@intentius/chant-lexicon-k8s 0.46.0 → 0.50.0

package/src/generated/operations.json

@@ -31,6 +31,38 @@
       "watch"
     ]
   },
+  "K8s::Addons::ClusterResourceSet": {
+    "entityType": "K8s::Addons::ClusterResourceSet",
+    "apiVersion": "addons.cluster.x-k8s.io/v1beta2",
+    "kind": "ClusterResourceSet",
+    "plural": "clusterresourcesets",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Addons::HelmChartProxy": {
+    "entityType": "K8s::Addons::HelmChartProxy",
+    "apiVersion": "addons.cluster.x-k8s.io/v1alpha1",
+    "kind": "HelmChartProxy",
+    "plural": "helmchartproxies",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
   "K8s::Admissionregistration::MutatingAdmissionPolicy": {
     "entityType": "K8s::Admissionregistration::MutatingAdmissionPolicy",
     "apiVersion": "admissionregistration.k8s.io/v1",
@@ -495,6 +527,38 @@
     "scope": "Namespaced",
     "verbs": []
   },
+  "K8s::CAPI::Cluster": {
+    "entityType": "K8s::CAPI::Cluster",
+    "apiVersion": "cluster.x-k8s.io/v1beta2",
+    "kind": "Cluster",
+    "plural": "clusters",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::CAPI::MachinePool": {
+    "entityType": "K8s::CAPI::MachinePool",
+    "apiVersion": "cluster.x-k8s.io/v1beta2",
+    "kind": "MachinePool",
+    "plural": "machinepools",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
   "K8s::CertManager::Certificate": {
     "entityType": "K8s::CertManager::Certificate",
     "apiVersion": "cert-manager.io/v1",
@@ -705,6 +769,22 @@
       "watch"
     ]
   },
+  "K8s::Controlplane::AWSManagedControlPlane": {
+    "entityType": "K8s::Controlplane::AWSManagedControlPlane",
+    "apiVersion": "controlplane.cluster.x-k8s.io/v1beta2",
+    "kind": "AWSManagedControlPlane",
+    "plural": "awsmanagedcontrolplanes",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
   "K8s::Coordination::Lease": {
     "entityType": "K8s::Coordination::Lease",
     "apiVersion": "coordination.k8s.io/v1",
@@ -1199,6 +1279,22 @@
     "scope": "Namespaced",
     "verbs": []
   },
+  "K8s::Eks::PodIdentityAssociation": {
+    "entityType": "K8s::Eks::PodIdentityAssociation",
+    "apiVersion": "eks.services.k8s.aws/v1alpha1",
+    "kind": "PodIdentityAssociation",
+    "plural": "podidentityassociations",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
   "K8s::Events::Event": {
     "entityType": "K8s::Events::Event",
     "apiVersion": "events.k8s.io/v1",
@@ -1617,6 +1713,54 @@
       "watch"
     ]
   },
+  "K8s::Iam::Policy": {
+    "entityType": "K8s::Iam::Policy",
+    "apiVersion": "iam.services.k8s.aws/v1alpha1",
+    "kind": "Policy",
+    "plural": "policies",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Iam::Role": {
+    "entityType": "K8s::Iam::Role",
+    "apiVersion": "iam.services.k8s.aws/v1alpha1",
+    "kind": "Role",
+    "plural": "roles",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Iam::User": {
+    "entityType": "K8s::Iam::User",
+    "apiVersion": "iam.services.k8s.aws/v1alpha1",
+    "kind": "User",
+    "plural": "users",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
   "K8s::Infisical::InfisicalDynamicSecret": {
     "entityType": "K8s::Infisical::InfisicalDynamicSecret",
     "apiVersion": "secrets.infisical.com/v1alpha1",
@@ -1665,6 +1809,54 @@
       "watch"
     ]
   },
+  "K8s::Infrastructure::AWSClusterControllerIdentity": {
+    "entityType": "K8s::Infrastructure::AWSClusterControllerIdentity",
+    "apiVersion": "infrastructure.cluster.x-k8s.io/v1beta2",
+    "kind": "AWSClusterControllerIdentity",
+    "plural": "awsclustercontrolleridentities",
+    "scope": "Cluster",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Infrastructure::AWSManagedCluster": {
+    "entityType": "K8s::Infrastructure::AWSManagedCluster",
+    "apiVersion": "infrastructure.cluster.x-k8s.io/v1beta2",
+    "kind": "AWSManagedCluster",
+    "plural": "awsmanagedclusters",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Infrastructure::AWSManagedMachinePool": {
+    "entityType": "K8s::Infrastructure::AWSManagedMachinePool",
+    "apiVersion": "infrastructure.cluster.x-k8s.io/v1beta2",
+    "kind": "AWSManagedMachinePool",
+    "plural": "awsmanagedmachinepools",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
   "K8s::K3s::Addon": {
     "entityType": "K8s::K3s::Addon",
     "apiVersion": "k3s.cattle.io/v1",
@@ -1713,6 +1905,54 @@
       "watch"
     ]
   },
+  "K8s::KServe::ClusterServingRuntime": {
+    "entityType": "K8s::KServe::ClusterServingRuntime",
+    "apiVersion": "serving.kserve.io/v1alpha1",
+    "kind": "ClusterServingRuntime",
+    "plural": "clusterservingruntimes",
+    "scope": "Cluster",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::KServe::InferenceService": {
+    "entityType": "K8s::KServe::InferenceService",
+    "apiVersion": "serving.kserve.io/v1beta1",
+    "kind": "InferenceService",
+    "plural": "inferenceservices",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::KServe::ServingRuntime": {
+    "entityType": "K8s::KServe::ServingRuntime",
+    "apiVersion": "serving.kserve.io/v1alpha1",
+    "kind": "ServingRuntime",
+    "plural": "servingruntimes",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
   "K8s::KubeMicroVM::MicroVM": {
     "entityType": "K8s::KubeMicroVM::MicroVM",
     "apiVersion": "lambda.aws.amazon.com/v1alpha1",
@@ -2123,6 +2363,22 @@
     "scope": "Namespaced",
     "verbs": []
   },
+  "K8s::Rds::DBInstance": {
+    "entityType": "K8s::Rds::DBInstance",
+    "apiVersion": "rds.services.k8s.aws/v1alpha1",
+    "kind": "DBInstance",
+    "plural": "dbinstances",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
   "K8s::Resource::DeviceClass": {
     "entityType": "K8s::Resource::DeviceClass",
     "apiVersion": "resource.k8s.io/v1",
@@ -2233,6 +2489,22 @@
     "scope": "Namespaced",
     "verbs": []
   },
+  "K8s::S3::Bucket": {
+    "entityType": "K8s::S3::Bucket",
+    "apiVersion": "s3.services.k8s.aws/v1alpha1",
+    "kind": "Bucket",
+    "plural": "buckets",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
   "K8s::Scheduling::PriorityClass": {
     "entityType": "K8s::Scheduling::PriorityClass",
     "apiVersion": "scheduling.k8s.io/v1",

package/src/group-namespace.test.ts

@@ -27,6 +27,18 @@ describe("namespaceSegmentForGroup", () => {
   test("the toolkit groups collapse to Flux", () => {
     expect(namespaceSegmentForGroup("kustomize.toolkit.fluxcd.io")).toBe("Flux");
   });
+
+  test("serving.kserve.io takes the KServe override", () => {
+    expect(namespaceSegmentForGroup("serving.kserve.io")).toBe("KServe");
+  });
+
+  test("cluster.x-k8s.io takes the CAPI override, avoiding the Cluster::Cluster stutter", () => {
+    expect(namespaceSegmentForGroup("cluster.x-k8s.io")).toBe("CAPI");
+  });
+
+  test("infrastructure.cluster.x-k8s.io is not overridden — first segment reads fine", () => {
+    expect(namespaceSegmentForGroup("infrastructure.cluster.x-k8s.io")).toBe("Infrastructure");
+  });
 });
 
 // #1628: rendered and imported entityTypes used to bypass the overrides, so a
@@ -61,4 +73,23 @@ spec:
     expect(ir.resources.length).toBe(1);
     expect(ir.resources[0].type).toBe("K8s::Argo::Application");
   });
+
+  test("an imported InferenceService is typed K8s::KServe::InferenceService", () => {
+    const ir = new K8sParser().parse(`
+apiVersion: serving.kserve.io/v1beta1
+kind: InferenceService
+metadata:
+  name: sklearn-iris
+  namespace: kserve-test
+spec:
+  predictor:
+    model:
+      modelFormat:
+        name: sklearn
+      storageUri: gs://kfserving-examples/models/sklearn/1.0/model
+`);
+
+    expect(ir.resources.length).toBe(1);
+    expect(ir.resources[0].type).toBe("K8s::KServe::InferenceService");
+  });
 });

package/src/group-namespace.ts

@@ -59,6 +59,19 @@ export const GROUP_NAMESPACE_OVERRIDES: Record<string, string> = {
   // and would split HelmChart from the Addon that tracks its deployment.
   "helm.cattle.io": "K3s",
   "k3s.cattle.io": "K3s",
+  // The first-segment rule would give `Serving`, which reads like a generic
+  // core concept rather than the KServe operator that owns it.
+  "serving.kserve.io": "KServe",
+  // The first-segment rule would give `Cluster`, which stutters against the
+  // CAPI `Cluster` kind itself (`K8s::Cluster::Cluster`) the same way the
+  // rejected `K8s::MicroVM::MicroVM` reads above. `infrastructure.cluster.x-k8s.io`
+  // (CAPA's AWSManagedCluster, AWSManagedMachinePool, AWSClusterControllerIdentity)
+  // and `controlplane.cluster.x-k8s.io` (CAPA's AWSManagedControlPlane) are left on
+  // the first-segment rule — their kinds already carry an `AWS` prefix, so
+  // `K8s::Infrastructure::AWSManagedCluster` / `K8s::Controlplane::AWSManagedControlPlane`
+  // don't need the same rescue. `addons.cluster.x-k8s.io` (CAAPH's HelmChartProxy,
+  // core CAPI's ClusterResourceSet) likewise stays `Addons`.
+  "cluster.x-k8s.io": "CAPI",
 };
 
 /**

package/src/index.ts

@@ -4,6 +4,15 @@ export { k8sSerializer } from "./serializer";
 // Plugin
 export { k8sPlugin } from "./plugin";
 
+// Typed Op step-builder wrappers (chant #1288 Stage 2) — kubectlApply/
+// waitForReady/ensureSecret — are deliberately NOT re-exported here: their
+// types derive from the activities' own *Args interfaces, which name the API
+// client and therefore sit behind the #1074 dynamic-import boundary this
+// entry point must never reach, even type-only
+// (examples/k8s-client-boundary.test.ts). Import them via the subpath
+// `@intentius/chant-lexicon-k8s/op/builders`, the same way workers import
+// `@intentius/chant-lexicon-k8s/op/activities`.
+
 // The capability plugin core's loader discovers on this package (#1495 piece 2)
 // — the kubectl-apply leaf a component composes, the way aws contributes
 // cfn-deploy.
@@ -18,6 +27,10 @@ export { DEFAULT_LABELS_MARKER, DEFAULT_ANNOTATIONS_MARKER } from "./default-lab
 // Variables / label constants
 export { K8sLabels, K8sAnnotations } from "./variables";
 
+// Generated-once secret marker (#1830) — constants only; the store adapter
+// itself lives at the `/secret-store` subpath, off the build path (#1074).
+export { GENERATED_ONCE_LABEL_KEY, GENERATED_ONCE_LABEL_VALUE, isGeneratedOnce } from "./secret-labels";
+
 // MicroTime helpers — see micro-time.ts for why this exists.
 export { microTime, isMicroTimeFormatted } from "./micro-time";
 
@@ -38,6 +51,8 @@ export {
   AgicIngress, AzureDiskStorageClass, AzureFileStorageClass, AzureMonitorCollector,
   AksWorkloadIdentityServiceAccount,
   GkeFluentBitAgent, GkeOtelCollector, GkeExternalDnsAgent, AksExternalDnsAgent,
+  Model, resolveModelStorageUri,
+  OperatorStack, deriveHostVerbClass, DEFAULT_RESOURCE_RULES,
 } from "./composites/index";
 export type {
   WebAppProps, WebAppResult, StatefulAppProps, StatefulAppResult, CronWorkloadProps, CronWorkloadResult,
@@ -77,6 +92,8 @@ export type {
   GkeOtelCollectorProps, GkeOtelCollectorResult,
   GkeExternalDnsAgentProps, GkeExternalDnsAgentResult,
   AksExternalDnsAgentProps, AksExternalDnsAgentResult,
+  ModelSource, ModelProps, ModelResult,
+  OperatorDial, OperatorRbacResourceRule, OperatorStackConvergeHost, OperatorStackConfig, OperatorStackResult,
 } from "./composites/index";
 
 // RBAC verb constants

package/src/kube/apply.ts

@@ -96,6 +96,11 @@ export async function runApply(rawArgs: string[], deps: ApplyDeps = {}): Promise
   } else {
     console.log(`applied ${result.applied.length} object(s) as field manager "${result.fieldManager}"`);
     if (result.pruned.length > 0) console.log(`pruned ${result.pruned.length} chant-owned object(s) no longer declared`);
+    if ((result.retained ?? []).length > 0) {
+      console.log(
+        `retained ${result.retained!.length} generated-once secret(s) no longer declared — never pruned; delete explicitly if you mean to`,
+      );
+    }
   }
   return 0;
 }

package/src/lint/audit-catalog.ts

@@ -36,6 +36,13 @@ export const k8sAuditCatalog: Record<string, RuleMeta> = {
   WK8401: auditRule("WK8401", "merge-worthy", "guidance", "shmSize exceeds the container memory limit", "Lower shmSize or raise the memory limit so the pod can schedule.", { category: "best-practice" }),
   WK8402: auditRule("WK8402", "report-only", "guidance", "RayCluster missing spec.rayVersion", "Set spec.rayVersion so KubeRay picks the right autoscaler image.", { category: "best-practice" }),
   WK8403: auditRule("WK8403", "report-only", "guidance", "rayVersion does not match the head image tag", "Align spec.rayVersion with the Ray version in the head container image.", { category: "best-practice" }),
+  WK8404: auditRule("WK8404", "merge-worthy", "guidance", "GPU request without a matching toleration", "Add a toleration for the nvidia.com/gpu taint (or a wildcard Exists toleration) so the pod can schedule onto a GPU node pool.", { category: "correctness" }),
+  WK8405: auditRule("WK8405", "report-only", "guidance", "Serving workload has no PodDisruptionBudget", "Add a PDB selecting the InferenceService/serving Deployment so a node drain can't take down every replica at once.", { category: "best-practice" }),
+  WK8406: auditRule("WK8406", "merge-worthy", "guidance", "GPU container missing resource limits", "Set CPU and memory limits on GPU-requesting containers to avoid starving the (scarce, expensive) GPU node.", { category: "best-practice" }),
+  WK8407: auditRule("WK8407", "merge-worthy", "guidance", "Unpinned model version", "Pin the InferenceService model storageUri to an explicit version segment (e.g. via the Model composite's required version) instead of a floating tag.", { category: "correctness" }),
   WK8501: auditRule("WK8501", "merge-worthy", "guidance", "Custom resource spec has a field its CRD does not declare", "Fix the field name; the API server prunes unknown fields and the controller never sees them.", { category: "correctness" }),
   WK8502: auditRule("WK8502", "merge-worthy", "guidance", "Custom resource spec field has the wrong type or enum value", "Match the CRD schema: use the declared scalar type and one of the enum values.", { category: "correctness" }),
+  WK8503: auditRule("WK8503", "merge-worthy", "guidance", "Workload consumes a Secret nothing in the output produces", "Produce the Secret in the same build (Secret, ExternalSecret, InfisicalSecret, cert-manager Certificate), or declare its provenance with declareSecret() if it exists out of band.", { category: "correctness" }),
+  WK8504: auditRule("WK8504", "merge-worthy", "guidance", "committed-encrypted secret declaration does not resolve", "Point `file` at the committed ciphertext, make its metadata.name match the declaration, and re-run `sops -e -i` so every data/stringData value is ENC[...].", { authority: [K8S_SECRETS] }),
+  WK8505: auditRule("WK8505", "report-only", "guidance", "committed-encrypted secret with no Flux decryption wiring", "Add decryption: \"sops\" to the FluxAppFor reconciling the path that carries the ciphertext sidecar, or ignore if that Kustomization is declared in a different build.", { category: "correctness" }),
 };

package/src/lint/post-synth/argo-helpers.ts

@@ -6,7 +6,7 @@
  * Excluded from check auto-discovery by the "helper" filename filter.
  */
 import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, type K8sManifest } from "./k8s-helpers";
+import { docsToManifests, type K8sManifest } from "./k8s-helpers";
 
 /** The always-present, in-cluster Argo destination. */
 export const IN_CLUSTER_SERVER = "https://kubernetes.default.svc";
@@ -17,11 +17,7 @@ export const CLUSTER_SECRET_TYPE_LABEL = "argocd.argoproj.io/secret-type";
 
 /** All manifests across every lexicon output. */
 export function allManifests(ctx: PostSynthContext): K8sManifest[] {
-  const manifests: K8sManifest[] = [];
-  for (const [, output] of ctx.outputs) {
-    manifests.push(...parseK8sManifests(getPrimaryOutput(output)));
-  }
-  return manifests;
+  return docsToManifests(ctx);
 }
 
 /** Manifests of a given Argo kind. */

package/src/lint/post-synth/crd-schema-helpers.ts

@@ -14,7 +14,7 @@
 import { createRequire } from "module";
 import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
 import type { CrdFieldSchema } from "../../spec/parse";
-import { getPrimaryOutput, parseK8sManifests, type K8sManifest } from "./k8s-helpers";
+import { docsToManifests, type K8sManifest } from "./k8s-helpers";
 
 export type { CrdFieldSchema };
 
@@ -70,11 +70,9 @@ export function specSchemaFor(manifest: K8sManifest): CrdFieldSchema | undefined
 /** Every manifest in the build that has a shipped spec schema, with that schema. */
 export function customResources(ctx: PostSynthContext): Array<{ manifest: K8sManifest; schema: CrdFieldSchema }> {
   const out: Array<{ manifest: K8sManifest; schema: CrdFieldSchema }> = [];
-  for (const [, output] of ctx.outputs) {
-    for (const manifest of parseK8sManifests(getPrimaryOutput(output))) {
-      const schema = specSchemaFor(manifest);
-      if (schema) out.push({ manifest, schema });
-    }
+  for (const manifest of docsToManifests(ctx)) {
+    const schema = specSchemaFor(manifest);
+    if (schema) out.push({ manifest, schema });
   }
   return out;
 }

package/src/lint/post-synth/index.ts

@@ -31,8 +31,15 @@ import { wk8306 } from "./wk8306";
 import { wk8401 } from "./wk8401";
 import { wk8402 } from "./wk8402";
 import { wk8403 } from "./wk8403";
+import { wk8404 } from "./wk8404";
+import { wk8405 } from "./wk8405";
+import { wk8406 } from "./wk8406";
+import { wk8407 } from "./wk8407";
 import { wk8501 } from "./wk8501";
 import { wk8502 } from "./wk8502";
+import { wk8503 } from "./wk8503";
+import { wk8504 } from "./wk8504";
+import { wk8505 } from "./wk8505";
 
 export const postSynthChecks: PostSynthCheck[] = [
   argo002,
@@ -66,6 +73,13 @@ export const postSynthChecks: PostSynthCheck[] = [
   wk8401,
   wk8402,
   wk8403,
+  wk8404,
+  wk8405,
+  wk8406,
+  wk8407,
   wk8501,
   wk8502,
+  wk8503,
+  wk8504,
+  wk8505,
 ];

package/src/lint/post-synth/k8s-helpers.test.ts

@@ -1,12 +1,13 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import {
-  parseK8sManifests,
+  docsToManifests,
   extractContainers,
   extractPodSpec,
   WORKLOAD_KINDS,
 } from "./k8s-helpers";
 
-describe("parseK8sManifests", () => {
+describe("docsToManifests", () => {
   test("splits multi-doc YAML", () => {
     const yaml = `
 apiVersion: v1
@@ -19,7 +20,7 @@ kind: Deployment
 metadata:
   name: deploy
 `;
-    const manifests = parseK8sManifests(yaml);
+    const manifests = docsToManifests(makePostSynthCtx("k8s", yaml));
     expect(manifests.length).toBe(2);
     expect(manifests[0].kind).toBe("Service");
     expect(manifests[1].kind).toBe("Deployment");
@@ -34,16 +35,15 @@ metadata:
 data:
   key: value
 `;
-    const manifests = parseK8sManifests(yaml);
+    const manifests = docsToManifests(makePostSynthCtx("k8s", yaml));
     expect(manifests.length).toBe(1);
     expect(manifests[0].kind).toBe("ConfigMap");
   });
 
   test("handles empty/invalid YAML gracefully", () => {
-    expect(parseK8sManifests("")).toEqual([]);
-    expect(parseK8sManifests("---")).toEqual([]);
-    // "---\n---" doesn't split on /\n---\n/ — the full string is parsed as empty object
-    expect(parseK8sManifests("---\n---\n")).toEqual([]);
+    expect(docsToManifests(makePostSynthCtx("k8s", ""))).toEqual([]);
+    expect(docsToManifests(makePostSynthCtx("k8s", "---"))).toEqual([]);
+    expect(docsToManifests(makePostSynthCtx("k8s", "---\n---\n"))).toEqual([]);
   });
 
   test("skips blank documents between separators", () => {
@@ -60,9 +60,26 @@ kind: Service
 metadata:
   name: s
 `;
-    const manifests = parseK8sManifests(yaml);
+    const manifests = docsToManifests(makePostSynthCtx("k8s", yaml));
     expect(manifests.length).toBe(2);
   });
+
+  test("falls back to parsing ctx.outputs when ctx.docs is absent (hand-rolled test contexts)", () => {
+    const ctx = {
+      outputs: new Map([["k8s", "apiVersion: v1\nkind: Pod\nmetadata:\n  name: p\n"]]),
+      entities: new Map(),
+      buildResult: {
+        outputs: new Map([["k8s", "apiVersion: v1\nkind: Pod\nmetadata:\n  name: p\n"]]),
+        entities: new Map(),
+        warnings: [],
+        errors: [],
+        sourceFileCount: 1,
+      },
+    };
+    const manifests = docsToManifests(ctx);
+    expect(manifests.length).toBe(1);
+    expect(manifests[0].kind).toBe("Pod");
+  });
 });
 
 describe("extractContainers", () => {