prompture 1.11.2.dev1__tar.gz → 1.11.2.dev2__tar.gz

{prompture-1.11.2.dev1 → prompture-1.11.2.dev2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: prompture
-Version: 1.11.2.dev1
+Version: 1.11.2.dev2
 Summary: Ask LLMs to return structured JSON and run cross-model tests. API-first.
 Author-email: Juan Denis <juan@vene.co>
 License-Expression: MIT

{prompture-1.11.2.dev1 → prompture-1.11.2.dev2}/prompture/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.11.2.dev1'
-__version_tuple__ = version_tuple = (1, 11, 2, 'dev1')
+__version__ = version = '1.11.2.dev2'
+__version_tuple__ = version_tuple = (1, 11, 2, 'dev2')
 
 __commit_id__ = commit_id = None

{prompture-1.11.2.dev1 → prompture-1.11.2.dev2}/prompture/execution/gates.py

@@ -42,7 +42,8 @@ __all__ = [
 class GateVerdict(str, Enum):
     """Outcome of one gate criterion."""
 
-    PASS = "pass"
+    # Evaluation verdict, not a credential.
+    PASS = "pass"  # nosec B105
     FAIL = "fail"
     UNKNOWN = "unknown"
 

{prompture-1.11.2.dev1 → prompture-1.11.2.dev2}/prompture/infra/token_counting.py

@@ -181,7 +181,8 @@ def _estimate(
 ) -> CostEstimate:
     context = {key: options[key] for key in ("service_tier", "inference_geo") if options and key in options}
     context.update(pricing_context)
-    return replace(
+    # token_counter labels the counting source; it never contains a credential.
+    return replace(  # nosec B106
         estimate_call_cost(
             count.model, count.input_tokens, expected_completion_tokens=expected_completion_tokens, **context
         ),

{prompture-1.11.2.dev1 → prompture-1.11.2.dev2}/prompture/infra/tracker.py

@@ -761,8 +761,10 @@ class UsageTracker:
             conn = self._connect()
             try:
                 # One grouped SQL query provides a consistent snapshot of all totals.
+                # _query_filters emits fixed column predicates; all filter values
+                # are bound separately in params, never interpolated into SQL.
                 rows = conn.execute(
-                    f"SELECT model_name, provider, COUNT(*) AS events, "
+                    f"SELECT model_name, provider, COUNT(*) AS events, "  # nosec B608
                     "SUM(prompt_tokens) AS prompt, SUM(completion_tokens) AS completion, "
                     "SUM(total_tokens) AS tokens, SUM(cost) AS cost, SUM(elapsed_ms) AS elapsed "
                     f"FROM usage_events WHERE {where} GROUP BY model_name, provider",
@@ -795,7 +797,9 @@ class UsageTracker:
         self.flush()
         conn = self._connect()
         try:
-            rows = conn.execute(f"SELECT * FROM usage_events WHERE {where}", params)
+            # Only static predicates from _query_filters enter the SQL string;
+            # caller-supplied filter values remain bound parameters.
+            rows = conn.execute(f"SELECT * FROM usage_events WHERE {where}", params)  # nosec B608
 
             def events_with_outcomes():
                 extraction_ids: set[str] = set()
@@ -815,8 +819,10 @@ class UsageTracker:
                 for offset in range(0, len(missing), 500):
                     batch = missing[offset : offset + 500]
                     placeholders = ",".join("?" for _ in batch)
+                    # Interpolation adds only generated '?' placeholders. The
+                    # extraction IDs are bound as batch, including untrusted IDs.
                     outcome_rows = conn.execute(
-                        "SELECT * FROM usage_events WHERE operation = 'extraction_outcome' "
+                        "SELECT * FROM usage_events WHERE operation = 'extraction_outcome' "  # nosec B608
                         f"AND json_extract(metadata, '$.extraction_id') IN ({placeholders})",
                         batch,
                     )

{prompture-1.11.2.dev1 → prompture-1.11.2.dev2}/prompture.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: prompture
-Version: 1.11.2.dev1
+Version: 1.11.2.dev2
 Summary: Ask LLMs to return structured JSON and run cross-model tests. API-first.
 Author-email: Juan Denis <juan@vene.co>
 License-Expression: MIT