@intentius/chant-lexicon-k8s 0.49.0 → 0.50.0

package/dist/lint/post-synth/wk8404.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wk8404.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8404.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAW9G,eAAO,MAAM,MAAM,EAAE,cAiCpB,CAAC"}
+{"version":3,"file":"wk8404.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8404.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAU9G,eAAO,MAAM,MAAM,EAAE,cA4BpB,CAAC"}

package/dist/lint/post-synth/wk8405.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wk8405.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8405.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAc9G,eAAO,MAAM,MAAM,EAAE,cAiCpB,CAAC"}
+{"version":3,"file":"wk8405.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8405.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAc9G,eAAO,MAAM,MAAM,EAAE,cA8BpB,CAAC"}

package/dist/lint/post-synth/wk8406.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wk8406.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8406.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA8CpB,CAAC"}
+{"version":3,"file":"wk8406.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8406.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAyCpB,CAAC"}

package/dist/lint/post-synth/wk8407.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wk8407.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8407.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAM9G;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAS9D;AAED,eAAO,MAAM,MAAM,EAAE,cAmCpB,CAAC"}
+{"version":3,"file":"wk8407.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8407.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAM9G;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAS9D;AAED,eAAO,MAAM,MAAM,EAAE,cA8BpB,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.49.0",
+  "version": "0.50.0",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/dist/op/builders.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Typed step-builder wrappers for this lexicon's activities (chant #1288
+ * Stage 2 — "regenerate the step builders as fully typed wrappers"). Core
+ * cannot import a lexicon's `*Args` types (lexicons depend on core, not the
+ * other way around — see `packages/core/src/op/activity-contract.ts`'s module
+ * doc for the same layering constraint on Stage 1's contracts), so a fully
+ * typed `kubectlApply`/`waitForReady`/`ensureSecret` has to live beside the
+ * `*Args` interface it derives from: here, next to `./activities/kubectl.ts`
+ * etc. `opts`'s type in each wrapper below IS the activity's own `*Args`
+ * interface (via `Omit`/`WithStepRefs`) — never a hand-restated mirror — so
+ * `kubectlApply`/`waitForReady`/`ensureSecret`'s full option surface (the
+ * dozen-plus cross-field options on `kubectlApply` that Stage 1's zod
+ * contracts deliberately skipped rather than duplicate) is authoring-time
+ * typed for free, and stays in sync with the implementation by construction.
+ *
+ * Every field also accepts a {@link StepOutputRef} in its place
+ * ({@link WithStepRefs}, chant #1950) — a later step's args can consume an
+ * earlier step's declared output.
+ *
+ * `core`'s own `kubectlApply`/`waitForReady`/`ensureSecret` (in
+ * `@intentius/chant/op`, re-exported from `@intentius/chant-lexicon-temporal`
+ * for lexicon-agnostic single-import convenience) are UNCHANGED and produce
+ * byte-identical `ActivityStep` output for the same inputs — these are purely
+ * additive. Deliberately not swapped into the temporal barrel: that would
+ * make `@intentius/chant-lexicon-temporal` depend on this package (and on
+ * helm, for `helmInstall`) at runtime, which is exactly the "a worker image
+ * needs no kubectl binary" / "temporal stays product-agnostic" property the
+ * `op/activities/index.ts` module docs across this repo call out on purpose
+ * (activities were moved OUT of temporal into per-product lexicons for this
+ * reason; the step-builder layer shouldn't reintroduce the coupling from the
+ * other direction). An author who wants the typed surface imports it from
+ * here — `@intentius/chant-lexicon-k8s` — which a project using `kubectlApply`
+ * already depends on; existing `@intentius/chant-lexicon-temporal` imports
+ * keep working exactly as before, opting in only if the import is changed.
+ */
+import { type ActivityStep, type NamedActivityStep, type WithStepRefs } from "@intentius/chant/op";
+import type { KubectlApplyArgs } from "./activities/kubectl.js";
+import type { WaitForReadyArgs } from "./activities/wait-for-ready.js";
+import type { EnsureSecretActivityArgs } from "./activities/ensure-secret.js";
+/** Extra opts every wrapper below accepts alongside its activity's own fields. */
+type StepOpts = {
+    profile?: ActivityStep["profile"];
+    id?: string;
+};
+/**
+ * Run `kubectl apply -f <manifest>` — the fully typed twin of core's
+ * `kubectlApply` step-builder shortcut (chant #1288 Stage 2). `opts` is
+ * {@link KubectlApplyArgs} itself (minus the positional `manifest`) — every
+ * field `applyManifest` accepts, including `deleteMode`, `force`,
+ * `fieldManager`, `documents`, is authoring-time typed here, not just the
+ * subset a hand-written zod mirror would bother restating. Defaults to the
+ * `longInfra` profile (override via `opts.profile`).
+ */
+export declare const kubectlApply: (manifest: string, opts?: WithStepRefs<Omit<KubectlApplyArgs, "manifest">> & StepOpts) => NamedActivityStep;
+/**
+ * Poll a Kubernetes resource until it reports ready, driven by a data-only
+ * readiness spec (CRD-aware; #365) — the fully typed twin of core's
+ * `waitForReady`. `opts` is {@link WaitForReadyArgs} itself, minus the
+ * positional `kind`/`name`. Defaults to the `k8sWait` profile.
+ */
+export declare const waitForReady: (kind: string, name: string, opts?: WithStepRefs<Omit<WaitForReadyArgs, "kind" | "name">> & StepOpts) => NamedActivityStep;
+/**
+ * Ensure a `generated-once` secret exists in the target store (#1829) — the
+ * fully typed twin of core's `ensureSecret`. `opts` is
+ * {@link EnsureSecretActivityArgs} itself, minus the positional `name`/`keys`.
+ */
+export declare const ensureSecret: (name: string, keys: string[], opts?: WithStepRefs<Omit<EnsureSecretActivityArgs, "name" | "keys">> & StepOpts) => NamedActivityStep;
+export {};
+//# sourceMappingURL=builders.d.ts.map

package/dist/op/builders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/op/builders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAE3E,kFAAkF;AAClF,KAAK,QAAQ,GAAG;IAAE,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,GACvB,UAAU,MAAM,EAChB,OAAO,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC,GAAG,QAAQ,KACjE,iBAGF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GACvB,MAAM,MAAM,EACZ,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,QAAQ,KACtE,iBAGF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,YAAY,GACvB,MAAM,MAAM,EACZ,MAAM,MAAM,EAAE,EACd,OAAO,YAAY,CAAC,IAAI,CAAC,wBAAwB,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9E,iBAGF,CAAC"}

package/dist/rules/argo-helpers.ts

@@ -6,7 +6,7 @@
  * Excluded from check auto-discovery by the "helper" filename filter.
  */
 import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, type K8sManifest } from "./k8s-helpers";
+import { docsToManifests, type K8sManifest } from "./k8s-helpers";
 
 /** The always-present, in-cluster Argo destination. */
 export const IN_CLUSTER_SERVER = "https://kubernetes.default.svc";
@@ -17,11 +17,7 @@ export const CLUSTER_SECRET_TYPE_LABEL = "argocd.argoproj.io/secret-type";
 
 /** All manifests across every lexicon output. */
 export function allManifests(ctx: PostSynthContext): K8sManifest[] {
-  const manifests: K8sManifest[] = [];
-  for (const [, output] of ctx.outputs) {
-    manifests.push(...parseK8sManifests(getPrimaryOutput(output)));
-  }
-  return manifests;
+  return docsToManifests(ctx);
 }
 
 /** Manifests of a given Argo kind. */

package/dist/rules/crd-schema-helpers.ts

@@ -14,7 +14,7 @@
 import { createRequire } from "module";
 import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
 import type { CrdFieldSchema } from "../../spec/parse";
-import { getPrimaryOutput, parseK8sManifests, type K8sManifest } from "./k8s-helpers";
+import { docsToManifests, type K8sManifest } from "./k8s-helpers";
 
 export type { CrdFieldSchema };
 
@@ -70,11 +70,9 @@ export function specSchemaFor(manifest: K8sManifest): CrdFieldSchema | undefined
 /** Every manifest in the build that has a shipped spec schema, with that schema. */
 export function customResources(ctx: PostSynthContext): Array<{ manifest: K8sManifest; schema: CrdFieldSchema }> {
   const out: Array<{ manifest: K8sManifest; schema: CrdFieldSchema }> = [];
-  for (const [, output] of ctx.outputs) {
-    for (const manifest of parseK8sManifests(getPrimaryOutput(output))) {
-      const schema = specSchemaFor(manifest);
-      if (schema) out.push({ manifest, schema });
-    }
+  for (const manifest of docsToManifests(ctx)) {
+    const schema = specSchemaFor(manifest);
+    if (schema) out.push({ manifest, schema });
   }
   return out;
 }

package/dist/rules/k8s-helpers.ts

@@ -1,11 +1,11 @@
 /**
  * Shared helpers for Kubernetes post-synthesis lint rules.
  *
- * Provides YAML parsing for multi-document K8s manifests and container
- * extraction logic that handles all common workload types.
+ * Provides the `ctx.docs` → `K8sManifest[]` bridge every check reads through,
+ * and container extraction logic that handles all common workload types.
  */
 
-import { parseYAML } from "@intentius/chant/yaml";
+import { parseOutputDocs, type PostSynthContext } from "@intentius/chant/lint/post-synth";
 export { getPrimaryOutput, getAdditionalFiles } from "@intentius/chant/lint/post-synth";
 
 /**
@@ -45,27 +45,36 @@ export interface K8sContainer {
 }
 
 /**
- * Split a multi-document YAML string on `---` boundaries and parse each
- * document into a K8sManifest.
+ * Every parsed Kubernetes manifest across all lexicon outputs, via `ctx.docs`
+ * (chant #975) — the shared, parse-once view every k8s post-synth check
+ * reads, in place of the old per-check `parseK8sManifests(getPrimaryOutput(output))`
+ * splitter (chant #976). Two documents are dropped rather than passed through
+ * as a "manifest":
+ *
+ * - `d.error` — a document `parseOutputDocs` could not make sense of.
+ * - `d.file` — a document that came from a `SerializerResult.files` sidecar
+ *   (a committed-encrypted secret's ciphertext, in this lexicon) rather than
+ *   a lexicon's primary output. `parseK8sManifests` only ever saw
+ *   `getPrimaryOutput(output)`, so a sidecar was invisible to every general
+ *   manifest-consuming check — see `getAdditionalFiles`'s doc comment on why
+ *   that separation is deliberate. Only `sops-helpers.ts`'s
+ *   `resolveEncryptedSecretClaims` (WK8504/WK8503's producer join) reads
+ *   `.files` explicitly; this bridge must keep it that way.
+ *
+ * `ctx.docs` is populated by every context chant itself builds (`chant
+ * build`, `@intentius/chant-test-utils`'s `createPostSynthContext` /
+ * `makePostSynthCtx*`) — see `PostSynthContext.docs`'s doc comment for why
+ * it is still optional at the type level. A handful of this lexicon's own
+ * hand-rolled `PostSynthContext` test literals (`post-synth.test.ts`'s
+ * `makeCtx`) predate that field and never set it; for those, fall back to
+ * parsing `ctx.outputs` directly with the same `parseOutputDocs` primitive,
+ * rather than silently returning no manifests.
  */
-export function parseK8sManifests(yaml: string): K8sManifest[] {
-  const documents = yaml.split(/\n---\n/);
-  const manifests: K8sManifest[] = [];
-
-  for (const doc of documents) {
-    const trimmed = doc.trim();
-    if (trimmed === "" || trimmed === "---") continue;
-    try {
-      const parsed = parseYAML(trimmed);
-      if (typeof parsed === "object" && parsed !== null) {
-        manifests.push(parsed as K8sManifest);
-      }
-    } catch {
-      // Skip unparseable documents
-    }
-  }
-
-  return manifests;
+export function docsToManifests(ctx: PostSynthContext): K8sManifest[] {
+  const docs = ctx.docs ?? parseOutputDocs(ctx.outputs);
+  return docs
+    .filter((d) => !d.error && !d.file)
+    .map((d) => d.value as K8sManifest);
 }
 
 /**

package/dist/rules/wk8005.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
 
 const SENSITIVE_NAME_PATTERN = /password|token|key|secret/i;
 
@@ -18,37 +18,32 @@ export const wk8005: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
-
-        const containers = extractContainers(manifest);
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
-
-        for (const container of containers) {
-          if (!Array.isArray(container.env)) continue;
-
-          for (const envVar of container.env) {
-            if (
-              typeof envVar.name === "string" &&
-              SENSITIVE_NAME_PATTERN.test(envVar.name) &&
-              envVar.value !== undefined &&
-              envVar.value !== null &&
-              typeof envVar.value === "string" &&
-              envVar.value !== "" &&
-              !envVar.valueFrom
-            ) {
-              diagnostics.push({
-                checkId: "WK8005",
-                severity: "error",
-                message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has hardcoded value for sensitive env var "${envVar.name}" — use secretKeyRef instead`,
-                entity: resourceName,
-                lexicon: "k8s",
-              });
-            }
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+
+      const containers = extractContainers(manifest);
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
+
+      for (const container of containers) {
+        if (!Array.isArray(container.env)) continue;
+
+        for (const envVar of container.env) {
+          if (
+            typeof envVar.name === "string" &&
+            SENSITIVE_NAME_PATTERN.test(envVar.name) &&
+            envVar.value !== undefined &&
+            envVar.value !== null &&
+            typeof envVar.value === "string" &&
+            envVar.value !== "" &&
+            !envVar.valueFrom
+          ) {
+            diagnostics.push({
+              checkId: "WK8005",
+              severity: "error",
+              message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has hardcoded value for sensitive env var "${envVar.name}" — use secretKeyRef instead`,
+              entity: resourceName,
+              lexicon: "k8s",
+            });
           }
         }
       }

package/dist/rules/wk8006.ts

@@ -6,7 +6,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
 
 export const wk8006: PostSynthCheck = {
   id: "WK8006",
@@ -15,49 +15,44 @@ export const wk8006: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
-
-        const containers = extractContainers(manifest);
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
-
-        for (const container of containers) {
-          const image = container.image;
-          if (typeof image !== "string" || image === "") continue;
-
-          // Split off digest (@sha256:...) — those are pinned and fine
-          if (image.includes("@")) continue;
-
-          // Extract the tag portion (after the last colon that isn't part of a port)
-          // Images can be: name, name:tag, registry:port/name, registry:port/name:tag
-          const slashIndex = image.lastIndexOf("/");
-          const afterSlash = slashIndex >= 0 ? image.slice(slashIndex + 1) : image;
-          const colonIndex = afterSlash.lastIndexOf(":");
-
-          if (colonIndex === -1) {
-            // No tag at all
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+
+      const containers = extractContainers(manifest);
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
+
+      for (const container of containers) {
+        const image = container.image;
+        if (typeof image !== "string" || image === "") continue;
+
+        // Split off digest (@sha256:...) — those are pinned and fine
+        if (image.includes("@")) continue;
+
+        // Extract the tag portion (after the last colon that isn't part of a port)
+        // Images can be: name, name:tag, registry:port/name, registry:port/name:tag
+        const slashIndex = image.lastIndexOf("/");
+        const afterSlash = slashIndex >= 0 ? image.slice(slashIndex + 1) : image;
+        const colonIndex = afterSlash.lastIndexOf(":");
+
+        if (colonIndex === -1) {
+          // No tag at all
+          diagnostics.push({
+            checkId: "WK8006",
+            severity: "warning",
+            message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" uses untagged image "${image}" — specify an explicit version tag`,
+            entity: resourceName,
+            lexicon: "k8s",
+          });
+        } else {
+          const tag = afterSlash.slice(colonIndex + 1);
+          if (tag === "latest") {
             diagnostics.push({
               checkId: "WK8006",
               severity: "warning",
-              message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" uses untagged image "${image}" — specify an explicit version tag`,
+              message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" uses :latest tag on image "${image}" — use a specific version tag`,
               entity: resourceName,
               lexicon: "k8s",
             });
-          } else {
-            const tag = afterSlash.slice(colonIndex + 1);
-            if (tag === "latest") {
-              diagnostics.push({
-                checkId: "WK8006",
-                severity: "warning",
-                message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" uses :latest tag on image "${image}" — use a specific version tag`,
-                entity: resourceName,
-                lexicon: "k8s",
-              });
-            }
           }
         }
       }

package/dist/rules/wk8041.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
 
 /**
  * Known API key patterns and their descriptions.
@@ -35,33 +35,28 @@ export const wk8041: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
 
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+      const containers = extractContainers(manifest);
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
 
-        const containers = extractContainers(manifest);
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
+      for (const container of containers) {
+        if (!Array.isArray(container.env)) continue;
 
-        for (const container of containers) {
-          if (!Array.isArray(container.env)) continue;
+        for (const envVar of container.env) {
+          if (typeof envVar.value !== "string" || envVar.value === "") continue;
 
-          for (const envVar of container.env) {
-            if (typeof envVar.value !== "string" || envVar.value === "") continue;
-
-            for (const { pattern, label } of API_KEY_PATTERNS) {
-              if (pattern.test(envVar.value)) {
-                diagnostics.push({
-                  checkId: "WK8041",
-                  severity: "error",
-                  message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has a ${label} hardcoded in env var "${envVar.name ?? "(unnamed)"}" — use a Secret reference instead`,
-                  entity: resourceName,
-                  lexicon: "k8s",
-                });
-                break; // One match per env var is sufficient
-              }
+          for (const { pattern, label } of API_KEY_PATTERNS) {
+            if (pattern.test(envVar.value)) {
+              diagnostics.push({
+                checkId: "WK8041",
+                severity: "error",
+                message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has a ${label} hardcoded in env var "${envVar.name ?? "(unnamed)"}" — use a Secret reference instead`,
+                entity: resourceName,
+                lexicon: "k8s",
+              });
+              break; // One match per env var is sufficient
             }
           }
         }

package/dist/rules/wk8042.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests } from "./k8s-helpers";
+import { docsToManifests } from "./k8s-helpers";
 
 const PRIVATE_KEY_PATTERN = /-----BEGIN\s+[\w\s]*PRIVATE KEY-----/;
 
@@ -18,27 +18,22 @@ export const wk8042: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (manifest.kind !== "ConfigMap") continue;
-
-        const resourceName = manifest.metadata?.name ?? "ConfigMap";
-        const data = manifest.data;
-        if (typeof data !== "object" || data === null) continue;
-
-        for (const [key, value] of Object.entries(data)) {
-          if (typeof value === "string" && PRIVATE_KEY_PATTERN.test(value)) {
-            diagnostics.push({
-              checkId: "WK8042",
-              severity: "error",
-              message: `ConfigMap "${resourceName}" contains a private key in data field "${key}" — use a Secret resource instead`,
-              entity: resourceName,
-              lexicon: "k8s",
-            });
-          }
+    for (const manifest of docsToManifests(ctx)) {
+      if (manifest.kind !== "ConfigMap") continue;
+
+      const resourceName = manifest.metadata?.name ?? "ConfigMap";
+      const data = manifest.data;
+      if (typeof data !== "object" || data === null) continue;
+
+      for (const [key, value] of Object.entries(data)) {
+        if (typeof value === "string" && PRIVATE_KEY_PATTERN.test(value)) {
+          diagnostics.push({
+            checkId: "WK8042",
+            severity: "error",
+            message: `ConfigMap "${resourceName}" contains a private key in data field "${key}" — use a Secret resource instead`,
+            entity: resourceName,
+            lexicon: "k8s",
+          });
         }
       }
     }

package/dist/rules/wk8101.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests } from "./k8s-helpers";
+import { docsToManifests } from "./k8s-helpers";
 
 export const wk8101: PostSynthCheck = {
   id: "WK8101",
@@ -16,46 +16,41 @@ export const wk8101: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (manifest.kind !== "Deployment") continue;
-
-        const resourceName = manifest.metadata?.name ?? "Deployment";
-        const spec = manifest.spec;
-        if (!spec) continue;
-
-        const selector = spec.selector as Record<string, unknown> | undefined;
-        const matchLabels = selector?.matchLabels as Record<string, string> | undefined;
-        if (!matchLabels || typeof matchLabels !== "object") continue;
-
-        const template = spec.template as Record<string, unknown> | undefined;
-        const templateMetadata = template?.metadata as Record<string, unknown> | undefined;
-        const templateLabels = templateMetadata?.labels as Record<string, string> | undefined;
+    for (const manifest of docsToManifests(ctx)) {
+      if (manifest.kind !== "Deployment") continue;
+
+      const resourceName = manifest.metadata?.name ?? "Deployment";
+      const spec = manifest.spec;
+      if (!spec) continue;
+
+      const selector = spec.selector as Record<string, unknown> | undefined;
+      const matchLabels = selector?.matchLabels as Record<string, string> | undefined;
+      if (!matchLabels || typeof matchLabels !== "object") continue;
+
+      const template = spec.template as Record<string, unknown> | undefined;
+      const templateMetadata = template?.metadata as Record<string, unknown> | undefined;
+      const templateLabels = templateMetadata?.labels as Record<string, string> | undefined;
+
+      if (!templateLabels || typeof templateLabels !== "object") {
+        diagnostics.push({
+          checkId: "WK8101",
+          severity: "error",
+          message: `Deployment "${resourceName}" has spec.selector.matchLabels but no spec.template.metadata.labels`,
+          entity: resourceName,
+          lexicon: "k8s",
+        });
+        continue;
+      }
 
-        if (!templateLabels || typeof templateLabels !== "object") {
+      for (const [key, value] of Object.entries(matchLabels)) {
+        if (templateLabels[key] !== value) {
           diagnostics.push({
             checkId: "WK8101",
             severity: "error",
-            message: `Deployment "${resourceName}" has spec.selector.matchLabels but no spec.template.metadata.labels`,
+            message: `Deployment "${resourceName}" selector label "${key}=${value}" does not match template label "${key}=${templateLabels[key] ?? '(missing)'}"`,
             entity: resourceName,
             lexicon: "k8s",
           });
-          continue;
-        }
-
-        for (const [key, value] of Object.entries(matchLabels)) {
-          if (templateLabels[key] !== value) {
-            diagnostics.push({
-              checkId: "WK8101",
-              severity: "error",
-              message: `Deployment "${resourceName}" selector label "${key}=${value}" does not match template label "${key}=${templateLabels[key] ?? '(missing)'}"`,
-              entity: resourceName,
-              lexicon: "k8s",
-            });
-          }
         }
       }
     }