@intentius/chant-lexicon-gcp 0.124.30 → 0.124.32

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gcp",
-  "version": "0.124.30",
+  "version": "0.124.32",
   "chantVersion": ">=0.1.0",
   "namespace": "GCP",
   "intrinsics": [],

package/dist/op/activities/floci-gcp.js

@@ -0,0 +1,49 @@
+import { emulatorLifecycle } from "@intentius/chant/op";
+// floci-gcp is a bespoke GCP-REST fake (not LocalStack) — a plain 200 on its
+// health endpoint means ready. Shared lifecycle: emulatorLifecycle (#746).
+// Pinned rather than `:latest` (#1345), same reasoning as the other emulators.
+export const FLOCI_GCP_SPEC = {
+    name: "chant-floci-gcp",
+    image: "floci/floci-gcp:0.5.0",
+    containerPort: 4588,
+    healthPath: "/_floci-gcp/health",
+    upstream: { repo: "floci-io/floci-gcp" },
+};
+/**
+ * The gcp plugin's emulator capability (#1345, corrected in #1431).
+ *
+ * The apply and read paths reach the emulator differently, and the capability
+ * exists for the one that cannot be told where to look:
+ *
+ *  - **apply** — `gcpApply` takes an explicit `endpoint` argument. Nothing to
+ *    inject; the caller already holds it.
+ *  - **read** — `describeResources` and `observeResourcesDeep` take it from
+ *    `GCP_ENDPOINT_URL` and nothing else (`../../describe-resources.ts`,
+ *    `../../deep-observe.ts`). A reader given no variable talks to real GCP.
+ *
+ * `env` was empty because when #1345 declared this capability the second bullet
+ * was not yet true: GCP was observed through Config Connector over kubectl, so
+ * there genuinely was no variable to inject. #1209 moved observation onto the
+ * applier's own direct-REST transport about two hours later, and nothing
+ * re-read this comment. The result was an emulator that booted, reported its
+ * endpoint, and left every `--live` read pointed at production.
+ *
+ * Injecting it makes `chant emulator up --lexicon gcp` mean the same thing for
+ * gcp that it already means for aws and azure: the estate's reads land on the
+ * emulator you just started.
+ */
+export const FLOCI_GCP_EMULATOR = {
+    spec: FLOCI_GCP_SPEC,
+    env: (endpoint) => ({ GCP_ENDPOINT_URL: endpoint }),
+};
+const gcp = emulatorLifecycle(FLOCI_GCP_SPEC);
+export const flociGcpExistsCommand = gcp.existsCommand;
+export const flociGcpRmCommand = gcp.rmCommand;
+export const flociGcpHealthUrl = gcp.healthUrl;
+/** The GCP endpoint URL (what `gcpApply`'s `endpoint` should point at). */
+export const flociGcpEndpoint = gcp.endpoint;
+export const flociGcpRunCommand = (args = {}) => gcp.runCommand(args);
+/** Boot a local floci-gcp (GCP emulator) in Docker and return its endpoint. */
+export const flociGcpUp = (args = {}, signal) => gcp.up(args, signal);
+/** Stop and remove the local floci-gcp container (no-op if already gone). */
+export const flociGcpDown = (args = {}, signal) => gcp.down(args, signal);

package/dist/op/activities/gcp-apply.js

@@ -0,0 +1,618 @@
+import { readFileSync } from "node:fs";
+import { parseYAML } from "@intentius/chant/yaml";
+import { sleep } from "@intentius/chant/op";
+import { hasOwnershipMarker, OWNERSHIP_MANAGED_BY_VALUE } from "@intentius/chant/ownership";
+import { GCP_RESOURCE_OWNERSHIP_KEYS } from "../../ownership.js";
+import { applyResult, } from "@intentius/chant/apply";
+const PROJECT_ID_ANNOTATION = "cnrm.cloud.google.com/project-id";
+/**
+ * The GCP labels chant stamps on resources it creates.
+ *
+ * Only the managed-by marker, not stack/env: this applier has no ownership
+ * marker to hand — the serializer stamps those from project config onto the
+ * Config Connector object. Same shape the fly serializer uses when no ownership
+ * context is set.
+ */
+export function chantOwnershipLabels() {
+    return { [GCP_RESOURCE_OWNERSHIP_KEYS.managedBy]: OWNERSHIP_MANAGED_BY_VALUE };
+}
+/**
+ * True when a live resource's labels carry chant's ownership marker.
+ *
+ * Resolves through core's `hasOwnershipMarker` against the lexicon's declared
+ * GCP-resource channel (#1446) rather than comparing a string literal inline,
+ * so the stamp and the prune filter cannot drift. The key itself is unchanged
+ * and deliberately GCP-valid — see `../../ownership.ts` for why this surface
+ * cannot use core's `LABEL_OWNERSHIP_KEYS`.
+ */
+export function isChantOwned(labels) {
+    return hasOwnershipMarker(labels ?? undefined, GCP_RESOURCE_OWNERSHIP_KEYS);
+}
+/** Merge the ownership marker into a create/update body's `labels`. */
+function stampOwnership(body) {
+    const existing = body.labels ?? {};
+    return { ...body, labels: { ...existing, ...chantOwnershipLabels() } };
+}
+/**
+ * A standard `google.longrunning` operation spec: the create response carries an
+ * operation `name` (`projects/…/operations/…`), polled at `{base}/{version}/{name}`
+ * until `done: true`. Reused by every service that follows the pattern.
+ */
+export function longRunningOperation(version) {
+    return {
+        pollUrl(createResponseBody, { base }) {
+            const opName = createResponseBody?.name;
+            if (!opName || !opName.includes("/operations/"))
+                return undefined;
+            return `${base}/${version}/${opName}`;
+        },
+        isDone(operationBody) {
+            return operationBody?.done === true;
+        },
+        error(operationBody) {
+            return operationBody?.error?.message;
+        },
+    };
+}
+/**
+ * Map a CNRM StorageBucket to a GCS Buckets:insert body. Pure. CNRM mirrors the
+ * Terraform google provider which mirrors the GCS API, so most fields are
+ * field-for-field; the renames are `uniformBucketLevelAccess` →
+ * `iamConfiguration.uniformBucketLevelAccess.enabled` and `lifecycleRule` →
+ * `lifecycle.rule`.
+ */
+export function bucketInsertBody(cnrm) {
+    const name = cnrm.metadata?.name;
+    if (!name)
+        throw new Error("StorageBucket has no metadata.name");
+    const spec = cnrm.spec ?? {};
+    const body = { name };
+    if (spec.location)
+        body.location = spec.location;
+    if (spec.storageClass)
+        body.storageClass = spec.storageClass;
+    if (spec.uniformBucketLevelAccess !== undefined) {
+        body.iamConfiguration = { uniformBucketLevelAccess: { enabled: spec.uniformBucketLevelAccess } };
+    }
+    if (spec.versioning?.enabled !== undefined) {
+        body.versioning = { enabled: spec.versioning.enabled };
+    }
+    if (spec.lifecycleRule?.length) {
+        body.lifecycle = {
+            rule: spec.lifecycleRule.map((r) => ({
+                action: r.action ?? {},
+                ...(r.condition ? { condition: r.condition } : {}),
+            })),
+        };
+    }
+    return body;
+}
+/** Map a CNRM PubSubTopic to a Pub/Sub Topic body. Pure. Name travels in the URL. */
+export function pubSubTopicBody(resource) {
+    const spec = (resource.spec ?? {});
+    const body = {};
+    const labels = resource.metadata?.labels;
+    if (labels && Object.keys(labels).length)
+        body.labels = labels;
+    if (spec.messageRetentionDuration)
+        body.messageRetentionDuration = spec.messageRetentionDuration;
+    return body;
+}
+export const storageBucketMapper = {
+    kind: "StorageBucket",
+    defaultHost: "https://storage.googleapis.com",
+    plan(resource, { base, project }) {
+        const body = stampOwnership(bucketInsertBody(resource));
+        const url = `${base}/storage/v1/b/${encodeURIComponent(body.name)}`;
+        // Reconcile in place with a PATCH of the desired mutable fields (the name is
+        // immutable and travels in the URL).
+        const { name: _name, ...patch } = body;
+        return {
+            getUrl: url,
+            create: { method: "POST", url: `${base}/storage/v1/b?project=${encodeURIComponent(project)}`, body },
+            update: { method: "PATCH", url, body: patch },
+        };
+    },
+    list: {
+        url: ({ base, project }) => `${base}/storage/v1/b?project=${encodeURIComponent(project)}`,
+        items: (body) => (body?.items ?? []),
+    },
+};
+export const pubSubTopicMapper = {
+    kind: "PubSubTopic",
+    defaultHost: "https://pubsub.googleapis.com",
+    plan(resource, { base, project }) {
+        const topic = resource.metadata?.name;
+        if (!topic)
+            throw new Error("PubSubTopic has no metadata.name");
+        // Pub/Sub creates a topic with an idempotent PUT to its resource URL; GET the
+        // same URL for the existence check.
+        const url = `${base}/v1/projects/${encodeURIComponent(project)}/topics/${encodeURIComponent(topic)}`;
+        const body = stampOwnership(pubSubTopicBody(resource));
+        // UpdateTopic uses the {topic, updateMask} envelope — the mask lists the
+        // fields being set (labels, messageRetentionDuration).
+        const update = {
+            method: "PATCH",
+            url,
+            body: { topic: { name: `projects/${project}/topics/${topic}`, ...body }, updateMask: Object.keys(body).join(",") },
+        };
+        return { getUrl: url, create: { method: "PUT", url, body }, update };
+    },
+    list: {
+        url: ({ base, project }) => `${base}/v1/projects/${encodeURIComponent(project)}/topics`,
+        items: (body) => (body?.topics ?? []).map((t) => ({ name: t.name.split("/").pop() ?? t.name, labels: t.labels })),
+    },
+};
+/** Map a CNRM RunService to a Cloud Run v2 Service body. Pure. */
+export function cloudRunServiceBody(resource) {
+    const spec = (resource.spec ?? {});
+    const body = {};
+    if (spec.template)
+        body.template = spec.template;
+    return body;
+}
+export const cloudRunServiceMapper = {
+    kind: "RunService",
+    defaultHost: "https://run.googleapis.com",
+    // Cloud Run create is asynchronous — it returns a google.longrunning operation.
+    operation: longRunningOperation("v2"),
+    plan(resource, { base, project }) {
+        const name = resource.metadata?.name;
+        if (!name)
+            throw new Error("RunService has no metadata.name");
+        const location = (resource.spec ?? {}).location ?? "us-central1";
+        const services = `${base}/v2/projects/${encodeURIComponent(project)}/locations/${encodeURIComponent(location)}/services`;
+        const url = `${services}/${encodeURIComponent(name)}`;
+        return {
+            getUrl: url,
+            create: {
+                method: "POST",
+                url: `${services}?serviceId=${encodeURIComponent(name)}`,
+                body: cloudRunServiceBody(resource),
+            },
+            // Cloud Run reconciles with a PATCH of the service; like create it returns
+            // a long-running operation, polled via the mapper's `operation`.
+            update: { method: "PATCH", url, body: cloudRunServiceBody(resource) },
+        };
+    },
+};
+/**
+ * Map a CNRM PubSubSubscription to a Pub/Sub Subscription body, resolving the
+ * `topicRef` to a full topic path. Pure.
+ */
+export function pubSubSubscriptionBody(resource, project) {
+    const spec = (resource.spec ?? {});
+    const ref = spec.topicRef;
+    const topic = ref?.external ?? (ref?.name ? `projects/${project}/topics/${ref.name}` : undefined);
+    if (!topic)
+        throw new Error("PubSubSubscription has no spec.topicRef.name");
+    const body = { topic };
+    if (spec.ackDeadlineSeconds !== undefined)
+        body.ackDeadlineSeconds = spec.ackDeadlineSeconds;
+    return body;
+}
+export const pubSubSubscriptionMapper = {
+    kind: "PubSubSubscription",
+    defaultHost: "https://pubsub.googleapis.com",
+    plan(resource, { base, project }) {
+        const sub = resource.metadata?.name;
+        if (!sub)
+            throw new Error("PubSubSubscription has no metadata.name");
+        const url = `${base}/v1/projects/${encodeURIComponent(project)}/subscriptions/${encodeURIComponent(sub)}`;
+        return { getUrl: url, create: { method: "PUT", url, body: pubSubSubscriptionBody(resource, project) } };
+    },
+};
+/** Map a CNRM SecretManagerSecret to a Secret Manager create body. Pure. */
+export function secretBody(resource) {
+    const spec = (resource.spec ?? {});
+    return { replication: spec.replication ?? { automatic: {} } };
+}
+export const secretManagerSecretMapper = {
+    kind: "SecretManagerSecret",
+    defaultHost: "https://secretmanager.googleapis.com",
+    plan(resource, { base, project }) {
+        const name = resource.metadata?.name;
+        if (!name)
+            throw new Error("SecretManagerSecret has no metadata.name");
+        const secrets = `${base}/v1/projects/${encodeURIComponent(project)}/secrets`;
+        const url = `${secrets}/${encodeURIComponent(name)}`;
+        const body = stampOwnership(secretBody(resource));
+        return {
+            getUrl: url,
+            create: { method: "POST", url: `${secrets}?secretId=${encodeURIComponent(name)}`, body },
+            // UpdateSecret carries the updateMask in the query; only labels are mutable here.
+            update: { method: "PATCH", url: `${url}?updateMask=labels`, body: { labels: body.labels } },
+        };
+    },
+    list: {
+        url: ({ base, project }) => `${base}/v1/projects/${encodeURIComponent(project)}/secrets`,
+        items: (body) => (body?.secrets ?? []).map((s) => ({ name: s.name.split("/").pop() ?? s.name, labels: s.labels })),
+    },
+};
+/** Map a CNRM IAMServiceAccount to a service-account create body. Pure. */
+export function serviceAccountBody(resource, accountId) {
+    const spec = (resource.spec ?? {});
+    return { accountId, serviceAccount: spec.displayName ? { displayName: spec.displayName } : {} };
+}
+export const gcpServiceAccountMapper = {
+    kind: "IAMServiceAccount",
+    defaultHost: "https://iam.googleapis.com",
+    plan(resource, { base, project }) {
+        const accountId = resource.metadata?.name;
+        if (!accountId)
+            throw new Error("IAMServiceAccount has no metadata.name");
+        // The GCP identity is the derived email; IAM service accounts carry no labels,
+        // so there is no ownership stamping / prune for this kind.
+        const email = `${accountId}@${project}.iam.gserviceaccount.com`;
+        const accounts = `${base}/v1/projects/${encodeURIComponent(project)}/serviceAccounts`;
+        return {
+            getUrl: `${accounts}/${email}`,
+            create: { method: "POST", url: accounts, body: serviceAccountBody(resource, accountId) },
+        };
+    },
+};
+/** The kind → mapper dispatch table. Adding a resource type is a new entry here. */
+export const MAPPERS = {
+    StorageBucket: storageBucketMapper,
+    PubSubTopic: pubSubTopicMapper,
+    PubSubSubscription: pubSubSubscriptionMapper,
+    SecretManagerSecret: secretManagerSecretMapper,
+    IAMServiceAccount: gcpServiceAccountMapper,
+    RunService: cloudRunServiceMapper,
+};
+/**
+ * Collect the local resource names this resource references via CNRM `*Ref`
+ * fields (`topicRef: { name }`, `subnetworkRefs: [{ name }]`, …). `external`
+ * refs point outside the manifest and are ignored for ordering. Pure.
+ */
+export function referencedNames(resource) {
+    const names = [];
+    const visit = (v, key) => {
+        if (Array.isArray(v)) {
+            for (const x of v)
+                visit(x, key);
+            return;
+        }
+        if (v && typeof v === "object") {
+            const obj = v;
+            if (key && /Refs?$/.test(key) && typeof obj.name === "string") {
+                names.push(obj.name);
+            }
+            for (const [k, val] of Object.entries(obj))
+                visit(val, k);
+        }
+    };
+    visit(resource.spec);
+    return [...new Set(names)];
+}
+/**
+ * Topologically order resources so a referenced resource comes before the
+ * resource that references it (apply order; reverse for delete). Refs to names
+ * not in the manifest are left to exist already. Throws on a reference cycle.
+ * Pure — a DFS post-order.
+ */
+export function orderByReferences(resources) {
+    const byName = new Map();
+    for (const r of resources) {
+        const n = r.metadata?.name;
+        if (n)
+            byName.set(n, r);
+    }
+    const ordered = [];
+    const done = new Set();
+    const active = new Set();
+    const visit = (r) => {
+        if (done.has(r))
+            return;
+        if (active.has(r))
+            throw new Error(`reference cycle involving ${r.metadata?.name ?? "?"}`);
+        active.add(r);
+        for (const ref of referencedNames(r)) {
+            const dep = byName.get(ref);
+            if (dep && dep !== r)
+                visit(dep);
+        }
+        active.delete(r);
+        done.add(r);
+        ordered.push(r);
+    };
+    for (const r of resources)
+        visit(r);
+    return ordered;
+}
+// ── Resolution + HTTP ─────────────────────────────────────────────────────────
+/**
+ * Resolve the endpoint override (#1449): an explicit `endpoint` arg wins, then
+ * the `GCP_ENDPOINT_URL` env — the same variable the read path honours
+ * (`describe-resources`, floci-gcp), so an apply lands wherever `--live` is
+ * already looking. `undefined` means no override: each kind falls back to its
+ * real-GCP host. The same rule the aws applier applies to `AWS_ENDPOINT_URL`
+ * (#1694) and the fly applier to `FLY_FLAPS_BASE_URL`. Pure.
+ */
+export function resolveGcpEndpoint(args = {}, env = process.env) {
+    return args.endpoint || env.GCP_ENDPOINT_URL || undefined;
+}
+/** Resolve the project: `GOOGLE_CLOUD_PROJECT` env, else the CNRM project-id annotation. Pure. */
+export function resolveGcpProject(resource, env = process.env) {
+    const project = env.GOOGLE_CLOUD_PROJECT || resource.metadata?.annotations?.[PROJECT_ID_ANNOTATION];
+    if (!project) {
+        throw new Error(`no GCP project — set GOOGLE_CLOUD_PROJECT or the ${PROJECT_ID_ANNOTATION} annotation`);
+    }
+    return project;
+}
+const defaultHttp = async (method, url, body, signal) => {
+    const res = await fetch(url, {
+        method,
+        headers: body === undefined ? undefined : { "content-type": "application/json" },
+        body: body === undefined ? undefined : JSON.stringify(body),
+        signal,
+    });
+    return { status: res.status, text: await res.text() };
+};
+/**
+ * Reconcile one resource via its mapper: `GET` it; if present, PATCH it to the
+ * desired state (when the mapper supports `update`, else leave it); if absent,
+ * create it. Async create/update return an operation that is polled to
+ * completion. `http` is injectable for tests.
+ */
+export async function applyResource(mapper, resource, ctx, http = defaultHttp, signal) {
+    const plan = mapper.plan(resource, ctx);
+    const name = resource.metadata?.name ?? "?";
+    const get = await http("GET", plan.getUrl, undefined, signal);
+    if (get.status === 200) {
+        // Exists. Reconcile to desired if the mapper supports it; otherwise leave it.
+        if (!plan.update) {
+            return { kind: mapper.kind, name, created: false, updated: false };
+        }
+        const res = await http(plan.update.method, plan.update.url, plan.update.body, signal);
+        if (res.status >= 300) {
+            throw new Error(`${mapper.kind} ${name} update failed (${res.status}): ${res.text}`);
+        }
+        await pollIfAsync(mapper, res.text, ctx, http, signal);
+        return { kind: mapper.kind, name, created: false, updated: true };
+    }
+    const res = await http(plan.create.method, plan.create.url, plan.create.body, signal);
+    if (res.status >= 300) {
+        throw new Error(`${mapper.kind} ${name} create failed (${res.status}): ${res.text}`);
+    }
+    await pollIfAsync(mapper, res.text, ctx, http, signal);
+    return { kind: mapper.kind, name, created: true, updated: false };
+}
+/**
+ * When a mapper is async, extract the long-running operation from a create/update
+ * response and poll it to completion so the step never reports success early.
+ */
+async function pollIfAsync(mapper, responseText, ctx, http, signal) {
+    if (!mapper.operation)
+        return;
+    const pollUrl = mapper.operation.pollUrl(parseJson(responseText), ctx);
+    if (pollUrl) {
+        await waitForOperation(mapper.operation, pollUrl, http, signal);
+    }
+}
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Poll a long-running operation until it reports done (or errors / times out).
+ * `http` and the interval are injectable so tests drive it without real waits.
+ */
+export async function waitForOperation(op, pollUrl, http = defaultHttp, signal, opts) {
+    const interval = opts?.intervalMs ?? 2000;
+    const deadline = Date.now() + (opts?.timeoutMs ?? 300000);
+    let attempt = 0;
+    while (Date.now() < deadline) {
+        if (signal?.aborted)
+            throw new Error("waitForOperation aborted");
+        attempt++;
+        const res = await http("GET", pollUrl, undefined, signal);
+        const body = res.status < 300 ? parseJson(res.text) : undefined;
+        if (body) {
+            const err = op.error(body);
+            if (err)
+                throw new Error(`operation failed: ${err}`);
+            if (op.isDone(body))
+                return;
+        }
+        await sleep(interval, signal);
+    }
+    throw new Error(`operation did not complete within timeout: ${pollUrl}`);
+}
+/**
+ * A manifest entry with no `kind` is malformed, not unsupported (#1447).
+ *
+ * The old guard skipped it in silence, which put a hand-written or truncated
+ * manifest in the same bucket as a kind chant simply has no mapper for. One is
+ * a bug in the input and the other is a known gap in coverage; only the second
+ * belongs in `notAttempted`. Throws so the first surfaces.
+ */
+function requireKind(resource, manifestPath) {
+    if (!resource.kind) {
+        const name = resource.metadata?.name;
+        throw new Error(`${manifestPath}: manifest entry has no "kind"${name ? ` (metadata.name: ${name})` : ""} — ` +
+            `a CNRM resource must declare one. This is a malformed manifest, not an unsupported kind.`);
+    }
+    return true;
+}
+/** Parse a built manifest into CNRM resource objects — YAML (multi-doc) or JSON. Pure. */
+export function parseManifest(content, path) {
+    if (/\.json$/i.test(path)) {
+        const parsed = JSON.parse(content);
+        return (Array.isArray(parsed) ? parsed : [parsed]);
+    }
+    return content
+        .split(/^---\s*$/m)
+        .map((doc) => doc.trim())
+        .filter(Boolean)
+        .map((doc) => parseYAML(doc));
+}
+/**
+ * Normalize a gcp apply/delete result into core's apply envelope (#1446).
+ *
+ * The lexicon keeps its own richer shape — `created`/`updated` per resource,
+ * the CNRM `kind` — and this projects it onto the shared tri-state so a caller
+ * can read any applier's result the same way. Core's contract is the interface;
+ * it is not a replacement for what this applier knows.
+ */
+export function toApplyResult(result) {
+    const applied = (result.applied ?? []).map((a) => ({
+        kind: a.kind,
+        name: a.name,
+        action: a.created ? "created" : a.updated ? "updated" : "unchanged",
+    }));
+    const notAttempted = [
+        ...(result.notAttempted ?? []).map((n) => ({ kind: n.kind, name: n.name, reason: n.reason })),
+        // A kind the prune could not consider has no single resource name — the
+        // whole kind went unexamined, which `not-prunable` is the reason for.
+        ...(result.notPrunable ?? []).map((n) => ({
+            kind: n.kind,
+            name: "*",
+            reason: "not-prunable",
+            ...(n.detail ? { detail: n.detail } : {}),
+        })),
+    ];
+    // `gcpDelete` reports deletions as `deleted`; they are prunes in the shared
+    // vocabulary — the applier removed something the plan no longer wants.
+    return applyResult(applied, result.pruned ?? result.deleted ?? [], notAttempted);
+}
+/**
+ * Owned-only prune: for each manifested kind with `list` support, delete the
+ * chant-owned live resources whose name is not in `desiredByKind`. Foreign
+ * resources (no ownership label) are left alone.
+ *
+ * Returns what it could not consider alongside what it deleted — a kind with no
+ * `list`, or whose list call failed, is reported rather than dropped (#1447).
+ */
+export async function pruneOrphans(desired, resolve, http = defaultHttp, signal) {
+    const desiredByKind = new Map();
+    for (const r of desired) {
+        if (!r.kind)
+            continue;
+        const names = desiredByKind.get(r.kind) ?? new Set();
+        if (r.metadata?.name)
+            names.add(r.metadata.name);
+        desiredByKind.set(r.kind, names);
+    }
+    const pruned = [];
+    const notPrunable = [];
+    for (const [kind, keep] of desiredByKind) {
+        const mapper = MAPPERS[kind];
+        if (!mapper?.list) {
+            console.log(`prune: cannot list kind ${kind} — owned orphans of it are not considered`);
+            notPrunable.push({ kind, reason: "no-list-capability" });
+            continue;
+        }
+        const ctx = resolve(mapper, desired.find((r) => r.kind === kind));
+        const res = await http("GET", mapper.list.url(ctx), undefined, signal);
+        if (res.status >= 300) {
+            console.log(`prune: listing kind ${kind} failed (${res.status}) — not considered`);
+            notPrunable.push({ kind, reason: "list-failed", detail: `${res.status}: ${res.text}` });
+            continue;
+        }
+        for (const item of mapper.list.items(parseJson(res.text))) {
+            if (!isChantOwned(item.labels) || keep.has(item.name))
+                continue;
+            const result = await deleteResource(mapper, { kind, metadata: { name: item.name } }, ctx, http, signal);
+            console.log(`pruned: ${kind}/${item.name} (${ctx.base})`);
+            pruned.push(result);
+        }
+    }
+    return { pruned, notPrunable };
+}
+/**
+ * The native GCP applier (#706) — read a built CNRM manifest and apply each
+ * resource directly to its GCP REST API, targeting a local floci-gcp emulator or
+ * real GCP by endpoint override. Unlike AWS/Azure/k8s, GCP has no native deploy
+ * service to shell out to, so chant maps each `kind` to a REST call itself (the
+ * `MAPPERS` dispatch table). Uses longInfra profile. `http` is injectable for
+ * tests.
+ *
+ * A kind `MAPPERS` does not cover is **reported, not dropped** — it comes back
+ * in `notAttempted` (#1447). Before that, it was a `console.log` and a
+ * populated `applied` array, so a caller could not tell a partial apply from a
+ * complete one and `ApplyOp` reported success either way.
+ */
+export async function gcpApply(args, signal, http = defaultHttp) {
+    const resources = orderByReferences(parseManifest(readFileSync(args.manifestPath, "utf8"), args.manifestPath));
+    const endpoint = resolveGcpEndpoint(args);
+    const resolve = (mapper, resource) => ({
+        base: (endpoint ?? mapper.defaultHost).replace(/\/$/, ""),
+        project: args.project ?? (resource ? resolveGcpProject(resource) : ""),
+    });
+    const applied = [];
+    const notAttempted = [];
+    for (const r of resources) {
+        const mapper = requireKind(r, args.manifestPath) ? MAPPERS[r.kind] : undefined;
+        if (!mapper) {
+            const kind = r.kind;
+            console.log(`skip: no mapper for kind ${kind}`);
+            notAttempted.push({ kind, name: r.metadata?.name ?? "?", reason: "unsupported-kind" });
+            continue;
+        }
+        const ctx = resolve(mapper, r);
+        const result = await applyResource(mapper, r, ctx, http, signal);
+        const verb = result.created ? "created" : result.updated ? "updated" : "unchanged";
+        console.log(`${verb}: ${result.kind}/${result.name} (${ctx.base})`);
+        applied.push(result);
+    }
+    const prune = args.prune
+        ? await pruneOrphans(resources, resolve, http, signal)
+        : { pruned: [], notPrunable: [] };
+    return { applied, pruned: prune.pruned, notAttempted, notPrunable: prune.notPrunable };
+}
+/**
+ * Idempotently delete one resource: `DELETE` its resource URL. A 404 means it is
+ * already gone. For async resources, `DELETE` returns a long-running operation
+ * that is polled to completion. `http` is injectable for tests.
+ */
+export async function deleteResource(mapper, resource, ctx, http = defaultHttp, signal) {
+    const plan = mapper.plan(resource, ctx);
+    const name = resource.metadata?.name ?? "?";
+    const res = await http("DELETE", plan.getUrl, undefined, signal);
+    if (res.status === 404) {
+        return { kind: mapper.kind, name, deleted: false };
+    }
+    if (res.status >= 300) {
+        throw new Error(`${mapper.kind} ${name} delete failed (${res.status}): ${res.text}`);
+    }
+    if (mapper.operation) {
+        const pollUrl = mapper.operation.pollUrl(parseJson(res.text), ctx);
+        if (pollUrl) {
+            await waitForOperation(mapper.operation, pollUrl, http, signal);
+        }
+    }
+    return { kind: mapper.kind, name, deleted: true };
+}
+/**
+ * The inverse of {@link gcpApply} — read a built CNRM manifest and delete the
+ * resources it declares (in reverse order, so dependents go before their
+ * dependencies). Idempotent: already-absent resources are a no-op. Uses
+ * longInfra profile. `http` is injectable for tests.
+ */
+export async function gcpDelete(args, signal, http = defaultHttp) {
+    // Delete in reverse dependency order: a referrer goes before the resource it
+    // references.
+    const resources = orderByReferences(parseManifest(readFileSync(args.manifestPath, "utf8"), args.manifestPath)).reverse();
+    const deleted = [];
+    const notAttempted = [];
+    for (const r of resources) {
+        const mapper = requireKind(r, args.manifestPath) ? MAPPERS[r.kind] : undefined;
+        if (!mapper) {
+            const kind = r.kind;
+            console.log(`skip: no mapper for kind ${kind}`);
+            notAttempted.push({ kind, name: r.metadata?.name ?? "?", reason: "unsupported-kind" });
+            continue;
+        }
+        const base = (resolveGcpEndpoint(args) ?? mapper.defaultHost).replace(/\/$/, "");
+        const project = args.project ?? resolveGcpProject(r);
+        const result = await deleteResource(mapper, r, { base, project }, http, signal);
+        console.log(`${result.deleted ? "deleted" : "absent"}: ${result.kind}/${result.name} (${base})`);
+        deleted.push(result);
+    }
+    return { deleted, notAttempted };
+}

package/dist/op/activities/index.js

@@ -0,0 +1,10 @@
+/**
+ * GCP Op activities — resolved by the core activity registry when a project's
+ * `chant.config.ts` lists the `gcp` lexicon. Contributes the native GCP applier
+ * (`gcpApply`), which maps CNRM resources to GCP REST calls since GCP has no
+ * native deployment service to shell out to.
+ */
+export { gcpApply, gcpDelete, applyResource, deleteResource, waitForOperation, longRunningOperation, bucketInsertBody, pubSubTopicBody, pubSubSubscriptionBody, cloudRunServiceBody, secretBody, serviceAccountBody, storageBucketMapper, pubSubTopicMapper, pubSubSubscriptionMapper, cloudRunServiceMapper, secretManagerSecretMapper, gcpServiceAccountMapper, MAPPERS, referencedNames, orderByReferences, pruneOrphans, toApplyResult, chantOwnershipLabels, isChantOwned, resolveGcpEndpoint, resolveGcpProject, parseManifest, } from "./gcp-apply.js";
+// floci-gcp (GCP emulator) lifecycle — the typed twin of aws's flociUp/Down, so
+// the trio's GCP op boots/tears down the emulator as a modeled step, not a shell.
+export { flociGcpUp, flociGcpDown, flociGcpRunCommand, flociGcpRmCommand, flociGcpExistsCommand, flociGcpHealthUrl, flociGcpEndpoint, } from "./floci-gcp.js";