legion-data 1.6.18 → 1.6.20

data/lib/legion/data/connection.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'legion/logging/helper'
+
 require 'fileutils'
 require 'sequel'
 
@@ -28,6 +30,8 @@ module Legion
       # Prefixes warn-level messages with [slow-query] since Sequel uses warn
       # for queries exceeding log_warn_duration.
       class SlowQueryLogger
+        attr_reader :tagged
+
         def initialize(tagged_logger)
           @tagged = tagged_logger
         end
@@ -49,9 +53,52 @@ module Legion
         end
       end
 
+      class SegmentedTaggedLogger
+        attr_reader :segments
+
+        def initialize(segments:, logger: nil)
+          @segments = segments
+          @logger = logger || Legion::Logging
+        end
+
+        def warn(message)
+          with_segments { dispatch(:warn, message) }
+        end
+
+        def info(message)
+          with_segments { dispatch(:info, message) }
+        end
+
+        def debug(message)
+          with_segments { dispatch(:debug, message) }
+        end
+
+        def error(message)
+          with_segments { dispatch(:error, message) }
+        end
+
+        private
+
+        def dispatch(level, message)
+          return unless @logger.respond_to?(level)
+
+          @logger.public_send(level, message)
+        end
+
+        def with_segments
+          previous = Thread.current[:legion_log_segments]
+          Thread.current[:legion_log_segments] = @segments
+          yield
+        ensure
+          Thread.current[:legion_log_segments] = previous
+        end
+      end
+
       # File-based query logger that writes all SQL to a dedicated log file.
       # Isolated from the main Legion::Logging domain.
       class QueryFileLogger
+        include Legion::Logging::Helper
+
         attr_reader :path
 
         def initialize(path)
@@ -90,12 +137,15 @@ module Legion
           @mutex.synchronize do
             @file.puts "[#{Time.now.strftime('%Y-%m-%d %H:%M:%S.%L')}] #{level} #{message}"
           end
-        rescue IOError
+        rescue IOError => e
+          handle_exception(e, level: :warn, handled: true, operation: :query_file_write, path: @path)
           nil
         end
       end
 
       class << self
+        include Legion::Logging::Helper
+
         attr_accessor :sequel
 
         def adapter
@@ -104,26 +154,23 @@ module Legion
 
         def setup
           opts = sequel_opts
+          log.info("Legion::Data::Connection setup adapter=#{adapter}")
           @sequel = if adapter == :sqlite
                       ::Sequel.connect(opts.merge(adapter: :sqlite, database: sqlite_path))
                     else
                       begin
-                        ::Sequel.connect(opts.merge(adapter: adapter, **creds_builder))
+                        ::Sequel.connect(connection_opts_for(adapter: adapter, opts: opts))
                       rescue StandardError => e
                         raise unless dev_fallback?
 
-                        if defined?(Legion::Logging)
-                          Legion::Logging.warn(
-                            "Shared DB unreachable (#{e.message}), dev_mode fallback to SQLite"
-                          )
-                        end
+                        handle_exception(e, level: :warn, handled: true, operation: :shared_connect, fallback: :sqlite)
                         @adapter = :sqlite
                         sqlite_opts = sequel_opts
                         ::Sequel.connect(sqlite_opts.merge(adapter: :sqlite, database: sqlite_path))
                       end
                     end
           Legion::Settings[:data][:connected] = true
-          log_connection_info if defined?(Legion::Logging)
+          log_connection_info
           configure_extensions
           connect_with_replicas
         end
@@ -140,6 +187,7 @@ module Legion
             database:  database_stats
           }
         rescue StandardError => e
+          handle_exception(e, level: :warn, handled: true, operation: :data_connection_stats, adapter: adapter)
           { connected: (data[:connected] if data.is_a?(Hash)), adapter: adapter, error: e.message }
         end
 
@@ -171,7 +219,8 @@ module Legion
           end
 
           stats.compact
-        rescue StandardError
+        rescue StandardError => e
+          handle_exception(e, level: :warn, handled: true, operation: :data_pool_stats, adapter: adapter)
           {}
         end
 
@@ -180,7 +229,7 @@ module Legion
           @query_file_logger&.close
           @query_file_logger = nil
           Legion::Settings[:data][:connected] = false
-          Legion::Logging.info 'Legion::Data connection closed' if defined?(Legion::Logging)
+          log.info 'Legion::Data connection closed'
         end
 
         def connect_with_replicas
@@ -202,7 +251,7 @@ module Legion
           end
 
           @replica_servers = replica_list.each_with_index.map { |_, idx| :"read_#{idx}" }
-          Legion::Logging.debug "Registered #{@replica_servers.size} read replica(s)" if defined?(Legion::Logging)
+          log.debug "Registered #{@replica_servers.size} read replica(s)"
         end
 
         def read_server
@@ -258,20 +307,20 @@ module Legion
 
           Legion::Settings[:data][:tls] || {}
         rescue StandardError => e
-          Legion::Logging.debug("Connection#data_tls_settings failed: #{e.message}") if defined?(Legion::Logging)
+          handle_exception(e, level: :warn, handled: true, operation: :data_tls_settings)
           {}
         end
 
         def log_connection_info
           if adapter == :sqlite
-            Legion::Logging.info "Connected to SQLite at #{sqlite_path}"
+            log.info "Connected to SQLite at #{sqlite_path}"
           else
             actual = Legion::Settings[:data][:creds] || {}
             user = actual[:user] || actual[:username] || 'unknown'
             host = actual[:host] || '127.0.0.1'
             port = actual[:port]
             db   = actual[:database] || actual[:db]
-            Legion::Logging.info "Connected to #{adapter}://#{user}@#{host}:#{port}/#{db}"
+            log.info "Connected to #{adapter}://#{user}@#{host}:#{port}/#{db}"
           end
         end
 
@@ -284,6 +333,12 @@ module Legion
           Legion::Settings[:data][:creds][:database] || 'legionio.db'
         end
 
+        def connection_opts_for(adapter:, opts:)
+          connection_opts = opts.merge(adapter: adapter, **creds_builder)
+          connection_opts[:preconnect] = false if adapter != :sqlite && dev_fallback?
+          connection_opts
+        end
+
         def sequel_opts
           data = Legion::Settings[:data]
           opts = {}
@@ -356,6 +411,7 @@ module Legion
           else {}
           end
         rescue StandardError => e
+          handle_exception(e, level: :warn, handled: true, operation: :data_database_stats, adapter: adapter)
           { error: e.message }
         end
 
@@ -366,7 +422,8 @@ module Legion
              cache_size busy_timeout].each do |pragma|
             val = begin
               db.fetch("PRAGMA #{pragma}").single_value
-            rescue StandardError
+            rescue StandardError => e
+              handle_exception(e, level: :warn, handled: true, operation: :sqlite_stats_pragma, pragma: pragma)
               nil
             end
             stats[pragma.to_sym] = val unless val.nil?
@@ -457,12 +514,26 @@ module Legion
             @sequel.pool.connection_expiration_timeout = data[:connection_expiration_timeout] || 14_400
           end
         rescue StandardError => e
-          Legion::Logging.warn "Failed to load connection extensions: #{e.message}" if defined?(Legion::Logging)
+          handle_exception(e, level: :warn, handled: true, operation: :configure_extensions, adapter: adapter)
         end
 
         def build_data_logger
-          tagged = Legion::Logging::Logger.new(lex: 'data')
+          tagged = if defined?(Legion::Logging::TaggedLogger) && respond_to?(:tagged_logger_settings, true)
+                     Legion::Logging::TaggedLogger.new(
+                       segments: %w[data connection],
+                       **send(:tagged_logger_settings)
+                     )
+                   else
+                     SegmentedTaggedLogger.new(segments: %w[data connection])
+                   end
           SlowQueryLogger.new(tagged)
+        rescue StandardError => e
+          if respond_to?(:handle_exception, true)
+            handle_exception(e, level: :warn, handled: true, operation: :build_data_logger)
+          else
+            log.warn("build_data_logger failed: #{e.class}: #{e.message}")
+          end
+          SlowQueryLogger.new(SegmentedTaggedLogger.new(segments: %w[data connection], logger: log))
         end
       end
     end

data/lib/legion/data/encryption/key_provider.rb

@@ -1,11 +1,14 @@
 # frozen_string_literal: true
 
+require 'legion/logging/helper'
 require 'openssl'
 
 module Legion
   module Data
     module Encryption
       class KeyProvider
+        include Legion::Logging::Helper
+
         def initialize(mode: :auto)
           @mode = mode
           @key_cache = {}
@@ -18,20 +21,24 @@ module Legion
 
         def clear_cache!
           @key_cache.clear
+          log.debug 'Cleared encryption key cache'
         end
 
         private
 
         def derive_key(tenant_id)
           if tenant_id && crypt_available?
-            Legion::Logging.debug "Deriving Vault key for tenant #{tenant_id}" if defined?(Legion::Logging)
+            log.debug "Deriving Vault key for tenant #{tenant_id}"
             Legion::Crypt::PartitionKeys.derive(tenant_id: tenant_id)
           elsif crypt_available?
             Legion::Crypt.default_encryption_key
           else
-            Legion::Logging.warn 'Legion::Crypt unavailable, falling back to dev encryption key' if defined?(Legion::Logging)
+            log.warn 'Legion::Crypt unavailable, falling back to dev encryption key'
             local_key
           end
+        rescue StandardError => e
+          handle_exception(e, level: :error, handled: false, operation: :derive_key, tenant_id: tenant_id)
+          raise
         end
 
         def crypt_available?

data/lib/legion/data/encryption/sequel_plugin.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require 'legion/logging/helper'
 require_relative 'cipher'
 require_relative 'key_provider'
 
@@ -7,6 +8,33 @@ module Legion
   module Data
     module Encryption
       module SequelPlugin
+        extend Legion::Logging::Helper
+
+        class << self
+          def aad_for(table_name:, primary_key:, column:)
+            "#{table_name}:#{primary_key || 0}:#{column}"
+          end
+
+          def decrypt_value(blob:, key:, table_name:, primary_key:, column:)
+            errors = []
+
+            aad_candidates(primary_key).each do |aad_primary_key|
+              aad = aad_for(table_name: table_name, primary_key: aad_primary_key, column: column)
+              return Legion::Data::Encryption::Cipher.decrypt(blob, key: key, aad: aad)
+            rescue OpenSSL::Cipher::CipherError, ArgumentError => e
+              errors << e
+            end
+
+            raise errors.last if errors.any?
+          end
+
+          private
+
+          def aad_candidates(primary_key)
+            [primary_key, 0].compact.uniq
+          end
+        end
+
         module ClassMethods
           def encrypted_columns
             @encrypted_columns ||= {}
@@ -20,28 +48,42 @@ module Legion
               raw = super()
               return nil if raw.nil?
 
-              provider = self.class.encryption_key_provider
-              tenant = col_scope == :tenant ? self[:tenant_id] : nil
-              key = provider.key_for(tenant_id: tenant)
-              aad = "#{self.class.table_name}:#{pk}:#{name}"
               begin
-                Legion::Data::Encryption::Cipher.decrypt(raw.b, key: key, aad: aad)
+                decrypt_encrypted_column(name, raw, key_scope: col_scope)
               rescue StandardError => e
-                Legion::Logging.warn "Decrypt failed for #{self.class.table_name}##{pk} column #{name}: #{e.message}" if defined?(Legion::Logging)
+                Legion::Data::Encryption::SequelPlugin.handle_exception(
+                  e,
+                  level:       :warn,
+                  handled:     false,
+                  operation:   :decrypt_column,
+                  table:       self.class.table_name,
+                  primary_key: pk,
+                  column:      name
+                )
                 raise
               end
             end
 
             define_method(:"#{name}=") do |value|
               if value.nil?
+                clear_pending_encrypted_column(name)
                 super(nil)
               else
-                provider = self.class.encryption_key_provider
-                tenant = col_scope == :tenant ? self[:tenant_id] : nil
-                key = provider.key_for(tenant_id: tenant)
-                aad = "#{self.class.table_name}:#{pk || 0}:#{name}"
-                encrypted = Legion::Data::Encryption::Cipher.encrypt(value.to_s, key: key, aad: aad)
-                super(Sequel.blob(encrypted))
+                begin
+                  remember_pending_encrypted_column(name, value, key_scope: col_scope) if new?
+                  super(encrypt_encrypted_column(name, value, key_scope: col_scope, primary_key: pk || 0))
+                rescue StandardError => e
+                  Legion::Data::Encryption::SequelPlugin.handle_exception(
+                    e,
+                    level:       :error,
+                    handled:     false,
+                    operation:   :encrypt_column,
+                    table:       self.class.table_name,
+                    primary_key: pk,
+                    column:      name
+                  )
+                  raise
+                end
               end
             end
           end
@@ -52,6 +94,78 @@ module Legion
         end
 
         module InstanceMethods
+          def after_create
+            super
+            reencrypt_pending_encrypted_columns
+          end
+
+          private
+
+          def decrypt_encrypted_column(column, raw, key_scope:)
+            provider = self.class.encryption_key_provider
+            tenant = key_scope == :tenant ? self[:tenant_id] : nil
+            key = provider.key_for(tenant_id: tenant)
+
+            Legion::Data::Encryption::SequelPlugin.decrypt_value(
+              blob:        raw.b,
+              key:         key,
+              table_name:  self.class.table_name,
+              primary_key: pk,
+              column:      column
+            )
+          end
+
+          def encrypt_encrypted_column(column, value, key_scope:, primary_key:)
+            provider = self.class.encryption_key_provider
+            tenant = key_scope == :tenant ? self[:tenant_id] : nil
+            key = provider.key_for(tenant_id: tenant)
+            aad = Legion::Data::Encryption::SequelPlugin.aad_for(
+              table_name:  self.class.table_name,
+              primary_key: primary_key,
+              column:      column
+            )
+            encrypted = Legion::Data::Encryption::Cipher.encrypt(value.to_s, key: key, aad: aad)
+            Sequel.blob(encrypted)
+          end
+
+          def pending_encrypted_columns
+            @pending_encrypted_columns ||= {}
+          end
+
+          def remember_pending_encrypted_column(column, value, key_scope:)
+            pending_encrypted_columns[column] = { key_scope: key_scope, value: value.to_s }
+          end
+
+          def clear_pending_encrypted_column(column)
+            pending_encrypted_columns.delete(column) if defined?(@pending_encrypted_columns)
+          end
+
+          def reencrypt_pending_encrypted_columns
+            return if pending_encrypted_columns.empty?
+
+            encrypted_values = pending_encrypted_columns.each_with_object({}) do |(column, config), updates|
+              updates[column] = encrypt_encrypted_column(
+                column,
+                config[:value],
+                key_scope:   config[:key_scope],
+                primary_key: pk
+              )
+            end
+
+            self.class.where(pk_hash).update(encrypted_values)
+            encrypted_values.each { |column, encrypted| values[column] = encrypted }
+            pending_encrypted_columns.clear
+          rescue StandardError => e
+            Legion::Data::Encryption::SequelPlugin.handle_exception(
+              e,
+              level:       :error,
+              handled:     false,
+              operation:   :reencrypt_pending_columns,
+              table:       self.class.table_name,
+              primary_key: pk
+            )
+            raise
+          end
         end
       end
     end

data/lib/legion/data/event_store.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require 'legion/logging/helper'
 require 'digest'
 
 module Legion
@@ -14,6 +15,8 @@ module Legion
       ].freeze
 
       class << self
+        include Legion::Logging::Helper
+
         def append(stream:, type:, data: {}, metadata: {})
           return { error: 'db unavailable' } unless db_ready?
 
@@ -29,7 +32,7 @@ module Legion
 
             data_json = Legion::JSON.dump(data)
             metadata_json = Legion::JSON.dump(metadata)
-            event_hash = compute_hash(stream, seq, type, data_json, prev_hash)
+            event_hash = compute_hash(stream, seq, type, data_json, metadata_json, prev_hash)
 
             conn[:governance_events].insert(
               stream_id:       stream,
@@ -42,7 +45,7 @@ module Legion
               created_at:      Time.now
             )
 
-            Legion::Logging.debug "EventStore append: stream=#{stream} type=#{type} seq=#{seq}" if defined?(Legion::Logging)
+            log.debug "EventStore append: stream=#{stream} type=#{type} seq=#{seq}"
             { stream: stream, sequence: seq, hash: event_hash }
           end
         end
@@ -72,27 +75,43 @@ module Legion
                                .all
 
           prev_hash = '0' * 64
+          legacy_hashes = 0
           events.each do |e|
-            expected = compute_hash(stream, e[:sequence_number], e[:event_type], e[:data_json], prev_hash)
-            unless e[:event_hash] == expected
-              Legion::Logging.warn "EventStore chain broken: stream=#{stream} seq=#{e[:sequence_number]}" if defined?(Legion::Logging)
+            expected = compute_hash(stream, e[:sequence_number], e[:event_type], e[:data_json], e[:metadata_json], prev_hash)
+            legacy_expected = legacy_compute_hash(stream, e[:sequence_number], e[:event_type], e[:data_json], prev_hash)
+
+            unless [expected, legacy_expected].include?(e[:event_hash])
+              log.warn "EventStore chain broken: stream=#{stream} seq=#{e[:sequence_number]}"
               return { valid: false, broken_at: e[:sequence_number] }
             end
             unless e[:previous_hash] == prev_hash
-              Legion::Logging.warn "EventStore chain broken: stream=#{stream} seq=#{e[:sequence_number]}" if defined?(Legion::Logging)
+              log.warn "EventStore chain broken: stream=#{stream} seq=#{e[:sequence_number]}"
               return { valid: false, broken_at: e[:sequence_number] }
             end
 
+            legacy_hashes += 1 if e[:event_hash] == legacy_expected && e[:event_hash] != expected
             prev_hash = e[:event_hash]
           end
 
-          { valid: true, length: events.size }
+          result = { valid: true, length: events.size }
+          result[:legacy_hashes] = legacy_hashes if legacy_hashes.positive?
+          result
         end
 
         private
 
-        def compute_hash(stream, seq, type, data_json, prev_hash)
-          Digest::SHA256.hexdigest("#{stream}:#{seq}:#{type}:#{data_json}:#{prev_hash}")
+        def compute_hash(stream, seq, type, data_json, metadata_json, prev_hash)
+          Digest::SHA256.hexdigest(
+            "#{stream}:#{seq}:#{type}:#{normalized_json(data_json)}:#{normalized_json(metadata_json)}:#{prev_hash}"
+          )
+        end
+
+        def legacy_compute_hash(stream, seq, type, data_json, prev_hash)
+          Digest::SHA256.hexdigest("#{stream}:#{seq}:#{type}:#{normalized_json(data_json)}:#{prev_hash}")
+        end
+
+        def normalized_json(json)
+          json || '{}'
         end
 
         def deserialize(event)
@@ -111,7 +130,7 @@ module Legion
         def db_ready?
           defined?(Legion::Data) && Legion::Data.connection&.table_exists?(:governance_events)
         rescue StandardError => e
-          Legion::Logging.debug("EventStore#db_ready? check failed: #{e.message}") if defined?(Legion::Logging)
+          handle_exception(e, level: :warn, handled: true, operation: :event_store_db_ready?)
           false
         end
       end

data/lib/legion/data/extract/handlers/base.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'legion/logging/helper'
+
 module Legion
   module Data
     module Extract
@@ -8,6 +10,8 @@ module Legion
           @registry = {}.freeze
 
           class << self
+            include Legion::Logging::Helper
+
             attr_reader :registry
 
             def inherited(subclass)
@@ -22,6 +26,7 @@ module Legion
             end
 
             def register(handler_class)
+              log.debug "Registered extract handler type=#{handler_class.type} class=#{handler_class.name}"
               @registry = @registry.merge(handler_class.type => handler_class).freeze
             end
 
@@ -47,7 +52,8 @@ module Legion
 
               require gem_name
               true
-            rescue LoadError
+            rescue LoadError => e
+              handle_exception(e, level: :debug, handled: true, operation: :extract_handler_available, handler: name, gem: gem_name)
               false
             end
           end

data/lib/legion/data/extract/handlers/csv.rb

@@ -17,6 +17,7 @@ module Legion
             text = table.map { |row| row.to_h.map { |k, v| "#{k}: #{v}" }.join(', ') }.join("\n")
             { text: text, metadata: { rows: table.size, columns: table.headers.size, headers: table.headers } }
           rescue StandardError => e
+            handle_exception(e, level: :warn, handled: true, operation: :extract_csv)
             { text: nil, error: e.message }
           end
         end

data/lib/legion/data/extract/handlers/docx.rb

@@ -16,9 +16,11 @@ module Legion
             paragraphs = doc.paragraphs.map(&:text).reject(&:empty?)
             text = paragraphs.join("\n\n")
             { text: text, metadata: { paragraphs: paragraphs.size } }
-          rescue LoadError
+          rescue LoadError => e
+            handle_exception(e, level: :warn, handled: true, operation: :extract_docx, gem: gem_name)
             { text: nil, error: :gem_not_installed, gem: gem_name }
           rescue StandardError => e
+            handle_exception(e, level: :warn, handled: true, operation: :extract_docx)
             { text: nil, error: e.message }
           end
         end

data/lib/legion/data/extract/handlers/html.rb

@@ -21,9 +21,11 @@ module Legion
             title = doc.at_css('title')&.text&.strip
             text = doc.text.gsub(/\s+/, ' ').strip
             { text: text, metadata: { title: title } }
-          rescue LoadError
+          rescue LoadError => e
+            handle_exception(e, level: :warn, handled: true, operation: :extract_html, gem: gem_name)
             { text: nil, error: :gem_not_installed, gem: gem_name }
           rescue StandardError => e
+            handle_exception(e, level: :warn, handled: true, operation: :extract_html)
             { text: nil, error: e.message }
           end
         end

data/lib/legion/data/extract/handlers/json.rb

@@ -17,6 +17,7 @@ module Legion
             text = ::JSON.pretty_generate(parsed)
             { text: text, metadata: { keys: parsed.is_a?(Hash) ? parsed.keys : nil } }
           rescue StandardError => e
+            handle_exception(e, level: :warn, handled: true, operation: :extract_json)
             { text: nil, error: e.message }
           end
         end

data/lib/legion/data/extract/handlers/jsonl.rb

@@ -17,6 +17,7 @@ module Legion
             text = lines.map { |l| l.is_a?(Hash) ? ::JSON.pretty_generate(l) : l }.join("\n---\n")
             { text: text, metadata: { lines: lines.size } }
           rescue StandardError => e
+            handle_exception(e, level: :warn, handled: true, operation: :extract_jsonl)
             { text: nil, error: e.message }
           end
         end

data/lib/legion/data/extract/handlers/markdown.rb

@@ -15,6 +15,7 @@ module Legion
             text = content.sub(/\A---\n.*?\n---\n/m, '')
             { text: text.strip, metadata: { bytes: content.bytesize, has_frontmatter: content != text } }
           rescue StandardError => e
+            handle_exception(e, level: :warn, handled: true, operation: :extract_markdown)
             { text: nil, error: e.message }
           end
         end

data/lib/legion/data/extract/handlers/pdf.rb

@@ -15,9 +15,11 @@ module Legion
             reader = ::PDF::Reader.new(source)
             text = reader.pages.map(&:text).join("\n\n")
             { text: text, metadata: { pages: reader.page_count, title: reader.info[:Title] } }
-          rescue LoadError
+          rescue LoadError => e
+            handle_exception(e, level: :warn, handled: true, operation: :extract_pdf, gem: gem_name)
             { text: nil, error: :gem_not_installed, gem: gem_name }
           rescue StandardError => e
+            handle_exception(e, level: :warn, handled: true, operation: :extract_pdf)
             { text: nil, error: e.message }
           end
         end

data/lib/legion/data/extract/handlers/pptx.rb

@@ -24,9 +24,11 @@ module Legion
             end
             text = slides.each_with_index.map { |s, i| "Slide #{i + 1}: #{s}" }.join("\n\n")
             { text: text, metadata: { slides: slides.size } }
-          rescue LoadError
+          rescue LoadError => e
+            handle_exception(e, level: :warn, handled: true, operation: :extract_pptx, gem: gem_name)
             { text: nil, error: :gem_not_installed, gem: 'rubyzip' }
           rescue StandardError => e
+            handle_exception(e, level: :warn, handled: true, operation: :extract_pptx)
             { text: nil, error: e.message }
           end
         end

data/lib/legion/data/extract/handlers/text.rb

@@ -13,6 +13,7 @@ module Legion
             content = source.respond_to?(:read) ? source.read : File.read(source.to_s)
             { text: content, metadata: { bytes: content.bytesize } }
           rescue StandardError => e
+            handle_exception(e, level: :warn, handled: true, operation: :extract_text)
             { text: nil, error: e.message }
           end
         end