"
-version = "0.6.6"
+version = "0.6.7"
 description = "Fire-and-forget LLM spend capture for Metergraph"
 readme = "README.md"
 requires-python = ">=3.10"

{metergraph-0.6.6 → metergraph-0.6.7}/src/metergraph/_capture.py

@@ -20,7 +20,7 @@ from urllib.parse import urlsplit
 
 from ._context import CaptureContext, snapshot
 from ._gateway import detect_gateway, gateway_evidence, resolve_gateway
-from ._template import scrub, template_hash
+from ._template import json_value, scrub_request, template_hash
 from ._version import SDK_VERSION
 
 
@@ -330,29 +330,34 @@ def _request_id(response: Any) -> str | None:
 def _response_content(response: Any, aggregate_text: str | None = None) -> Any:
     if aggregate_text is not None:
         return aggregate_text
-    direct = _get(response, "output_text") or _get(response, "text")
-    if direct is not None:
-        return scrub(direct)
+    # Only a non-empty string is reply text. On an OpenAI Responses object
+    # `text` is the text *config*, and a function-call-only reply lives in
+    # `output`.
+    direct = _get(response, "output_text")
+    if not isinstance(direct, str) or not direct:
+        direct = _get(response, "text")
+    if isinstance(direct, str):
+        return direct
     choice = _first(_get(response, "choices"))
     message = _get(choice, "message")
     content = _get(message, "content")
     if content is not None:
-        return scrub(content)
+        return json_value(content)
     parsed = _get(message, "parsed")
     if parsed is not None:
-        return scrub(parsed)
+        return json_value(parsed)
     normalized_text = _response_text(response)
     if normalized_text is not None:
         return normalized_text
     blocks = _get(response, "content")
     if blocks is not None:
-        return scrub(blocks)
+        return json_value(blocks)
     outputs = _get(response, "output")
     if outputs is not None:
-        return scrub(outputs)
+        return json_value(outputs)
     candidates = _get(response, "candidates")
     if candidates is not None:
-        return scrub(candidates)
+        return json_value(candidates)
     return None
 
 
@@ -402,7 +407,7 @@ def _tool_argument(value: Any) -> Any:
             return json.loads(value)
         except json.JSONDecodeError:
             return value
-    return scrub(value)
+    return json_value(value)
 
 
 def _tool_policies(request: Mapping[str, Any]) -> dict[str, str]:
@@ -591,7 +596,7 @@ def _tool_events(
             block = _get(chunk, "content_block")
             if _get(block, "type") == "tool_use":
                 key = str(_get(chunk, "index", len(anthropic_deltas)))
-                initial_input = scrub(_get(block, "input", {}))
+                initial_input = json_value(_get(block, "input", {}))
                 anthropic_deltas[key] = {
                     "id": str(_get(block, "id") or key),
                     "name": str(_get(block, "name") or ""),
@@ -769,7 +774,7 @@ class CallState:
             if self.context.capture_text is not None
             else self.runtime.options.capture_text
         )
-        request_clean = scrub(self.request)
+        request_clean = scrub_request(self.request)
         request_json, request_truncated = self.runtime._text(
             json.dumps(request_clean, separators=(",", ":"), default=repr),
             "request",

metergraph-0.6.7/src/metergraph/_template.py

@@ -0,0 +1,149 @@
+"""Stable, privacy-conscious request fingerprinting for untagged traffic."""
+
+from __future__ import annotations
+
+import dataclasses
+import hashlib
+import json
+import re
+from collections.abc import Mapping, Sequence
+from typing import Any
+
+
+_UUID = re.compile(r"\b[0-9a-f]{8}-[0-9a-f-]{27,}\b", re.I)
+_EMAIL = re.compile(r"\b[^\s@]+@[^\s@]+\.[^\s@]+\b")
+_URL = re.compile(r"\bhttps?://\S+")
+_NUMBER = re.compile(r"(?<![A-Za-z])[-+]?\d+(?:\.\d+)?(?![A-Za-z])")
+_LONG_TOKEN = re.compile(r"\b[A-Za-z0-9_-]{24,}\b")
+_SENSITIVE_KEYS = {
+    "api-key",
+    "api_key",
+    "apikey",
+    "authorization",
+    "client_secret",
+    "cookie",
+    "headers",
+    "id_token",
+    "password",
+    "proxy-authorization",
+    "refresh_token",
+    "secret",
+    "set-cookie",
+    "token",
+    "x-api-key",
+}
+
+
+def _normalize_text(value: str) -> str:
+    value = _UUID.sub("<uuid>", value)
+    value = _EMAIL.sub("<email>", value)
+    value = _URL.sub("<url>", value)
+    value = _LONG_TOKEN.sub("<token>", value)
+    value = _NUMBER.sub("<n>", value)
+    return " ".join(value.split())
+
+
+# Header and query containers carry transport credentials and nothing analysis
+# reads, so they are dropped whole. Keys compare lower-cased, so camelCase
+# client options match.
+_TRANSPORT_CONTAINERS = {
+    "default_headers",
+    "default_query",
+    "defaultheaders",
+    "defaultquery",
+    "extra_headers",
+    "extra_query",
+    "extraheaders",
+    "extraquery",
+    "headers",
+    "query",
+}
+
+
+def json_value(value: Any) -> Any:
+    """`value` as plain JSON data, with nothing removed."""
+    model_dump = getattr(value, "model_dump", None)
+    if callable(model_dump):
+        try:
+            return json_value(model_dump(mode="json", exclude_none=True))
+        except Exception:
+            pass
+        # The Python-mode dump keeps the structure analysis reads; only the
+        # values JSON cannot hold fall back to text.
+        try:
+            return json_value(model_dump(exclude_none=True))
+        except Exception:
+            return repr(value)
+    if dataclasses.is_dataclass(value) and not isinstance(value, type):
+        return json_value({
+            field.name: getattr(value, field.name)
+            for field in dataclasses.fields(value)
+            if getattr(value, field.name) is not None
+        })
+    if isinstance(value, Mapping):
+        return {str(k): json_value(v) for k, v in value.items()}
+    if isinstance(value, Sequence) and not isinstance(value, (str, bytes, bytearray)):
+        return [json_value(item) for item in value]
+    if isinstance(value, str):
+        return value
+    if isinstance(value, (int, float, bool)) or value is None:
+        return value
+    return repr(value)
+
+
+def _credential_key(key: str) -> bool:
+    key = key.strip().lower()
+    return key in _SENSITIVE_KEYS or key in _TRANSPORT_CONTAINERS
+
+
+def scrub_request(request: Any) -> Any:
+    """The provider request as captured: JSON data without its credentials.
+
+    Credentials travel as request-level parameters and in header or query
+    containers. `extra_body` is merged into the request body, so its keys are
+    request-level too. Messages, tools and schemas are kept exactly as sent,
+    even where a name matches a credential's (a tool parameter called `token`),
+    because they are the request analysis replays.
+    """
+    value = json_value(request)
+    if not isinstance(value, Mapping):
+        return value
+    clean = {k: v for k, v in value.items() if not _credential_key(k)}
+    extra_body = clean.get("extra_body")
+    if isinstance(extra_body, Mapping):
+        clean["extra_body"] = {
+            k: v for k, v in extra_body.items() if not _credential_key(k)
+        }
+    return clean
+
+
+def _without_credential_names(value: Any) -> Any:
+    if isinstance(value, Mapping):
+        return {
+            k: _without_credential_names(v)
+            for k, v in value.items()
+            if k.strip().lower() not in _SENSITIVE_KEYS
+        }
+    if isinstance(value, list):
+        return [_without_credential_names(item) for item in value]
+    return value
+
+
+def template_hash(request: Mapping[str, Any]) -> str:
+    def skeleton(value: Any) -> Any:
+        if isinstance(value, Mapping):
+            return {str(k): skeleton(v) for k, v in sorted(value.items())}
+        if isinstance(value, list):
+            return [skeleton(item) for item in value]
+        if isinstance(value, str):
+            return _normalize_text(value)
+        return value
+
+    # Credential names are left out at every depth. This hash routes unnamed
+    # workloads, so its input must stay stable across SDK versions.
+    encoded = json.dumps(
+        skeleton(_without_credential_names(json_value(request))),
+        sort_keys=True,
+        separators=(",", ":"),
+    )
+    return hashlib.sha256(encoded.encode()).hexdigest()

{metergraph-0.6.6 → metergraph-0.6.7}/src/metergraph/_version.py

@@ -8,4 +8,4 @@ import importlib.metadata
 try:
     SDK_VERSION = importlib.metadata.version("metergraph")
 except Exception:
-    SDK_VERSION = "0.6.6"
+    SDK_VERSION = "0.6.7"

{metergraph-0.6.6 → metergraph-0.6.7/src/metergraph.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: metergraph
-Version: 0.6.6
+Version: 0.6.7
 Summary: Fire-and-forget LLM spend capture for Metergraph
 Author: Pioneer Square Labs
 License-Expression: Apache-2.0

metergraph-0.6.6/src/metergraph/_template.py

@@ -1,80 +0,0 @@
-"""Stable, privacy-conscious request fingerprinting for untagged traffic."""
-
-from __future__ import annotations
-
-import hashlib
-import json
-import re
-from collections.abc import Mapping, Sequence
-from typing import Any
-
-
-_UUID = re.compile(r"\b[0-9a-f]{8}-[0-9a-f-]{27,}\b", re.I)
-_EMAIL = re.compile(r"\b[^\s@]+@[^\s@]+\.[^\s@]+\b")
-_URL = re.compile(r"\bhttps?://\S+")
-_NUMBER = re.compile(r"(?<![A-Za-z])[-+]?\d+(?:\.\d+)?(?![A-Za-z])")
-_LONG_TOKEN = re.compile(r"\b[A-Za-z0-9_-]{24,}\b")
-_SENSITIVE_KEYS = {
-    "api-key",
-    "api_key",
-    "apikey",
-    "authorization",
-    "client_secret",
-    "cookie",
-    "headers",
-    "id_token",
-    "password",
-    "proxy-authorization",
-    "refresh_token",
-    "secret",
-    "set-cookie",
-    "token",
-    "x-api-key",
-}
-
-
-def _normalize_text(value: str) -> str:
-    value = _UUID.sub("<uuid>", value)
-    value = _EMAIL.sub("<email>", value)
-    value = _URL.sub("<url>", value)
-    value = _LONG_TOKEN.sub("<token>", value)
-    value = _NUMBER.sub("<n>", value)
-    return " ".join(value.split())
-
-
-def scrub(value: Any) -> Any:
-    model_dump = getattr(value, "model_dump", None)
-    if callable(model_dump):
-        try:
-            return scrub(model_dump(mode="json", exclude_none=True))
-        except Exception:
-            return repr(value)
-    if isinstance(value, Mapping):
-        return {
-            str(k): scrub(v)
-            for k, v in value.items()
-            if str(k).strip().lower() not in _SENSITIVE_KEYS
-        }
-    if isinstance(value, Sequence) and not isinstance(value, (str, bytes, bytearray)):
-        return [scrub(item) for item in value]
-    if isinstance(value, str):
-        return value
-    if isinstance(value, (int, float, bool)) or value is None:
-        return value
-    return repr(value)
-
-
-def template_hash(request: Mapping[str, Any]) -> str:
-    def skeleton(value: Any) -> Any:
-        if isinstance(value, Mapping):
-            return {str(k): skeleton(v) for k, v in sorted(value.items())}
-        if isinstance(value, list):
-            return [skeleton(item) for item in value]
-        if isinstance(value, str):
-            return _normalize_text(value)
-        return value
-
-    encoded = json.dumps(
-        skeleton(scrub(request)), sort_keys=True, separators=(",", ":")
-    )
-    return hashlib.sha256(encoded.encode()).hexdigest()