@intentius/chant 0.100.0 → 0.102.0

package/src/lifecycle/plan-digest.test.ts

@@ -1,5 +1,7 @@
 import { describe, test, expect } from "vitest";
-import { computePlanDigest, isPlanDigest, describePlanDigest } from "./plan-digest";
+import { canonicalJson } from "../effect-receipt";
+import { contentDigest } from "../content-digest";
+import { computePlanDigest, isPlanDigest, describePlanDigest, samePlanDigest, PLAN_DIGEST_PREFIX } from "./plan-digest";
 
 describe("computePlanDigest", () => {
   test("the same change set digests the same, whatever order its keys arrived in", () => {
@@ -23,19 +25,68 @@ describe("computePlanDigest", () => {
     );
   });
 
-  test("it is a sha256 digest, in the shape isPlanDigest accepts", () => {
+  test("it is a versioned jcs1-sha256 digest, in the shape isPlanDigest accepts", () => {
     const digest = computePlanDigest("terraform-plan", {});
-    expect(digest).toMatch(/^sha256:[0-9a-f]{64}$/);
+    expect(digest).toMatch(/^jcs1-sha256:[0-9a-f]{64}$/);
+    expect(digest.startsWith(PLAN_DIGEST_PREFIX)).toBe(true);
     expect(isPlanDigest(digest)).toBe(true);
   });
+
+  test("it hashes the same bytes the bare sha256: digest of chant before #2547 did", () => {
+    const subject = { b: [1, { y: 2, x: 1 }], a: "\u00e9" };
+    const legacy = contentDigest(canonicalJson({ kind: "k", subject }));
+    expect(computePlanDigest("k", subject)).toBe(`jcs1-${legacy}`);
+  });
+});
+
+describe("the canonical form is RFC 8785", () => {
+  test("it sorts keys by UTF-16 code unit, as RFC 8785 section 3.2.3 does", () => {
+    // The RFC's own example: these keys in this order.
+    const keys = ["\r", "1", "\u0080", "\u00f6", "\u20ac", "\ud83d\ude00", "\ufb33"];
+    const reversed = [...keys].reverse();
+    const value = Object.fromEntries(reversed.map((k) => [k, reversed.indexOf(k)]));
+    // Written out by hand because Object.keys puts "1" first, whatever order a key was added in.
+    expect(canonicalJson(value)).toBe(`{${keys.map((k) => `${JSON.stringify(k)}:${reversed.indexOf(k)}`).join(",")}}`);
+  });
+
+  test("it writes numbers as ECMAScript does, which is what RFC 8785 section 3.2.2 specifies", () => {
+    expect(canonicalJson([1e21, 1e-7, 0.000001, -0, 4.5, 333333333.33333329])).toBe("[1e+21,1e-7,0.000001,0,4.5,333333333.3333333]");
+  });
+});
+
+describe("samePlanDigest", () => {
+  const hex = "a".repeat(64);
+  test("a digest recorded under the bare prefix is the same plan as the jcs1 one", () => {
+    expect(samePlanDigest(`sha256:${hex}`, `jcs1-sha256:${hex}`)).toBe(true);
+    expect(samePlanDigest(`jcs1-sha256:${hex}`, `sha256:${hex}`)).toBe(true);
+    expect(samePlanDigest(`sha256:${hex}`, `sha256:${hex}`)).toBe(true);
+  });
+
+  test("a different hash is a different plan, in either prefix", () => {
+    expect(samePlanDigest(`sha256:${hex}`, `jcs1-sha256:${"b".repeat(64)}`)).toBe(false);
+  });
+
+  test("a value that is not a plan digest matches only itself", () => {
+    expect(samePlanDigest("anything", "anything")).toBe(true);
+    expect(samePlanDigest("anything", `sha256:${hex}`)).toBe(false);
+    expect(samePlanDigest(undefined, `sha256:${hex}`)).toBe(false);
+    expect(samePlanDigest(undefined, undefined)).toBe(true);
+  });
 });
 
 describe("isPlanDigest", () => {
+  test("accepts both prefixes, since gates recorded before #2547 carry the bare one", () => {
+    expect(isPlanDigest(`sha256:${"a".repeat(64)}`)).toBe(true);
+    expect(isPlanDigest(`jcs1-sha256:${"a".repeat(64)}`)).toBe(true);
+  });
+
   test("refuses everything a copy-paste or a path could be", () => {
     expect(isPlanDigest("chant.tfplan")).toBe(false);
     expect(isPlanDigest(`sha256:${"a".repeat(63)}`)).toBe(false);
     expect(isPlanDigest("a".repeat(64))).toBe(false);
     expect(isPlanDigest(`sha256:${"A".repeat(64)}`)).toBe(false);
+    expect(isPlanDigest(`jcs2-sha256:${"a".repeat(64)}`)).toBe(false);
+    expect(isPlanDigest(`jcs1-sha256:${"a".repeat(63)}`)).toBe(false);
     expect(isPlanDigest(undefined)).toBe(false);
     expect(isPlanDigest(12)).toBe(false);
   });

package/src/lifecycle/plan-digest.ts

@@ -39,11 +39,22 @@
 import { canonicalJson } from "../effect-receipt";
 import { contentDigest } from "../content-digest";
 
-/** The hash a plan digest is taken with, and the prefix every digest carries. */
+/** The hash a plan digest is taken with. */
 export const PLAN_DIGEST_ALGORITHM = "sha256";
 
-/** Shape of a well-formed digest: `sha256:` and 64 lowercase hex characters. */
-const PLAN_DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;
+/**
+ * The version prefix a plan digest is written with since #2547: `jcs1` names
+ * the input form (the RFC 8785 canonical JSON of `{ kind, subject }`, see
+ * `canonicalJson` in ../effect-receipt.ts) and `sha256` the hash. A later
+ * input form gets a new prefix, so a digest always says how it was made.
+ */
+export const PLAN_DIGEST_PREFIX = "jcs1-sha256:";
+
+/** The bare prefix every digest written before #2547 carries. Still read, never written for a plan. */
+export const LEGACY_PLAN_DIGEST_PREFIX = "sha256:";
+
+/** Shape of a well-formed digest: either prefix, then 64 lowercase hex characters. */
+const PLAN_DIGEST_PATTERN = /^(?:jcs1-)?sha256:([0-9a-f]{64})$/;
 
 /**
  * Hash a plan's change set into a stable identity.
@@ -60,21 +71,40 @@ const PLAN_DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;
  * versions, does not change the answer. It is the caller's job to
  * hand in a projection that already excludes the volatile fields this
  * module's doc comment lists.
+ *
+ * The result is `jcs1-sha256:<hex>` (#2547). Before that it was
+ * `sha256:<hex>` over the same bytes, so the hex is unchanged and
+ * {@link samePlanDigest} treats the two spellings as one digest: a gate
+ * recorded under the old prefix still matches the plan it was approved for.
  */
 export function computePlanDigest(kind: string, subject: unknown): string {
-  return contentDigest(canonicalJson({ kind, subject }));
+  return PLAN_DIGEST_PREFIX + contentDigest(canonicalJson({ kind, subject })).slice(LEGACY_PLAN_DIGEST_PREFIX.length);
 }
 
 /**
- * Whether `raw` is a digest this code produced. Used at the `chant approve
- * --plan` boundary, so a typo, a truncated copy-paste or a plan *file* path
- * is refused before it is written into an immutable resolution that would
- * then never match anything.
+ * Whether `raw` is a digest this code produced, in either prefix. Used at the
+ * `chant approve --plan` boundary, so a typo, a truncated copy-paste or a plan
+ * *file* path is refused before it is written into an immutable resolution
+ * that would then never match anything.
  */
 export function isPlanDigest(raw: unknown): raw is string {
   return typeof raw === "string" && PLAN_DIGEST_PATTERN.test(raw);
 }
 
+/**
+ * Whether two recorded or computed plan digests name the same plan. Two
+ * well-formed plan digests are the same when their hex is, whichever prefix
+ * each carries (read both, write new, #2547). Anything else, such as a
+ * release plan's own digest, is the same only when the strings are equal.
+ */
+export function samePlanDigest(a: string | undefined, b: string | undefined): boolean {
+  if (a === b) return true;
+  if (a === undefined || b === undefined) return false;
+  const x = PLAN_DIGEST_PATTERN.exec(a);
+  const y = PLAN_DIGEST_PATTERN.exec(b);
+  return x !== null && y !== null && x[1] === y[1];
+}
+
 /**
  * A digest as it reads in a message, and the one place that decides how an
  * absent one reads. Records written before #2300 carry no digest at all, and

package/src/lifecycle/snapshot.ts

@@ -18,7 +18,7 @@ import { formatUnobserved, normalizeObservation, unobservedAll, type UnobservedE
 // property tree is ever rendered or committed. Two lists would eventually
 // disagree about what counts as a secret.
 import { isSensitiveKey } from "../deep-observation";
-import { isResourceDeclarable } from "../declarable";
+import { isObservableDeclarable } from "../declarable";
 
 /**
  * Check for potential sensitive data in resource attributes and return warnings.
@@ -128,7 +128,7 @@ export async function takeSnapshot(
     for (const [name, entity] of buildResult.entities) {
       // Resource declarables only — outputs, parameters and serializer
       // directives have no live counterpart (see lifecycle/observe.ts).
-      if (entity.lexicon === plugin.name && isResourceDeclarable(entity)) {
+      if (entity.lexicon === plugin.name && isObservableDeclarable(entity)) {
         entityNames.push(name);
         entities.set(name, {
           entityType: entity.entityType,

package/src/lifecycle/work-lease.test.ts

@@ -107,7 +107,7 @@ describe("a work lease in one clone", () => {
 
     const again = await claimWorkLease("W-003", "carol", { cwd, ttlMs: 1_000, now: at(t0) });
     if (!again.ok) throw new Error(again.message);
-    const closed = await releaseWorkLease("W-003", "dispatcher", { cwd, outcome: "expired", now: at("2026-09-25T11:00:00.000Z") });
+    const closed = await releaseWorkLease("W-003", "dispatcher", { cwd, outcome: "abandoned", now: at("2026-09-25T11:00:00.000Z") });
     expect(closed).toMatchObject({ ok: true, lease: { holder: "carol" } });
   });
 

package/src/lifecycle/work-lease.ts

@@ -100,6 +100,93 @@ export interface WorkLeaseState extends WorkLease {
   ref: string;
 }
 
+/**
+ * How a work lease can end (#3147): the closed list of outcomes a release
+ * records. A new outcome is a contract change. Readers of an older history
+ * may still find free text from before the list was closed, which counts as
+ * an attempt (see {@link outcomeCountsAsAttempt}).
+ */
+export const WORK_LEASE_OUTCOMES = [
+  /** The work was finished: built, checked and recorded. */
+  "done",
+  /** A build ran and did not finish, or the run failed. Counts as an attempt. */
+  "not_done",
+  /** An expired lease closed out by someone other than its holder: the worker went away. Counts as an attempt. */
+  "abandoned",
+  /** The run stopped at a gate, waiting for an approval. */
+  "gated",
+  /** The run stopped on a decision point's open question, waiting for a person. */
+  "waiting",
+  /** The item was dropped, such as by a refuse at the understand point. Nothing was built. */
+  "dropped",
+  /** The understand point answered redraft: the item goes back to its author. Nothing was built. */
+  "redraft",
+  /** The understand point answered ask: the item waits on a question to its author. Nothing was built. */
+  "ask",
+] as const;
+export type WorkLeaseOutcome = (typeof WORK_LEASE_OUTCOMES)[number];
+
+/** The outcomes that count toward an item's attempt limit. */
+export const ATTEMPT_OUTCOMES: readonly WorkLeaseOutcome[] = ["not_done", "abandoned"];
+
+/** Whether `value` is one of {@link WORK_LEASE_OUTCOMES}. */
+export function isWorkLeaseOutcome(value: unknown): value is WorkLeaseOutcome {
+  return typeof value === "string" && (WORK_LEASE_OUTCOMES as readonly string[]).includes(value);
+}
+
+/**
+ * Whether a release with `outcome` counts toward the item's attempt limit:
+ * `not_done` and `abandoned` do, and so does a release that gave no outcome
+ * or one outside the closed list (free text written before #3147), since
+ * nothing says the work got anywhere.
+ */
+export function outcomeCountsAsAttempt(outcome: string | null | undefined): boolean {
+  if (!isWorkLeaseOutcome(outcome)) return true;
+  return ATTEMPT_OUTCOMES.includes(outcome);
+}
+
+/** The ref prefix that keeps an unfinished attempt's work (#3147). */
+export const KEPT_REF_PREFIX = "refs/chant/kept/";
+
+/**
+ * Where the work of an attempt that ended `not_done` is kept: one ref per
+ * lease token, `refs/chant/kept/[<member>/...]<item>/<token>`, scoped by the
+ * members the way the work branch `chant/work/[<member>/]<item>` is.
+ */
+export function keptAttemptRef(id: string, token: string, members: readonly string[] = []): string {
+  return `${keptAttemptPrefix(id, members)}${token}`;
+}
+
+/** The prefix under which every kept attempt of item `id` sits. */
+export function keptAttemptPrefix(id: string, members: readonly string[] = []): string {
+  return `${KEPT_REF_PREFIX}${members.length ? `${members.join("/")}/` : ""}${id}/`;
+}
+
+/** One kept attempt, as `work history` lists it. */
+export interface KeptAttempt {
+  /** The lease token the attempt ran under. */
+  token: string;
+  ref: string;
+  /** The commit the ref points at. */
+  commit: string;
+}
+
+/** Every kept attempt of item `id`, from the local refs, sorted by ref. Empty outside git. */
+export async function listKeptAttempts(id: string, opts: { cwd: string; members?: readonly string[] }): Promise<KeptAttempt[]> {
+  const prefix = keptAttemptPrefix(id, opts.members ?? []);
+  const out = await getRuntime().spawn(["git", "for-each-ref", "--format=%(refname) %(objectname)", prefix], { cwd: opts.cwd });
+  if (out.exitCode !== 0) return [];
+  return out.stdout
+    .split("\n")
+    .filter(Boolean)
+    .map((line) => {
+      const [ref, commit] = line.split(" ");
+      return { token: ref.slice(prefix.length), ref, commit };
+    })
+    .filter((k) => k.token !== "" && !k.token.includes("/"))
+    .sort((a, b) => (a.ref < b.ref ? -1 : a.ref > b.ref ? 1 : 0));
+}
+
 /** One line of `_leases/<id>.jsonl`. */
 export interface LeaseHistoryRecord {
   version: 1;
@@ -115,7 +202,7 @@ export interface LeaseHistoryRecord {
   expiresAt: string;
   /** When the event happened. */
   timestamp: string;
-  /** How the work ended, on a release. Free text such as done, not_done or skipped. */
+  /** How the work ended, on a release: one of {@link WORK_LEASE_OUTCOMES}, or free text in a line written before #3147. */
   outcome?: string;
   note?: string;
 }
@@ -257,7 +344,8 @@ async function finish(
 /**
  * Give the lease on `id` back. The holder releases a live lease (with
  * `token`, only that one); anyone may release an expired one, which is how an
- * abandoned claim is closed out. `outcome` says how the work ended. Refused
+ * abandoned claim is closed out. `outcome` says how the work ended, from the
+ * closed list {@link WORK_LEASE_OUTCOMES}; any other value throws. Refused
  * with `lease-not-held` when there is no lease, and `lease-held` when someone
  * else holds it live.
  */
@@ -267,6 +355,9 @@ export async function releaseWorkLease(
   opts: WorkLeaseOptions & { token?: string; outcome?: string; note?: string },
 ): Promise<WorkLeaseResult> {
   checkId(id);
+  if (opts.outcome !== undefined && !isWorkLeaseOutcome(opts.outcome)) {
+    throw new Error(`${JSON.stringify(opts.outcome)} is not a work lease outcome: use one of ${WORK_LEASE_OUTCOMES.join(", ")}`);
+  }
   const key = workLeaseKey(id);
   const now = opts.now?.() ?? new Date();
   const { record } = await readLease(key, { cwd: opts.cwd });

package/src/lint/engine.test.ts

@@ -6,6 +6,61 @@ import { writeFile } from "node:fs/promises";
 import { join } from "node:path";
 
 describe("runLint", () => {
+  // #2511
+  test("a rule that throws is an error for that file, and the other rules still run", async () => {
+    await withTestDir(async (testDir) => {
+      const testFile = join(testDir, "test.ts");
+      await writeFile(testFile, "const x = 1;");
+
+      const throwing: LintRule = {
+        id: "throws",
+        severity: "warning",
+        category: "correctness",
+        check: () => {
+          throw new Error("bad input");
+        },
+      };
+      const after: LintRule = {
+        id: "after",
+        severity: "warning",
+        category: "correctness",
+        check: (context: LintContext): LintDiagnostic[] => [
+          { file: context.filePath, line: 1, column: 1, ruleId: "after", severity: "warning", message: "ran" },
+        ],
+      };
+
+      const { diagnostics } = await runLint([testFile], [throwing, after]);
+
+      expect(diagnostics.map((d) => d.ruleId).sort()).toEqual(["after", "throws"]);
+      const threw = diagnostics.find((d) => d.ruleId === "throws")!;
+      expect(threw.severity).toBe("error");
+      expect(threw.file).toBe(testFile);
+      expect(threw.message).toBe(`Rule throws threw while checking ${testFile}: bad input`);
+    });
+  });
+
+  test("a disable comment does not suppress a rule's failure", async () => {
+    await withTestDir(async (testDir) => {
+      const testFile = join(testDir, "test.ts");
+      await writeFile(testFile, "// chant-disable\nconst x = 1;");
+
+      const throwing: LintRule = {
+        id: "throws",
+        severity: "warning",
+        category: "correctness",
+        check: () => {
+          throw "not an Error";
+        },
+      };
+
+      const { diagnostics, suppressed } = await runLint([testFile], [throwing]);
+
+      expect(suppressed).toHaveLength(0);
+      expect(diagnostics).toHaveLength(1);
+      expect(diagnostics[0].message).toContain("not an Error");
+    });
+  });
+
   test("executes rules and returns diagnostics", async () => {
     await withTestDir(async (testDir) => {
       const testFile = join(testDir, "test.ts");

package/src/lint/engine.ts

@@ -189,6 +189,23 @@ function isDiagnosticDisabled(
   return { suppressed: false };
 }
 
+/**
+ * The error reported when a rule throws while checking a file (#2511). It
+ * names the rule, the file and the thrown message, at error severity so
+ * `chant lint` exits non-zero.
+ */
+export function ruleThrewDiagnostic(ruleId: string, filePath: string, error: unknown): LintDiagnostic {
+  const message = error instanceof Error ? error.message : String(error);
+  return {
+    file: filePath,
+    line: 1,
+    column: 1,
+    ruleId,
+    severity: "error",
+    message: `Rule ${ruleId} threw while checking ${filePath}: ${message}`,
+  };
+}
+
 /**
  * Execute lint rules on a set of files
  * @param files - Array of file paths to lint
@@ -246,11 +263,17 @@ export async function runLint(
         propertyClasses,
       };
 
-      // Execute each rule
+      // Execute each rule. A rule that throws is reported as an error for
+      // this file (#2511) and the remaining rules still run.
+      const ruleErrors: LintDiagnostic[] = [];
       for (const rule of rules) {
         const options = ruleOptions?.get(rule.id);
-        const diagnostics = rule.check(context, options);
-        allDiagnostics.push(...diagnostics);
+        try {
+          const diagnostics = rule.check(context, options);
+          allDiagnostics.push(...diagnostics);
+        } catch (error) {
+          ruleErrors.push(ruleThrewDiagnostic(rule.id, filePath, error));
+        }
       }
 
       // Partition file diagnostics into active and suppressed
@@ -269,7 +292,10 @@ export async function runLint(
 
       // Replace file diagnostics with filtered ones
       allDiagnostics.length = 0;
-      allDiagnostics.push(...otherFileDiags, ...keptDiags);
+      // A rule's own failure is never suppressed by a disable comment: the
+      // comment is aimed at the rule's findings, and hiding the failure would
+      // make a rule that did not run look like a clean lint.
+      allDiagnostics.push(...otherFileDiags, ...keptDiags, ...ruleErrors);
     } catch (error) {
       // If parsing fails, skip this file and continue with others
       continue;

package/src/lint/output-docs.test.ts

@@ -1,6 +1,7 @@
 import { describe, test, expect } from "vitest";
 import { parseOutputDocs, pick, get } from "./output-docs";
 import type { SerializerResult } from "../serializer";
+import { load as jsYamlLoad } from "js-yaml";
 
 describe("parseOutputDocs", () => {
   test("parses a single JSON output as one document", () => {
@@ -156,65 +157,67 @@ describe("parseOutputDocs", () => {
       expect(bad.value).toBeUndefined();
     });
   });
-});
-
-describe("pick", () => {
-  interface Widget {
-    kind: string;
-    name: string;
-    extra: unknown;
-  }
-
-  test("returns only the named keys that are present", () => {
-    const value = { kind: "Deployment", name: "web", other: "ignored" };
-    expect(pick<Widget>(value, ["kind", "name"])).toEqual({ kind: "Deployment", name: "web" });
-  });
-
-  test("omits a named key that is absent — no invented default", () => {
-    const value = { kind: "Deployment" };
-    expect(pick<Widget>(value, ["kind", "name"])).toEqual({ kind: "Deployment" });
-  });
-
-  test("returns an empty object for a non-object value", () => {
-    expect(pick<Widget>(null, ["kind"])).toEqual({});
-    expect(pick<Widget>("a string", ["kind"])).toEqual({});
-    expect(pick<Widget>(undefined, ["kind"])).toEqual({});
-  });
-
-  test("copies values through unvalidated, whatever their actual shape", () => {
-    const value = { kind: 42 }; // wrong runtime type for `kind: string`
-    expect(pick<Widget>(value, ["kind"])).toEqual({ kind: 42 });
-  });
-});
-
-describe("get", () => {
-  test("walks a dotted path through nested objects", () => {
-    const value = { spec: { template: { spec: { containers: [] } } } };
-    expect(get(value, "spec.template.spec")).toEqual({ containers: [] });
-  });
-
-  test("returns undefined as soon as a segment is missing", () => {
-    const value = { spec: {} };
-    expect(get(value, "spec.template.spec")).toBeUndefined();
-  });
 
-  test("returns undefined when an intermediate value is not indexable", () => {
-    const value = { spec: "not-an-object" };
-    expect(get(value, "spec.template")).toBeUndefined();
-  });
+  // #2925: hand-written and third-party YAML (`chant audit`, test fixtures)
+  // uses flow collections and folded scalars. Each case is checked against
+  // js-yaml, so the expected value is what a full parser reads.
+  describe("YAML a hand-written manifest uses (#2925)", () => {
+    const docOf = (yaml: string): unknown => {
+      const docs = parseOutputDocs(new Map<string, string | SerializerResult>([["k8s", yaml]]));
+      expect(docs).toHaveLength(1);
+      expect(docs[0].error).toBeUndefined();
+      return docs[0].value;
+    };
 
-  test("indexes into arrays with a numeric path segment", () => {
-    const value = { items: [{ name: "first" }, { name: "second" }] };
-    expect(get(value, "items.1.name")).toBe("second");
-  });
+    test("flow mappings read as mappings, not strings", () => {
+      const yaml = [
+        "apiVersion: apps/v1",
+        "kind: Deployment",
+        "metadata: { name: gw, namespace: obs }",
+        "spec:",
+        "  template:",
+        "    spec:",
+        "      volumes:",
+        "        - name: conf",
+        "          configMap: { name: gw-config }",
+      ].join("\n");
+      const value = docOf(yaml);
+      expect(value).toEqual(jsYamlLoad(yaml));
+      expect(get(value, "metadata.namespace")).toBe("obs");
+      expect(get(value, "spec.template.spec.volumes.0.configMap.name")).toBe("gw-config");
+    });
 
-  test("returns the value itself for an empty path", () => {
-    const value = { a: 1 };
-    expect(get(value, "")).toBe(value);
-  });
+    test("a flow sequence of flow mappings reads as a list of mappings", () => {
+      const yaml = [
+        "kind: Pod",
+        "spec:",
+        "  containers:",
+        "    - name: gw",
+        "      volumeMounts: [{ name: conf, mountPath: /conf }, { name: data, mountPath: /data, readOnly: true }]",
+        "      args: [--config, /conf/config.yaml]",
+      ].join("\n");
+      const value = docOf(yaml);
+      expect(value).toEqual(jsYamlLoad(yaml));
+      expect(get(value, "spec.containers.0.volumeMounts.1.readOnly")).toBe(true);
+      expect(get(value, "spec.containers.0.args")).toEqual(["--config", "/conf/config.yaml"]);
+    });
 
-  test("does not throw on null/undefined input", () => {
-    expect(get(null, "a.b")).toBeUndefined();
-    expect(get(undefined, "a.b")).toBeUndefined();
+    test("a folded scalar keeps the line breaks of its more-indented lines", () => {
+      // js-yaml dumps a long ConfigMap value this way.
+      const yaml = [
+        "kind: ConfigMap",
+        "data:",
+        "  config.yaml: >",
+        "    receivers:",
+        "      k8s_cluster:",
+        "        auth_type: serviceAccount",
+        "    exporters: {}",
+      ].join("\n");
+      const value = docOf(yaml);
+      expect(value).toEqual(jsYamlLoad(yaml));
+      expect((value as { data: Record<string, string> }).data["config.yaml"]).toBe(
+        "receivers:\n  k8s_cluster:\n    auth_type: serviceAccount\nexporters: {}\n",
+      );
+    });
   });
 });

package/src/op/activities/activity-contracts.ts

@@ -153,6 +153,7 @@ export const proposeWorkspaceUpgradeContract = activityContract(
     base: z.string().optional(),
     remote: z.string().optional(),
     allowCode: z.boolean().optional(),
+    source: z.string().optional(),
     cwd: z.string().optional(),
   }),
   z.object({