logseq-md 0.1.0__tar.gz

logseq_md-0.1.0/.biome.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "https://biomejs.dev/schemas/2.5.12/schema.json",
+  "vcs": {
+    "enabled": true,
+    "clientKind": "git",
+    "useIgnoreFile": true
+  },
+  "files": {
+    "includes": ["**/*.json", "**/*.jsonc"]
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space",
+    "indentWidth": 2,
+    "lineEnding": "lf",
+    "lineWidth": 100
+  },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "recommended": true
+    }
+  }
+}

logseq_md-0.1.0/.checkmake.ini

@@ -0,0 +1,4 @@
+[minphony]
+# This repo has no build/clean phase; the real entry points are test/check/
+# bootstrap. Disable the default requirement for `all` and `clean` targets.
+disabled = true

logseq_md-0.1.0/.editorconfig

@@ -0,0 +1,30 @@
+# EditorConfig - editor-layer half of LF enforcement (see .gitattributes and the
+# mixed-line-ending pre-commit hook for the other two layers).
+# https://editorconfig.org
+root = true
+
+[*]
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+charset = utf-8
+indent_style = space
+indent_size = 2
+
+# What ruff-format emits, written down so an editor does not fight it.
+[*.py]
+indent_size = 4
+
+[*.{json,jsonc,yaml,yml,toml,md}]
+indent_size = 2
+
+[Makefile]
+indent_style = tab
+
+# Logseq's own files, for whenever fixtures land here. The format is tab
+# indented and that is not a preference: a fixture reindented to spaces stops
+# testing what it was written to test.
+[tests/fixtures/**]
+indent_style = tab
+trim_trailing_whitespace = false
+insert_final_newline = false

logseq_md-0.1.0/.gitattributes

@@ -0,0 +1,46 @@
+# Normalise all text to LF on commit, independent of contributor OS.
+# Pairs with .editorconfig and the mixed-line-ending pre-commit hook
+# (belt-and-braces LF enforcement).
+* text=auto eol=lf
+
+# Explicit text types (source, documentation, tooling)
+*.py        text eol=lf
+*.pyi       text eol=lf
+*.md        text eol=lf
+*.json      text eol=lf
+*.jsonc     text eol=lf
+*.yaml      text eol=lf
+*.yml       text eol=lf
+*.toml      text eol=lf
+*.cfg       text eol=lf
+*.ini       text eol=lf
+*.sh        text eol=lf
+.gitignore      text eol=lf
+.gitattributes  text eol=lf
+.editorconfig   text eol=lf
+
+# Test fixtures are bytes under test, not text to normalise. A graph fixture
+# exists to prove a write left every untouched byte alone, so a checkout that
+# rewrites its line endings makes the test assert something else - and it passes
+# on Linux and fails on Windows, which is the worst of the three outcomes.
+tests/fixtures/** -text
+
+# Generated or vendored content that should not count as authored code in the
+# language statistics on the repository page.
+tests/fixtures/** linguist-vendored
+
+# Binary assets: if we ever add images or PDFs, they belong in Git LFS (keeps
+# history lean). `-text` exempts them from the `* text eol=lf` rule above so LFS
+# and line-ending normalisation do not collide.
+#
+# These rules are inert until a matching file is added: with none tracked, git
+# never invokes the lfs filter, so git-lfs is NOT required to clone, commit or
+# test. It becomes required only for whoever first adds such a file - run
+# `git lfs install` in your clone before committing one.
+*.png       filter=lfs diff=lfs merge=lfs -text
+*.jpg       filter=lfs diff=lfs merge=lfs -text
+*.jpeg      filter=lfs diff=lfs merge=lfs -text
+*.gif       filter=lfs diff=lfs merge=lfs -text
+*.webp      filter=lfs diff=lfs merge=lfs -text
+*.svg       filter=lfs diff=lfs merge=lfs -text
+*.pdf       filter=lfs diff=lfs merge=lfs -text

logseq_md-0.1.0/.github/dependabot.yml

@@ -0,0 +1,28 @@
+---
+version: 2
+updates:
+# Bump pinned pre-commit hook SHAs (keeps the frozen revisions current).
+- package-ecosystem: pre-commit
+  directory: /
+  schedule:
+    interval: weekly
+  commit-message:
+    prefix: "chore(pre-commit)"
+
+# Bump pinned GitHub Actions SHAs.
+- package-ecosystem: github-actions
+  directory: /
+  schedule:
+    interval: weekly
+  commit-message:
+    prefix: "chore(actions)"
+
+# Python dependencies. There are none yet beyond the dev group, and the entry
+# is here so the first one added is watched from the day it lands rather than
+# from the day somebody remembers this file.
+- package-ecosystem: uv
+  directory: /
+  schedule:
+    interval: weekly
+  commit-message:
+    prefix: "chore(deps)"

logseq_md-0.1.0/.github/workflows/governance.yml

@@ -0,0 +1,59 @@
+---
+name: Governance
+
+permissions:
+  contents: read
+
+# Pull requests only, and deliberately: GitHub builds a pull request's checks
+# against the head merged into `main`, so what this runs on is already the merge
+# result. `workflow_dispatch` remains for asking `main` the question by hand.
+#
+# What this gives up is the case where two pull requests pass separately and
+# conflict in meaning once both are in. Closing that needs the branch to be up
+# to date before merging, which is a repository setting rather than anything
+# here.
+on:
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: governance_${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  governance:
+    name: 🩺 (run governance checks)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    defaults:
+      run:
+        shell: bash -elo pipefail {0}
+    steps:
+    - name: Checkout
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+    - name: Setup node
+      # The link checker drives a headless browser, which is a node toolchain.
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+      with:
+        node-version: "24"
+
+    - name: Setup uv
+      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+      with:
+        cache-dependency-glob: |
+          pyproject.toml
+          .scripts/*.py
+
+    # The suite includes ruff over every Python file and `ty` over `src/` and
+    # `tests/`, so the type check is one hook rather than a second job: a
+    # contributor who runs `make check` gets the same answer CI does, which is
+    # the property worth having.
+    #
+    # It also covers every link in the tree. `linkspector-changed` is handed the
+    # changed files on the commit path and every file here, which is the whole
+    # sweep already: a separate `linkspector-all` step would drive the same
+    # browser over the same URLs a second time, double the runtime and double
+    # the chance of a throttled link failing the job.
+    - name: Run pre-commit hooks
+      run: uvx prek run --show-diff-on-failure --color=always --all-files

logseq_md-0.1.0/.github/workflows/rehearsal.yml

@@ -0,0 +1,124 @@
+---
+name: Rehearsal
+
+# Publish every pull request to TestPyPI under a throwaway version, then install
+# it from there and run it.
+#
+# What this catches and nothing else does is an index saying no. A classifier
+# warehouse dislikes, a licence expression it will not parse, a name that
+# normalises onto an existing project, a metadata version the upload path does
+# not know. Those are answered by an upload and by nothing before it, and the
+# first release of federated-agent-kits, where this workflow comes from, was
+# stopped by the last of them, on `main`, after a tag had been pushed.
+#
+# It is a separate workflow from `release.yml` rather than a job inside it,
+# because a trusted publisher is matched on the workflow's filename. One file
+# can reach TestPyPI and one can reach PyPI, and the one that can reach PyPI
+# runs only on a push to `main`. A rehearsal that could authenticate as the
+# release would not be a rehearsal.
+
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: rehearsal_${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  rehearsal:
+    name: 🧪 (publish a rehearsal and install it)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    environment: testpypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+
+    - name: Checkout
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      with:
+        fetch-depth: 0
+
+    - name: Setup uv
+      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+      with:
+        cache-dependency-glob: |
+          pyproject.toml
+          .scripts/*.py
+
+    - name: Work out a version nobody will want
+      id: version
+      # The version this pull request would release if it merged next, with a
+      # dev segment behind it, so what gets uploaded is shaped like what would
+      # be. The level comes from the bump label, which the release workflow
+      # already insists on exactly one of; without one, `patch` stands in,
+      # because the point here is the upload path rather than the number.
+      #
+      # The serial is the run id. Not a commit sha, which is the obvious choice
+      # and is not available: PEP 440 wants a number in a dev segment, and the
+      # other spelling, `0.2.1+g6ec3cb1`, is refused by both indexes because
+      # warehouse forbids local versions. A run id is also the better answer
+      # anyway, because an index accepts a version exactly once and never again,
+      # so re-running this workflow on the same commit has to produce a new
+      # string.
+      env:
+        LABELS: ${{ join(github.event.pull_request.labels.*.name, ' ') }}
+        SERIAL: ${{ github.run_id }}
+      run: |
+        set -euo pipefail
+        level="patch"
+        for label in ${LABELS}; do
+          case "${label}" in
+            major|minor|patch) level="${label}" ;;
+          esac
+        done
+        rehearsal=$(uv run .scripts/version.py dev "${level}" "${SERIAL}")
+        echo "rehearsal=${rehearsal}" >> "${GITHUB_OUTPUT}"
+        echo "Rehearsing ${level} as ${rehearsal}."
+
+    - name: Write it into the working tree
+      # Written, never committed. The release workflow refuses a pull request
+      # that edits the version line, and this does not: nothing here is pushed.
+      env:
+        REHEARSAL: ${{ steps.version.outputs.rehearsal }}
+      run: uv run .scripts/version.py write "${REHEARSAL}"
+
+    - name: Build the distribution
+      run: uv build --out-dir dist
+
+    - name: Check the distribution
+      # The same `--strict` gate the release runs, here so that the cheap
+      # failure is reported before the slow one.
+      run: uvx twine check --strict dist/*
+
+    - name: Publish to TestPyPI
+      # Skipped for a pull request from a fork, which cannot be given
+      # `id-token: write` and therefore cannot authenticate. The job still
+      # reports, having built and checked, so this can be a required check
+      # without a fork's pull request being unmergeable.
+      if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository
+      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+      with:
+        repository-url: https://test.pypi.org/legacy/
+
+    - name: Install it from TestPyPI and run it
+      # A green publish means an index accepted some bytes. It does not mean
+      # anybody can install them, and it does not mean what they install works.
+      if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository
+      env:
+        REHEARSAL: ${{ steps.version.outputs.rehearsal }}
+      run: uv run .scripts/verify-published.py "${REHEARSAL}" https://test.pypi.org/simple/
+
+    - name: Say why nothing was uploaded
+      if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
+      # Out loud, because a silently skipped step in a green job is how a gate
+      # stops being a gate without anybody noticing.
+      run: |-
+        echo "::warning::This pull request is from a fork, which cannot be given an OIDC token."
+        echo "::warning::The distribution was built and checked; it was not uploaded or installed."

logseq_md-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,288 @@
+---
+name: Release
+
+# Every merge to main ships. The version lives in `pyproject.toml`, is written
+# here and never in a pull request. Two reasons, and the second is the one that
+# decided it: a hand-bumped version disagrees with its tag the first time
+# somebody forgets, and every concurrent pull request touches the same line and
+# conflicts on merge. What a pull request carries instead is a label saying how
+# big it is, which is a thing a reviewer already decides.
+#
+# An unpublished package is an untested release pipeline, which is why the first
+# version ships with this pipeline (IMPLEMENTATION.md, S0) rather than with the
+# first verb: the first real publish is the one that finds the misconfigured
+# name, the missing classifier and the trusted-publisher mismatch.
+#
+# The order of the steps below is the lesson from that first publish, and it is
+# not the one first drawn from it. The upload is the only step that cannot be
+# undone, so it goes last. Everything before it is revocable: a version written
+# into a working tree, a commit, a tag. What stopped the sibling's first release was a
+# malformed distribution, and `twine check --strict` now catches that before
+# anything is written at all.
+
+on:
+  pull_request:
+    types: [opened, reopened, labeled, unlabeled, synchronize]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  # Never cancelled in flight: a release half-done is a tag with no version
+  # behind it, or the reverse.
+  group: release_${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: false
+
+jobs:
+  bump_label:
+    name: 🏷 (the pull request says how big it is)
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+
+    - name: Checkout
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      with:
+        fetch-depth: 0
+
+    - name: Setup uv
+      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+      with:
+        cache-dependency-glob: |
+          pyproject.toml
+          .scripts/*.py
+
+    - name: Refuse a pull request without exactly one bump label
+      # Exactly one, not at least one: two labels is not a bigger bump, it is a
+      # disagreement, and picking the larger silently would release a major
+      # because somebody left `minor` on from an earlier round.
+      env:
+        LABELS: ${{ join(github.event.pull_request.labels.*.name, ' ') }}
+      run: |
+        set -euo pipefail
+        chosen=""
+        for label in ${LABELS}; do
+          case "${label}" in
+            major|minor|patch|no-release)
+              if [ -n "${chosen}" ]; then
+                echo "::error::Two bump labels (${chosen}, ${label}). One says what this change is."
+                exit 1
+              fi
+              chosen="${label}"
+              ;;
+          esac
+        done
+        if [ -z "${chosen}" ]; then
+          echo "::error::Label this pull request major, minor, patch or no-release."
+          echo "major: a setup that works stops working. minor: something new. patch: a fix."
+          echo "no-release: nothing that ships - CI, docs about the repo itself."
+          exit 1
+        fi
+        echo "This pull request is a ${chosen}."
+
+    - name: Refuse a hand-edited version
+      # The release job owns that one line. A pull request that also writes it
+      # gets overwritten on merge at best, and at worst ships a version the tag
+      # does not agree with, which is unfixable afterwards because the package is
+      # already on PyPI. The rest of `pyproject.toml` is free: a classifier or a
+      # dependency is an ordinary change, so this reads the diff rather than the
+      # file list.
+      run: uv run .scripts/version.py check-untouched "origin/${{ github.event.pull_request.base.ref }}"
+
+  release:
+    name: 🏷 (tag the merge)
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    environment: pypi
+    permissions:
+      contents: write
+      # Trusted publishing: PyPI is told to trust this workflow in this
+      # repository, so there is no API token to leak, rotate or forget.
+      id-token: write
+    steps:
+
+    - name: Mint a token for the release bot
+      id: token
+      # The release commit has to pass the ruleset on main, and the token a job
+      # is handed by default cannot: it is deliberately not allowed to bypass
+      # rules, which is the right default everywhere except here. An app
+      # installed on this repository can be. It holds one permission
+      # (contents: write), the token it mints expires within the hour, and it is
+      # not a person - so revoking it touches nobody's own access and the release
+      # commits read as a bot's rather than as a maintainer's.
+      #
+      # Configured by hand, once, by somebody with admin: the app, its
+      # installation here, the two secrets below, and an entry for the app in
+      # the bypass list of the ruleset protecting main. The last of those is not
+      # a permission and is the one that gets forgotten; without it this pushes
+      # and is declined. IMPLEMENTATION.md, S0, lists the steps.
+      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
+      with:
+        # The client id rather than the numeric app id, which the action now
+        # deprecates. Both name the same app; the client id is the one GitHub
+        # has standardised on, and it is on the app's own settings page beside
+        # the id it replaces.
+        client-id: ${{ secrets.RELEASE_APP_CLIENT_ID }}
+        private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+
+    - name: Checkout
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      with:
+        fetch-depth: 0
+        token: ${{ steps.token.outputs.token }}
+
+    - name: Setup uv
+      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+      with:
+        cache-dependency-glob: |
+          pyproject.toml
+          .scripts/*.py
+
+    - name: Find the bump this merge asked for
+      id: bump
+      # From the pull request the commit came in on, because that is where a
+      # person judged the change as a whole. A push straight to main has no such
+      # judgement and releases nothing: silence is the safe reading, since the
+      # alternative is guessing a severity for a change nobody reviewed.
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        set -euo pipefail
+        labels=$(gh api "repos/${{ github.repository }}/commits/${{ github.sha }}/pulls" \
+          --jq '.[0].labels[].name' || true)
+        level=""
+        for label in ${labels}; do
+          case "${label}" in
+            major|minor|patch) level="${label}" ;;
+            no-release) level="none" ;;
+          esac
+        done
+        if [ -z "${level}" ]; then
+          echo "No bump label on the pull request this commit arrived in; nothing to release."
+          level="none"
+        fi
+        echo "level=${level}" >> "${GITHUB_OUTPUT}"
+
+    - name: Work out the next version
+      id: version
+      if: steps.bump.outputs.level != 'none'
+      env:
+        LEVEL: ${{ steps.bump.outputs.level }}
+      run: |
+        set -euo pipefail
+        current=$(uv run .scripts/version.py current)
+        next=$(uv run .scripts/version.py next "${LEVEL}")
+        echo "current=${current}" >> "${GITHUB_OUTPUT}"
+        echo "next=${next}" >> "${GITHUB_OUTPUT}"
+        echo "Releasing ${current} -> ${next}."
+
+    - name: Work out who the bot commits as
+      id: identity
+      if: steps.bump.outputs.level != 'none'
+      # A bot's noreply address has to carry its numeric user id, and a commit
+      # whose address does not match is attributed to nobody - it renders as a
+      # grey avatar and links nowhere, which is how a history stops answering
+      # "who did this". The id is asked for rather than pasted in because the app
+      # it belongs to is created by hand, and a number hardcoded here is one
+      # nobody will think to change.
+      env:
+        GH_TOKEN: ${{ steps.token.outputs.token }}
+        SLUG: ${{ steps.token.outputs.app-slug }}
+      run: |
+        set -euo pipefail
+        id=$(gh api "/users/${SLUG}[bot]" --jq .id)
+        echo "name=${SLUG}[bot]" >> "${GITHUB_OUTPUT}"
+        echo "email=${id}+${SLUG}[bot]@users.noreply.github.com" >> "${GITHUB_OUTPUT}"
+
+    - name: Write the version into the working tree
+      if: steps.bump.outputs.level != 'none'
+      env:
+        NEXT: ${{ steps.version.outputs.next }}
+      run: uv run .scripts/version.py write "${NEXT}"
+
+    - name: Build the distribution
+      if: steps.bump.outputs.level != 'none'
+      # Both artefacts: the wheel is what uvx resolves and runs, and the sdist is
+      # what anybody packaging this downstream needs.
+      run: uv build --out-dir dist
+
+    - name: Check the distribution before anyone sees it
+      if: steps.bump.outputs.level != 'none'
+      # `--strict`, so a warning is a failure. This is the half of the upload's
+      # validation that can be run without an index, and the half that stopped
+      # the sibling's first release: a metadata version the pinned twine did not know.
+      # Running it here rather than inside the publish step means it fails
+      # before anything has been written anywhere.
+      #
+      # The other half, what an index will actually accept, is answered on every
+      # pull request by the rehearsal workflow.
+      run: uvx twine check --strict dist/*
+
+    - name: Commit the version and tag it
+      if: steps.bump.outputs.level != 'none'
+      # Before the upload, and this is deliberate: the upload is the only step
+      # here that cannot be undone, so it goes last, once everything that can be
+      # has already succeeded.
+      #
+      # If this step fails, nothing has been published and the version number is
+      # still free. If it ran after the upload instead, a push declined by the
+      # ruleset - the exact failure the bypass list exists to prevent - would
+      # leave PyPI holding a version this repository never recorded, and PyPI
+      # has no delete-and-reuse, only yank.
+      #
+      # One commit carrying the version, and the tag on that commit rather than
+      # on the merge: a tag whose tree holds the previous version is a release
+      # that installs as its predecessor, and nothing downstream can tell.
+      #
+      # **One push, carrying both refs.** As two pushes, federated-agent-kits shipped
+      # 0.13.0's commit and then had its tag rejected with "missing necessary objects":
+      # the second pack holds the tag alone, because the commit it points at
+      # went up a moment earlier, and a receiving replica that has not seen that
+      # commit yet reads the pack as incomplete. One push puts both in one pack
+      # and closes the window. `--atomic` then makes the pair all-or-nothing,
+      # which is what the concurrency group at the top of this file is for: a
+      # half-done release is a tag with no version behind it, or the reverse.
+      env:
+        NEXT: ${{ steps.version.outputs.next }}
+        BOT_NAME: ${{ steps.identity.outputs.name }}
+        BOT_EMAIL: ${{ steps.identity.outputs.email }}
+      run: |
+        set -euo pipefail
+        git config user.name "${BOT_NAME}"
+        git config user.email "${BOT_EMAIL}"
+        git add pyproject.toml
+        git commit -m "Release ${NEXT}"
+        git tag -a "v${NEXT}" -m "Release ${NEXT}"
+        git push --atomic origin HEAD:main "refs/tags/v${NEXT}"
+
+    - name: Publish to PyPI
+      if: steps.bump.outputs.level != 'none'
+      # Last, because it is the one thing that cannot be taken back. A failure
+      # here leaves a tag naming a version that is not on the index, which is a
+      # tag to delete and a number still free to reuse. That is the cheap half
+      # of the only trade available: there is no transaction across an index and
+      # a git remote, so something has to be the orphan, and a deletable tag is
+      # a better orphan than an unpublishable version.
+      #
+      # One index. A rehearsal that is allowed to fail protects nothing, and one
+      # that is not blocks releases on an index that expires its projects. The
+      # rehearsal belongs on pull requests, where it is free, and that is where
+      # it is.
+      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+
+    - name: Announce it
+      if: steps.bump.outputs.level != 'none'
+      env:
+        GH_TOKEN: ${{ github.token }}
+        NEXT: ${{ steps.version.outputs.next }}
+      run: |-
+        set -euo pipefail
+        gh release create "v${NEXT}" \
+          --title "v${NEXT}" \
+          --notes "\`uvx logseq-md@${NEXT} --help\`" \
+          --generate-notes \
+          --verify-tag