log-foundry 0.10.2.dev45__tar.gz → 0.10.2.dev47__tar.gz

{log_foundry-0.10.2.dev45 → log_foundry-0.10.2.dev47}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: log-foundry
-Version: 0.10.2.dev45
+Version: 0.10.2.dev47
 Summary: Generate logs for your console and JSON events for downstream consumption.
 License-Expression: MIT
 License-File: LICENSE
@@ -1127,7 +1127,15 @@ entries and `max_depth` levels. `datetime`, `UUID`, `Decimal`, `bytes` and frien
 strings; anything with no JSON form becomes `<unserializable: TypeName>` — the type name only,
 never a `repr`, so coercion can never leak a value the library was careful not to capture.
 
-Integers are the one case worth knowing about. They are passed through unchanged — an ID or an
+**Floats that are not finite are replaced.** `NaN`, `Infinity` and `-Infinity` are values Python
+produces readily — a division that underflowed, a ratio over an empty window — and `json.dumps`
+writes all three happily. RFC 8259 defines none of them, so a strict consumer (Fluent Bit, a
+Logstash `json` codec, Jackson behind Elasticsearch) rejects the **whole record**, with nothing on
+this side to see. Each becomes `<float: nan>`, `<float: inf>` or `<float: -inf>` — which one it
+was is kept, because that is the only information the field still carried. Ordinary floats,
+including `-0.0` and subnormals, pass through untouched.
+
+Integers are the other case worth knowing about. They are passed through unchanged — an ID or an
 amount stays a number, at full precision — but an integer too long to *render* is replaced by
 `<int: ~N digits>`. CPython refuses to convert an integer past `sys.get_int_max_str_digits()`
 decimal digits (**4300** by default) and raises, and `json.dumps` inherits that refusal, so with

{log_foundry-0.10.2.dev45 → log_foundry-0.10.2.dev47}/README.md

@@ -1091,7 +1091,15 @@ entries and `max_depth` levels. `datetime`, `UUID`, `Decimal`, `bytes` and frien
 strings; anything with no JSON form becomes `<unserializable: TypeName>` — the type name only,
 never a `repr`, so coercion can never leak a value the library was careful not to capture.
 
-Integers are the one case worth knowing about. They are passed through unchanged — an ID or an
+**Floats that are not finite are replaced.** `NaN`, `Infinity` and `-Infinity` are values Python
+produces readily — a division that underflowed, a ratio over an empty window — and `json.dumps`
+writes all three happily. RFC 8259 defines none of them, so a strict consumer (Fluent Bit, a
+Logstash `json` codec, Jackson behind Elasticsearch) rejects the **whole record**, with nothing on
+this side to see. Each becomes `<float: nan>`, `<float: inf>` or `<float: -inf>` — which one it
+was is kept, because that is the only information the field still carried. Ordinary floats,
+including `-0.0` and subnormals, pass through untouched.
+
+Integers are the other case worth knowing about. They are passed through unchanged — an ID or an
 amount stays a number, at full precision — but an integer too long to *render* is replaced by
 `<int: ~N digits>`. CPython refuses to convert an integer past `sys.get_int_max_str_digits()`
 decimal digits (**4300** by default) and raises, and `json.dumps` inherits that refusal, so with

{log_foundry-0.10.2.dev45 → log_foundry-0.10.2.dev47}/pyproject.toml

@@ -20,7 +20,7 @@ dependencies = [
 ]
 
 # Optional features. Install with: pip install log-foundry[aws]
-version = "0.10.2.dev45"
+version = "0.10.2.dev47"
 
 [project.optional-dependencies]
 aws = ["boto3>=1.43.61"]              # SQSSink, SNSSink, KinesisSink, FirehoseSink

{log_foundry-0.10.2.dev45 → log_foundry-0.10.2.dev47}/src/log_foundry/api.py

@@ -57,12 +57,21 @@ def _log(level: str, message: str, echo: bool, fields: dict[str, object]) -> Non
     sink that was written to. ``_ensure_sink`` is resolved first, so a sink that fails to
     *construct* arms nothing: there is nothing to close.
 
-    The orphan branch is the one that reaches the sink on the caller's own thread, with no
-    worker between them to absorb a failure, so the whole branch is guarded (SPEC-025
-    FR-003) — ``_ensure_sink`` constructs the sink on first use, so a sink that fails to
-    build raises here too. The in-span branch is deliberately left untouched, since it only
-    appends to a list. The echo runs after the emit, so a closed or redirected stream never
-    costs the event itself.
+    **Both branches are guarded.** The orphan branch reaches the sink on the caller's own
+    thread, with no worker between them to absorb a failure (SPEC-025 FR-003) — ``_ensure_sink``
+    constructs the sink on first use, so a sink that fails to build raises here too.
+
+    ~~The in-span branch is deliberately left untouched, since it only appends to a list.~~ —
+    struck (SPEC-021), and it is why that branch shipped unguarded: it does not *only* append.
+    It calls ``build_event``, which calls ``truncate_str``, which calls ``value.encode`` — so
+    ``info(some_exception)``, a slip ``mypy`` catches only at typed call sites, returned normally
+    on the orphan path and killed the caller's function inside a span. Worse than a crash: the
+    decorator's own handler then recorded the span ``status=error`` with an ``error.type`` of
+    ``AttributeError`` that the caller's code never raised — wrong data *and* a broken caller.
+    A guard that reads "this cannot fail" is a guard that stops being true when the code under
+    it changes, and this one had already stopped.
+
+    The echo runs after the emit, so a closed or redirected stream never costs the event itself.
 
     Args:
       level: The severity label to stamp on the event.
@@ -81,8 +90,11 @@ def _log(level: str, message: str, echo: bool, fields: dict[str, object]) -> Non
     span = context.current_span()
     event: dict[str, object] | None = None
     if span is not None:
-        event = build_event(span, level, message, fields=fields, baggage=baggage)
-        span.events.append(event)
+        try:
+            event = build_event(span, level, message, fields=fields, baggage=baggage)
+            span.events.append(event)
+        except Exception as exc:
+            _diag.absorbed("building an in-span log", exc, "the event was lost")
     else:
         try:
             orphan = Span(

{log_foundry-0.10.2.dev45 → log_foundry-0.10.2.dev47}/src/log_foundry/sanitize.py

@@ -7,6 +7,7 @@ from collections.abc import Iterable, Mapping, Sequence
 from datetime import date, datetime, time
 from decimal import Decimal
 from enum import Enum
+from math import isfinite
 from typing import TYPE_CHECKING, Any
 from uuid import UUID
 
@@ -25,8 +26,21 @@ _LOG10_2_NUM = 30103
 _LOG10_2_DEN = 100000
 
 _INT_LT = int.__lt__
+_FLOAT_REPR = float.__repr__
+"""``float.__repr__``, unbound, so a subclass cannot divert the placeholder's text.
 
-_PLAIN_SCALARS: frozenset[type] = frozenset({int, float, bool})
+The f-string form ``f"<float: {value}>"`` calls ``format(value, "")``, which is the value's own
+``__str__`` — so a ``float`` subclass chose what the library printed. Measured: a subclass whose
+``__str__`` names its source emitted ``<float: inf from probe-7 (token=sk-live-…)>`` into the event
+stream, and one returning two megabytes emitted all of it against a configured
+``max_value_bytes`` of 8192. Both are the disclosure arch §6 forbids and the ceiling this module
+exists to apply, defeated by the one new rule that handed the decision back to the value.
+
+The same reasoning as :data:`_INT_LT` beside it, and as ``_placeholder``'s refusal to use
+``repr()``: what the library writes about a value must be computed by the library.
+"""
+
+_PLAIN_SCALARS: frozenset[type] = frozenset({int, bool})
 
 _TEXTLIKE: tuple[type, ...] = (str, bytes, bytearray, memoryview)
 
@@ -222,6 +236,8 @@ class _Coercer:
             return self.text(value)  # type: ignore[arg-type]
         if kind is int:
             return self.integer(value)  # type: ignore[arg-type]
+        if kind is float:
+            return self.real(value)  # type: ignore[arg-type]
         if kind in _PLAIN_SCALARS:
             return value
         if kind is dict:
@@ -233,6 +249,8 @@ class _Coercer:
             member = value.value
             if type(member) is int:
                 return self.integer(member)
+            if isinstance(member, float) and not isinstance(member, bool):
+                return self.real(member)
             if type(member) in _PLAIN_SCALARS or member is None:
                 return member
             if isinstance(member, str):
@@ -243,7 +261,7 @@ class _Coercer:
         if isinstance(value, int):
             return self.integer(value)
         if isinstance(value, float):
-            return value
+            return self.real(value)
         if isinstance(value, (datetime, date, time)):
             return self.text(value.isoformat())
         if isinstance(value, UUID):
@@ -331,6 +349,12 @@ class _Coercer:
         a placeholder, so one hostile key would take every sibling with it, unmarked. ``bool``
         is excluded because ``True`` must render as the key ``"True"``, not ``"1"``.
 
+        A float key goes through :meth:`real` for the same reason, and its ``text()`` wrap is
+        defence in depth rather than load-bearing: ``real`` computes its placeholder through
+        :data:`_FLOAT_REPR`, so it cannot hand back a long string. No test distinguishes the wrap
+        from its absence, which is recorded here rather than pinned by an assertion that cannot
+        fail.
+
         Args:
           key: The mapping key, of any type.
 
@@ -345,6 +369,9 @@ class _Coercer:
         if isinstance(key, int) and not isinstance(key, bool):
             rendered = self.integer(key)
             return self.text(rendered if isinstance(rendered, str) else str(rendered))
+        if isinstance(key, float):
+            replaced = self.real(key)
+            return self.text(replaced if isinstance(replaced, str) else str(replaced))
         return self.text(str(key))
 
     def integer(self, value: int) -> object:
@@ -379,6 +406,35 @@ class _Coercer:
         self.truncated = True
         return f"<int: ~{digits} digits>"
 
+    def real(self, value: float) -> object:
+        """Replaces a non-finite float, since ``NaN`` and ``Infinity`` are not JSON.
+
+        ``json.dumps`` writes ``NaN``, ``Infinity`` and ``-Infinity`` happily, and RFC 8259
+        defines none of them: a strict consumer — Fluent Bit, a Logstash ``json`` codec, Jackson
+        behind Elasticsearch — rejects the whole record, with nothing on the library side to see.
+        That contradicts ``build_event``'s promise that an event is safe for any sink to
+        serialize (SPEC-017).
+
+        Replaced rather than coerced to ``None`` or ``0.0``, on SPEC-020's reasoning for the
+        over-long integer this mirrors: a wrong number is worse than a visibly elided one, and
+        the marker says which of the three it was. ``truncated`` is set for the same reason it is
+        set everywhere else — a substitution nobody can see is a silent change to the data.
+
+        Args:
+          value: The float to check.
+
+        Returns:
+          The float itself when finite, or a ``<float: nan>`` / ``<float: inf>`` /
+          ``<float: -inf>`` placeholder naming which it was.
+
+        Raises:
+          None.
+        """
+        if isfinite(value):
+            return value
+        self.truncated = True
+        return f"<float: {_FLOAT_REPR(value)}>"
+
     def text(self, value: str) -> str:
         """Applies ``max_value_bytes`` to a string, recording whether it fired.