helm-schema-ir 0.0.7

macro_rules! values_path {
    ($path:expr $(,)?) => {
        crate::abstract_value::AbstractValue::ValuesPath(helm_schema_core::ValuesPath::parse(
            &$path,
        ))
    };
}

fn conditional_path(value: &str) -> helm_schema_core::ValuesPath {
    helm_schema_core::ValuesPath::parse(value)
}

mod contract;
mod contract_signals;
mod expr_eval;
mod expr_eval_helper_hooks;
mod fragment_dict_config_guards;
mod fragment_expr_eval;
mod fragment_fanout;
mod fragment_golden;
mod fragment_scope_eval;
mod function_semantics;
mod ip_item_pattern;
mod observed_facts;
mod range_modes;
mod resource_identity;
mod selection_reachability;
mod symbolic_local_state;
mod url_parse_pattern;

use crate::{Guard, SymbolicIrContext, ValueKind, YamlPath};
use color_eyre::eyre;
use helm_schema_core::{DYNAMIC_MAPPING_VALUE_SEGMENT, GuardDnf, Predicate};
use indoc::indoc;

/// The raw per-branch guard stacks of one helper meta (branch predicates in
/// canonical guard order plus the defaulted marker), the same lowering the
/// fragment projection's pathless reads use. Test-side replacement for the
/// retired emission-side `contract_guard_sets` (which additionally applied
/// the deleted sibling/suppression prune algebra).
pub(crate) fn raw_guard_sets(
    meta: &crate::helper_meta::HelperOutputMeta,
    source_expr: &str,
) -> Vec<Vec<Guard>> {
    let branches: Vec<Vec<Predicate>> = if meta.predicates.is_empty() {
        vec![Vec::new()]
    } else {
        meta.predicates
            .iter()
            .map(|branch| branch.iter().cloned().collect())
            .collect()
    };
    let mut guard_sets = branches
        .into_iter()
        .flat_map(|branch| {
            let guards = Predicate::contract_guard_stack(&branch);
            let mut condition = GuardDnf::from_guards(guards);
            if meta.defaulted {
                condition = condition.conjoined_with_guards([Guard::Default {
                    path: helm_schema_core::ValuesPath::parse(source_expr),
                }]);
            }
            condition.guard_conjunctions()
        })
        .collect::<Vec<_>>();
    guard_sets.sort();
    guard_sets.dedup();
    guard_sets
}
use helm_schema_ast::DefineIndex;
use test_util::prelude::sim_assert_eq;

/// Simple template IR generation test.
#[test]
fn simple_template_ir() {
    let src = indoc! {r"
        {{- if .Values.enabled }}
        foo: {{ .Values.name }}
        {{- end }}
    "};
    let idx = DefineIndex::new();
    let ir = SymbolicIrContext::new(&idx)
        .generate_contract_ir(src)
        .finalize();

    assert!(
        ir.uses()
            .iter()
            .any(|u| u.source_expr == conditional_path("enabled")
                && u.single_guard_conjunction()
                    == vec![Guard::Truthy {
                        path: helm_schema_core::ValuesPath::parse("enabled")
                    }])
    );
    assert!(
        ir.uses()
            .iter()
            .any(|u| u.source_expr == conditional_path("name")
                && u.path == YamlPath(vec!["foo".to_string()])
                && u.kind == ValueKind::Scalar
                && u.single_guard_conjunction()
                    == vec![Guard::Truthy {
                        path: helm_schema_core::ValuesPath::parse("enabled")
                    }])
    );
}

#[test]
fn direct_tpl_files_get_executes_json_template_source() {
    let src = indoc! {r#"
        apiVersion: v1
        kind: Secret
        data:
          clients.json: {{ tpl (.Files.Get "config/client-auth.json") . | b64enc }}
    "#};
    let file = indoc! {r"
        {{- range $user := .Values.users }}
        {{ $user.username }}: {{ $user.password }}
        {{- end }}
    "};
    let mut index = DefineIndex::new();
    index.add_file_source("config/client-auth.json", file);
    let ir = SymbolicIrContext::new(&index)
        .generate_contract_ir(src)
        .finalize();

    for path in ["users.*.username", "users.*.password"] {
        assert!(
            ir.uses()
                .iter()
                .any(|use_| use_.source_expr == conditional_path(path)),
            "the tpl-executed file should contribute {path}: {ir:#?}"
        );
    }
}

#[test]
fn ranged_tpl_executes_matching_values_default_programs() {
    let helpers = indoc! {r#"
        {{- define "bundle-config" -}}
        {{- range .Values.dagProcessor.dagBundleConfigList -}}
        {{- .name -}}
        {{- end -}}
        {{- end -}}
    "#};
    let source = indoc! {r"
        {{- $root := . -}}
        {{- range $section, $settings := .Values.config -}}
        {{- range $key, $value := $settings -}}
        {{- tpl ($value | toString) $root -}}
        {{- end -}}
        {{- end -}}
    "};
    let mut index = DefineIndex::new();
    index.add_file_source("<inline:0>", helpers);
    let context = SymbolicIrContext::with_chart_default_strings(
        &index,
        std::collections::BTreeMap::from([(
            "config.dag_processor.dag_bundle_config_list".to_string(),
            r#"{{ include "bundle-config" . }}"#.to_string(),
        )]),
    );
    let signals = context
        .generate_contract_ir(source)
        .finalize()
        .into_schema_signals();

    assert!(
        signals
            .evidence_for(&helm_schema_core::ValuesPath::parse(
                "dagProcessor.dagBundleConfigList",
            ))
            .is_some_and(|evidence| evidence
                .conditional_overlays
                .iter()
                .any(|overlay| overlay.evidence.facts.is_ranged_source)
                && evidence.requirement_implications.iter().any(|implication| {
                    implication.requirements.iter().any(|requirement| {
                        matches!(
                            requirement,
                            helm_schema_core::FailValueRequirement::Iterable { .. }
                        )
                    })
                })),
        "the exact default program selected through config.*.* must contribute its range input: \
         {signals:#?}"
    );
}

#[test]
fn ranged_tpl_executes_a_selected_nested_default_program() {
    let source = indoc! {r#"
        {{- range $key, $value := index .Values "grafana.ini" }}
        {{- if kindIs "map" $value }}
        {{- range $elem, $elemVal := $value }}
        {{- if kindIs "invalid" $elemVal }}
        {{ $elem }} =
        {{- else if kindIs "slice" $elemVal }}
        {{ $elem }} = {{ toJson $elemVal }}
        {{- else if kindIs "string" $elemVal }}
        {{ $elem }} = {{ tpl $elemVal $ }}
        {{- else }}
        {{ $elem }} = {{ $elemVal }}
        {{- end -}}
        {{- end -}}
        {{- end -}}
        {{- end -}}
    "#};
    let program = indoc! {r"
        {{ if (and .Values.ingress.enabled .Values.ingress.hosts) }}
          {{ tpl (.Values.ingress.hosts | first) . }}
        {{ else if (and .Values.route.main.enabled .Values.route.main.hostnames) }}
          {{ tpl (.Values.route.main.hostnames | first) . }}
        {{ else }}
          fallback
        {{ end }}
    "};
    let defines = DefineIndex::new();
    let context = SymbolicIrContext::with_chart_default_strings(
        &defines,
        std::collections::BTreeMap::from([(
            r"grafana\.ini.server.domain".to_string(),
            program.to_string(),
        )]),
    );
    let signals = context
        .generate_contract_ir(source)
        .finalize()
        .into_schema_signals();
    let selected_program = helm_schema_core::ConditionalGuard::Eq {
        path: conditional_path(r"grafana\.ini.server.domain"),
        value: helm_schema_core::GuardValue::string(program),
    };
    let ingress_branch = helm_schema_core::ConditionalGuard::AllOf(vec![
        helm_schema_core::ConditionalGuard::Truthy {
            path: conditional_path("ingress.enabled"),
        },
        helm_schema_core::ConditionalGuard::Truthy {
            path: conditional_path("ingress.hosts"),
        },
    ]);

    sim_assert_eq!(
        have: signals.terminal_clauses(),
        want: &vec![
            vec![
                selected_program.clone(),
                helm_schema_core::ConditionalGuard::Absent {
                    path: conditional_path("ingress"),
                },
            ],
            vec![
                selected_program.clone(),
                helm_schema_core::ConditionalGuard::Absent {
                    path: conditional_path("route"),
                },
                helm_schema_core::ConditionalGuard::Not(Box::new(ingress_branch.clone())),
            ],
            vec![
                selected_program,
                helm_schema_core::ConditionalGuard::Absent {
                    path: conditional_path("route.main"),
                },
                helm_schema_core::ConditionalGuard::Not(Box::new(ingress_branch)),
            ],
        ],
    );
}

#[test]
fn base_path_include_executes_implicit_template_source() {
    let src = indoc! {r#"
        apiVersion: v1
        kind: ConfigMap
        data:
          initialize: |-
            {{ include (print $.Template.BasePath "/_create.txt") . | nindent 4 }}
    "#};
    let partial = indoc! {r"
        {{- range $bucket := .Values.buckets }}
        create {{ $bucket.name }}
        {{- end }}
    "};
    let mut index = DefineIndex::new();
    index.add_file_source("templates/_create.txt", partial);
    let ir = SymbolicIrContext::new(&index)
        .generate_contract_ir(src)
        .finalize();

    assert!(
        ir.uses()
            .iter()
            .any(|use_| use_.source_expr == conditional_path("buckets.*.name")),
        "the implicit template body should contribute its member access: {ir:#?}"
    );
}

#[test]
fn dynamic_mapping_value_projects_structural_member_path() {
    let src = indoc! {r"
        apiVersion: v1
        kind: ConfigMap
        data:
          {{- range $key, $value := .Values.entries }}
          {{ $key }}: {{ $value }}
          {{- end }}
    "};
    let idx = DefineIndex::new();
    let ir = SymbolicIrContext::new(&idx)
        .generate_contract_ir(src)
        .finalize();

    assert!(ir.uses().iter().any(|use_| {
        use_.source_expr == conditional_path("entries.*")
            && use_.path
                == YamlPath(vec![
                    "data".to_string(),
                    DYNAMIC_MAPPING_VALUE_SEGMENT.to_string(),
                ])
            && use_.kind == ValueKind::Scalar
    }));
}

#[test]
fn document_output_projection_preserves_resource_claim() {
    let src = indoc! {r"
        apiVersion: v1
        kind: Service
        metadata:
          name: {{ .Values.serviceName }}
    "};
    let idx = DefineIndex::new();
    let ir = SymbolicIrContext::new(&idx)
        .generate_contract_ir(src)
        .finalize();

    let name_use = ir
        .uses()
        .iter()
        .find(|use_| use_.source_expr == conditional_path("serviceName"))
        .expect("serviceName use");

    sim_assert_eq!(
        have: name_use.path,
        want: YamlPath(vec!["metadata".to_string(), "name".to_string()])
    );
    let resource = name_use.resource.as_ref().expect("resource claim");
    sim_assert_eq!(have: resource.api_version, want: "v1");
    sim_assert_eq!(have: resource.kind, want: "Service");
}

#[test]
fn scalar_helper_document_projection_preserves_resource_claim() {
    let helpers = indoc! {r#"
        {{- define "common.serviceName" -}}
        {{ .Values.serviceName }}
        {{- end -}}
    "#};
    let src = indoc! {r#"
        apiVersion: v1
        kind: Service
        metadata:
          name: {{ include "common.serviceName" . }}
    "#};
    let mut idx = DefineIndex::new();
    idx.add_file_source("<inline:0>", helpers);
    let ir = SymbolicIrContext::new(&idx)
        .generate_contract_ir(src)
        .finalize();

    let name_use = ir
        .uses()
        .iter()
        .find(|use_| use_.source_expr == conditional_path("serviceName"))
        .expect("serviceName use");

    sim_assert_eq!(
        have: name_use.path,
        want: YamlPath(vec!["metadata".to_string(), "name".to_string()])
    );
    let resource = name_use.resource.as_ref().expect("resource claim");
    sim_assert_eq!(have: resource.api_version, want: "v1");
    sim_assert_eq!(have: resource.kind, want: "Service");
}

#[test]
fn document_guard_survives_helper_sibling_claim_scoping() {
    let helpers = indoc! {r#"
        {{- define "guarded.port" -}}
        {{- if .enabled -}}
        {{- .port -}}
        {{- end -}}
        {{- end -}}
    "#};
    let src = indoc! {r#"
        {{- if .Values.enabled }}
        apiVersion: v1
        kind: Service
        spec:
          value: {{ include "guarded.port" (dict "enabled" .Values.enabled "port" .Values.port) }}
        {{- end }}
    "#};
    let mut index = DefineIndex::new();
    index.add_file_source("<inline:0>", helpers);
    let ir = SymbolicIrContext::new(&index)
        .generate_contract_ir(src)
        .finalize();

    let port = ir
        .uses()
        .iter()
        .find(|use_| use_.source_expr == conditional_path("port") && !use_.path.0.is_empty())
        .unwrap_or_else(|| panic!("expected rendered port use: {ir:#?}"));
    assert!(
        port.single_guard_conjunction().contains(&Guard::Truthy {
            path: helm_schema_core::ValuesPath::parse("enabled"),
        }),
        "the document guard executes outside the helper's sibling claims: {port:#?}"
    );
}

#[test]
fn document_branch_guard_survives_local_helper_reassignment() {
    let helpers = indoc! {r#"
        {{- define "selected.value" -}}
        {{- .Values.payload -}}
        {{- end -}}
    "#};
    let src = indoc! {r#"
        {{- $selected := "" -}}
        {{- if eq .Values.mode "active" -}}
        {{- $selected = include "selected.value" . -}}
        {{- end -}}
        {{- if $selected }}
        apiVersion: v1
        kind: ConfigMap
        data:
          value: {{ $selected }}
        {{- end }}
    "#};
    let mut index = DefineIndex::new();
    index.add_file_source("<inline:0>", helpers);
    let ir = SymbolicIrContext::new(&index)
        .generate_contract_ir(src)
        .finalize();

    let payload = ir
        .uses()
        .iter()
        .find(|use_| {
            use_.source_expr == conditional_path("payload")
                && use_.path == YamlPath(vec!["data".to_string(), "value".to_string()])
        })
        .unwrap_or_else(|| panic!("expected rendered payload use: {ir:#?}"));
    assert!(
        payload.single_guard_conjunction().contains(&Guard::Eq {
            path: helm_schema_core::ValuesPath::parse("mode"),
            value: helm_schema_core::GuardValue::string("active"),
        }),
        "the assignment branch must remain on the local's rendered value: {payload:#?}"
    );
}

#[test]
fn document_local_coalesce_preserves_ordered_candidate_selection() {
    let src = indoc! {r"
        {{- $selected := coalesce .Values.primary .Values.fallback -}}
        apiVersion: v1
        kind: Secret
        data:
          value: {{ $selected | b64enc | quote }}
    "};
    let ir = SymbolicIrContext::new(&DefineIndex::new())
        .generate_contract_ir(src)
        .finalize();

    let primary = ir
        .uses()
        .iter()
        .find(|use_| use_.source_expr == conditional_path("primary") && !use_.path.0.is_empty())
        .unwrap_or_else(|| panic!("expected rendered primary use: {ir:#?}"));
    sim_assert_eq!(
        have: primary.condition.guard_conjunctions(),
        want: vec![vec![
            Guard::Truthy {
                path: helm_schema_core::ValuesPath::parse("primary"),
            },
            Guard::Default {
                path: helm_schema_core::ValuesPath::parse("primary"),
            },
        ]]
    );

    let fallback = ir
        .uses()
        .iter()
        .find(|use_| use_.source_expr == conditional_path("fallback") && !use_.path.0.is_empty())
        .unwrap_or_else(|| panic!("expected rendered fallback use: {ir:#?}"));
    sim_assert_eq!(
        have: fallback.condition.guard_conjunctions(),
        want: vec![vec![
            Guard::Truthy {
                path: helm_schema_core::ValuesPath::parse("fallback"),
            },
            Guard::Not {
                path: helm_schema_core::ValuesPath::parse("primary"),
            },
            Guard::Default {
                path: helm_schema_core::ValuesPath::parse("fallback"),
            },
        ]]
    );
}

#[test]
fn helper_type_dispatch_keeps_or_candidate_selection_on_each_row() {
    let helpers = indoc! {r#"
        {{- define "selected.value" -}}
        {{- $selected := or .Values.primary .Values.fallback -}}
        {{- if $selected -}}
        {{- $type := typeOf $selected -}}
        {{- if eq $type "string" -}}
        {{ tpl $selected . }}
        {{- else -}}
        {{ toYaml $selected }}
        {{- end -}}
        {{- end -}}
        {{- end -}}
    "#};
    let src = indoc! {r#"
        apiVersion: v1
        kind: ConfigMap
        data:
          value: {{ include "selected.value" . | quote }}
    "#};
    let mut index = DefineIndex::new();
    index.add_file_source("<inline:0>", helpers);
    let ir = SymbolicIrContext::new(&index)
        .generate_contract_ir(src)
        .finalize();

    let primary = ir
        .uses()
        .iter()
        .filter(|use_| use_.source_expr == conditional_path("primary") && !use_.path.0.is_empty())
        .collect::<Vec<_>>();
    assert!(!primary.is_empty(), "expected primary rows: {ir:#?}");
    assert!(
        primary.iter().all(|use_| {
            use_.condition
                .disjuncts()
                .iter()
                .all(|branch| branch.contains(&Predicate::truthy_path("primary")))
        }),
        "every rendered primary row must retain its selection predicate: {primary:#?}"
    );

    let fallback = ir
        .uses()
        .iter()
        .filter(|use_| use_.source_expr == conditional_path("fallback") && !use_.path.0.is_empty())
        .collect::<Vec<_>>();
    assert!(!fallback.is_empty(), "expected fallback rows: {ir:#?}");
    assert!(
        fallback.iter().all(|use_| {
            use_.condition
                .disjuncts()
                .iter()
                .all(|branch| branch.contains(&Predicate::truthy_path("primary").negated()))
        }),
        "every rendered fallback row must retain the earlier empty predicate: {fallback:#?}"
    );
}

#[test]
fn opaque_include_guard_abstains_from_provider_schema_evidence() {
    // The arm uses an unknown function whose output grammar is not modeled,
    // so the include guard stays undecodable.
    let helpers = indoc! {r#"
        {{- define "resource.enabled" -}}
        {{- if .Values.enabled -}}
        {{ mystery .Values.marker }}
        {{- end -}}
        {{- end -}}
    "#};
    let src = indoc! {r#"
        {{- if include "resource.enabled" . }}
        apiVersion: v1
        kind: ConfigMap
        data:
          value: {{ .Values.payload }}
        {{- end }}
    "#};
    let mut index = DefineIndex::new();
    index.add_file_source("<inline:0>", helpers);
    let finalized = SymbolicIrContext::new(&index)
        .generate_contract_ir(src)
        .finalize();

    let payload = finalized
        .uses()
        .iter()
        .find(|use_| {
            use_.source_expr == conditional_path("payload")
                && use_.path == YamlPath(vec!["data".to_string(), "value".to_string()])
        })
        .unwrap_or_else(|| panic!("expected rendered payload use: {finalized:#?}"));
    assert!(
        payload
            .condition
            .disjuncts()
            .iter()
            .all(|conjunction| conjunction.iter().any(Predicate::contains_approximation)),
        "the unlowerable include result must remain approximate in memory: {payload:#?}"
    );
    assert!(
        finalized
            .schema_signals()
            .schema_evidence_by_value_path()
            .get(&helm_schema_core::ValuesPath::parse("payload"))
            .is_none_or(|evidence| evidence.provider_schema_uses.is_empty()),
        "an approximate resource guard must not leak provider constraints: {finalized:#?}"
    );
}

#[test]
fn scalar_helper_document_projection_preserves_scope_guard() {
    let helpers = indoc! {r#"
        {{- define "common.serviceName" -}}
        {{ .Values.serviceName }}
        {{- end -}}
    "#};
    let src = indoc! {r#"
        apiVersion: v1
        kind: Service
        metadata:
          {{- if .Values.enabled }}
          name: {{ include "common.serviceName" . }}
          {{- end }}
    "#};
    let mut idx = DefineIndex::new();
    idx.add_file_source("<inline:0>", helpers);
    let ir = SymbolicIrContext::new(&idx)
        .generate_contract_ir(src)
        .finalize();

    let name_use = ir
        .uses()
        .iter()
        .find(|use_| use_.source_expr == conditional_path("serviceName"))
        .expect("serviceName use");

    sim_assert_eq!(
        have: name_use.single_guard_conjunction(),
        want: vec![Guard::Truthy {
            path: helm_schema_core::ValuesPath::parse("enabled")
        }]
    );
}

#[test]
fn labels_helper_does_not_apply_custom_label_guard_to_name_helper_dependency() -> eyre::Result<()> {
    let src = indoc! {r#"
        {{- if .Values.networkPolicy.enabled }}
        apiVersion: networking.k8s.io/v1
        kind: NetworkPolicy
        metadata:
          name: {{ template "common.names.fullname" . }}
          labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
        spec:
          podSelector:
            matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 6 }}
        {{- end }}
    "#};
    let mut idx = DefineIndex::new();
    let sources = test_util::DefineSourceSpec {
        helper_templates: &[],
        helper_template_dirs: &[("charts/common/templates", "tpl")],
        file_sources: &[],
    }
    .load()?;
    for source in sources {
        idx.add_file_source(&source.path, &source.source);
    }
    let ir = SymbolicIrContext::new(&idx)
        .generate_contract_ir(src)
        .finalize();

    let name_override_uses = ir
        .uses()
        .iter()
        .filter(|use_| use_.source_expr == conditional_path("nameOverride"))
        .collect::<Vec<_>>();

    let pathless_name_override_uses = name_override_uses
        .iter()
        .filter(|use_| use_.path.0.is_empty())
        .collect::<Vec<_>>();
    assert!(
        pathless_name_override_uses.iter().all(|use_| !use_
            .condition
            .guard_conjunctions()
            .iter()
            .flatten()
            .any(
                |guard| matches!(guard, Guard::Truthy { path } if path.encode() == "commonLabels")
            )),
        "commonLabels is the custom-label source, not a guard for the pathless common.names.name dependency: {pathless_name_override_uses:#?}"
    );
    let selected_default_branch = [
        Guard::Truthy {
            path: helm_schema_core::ValuesPath::parse("nameOverride"),
        },
        Guard::Truthy {
            path: helm_schema_core::ValuesPath::parse("networkPolicy.enabled"),
        },
        Guard::Default {
            path: helm_schema_core::ValuesPath::parse("nameOverride"),
        },
    ];
    assert!(
        name_override_uses.iter().any(|use_| {
            use_.path == YamlPath(Vec::new())
                && use_
                    .condition
                    .guard_conjunctions()
                    .iter()
                    .any(|guards| guards == &selected_default_branch)
        }),
        "expected pathless nameOverride dependency to keep its selected default branch under the document execution guard: {name_override_uses:#?}"
    );
    let app_name_path = YamlPath(vec![
        "metadata".to_string(),
        "labels".to_string(),
        "app.kubernetes.io/name".to_string(),
    ]);
    assert!(
        name_override_uses
            .iter()
            .filter(|use_| use_.path == app_name_path)
            .all(
                |use_| !use_.condition.guard_conjunctions().iter().flatten().any(
                    |guard| matches!(guard, Guard::Not { path } if path.encode() == "nameOverride")
                )
            ),
        "a customLabels branch should not keep nameOverride=false after common.names.name is projected: {name_override_uses:#?}"
    );
    Ok(())
}

#[test]
fn transitive_scalar_helper_default_projects_default_guard() {
    let helpers = indoc! {r#"
        {{- define "liba.fullname" -}}
        {{- include "libb.name" . -}}
        {{- end -}}

        {{- define "libb.name" -}}
        {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
        {{- end -}}
    "#};
    let src = indoc! {r#"
        apiVersion: v1
        kind: ConfigMap
        metadata:
          name: {{ include "liba.fullname" . }}
    "#};
    let mut idx = DefineIndex::new();
    idx.add_file_source("<inline:0>", helpers);
    let ir = SymbolicIrContext::new(&idx)
        .generate_contract_ir(src)
        .finalize();

    assert!(
        ir.uses().iter().any(|use_| {
            use_.source_expr == conditional_path("nameOverride")
                && use_.path == YamlPath(vec!["metadata".to_string(), "name".to_string()])
                && use_.single_guard_conjunction().contains(&Guard::Default {
                    path: helm_schema_core::ValuesPath::parse("nameOverride"),
                })
        }),
        "expected transitive helper default to survive into rendered contract use, got {:?}",
        ir.uses()
    );
}

#[test]
fn nonempty_choice_list_range_preserves_computed_mutation() {
    let helpers = indoc! {r#"
        {{- define "mutate.patch" -}}
        {{- $patch := .Values.patch -}}
        {{- $keys := list "path" -}}
        {{- if .Values.copy -}}
        {{- $keys = append $keys "from" -}}
        {{- end -}}
        {{- range $key := $keys -}}
        {{- $_ := set $patch (printf "%sKey" $key) "derived" -}}
        {{- end -}}
        {{- $patch.pathKey -}}
        {{- end -}}
    "#};
    let mut index = DefineIndex::new();
    index.add_file_source("<inline:0>", helpers);

    let ir = SymbolicIrContext::new(&index)
        .generate_contract_ir(r#"{{ include "mutate.patch" . }}"#)
        .finalize();

    assert!(
        ir.uses()
            .iter()
            .all(|use_| use_.source_expr != conditional_path("patch.pathKey")),
        "the guaranteed path iteration sets pathKey before its later read: {ir:#?}"
    );
}

/// A file-backed include piped into a hashing transform renders the file as
/// TEXT for the hash: every path the file splices influences the annotation
/// but never lands there raw, so the caller-side row must carry the
/// Serialized kind (a Scalar row would stamp the annotation slot's provider
/// string schema onto trivy-operator's whole `ConfigMap` surface).
#[test]
fn checksum_include_rows_stay_serialized_at_the_annotation_slot() {
    let mut idx = DefineIndex::new();
    idx.add_file_source(
        "templates/configmaps/config.yaml",
        indoc! {r#"
            kind: ConfigMap
            apiVersion: v1
            metadata:
              name: config
              labels: {{- include "repro.labels" . | nindent 4 }}
            data:
              NAMES: {{ .Values.scanSecrets | toJson | quote }}
        "#},
    );
    idx.add_file_source(
        "<inline:0>",
        indoc! {r#"
            {{- define "repro.labels" -}}
            app: repro
            {{- end -}}"#},
    );
    let src = indoc! {r#"
        apiVersion: apps/v1
        kind: Deployment
        metadata:
          name: test
        spec:
          template:
            metadata:
              annotations:
                checksum/config: {{ include (print $.Template.BasePath "/configmaps/config.yaml") . | sha256sum }}
    "#};
    let ir = SymbolicIrContext::new(&idx)
        .generate_contract_ir(src)
        .finalize();

    let annotation_kinds: Vec<ValueKind> = ir
        .uses()
        .iter()
        .filter(|contract_use| {
            contract_use.source_expr == conditional_path("scanSecrets")
                && contract_use
                    .path
                    .0
                    .last()
                    .is_some_and(|segment| segment == "checksum/config")
        })
        .map(|contract_use| contract_use.kind)
        .collect();
    assert!(
        annotation_kinds
            .iter()
            .all(|kind| *kind == ValueKind::Serialized),
        "hashed file renders constrain nothing at the annotation slot: {annotation_kinds:?}"
    );
    assert!(
        !annotation_kinds.is_empty(),
        "the checksum include must still attribute its file's paths"
    );
}