@intentius/chant-lexicon-gcp 0.124.36 → 0.124.37

package/dist/deep-observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAajE,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAErC,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWtF;AAUD;6EAC6E;AAC7E,UAAU,aAAa;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA0OD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASnH;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA8F5G"}
+{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAajE,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAErC,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWtF;AAUD;6EAC6E;AAC7E,UAAU,aAAa;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA0OD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASnH;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAuF5G"}

package/dist/deep-observe.js

@@ -55,7 +55,7 @@
  */
 import { deepObservation, normalizeDeepProperties } from "@intentius/chant/deep-observation";
 import { hasOwnershipMarker } from "@intentius/chant/ownership";
-import { deriveGVK, manifestProjectAnnotations, resolveReadProject } from "./describe-resources.js";
+import { deriveGVK, manifestProjectAnnotations, readTargets, resolveReadProject } from "./describe-resources.js";
 import { getResource, mapperForKind, GcpReadError, isNotFound } from "./api/read-client.js";
 import { gcpDeepNormalizationHooks } from "./deep-observe-hooks.js";
 /** The labels the applier stamps — see describe-resources.ts. */
@@ -364,7 +364,8 @@ export async function observeResourcesDeepGcp(options) {
     const unobserved = {};
     const endpoint = process.env.GCP_ENDPOINT_URL;
     const manifestProjects = manifestProjectAnnotations(options.buildOutput);
-    const reads = [...options.entities].map(async ([entityName, { entityType, props }]) => {
+    const targets = readTargets(options.entities);
+    const reads = [...options.entities].map(async ([entityName, { entityType }]) => {
         const gvk = deriveGVK(entityType);
         if (!gvk || !mapperForKind(gvk.kind)) {
             unobserved[entityName] = {
@@ -376,16 +377,8 @@ export async function observeResourcesDeepGcp(options) {
             };
             return;
         }
+        const { name, props } = targets.get(entityName);
         const metadata = props.metadata;
-        const name = metadata?.name;
-        if (!name) {
-            unobserved[entityName] = {
-                type: entityType,
-                reason: "read-failed",
-                detail: "declared entity has no metadata.name to query by",
-            };
-            return;
-        }
         let client;
         try {
             client = {

package/dist/describe-resources.d.ts

@@ -82,15 +82,29 @@ export declare function deriveGVK(entityType: string): {
  */
 export declare function manifestProjectAnnotations(buildOutput: string | undefined): Map<string, string>;
 /**
- * The project a read should target: the entity's `projectRef.external`,
- * `GOOGLE_CLOUD_PROJECT`, the entity's own annotation (via
- * `resolveGcpProject`, the applier's rule), then the built
- * manifest's merged annotation. Throws the applier's own error when nothing
- * resolves, so the `no-binding` detail names both knobs.
+ * The project a read should target, in apply's order (#4252): the entity's
+ * own literal `projectRef.external`, then the built manifest's project for it
+ * (its resolved projectRef, or the project-id annotation chant.config's
+ * `gcp.project` writes), then the entity's own annotation, then
+ * `GCP_PROJECT_ID`, then `GOOGLE_CLOUD_PROJECT`. Throws apply's own error when
+ * nothing resolves, so the `no-binding` detail names every knob.
  */
 export declare function resolveReadProject(kind: string, name: string, metadata: {
     annotations?: Record<string, string>;
-} | undefined, manifestProjects: Map<string, string>, props?: Record<string, unknown>): string;
+} | undefined, manifestProjects: Map<string, string>, props?: Record<string, unknown>, env?: NodeJS.ProcessEnv): string;
+/**
+ * Each declared entity as a read sees it (#4251): the name the build writes
+ * (`metadata.name`, else the kebab-cased logical id) and its props with every
+ * reference to another resource resolved as the serializer resolves it, so a
+ * mapper building a read URL never meets an attribute reference.
+ */
+export declare function readTargets(entities: Map<string, {
+    entityType: string;
+    props: Record<string, unknown>;
+}>): Map<string, {
+    name: string;
+    props: Record<string, unknown>;
+}>;
 /**
  * Status from a REST payload.
  *

package/dist/describe-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAsC,MAAM,0BAA0B,CAAC;AAsBtG;;gCAEgC;AAChC,UAAU,eAAe;IACvB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACxF,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACtB,CAAC;CACH;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAIpF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAgB/F;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,SAAS,EAC9D,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,CAQR;AAUD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAY3D;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwH7B"}
+{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAsC,MAAM,0BAA0B,CAAC;AAsBtG;;gCAEgC;AAChC,UAAU,eAAe;IACvB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACxF,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACtB,CAAC;CACH;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAIpF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAgB/F;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,SAAS,EAC9D,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAUR;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,GAC5E,GAAG,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAY/D;AAUD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAY3D;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAiH7B"}

package/dist/describe-resources.js

@@ -38,8 +38,8 @@
 import { observation } from "@intentius/chant/observation";
 import { hasOwnershipMarker, classifyOwnership, readOwnership } from "@intentius/chant/ownership";
 import { getResource, mapperForKind, GcpReadError, isNotFound } from "./api/read-client.js";
-import { resolveGcpProject, parseManifest, projectRefProject } from "./op/activities/gcp-apply.js";
-import { resolveGVK } from "./serializer.js";
+import { NO_PROJECT, parseManifest, projectRefProject } from "./op/activities/gcp-apply.js";
+import { cnrmNameOf, resolveCnrmRefs, resolveGVK } from "./serializer.js";
 /**
  * chant's ownership marker as GCP labels.
  *
@@ -99,22 +99,43 @@ export function manifestProjectAnnotations(buildOutput) {
     return out;
 }
 /**
- * The project a read should target: the entity's `projectRef.external`,
- * `GOOGLE_CLOUD_PROJECT`, the entity's own annotation (via
- * `resolveGcpProject`, the applier's rule), then the built
- * manifest's merged annotation. Throws the applier's own error when nothing
- * resolves, so the `no-binding` detail names both knobs.
+ * The project a read should target, in apply's order (#4252): the entity's
+ * own literal `projectRef.external`, then the built manifest's project for it
+ * (its resolved projectRef, or the project-id annotation chant.config's
+ * `gcp.project` writes), then the entity's own annotation, then
+ * `GCP_PROJECT_ID`, then `GOOGLE_CLOUD_PROJECT`. Throws apply's own error when
+ * nothing resolves, so the `no-binding` detail names every knob.
  */
-export function resolveReadProject(kind, name, metadata, manifestProjects, props) {
-    try {
-        return resolveGcpProject({ kind, metadata, ...(props ? { spec: props } : {}) });
-    }
-    catch (err) {
-        const fromManifest = manifestProjects.get(`${kind}/${name}`);
-        if (fromManifest)
-            return fromManifest;
-        throw err;
+export function resolveReadProject(kind, name, metadata, manifestProjects, props, env = process.env) {
+    const project = projectRefProject(props, {}) ||
+        manifestProjects.get(`${kind}/${name}`) ||
+        metadata?.annotations?.["cnrm.cloud.google.com/project-id"] ||
+        projectRefProject(props, env) ||
+        env.GCP_PROJECT_ID ||
+        env.GOOGLE_CLOUD_PROJECT;
+    if (!project)
+        throw new Error(NO_PROJECT);
+    return project;
+}
+/**
+ * Each declared entity as a read sees it (#4251): the name the build writes
+ * (`metadata.name`, else the kebab-cased logical id) and its props with every
+ * reference to another resource resolved as the serializer resolves it, so a
+ * mapper building a read URL never meets an attribute reference.
+ */
+export function readTargets(entities) {
+    const logicalByProps = new Map();
+    for (const [logical, { props }] of entities)
+        logicalByProps.set(props, logical);
+    const logicalOf = (props) => logicalByProps.get(props);
+    const out = new Map();
+    for (const [logical, { props }] of entities) {
+        out.set(logical, {
+            name: cnrmNameOf(logical, props),
+            props: resolveCnrmRefs(props, logicalOf),
+        });
     }
+    return out;
 }
 function pruneUndefined(obj) {
     const out = {};
@@ -163,7 +184,8 @@ export async function describeResources(options) {
     // `describe-stack-resources` returns no tags.
     let warnedOwnership = false;
     const manifestProjects = manifestProjectAnnotations(options.buildOutput);
-    const reads = [...options.entities].map(async ([entityName, { entityType, props }]) => {
+    const targets = readTargets(options.entities);
+    const reads = [...options.entities].map(async ([entityName, { entityType }]) => {
         const gvk = deriveGVK(entityType);
         if (!gvk) {
             unobserved[entityName] = {
@@ -183,16 +205,8 @@ export async function describeResources(options) {
             };
             return;
         }
+        const { name, props } = targets.get(entityName);
         const metadata = props.metadata;
-        const name = metadata?.name;
-        if (!name) {
-            unobserved[entityName] = {
-                type: entityType,
-                reason: "read-failed",
-                detail: "declared entity has no metadata.name to query by",
-            };
-            return;
-        }
         let client;
         try {
             client = {

package/dist/health.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../src/health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,EAAoB,MAAM,0BAA0B,CAAC;AACnH,OAAO,EAAyC,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAG5F,eAAO,MAAM,gBAAgB,YAAI,mBAAmB,CAAU,CAAC;AAE/D,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,UAAU,SAAS;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,gEAAgE;AAChE,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,CAAC,EAAE,SAAS,CAAC;IAC9B,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD;AAOD,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAqBzF;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAoD3F"}
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../src/health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,EAAoB,MAAM,0BAA0B,CAAC;AACnH,OAAO,EAAyC,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAG5F,eAAO,MAAM,gBAAgB,YAAI,mBAAmB,CAAU,CAAC;AAE/D,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,UAAU,SAAS;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,gEAAgE;AAChE,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,CAAC,EAAE,SAAS,CAAC;IAC9B,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD;AAOD,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAqBzF;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAiD3F"}

package/dist/health.js

@@ -9,7 +9,7 @@
  * `GCP_ENDPOINT_URL` (floci-gcp) answers.
  */
 import { getResource, GcpReadError, isNotFound } from "./api/read-client.js";
-import { deriveGVK, manifestProjectAnnotations, resolveReadProject } from "./describe-resources.js";
+import { deriveGVK, manifestProjectAnnotations, readTargets, resolveReadProject } from "./describe-resources.js";
 export const GCP_HEALTH_TYPES = ["GCP::Run::Service"];
 function readyCondition(body) {
     if (body.terminalCondition && (body.terminalCondition.type ?? "Ready") === "Ready")
@@ -46,16 +46,13 @@ export async function observeHealthGcp(options) {
     const entities = {};
     const unobserved = {};
     const absent = [];
-    await Promise.all([...options.entities].map(async ([entityName, { entityType, props }]) => {
+    const targets = readTargets(options.entities);
+    await Promise.all([...options.entities].map(async ([entityName, { entityType }]) => {
         const gvk = deriveGVK(entityType);
+        const { name, props } = targets.get(entityName);
         const metadata = props.metadata;
-        const name = metadata?.name;
-        if (!gvk || !name) {
-            unobserved[entityName] = {
-                type: entityType,
-                reason: "read-failed",
-                detail: gvk ? "declared entity has no metadata.name to query by" : `cannot derive a GCP kind from ${entityType}`,
-            };
+        if (!gvk) {
+            unobserved[entityName] = { type: entityType, reason: "read-failed", detail: `cannot derive a GCP kind from ${entityType}` };
             return;
         }
         let project;

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "9c67ab15a45ae8ce5c5ac3a6e3a83295bd28e78a4acf71b0d00d74040f5d27e0",
+    "manifest.json": "648e7fb96c2a44b72459dc70e777c22836de776eb5f5b8017f8c6057135062a3",
     "meta.json": "75643660010c044c6f465bef2688a864ab30cc96fd9b68111969749748ac64ca",
     "types/index.d.ts": "da1ebc6bcf83e1a018a773b59714194aeeb74ae1d5c1252b737b7e730ca98bd5",
     "rules/hardcoded-project.ts": "6d5ae9efa74d73800eebe1a0a0d43c619ee0fdebe3347195df93fcbe63b34f0d",
@@ -40,5 +40,5 @@
     "skills/chant-gcp-patterns.md": "4c6809fc7c37fa1879379ad4c0e2d114dec9497bc6eb9d1bca4e79fddea4f509",
     "skills/chant-gcp-gke.md": "be277019da9a722c851e47cd2dfb9c9536668948c3535fb20db7697e934c4e2b"
   },
-  "composite": "f841125ccfbe364d6981cf4a1f444c9edeaa213e3b5d562dce7b12b341d82daf"
+  "composite": "12781f2fbe08546cbfed0496ef97a0cfc6f301c5576bfafad2cbd4bf3cac39f3"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gcp",
-  "version": "0.124.36",
+  "version": "0.124.37",
   "chantVersion": ">=0.1.0",
   "namespace": "GCP",
   "intrinsics": [],

package/dist/op/activities/gcp-apply.d.ts

@@ -249,7 +249,6 @@ export declare function orderByReferences(resources: GcpResource[]): GcpResource
 export declare function resolveGcpEndpoint(args?: {
     endpoint?: string;
 }, env?: NodeJS.ProcessEnv): string | undefined;
-/** Resolve the project: `GOOGLE_CLOUD_PROJECT` env, else the CNRM project-id annotation. Pure. */
 /**
  * The project a resource names in `spec.projectRef.external` (#4201): a
  * project id or `projects/<id>`. A `GCP.ProjectId` pseudo-parameter there
@@ -257,7 +256,14 @@ export declare function resolveGcpEndpoint(args?: {
  * `GCP_PROJECT_ID`, as the serializer does.
  */
 export declare function projectRefProject(spec: Record<string, unknown> | undefined, env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * The project a resource is applied in (#4252): its own `spec.projectRef.external`,
+ * else its project-id annotation (where chant.config's `gcp.project` is
+ * written at build), else `GCP_PROJECT_ID`, else `GOOGLE_CLOUD_PROJECT`. Pure.
+ */
 export declare function resolveGcpProject(resource: GcpResource, env?: NodeJS.ProcessEnv): string;
+/** The error every stage gives when no project resolves. */
+export declare const NO_PROJECT = "no GCP project \u2014 set gcp.project in chant.config, GCP_PROJECT_ID or GOOGLE_CLOUD_PROJECT, or the resource's spec.projectRef.external";
 /** Injectable HTTP client — mirrors argo's injectable fetcher so tests avoid the network. */
 export type GcpHttp = (method: string, url: string, body?: unknown, signal?: AbortSignal) => Promise<{
     status: number;

package/dist/op/activities/gcp-apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/gcp-apply.ts"],"names":[],"mappings":"AAgBA,OAAO,EAEL,KAAK,WAAW,EAGjB,MAAM,wBAAwB,CAAC;AAIhC;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEvF;AAQD,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACtC,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,8DAA8D;AAC9D,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,IAAI,CAAC,EAAE;QACL,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,wBAAwB,CAAC,EAAE,OAAO,CAAC;QACnC,UAAU,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QACnC,aAAa,CAAC,EAAE,KAAK,CAAC;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAC;KAClG,CAAC;CACH;AAED,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE;QAAE,wBAAwB,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IACtE,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAClC,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACvG;AAED,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAID;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/D,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,OAAO,GAAG,KAAK,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;CAClE;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,OAAO,CAAC,kBAAkB,EAAE,OAAO,EAAE,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IACjG,8DAA8D;IAC9D,MAAM,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC;IACxC,8EAA8E;IAC9E,KAAK,CAAC,aAAa,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;CACnD;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,kCAAkC;IAClC,GAAG,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IACpD,4EAA4E;IAC5E,KAAK,CAAC,YAAY,EAAE,OAAO,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAC/F;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnI,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrG,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7H;AAED,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC7B,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,GAAG,SAAS,CAAC;IACvD,2IAA2I;IAC3I,OAAO,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC;IACzD,8EAA8E;IAC9E,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,iFAAiF;IACjF,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,oFAAoF;IACpF,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CAcnE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,gBAAgB,CAsB1E;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,GAAG,eAAe,CAOtE;AAED,eAAO,MAAM,mBAAmB,EAAE,cAmBjC,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,cA0B/B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAcnG;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAarG;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAS/H;AAED,eAAO,MAAM,qBAAqB,EAAE,cAuBnC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWtG;AAED,eAAO,MAAM,wBAAwB,EAAE,cAStC,CAAC;AAEF,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGzE;AAED,eAAO,MAAM,yBAAyB,EAAE,cAuBvC,CAAC;AAEF,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGpG;AAED,eAAO,MAAM,uBAAuB,EAAE,cAerC,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAiBlD,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,EAAE,CAE/D;AAqBD,2GAA2G;AAC3G,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBjG;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAwBzE;AAID;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,EAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAEpB;AAED,kGAAkG;AAClG;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAYrI;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAWrG;AAED,6FAA6F;AAC7F,MAAM,MAAM,OAAO,GAAG,CACpB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAY/C;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE,SAAS,EACd,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA4B7E;AA4BD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,aAAa,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD,OAAO,CAAC,IAAI,CAAC,CAiBf;AAqBD,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAU1E;AAED,MAAM,WAAW,YAAY;IAC3B,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;IACrB;0EACsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACpC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACpF,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAClE,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjE,YAAY,CAAC,EAAE,eAAe,EAAE,CAAC;IACjC,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC;CAChC,GAAG,WAAW,CAoBd;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,MAAM,EAAE,oBAAoB,GAAG,aAAa,CAAC;IAC7C,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,OAAO,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,WAAW,KAAK,SAAS,EACtE,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IACT,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChE,WAAW,EAAE,cAAc,EAAE,CAAC;CAC/B,CAAC,CAiCD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnF,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChE,+EAA+E;IAC/E,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,qEAAqE;IACrE,WAAW,EAAE,cAAc,EAAE,CAAC;CAC/B,CAAC,CAmCD;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE,SAAS,EACd,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAoB3D;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjE;;2EAEuE;IACvE,YAAY,EAAE,eAAe,EAAE,CAAC;CACjC,CAAC,CA2BD"}
+{"version":3,"file":"gcp-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/gcp-apply.ts"],"names":[],"mappings":"AAgBA,OAAO,EAEL,KAAK,WAAW,EAGjB,MAAM,wBAAwB,CAAC;AAIhC;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEvF;AAQD,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACtC,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,8DAA8D;AAC9D,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,IAAI,CAAC,EAAE;QACL,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,wBAAwB,CAAC,EAAE,OAAO,CAAC;QACnC,UAAU,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QACnC,aAAa,CAAC,EAAE,KAAK,CAAC;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAC;KAClG,CAAC;CACH;AAED,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE;QAAE,wBAAwB,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IACtE,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAClC,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACvG;AAED,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAID;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/D,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,OAAO,GAAG,KAAK,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;CAClE;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,OAAO,CAAC,kBAAkB,EAAE,OAAO,EAAE,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IACjG,8DAA8D;IAC9D,MAAM,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC;IACxC,8EAA8E;IAC9E,KAAK,CAAC,aAAa,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;CACnD;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,kCAAkC;IAClC,GAAG,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IACpD,4EAA4E;IAC5E,KAAK,CAAC,YAAY,EAAE,OAAO,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAC/F;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnI,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrG,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7H;AAED,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC7B,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,GAAG,SAAS,CAAC;IACvD,2IAA2I;IAC3I,OAAO,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC;IACzD,8EAA8E;IAC9E,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,iFAAiF;IACjF,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,oFAAoF;IACpF,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CAcnE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,gBAAgB,CAsB1E;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,GAAG,eAAe,CAOtE;AAED,eAAO,MAAM,mBAAmB,EAAE,cAmBjC,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,cA0B/B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAcnG;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAarG;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAS/H;AAED,eAAO,MAAM,qBAAqB,EAAE,cAuBnC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWtG;AAED,eAAO,MAAM,wBAAwB,EAAE,cAStC,CAAC;AAEF,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGzE;AAED,eAAO,MAAM,yBAAyB,EAAE,cAuBvC,CAAC;AAEF,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGpG;AAED,eAAO,MAAM,uBAAuB,EAAE,cAerC,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAiBlD,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,EAAE,CAE/D;AAqBD,2GAA2G;AAC3G,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBjG;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAwBzE;AAID;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,EAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAEpB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAYrI;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAQrG;AAED,4DAA4D;AAC5D,eAAO,MAAM,UAAU,8IACiH,CAAC;AAEzI,6FAA6F;AAC7F,MAAM,MAAM,OAAO,GAAG,CACpB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAY/C;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE,SAAS,EACd,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA4B7E;AA4BD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,aAAa,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD,OAAO,CAAC,IAAI,CAAC,CAiBf;AAqBD,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAU1E;AAED,MAAM,WAAW,YAAY;IAC3B,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;IACrB;0EACsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACpC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACpF,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAClE,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjE,YAAY,CAAC,EAAE,eAAe,EAAE,CAAC;IACjC,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC;CAChC,GAAG,WAAW,CAoBd;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,MAAM,EAAE,oBAAoB,GAAG,aAAa,CAAC;IAC7C,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,OAAO,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,WAAW,KAAK,SAAS,EACtE,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IACT,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChE,WAAW,EAAE,cAAc,EAAE,CAAC;CAC/B,CAAC,CAiCD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnF,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChE,+EAA+E;IAC/E,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,qEAAqE;IACrE,WAAW,EAAE,cAAc,EAAE,CAAC;CAC/B,CAAC,CAmCD;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE,SAAS,EACd,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAoB3D;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjE;;2EAEuE;IACvE,YAAY,EAAE,eAAe,EAAE,CAAC;CACjC,CAAC,CA2BD"}

package/dist/op/activities/gcp-apply.js

@@ -425,7 +425,6 @@ export function orderByReferences(resources) {
 export function resolveGcpEndpoint(args = {}, env = process.env) {
     return args.endpoint || env.GCP_ENDPOINT_URL || undefined;
 }
-/** Resolve the project: `GOOGLE_CLOUD_PROJECT` env, else the CNRM project-id annotation. Pure. */
 /**
  * The project a resource names in `spec.projectRef.external` (#4201): a
  * project id or `projects/<id>`. A `GCP.ProjectId` pseudo-parameter there
@@ -447,15 +446,22 @@ export function projectRefProject(spec, env = process.env) {
         return undefined;
     return external.startsWith("projects/") ? external.slice("projects/".length).split("/")[0] : external;
 }
+/**
+ * The project a resource is applied in (#4252): its own `spec.projectRef.external`,
+ * else its project-id annotation (where chant.config's `gcp.project` is
+ * written at build), else `GCP_PROJECT_ID`, else `GOOGLE_CLOUD_PROJECT`. Pure.
+ */
 export function resolveGcpProject(resource, env = process.env) {
     const project = projectRefProject(resource.spec, env) ||
-        env.GOOGLE_CLOUD_PROJECT ||
-        resource.metadata?.annotations?.[PROJECT_ID_ANNOTATION];
-    if (!project) {
-        throw new Error(`no GCP project — set spec.projectRef.external, GOOGLE_CLOUD_PROJECT or the ${PROJECT_ID_ANNOTATION} annotation`);
-    }
+        resource.metadata?.annotations?.[PROJECT_ID_ANNOTATION] ||
+        env.GCP_PROJECT_ID ||
+        env.GOOGLE_CLOUD_PROJECT;
+    if (!project)
+        throw new Error(NO_PROJECT);
     return project;
 }
+/** The error every stage gives when no project resolves. */
+export const NO_PROJECT = `no GCP project — set gcp.project in chant.config, GCP_PROJECT_ID or GOOGLE_CLOUD_PROJECT, or the resource's spec.projectRef.external`;
 const defaultHttp = async (method, url, body, signal) => {
     const res = await fetch(url, {
         method,

package/dist/op/activities/gcp-iam.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-iam.d.ts","sourceRoot":"","sources":["../../../src/op/activities/gcp-iam.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAW,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAExE,iDAAiD;AACjD,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvF,SAAS,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,OAAO;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3E;AAED,UAAU,MAAM;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;CACtB;AAED,mDAAmD;AACnD,MAAM,WAAW,SAAS;IACxB,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QAAE,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/E,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK;QAAE,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;CAC/F;AAED,gHAAgH;AAChH,eAAO,MAAM,gBAAgB,+BAA+B,CAAC;AAqB7D;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,SAAS,WAAW,EAAO,EACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,SAAS,GAAG,SAAS,CAgDvB;AAYD,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAElF;AAED,8FAA8F;AAC9F,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAY5E;AAED,kGAAkG;AAClG,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAS/E;AAkED,eAAO,MAAM,qBAAqB,EAAE,cA8CnC,CAAC"}
+{"version":3,"file":"gcp-iam.d.ts","sourceRoot":"","sources":["../../../src/op/activities/gcp-iam.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAW,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAExE,iDAAiD;AACjD,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvF,SAAS,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,OAAO;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3E;AAED,UAAU,MAAM;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;CACtB;AAED,mDAAmD;AACnD,MAAM,WAAW,SAAS;IACxB,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QAAE,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/E,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK;QAAE,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;CAC/F;AAED,gHAAgH;AAChH,eAAO,MAAM,gBAAgB,+BAA+B,CAAC;AAqB7D;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,SAAS,WAAW,EAAO,EACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,SAAS,GAAG,SAAS,CAgDvB;AAYD,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAElF;AAED,8FAA8F;AAC9F,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAY5E;AAED,kGAAkG;AAClG,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAS/E;AAkED,eAAO,MAAM,qBAAqB,EAAE,cAgDnC,CAAC"}

package/dist/op/activities/gcp-iam.js

@@ -202,6 +202,8 @@ export const iamPolicyMemberMapper = {
                 status: 200,
                 // `resourceRef` is the declared one: the policy read is that target's, so the binding is on it.
                 text: JSON.stringify({
+                    // The binding has no id of its own; this one names it, so a read reports a physical id (#4251).
+                    selfLink: `${target.path}#${spec.role}#${spec.member}`,
                     member: spec.member,
                     role: spec.role,
                     resource: target.path,

package/dist/serializer.d.ts

@@ -23,8 +23,20 @@ export declare function resolveGVK(entityType: string): {
  * props, else its logical id in kebab case.
  */
 export declare function cnrmName(logical: string, entity: Declarable): string;
+/** {@link cnrmName} from a resource's props, for callers holding props rather than the declarable. */
+export declare function cnrmNameOf(logical: string, props: unknown): string;
+/**
+ * Declared props with each reference to another resource replaced as the
+ * serializer writes it (#4251): an attribute reference (`neg.name`) becomes the
+ * target's metadata.name, and a resource placed whole becomes `{ name }`.
+ * `logicalOf` maps a target's props object to its logical id, for a reference
+ * that does not carry one. Other values, pseudo-parameters included, are kept.
+ */
+export declare function resolveCnrmRefs(value: unknown, logicalOf: (props: unknown) => string | undefined): unknown;
 /**
  * GCP Config Connector YAML serializer implementation.
  */
 export declare const gcpSerializer: Serializer;
+/** The `gcp.project` a chant.config declares, if any (#4252). */
+export declare function gcpConfigProject(config: Record<string, unknown> | undefined): string | undefined;
 //# sourceMappingURL=serializer.d.ts.map

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AAiClG;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAW1F;AA+CD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,MAAM,CAIpE;AA4BD;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UAiG3B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAG9D,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AAiClG;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAW1F;AA+CD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,MAAM,CAEpE;AAED,sGAAsG;AACtG,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAGlE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,GAAG,OAAO,CAkB1G;AA4BD;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UAsG3B,CAAC;AAIF,iEAAiE;AACjE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAGhG"}

package/dist/serializer.js

@@ -6,7 +6,8 @@
  */
 import { createRequire } from "module";
 import { moduleSourceUrl } from "@intentius/chant/module-source";
-import { isPropertyDeclarable, isResourceDeclarable } from "@intentius/chant/declarable";
+import { isDeclarable, isPropertyDeclarable, isResourceDeclarable } from "@intentius/chant/declarable";
+import { AttrRef } from "@intentius/chant/attrref";
 import { ownershipEntries, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
 import { walkValue } from "@intentius/chant/serializer-walker";
 import { emitYAML } from "@intentius/chant/yaml";
@@ -91,10 +92,43 @@ function gcpVisitor(entityNames) {
  * props, else its logical id in kebab case.
  */
 export function cnrmName(logical, entity) {
-    const props = isResourceDeclarable(entity) ? entity.props : undefined;
+    return cnrmNameOf(logical, isResourceDeclarable(entity) ? entity.props : undefined);
+}
+/** {@link cnrmName} from a resource's props, for callers holding props rather than the declarable. */
+export function cnrmNameOf(logical, props) {
     const declared = props?.metadata?.name;
     return typeof declared === "string" && declared.length > 0 ? declared : kebabName(logical);
 }
+/**
+ * Declared props with each reference to another resource replaced as the
+ * serializer writes it (#4251): an attribute reference (`neg.name`) becomes the
+ * target's metadata.name, and a resource placed whole becomes `{ name }`.
+ * `logicalOf` maps a target's props object to its logical id, for a reference
+ * that does not carry one. Other values, pseudo-parameters included, are kept.
+ */
+export function resolveCnrmRefs(value, logicalOf) {
+    if (value instanceof AttrRef) {
+        const parent = value.parent.deref();
+        const props = parent && isResourceDeclarable(parent) ? parent.props : undefined;
+        const logical = value.getLogicalName() ?? logicalOf(props);
+        return logical === undefined ? value : cnrmNameOf(logical, props);
+    }
+    if (Array.isArray(value))
+        return value.map((v) => resolveCnrmRefs(v, logicalOf));
+    if (value === null || typeof value !== "object")
+        return value;
+    if (isDeclarable(value)) {
+        const props = isResourceDeclarable(value) ? value.props : undefined;
+        const logical = logicalOf(props);
+        return logical === undefined ? value : { name: cnrmNameOf(logical, props) };
+    }
+    if (INTRINSIC_MARKER in value)
+        return value;
+    const out = {};
+    for (const [k, v] of Object.entries(value))
+        out[k] = resolveCnrmRefs(v, logicalOf);
+    return out;
+}
 function kebabName(logical) {
     return logical.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
 }
@@ -133,7 +167,11 @@ export const gcpSerializer = {
         let defaultLabelEntries = context?.ownership
             ? { ...ownershipEntries(LABEL_OWNERSHIP_KEYS, context.ownership) }
             : {};
-        let defaultAnnotationEntries = {};
+        // #4252: a member's project, once, in chant.config's `gcp.project`. It
+        // resolves GCP.ProjectId and is written as each resource's project-id
+        // annotation, which apply and the readers take ahead of the env vars.
+        const configProject = gcpConfigProject(context?.config);
+        let defaultAnnotationEntries = configProject ? { [PROJECT_ID_ANNOTATION]: configProject } : {};
         for (const [, entity] of entities) {
             if (isDefaultLabels(entity)) {
                 defaultLabelEntries = { ...defaultLabelEntries, ...entity.labels };
@@ -153,7 +191,7 @@ export const gcpSerializer = {
             const gvk = resolveGVK(entityType);
             if (!gvk)
                 continue;
-            const props = resolvePseudoParameters(toYAMLValue(isResourceDeclarable(entity) ? entity.props : undefined, entityNames), name, unresolved);
+            const props = resolvePseudoParameters(toYAMLValue(isResourceDeclarable(entity) ? entity.props : undefined, entityNames), name, unresolved, configProject);
             if (!props)
                 continue;
             // Build the Config Connector manifest structure
@@ -201,6 +239,12 @@ export const gcpSerializer = {
         return warnings.length > 0 ? { primary, warnings } : primary;
     },
 };
+const PROJECT_ID_ANNOTATION = "cnrm.cloud.google.com/project-id";
+/** The `gcp.project` a chant.config declares, if any (#4252). */
+export function gcpConfigProject(config) {
+    const project = config?.gcp?.project;
+    return typeof project === "string" && project.length > 0 ? project : undefined;
+}
 /**
  * Pseudo-parameter → environment variable mapping.
  * Config Connector annotations must be plain strings, so PseudoParameters
@@ -218,16 +262,16 @@ const PSEUDO_ENV_MAP = {
  * the API as an object. A variable that isn't set is recorded, and the
  * build refuses with every one named.
  */
-function resolvePseudoParameters(value, entity, unresolved) {
+function resolvePseudoParameters(value, entity, unresolved, project) {
     if (Array.isArray(value))
-        return value.map((v) => resolvePseudoParameters(v, entity, unresolved));
+        return value.map((v) => resolvePseudoParameters(v, entity, unresolved, project));
     if (value === null || typeof value !== "object")
         return value;
     const obj = value;
     const keys = Object.keys(obj);
     if (keys.length === 1 && keys[0] === "Ref" && typeof obj.Ref === "string" && obj.Ref in PSEUDO_ENV_MAP) {
         const { envVar } = PSEUDO_ENV_MAP[obj.Ref];
-        const resolved = process.env[envVar];
+        const resolved = (obj.Ref === "GCP::ProjectId" ? project : undefined) ?? process.env[envVar];
         if (resolved)
             return resolved;
         unresolved.push({ entity, ref: obj.Ref, envVar });
@@ -235,7 +279,7 @@ function resolvePseudoParameters(value, entity, unresolved) {
     }
     const out = {};
     for (const [k, v] of Object.entries(obj))
-        out[k] = resolvePseudoParameters(v, entity, unresolved);
+        out[k] = resolvePseudoParameters(v, entity, unresolved, project);
     return out;
 }
 function unresolvedMessage(unresolved) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gcp",
-  "version": "0.124.36",
+  "version": "0.124.37",
   "description": "Google Cloud lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -76,6 +76,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.36"
+    "@intentius/chant": "^0.124.37"
   }
 }

package/src/deep-observe.ts

@@ -61,7 +61,7 @@ import type {
 } from "@intentius/chant/lexicon";
 import { deepObservation, normalizeDeepProperties } from "@intentius/chant/deep-observation";
 import { hasOwnershipMarker, type ChannelKeys } from "@intentius/chant/ownership";
-import { deriveGVK, manifestProjectAnnotations, resolveReadProject } from "./describe-resources";
+import { deriveGVK, manifestProjectAnnotations, readTargets, resolveReadProject } from "./describe-resources";
 import { getResource, mapperForKind, GcpReadError, isNotFound, type GcpReadClientOptions } from "./api/read-client";
 import { gcpDeepNormalizationHooks } from "./deep-observe-hooks";
 
@@ -387,8 +387,9 @@ export async function observeResourcesDeepGcp(options: GcpDeepObserveOptions): P
 
   const endpoint = process.env.GCP_ENDPOINT_URL;
   const manifestProjects = manifestProjectAnnotations(options.buildOutput);
+  const targets = readTargets(options.entities);
 
-  const reads = [...options.entities].map(async ([entityName, { entityType, props }]) => {
+  const reads = [...options.entities].map(async ([entityName, { entityType }]) => {
     const gvk = deriveGVK(entityType);
     if (!gvk || !mapperForKind(gvk.kind)) {
       unobserved[entityName] = {
@@ -401,16 +402,8 @@ export async function observeResourcesDeepGcp(options: GcpDeepObserveOptions): P
       return;
     }
 
-    const metadata = props.metadata as { name?: string; annotations?: Record<string, string> } | undefined;
-    const name = metadata?.name;
-    if (!name) {
-      unobserved[entityName] = {
-        type: entityType,
-        reason: "read-failed",
-        detail: "declared entity has no metadata.name to query by",
-      };
-      return;
-    }
+    const { name, props } = targets.get(entityName)!;
+    const metadata = props.metadata as { annotations?: Record<string, string> } | undefined;
 
     let client: GcpReadClientOptions;
     try {

package/src/describe-resources.test.ts

@@ -86,10 +86,11 @@ describe("gcp describeResources — direct REST (#1209)", () => {
     expect(fetchMock).not.toHaveBeenCalled();
   });
 
-  test("an entity with no metadata.name has nothing to query by", async () => {
-    const out = await read(makeEntities([{ name: "e", entityType: "GCP::Storage::Bucket", props: {} }]));
-    expect(out.unobserved?.e?.reason).toBe("read-failed");
-    expect(fetchMock).not.toHaveBeenCalled();
+  test("an entity with no metadata.name is read by the name the build gives it, the kebab-cased logical id (#4251)", async () => {
+    fetchMock.mockResolvedValue(reply(200, { name: "web-assets" }));
+    const out = await read(makeEntities([{ name: "webAssets", entityType: "GCP::Storage::Bucket", props: {} }]));
+    expect(out.resources.webAssets).toBeDefined();
+    expect(String(fetchMock.mock.calls[0][0])).toContain("/b/web-assets");
   });
 
   test("kinds resolve through the serializer's GVK map, not naive recasing", async () => {

package/src/describe-resources.ts

@@ -40,8 +40,8 @@ import type { ObservationResult, ResourceMetadata, UnobservedEntity } from "@int
 import { observation } from "@intentius/chant/observation";
 import { hasOwnershipMarker, classifyOwnership, readOwnership, type ChannelKeys } from "@intentius/chant/ownership";
 import { getResource, mapperForKind, GcpReadError, isNotFound, type GcpReadClientOptions } from "./api/read-client";
-import { resolveGcpProject, parseManifest, projectRefProject } from "./op/activities/gcp-apply";
-import { resolveGVK } from "./serializer";
+import { NO_PROJECT, parseManifest, projectRefProject } from "./op/activities/gcp-apply";
+import { cnrmNameOf, resolveCnrmRefs, resolveGVK } from "./serializer";
 
 /**
  * chant's ownership marker as GCP labels.
@@ -119,11 +119,12 @@ export function manifestProjectAnnotations(buildOutput: string | undefined): Map
 }
 
 /**
- * The project a read should target: the entity's `projectRef.external`,
- * `GOOGLE_CLOUD_PROJECT`, the entity's own annotation (via
- * `resolveGcpProject`, the applier's rule), then the built
- * manifest's merged annotation. Throws the applier's own error when nothing
- * resolves, so the `no-binding` detail names both knobs.
+ * The project a read should target, in apply's order (#4252): the entity's
+ * own literal `projectRef.external`, then the built manifest's project for it
+ * (its resolved projectRef, or the project-id annotation chant.config's
+ * `gcp.project` writes), then the entity's own annotation, then
+ * `GCP_PROJECT_ID`, then `GOOGLE_CLOUD_PROJECT`. Throws apply's own error when
+ * nothing resolves, so the `no-binding` detail names every knob.
  */
 export function resolveReadProject(
   kind: string,
@@ -131,14 +132,39 @@ export function resolveReadProject(
   metadata: { annotations?: Record<string, string> } | undefined,
   manifestProjects: Map<string, string>,
   props?: Record<string, unknown>,
+  env: NodeJS.ProcessEnv = process.env,
 ): string {
-  try {
-    return resolveGcpProject({ kind, metadata, ...(props ? { spec: props } : {}) });
-  } catch (err) {
-    const fromManifest = manifestProjects.get(`${kind}/${name}`);
-    if (fromManifest) return fromManifest;
-    throw err;
+  const project =
+    projectRefProject(props, {}) ||
+    manifestProjects.get(`${kind}/${name}`) ||
+    metadata?.annotations?.["cnrm.cloud.google.com/project-id"] ||
+    projectRefProject(props, env) ||
+    env.GCP_PROJECT_ID ||
+    env.GOOGLE_CLOUD_PROJECT;
+  if (!project) throw new Error(NO_PROJECT);
+  return project;
+}
+
+/**
+ * Each declared entity as a read sees it (#4251): the name the build writes
+ * (`metadata.name`, else the kebab-cased logical id) and its props with every
+ * reference to another resource resolved as the serializer resolves it, so a
+ * mapper building a read URL never meets an attribute reference.
+ */
+export function readTargets(
+  entities: Map<string, { entityType: string; props: Record<string, unknown> }>,
+): Map<string, { name: string; props: Record<string, unknown> }> {
+  const logicalByProps = new Map<unknown, string>();
+  for (const [logical, { props }] of entities) logicalByProps.set(props, logical);
+  const logicalOf = (props: unknown) => logicalByProps.get(props);
+  const out = new Map<string, { name: string; props: Record<string, unknown> }>();
+  for (const [logical, { props }] of entities) {
+    out.set(logical, {
+      name: cnrmNameOf(logical, props),
+      props: resolveCnrmRefs(props, logicalOf) as Record<string, unknown>,
+    });
   }
+  return out;
 }
 
 function pruneUndefined<T extends Record<string, unknown>>(obj: T): Record<string, unknown> {
@@ -196,8 +222,9 @@ export async function describeResources(options: {
   let warnedOwnership = false;
 
   const manifestProjects = manifestProjectAnnotations(options.buildOutput);
+  const targets = readTargets(options.entities);
 
-  const reads = [...options.entities].map(async ([entityName, { entityType, props }]) => {
+  const reads = [...options.entities].map(async ([entityName, { entityType }]) => {
     const gvk = deriveGVK(entityType);
     if (!gvk) {
       unobserved[entityName] = {
@@ -218,16 +245,8 @@ export async function describeResources(options: {
       return;
     }
 
-    const metadata = props.metadata as { name?: string; annotations?: Record<string, string> } | undefined;
-    const name = metadata?.name;
-    if (!name) {
-      unobserved[entityName] = {
-        type: entityType,
-        reason: "read-failed",
-        detail: "declared entity has no metadata.name to query by",
-      };
-      return;
-    }
+    const { name, props } = targets.get(entityName)!;
+    const metadata = props.metadata as { annotations?: Record<string, string> } | undefined;
 
     let client: GcpReadClientOptions;
     try {

package/src/health.ts

@@ -11,7 +11,7 @@
 
 import type { HealthEntry, HealthReadOptions, HealthReadResult, UnobservedEntity } from "@intentius/chant/lexicon";
 import { getResource, GcpReadError, isNotFound, type GcpReadHttp } from "./api/read-client";
-import { deriveGVK, manifestProjectAnnotations, resolveReadProject } from "./describe-resources";
+import { deriveGVK, manifestProjectAnnotations, readTargets, resolveReadProject } from "./describe-resources";
 
 export const GCP_HEALTH_TYPES = ["GCP::Run::Service"] as const;
 
@@ -75,18 +75,15 @@ export async function observeHealthGcp(options: GcpHealthOptions): Promise<Healt
   const entities: Record<string, HealthEntry> = {};
   const unobserved: Record<string, UnobservedEntity> = {};
   const absent: string[] = [];
+  const targets = readTargets(options.entities);
 
   await Promise.all(
-    [...options.entities].map(async ([entityName, { entityType, props }]) => {
+    [...options.entities].map(async ([entityName, { entityType }]) => {
       const gvk = deriveGVK(entityType);
-      const metadata = props.metadata as { name?: string; annotations?: Record<string, string> } | undefined;
-      const name = metadata?.name;
-      if (!gvk || !name) {
-        unobserved[entityName] = {
-          type: entityType,
-          reason: "read-failed",
-          detail: gvk ? "declared entity has no metadata.name to query by" : `cannot derive a GCP kind from ${entityType}`,
-        };
+      const { name, props } = targets.get(entityName)!;
+      const metadata = props.metadata as { annotations?: Record<string, string> } | undefined;
+      if (!gvk) {
+        unobserved[entityName] = { type: entityType, reason: "read-failed", detail: `cannot derive a GCP kind from ${entityType}` };
         return;
       }
       let project: string;

package/src/op/activities/gcp-apply.test.ts

@@ -296,9 +296,16 @@ describe("Cloud Run mapper + LRO (#706)", () => {
 });
 
 describe("resolveGcpProject (#711)", () => {
-  test("env wins over the annotation", () => {
-    expect(resolveGcpProject(BUCKET, { GOOGLE_CLOUD_PROJECT: "env-project" } as NodeJS.ProcessEnv))
-      .toBe("env-project");
+  test("the annotation (where chant.config's gcp.project lands) wins over the env vars (#4252)", () => {
+    expect(resolveGcpProject(BUCKET, { GOOGLE_CLOUD_PROJECT: "env-project", GCP_PROJECT_ID: "id-project" } as NodeJS.ProcessEnv))
+      .toBe("annotated-project");
+  });
+
+  test("without an annotation, GCP_PROJECT_ID wins over GOOGLE_CLOUD_PROJECT, and projectRef over both (#4252)", () => {
+    const bare = { metadata: { name: "b" } };
+    expect(resolveGcpProject(bare, { GOOGLE_CLOUD_PROJECT: "g", GCP_PROJECT_ID: "p" } as NodeJS.ProcessEnv)).toBe("p");
+    expect(resolveGcpProject(bare, { GOOGLE_CLOUD_PROJECT: "g" } as NodeJS.ProcessEnv)).toBe("g");
+    expect(resolveGcpProject({ ...bare, spec: { projectRef: { external: "own" } } }, { GCP_PROJECT_ID: "p" } as NodeJS.ProcessEnv)).toBe("own");
   });
 
   test("falls back to the CNRM annotation", () => {

package/src/op/activities/gcp-apply.ts

@@ -568,7 +568,6 @@ export function resolveGcpEndpoint(
   return args.endpoint || env.GCP_ENDPOINT_URL || undefined;
 }
 
-/** Resolve the project: `GOOGLE_CLOUD_PROJECT` env, else the CNRM project-id annotation. Pure. */
 /**
  * The project a resource names in `spec.projectRef.external` (#4201): a
  * project id or `projects/<id>`. A `GCP.ProjectId` pseudo-parameter there
@@ -589,19 +588,25 @@ export function projectRefProject(spec: Record<string, unknown> | undefined, env
   return external.startsWith("projects/") ? external.slice("projects/".length).split("/")[0] : external;
 }
 
+/**
+ * The project a resource is applied in (#4252): its own `spec.projectRef.external`,
+ * else its project-id annotation (where chant.config's `gcp.project` is
+ * written at build), else `GCP_PROJECT_ID`, else `GOOGLE_CLOUD_PROJECT`. Pure.
+ */
 export function resolveGcpProject(resource: GcpResource, env: NodeJS.ProcessEnv = process.env): string {
   const project =
     projectRefProject(resource.spec, env) ||
-    env.GOOGLE_CLOUD_PROJECT ||
-    resource.metadata?.annotations?.[PROJECT_ID_ANNOTATION];
-  if (!project) {
-    throw new Error(
-      `no GCP project — set spec.projectRef.external, GOOGLE_CLOUD_PROJECT or the ${PROJECT_ID_ANNOTATION} annotation`,
-    );
-  }
+    resource.metadata?.annotations?.[PROJECT_ID_ANNOTATION] ||
+    env.GCP_PROJECT_ID ||
+    env.GOOGLE_CLOUD_PROJECT;
+  if (!project) throw new Error(NO_PROJECT);
   return project;
 }
 
+/** The error every stage gives when no project resolves. */
+export const NO_PROJECT =
+  `no GCP project — set gcp.project in chant.config, GCP_PROJECT_ID or GOOGLE_CLOUD_PROJECT, or the resource's spec.projectRef.external`;
+
 /** Injectable HTTP client — mirrors argo's injectable fetcher so tests avoid the network. */
 export type GcpHttp = (
   method: string,

package/src/op/activities/gcp-iam.ts

@@ -271,6 +271,8 @@ export const iamPolicyMemberMapper: ResourceMapper = {
         status: 200,
         // `resourceRef` is the declared one: the policy read is that target's, so the binding is on it.
         text: JSON.stringify({
+          // The binding has no id of its own; this one names it, so a read reports a physical id (#4251).
+          selfLink: `${target.path}#${spec.role}#${spec.member}`,
           member: spec.member,
           role: spec.role,
           resource: target.path,

package/src/project-config.test.ts

@@ -0,0 +1,119 @@
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { mkdir, writeFile, rm, realpath } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import type { Declarable } from "@intentius/chant/declarable";
+import { loadChantConfig } from "@intentius/chant/config";
+import { armSandboxConfigEvaluation, resetSandboxConfigEvaluationForTests } from "@intentius/chant/config-sandbox";
+import { gcpSerializer } from "./serializer";
+import { manifestProjectAnnotations, resolveReadProject } from "./describe-resources";
+import { parseManifest, resolveGcpProject } from "./op/activities/gcp-apply";
+import { CloudRunService, StorageBucket } from "./generated";
+import { defaultAnnotations } from "./default-labels";
+import { GCP } from "./pseudo";
+
+/** #4252: one GCP project for build, apply and read, set once in chant.config. */
+
+const ANNOTATION = "cnrm.cloud.google.com/project-id";
+
+function build(entities: Record<string, unknown>, config?: Record<string, unknown>): string {
+  const out = gcpSerializer.serialize(new Map(Object.entries(entities)) as Map<string, Declarable>, undefined, config ? { config } : undefined);
+  return typeof out === "string" ? out : out.primary;
+}
+
+describe("gcp.project in chant.config (#4252)", () => {
+  let saved: NodeJS.ProcessEnv;
+  beforeEach(() => {
+    saved = { ...process.env };
+    process.env.GCP_PROJECT_ID = "env-id";
+    process.env.GOOGLE_CLOUD_PROJECT = "env-google";
+  });
+  afterEach(() => {
+    process.env = saved;
+  });
+
+  test("the build writes it as each resource's project-id annotation and resolves GCP.ProjectId from it", () => {
+    const yaml = build(
+      {
+        assets: new StorageBucket({ metadata: { name: "assets" }, location: "US" } as never),
+        web: new CloudRunService({ metadata: { name: "web" }, location: "us-central1", projectRef: { external: GCP.ProjectId } } as never),
+      },
+      { gcp: { project: "cfg-project" } },
+    );
+    const docs = parseManifest(yaml, "test");
+    expect(docs.find((d) => d.metadata?.name === "assets")?.metadata?.annotations?.[ANNOTATION]).toBe("cfg-project");
+    expect((docs.find((d) => d.metadata?.name === "web")?.spec as { projectRef: unknown }).projectRef).toEqual({ external: "cfg-project" });
+  });
+
+  test("without it the build writes no annotation, as before", () => {
+    const yaml = build({ assets: new StorageBucket({ metadata: { name: "assets" }, location: "US" } as never) });
+    expect(parseManifest(yaml, "test")[0].metadata?.annotations?.[ANNOTATION]).toBeUndefined();
+  });
+
+  test("a defaultAnnotations project wins over the config's", () => {
+    const yaml = build(
+      {
+        assets: new StorageBucket({ metadata: { name: "assets" }, location: "US" } as never),
+        annotations: defaultAnnotations({ [ANNOTATION]: "declared-project" }),
+      },
+      { gcp: { project: "cfg-project" } },
+    );
+    expect(parseManifest(yaml, "test")[0].metadata?.annotations?.[ANNOTATION]).toBe("declared-project");
+  });
+
+  test("apply and read both take it ahead of GCP_PROJECT_ID and GOOGLE_CLOUD_PROJECT, and a projectRef ahead of it", () => {
+    const yaml = build(
+      {
+        assets: new StorageBucket({ metadata: { name: "assets" }, location: "US" } as never),
+        other: new StorageBucket({ metadata: { name: "other" }, location: "US", projectRef: { external: "own-project" } } as never),
+      },
+      { gcp: { project: "cfg-project" } },
+    );
+    const docs = parseManifest(yaml, "test");
+    expect(resolveGcpProject(docs.find((d) => d.metadata?.name === "assets")!)).toBe("cfg-project");
+    expect(resolveGcpProject(docs.find((d) => d.metadata?.name === "other")!)).toBe("own-project");
+
+    const manifest = manifestProjectAnnotations(yaml);
+    expect(resolveReadProject("StorageBucket", "assets", undefined, manifest, { metadata: { name: "assets" } })).toBe("cfg-project");
+    expect(resolveReadProject("StorageBucket", "other", undefined, manifest, { projectRef: { external: "own-project" } })).toBe("own-project");
+  });
+
+  test("with nothing declared, read falls back to GCP_PROJECT_ID, then GOOGLE_CLOUD_PROJECT", () => {
+    const none = new Map<string, string>();
+    expect(resolveReadProject("StorageBucket", "b", undefined, none, {})).toBe("env-id");
+    delete process.env.GCP_PROJECT_ID;
+    expect(resolveReadProject("StorageBucket", "b", undefined, none, {})).toBe("env-google");
+    delete process.env.GOOGLE_CLOUD_PROJECT;
+    expect(() => resolveReadProject("StorageBucket", "b", undefined, none, {})).toThrow(/gcp\.project in chant\.config/);
+  });
+});
+
+describe("gcp.project under --sandbox (#4252)", () => {
+  let dir: string;
+  beforeEach(async () => {
+    const d = join(tmpdir(), `chant-4252-${Date.now()}-${Math.random()}`);
+    await mkdir(d, { recursive: true });
+    dir = await realpath(d);
+    resetSandboxConfigEvaluationForTests();
+  });
+  afterEach(async () => {
+    resetSandboxConfigEvaluationForTests();
+    await rm(dir, { recursive: true, force: true });
+  });
+
+  test("the config crosses from the sandboxed child as data, and the build reads it from there, not from process.env", async () => {
+    await writeFile(join(dir, "chant.config.ts"), `export default { lexicons: ["gcp"], gcp: { project: "sandboxed-project" } };\n`);
+    armSandboxConfigEvaluation();
+    const { config } = await loadChantConfig(dir);
+    expect((config as { gcp?: { project?: string } }).gcp?.project).toBe("sandboxed-project");
+
+    const saved = process.env.GCP_PROJECT_ID;
+    delete process.env.GCP_PROJECT_ID;
+    try {
+      const yaml = build({ assets: new StorageBucket({ metadata: { name: "assets" }, location: "US" } as never) }, config as Record<string, unknown>);
+      expect(parseManifest(yaml, "test")[0].metadata?.annotations?.[ANNOTATION]).toBe("sandboxed-project");
+    } finally {
+      if (saved !== undefined) process.env.GCP_PROJECT_ID = saved;
+    }
+  });
+});

package/src/read-refs.test.ts

@@ -0,0 +1,135 @@
+import { describe, test, expect, vi, beforeEach, afterEach } from "vitest";
+import { describeResources } from "./describe-resources";
+import {
+  BackendService,
+  CloudRunService,
+  ComputeAddress,
+  ForwardingRule,
+  IAMPolicyMember,
+  RegionNetworkEndpointGroup,
+  Subnetwork,
+  TargetHTTPProxy,
+  URLMap,
+  VPCNetwork,
+} from "./generated";
+
+/**
+ * #4251: behold's three-cloud gcp member, read back. Every resource here names
+ * another by `.name`, an attribute reference the serializer resolves to the
+ * target's metadata.name (#4245). The read path has to resolve it the same way
+ * before a mapper builds a URL from the declared props.
+ */
+const fetchMock = vi.fn();
+
+function reply(status: number, body: unknown) {
+  return { status, text: async () => JSON.stringify(body) };
+}
+
+function estate() {
+  const web = new CloudRunService({ metadata: { name: "three-cloud-site" }, location: "us-central1", template: {} } as never);
+  const vpc = new VPCNetwork({ metadata: { name: "three-cloud-vpc" }, autoCreateSubnetworks: false } as never);
+  const subnet = new Subnetwork({
+    metadata: { name: "three-cloud-subnet" },
+    region: "us-central1",
+    ipCidrRange: "10.8.0.0/24",
+    networkRef: { name: vpc.name },
+  } as never);
+  (web as unknown as { props: Record<string, unknown> }).props.template = {
+    containers: [{ image: "gcr.io/p/site:1" }],
+    vpcAccess: { egress: "ALL_TRAFFIC", networkInterfaces: [{ networkRef: { name: vpc.name }, subnetworkRef: { name: subnet.name } }] },
+  };
+  const neg = new RegionNetworkEndpointGroup({
+    metadata: { name: "three-cloud-neg" },
+    region: "us-central1",
+    networkEndpointType: "SERVERLESS",
+    cloudRun: { serviceRef: { name: web.name } },
+  } as never);
+  const backend = new BackendService({
+    metadata: { name: "three-cloud-backend" },
+    location: "global",
+    loadBalancingScheme: "EXTERNAL_MANAGED",
+    backend: [{ group: { networkEndpointGroupRef: { name: neg.name } } }],
+  } as never);
+  const urlMap = new URLMap({
+    metadata: { name: "three-cloud-urlmap" },
+    location: "global",
+    defaultService: { backendServiceRef: { name: backend.name } },
+  } as never);
+  const proxy = new TargetHTTPProxy({ metadata: { name: "three-cloud-proxy" }, location: "global", urlMapRef: { name: urlMap.name } } as never);
+  const address = new ComputeAddress({ metadata: { name: "three-cloud-ip" }, location: "global" } as never);
+  const rule = new ForwardingRule({
+    metadata: { name: "three-cloud-rule" },
+    location: "global",
+    loadBalancingScheme: "EXTERNAL_MANAGED",
+    portRange: "80",
+    target: { targetHTTPProxyRef: { name: proxy.name } },
+    ipAddress: { addressRef: { name: address.name } },
+  } as never);
+  const publicIam = new IAMPolicyMember({
+    metadata: { name: "three-cloud-site-public" },
+    member: "allUsers",
+    role: "roles/run.invoker",
+    resourceRef: { apiVersion: "run.cnrm.cloud.google.com/v1beta1", kind: "RunService", name: "three-cloud-site" },
+  } as never);
+  const all = { web, vpc, subnet, neg, backend, urlMap, proxy, address, rule, publicIam };
+  return new Map(
+    Object.entries(all).map(([logical, e]) => {
+      const entity = e as unknown as { entityType: string; props: Record<string, unknown> };
+      return [logical, { entityType: entity.entityType, props: entity.props }];
+    }),
+  );
+}
+
+describe("gcp live read resolves .name references as the build does (#4251)", () => {
+  beforeEach(() => {
+    fetchMock.mockReset();
+    vi.stubGlobal("fetch", fetchMock);
+    process.env.GCP_ENDPOINT_URL = "http://localhost:4588";
+    process.env.GOOGLE_CLOUD_PROJECT = "three-cloud";
+    fetchMock.mockImplementation(async (url: string) => {
+      if (url.includes(":getIamPolicy")) {
+        return reply(200, { etag: "e1", bindings: [{ role: "roles/run.invoker", members: ["allUsers"] }] });
+      }
+      return reply(200, { id: url, name: url.split("/").pop() });
+    });
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    delete process.env.GCP_ENDPOINT_URL;
+    delete process.env.GOOGLE_CLOUD_PROJECT;
+  });
+
+  test("every resource reads, by the names the build writes, and none fails on a reference", async () => {
+    const entities = estate();
+    const out = await describeResources({ environment: "local", buildOutput: "", entityNames: [...entities.keys()], entities });
+
+    expect(out.unobserved ?? {}).toEqual({});
+    for (const logical of entities.keys()) {
+      expect(out.resources[logical]?.physicalId, logical).toBeTruthy();
+    }
+    const urls = fetchMock.mock.calls.map((c) => String(c[0]));
+    for (const name of ["three-cloud-neg", "three-cloud-backend", "three-cloud-urlmap", "three-cloud-proxy", "three-cloud-rule", "three-cloud-subnet", "three-cloud-site"]) {
+      expect(urls.some((u) => u.includes(name)), name).toBe(true);
+    }
+    expect(urls.every((u) => !u.includes("[object"))).toBe(true);
+  });
+
+  test("the public IAMPolicyMember reads as the binding in the service's policy, with a physical id", async () => {
+    const entities = estate();
+    const out = await describeResources({ environment: "local", buildOutput: "", entityNames: [...entities.keys()], entities });
+    expect(out.resources.publicIam?.physicalId).toBe(
+      "projects/three-cloud/locations/us-central1/services/three-cloud-site#roles/run.invoker#allUsers",
+    );
+  });
+
+  test("a binding missing from the policy reads as absent, not observed", async () => {
+    fetchMock.mockImplementation(async (url: string) =>
+      url.includes(":getIamPolicy") ? reply(200, { etag: "e1", bindings: [] }) : reply(200, { id: url }),
+    );
+    const entities = estate();
+    const out = await describeResources({ environment: "local", buildOutput: "", entityNames: [...entities.keys()], entities });
+    expect(out.resources.publicIam).toBeUndefined();
+    expect(out.unobserved?.publicIam).toBeUndefined();
+  });
+});

package/src/serializer.ts

@@ -8,7 +8,8 @@
 import { createRequire } from "module";
 import { moduleSourceUrl } from "@intentius/chant/module-source";
 import type { Declarable } from "@intentius/chant/declarable";
-import { isPropertyDeclarable, isResourceDeclarable } from "@intentius/chant/declarable";
+import { isDeclarable, isPropertyDeclarable, isResourceDeclarable } from "@intentius/chant/declarable";
+import { AttrRef } from "@intentius/chant/attrref";
 import type { Serializer, SerializerResult, SerializeContext } from "@intentius/chant/serializer";
 import { ownershipEntries, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
 import type { LexiconOutput } from "@intentius/chant/lexicon-output";
@@ -113,11 +114,42 @@ function gcpVisitor(entityNames: Map<Declarable, string>): SerializerVisitor {
  * props, else its logical id in kebab case.
  */
 export function cnrmName(logical: string, entity: Declarable): string {
-  const props = isResourceDeclarable(entity) ? (entity.props as { metadata?: { name?: unknown } } | undefined) : undefined;
-  const declared = props?.metadata?.name;
+  return cnrmNameOf(logical, isResourceDeclarable(entity) ? entity.props : undefined);
+}
+
+/** {@link cnrmName} from a resource's props, for callers holding props rather than the declarable. */
+export function cnrmNameOf(logical: string, props: unknown): string {
+  const declared = (props as { metadata?: { name?: unknown } } | undefined)?.metadata?.name;
   return typeof declared === "string" && declared.length > 0 ? declared : kebabName(logical);
 }
 
+/**
+ * Declared props with each reference to another resource replaced as the
+ * serializer writes it (#4251): an attribute reference (`neg.name`) becomes the
+ * target's metadata.name, and a resource placed whole becomes `{ name }`.
+ * `logicalOf` maps a target's props object to its logical id, for a reference
+ * that does not carry one. Other values, pseudo-parameters included, are kept.
+ */
+export function resolveCnrmRefs(value: unknown, logicalOf: (props: unknown) => string | undefined): unknown {
+  if (value instanceof AttrRef) {
+    const parent = value.parent.deref() as Declarable | undefined;
+    const props = parent && isResourceDeclarable(parent) ? parent.props : undefined;
+    const logical = value.getLogicalName() ?? logicalOf(props);
+    return logical === undefined ? value : cnrmNameOf(logical, props);
+  }
+  if (Array.isArray(value)) return value.map((v) => resolveCnrmRefs(v, logicalOf));
+  if (value === null || typeof value !== "object") return value;
+  if (isDeclarable(value)) {
+    const props = isResourceDeclarable(value) ? value.props : undefined;
+    const logical = logicalOf(props);
+    return logical === undefined ? value : { name: cnrmNameOf(logical, props) };
+  }
+  if (INTRINSIC_MARKER in (value as object)) return value;
+  const out: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(value as Record<string, unknown>)) out[k] = resolveCnrmRefs(v, logicalOf);
+  return out;
+}
+
 function kebabName(logical: string): string {
   return logical.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
 }
@@ -163,7 +195,11 @@ export const gcpSerializer: Serializer = {
     let defaultLabelEntries: Record<string, unknown> = context?.ownership
       ? { ...ownershipEntries(LABEL_OWNERSHIP_KEYS, context.ownership) }
       : {};
-    let defaultAnnotationEntries: Record<string, unknown> = {};
+    // #4252: a member's project, once, in chant.config's `gcp.project`. It
+    // resolves GCP.ProjectId and is written as each resource's project-id
+    // annotation, which apply and the readers take ahead of the env vars.
+    const configProject = gcpConfigProject(context?.config);
+    let defaultAnnotationEntries: Record<string, unknown> = configProject ? { [PROJECT_ID_ANNOTATION]: configProject } : {};
 
     for (const [, entity] of entities) {
       if (isDefaultLabels(entity)) {
@@ -189,6 +225,7 @@ export const gcpSerializer: Serializer = {
         toYAMLValue(isResourceDeclarable(entity) ? entity.props : undefined, entityNames),
         name,
         unresolved,
+        configProject,
       ) as Record<string, unknown> | undefined;
 
       if (!props) continue;
@@ -246,6 +283,14 @@ export const gcpSerializer: Serializer = {
   },
 };
 
+const PROJECT_ID_ANNOTATION = "cnrm.cloud.google.com/project-id";
+
+/** The `gcp.project` a chant.config declares, if any (#4252). */
+export function gcpConfigProject(config: Record<string, unknown> | undefined): string | undefined {
+  const project = (config?.gcp as { project?: unknown } | undefined)?.project;
+  return typeof project === "string" && project.length > 0 ? project : undefined;
+}
+
 /**
  * Pseudo-parameter → environment variable mapping.
  * Config Connector annotations must be plain strings, so PseudoParameters
@@ -270,20 +315,20 @@ interface UnresolvedPseudo {
  * the API as an object. A variable that isn't set is recorded, and the
  * build refuses with every one named.
  */
-function resolvePseudoParameters(value: unknown, entity: string, unresolved: UnresolvedPseudo[]): unknown {
-  if (Array.isArray(value)) return value.map((v) => resolvePseudoParameters(v, entity, unresolved));
+function resolvePseudoParameters(value: unknown, entity: string, unresolved: UnresolvedPseudo[], project?: string): unknown {
+  if (Array.isArray(value)) return value.map((v) => resolvePseudoParameters(v, entity, unresolved, project));
   if (value === null || typeof value !== "object") return value;
   const obj = value as Record<string, unknown>;
   const keys = Object.keys(obj);
   if (keys.length === 1 && keys[0] === "Ref" && typeof obj.Ref === "string" && obj.Ref in PSEUDO_ENV_MAP) {
     const { envVar } = PSEUDO_ENV_MAP[obj.Ref];
-    const resolved = process.env[envVar];
+    const resolved = (obj.Ref === "GCP::ProjectId" ? project : undefined) ?? process.env[envVar];
     if (resolved) return resolved;
     unresolved.push({ entity, ref: obj.Ref, envVar });
     return value;
   }
   const out: Record<string, unknown> = {};
-  for (const [k, v] of Object.entries(obj)) out[k] = resolvePseudoParameters(v, entity, unresolved);
+  for (const [k, v] of Object.entries(obj)) out[k] = resolvePseudoParameters(v, entity, unresolved, project);
   return out;
 }