l3io-wordpress-database 0.3.5__tar.gz → 0.3.6__tar.gz

{l3io_wordpress_database-0.3.5 → l3io_wordpress_database-0.3.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: l3io-wordpress-database
-Version: 0.3.5
+Version: 0.3.6
 Summary: Create and inspect WordPress MySQL databases and their users, idempotently.
 Project-URL: Homepage, https://github.com/LiquidLogicLabs/l3io-wordpress-database
 Project-URL: Source, https://github.com/LiquidLogicLabs/l3io-wordpress-database
@@ -27,7 +27,7 @@ Requires-Dist: structlog<27,>=26.1
 Provides-Extra: aws
 Requires-Dist: boto3<2,>=1.34; extra == 'aws'
 Provides-Extra: encryption
-Requires-Dist: l3io-age-passphrase<0.2,>=0.1.1; extra == 'encryption'
+Requires-Dist: l3io-age-passphrase<0.2,>=0.1.3; extra == 'encryption'
 Requires-Dist: pyrage<2,>=1.4; extra == 'encryption'
 Provides-Extra: wpconfig
 Requires-Dist: l3io-wordpress-config<0.2,>=0.1.2; extra == 'wpconfig'

{l3io_wordpress_database-0.3.5 → l3io_wordpress_database-0.3.6}/pyproject.toml

@@ -40,7 +40,7 @@ aws = ["boto3>=1.34,<2"]
 wpconfig = ["l3io-wordpress-config>=0.1.2,<0.2"]
 encryption = [
   "pyrage>=1.4,<2",
-  "l3io-age-passphrase>=0.1.1,<0.2",
+  "l3io-age-passphrase>=0.1.3,<0.2",
 ]
 
 # Mechanical enforcement of the family's uv version, matching l3io-wordpress-config.
@@ -58,7 +58,7 @@ required-version = "==0.11.6"
 # build that carries a VCS dependency. Delete this block once public PyPI (or
 # a documented default index) carries both.
 l3io-wordpress-config = { git = "https://github.com/LiquidLogicLabs/l3io-wordpress-config.git", tag = "v0.1.3" }
-l3io-age-passphrase = { git = "https://github.com/LiquidLogicLabs/l3io-age-passphrase.git", tag = "v0.1.1" }
+l3io-age-passphrase = { git = "https://github.com/LiquidLogicLabs/l3io-age-passphrase.git", tag = "v0.1.3" }
 
 [project.scripts]
 l3io-wordpress-database = "l3io.wp.database.cli:main"
@@ -83,10 +83,10 @@ dev = [
   # dependency on it.
   "packaging==26.3",
   # Span assertions need a real SDK; the package itself depends on the API only.
-  "opentelemetry-sdk==1.45.1",
+  "opentelemetry-sdk==1.45.2",
   # The encryption extra, also here because `uv run` prunes extras.
   "pyrage==1.4.0",
-  "l3io-age-passphrase>=0.1.1,<0.2",
+  "l3io-age-passphrase>=0.1.3,<0.2",
   # The optional extras are dev dependencies too, so a bare `uv run` can
   # exercise the code paths behind them. `uv run` syncs the default groups
   # only, which PRUNES extras -- without this, every `uv run` silently

{l3io_wordpress_database-0.3.5 → l3io_wordpress_database-0.3.6}/src/l3io/wp/database/__init__.py

@@ -53,6 +53,7 @@ from .errors import (
     TlsHandshakeError,
     TlsVerificationError,
     TransferError,
+    WorkFactorTooHighError,
 )
 from .facade import Database
 from .identifiers import (
@@ -155,6 +156,7 @@ __all__ = [
     "TransferError",
     "TransferResult",
     "Verdict",
+    "WorkFactorTooHighError",
     "WpConfigFile",
     "__version__",
     "check_drop_database",

{l3io_wordpress_database-0.3.5 → l3io_wordpress_database-0.3.6}/src/l3io/wp/database/_observe.py

@@ -136,11 +136,14 @@ def _complete(
     # must never raise here, because this runs inside the exception handlers.
     # The event name is structlog's first positional parameter, so it travels as a
     # keyword too; otherwise a caller field named "event" collides with it.
+    # Event names are stable snake_case tokens so consumers can group and alert
+    # on them; free-text prose belongs in ``message`` (Finding.message, etc.).
     verdict = fields.pop(VERDICT_KEY, None)
     if isinstance(verdict, Verdict):
         for finding in verdict.warnings:
             _log.warning(
-                event=finding.message,
+                event=str(finding.code),
+                message=finding.message,
                 code=str(finding.code),
                 operation=name,
                 database=connection.database,
@@ -148,7 +151,7 @@ def _complete(
     caller_fields = {k: v for k, v in fields.items() if k not in _STRUCTLOG_PARAMETERS}
     event: dict[str, object] = {
         **caller_fields,
-        "event": "operation complete",
+        "event": "operation_completed",
         "operation": name,
         "outcome": outcome,
         "duration_ms": round((time.monotonic() - started) * 1000, 1),

{l3io_wordpress_database-0.3.5 → l3io_wordpress_database-0.3.6}/src/l3io/wp/database/_passphrase.py

@@ -18,7 +18,13 @@ import subprocess
 import threading
 from typing import IO, Any, Literal
 
-from .errors import CorruptDumpError, DecryptionError, InvalidArgumentsError, MissingDependencyError
+from .errors import (
+    CorruptDumpError,
+    DecryptionError,
+    InvalidArgumentsError,
+    MissingDependencyError,
+    WorkFactorTooHighError,
+)
 
 BackendName = Literal["binder", "cli"]
 _ENV = "L3IO_AGE_PASSPHRASE_BACKEND"
@@ -121,6 +127,9 @@ def _binder_decrypt(reader: IO[bytes], writer: IO[bytes], passphrase: str) -> No
         if text == "Decryption failed":
             msg = "the passphrase cannot decrypt this dump"
             raise DecryptionError(msg) from exc
+        if "Excessive work parameter" in text:
+            msg = "the Archive's scrypt work factor exceeds this machine's limit"
+            raise WorkFactorTooHighError(msg) from exc
         msg = "the encrypted dump is damaged or not an age file"
         raise CorruptDumpError(msg) from exc
     except OSError as exc:
@@ -223,6 +232,9 @@ def _map_cli_failure(*, encrypt: bool, err: str, code: int) -> None:
         if "no identity matched" in lower or "incorrect" in lower or "wrong" in lower:
             msg = "the passphrase cannot decrypt this dump"
             raise DecryptionError(msg)
+        if "excessive work" in lower:
+            msg = "the Archive's scrypt work factor exceeds this machine's limit"
+            raise WorkFactorTooHighError(msg)
         if "failed to read header" in lower or "not an age" in lower or "parsing" in lower:
             msg = "the encrypted dump is damaged or not an age file"
             raise CorruptDumpError(msg)

{l3io_wordpress_database-0.3.5 → l3io_wordpress_database-0.3.6}/src/l3io/wp/database/credentials.py

@@ -138,7 +138,7 @@ class AwsSecretsManager:
         if not region:
             raise RegionNotKnownError
 
-        _log.debug("resolving secret", source=self.source, region=region)
+        _log.debug("resolving_secret", source=self.source, region=region)
         try:
             client = boto3.client("secretsmanager", region_name=region)
             payload: Any = client.get_secret_value(SecretId=self.secret_id)["SecretString"]

{l3io_wordpress_database-0.3.5 → l3io_wordpress_database-0.3.6}/src/l3io/wp/database/errors.py

@@ -182,5 +182,14 @@ class DecryptionError(DatabaseError):
     """None of the supplied identities or the passphrase can decrypt the source."""
 
 
+class WorkFactorTooHighError(DatabaseError):
+    """The Archive's scrypt work factor exceeds this machine's decrypt limit.
+
+    Distinct from :class:`CorruptDumpError`: the payload is intact, but this
+    host refuses the work (e.g. binder ``Excessive work parameter``). Never
+    names the passphrase.
+    """
+
+
 class CorruptDumpError(DatabaseError):
     """An encrypted source is truncated, damaged, or not an age file."""