@intentius/chant 0.34.1 → 0.37.2

package/src/lifecycle/status.ts

@@ -86,6 +86,19 @@ export interface ComponentStatusRow {
    * present-but-not-healthy amber (mid-deploy) / red (rollback/failed).
    */
   stack?: LiveStackInfo;
+  /**
+   * How this component's own resources answered (behold#98). Present whenever
+   * `--live` gathered evidence across a live-name mapping.
+   *
+   * `stack` above only exists where the substrate has a deploy object to read,
+   * which is AWS and nowhere else — floci-az and floci-gcp have none, so a
+   * consumer painting component status off `stack` has nothing to paint from
+   * there. These counts are the substrate-neutral source for the same job:
+   * they aggregate observations, which every lexicon produces, rather than a
+   * provider-specific grouping object. `stack` stays as the richer enrichment
+   * where it exists.
+   */
+  resources?: ComponentResourceRollup;
 }
 
 /** A component's owning deploy unit and its provider-native status. */
@@ -129,6 +142,14 @@ export interface LiveComponentEvidence {
   /** The owning deploy unit's raw status, when observed (AWS: the component's own
    * CFN stack). Surfaced onto `ComponentStatusRow.stack` for a richer palette. */
   stack?: LiveStackInfo;
+  /**
+   * How the component's own resources answered, before any merge collapsed
+   * them (behold#98). Always present when evidence exists — a component that
+   * maps to a single entity by identity gets a rollup of one, so a consumer
+   * never has to branch on whether a live-name mapping happened to be
+   * configured.
+   */
+  rollup?: ComponentResourceRollup;
 }
 
 /**
@@ -141,6 +162,16 @@ export interface LiveComponentEvidence {
  * is authoritative for **presence** (`live`) and **ownership**; the change-set's
  * `action` is kept, since drift is still assessed from the diff. A component in
  * only one map passes through unchanged.
+ *
+ * The change-set's `rollup` is kept too (behold#100). This merge rebuilds the
+ * evidence object field by field, so anything not named here is dropped — and
+ * `describeStackStatus` reports a stack, never per-resource counts, so the
+ * supplement has no rollup to contribute. Before this, every component on a
+ * lexicon that implements `describeStackStatus` lost the counts #1300 had just
+ * computed. That is AWS and only AWS, which made the rollup absent on exactly
+ * the substrate it was meant to be verified against: behold#98 shipped its
+ * consumer against floci-az/floci-gcp rows, where no stack observer runs and
+ * the field survived.
  */
 export function mergeLiveEvidence(
   base: Map<string, LiveComponentEvidence> | undefined,
@@ -158,6 +189,9 @@ export function mergeLiveEvidence(
       ownership: sup.ownership ?? b?.ownership,
       action: b?.action,
       stack: sup.stack ?? b?.stack,
+      // Base first: the counts come from the change set, and a stack
+      // observation has none to offer.
+      ...(b?.rollup ?? sup.rollup ? { rollup: b?.rollup ?? sup.rollup } : {}),
     });
   }
   return merged;
@@ -180,6 +214,42 @@ export function resolveLiveNames(component: string, mapping?: LiveNameMapping):
   return mapped && mapped.length > 0 ? mapped : [component];
 }
 
+/**
+ * How a component's own resources answered, one count per tri-state verdict.
+ *
+ * The merged verdict above is deliberately lossy — it answers "is this
+ * component deployed" and nothing else. A consumer painting component status
+ * without a deploy object to read (behold#98: floci-az and floci-gcp have no
+ * CloudFormation stack, so `stack` below is absent and there is nothing to
+ * colour from) needs the shape underneath: how many of the component's
+ * resources were seen, how many were confirmed gone, how many nobody could
+ * look at. Substrate-neutral by construction — it counts observations, not
+ * provider objects.
+ */
+export interface ComponentResourceRollup {
+  /** Resources this component owns, per the live-name mapping. */
+  total: number;
+  /** Observed present. */
+  present: number;
+  /** Looked for, reported missing. Never includes a resource nobody could read. */
+  absent: number;
+  /** NOT-OBSERVED (#1089) — a hole, never counted as absence. */
+  unobserved: number;
+}
+
+/** Count a component's entity verdicts without collapsing them (behold#98). */
+function rollUp(entries: LiveComponentEvidence[]): ComponentResourceRollup {
+  let present = 0;
+  let absent = 0;
+  let unobserved = 0;
+  for (const e of entries) {
+    if (e.unobserved) unobserved += 1;
+    else if (e.live) present += 1;
+    else absent += 1;
+  }
+  return { total: entries.length, present, absent, unobserved };
+}
+
 /**
  * Merge live evidence for several entity/resource names owned by one
  * component into a single verdict. `live` and `ownership` favor the
@@ -187,10 +257,14 @@ export function resolveLiveNames(component: string, mapping?: LiveNameMapping):
  * favors `update` so that drift on *any* owned entity surfaces as drift for
  * the component as a whole, matching `reconcileStatus`'s single check for
  * `action === "update"`.
+ *
+ * The per-entity counts survive as {@link LiveComponentEvidence.rollup}, so a
+ * consumer that needs the shape rather than the verdict is not forced to redo
+ * this join on the far side of a CLI boundary.
  */
 function mergeEvidence(entries: LiveComponentEvidence[]): LiveComponentEvidence | undefined {
   if (entries.length === 0) return undefined;
-  if (entries.length === 1) return entries[0];
+  if (entries.length === 1) return { ...entries[0], rollup: rollUp(entries) };
 
   const live = entries.some((e) => e.live);
   const ownership = entries.some((e) => e.ownership === "owned")
@@ -206,7 +280,7 @@ function mergeEvidence(entries: LiveComponentEvidence[]): LiveComponentEvidence
   // actually seen live, which already answers "is this deployed".
   const unobserved = live ? undefined : entries.find((e) => e.unobserved)?.unobserved;
 
-  return { live, ownership, action, ...(unobserved ? { unobserved } : {}) };
+  return { live, ownership, action, ...(unobserved ? { unobserved } : {}), rollup: rollUp(entries) };
 }
 
 /**
@@ -228,6 +302,14 @@ export function liveEvidenceFromChangeSet(
   const evidenceByName = new Map<string, LiveComponentEvidence>();
   for (const entry of cs.entries) {
     evidenceByName.set(entry.name, {
+      rollup: rollUp([
+        {
+          live: entry.evidence.live,
+          ...(entry.action === "unobserved" && entry.unobservedReason
+            ? { unobserved: { reason: entry.unobservedReason } }
+            : {}),
+        },
+      ]),
       live: entry.evidence.live,
       action: entry.action,
       ownership: entry.ownership,
@@ -352,6 +434,7 @@ export function reconcileStatus(
       ...(liveEvidence && !evidence?.unobserved ? { live: !!evidence?.live } : {}),
       ...(evidence?.unobserved ? { unobserved: evidence.unobserved } : {}),
       ...(evidence?.stack ? { stack: evidence.stack } : {}),
+      ...(evidence?.rollup ? { resources: evidence.rollup } : {}),
     });
   }
 

package/src/yaml.test.ts

@@ -244,3 +244,92 @@ describe("parseYAML block scalars (#910)", () => {
     expect(parseYAML("msg: >\n  a\n  b\n\n  c\n")).toEqual({ msg: "a b\nc\n" });
   });
 });
+
+// #1311 — a sequence item's sibling keys survive a nested block, whichever key
+// comes first. The bug was purely positional: the same keys in the other order
+// parsed correctly, so nothing about the keys themselves was at fault.
+describe("parseYAML — sibling keys after a nested block in a sequence item (#1311)", () => {
+  test("a sibling key after a nested MAPPING is not swallowed", () => {
+    expect(parseYAML("items:\n- context:\n    cluster: c1\n  name: n1\n")).toEqual({
+      items: [{ context: { cluster: "c1" }, name: "n1" }],
+    });
+  });
+
+  test("the same keys in the other order still parse — the ordering is what mattered", () => {
+    expect(parseYAML("items:\n- name: n1\n  context:\n    cluster: c1\n")).toEqual({
+      items: [{ name: "n1", context: { cluster: "c1" } }],
+    });
+  });
+
+  test("several siblings after a nested mapping", () => {
+    expect(parseYAML("items:\n- context:\n    cluster: c1\n  name: n1\n  user: u1\n")).toEqual({
+      items: [{ context: { cluster: "c1" }, name: "n1", user: "u1" }],
+    });
+  });
+
+  test("back-to-back nested mappings", () => {
+    expect(parseYAML("items:\n- a:\n    x: 1\n  b:\n    y: 2\n")).toEqual({ items: [{ a: { x: 1 }, b: { y: 2 } }] });
+  });
+
+  test("every item in a multi-item sequence keeps its siblings", () => {
+    expect(parseYAML("items:\n- context:\n    cluster: c1\n  name: n1\n- context:\n    cluster: c2\n  name: n2\n")).toEqual({
+      items: [
+        { context: { cluster: "c1" }, name: "n1" },
+        { context: { cluster: "c2" }, name: "n2" },
+      ],
+    });
+  });
+
+  test("a sibling key after a SAME-COLUMN nested sequence — valid YAML, and what kubectl emits", () => {
+    expect(parseYAML("items:\n- ports:\n  - 80\n  - 443\n  name: n1\n")).toEqual({
+      items: [{ ports: [80, 443], name: "n1" }],
+    });
+  });
+
+  test("a key with no value stays null when the next line is a sibling, not its content", () => {
+    // The reason a nested MAPPING must be indented PAST its key while a
+    // sequence may share its column: `other` here belongs to the item, not to
+    // `meta`. Reading both against the same threshold breaks one or the other.
+    expect(parseYAML("items:\n- name: a\n  meta:\n  other: b\n")).toEqual({
+      items: [{ name: "a", meta: null, other: "b" }],
+    });
+  });
+
+  test("a real Kubernetes container: same-column sequences between scalar keys", () => {
+    expect(
+      parseYAML('containers:\n- name: web\n  ports:\n  - containerPort: 80\n  env:\n  - name: X\n    value: "1"\n  image: nginx\n'),
+    ).toEqual({
+      containers: [
+        {
+          name: "web",
+          ports: [{ containerPort: 80 }],
+          env: [{ name: "X", value: "1" }],
+          image: "nginx",
+        },
+      ],
+    });
+  });
+
+  test("a real kubeconfig context block — the shape that surfaced this", () => {
+    const kubeconfig = [
+      "contexts:",
+      "- context:",
+      "    cluster: arn:aws:eks:us-east-1:000000000000:cluster/cc-eks",
+      "    user: arn:aws:eks:us-east-1:000000000000:cluster/cc-eks",
+      "  name: arn:aws:eks:us-east-1:000000000000:cluster/cc-eks",
+      "current-context: arn:aws:eks:us-east-1:000000000000:cluster/cc-eks",
+      "",
+    ].join("\n");
+    const arn = "arn:aws:eks:us-east-1:000000000000:cluster/cc-eks";
+    expect(parseYAML(kubeconfig)).toEqual({
+      contexts: [{ context: { cluster: arn, user: arn }, name: arn }],
+      "current-context": arn,
+    });
+  });
+
+  test("a GitHub Actions step with `with:` before its sibling keys", () => {
+    expect(parseYAML("steps:\n- with:\n    fetch-depth: 0\n  name: checkout\n  uses: actions/checkout@v4\n")).toEqual({
+      steps: [{ with: { "fetch-depth": 0 }, name: "checkout", uses: "actions/checkout@v4" }],
+    });
+  });
+});

package/src/yaml.ts

@@ -329,7 +329,7 @@ function parseArrayItemValue(
   inlineValue: string,
   lines: string[],
   currentIndex: number,
-  childIndent: number,
+  keyIndent: number,
 ): unknown {
   if (inlineValue !== "" && !inlineValue.startsWith("#")) {
     const header = blockScalarHeader(inlineValue);
@@ -349,16 +349,28 @@ function parseArrayItemValue(
     }
     return parseScalar(inlineValue);
   }
-  // Empty inline value — check for nested block
+  // Empty inline value — check for a nested block. `keyIndent` is the key's own
+  // column, and the two nested shapes do NOT share a threshold (#1311):
+  //
+  //   - a SEQUENCE may sit at the key's own column (valid YAML, and what
+  //     kubectl and Kubernetes manifests emit);
+  //   - a MAPPING must be indented past it, otherwise the next line is a
+  //     sibling key and this key's value is null:
+  //
+  //         - name: a
+  //           meta:          <- no value
+  //           other: b       <- a sibling, NOT meta's content
+  //
+  // Testing both against `>= keyIndent` would swallow that sibling; testing
+  // both against `> keyIndent` loses the same-column sequence.
   const nextIdx = currentIndex + 1;
   if (nextIdx < lines.length) {
     const nextLine = lines[nextIdx];
     if (nextLine.trim() !== "" && !nextLine.trim().startsWith("#")) {
       const ni = nextLine.search(/\S/);
-      if (ni >= childIndent) {
-        if (nextLine.trimStart().startsWith("- ")) {
-          return parseYAMLArray(lines, nextIdx, ni).value;
-        }
+      if (nextLine.trimStart().startsWith("- ")) {
+        if (ni >= keyIndent) return parseYAMLArray(lines, nextIdx, ni).value;
+      } else if (ni > keyIndent) {
         return parseYAMLLines(lines, nextIdx, ni).value;
       }
     }
@@ -366,6 +378,37 @@ function parseArrayItemValue(
   return null;
 }
 
+/**
+ * Skip past the value block belonging to a key at column `keyIndent` inside a
+ * sequence item, returning the first line that is NOT part of it (#1311).
+ *
+ * Two shapes, and only the first is a matter of indentation:
+ *
+ *   - a nested MAPPING is indented past its key, so anything further right
+ *     belongs to it and anything at the key's own column is a sibling;
+ *   - a nested SEQUENCE may sit at the SAME column as its key, which is valid
+ *     YAML and what kubectl and Kubernetes manifests both emit:
+ *
+ *         - name: web
+ *           ports:
+ *           - containerPort: 80
+ *           env:                    <- a sibling, at `ports`' own column
+ *
+ *     An indent rule cannot separate those, so the sequence is re-parsed to
+ *     find where it ends. `parseYAMLArray` already reports that as `endIndex`.
+ */
+function skipValueBlock(lines: string[], startIndex: number, keyIndent: number): number {
+  let k = startIndex;
+  while (k < lines.length && (lines[k].trim() === "" || lines[k].trim().startsWith("#"))) k++;
+  if (k < lines.length) {
+    const ni = lines[k].search(/\S/);
+    if (ni >= keyIndent && lines[k].trimStart().startsWith("- ")) {
+      return parseYAMLArray(lines, k, ni).endIndex;
+    }
+  }
+  return skipNestedBlock(lines, startIndex, keyIndent + 1);
+}
+
 /**
  * Skip past a nested block (object or array) starting at startIndex with the given indent.
  * Returns the index of the first line that is NOT part of the nested block.
@@ -420,7 +463,19 @@ export function parseYAMLArray(
         const nextIndent = indent + 2;
         const firstVal = kvMatch[2].trim();
         let j = firstVal === "" || firstVal.startsWith("#")
-          ? skipNestedBlock(lines, i + 1, nextIndent)
+          // The nested block belongs to THIS key and is indented past it, so
+          // skip lines indented more than the key's own column (#1311). Using
+          // the key's column itself also swallowed the item's sibling keys,
+          // which sit at exactly that column:
+          //
+          //     - context:          <- key at column 2
+          //         cluster: c1     <- its block, column 4
+          //       name: n1          <- a SIBLING at column 2, was skipped
+          //
+          // Only the item's first key was affected: the sibling loop below
+          // already skips past its own key's column, and the block-scalar
+          // branch immediately below has always used `+ 1` for this reason.
+          ? skipValueBlock(lines, i + 1, nextIndent)
           : blockScalarHeader(firstVal)
             // Block body is indented past the key (nextIndent); skip it (#910).
             ? skipNestedBlock(lines, i + 1, nextIndent + 1)
@@ -437,9 +492,11 @@ export function parseYAMLArray(
           const nextKV = nextLine.match(/^(\s*)([^\s:][^:]*?):\s*(.*)$/);
           if (nextKV) {
             const nextVal = nextKV[3].trim();
-            obj[nextKV[2].trim()] = parseArrayItemValue(nextVal, lines, j, ni + 2);
+            obj[nextKV[2].trim()] = parseArrayItemValue(nextVal, lines, j, ni);
             if (nextVal === "" || nextVal.startsWith("#")) {
-              j = skipNestedBlock(lines, j + 1, ni + 2);
+              // Same rule as the first key above: past this key's own column,
+              // or to the end of a same-column sequence (#1311).
+              j = skipValueBlock(lines, j + 1, ni);
             } else if (blockScalarHeader(nextVal)) {
               // Skip the block body (indented past this key at `ni`) (#910).
               j = skipNestedBlock(lines, j + 1, ni + 1);