keymap-align 0.2.0__tar.gz

keymap_align-0.2.0/.editorconfig

@@ -0,0 +1,69 @@
+# forge-managed
+#
+# Deployed as .editorconfig.
+#
+# This is where shell formatting is defined, not the shfmt hook. shfmt treats a
+# parser or printer flag as a replacement for this file rather than an addition
+# to it: a single `--indent 2` on the hook would discard switch_case_indent and
+# binary_next_line along with it. Output flags (--write, --diff) are safe.
+#
+# The shell keys sit under [*] rather than [*.sh] because a shell executable is
+# commonly shipped with no extension at all. A suffix pattern cannot reach one,
+# and an unmatched file is not skipped: shfmt falls back to tab indentation and
+# reformats it wrongly. shfmt only reads these for files it identifies as shell,
+# so [*] costs nothing there. The per-language sections below exist because
+# editors, unlike shfmt, read [*] for every file.
+#
+# indent_size, switch_case_indent and binary_next_line are shfmt's -i 2 -ci -bn,
+# which the shfmt manual gives as its approximation of the Google Shell Style
+# Guide. Google specifies all three: two-space indent, case alternatives
+# indented, and a split pipeline carrying `|`, `||` and `&&` at the start of the
+# continuation line rather than the end of the previous one.
+#
+# space_redirects is deliberately absent, leaving shfmt's default of `>file`.
+# Google's guide does not rule on redirect spacing, and overriding a formatter's
+# considered default with no standard behind it is config that cannot be
+# justified later.
+#
+# simplify is likewise absent, and is not a formatting option: it rewrites
+# `${var}` to `$var`, which Google's guide explicitly argues against.
+
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 2
+switch_case_indent = true
+binary_next_line = true
+
+# gofmt is not configurable and emits tabs.
+[*.go]
+indent_style = tab
+
+# PEP 8, and the default both ruff-format and rustfmt apply.
+[*.{py,rs}]
+indent_size = 4
+
+# StyLua reads these where a repo carries no stylua.toml, and its own defaults
+# are 120 columns and double quotes. 140 is the width ruff, prettier and rustfmt
+# are given, and single quotes are what ruff's quote-style and prettier's
+# singleQuote already choose.
+[*.lua]
+max_line_length = 140
+quote_type = single
+
+# Inherits indent_size = 2 to agree with markdownlint's MD007, which the shared
+# .markdownlint.yaml leaves at its 2-space default via `default: true`.
+# trim_trailing_whitespace matches the trailing-whitespace hook's
+# --markdown-linebreak-ext=md, which preserves the two-space line break; an
+# editor and the hook must not undo each other.
+[*.md]
+trim_trailing_whitespace = false
+
+# make requires a literal tab before every recipe line.
+[Makefile]
+indent_style = tab

keymap_align-0.2.0/.github/actionlint.yaml

@@ -0,0 +1,8 @@
+# forge-toolchain: 46
+# Labels actionlint cannot discover. Its list of GitHub's hosted images is the
+# one its release shipped with, and a self-hosted runner's labels are on no
+# list. Without this every runs-on naming one is reported as a typo and the
+# actionlint hook fails.
+self-hosted-runner:
+  labels:
+    - ubuntu-26.04

keymap_align-0.2.0/.github/workflows/release.yml

@@ -0,0 +1,68 @@
+name: Release
+
+on:
+  push:
+    branches: [main]
+
+# Scoped per job rather than here: validate only reads, and it is the job that
+# runs the most third-party code.
+permissions:
+  contents: read
+
+# Two pushes to main inside one run's window would otherwise race. Both runs
+# resolve the same version, and the later one fails pushing its tag or its
+# version commit.
+# Never cancel-in-progress: a canceled release can leave a tag with no release.
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  # Without this, release publishes whatever is on main, tested or not.
+  validate:
+    uses: ./.github/workflows/validate.yml
+
+  release:
+    needs: validate
+    uses: datapointchris/reusable-workflows/.github/workflows/python-semantic-release.yml@v1
+    permissions:
+      contents: write
+
+  # A separate job in the same workflow, gated on the one above.
+  #
+  # Same workflow because a tag pushed with GITHUB_TOKEN does not trigger
+  # another workflow run, so a publish keyed on `push: tags` would never fire.
+  # Separate job so the publishing credential is reachable from these steps
+  # only, and not from the release job that runs python-semantic-release.
+  #
+  # A commit type that bumps nothing leaves `released` false, and this job is
+  # skipped. A skipped publish on a green run is the correct result there.
+  publish:
+    needs: release
+    if: needs.release.outputs.released == 'true'
+    runs-on: ubuntu-26.04
+    environment:
+      name: pypi
+      url: https://pypi.org/p/keymap-align
+    permissions:
+      # Trusted Publishing. No API token is stored in this repository; PyPI is
+      # configured to accept a short-lived OIDC credential from this workflow.
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # The tag, not the branch. The version is read from the tag, so a
+          # build anywhere else names the previous release plus a distance, and
+          # main may already have moved past what was released.
+          ref: ${{ needs.release.outputs.tag }}
+
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+
+      - run: uv build
+
+      # A version cannot be replaced once uploaded, only yanked, so the sdist
+      # and wheel are checked before anything is irreversible.
+      - run: uv run --no-project --with twine twine check dist/*
+
+      - name: Publish to PyPI
+        run: uv publish

keymap_align-0.2.0/.github/workflows/validate.yml

@@ -0,0 +1,249 @@
+# forge-toolchain: 46
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+
+  python:
+    runs-on: ubuntu-26.04
+    steps:
+
+      - uses: actions/checkout@v7
+
+      # generated:python
+      # enable-cache is left at setup-uv's `auto`, which caches on a hosted
+      # runner only. Every repo's self-hosted runner shares one ~/.cache/uv
+      # that outlives the job, so there the post step's prune and upload are
+      # work the disk already did, and two jobs pruning at once collide on the
+      # same files. version is the release the uv-lock hook pins, so the sync
+      # here and the lock check in the hooks job run one uv.
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          version: "0.12.24"
+
+      - run: uv sync --all-extras --dev
+
+      # --with pytest, because skipping is the wrong answer here: a repo with a
+      # real test suite that never declared pytest as a dependency would
+      # silently stop being tested. Supplying the runner runs the tests; a suite
+      # needing plugins still declares those itself.
+      #
+      # pytest exits 5 when it collects nothing, which is not a failure for a
+      # repo that has no tests yet. Written explicitly rather than as an && chain
+      # because the runner uses `bash -e`, where the concise form depends on
+      # subtle errexit-exemption rules.
+      - name: Test
+        run: |
+          set +e
+          uv run --with pytest pytest
+          code=$?
+          set -e
+          if [ "$code" -eq 0 ] || [ "$code" -eq 5 ]; then exit 0; fi
+          exit 1
+
+  hooks:
+    runs-on: ubuntu-26.04
+    steps:
+
+      - uses: actions/checkout@v7
+
+      # generated:hooks
+      # Every hook a standard block put in the repo's committed config, which
+      # forge lists below. A push from a checkout that never ran `pre-commit
+      # install`, or a merge in the web UI, passes every hook by not running it,
+      # and this is the gate that catches both. CI runs the hooks themselves
+      # rather than copies of their checks, because a copy is a second spelling
+      # of the check that drifts from the first.
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          version: "0.12.24"
+
+      # A self-hosted runner keeps ~/.cache/pre-commit between jobs, so there
+      # the archive is a download of what is already on disk.
+      - uses: actions/cache@v6
+        if: runner.environment == 'github-hosted'
+        with:
+          path: ~/.cache/pre-commit
+          key: pre-commit-${{ runner.os }}-${{ hashFiles('.pre-commit-config.yaml') }}
+
+      # The bats hook is `language: system`, so bats has to be on PATH. Every
+      # config carries the hook, and the step does nothing where there are no
+      # suites.
+      #
+      # All three are cloned at a tag rather than from main: a test harness
+      # that moves on its own turns an unrelated upstream change into a failing
+      # build, and nothing records which version a green run used.
+      #
+      # bats-core runs from its clone in RUNNER_TEMP, by PATH. Installed into
+      # /usr/local, it would be one copy every runner on a self-hosted box
+      # rewrites while the others execute it.
+      #
+      # The helper libraries go under ~/.local/lib because that is where the
+      # suites `load` them from — the same path they use on a workstation, so a
+      # test cannot pass locally and fail here over a lookup path. The suites
+      # name that path literally, and `load` resolves nothing, so BATS_LIB_PATH
+      # cannot move the libraries anywhere cheaper.
+      #
+      # On the self-hosted pool that $HOME outlives the job and is shared by
+      # every repo's runner, so concurrent jobs meet at ~/.local/lib. Each
+      # release is cloned once, into a directory named for its version, and
+      # nothing that has been loaded from is ever removed. The clone is staged
+      # beside its target and renamed into place, so a reader never sees a
+      # partial one, and a job that loses the race keeps the winner's copy. The
+      # path the suites load is a symlink to the pinned release, replaced by
+      # rename. A new pin names a new directory, so a runner never serves the
+      # tag it cloned first while CI reports the pin. A real directory at the
+      # symlink's path cannot be renamed over, so it is removed first.
+      #
+      # The hook runs tests/*.bats, flat. Recursing would sweep an integration
+      # tier in beside the unit one, and only the repo knows which of its tiers
+      # is runner-safe. A nested layout is named in a notice rather than passed
+      # over in silence, which is how one went unnoticed before.
+      #
+      # jq is installed ahead of the runner's own, because the scripts under
+      # test evaluate jq programs and jq's grammar moves between releases. 1.8
+      # accepts an object value piped into `//` without parentheses, and 1.7
+      # rejects the whole program. The version is the release the development
+      # machines run, so a program parses here exactly when it parses there.
+      - name: Set up bats
+        run: |
+          bats_version="1.14.0"
+          bats_support_version="0.3.0"
+          bats_assert_version="2.2.4"
+          jq_version="1.8.2"
+
+          if ! compgen -G "tests/*.bats" > /dev/null; then
+            if [ -n "$(find tests -name '*.bats' -print -quit 2>/dev/null)" ]; then
+              echo "::notice::bats suites exist under tests/ but none at its root, and the bats hook runs tests/*.bats only"
+            fi
+            exit 0
+          fi
+
+          git clone --depth 1 --branch "v${bats_version}" \
+            https://github.com/bats-core/bats-core.git "$RUNNER_TEMP/bats"
+          echo "$RUNNER_TEMP/bats/bin" >> "$GITHUB_PATH"
+
+          lib="$HOME/.local/lib"
+          mkdir -p "$lib"
+          for helper in "bats-support:${bats_support_version}" "bats-assert:${bats_assert_version}"; do
+            name="${helper%%:*}"
+            release="${name}-v${helper#*:}"
+            if [ ! -d "$lib/$release" ]; then
+              staged=$(mktemp -d "$lib/.$release.XXXXXX")
+              git clone --depth 1 --branch "v${helper#*:}" \
+                "https://github.com/bats-core/$name.git" "$staged"
+              mv -T "$staged" "$lib/$release" 2>/dev/null || rm -rf "$staged"
+            fi
+            [ -L "$lib/$name" ] || rm -rf "${lib:?}/$name"
+            ln -s "$release" "$lib/.$name.$$"
+            mv -T "$lib/.$name.$$" "$lib/$name"
+          done
+
+          mkdir -p "$RUNNER_TEMP/jq"
+          curl -fsSL --retry 3 -o "$RUNNER_TEMP/jq/jq" \
+            "https://github.com/jqlang/jq/releases/download/jq-${jq_version}/jq-linux-amd64"
+          chmod +x "$RUNNER_TEMP/jq/jq"
+          echo "$RUNNER_TEMP/jq" >> "$GITHUB_PATH"
+          "$RUNNER_TEMP/jq/jq" --version
+
+      # Over what the push or pull request changed, which is what the hooks
+      # would have seen at commit time. --all-files would fail a push on every
+      # finding in a file it never touched, so it is the scope only where no
+      # earlier commit can be fetched, as on a repo's first push.
+      #
+      # Or where the change touches a file that configures a hook or pins what
+      # it checks against: the hook config, a tool's config, a manifest, a lock
+      # or a toolchain file. None of those matches a hook's own file types, so
+      # a new release or rule would otherwise grade nothing in the commit that
+      # brought it, and its findings would land on the next author to touch the
+      # code.
+      #
+      # The checkout is one commit deep, and diffing needs one more. pre-commit
+      # falls back to a two-dot diff where the two commits share no history on
+      # disk, and refcheck's --moves reads the range as a two-dot diff too, so
+      # the base commit alone is enough.
+      #
+      # GITHUB_TOKEN is for the tflint hook, whose --init installs the plugins a
+      # .tflint.hcl names from GitHub, which rate-limits a runner that does not
+      # authenticate.
+      #
+      # setup-go exports GOTOOLCHAIN=local, and this job sets Go up once per
+      # module. Under local, a later setup-go ignores its go.mod's toolchain
+      # line, and each module's go refuses a go.mod asking for a newer release.
+      # auto lets each module's go switch to the toolchain its go.mod names. It
+      # is exported in the script, where no GITHUB_ENV write can override it.
+      - name: Run the hooks over the change
+        env:
+          BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          export GOTOOLCHAIN=auto
+          from=
+          if [ -n "$BASE" ] && git fetch --quiet --depth=1 --no-tags origin "$BASE" 2>/dev/null; then
+            from=$BASE
+          elif git fetch --quiet --depth=2 --no-tags origin "$(git rev-parse HEAD)" &&
+            git rev-parse --quiet --verify HEAD~1 >/dev/null; then
+            echo "::notice::this event names no base commit, so only the head commit's change is checked"
+            from=HEAD~1
+          else
+            echo "::notice::no earlier commit to diff against, so every file is checked"
+          fi
+          scope=(--all-files)
+          if [ -n "$from" ]; then
+            scope=(--from-ref "$from" --to-ref HEAD)
+            while IFS= read -r changed; do
+              case "${changed##*/}" in
+                .pre-commit-config.yaml | .editorconfig | .codespellrc | .markdownlint.yaml | \
+                  .shellcheckrc | .golangci.yml | .sqlfluff | .tflint.hcl | .prettierrc.yaml | \
+                  .prettierignore | rustfmt.toml | .rustfmt.toml | \
+                  eslint.config.* | tsconfig*.json | stylua.toml | .stylua.toml | \
+                  pyproject.toml | uv.lock | go.mod | go.sum | Cargo.toml | Cargo.lock | \
+                  rust-toolchain.toml | package.json | package-lock.json | .nvmrc | .terraform.lock.hcl)
+                  echo "::notice::$changed changed, so every file is checked"
+                  scope=(--all-files)
+                  break
+                  ;;
+              esac
+            done < <(git diff --name-only "$from" HEAD)
+          fi
+          hooks=(
+            check-yaml
+            check-toml
+            check-json
+            end-of-file-fixer
+            trailing-whitespace
+            check-executables-have-shebangs
+            check-shebang-scripts-are-executable
+            check-added-large-files
+            check-merge-conflict
+            mixed-line-ending
+            check-case-conflict
+            detect-private-key
+            check-json5
+            markdownlint
+            shellcheck
+            shfmt
+            bats
+            codespell
+            refcheck
+            uv-lock
+            ruff-format
+            ruff-check
+            mypy
+            actionlint
+          )
+          # Every hook runs whatever the one before it found, so one push
+          # reports every failing hook rather than the first.
+          status=0
+          for hook in "${hooks[@]}"; do
+            uvx pre-commit run "$hook" "${scope[@]}" --show-diff-on-failure || status=1
+          done
+          exit "$status"

keymap_align-0.2.0/.gitignore

@@ -0,0 +1,56 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# Virtual environments
+.venv/
+venv/
+ENV/
+env/
+
+# IDEs
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+.DS_Store
+
+# Testing
+.coverage
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+htmlcov/
+.tox/
+tests/test_keymaps/test_output/
+
+# Documentation
+site/
+docs/_build/
+
+# Misc
+*.log
+*.tmp
+.cache/
+.claude/
+coverage.xml

keymap_align-0.2.0/.markdownlint.yaml

@@ -0,0 +1,42 @@
+# forge-managed
+#
+# Deployed as .markdownlint.yaml.
+#
+# YAML rather than JSON so the file can carry the marker on its first line. JSON
+# has no comment syntax, and markdownlint reads either spelling — including at
+# the rev the markdown block pins.
+#
+# markdownlint prefers .markdownlint.json when both are present, so a repo still
+# holding the JSON spelling has it removed in the same run that writes this one.
+
+default: true
+
+# Line length. Prose here is wrapped for the editor, not for a linter, and a
+# rule that fires on a long URL costs more than it finds.
+MD013: false
+
+# Duplicate headings, siblings only. A document with repeated subsections under
+# different parents is ordinary; two identical headings under one parent is not.
+MD024:
+  siblings_only: true
+
+# Inline HTML. Markdown that needs a <details> block or an anchor needs it.
+MD033: false
+
+# First line a top-level heading, or a title in front matter. `name:` counts as
+# a title as well as `title:`, because a skill or agent definition carries its
+# title under that key and opens on no heading.
+MD041:
+  front_matter_title: "^\\s*(title|name)\\s*[:=]"
+
+# Emphasis used instead of a heading. Deliberate in short documents that want a
+# bold run-in without adding a level to the outline.
+MD036: false
+
+# Spaces inside code span markers. Fires on a code span whose content is a
+# literal space, which is a legitimate thing to write.
+MD038: false
+
+# Code block style. Both fenced and indented blocks appear in these repos and
+# neither is wrong.
+MD046: false

keymap_align-0.2.0/.markdownlintignore

@@ -0,0 +1,4 @@
+# Preventive: no release here writes a changelog. The entry stands so that one
+# arriving generated is never linted, since normalization of a generated file
+# is undone on the next release and returns as a conflict.
+CHANGELOG.md