billwright 0.2.0__tar.gz

billwright-0.2.0/.github/workflows/ci.yml

@@ -0,0 +1,135 @@
+name: CI
+
+# Runs against `example/` only. The private profile does not exist on a runner,
+# and a workflow that needed it would be a workflow that one day leaked it.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  FORCE_COLOR: "1"
+
+jobs:
+  linux:
+    name: ubuntu / python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # Every version `requires-python` claims to support. A claim nothing
+        # exercises is a claim that is wrong sooner or later.
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
+
+    steps:
+      - uses: actions/checkout@v5
+
+      # WeasyPrint binds Pango and Cairo through cffi. Without these every
+      # rendering test fails on `cannot load library 'libgobject-2.0-0'`.
+      - name: Install native libraries
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            libpango-1.0-0 libpangoft2-1.0-0 libharfbuzz0b libcairo2 poppler-utils
+
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          python-version: ${{ matrix.python-version }}
+
+      # --locked, so a stale uv.lock fails the build rather than being
+      # silently resolved around.
+      - name: Install
+        run: uv sync --locked --all-extras --dev
+
+      - name: Lint
+        run: |
+          uv run ruff check --output-format=github .
+          uv run ruff format --check .
+
+      - name: Types
+        run: uv run mypy
+
+      # The leak guard. On a clone there is no private profile, so this is the
+      # structural layer: anything shaped like an IBAN, a Swiss UID, an email
+      # address or a phone number in a tracked file fails the build.
+      - name: Scan for private values
+        run: uv run billwright scan
+
+      - name: Test
+        run: uv run pytest -q
+
+      - name: Numbering and sanity checks
+        run: uv run billwright check
+
+      - name: Render the example documents
+        run: |
+          uv run billwright bill RE-26001
+          uv run billwright statement 2026
+
+      # So a human can look at a render without cloning anything. Rule 6:
+      # structural checks pass happily while the layout is broken.
+      - name: Upload rendered PDFs
+        if: matrix.python-version == '3.13'
+        uses: actions/upload-artifact@v4
+        with:
+          name: example-documents
+          path: out/*.pdf
+          if-no-files-found: error
+
+  macos:
+    name: macos / python 3.13
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      # Worth a separate job: macOS is the platform this is developed on, and
+      # the only one that exercises native.py's dyld repair.
+      - name: Install native libraries
+        run: brew install pango
+
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          python-version: "3.13"
+
+      - name: Install
+        run: uv sync --locked --all-extras --dev
+
+      - name: Test
+        run: make test
+
+      - name: Render the example bill through the CLI
+        run: uv run billwright bill RE-26001
+
+  hooks:
+    name: pre-commit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install native libraries
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            libpango-1.0-0 libpangoft2-1.0-0 libharfbuzz0b libcairo2
+
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          python-version: "3.13"
+
+      - name: Install
+        run: uv sync --locked --all-extras --dev
+
+      - name: Run every hook over every file
+        run: uv run pre-commit run --all-files --show-diff-on-failure

billwright-0.2.0/.github/workflows/release.yml

@@ -0,0 +1,92 @@
+name: Release
+
+# Publishes to PyPI when a `v*` tag is pushed.
+#
+# There is no token anywhere — not in the repository, not in a secret, not on
+# anyone's laptop. PyPI's trusted publishing exchanges this workflow's OIDC
+# identity for a credential that lasts minutes. That makes three things in here
+# load-bearing rather than decorative, and PyPI matches on all of them: the
+# filename `release.yml`, the `pypi` environment, and `id-token: write`. Rename
+# any of them and the upload fails with a 403 that does not explain itself.
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  # Build and publish are separate jobs on purpose. Only `publish` can mint a
+  # PyPI credential, and all it does is upload files it did not produce; the
+  # build — which runs hatchling and the dependency tree — never holds one.
+  build:
+    name: build and check the artifacts
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          python-version: "3.13"
+
+      - name: The tag must be the version being published
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          version=$(uv run --no-project python -c \
+            'import tomllib,pathlib; print(tomllib.loads(pathlib.Path("pyproject.toml").read_text())["project"]["version"])')
+          if [ "$tag" != "$version" ]; then
+            echo "tag $GITHUB_REF_NAME does not match pyproject version $version" >&2
+            exit 1
+          fi
+          echo "publishing $version"
+
+      - name: Build
+        run: uv build
+
+      # The regression that 0.2.0 exists to fix: the typeface was not in the
+      # wheel, so an installed copy typeset client invoices in a substituted
+      # font and said nothing. A release that ships that again is worse than no
+      # release, and this is the last point at which it is cheap to notice.
+      - name: The wheel must carry the fonts and the manual
+        run: |
+          wheel=$(ls dist/*.whl)
+          for entry in \
+            billwright/assets/fonts/Inter-Regular.otf \
+            billwright/assets/fonts/Inter-Medium.otf \
+            billwright/assets/fonts/Inter-SemiBold.otf \
+            billwright/assets/fonts/OFL.txt \
+            billwright/AGENTS.md
+          do
+            unzip -l "$wheel" | grep -q "$entry" || { echo "missing from wheel: $entry" >&2; exit 1; }
+          done
+          echo "wheel contents verified"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+  publish:
+    name: publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write # the whole mechanism; without it there is no credential
+    steps:
+      - uses: astral-sh/setup-uv@v7
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      # `always`, not `automatic`: if trusted publishing is unavailable for any
+      # reason, fail rather than quietly looking for a token that should not
+      # exist.
+      - name: Publish
+        run: uv publish --trusted-publishing always

billwright-0.2.0/.gitignore

@@ -0,0 +1,259 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#   Usually these files are written by a python script from a template
+#   before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+# Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+# uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+# poetry.lock
+# poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+# pdm.lock
+# pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+# pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# Redis
+*.rdb
+*.aof
+*.pid
+
+# RabbitMQ
+mnesia/
+rabbitmq/
+rabbitmq-data/
+
+# ActiveMQ
+activemq-data/
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#   JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#   be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#   and can be added to the global gitignore or merged into this file.  For a more nuclear
+#   option (not recommended) you can uncomment the following to ignore the entire idea folder.
+# .idea/
+
+# Abstra
+#   Abstra is an AI-powered process automation framework.
+#   Ignore directories containing user credentials, local state, and settings.
+#   Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#   Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore
+#   that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#   and can be added to the global gitignore or merged into this file. However, if you prefer,
+#   you could uncomment the following to ignore the entire vscode folder
+# .vscode/
+# Temporary file for partial code execution
+tempCodeRunnerFile.py
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/
+
+# Streamlit
+.streamlit/secrets.toml
+
+# Agent working notes — local only, never version controlled.
+# Build plans, handovers and scratch thinking. Company facts may appear here.
+notes/
+
+# Rendered drafts. The archive/ copies are the record; out/ is scratch.
+out/
+
+# ---------------------------------------------------------------------------
+# The private surface. Everything company-specific lives here and nowhere else:
+# the engine in src/ holds no company values, so these are the only paths that
+# must never reach a public remote.
+#
+#   data/              the active company profile — issuer, IBAN, clients,
+#                      rates, issued bills, brand tokens
+#   archive/           the PDFs actually sent, retained 10 years (OR 958f)
+#   assets/reference/  source documents from clients
+#
+# No .gitkeep placeholders here — an empty but present data/ would be selected
+# by resolve_profile() and then fail, instead of falling through to example/.
+# Directories are created on demand by the code that writes into them.
+# ---------------------------------------------------------------------------
+/data/
+/archive/
+assets/reference/
+
+# Company-specific skill: client names, VAT status, rate, business structure.
+# Ignored so it cannot be swept into a commit while its fate is undecided —
+# renaming or splitting it into a generic skill plus a private profile is a
+# decision, not a chore. Un-ignore once that call is made.
+/skills/private-company-profile/
+
+# uv
+.venv/
+
+# Finder and editor clutter. Finder drops .DS_Store into any directory it has
+# been opened in, and the file records that directory's contents — so it is
+# both noise and, in a repository organised around keeping company values out
+# of git, a small thing that lists filenames nobody chose to publish.
+.DS_Store
+._*

billwright-0.2.0/.pre-commit-config.yaml

@@ -0,0 +1,41 @@
+# Runs before a commit is created, rather than telling you about it afterwards.
+# Install once with `make hooks`; `make check` runs the same set over every file.
+#
+# mypy and the leak scan are `local` hooks on purpose: both need the project's
+# own environment (its dependencies, its profile), and a hook running in an
+# isolated venv would either fail to import weasyprint or scan with no profile
+# at all — passing for the wrong reason, which is worse than failing.
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.14.5
+    hooks:
+      - id: ruff-check
+        args: [--fix]
+      - id: ruff-format
+
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+      - id: check-yaml
+      - id: check-toml
+      - id: check-added-large-files
+      - id: check-merge-conflict
+      - id: detect-private-key
+
+  - repo: local
+    hooks:
+      - id: mypy
+        name: mypy
+        entry: uv run mypy
+        language: system
+        types: [python]
+        pass_filenames: false
+
+      - id: scan
+        name: scan for private values in tracked files
+        entry: uv run billwright scan
+        language: system
+        pass_filenames: false
+        always_run: true