@intentius/chant-lexicon-k8s 0.46.0 → 0.50.0

package/dist/op/activities/index.d.ts

@@ -19,6 +19,8 @@
  */
 export { kubectlApply, applyManifest, readManifestDocuments } from "./kubectl.js";
 export type { KubectlApplyArgs, ApplyManifestResult, AppliedRef, ApplyDeleteMode } from "./kubectl.js";
+export { ensureSecret } from "./ensure-secret.js";
+export type { EnsureSecretActivityArgs } from "./ensure-secret.js";
 export { waitForArgoSync, defaultArgoStatusFetcher, ArgoSyncFailedError } from "./argo.js";
 export type { WaitForArgoSyncArgs, ArgoAppStatus, ArgoStatusFetcher } from "./argo.js";
 export { waitForReady, defaultResourceFetcher, apiResourceFetcher, ReadinessFailedError, readinessFor, isReady, firstTerminal, DEFAULT_READINESS, READINESS_OVERRIDES, } from "./wait-for-ready.js";

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC/E,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEpG,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AACxF,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAEpF,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,cAAc,EACd,cAAc,EACd,SAAS,GACV,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACrG,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC/E,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAMpG,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AACxF,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAEpF,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,cAAc,EACd,cAAc,EACd,SAAS,GACV,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACrG,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/op/activities/kubectl.d.ts

@@ -116,6 +116,15 @@ export interface ApplyManifestResult {
     applied: AppliedRef[];
     /** Objects deleted because they carried chant's marker and are no longer declared. */
     pruned: AppliedRef[];
+    /**
+     * Owned, no longer declared, and deliberately KEPT (#1830, epic #1365
+     * decision 5): Secrets carrying the `chant.intentius.io/generated-once`
+     * label never enter the prunable set — the stored bytes are the only copy
+     * of material chant never held. Reported loudly here and on the console;
+     * deletion is an explicit act (`kubectl delete`, or a future gated op),
+     * never a prune's. Present whenever the prune ran.
+     */
+    retained?: AppliedRef[];
 }
 /** Read a manifest path — one file, or every YAML/JSON file in a directory. */
 export declare function readManifestDocuments(path: string): Record<string, unknown>[];

package/dist/op/activities/kubectl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kubectl.d.ts","sourceRoot":"","sources":["../../../src/op/activities/kubectl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAYH,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAI3E;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IACxB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,sCAAsC;AACtC,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,sFAAsF;IACtF,MAAM,EAAE,UAAU,EAAE,CAAC;CACtB;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAiB7E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjF;AAqHD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,mBAAmB,CAAC,CAkE9B;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAEf"}
+{"version":3,"file":"kubectl.d.ts","sourceRoot":"","sources":["../../../src/op/activities/kubectl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAYH,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAK3E;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IACxB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,sCAAsC;AACtC,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,sFAAsF;IACtF,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;CACzB;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAiB7E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjF;AAqHD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,mBAAmB,CAAC,CAkE9B;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/op/activities/wait-for-ready.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wait-for-ready.d.ts","sourceRoot":"","sources":["../../../src/op/activities/wait-for-ready.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE3E;;;;;;;;;;;;;;;;;GAiBG;AAIH,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,2DAA2D;AAC3D,MAAM,WAAW,SAAS;IACxB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACnC,4CAA4C;IAC5C,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;CAEhC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,SAAS,GAAG,oBAAoB,CAAC;AAE/E,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,aAG/B,CAAC;AAoBF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAyC7D,CAAC;AAEF,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAEnF;AAyDD,qFAAqF;AACrF,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAGlE;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,cAAc,GAAG,SAAS,CAE3F;AAID,6EAA6E;AAC7E,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,CAC5B,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEtC;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,YAAkC,GAAG,eAAe,CAmC/F;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,eAAsE,CAAC;AAE5G;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,eAAsC,GAC9C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAuBlC"}
+{"version":3,"file":"wait-for-ready.d.ts","sourceRoot":"","sources":["../../../src/op/activities/wait-for-ready.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE3E;;;;;;;;;;;;;;;;;GAiBG;AAIH,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,2DAA2D;AAC3D,MAAM,WAAW,SAAS;IACxB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACnC,4CAA4C;IAC5C,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;CAEhC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,SAAS,GAAG,oBAAoB,CAAC;AAE/E,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,aAG/B,CAAC;AA4CF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CA2C7D,CAAC;AAEF,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAEnF;AAyDD,qFAAqF;AACrF,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAGlE;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,cAAc,GAAG,SAAS,CAE3F;AAID,6EAA6E;AAC7E,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,CAC5B,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEtC;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,YAAkC,GAAG,eAAe,CAmC/F;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,eAAsE,CAAC;AAE5G;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,eAAsC,GAC9C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAuBlC"}

package/dist/op/builders.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Typed step-builder wrappers for this lexicon's activities (chant #1288
+ * Stage 2 — "regenerate the step builders as fully typed wrappers"). Core
+ * cannot import a lexicon's `*Args` types (lexicons depend on core, not the
+ * other way around — see `packages/core/src/op/activity-contract.ts`'s module
+ * doc for the same layering constraint on Stage 1's contracts), so a fully
+ * typed `kubectlApply`/`waitForReady`/`ensureSecret` has to live beside the
+ * `*Args` interface it derives from: here, next to `./activities/kubectl.ts`
+ * etc. `opts`'s type in each wrapper below IS the activity's own `*Args`
+ * interface (via `Omit`/`WithStepRefs`) — never a hand-restated mirror — so
+ * `kubectlApply`/`waitForReady`/`ensureSecret`'s full option surface (the
+ * dozen-plus cross-field options on `kubectlApply` that Stage 1's zod
+ * contracts deliberately skipped rather than duplicate) is authoring-time
+ * typed for free, and stays in sync with the implementation by construction.
+ *
+ * Every field also accepts a {@link StepOutputRef} in its place
+ * ({@link WithStepRefs}, chant #1950) — a later step's args can consume an
+ * earlier step's declared output.
+ *
+ * `core`'s own `kubectlApply`/`waitForReady`/`ensureSecret` (in
+ * `@intentius/chant/op`, re-exported from `@intentius/chant-lexicon-temporal`
+ * for lexicon-agnostic single-import convenience) are UNCHANGED and produce
+ * byte-identical `ActivityStep` output for the same inputs — these are purely
+ * additive. Deliberately not swapped into the temporal barrel: that would
+ * make `@intentius/chant-lexicon-temporal` depend on this package (and on
+ * helm, for `helmInstall`) at runtime, which is exactly the "a worker image
+ * needs no kubectl binary" / "temporal stays product-agnostic" property the
+ * `op/activities/index.ts` module docs across this repo call out on purpose
+ * (activities were moved OUT of temporal into per-product lexicons for this
+ * reason; the step-builder layer shouldn't reintroduce the coupling from the
+ * other direction). An author who wants the typed surface imports it from
+ * here — `@intentius/chant-lexicon-k8s` — which a project using `kubectlApply`
+ * already depends on; existing `@intentius/chant-lexicon-temporal` imports
+ * keep working exactly as before, opting in only if the import is changed.
+ */
+import { type ActivityStep, type NamedActivityStep, type WithStepRefs } from "@intentius/chant/op";
+import type { KubectlApplyArgs } from "./activities/kubectl.js";
+import type { WaitForReadyArgs } from "./activities/wait-for-ready.js";
+import type { EnsureSecretActivityArgs } from "./activities/ensure-secret.js";
+/** Extra opts every wrapper below accepts alongside its activity's own fields. */
+type StepOpts = {
+    profile?: ActivityStep["profile"];
+    id?: string;
+};
+/**
+ * Run `kubectl apply -f <manifest>` — the fully typed twin of core's
+ * `kubectlApply` step-builder shortcut (chant #1288 Stage 2). `opts` is
+ * {@link KubectlApplyArgs} itself (minus the positional `manifest`) — every
+ * field `applyManifest` accepts, including `deleteMode`, `force`,
+ * `fieldManager`, `documents`, is authoring-time typed here, not just the
+ * subset a hand-written zod mirror would bother restating. Defaults to the
+ * `longInfra` profile (override via `opts.profile`).
+ */
+export declare const kubectlApply: (manifest: string, opts?: WithStepRefs<Omit<KubectlApplyArgs, "manifest">> & StepOpts) => NamedActivityStep;
+/**
+ * Poll a Kubernetes resource until it reports ready, driven by a data-only
+ * readiness spec (CRD-aware; #365) — the fully typed twin of core's
+ * `waitForReady`. `opts` is {@link WaitForReadyArgs} itself, minus the
+ * positional `kind`/`name`. Defaults to the `k8sWait` profile.
+ */
+export declare const waitForReady: (kind: string, name: string, opts?: WithStepRefs<Omit<WaitForReadyArgs, "kind" | "name">> & StepOpts) => NamedActivityStep;
+/**
+ * Ensure a `generated-once` secret exists in the target store (#1829) — the
+ * fully typed twin of core's `ensureSecret`. `opts` is
+ * {@link EnsureSecretActivityArgs} itself, minus the positional `name`/`keys`.
+ */
+export declare const ensureSecret: (name: string, keys: string[], opts?: WithStepRefs<Omit<EnsureSecretActivityArgs, "name" | "keys">> & StepOpts) => NamedActivityStep;
+export {};
+//# sourceMappingURL=builders.d.ts.map

package/dist/op/builders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/op/builders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAE3E,kFAAkF;AAClF,KAAK,QAAQ,GAAG;IAAE,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,GACvB,UAAU,MAAM,EAChB,OAAO,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC,GAAG,QAAQ,KACjE,iBAGF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GACvB,MAAM,MAAM,EACZ,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,QAAQ,KACtE,iBAGF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,YAAY,GACvB,MAAM,MAAM,EACZ,MAAM,MAAM,EAAE,EACd,OAAO,YAAY,CAAC,IAAI,CAAC,wBAAwB,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9E,iBAGF,CAAC"}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AA2BjG,eAAO,MAAM,SAAS,EAAE,aAkrBvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AA6BjG,eAAO,MAAM,SAAS,EAAE,aAmsBvB,CAAC"}

package/dist/rules/argo-helpers.ts

@@ -6,7 +6,7 @@
  * Excluded from check auto-discovery by the "helper" filename filter.
  */
 import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, type K8sManifest } from "./k8s-helpers";
+import { docsToManifests, type K8sManifest } from "./k8s-helpers";
 
 /** The always-present, in-cluster Argo destination. */
 export const IN_CLUSTER_SERVER = "https://kubernetes.default.svc";
@@ -17,11 +17,7 @@ export const CLUSTER_SECRET_TYPE_LABEL = "argocd.argoproj.io/secret-type";
 
 /** All manifests across every lexicon output. */
 export function allManifests(ctx: PostSynthContext): K8sManifest[] {
-  const manifests: K8sManifest[] = [];
-  for (const [, output] of ctx.outputs) {
-    manifests.push(...parseK8sManifests(getPrimaryOutput(output)));
-  }
-  return manifests;
+  return docsToManifests(ctx);
 }
 
 /** Manifests of a given Argo kind. */

package/dist/rules/crd-schema-helpers.ts

@@ -14,7 +14,7 @@
 import { createRequire } from "module";
 import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
 import type { CrdFieldSchema } from "../../spec/parse";
-import { getPrimaryOutput, parseK8sManifests, type K8sManifest } from "./k8s-helpers";
+import { docsToManifests, type K8sManifest } from "./k8s-helpers";
 
 export type { CrdFieldSchema };
 
@@ -70,11 +70,9 @@ export function specSchemaFor(manifest: K8sManifest): CrdFieldSchema | undefined
 /** Every manifest in the build that has a shipped spec schema, with that schema. */
 export function customResources(ctx: PostSynthContext): Array<{ manifest: K8sManifest; schema: CrdFieldSchema }> {
   const out: Array<{ manifest: K8sManifest; schema: CrdFieldSchema }> = [];
-  for (const [, output] of ctx.outputs) {
-    for (const manifest of parseK8sManifests(getPrimaryOutput(output))) {
-      const schema = specSchemaFor(manifest);
-      if (schema) out.push({ manifest, schema });
-    }
+  for (const manifest of docsToManifests(ctx)) {
+    const schema = specSchemaFor(manifest);
+    if (schema) out.push({ manifest, schema });
   }
   return out;
 }

package/dist/rules/k8s-helpers.ts

@@ -1,12 +1,12 @@
 /**
  * Shared helpers for Kubernetes post-synthesis lint rules.
  *
- * Provides YAML parsing for multi-document K8s manifests and container
- * extraction logic that handles all common workload types.
+ * Provides the `ctx.docs` → `K8sManifest[]` bridge every check reads through,
+ * and container extraction logic that handles all common workload types.
  */
 
-import { parseYAML } from "@intentius/chant/yaml";
-export { getPrimaryOutput } from "@intentius/chant/lint/post-synth";
+import { parseOutputDocs, type PostSynthContext } from "@intentius/chant/lint/post-synth";
+export { getPrimaryOutput, getAdditionalFiles } from "@intentius/chant/lint/post-synth";
 
 /**
  * A parsed Kubernetes manifest (loosely typed).
@@ -45,27 +45,36 @@ export interface K8sContainer {
 }
 
 /**
- * Split a multi-document YAML string on `---` boundaries and parse each
- * document into a K8sManifest.
+ * Every parsed Kubernetes manifest across all lexicon outputs, via `ctx.docs`
+ * (chant #975) — the shared, parse-once view every k8s post-synth check
+ * reads, in place of the old per-check `parseK8sManifests(getPrimaryOutput(output))`
+ * splitter (chant #976). Two documents are dropped rather than passed through
+ * as a "manifest":
+ *
+ * - `d.error` — a document `parseOutputDocs` could not make sense of.
+ * - `d.file` — a document that came from a `SerializerResult.files` sidecar
+ *   (a committed-encrypted secret's ciphertext, in this lexicon) rather than
+ *   a lexicon's primary output. `parseK8sManifests` only ever saw
+ *   `getPrimaryOutput(output)`, so a sidecar was invisible to every general
+ *   manifest-consuming check — see `getAdditionalFiles`'s doc comment on why
+ *   that separation is deliberate. Only `sops-helpers.ts`'s
+ *   `resolveEncryptedSecretClaims` (WK8504/WK8503's producer join) reads
+ *   `.files` explicitly; this bridge must keep it that way.
+ *
+ * `ctx.docs` is populated by every context chant itself builds (`chant
+ * build`, `@intentius/chant-test-utils`'s `createPostSynthContext` /
+ * `makePostSynthCtx*`) — see `PostSynthContext.docs`'s doc comment for why
+ * it is still optional at the type level. A handful of this lexicon's own
+ * hand-rolled `PostSynthContext` test literals (`post-synth.test.ts`'s
+ * `makeCtx`) predate that field and never set it; for those, fall back to
+ * parsing `ctx.outputs` directly with the same `parseOutputDocs` primitive,
+ * rather than silently returning no manifests.
  */
-export function parseK8sManifests(yaml: string): K8sManifest[] {
-  const documents = yaml.split(/\n---\n/);
-  const manifests: K8sManifest[] = [];
-
-  for (const doc of documents) {
-    const trimmed = doc.trim();
-    if (trimmed === "" || trimmed === "---") continue;
-    try {
-      const parsed = parseYAML(trimmed);
-      if (typeof parsed === "object" && parsed !== null) {
-        manifests.push(parsed as K8sManifest);
-      }
-    } catch {
-      // Skip unparseable documents
-    }
-  }
-
-  return manifests;
+export function docsToManifests(ctx: PostSynthContext): K8sManifest[] {
+  const docs = ctx.docs ?? parseOutputDocs(ctx.outputs);
+  return docs
+    .filter((d) => !d.error && !d.file)
+    .map((d) => d.value as K8sManifest);
 }
 
 /**
@@ -103,6 +112,13 @@ export function extractPodSpec(
       return (template?.spec as Record<string, unknown>) ?? null;
     }
 
+    // KServe ServingRuntime/ClusterServingRuntime carry `containers` and
+    // `tolerations` directly on spec — no template wrapper, unlike the
+    // built-in workload kinds above.
+    case "ServingRuntime":
+    case "ClusterServingRuntime":
+      return spec;
+
     default:
       return null;
   }
@@ -148,6 +164,53 @@ export const WORKLOAD_KINDS = new Set([
   "CronJob",
 ]);
 
+/**
+ * Workload kinds that can request `nvidia.com/gpu` — the built-in workload
+ * kinds plus KServe's ServingRuntime/ClusterServingRuntime, which declare
+ * `containers`/`tolerations` directly on spec (see `extractPodSpec`).
+ */
+export const GPU_POD_KINDS = new Set([
+  ...WORKLOAD_KINDS,
+  "ServingRuntime",
+  "ClusterServingRuntime",
+]);
+
+/** A Kubernetes toleration (loosely typed). */
+export interface K8sToleration {
+  key?: string;
+  operator?: "Exists" | "Equal";
+  value?: string;
+  effect?: string;
+  [key: string]: unknown;
+}
+
+/** Resource name used for GPU requests/limits across the lexicon. */
+export const NVIDIA_GPU_RESOURCE = "nvidia.com/gpu";
+
+/**
+ * True when any container in `containers` requests or limits
+ * `nvidia.com/gpu`.
+ */
+export function requestsGpu(containers: K8sContainer[]): boolean {
+  return containers.some((c) => {
+    const requests = c.resources?.requests as Record<string, unknown> | undefined;
+    const limits = c.resources?.limits as Record<string, unknown> | undefined;
+    return Boolean(requests?.[NVIDIA_GPU_RESOURCE]) || Boolean(limits?.[NVIDIA_GPU_RESOURCE]);
+  });
+}
+
+/**
+ * True when `tolerations` includes one that tolerates the `nvidia.com/gpu`
+ * taint — either an explicit `key: "nvidia.com/gpu"` toleration, or a
+ * wildcard `{ operator: "Exists" }` with no key (tolerates every taint).
+ */
+export function toleratesGpu(tolerations: unknown): boolean {
+  if (!Array.isArray(tolerations)) return false;
+  return (tolerations as K8sToleration[]).some(
+    (t) => t.key === NVIDIA_GPU_RESOURCE || (t.operator === "Exists" && !t.key),
+  );
+}
+
 /**
  * Parse a Kubernetes memory string to bytes.
  *

package/dist/rules/sops-helpers.ts

@@ -0,0 +1,76 @@
+/**
+ * Shared helper for the committed-encrypted secret checks: join each
+ * `declareSecret({ provenance: "committed-encrypted" })` in the entity map to
+ * the sidecar file the build emitted for it.
+ *
+ * The join has to go through `output.files`, not `getPrimaryOutput`. The
+ * ciphertext is deliberately kept OUT of the primary output — that is what
+ * makes applying an undecrypted Secret structurally impossible — so a check
+ * that reads only the primary output sees nothing at all here.
+ *
+ * Excluded from check auto-discovery by the "helper" filename filter.
+ */
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { CommittedEncryptedSecretDeclaration } from "@intentius/chant/secret-provenance";
+import { getAdditionalFiles } from "./k8s-helpers";
+import { committedEncryptedDeclarations, sidecarFilename, validateEncryptedSecretDocument, type EncryptedSecretDocument } from "../../sops/encrypted-secret-file";
+
+/** One committed-encrypted declaration, joined to what the build emitted for it. */
+export interface ResolvedEncryptedSecret {
+  /** The entity-map key the declaration was discovered under. */
+  entityName: string;
+  declaration: CommittedEncryptedSecretDeclaration;
+  /** The sidecar filename the declaration's path maps to. */
+  filename: string;
+  /** Undefined when the build emitted no such sidecar — the file did not resolve. */
+  text?: string;
+  /** Everything wrong with the emitted document. Empty when it is clean. */
+  problems: string[];
+  /** Parsed structure, when the document parsed at all. */
+  document?: EncryptedSecretDocument;
+}
+
+/** Every sidecar file across every lexicon output, keyed by filename. */
+export function allAdditionalFiles(ctx: PostSynthContext): Map<string, string> {
+  const files = new Map<string, string>();
+  for (const [, output] of ctx.outputs) {
+    for (const [filename, content] of Object.entries(getAdditionalFiles(output))) {
+      files.set(filename, content);
+    }
+  }
+  return files;
+}
+
+/**
+ * Join every committed-encrypted declaration to its emitted sidecar,
+ * validating the document as it goes. A declaration with no sidecar comes
+ * back with `text` undefined and one problem naming the missing file.
+ */
+export function resolveEncryptedSecretClaims(ctx: PostSynthContext): ResolvedEncryptedSecret[] {
+  const declarations = committedEncryptedDeclarations(ctx.entities);
+  if (declarations.size === 0) return [];
+
+  const files = allAdditionalFiles(ctx);
+  const resolved: ResolvedEncryptedSecret[] = [];
+
+  for (const [entityName, declaration] of declarations) {
+    const filename = sidecarFilename(declaration.file);
+    const text = files.get(filename);
+    if (text === undefined) {
+      resolved.push({
+        entityName,
+        declaration,
+        filename,
+        problems: [
+          `the build emitted no file for "${declaration.file}" — ` +
+            `the declared ciphertext did not resolve`,
+        ],
+      });
+      continue;
+    }
+    const { problems, document } = validateEncryptedSecretDocument(text, declaration);
+    resolved.push({ entityName, declaration, filename, text, problems, document });
+  }
+
+  return resolved;
+}

package/dist/rules/wk8005.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
 
 const SENSITIVE_NAME_PATTERN = /password|token|key|secret/i;
 
@@ -18,37 +18,32 @@ export const wk8005: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
-
-        const containers = extractContainers(manifest);
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
-
-        for (const container of containers) {
-          if (!Array.isArray(container.env)) continue;
-
-          for (const envVar of container.env) {
-            if (
-              typeof envVar.name === "string" &&
-              SENSITIVE_NAME_PATTERN.test(envVar.name) &&
-              envVar.value !== undefined &&
-              envVar.value !== null &&
-              typeof envVar.value === "string" &&
-              envVar.value !== "" &&
-              !envVar.valueFrom
-            ) {
-              diagnostics.push({
-                checkId: "WK8005",
-                severity: "error",
-                message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has hardcoded value for sensitive env var "${envVar.name}" — use secretKeyRef instead`,
-                entity: resourceName,
-                lexicon: "k8s",
-              });
-            }
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+
+      const containers = extractContainers(manifest);
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
+
+      for (const container of containers) {
+        if (!Array.isArray(container.env)) continue;
+
+        for (const envVar of container.env) {
+          if (
+            typeof envVar.name === "string" &&
+            SENSITIVE_NAME_PATTERN.test(envVar.name) &&
+            envVar.value !== undefined &&
+            envVar.value !== null &&
+            typeof envVar.value === "string" &&
+            envVar.value !== "" &&
+            !envVar.valueFrom
+          ) {
+            diagnostics.push({
+              checkId: "WK8005",
+              severity: "error",
+              message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has hardcoded value for sensitive env var "${envVar.name}" — use secretKeyRef instead`,
+              entity: resourceName,
+              lexicon: "k8s",
+            });
           }
         }
       }

package/dist/rules/wk8006.ts

@@ -6,7 +6,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
 
 export const wk8006: PostSynthCheck = {
   id: "WK8006",
@@ -15,49 +15,44 @@ export const wk8006: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
-
-        const containers = extractContainers(manifest);
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
-
-        for (const container of containers) {
-          const image = container.image;
-          if (typeof image !== "string" || image === "") continue;
-
-          // Split off digest (@sha256:...) — those are pinned and fine
-          if (image.includes("@")) continue;
-
-          // Extract the tag portion (after the last colon that isn't part of a port)
-          // Images can be: name, name:tag, registry:port/name, registry:port/name:tag
-          const slashIndex = image.lastIndexOf("/");
-          const afterSlash = slashIndex >= 0 ? image.slice(slashIndex + 1) : image;
-          const colonIndex = afterSlash.lastIndexOf(":");
-
-          if (colonIndex === -1) {
-            // No tag at all
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+
+      const containers = extractContainers(manifest);
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
+
+      for (const container of containers) {
+        const image = container.image;
+        if (typeof image !== "string" || image === "") continue;
+
+        // Split off digest (@sha256:...) — those are pinned and fine
+        if (image.includes("@")) continue;
+
+        // Extract the tag portion (after the last colon that isn't part of a port)
+        // Images can be: name, name:tag, registry:port/name, registry:port/name:tag
+        const slashIndex = image.lastIndexOf("/");
+        const afterSlash = slashIndex >= 0 ? image.slice(slashIndex + 1) : image;
+        const colonIndex = afterSlash.lastIndexOf(":");
+
+        if (colonIndex === -1) {
+          // No tag at all
+          diagnostics.push({
+            checkId: "WK8006",
+            severity: "warning",
+            message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" uses untagged image "${image}" — specify an explicit version tag`,
+            entity: resourceName,
+            lexicon: "k8s",
+          });
+        } else {
+          const tag = afterSlash.slice(colonIndex + 1);
+          if (tag === "latest") {
             diagnostics.push({
               checkId: "WK8006",
               severity: "warning",
-              message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" uses untagged image "${image}" — specify an explicit version tag`,
+              message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" uses :latest tag on image "${image}" — use a specific version tag`,
               entity: resourceName,
               lexicon: "k8s",
             });
-          } else {
-            const tag = afterSlash.slice(colonIndex + 1);
-            if (tag === "latest") {
-              diagnostics.push({
-                checkId: "WK8006",
-                severity: "warning",
-                message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" uses :latest tag on image "${image}" — use a specific version tag`,
-                entity: resourceName,
-                lexicon: "k8s",
-              });
-            }
           }
         }
       }

package/dist/rules/wk8041.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
 
 /**
  * Known API key patterns and their descriptions.
@@ -35,33 +35,28 @@ export const wk8041: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
 
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+      const containers = extractContainers(manifest);
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
 
-        const containers = extractContainers(manifest);
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
+      for (const container of containers) {
+        if (!Array.isArray(container.env)) continue;
 
-        for (const container of containers) {
-          if (!Array.isArray(container.env)) continue;
+        for (const envVar of container.env) {
+          if (typeof envVar.value !== "string" || envVar.value === "") continue;
 
-          for (const envVar of container.env) {
-            if (typeof envVar.value !== "string" || envVar.value === "") continue;
-
-            for (const { pattern, label } of API_KEY_PATTERNS) {
-              if (pattern.test(envVar.value)) {
-                diagnostics.push({
-                  checkId: "WK8041",
-                  severity: "error",
-                  message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has a ${label} hardcoded in env var "${envVar.name ?? "(unnamed)"}" — use a Secret reference instead`,
-                  entity: resourceName,
-                  lexicon: "k8s",
-                });
-                break; // One match per env var is sufficient
-              }
+          for (const { pattern, label } of API_KEY_PATTERNS) {
+            if (pattern.test(envVar.value)) {
+              diagnostics.push({
+                checkId: "WK8041",
+                severity: "error",
+                message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has a ${label} hardcoded in env var "${envVar.name ?? "(unnamed)"}" — use a Secret reference instead`,
+                entity: resourceName,
+                lexicon: "k8s",
+              });
+              break; // One match per env var is sufficient
             }
           }
         }