@intentius/chant 0.34.1 → 0.37.0

package/src/lifecycle/rollback.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect } from "vitest";
-import { rollbackBranchName, rollbackTitle, rollbackBody } from "./rollback";
+import { rollbackBranchName, rollbackTitle, rollbackBody, rollbackToRevision } from "./rollback";
 
 describe("rollback helpers (#873)", () => {
   test("branch name includes env and short ref", () => {
@@ -23,3 +23,80 @@ describe("rollback helpers (#873)", () => {
     expect(body).toMatch(/approval gate|Sync|apply/i);
   });
 });
+
+// A dry run has to work where the PR path cannot: no remote, no `gh`, and the
+// repository left exactly as it was found. That is what makes chant#1208's
+// round-trip demonstrable offline instead of only asserting the noop case.
+describe("rollbackToRevision --dry-run", () => {
+  const git = async (args: string[], cwd: string) => {
+    const { promisify } = await import("node:util");
+    const { execFile } = await import("node:child_process");
+    return promisify(execFile)("git", args, { cwd });
+  };
+
+  /** A throwaway repo with two commits and NO remote configured. */
+  async function repoWithTwoCommits(): Promise<{ dir: string; base: string }> {
+    const { mkdtempSync, mkdirSync, writeFileSync } = await import("node:fs");
+    const { tmpdir } = await import("node:os");
+    const { join } = await import("node:path");
+    const dir = mkdtempSync(join(tmpdir(), "chant-rollback-test-"));
+    mkdirSync(join(dir, "src"));
+    await git(["init", "-q"], dir);
+    await git(["config", "user.email", "t@example.com"], dir);
+    await git(["config", "user.name", "t"], dir);
+    writeFileSync(join(dir, "src", "main.ts"), "export const a = 1;\n");
+    await git(["add", "-A"], dir);
+    await git(["commit", "-qm", "v1"], dir);
+    const base = (await git(["rev-parse", "HEAD"], dir)).stdout.trim();
+    writeFileSync(join(dir, "src", "main.ts"), "export const a = 2;\n");
+    await git(["add", "-A"], dir);
+    await git(["commit", "-qm", "v2"], dir);
+    return { dir, base };
+  }
+
+  test("returns the delta without a remote, and leaves no branch behind", async () => {
+    const { dir, base } = await repoWithTwoCommits();
+    const before = (await git(["branch", "--format=%(refname:short)"], dir)).stdout.trim();
+
+    const result = await rollbackToRevision({ ref: base, env: "local", sourceDir: "src", cwd: dir, dryRun: true });
+
+    expect(result.noop).toBe(false);
+    expect(result.prUrl).toBeUndefined();
+    expect(result.diff).toContain("-export const a = 2;");
+    expect(result.diff).toContain("+export const a = 1;");
+
+    // Nothing persisted: same branches as before, and the working tree still
+    // holds the NEW content — a dry run reports, it does not roll back.
+    const after = (await git(["branch", "--format=%(refname:short)"], dir)).stdout.trim();
+    expect(after).toBe(before);
+    const { readFileSync } = await import("node:fs");
+    const { join } = await import("node:path");
+    expect(readFileSync(join(dir, "src", "main.ts"), "utf8")).toContain("a = 2");
+  });
+
+  test("removes a file added since the ref — a per-path checkout leaves it, and that read as noop (#1327)", async () => {
+    // The shape a reconcile produces: `chant import --from <env>` writes NEW
+    // files rather than editing the authored ones, so the whole difference from
+    // the pre-reconcile revision is additions. `git checkout <ref> -- <dir>`
+    // never touches those, so rollback used to report "nothing to roll back".
+    const { dir, base } = await repoWithTwoCommits();
+    const { writeFileSync } = await import("node:fs");
+    const { join } = await import("node:path");
+    writeFileSync(join(dir, "src", "generated.ts"), "export const added = true;\n");
+    await git(["add", "-A"], dir);
+    await git(["commit", "-qm", "reconciled: a new file"], dir);
+
+    const result = await rollbackToRevision({ ref: base, env: "local", sourceDir: "src", cwd: dir, dryRun: true });
+
+    expect(result.noop).toBe(false);
+    expect(result.diff).toContain("src/generated.ts");
+    expect(result.diff).toContain("deleted file");
+  });
+
+  test("still reports noop when the source already matches the ref", async () => {
+    const { dir } = await repoWithTwoCommits();
+    const result = await rollbackToRevision({ ref: "HEAD", env: "local", sourceDir: "src", cwd: dir, dryRun: true });
+    expect(result.noop).toBe(true);
+    expect(result.diff).toBeUndefined();
+  });
+});

package/src/lifecycle/rollback.ts

@@ -40,19 +40,37 @@ export interface RollbackResult {
   noop: boolean;
   branch?: string;
   prUrl?: string;
+  /**
+   * The rollback delta as a unified diff — present only for a `dryRun`, where
+   * it is the whole point: the PR body's diff is what a reviewer would act on,
+   * so producing it without a PR is what makes the delta inspectable offline.
+   */
+  diff?: string;
 }
 
 /**
  * Open a rollback PR restoring `sourceDir` to `ref`. Isolated worktree; the
  * caller's branch is untouched. Throws on an unknown ref or a git/gh failure.
+ *
+ * `dryRun` computes the same delta and returns it as a diff without pushing a
+ * branch or opening a PR, leaving the repository exactly as it found it.
+ *
+ * That mode exists because the PR path needs a GitHub remote and an
+ * authenticated `gh` — reasonable for the operator flow this was built for
+ * (#873), and impossible for a hermetic acceptance run. chant#1208's CC
+ * round-trip has to demonstrate rollback offline, on an emulator, with no
+ * remote in the picture; without this it could only assert the `noop` case,
+ * which exercises none of the interesting work.
  */
 export async function rollbackToRevision(opts: {
   ref: string;
   env: string | undefined;
   sourceDir: string;
   cwd: string;
+  /** Compute and return the delta; open no PR, push nothing, leave no branch. */
+  dryRun?: boolean;
 }): Promise<RollbackResult> {
-  const { ref, env, sourceDir, cwd } = opts;
+  const { ref, env, sourceDir, cwd, dryRun } = opts;
   const git = (args: string[], wd: string): Promise<{ stdout: string }> => execFileAsync("git", args, { cwd: wd });
 
   const repoRoot = (await git(["rev-parse", "--show-toplevel"], cwd)).stdout.trim();
@@ -64,11 +82,28 @@ export async function rollbackToRevision(opts: {
 
   await git(["worktree", "add", wt, "-b", branch, "HEAD"], repoRoot);
   try {
-    // Restore just the source tree to the target revision (stages the changes).
+    // Restore the source tree to the target revision (stages the changes).
+    //
+    // `git checkout <ref> -- <dir>` alone is a PER-PATH checkout, not a tree
+    // replacement: it restores the paths that exist at `ref` and leaves
+    // everything else untouched, so a file added since `ref` survives. That
+    // made rollback report "nothing to roll back" whenever the only difference
+    // was added files (#1327) — which is exactly what a reconcile produces,
+    // since `chant import --from <env>` writes NEW files rather than editing
+    // the authored ones. Clearing the directory first makes this a real
+    // restore, so the deletions show up in the delta.
+    await git(["rm", "-rq", "--ignore-unmatch", "--", sourceDir], wt);
     await git(["checkout", ref, "--", sourceDir], wt);
     const staged = (await git(["status", "--porcelain", "--", sourceDir], wt)).stdout.trim();
     if (!staged) return { noop: true };
 
+    // The delta, before committing: `git diff` against the index shows exactly
+    // what restoring the source to `ref` changes. A dry run stops here.
+    if (dryRun) {
+      const { stdout } = await git(["diff", "--cached", "--", sourceDir], wt);
+      return { noop: false, branch, diff: stdout };
+    }
+
     await git(["commit", "-m", rollbackTitle(env, ref)], wt);
     await git(["push", "-u", "origin", branch], wt);
     const { stdout } = await execFileAsync(
@@ -79,5 +114,9 @@ export async function rollbackToRevision(opts: {
     return { noop: false, branch, prUrl: stdout.trim() };
   } finally {
     await git(["worktree", "remove", "--force", wt], repoRoot).catch(() => {});
+    // Removing the worktree leaves its branch behind. For the PR path that is
+    // correct — the branch is the PR. A dry run must leave nothing, or a repo
+    // accumulates a `chant/rollback-*` branch per inspection.
+    if (dryRun) await git(["branch", "-D", branch], repoRoot).catch(() => {});
   }
 }

package/src/lifecycle/status.test.ts

@@ -37,8 +37,18 @@ describe("status", () => {
         ],
       };
       const evidence = liveEvidenceFromChangeSet(cs);
-      expect(evidence.get("search-service")).toEqual({ live: true, action: "noop", ownership: "owned" });
-      expect(evidence.get("orphan-thing")).toEqual({ live: true, action: "adopt", ownership: "foreign" });
+      expect(evidence.get("search-service")).toEqual({
+          live: true,
+          action: "noop",
+          ownership: "owned",
+          rollup: { total: 1, present: 1, absent: 0, unobserved: 0 },
+        });
+      expect(evidence.get("orphan-thing")).toEqual({
+        live: true,
+        action: "adopt",
+        ownership: "foreign",
+        rollup: { total: 1, present: 1, absent: 0, unobserved: 0 },
+      });
     });
 
     // #598: a component's name need not equal the live entity/resource name
@@ -54,7 +64,15 @@ describe("status", () => {
         };
         const mapping: LiveNameMapping = new Map([["search-svc", ["search-service-v2"]]]);
         const evidence = liveEvidenceFromChangeSet(cs, mapping);
-        expect(evidence.get("search-svc")).toEqual({ live: true, action: "noop", ownership: "owned" });
+        // The merged verdict, plus the per-resource counts it collapsed
+        // (behold#98) — a consumer with no deploy object to read paints from
+        // those rather than from a CloudFormation stack.
+        expect(evidence.get("search-svc")).toEqual({
+          live: true,
+          action: "noop",
+          ownership: "owned",
+          rollup: { total: 1, present: 1, absent: 0, unobserved: 0 },
+        });
         // The live entity's own name is no longer a separate top-level key once
         // it's claimed by an explicit mapping's component.
       });
@@ -68,7 +86,14 @@ describe("status", () => {
         };
         const mapping: LiveNameMapping = new Map([["some-other-component", ["renamed-thing"]]]);
         const evidence = liveEvidenceFromChangeSet(cs, mapping);
-        expect(evidence.get("search-service")).toEqual({ live: true, action: "noop", ownership: "owned" });
+        // A rollup of one: the identity join still reports the shape, so a
+        // consumer never branches on whether a mapping was configured.
+        expect(evidence.get("search-service")).toEqual({
+          live: true,
+          action: "noop",
+          ownership: "owned",
+          rollup: { total: 1, present: 1, absent: 0, unobserved: 0 },
+        });
       });
 
       test("aggregates evidence across several live names owned by one component", () => {
@@ -82,7 +107,12 @@ describe("status", () => {
         const mapping: LiveNameMapping = new Map([["neo4j-cluster", ["cluster-node-1", "cluster-node-2"]]]);
         const evidence = liveEvidenceFromChangeSet(cs, mapping);
         // Drift on any owned entity surfaces as drift for the component.
-        expect(evidence.get("neo4j-cluster")).toEqual({ live: true, action: "update", ownership: "owned" });
+        expect(evidence.get("neo4j-cluster")).toEqual({
+          live: true,
+          action: "update",
+          ownership: "owned",
+          rollup: { total: 2, present: 2, absent: 0, unobserved: 0 },
+        });
       });
 
       test("a mapped component with none of its live names observed has no evidence entry", () => {
@@ -135,6 +165,39 @@ describe("status", () => {
       expect(rows[0].reconciliation).toBe("drifted");
     });
 
+    // behold#98 — floci-az and floci-gcp have no deploy object, so `stack` is
+    // absent and a renderer has nothing provider-native to colour from. The
+    // rollup is the substrate-neutral source for the same job.
+    test("surfaces a resource rollup for a component with no deploy object", () => {
+      const liveEvidence = new Map<string, LiveComponentEvidence>([
+        [
+          "search-service",
+          { live: true, ownership: "owned", rollup: { total: 4, present: 3, absent: 0, unobserved: 1 } },
+        ],
+      ]);
+      const rows = reconcileStatus("prod", [record()], { liveEvidence });
+      expect(rows[0].resources).toEqual({ total: 4, present: 3, absent: 0, unobserved: 1 });
+      // No CloudFormation stack to enrich from, and the row is still paintable.
+      expect(rows[0].stack).toBeUndefined();
+    });
+
+    test("a rollup and a stack coexist — the stack stays the richer enrichment where it exists", () => {
+      const liveEvidence = new Map<string, LiveComponentEvidence>([
+        [
+          "search-service",
+          {
+            live: true,
+            ownership: "owned",
+            stack: { name: "app-prod-search", status: "CREATE_COMPLETE", healthy: true },
+            rollup: { total: 2, present: 2, absent: 0, unobserved: 0 },
+          },
+        ],
+      ]);
+      const rows = reconcileStatus("prod", [record()], { liveEvidence });
+      expect(rows[0].resources).toEqual({ total: 2, present: 2, absent: 0, unobserved: 0 });
+      expect(rows[0].stack?.healthy).toBe(true);
+    });
+
     test("surfaces machine-readable live + stack status when observed (#57 hardening)", () => {
       const liveEvidence = new Map<string, LiveComponentEvidence>([
         ["search-service", { live: true, ownership: "owned", stack: { name: "app-prod-search", status: "CREATE_COMPLETE", healthy: true } }],
@@ -395,6 +458,28 @@ describe("status", () => {
       expect(merged.get("a")!.unobserved).toBeUndefined();
       expect(merged.get("b")!.unobserved?.reason).toBe("read-failed");
     });
+
+    test("the change-set rollup survives the stack overlay (behold#100)", () => {
+      // The merge rebuilds the evidence object field by field, so a field it
+      // does not name is dropped. `describeStackStatus` reports a stack, not
+      // per-resource counts, so the supplement never carries a rollup — and
+      // dropping the base's meant AWS, the only substrate with a stack
+      // observer, was the one substrate whose rows lost the #1300 counts.
+      const rollup = { total: 10, present: 10, absent: 0, unobserved: 0 };
+      const base = new Map<string, LiveComponentEvidence>([["cc-canonical", { live: true, ownership: "owned", rollup }]]);
+      const supplement = new Map<string, LiveComponentEvidence>([
+        ["cc-canonical", { live: true, ownership: "owned", stack: { name: "cc-canonical", status: "CREATE_COMPLETE", healthy: true } }],
+      ]);
+      const merged = mergeLiveEvidence(base, supplement);
+      expect(merged.get("cc-canonical")!.rollup).toEqual(rollup);
+      expect(merged.get("cc-canonical")!.stack?.status).toBe("CREATE_COMPLETE");
+    });
+
+    test("no rollup on either side leaves the field absent rather than undefined", () => {
+      const base = new Map<string, LiveComponentEvidence>([["c", { live: true }]]);
+      const supplement = new Map<string, LiveComponentEvidence>([["c", { live: true, ownership: "owned" }]]);
+      expect(mergeLiveEvidence(base, supplement).get("c")).not.toHaveProperty("rollup");
+    });
   });
 
   // ── The observation tri-state reaches the status join (#1089) ─────────────

package/src/lifecycle/status.ts

@@ -86,6 +86,19 @@ export interface ComponentStatusRow {
    * present-but-not-healthy amber (mid-deploy) / red (rollback/failed).
    */
   stack?: LiveStackInfo;
+  /**
+   * How this component's own resources answered (behold#98). Present whenever
+   * `--live` gathered evidence across a live-name mapping.
+   *
+   * `stack` above only exists where the substrate has a deploy object to read,
+   * which is AWS and nowhere else — floci-az and floci-gcp have none, so a
+   * consumer painting component status off `stack` has nothing to paint from
+   * there. These counts are the substrate-neutral source for the same job:
+   * they aggregate observations, which every lexicon produces, rather than a
+   * provider-specific grouping object. `stack` stays as the richer enrichment
+   * where it exists.
+   */
+  resources?: ComponentResourceRollup;
 }
 
 /** A component's owning deploy unit and its provider-native status. */
@@ -129,6 +142,14 @@ export interface LiveComponentEvidence {
   /** The owning deploy unit's raw status, when observed (AWS: the component's own
    * CFN stack). Surfaced onto `ComponentStatusRow.stack` for a richer palette. */
   stack?: LiveStackInfo;
+  /**
+   * How the component's own resources answered, before any merge collapsed
+   * them (behold#98). Always present when evidence exists — a component that
+   * maps to a single entity by identity gets a rollup of one, so a consumer
+   * never has to branch on whether a live-name mapping happened to be
+   * configured.
+   */
+  rollup?: ComponentResourceRollup;
 }
 
 /**
@@ -141,6 +162,16 @@ export interface LiveComponentEvidence {
  * is authoritative for **presence** (`live`) and **ownership**; the change-set's
  * `action` is kept, since drift is still assessed from the diff. A component in
  * only one map passes through unchanged.
+ *
+ * The change-set's `rollup` is kept too (behold#100). This merge rebuilds the
+ * evidence object field by field, so anything not named here is dropped — and
+ * `describeStackStatus` reports a stack, never per-resource counts, so the
+ * supplement has no rollup to contribute. Before this, every component on a
+ * lexicon that implements `describeStackStatus` lost the counts #1300 had just
+ * computed. That is AWS and only AWS, which made the rollup absent on exactly
+ * the substrate it was meant to be verified against: behold#98 shipped its
+ * consumer against floci-az/floci-gcp rows, where no stack observer runs and
+ * the field survived.
  */
 export function mergeLiveEvidence(
   base: Map<string, LiveComponentEvidence> | undefined,
@@ -158,6 +189,9 @@ export function mergeLiveEvidence(
       ownership: sup.ownership ?? b?.ownership,
       action: b?.action,
       stack: sup.stack ?? b?.stack,
+      // Base first: the counts come from the change set, and a stack
+      // observation has none to offer.
+      ...(b?.rollup ?? sup.rollup ? { rollup: b?.rollup ?? sup.rollup } : {}),
     });
   }
   return merged;
@@ -180,6 +214,42 @@ export function resolveLiveNames(component: string, mapping?: LiveNameMapping):
   return mapped && mapped.length > 0 ? mapped : [component];
 }
 
+/**
+ * How a component's own resources answered, one count per tri-state verdict.
+ *
+ * The merged verdict above is deliberately lossy — it answers "is this
+ * component deployed" and nothing else. A consumer painting component status
+ * without a deploy object to read (behold#98: floci-az and floci-gcp have no
+ * CloudFormation stack, so `stack` below is absent and there is nothing to
+ * colour from) needs the shape underneath: how many of the component's
+ * resources were seen, how many were confirmed gone, how many nobody could
+ * look at. Substrate-neutral by construction — it counts observations, not
+ * provider objects.
+ */
+export interface ComponentResourceRollup {
+  /** Resources this component owns, per the live-name mapping. */
+  total: number;
+  /** Observed present. */
+  present: number;
+  /** Looked for, reported missing. Never includes a resource nobody could read. */
+  absent: number;
+  /** NOT-OBSERVED (#1089) — a hole, never counted as absence. */
+  unobserved: number;
+}
+
+/** Count a component's entity verdicts without collapsing them (behold#98). */
+function rollUp(entries: LiveComponentEvidence[]): ComponentResourceRollup {
+  let present = 0;
+  let absent = 0;
+  let unobserved = 0;
+  for (const e of entries) {
+    if (e.unobserved) unobserved += 1;
+    else if (e.live) present += 1;
+    else absent += 1;
+  }
+  return { total: entries.length, present, absent, unobserved };
+}
+
 /**
  * Merge live evidence for several entity/resource names owned by one
  * component into a single verdict. `live` and `ownership` favor the
@@ -187,10 +257,14 @@ export function resolveLiveNames(component: string, mapping?: LiveNameMapping):
  * favors `update` so that drift on *any* owned entity surfaces as drift for
  * the component as a whole, matching `reconcileStatus`'s single check for
  * `action === "update"`.
+ *
+ * The per-entity counts survive as {@link LiveComponentEvidence.rollup}, so a
+ * consumer that needs the shape rather than the verdict is not forced to redo
+ * this join on the far side of a CLI boundary.
  */
 function mergeEvidence(entries: LiveComponentEvidence[]): LiveComponentEvidence | undefined {
   if (entries.length === 0) return undefined;
-  if (entries.length === 1) return entries[0];
+  if (entries.length === 1) return { ...entries[0], rollup: rollUp(entries) };
 
   const live = entries.some((e) => e.live);
   const ownership = entries.some((e) => e.ownership === "owned")
@@ -206,7 +280,7 @@ function mergeEvidence(entries: LiveComponentEvidence[]): LiveComponentEvidence
   // actually seen live, which already answers "is this deployed".
   const unobserved = live ? undefined : entries.find((e) => e.unobserved)?.unobserved;
 
-  return { live, ownership, action, ...(unobserved ? { unobserved } : {}) };
+  return { live, ownership, action, ...(unobserved ? { unobserved } : {}), rollup: rollUp(entries) };
 }
 
 /**
@@ -228,6 +302,14 @@ export function liveEvidenceFromChangeSet(
   const evidenceByName = new Map<string, LiveComponentEvidence>();
   for (const entry of cs.entries) {
     evidenceByName.set(entry.name, {
+      rollup: rollUp([
+        {
+          live: entry.evidence.live,
+          ...(entry.action === "unobserved" && entry.unobservedReason
+            ? { unobserved: { reason: entry.unobservedReason } }
+            : {}),
+        },
+      ]),
       live: entry.evidence.live,
       action: entry.action,
       ownership: entry.ownership,
@@ -352,6 +434,7 @@ export function reconcileStatus(
       ...(liveEvidence && !evidence?.unobserved ? { live: !!evidence?.live } : {}),
       ...(evidence?.unobserved ? { unobserved: evidence.unobserved } : {}),
       ...(evidence?.stack ? { stack: evidence.stack } : {}),
+      ...(evidence?.rollup ? { resources: evidence.rollup } : {}),
     });
   }
 

package/src/yaml.test.ts

@@ -244,3 +244,92 @@ describe("parseYAML block scalars (#910)", () => {
     expect(parseYAML("msg: >\n  a\n  b\n\n  c\n")).toEqual({ msg: "a b\nc\n" });
   });
 });
+
+// #1311 — a sequence item's sibling keys survive a nested block, whichever key
+// comes first. The bug was purely positional: the same keys in the other order
+// parsed correctly, so nothing about the keys themselves was at fault.
+describe("parseYAML — sibling keys after a nested block in a sequence item (#1311)", () => {
+  test("a sibling key after a nested MAPPING is not swallowed", () => {
+    expect(parseYAML("items:\n- context:\n    cluster: c1\n  name: n1\n")).toEqual({
+      items: [{ context: { cluster: "c1" }, name: "n1" }],
+    });
+  });
+
+  test("the same keys in the other order still parse — the ordering is what mattered", () => {
+    expect(parseYAML("items:\n- name: n1\n  context:\n    cluster: c1\n")).toEqual({
+      items: [{ name: "n1", context: { cluster: "c1" } }],
+    });
+  });
+
+  test("several siblings after a nested mapping", () => {
+    expect(parseYAML("items:\n- context:\n    cluster: c1\n  name: n1\n  user: u1\n")).toEqual({
+      items: [{ context: { cluster: "c1" }, name: "n1", user: "u1" }],
+    });
+  });
+
+  test("back-to-back nested mappings", () => {
+    expect(parseYAML("items:\n- a:\n    x: 1\n  b:\n    y: 2\n")).toEqual({ items: [{ a: { x: 1 }, b: { y: 2 } }] });
+  });
+
+  test("every item in a multi-item sequence keeps its siblings", () => {
+    expect(parseYAML("items:\n- context:\n    cluster: c1\n  name: n1\n- context:\n    cluster: c2\n  name: n2\n")).toEqual({
+      items: [
+        { context: { cluster: "c1" }, name: "n1" },
+        { context: { cluster: "c2" }, name: "n2" },
+      ],
+    });
+  });
+
+  test("a sibling key after a SAME-COLUMN nested sequence — valid YAML, and what kubectl emits", () => {
+    expect(parseYAML("items:\n- ports:\n  - 80\n  - 443\n  name: n1\n")).toEqual({
+      items: [{ ports: [80, 443], name: "n1" }],
+    });
+  });
+
+  test("a key with no value stays null when the next line is a sibling, not its content", () => {
+    // The reason a nested MAPPING must be indented PAST its key while a
+    // sequence may share its column: `other` here belongs to the item, not to
+    // `meta`. Reading both against the same threshold breaks one or the other.
+    expect(parseYAML("items:\n- name: a\n  meta:\n  other: b\n")).toEqual({
+      items: [{ name: "a", meta: null, other: "b" }],
+    });
+  });
+
+  test("a real Kubernetes container: same-column sequences between scalar keys", () => {
+    expect(
+      parseYAML('containers:\n- name: web\n  ports:\n  - containerPort: 80\n  env:\n  - name: X\n    value: "1"\n  image: nginx\n'),
+    ).toEqual({
+      containers: [
+        {
+          name: "web",
+          ports: [{ containerPort: 80 }],
+          env: [{ name: "X", value: "1" }],
+          image: "nginx",
+        },
+      ],
+    });
+  });
+
+  test("a real kubeconfig context block — the shape that surfaced this", () => {
+    const kubeconfig = [
+      "contexts:",
+      "- context:",
+      "    cluster: arn:aws:eks:us-east-1:000000000000:cluster/cc-eks",
+      "    user: arn:aws:eks:us-east-1:000000000000:cluster/cc-eks",
+      "  name: arn:aws:eks:us-east-1:000000000000:cluster/cc-eks",
+      "current-context: arn:aws:eks:us-east-1:000000000000:cluster/cc-eks",
+      "",
+    ].join("\n");
+    const arn = "arn:aws:eks:us-east-1:000000000000:cluster/cc-eks";
+    expect(parseYAML(kubeconfig)).toEqual({
+      contexts: [{ context: { cluster: arn, user: arn }, name: arn }],
+      "current-context": arn,
+    });
+  });
+
+  test("a GitHub Actions step with `with:` before its sibling keys", () => {
+    expect(parseYAML("steps:\n- with:\n    fetch-depth: 0\n  name: checkout\n  uses: actions/checkout@v4\n")).toEqual({
+      steps: [{ with: { "fetch-depth": 0 }, name: "checkout", uses: "actions/checkout@v4" }],
+    });
+  });
+});

package/src/yaml.ts

@@ -329,7 +329,7 @@ function parseArrayItemValue(
   inlineValue: string,
   lines: string[],
   currentIndex: number,
-  childIndent: number,
+  keyIndent: number,
 ): unknown {
   if (inlineValue !== "" && !inlineValue.startsWith("#")) {
     const header = blockScalarHeader(inlineValue);
@@ -349,16 +349,28 @@ function parseArrayItemValue(
     }
     return parseScalar(inlineValue);
   }
-  // Empty inline value — check for nested block
+  // Empty inline value — check for a nested block. `keyIndent` is the key's own
+  // column, and the two nested shapes do NOT share a threshold (#1311):
+  //
+  //   - a SEQUENCE may sit at the key's own column (valid YAML, and what
+  //     kubectl and Kubernetes manifests emit);
+  //   - a MAPPING must be indented past it, otherwise the next line is a
+  //     sibling key and this key's value is null:
+  //
+  //         - name: a
+  //           meta:          <- no value
+  //           other: b       <- a sibling, NOT meta's content
+  //
+  // Testing both against `>= keyIndent` would swallow that sibling; testing
+  // both against `> keyIndent` loses the same-column sequence.
   const nextIdx = currentIndex + 1;
   if (nextIdx < lines.length) {
     const nextLine = lines[nextIdx];
     if (nextLine.trim() !== "" && !nextLine.trim().startsWith("#")) {
       const ni = nextLine.search(/\S/);
-      if (ni >= childIndent) {
-        if (nextLine.trimStart().startsWith("- ")) {
-          return parseYAMLArray(lines, nextIdx, ni).value;
-        }
+      if (nextLine.trimStart().startsWith("- ")) {
+        if (ni >= keyIndent) return parseYAMLArray(lines, nextIdx, ni).value;
+      } else if (ni > keyIndent) {
         return parseYAMLLines(lines, nextIdx, ni).value;
       }
     }
@@ -366,6 +378,37 @@ function parseArrayItemValue(
   return null;
 }
 
+/**
+ * Skip past the value block belonging to a key at column `keyIndent` inside a
+ * sequence item, returning the first line that is NOT part of it (#1311).
+ *
+ * Two shapes, and only the first is a matter of indentation:
+ *
+ *   - a nested MAPPING is indented past its key, so anything further right
+ *     belongs to it and anything at the key's own column is a sibling;
+ *   - a nested SEQUENCE may sit at the SAME column as its key, which is valid
+ *     YAML and what kubectl and Kubernetes manifests both emit:
+ *
+ *         - name: web
+ *           ports:
+ *           - containerPort: 80
+ *           env:                    <- a sibling, at `ports`' own column
+ *
+ *     An indent rule cannot separate those, so the sequence is re-parsed to
+ *     find where it ends. `parseYAMLArray` already reports that as `endIndex`.
+ */
+function skipValueBlock(lines: string[], startIndex: number, keyIndent: number): number {
+  let k = startIndex;
+  while (k < lines.length && (lines[k].trim() === "" || lines[k].trim().startsWith("#"))) k++;
+  if (k < lines.length) {
+    const ni = lines[k].search(/\S/);
+    if (ni >= keyIndent && lines[k].trimStart().startsWith("- ")) {
+      return parseYAMLArray(lines, k, ni).endIndex;
+    }
+  }
+  return skipNestedBlock(lines, startIndex, keyIndent + 1);
+}
+
 /**
  * Skip past a nested block (object or array) starting at startIndex with the given indent.
  * Returns the index of the first line that is NOT part of the nested block.
@@ -420,7 +463,19 @@ export function parseYAMLArray(
         const nextIndent = indent + 2;
         const firstVal = kvMatch[2].trim();
         let j = firstVal === "" || firstVal.startsWith("#")
-          ? skipNestedBlock(lines, i + 1, nextIndent)
+          // The nested block belongs to THIS key and is indented past it, so
+          // skip lines indented more than the key's own column (#1311). Using
+          // the key's column itself also swallowed the item's sibling keys,
+          // which sit at exactly that column:
+          //
+          //     - context:          <- key at column 2
+          //         cluster: c1     <- its block, column 4
+          //       name: n1          <- a SIBLING at column 2, was skipped
+          //
+          // Only the item's first key was affected: the sibling loop below
+          // already skips past its own key's column, and the block-scalar
+          // branch immediately below has always used `+ 1` for this reason.
+          ? skipValueBlock(lines, i + 1, nextIndent)
           : blockScalarHeader(firstVal)
             // Block body is indented past the key (nextIndent); skip it (#910).
             ? skipNestedBlock(lines, i + 1, nextIndent + 1)
@@ -437,9 +492,11 @@ export function parseYAMLArray(
           const nextKV = nextLine.match(/^(\s*)([^\s:][^:]*?):\s*(.*)$/);
           if (nextKV) {
             const nextVal = nextKV[3].trim();
-            obj[nextKV[2].trim()] = parseArrayItemValue(nextVal, lines, j, ni + 2);
+            obj[nextKV[2].trim()] = parseArrayItemValue(nextVal, lines, j, ni);
             if (nextVal === "" || nextVal.startsWith("#")) {
-              j = skipNestedBlock(lines, j + 1, ni + 2);
+              // Same rule as the first key above: past this key's own column,
+              // or to the end of a same-column sequence (#1311).
+              j = skipValueBlock(lines, j + 1, ni);
             } else if (blockScalarHeader(nextVal)) {
               // Skip the block body (indented past this key at `ni`) (#910).
               j = skipNestedBlock(lines, j + 1, ni + 1);