@intentius/chant-lexicon-gcp 0.124.36 → 0.124.38

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gcp",
-  "version": "0.124.36",
+  "version": "0.124.38",
   "description": "Google Cloud lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -76,6 +76,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.36"
+    "@intentius/chant": "^0.124.38"
   }
 }

package/src/api/read-client.ts

@@ -47,6 +47,12 @@ export interface GcpReadClientOptions {
   project: string;
   /** Injectable HTTP, so tests never touch the network. */
   http?: GcpReadHttp;
+  /**
+   * The declared resources, refs resolved, as apply passes them (#4251): an
+   * IAMPolicyMember on a RunService named by `name` takes the service's region
+   * from its declaration, which a read otherwise can't know.
+   */
+  manifest?: readonly GcpResource[];
 }
 
 /** Injectable HTTP client — mirrors the applier's `GcpHttp`. A body is sent only for a POST read (`:getIamPolicy`). */
@@ -108,7 +114,7 @@ export async function getResource(
     spec: (declared?.spec as Record<string, unknown> | undefined) ?? declared ?? {},
   };
 
-  const ctx = { base, project: client.project };
+  const ctx = { base, project: client.project, ...(client.manifest ? { manifest: client.manifest } : {}) };
   if (mapper.accepts && !mapper.accepts(resource, ctx)) {
     throw new GcpReadError(`no REST read for ${kind}/${name}: its target has no endpoint chant can read`);
   }

package/src/deep-observe.ts

@@ -61,7 +61,7 @@ import type {
 } from "@intentius/chant/lexicon";
 import { deepObservation, normalizeDeepProperties } from "@intentius/chant/deep-observation";
 import { hasOwnershipMarker, type ChannelKeys } from "@intentius/chant/ownership";
-import { deriveGVK, manifestProjectAnnotations, resolveReadProject } from "./describe-resources";
+import { deriveGVK, manifestProjectAnnotations, readManifest, readTargets, resolveReadProject } from "./describe-resources";
 import { getResource, mapperForKind, GcpReadError, isNotFound, type GcpReadClientOptions } from "./api/read-client";
 import { gcpDeepNormalizationHooks } from "./deep-observe-hooks";
 
@@ -387,8 +387,10 @@ export async function observeResourcesDeepGcp(options: GcpDeepObserveOptions): P
 
   const endpoint = process.env.GCP_ENDPOINT_URL;
   const manifestProjects = manifestProjectAnnotations(options.buildOutput);
+  const targets = readTargets(options.entities);
+  const manifest = readManifest(options.entities, targets);
 
-  const reads = [...options.entities].map(async ([entityName, { entityType, props }]) => {
+  const reads = [...options.entities].map(async ([entityName, { entityType }]) => {
     const gvk = deriveGVK(entityType);
     if (!gvk || !mapperForKind(gvk.kind)) {
       unobserved[entityName] = {
@@ -401,22 +403,15 @@ export async function observeResourcesDeepGcp(options: GcpDeepObserveOptions): P
       return;
     }
 
-    const metadata = props.metadata as { name?: string; annotations?: Record<string, string> } | undefined;
-    const name = metadata?.name;
-    if (!name) {
-      unobserved[entityName] = {
-        type: entityType,
-        reason: "read-failed",
-        detail: "declared entity has no metadata.name to query by",
-      };
-      return;
-    }
+    const { name, props } = targets.get(entityName)!;
+    const metadata = props.metadata as { annotations?: Record<string, string> } | undefined;
 
     let client: GcpReadClientOptions;
     try {
       client = {
         project: resolveReadProject(gvk.kind, name, metadata, manifestProjects, props),
         ...(endpoint ? { endpoint } : {}),
+        manifest,
       };
     } catch (err) {
       unobserved[entityName] = {

package/src/describe-resources.test.ts

@@ -86,10 +86,11 @@ describe("gcp describeResources — direct REST (#1209)", () => {
     expect(fetchMock).not.toHaveBeenCalled();
   });
 
-  test("an entity with no metadata.name has nothing to query by", async () => {
-    const out = await read(makeEntities([{ name: "e", entityType: "GCP::Storage::Bucket", props: {} }]));
-    expect(out.unobserved?.e?.reason).toBe("read-failed");
-    expect(fetchMock).not.toHaveBeenCalled();
+  test("an entity with no metadata.name is read by the name the build gives it, the kebab-cased logical id (#4251)", async () => {
+    fetchMock.mockResolvedValue(reply(200, { name: "web-assets" }));
+    const out = await read(makeEntities([{ name: "webAssets", entityType: "GCP::Storage::Bucket", props: {} }]));
+    expect(out.resources.webAssets).toBeDefined();
+    expect(String(fetchMock.mock.calls[0][0])).toContain("/b/web-assets");
   });
 
   test("kinds resolve through the serializer's GVK map, not naive recasing", async () => {

package/src/describe-resources.ts

@@ -40,8 +40,8 @@ import type { ObservationResult, ResourceMetadata, UnobservedEntity } from "@int
 import { observation } from "@intentius/chant/observation";
 import { hasOwnershipMarker, classifyOwnership, readOwnership, type ChannelKeys } from "@intentius/chant/ownership";
 import { getResource, mapperForKind, GcpReadError, isNotFound, type GcpReadClientOptions } from "./api/read-client";
-import { resolveGcpProject, parseManifest, projectRefProject } from "./op/activities/gcp-apply";
-import { resolveGVK } from "./serializer";
+import { NO_PROJECT, parseManifest, projectRefProject, type GcpResource } from "./op/activities/gcp-apply";
+import { cnrmNameOf, resolveCnrmRefs, resolveGVK } from "./serializer";
 
 /**
  * chant's ownership marker as GCP labels.
@@ -119,11 +119,12 @@ export function manifestProjectAnnotations(buildOutput: string | undefined): Map
 }
 
 /**
- * The project a read should target: the entity's `projectRef.external`,
- * `GOOGLE_CLOUD_PROJECT`, the entity's own annotation (via
- * `resolveGcpProject`, the applier's rule), then the built
- * manifest's merged annotation. Throws the applier's own error when nothing
- * resolves, so the `no-binding` detail names both knobs.
+ * The project a read should target, in apply's order (#4252): the entity's
+ * own literal `projectRef.external`, then the built manifest's project for it
+ * (its resolved projectRef, or the project-id annotation chant.config's
+ * `gcp.project` writes), then the entity's own annotation, then
+ * `GCP_PROJECT_ID`, then `GOOGLE_CLOUD_PROJECT`. Throws apply's own error when
+ * nothing resolves, so the `no-binding` detail names every knob.
  */
 export function resolveReadProject(
   kind: string,
@@ -131,14 +132,59 @@ export function resolveReadProject(
   metadata: { annotations?: Record<string, string> } | undefined,
   manifestProjects: Map<string, string>,
   props?: Record<string, unknown>,
+  env: NodeJS.ProcessEnv = process.env,
 ): string {
-  try {
-    return resolveGcpProject({ kind, metadata, ...(props ? { spec: props } : {}) });
-  } catch (err) {
-    const fromManifest = manifestProjects.get(`${kind}/${name}`);
-    if (fromManifest) return fromManifest;
-    throw err;
+  const project =
+    projectRefProject(props, {}) ||
+    manifestProjects.get(`${kind}/${name}`) ||
+    metadata?.annotations?.["cnrm.cloud.google.com/project-id"] ||
+    projectRefProject(props, env) ||
+    env.GCP_PROJECT_ID ||
+    env.GOOGLE_CLOUD_PROJECT;
+  if (!project) throw new Error(NO_PROJECT);
+  return project;
+}
+
+/**
+ * Each declared entity as a read sees it (#4251): the name the build writes
+ * (`metadata.name`, else the kebab-cased logical id) and its props with every
+ * reference to another resource resolved as the serializer resolves it, so a
+ * mapper building a read URL never meets an attribute reference.
+ */
+export function readTargets(
+  entities: Map<string, { entityType: string; props: Record<string, unknown> }>,
+): Map<string, { name: string; props: Record<string, unknown> }> {
+  const logicalByProps = new Map<unknown, string>();
+  for (const [logical, { props }] of entities) logicalByProps.set(props, logical);
+  const logicalOf = (props: unknown) => logicalByProps.get(props);
+  const out = new Map<string, { name: string; props: Record<string, unknown> }>();
+  for (const [logical, { props }] of entities) {
+    out.set(logical, {
+      name: cnrmNameOf(logical, props),
+      props: resolveCnrmRefs(props, logicalOf) as Record<string, unknown>,
+    });
+  }
+  return out;
+}
+
+/**
+ * The declared resources as the applier's manifest holds them (kind, CNRM
+ * name, spec), for a read that needs another declared resource: an
+ * IAMPolicyMember on a RunService takes the service's region from it (#4251).
+ */
+export function readManifest(
+  entities: Map<string, { entityType: string; props: Record<string, unknown> }>,
+  targets: Map<string, { name: string; props: Record<string, unknown> }>,
+): GcpResource[] {
+  const out: GcpResource[] = [];
+  for (const [logical, { entityType }] of entities) {
+    const gvk = deriveGVK(entityType);
+    const target = targets.get(logical);
+    if (!gvk || !target) continue;
+    const spec = (target.props.spec as Record<string, unknown> | undefined) ?? target.props;
+    out.push({ kind: gvk.kind, metadata: { name: target.name }, spec });
   }
+  return out;
 }
 
 function pruneUndefined<T extends Record<string, unknown>>(obj: T): Record<string, unknown> {
@@ -196,8 +242,10 @@ export async function describeResources(options: {
   let warnedOwnership = false;
 
   const manifestProjects = manifestProjectAnnotations(options.buildOutput);
+  const targets = readTargets(options.entities);
+  const manifest = readManifest(options.entities, targets);
 
-  const reads = [...options.entities].map(async ([entityName, { entityType, props }]) => {
+  const reads = [...options.entities].map(async ([entityName, { entityType }]) => {
     const gvk = deriveGVK(entityType);
     if (!gvk) {
       unobserved[entityName] = {
@@ -218,22 +266,15 @@ export async function describeResources(options: {
       return;
     }
 
-    const metadata = props.metadata as { name?: string; annotations?: Record<string, string> } | undefined;
-    const name = metadata?.name;
-    if (!name) {
-      unobserved[entityName] = {
-        type: entityType,
-        reason: "read-failed",
-        detail: "declared entity has no metadata.name to query by",
-      };
-      return;
-    }
+    const { name, props } = targets.get(entityName)!;
+    const metadata = props.metadata as { annotations?: Record<string, string> } | undefined;
 
     let client: GcpReadClientOptions;
     try {
       client = {
         project: resolveReadProject(gvk.kind, name, metadata, manifestProjects, props),
         ...(endpoint ? { endpoint } : {}),
+        manifest,
       };
     } catch (err) {
       // No project resolvable — nothing was queried, so nothing is known.

package/src/health.ts

@@ -11,7 +11,7 @@
 
 import type { HealthEntry, HealthReadOptions, HealthReadResult, UnobservedEntity } from "@intentius/chant/lexicon";
 import { getResource, GcpReadError, isNotFound, type GcpReadHttp } from "./api/read-client";
-import { deriveGVK, manifestProjectAnnotations, resolveReadProject } from "./describe-resources";
+import { deriveGVK, manifestProjectAnnotations, readTargets, resolveReadProject } from "./describe-resources";
 
 export const GCP_HEALTH_TYPES = ["GCP::Run::Service"] as const;
 
@@ -75,18 +75,15 @@ export async function observeHealthGcp(options: GcpHealthOptions): Promise<Healt
   const entities: Record<string, HealthEntry> = {};
   const unobserved: Record<string, UnobservedEntity> = {};
   const absent: string[] = [];
+  const targets = readTargets(options.entities);
 
   await Promise.all(
-    [...options.entities].map(async ([entityName, { entityType, props }]) => {
+    [...options.entities].map(async ([entityName, { entityType }]) => {
       const gvk = deriveGVK(entityType);
-      const metadata = props.metadata as { name?: string; annotations?: Record<string, string> } | undefined;
-      const name = metadata?.name;
-      if (!gvk || !name) {
-        unobserved[entityName] = {
-          type: entityType,
-          reason: "read-failed",
-          detail: gvk ? "declared entity has no metadata.name to query by" : `cannot derive a GCP kind from ${entityType}`,
-        };
+      const { name, props } = targets.get(entityName)!;
+      const metadata = props.metadata as { annotations?: Record<string, string> } | undefined;
+      if (!gvk) {
+        unobserved[entityName] = { type: entityType, reason: "read-failed", detail: `cannot derive a GCP kind from ${entityType}` };
         return;
       }
       let project: string;

package/src/op/activities/gcp-apply.test.ts

@@ -296,9 +296,16 @@ describe("Cloud Run mapper + LRO (#706)", () => {
 });
 
 describe("resolveGcpProject (#711)", () => {
-  test("env wins over the annotation", () => {
-    expect(resolveGcpProject(BUCKET, { GOOGLE_CLOUD_PROJECT: "env-project" } as NodeJS.ProcessEnv))
-      .toBe("env-project");
+  test("the annotation (where chant.config's gcp.project lands) wins over the env vars (#4252)", () => {
+    expect(resolveGcpProject(BUCKET, { GOOGLE_CLOUD_PROJECT: "env-project", GCP_PROJECT_ID: "id-project" } as NodeJS.ProcessEnv))
+      .toBe("annotated-project");
+  });
+
+  test("without an annotation, GCP_PROJECT_ID wins over GOOGLE_CLOUD_PROJECT, and projectRef over both (#4252)", () => {
+    const bare = { metadata: { name: "b" } };
+    expect(resolveGcpProject(bare, { GOOGLE_CLOUD_PROJECT: "g", GCP_PROJECT_ID: "p" } as NodeJS.ProcessEnv)).toBe("p");
+    expect(resolveGcpProject(bare, { GOOGLE_CLOUD_PROJECT: "g" } as NodeJS.ProcessEnv)).toBe("g");
+    expect(resolveGcpProject({ ...bare, spec: { projectRef: { external: "own" } } }, { GCP_PROJECT_ID: "p" } as NodeJS.ProcessEnv)).toBe("own");
   });
 
   test("falls back to the CNRM annotation", () => {

package/src/op/activities/gcp-apply.ts

@@ -568,7 +568,6 @@ export function resolveGcpEndpoint(
   return args.endpoint || env.GCP_ENDPOINT_URL || undefined;
 }
 
-/** Resolve the project: `GOOGLE_CLOUD_PROJECT` env, else the CNRM project-id annotation. Pure. */
 /**
  * The project a resource names in `spec.projectRef.external` (#4201): a
  * project id or `projects/<id>`. A `GCP.ProjectId` pseudo-parameter there
@@ -589,19 +588,25 @@ export function projectRefProject(spec: Record<string, unknown> | undefined, env
   return external.startsWith("projects/") ? external.slice("projects/".length).split("/")[0] : external;
 }
 
+/**
+ * The project a resource is applied in (#4252): its own `spec.projectRef.external`,
+ * else its project-id annotation (where chant.config's `gcp.project` is
+ * written at build), else `GCP_PROJECT_ID`, else `GOOGLE_CLOUD_PROJECT`. Pure.
+ */
 export function resolveGcpProject(resource: GcpResource, env: NodeJS.ProcessEnv = process.env): string {
   const project =
     projectRefProject(resource.spec, env) ||
-    env.GOOGLE_CLOUD_PROJECT ||
-    resource.metadata?.annotations?.[PROJECT_ID_ANNOTATION];
-  if (!project) {
-    throw new Error(
-      `no GCP project — set spec.projectRef.external, GOOGLE_CLOUD_PROJECT or the ${PROJECT_ID_ANNOTATION} annotation`,
-    );
-  }
+    resource.metadata?.annotations?.[PROJECT_ID_ANNOTATION] ||
+    env.GCP_PROJECT_ID ||
+    env.GOOGLE_CLOUD_PROJECT;
+  if (!project) throw new Error(NO_PROJECT);
   return project;
 }
 
+/** The error every stage gives when no project resolves. */
+export const NO_PROJECT =
+  `no GCP project — set gcp.project in chant.config, GCP_PROJECT_ID or GOOGLE_CLOUD_PROJECT, or the resource's spec.projectRef.external`;
+
 /** Injectable HTTP client — mirrors argo's injectable fetcher so tests avoid the network. */
 export type GcpHttp = (
   method: string,

package/src/op/activities/gcp-iam.ts

@@ -271,6 +271,8 @@ export const iamPolicyMemberMapper: ResourceMapper = {
         status: 200,
         // `resourceRef` is the declared one: the policy read is that target's, so the binding is on it.
         text: JSON.stringify({
+          // The binding has no id of its own; this one names it, so a read reports a physical id (#4251).
+          selfLink: `${target.path}#${spec.role}#${spec.member}`,
           member: spec.member,
           role: spec.role,
           resource: target.path,

package/src/project-config.test.ts

@@ -0,0 +1,166 @@
+import { describe, test, expect, beforeEach, afterEach, vi } from "vitest";
+import { mkdir, writeFile, rm, realpath } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import type { Declarable } from "@intentius/chant/declarable";
+import { loadChantConfig } from "@intentius/chant/config";
+import { armSandboxConfigEvaluation, resetSandboxConfigEvaluationForTests } from "@intentius/chant/config-sandbox";
+import { gcpSerializer } from "./serializer";
+import { describeResources, manifestProjectAnnotations, resolveReadProject } from "./describe-resources";
+import { parseManifest, resolveGcpProject } from "./op/activities/gcp-apply";
+import { CloudRunService, PubSubTopic, StorageBucket } from "./generated";
+import { defaultAnnotations } from "./default-labels";
+import { GCP } from "./pseudo";
+
+/** #4252: one GCP project for build, apply and read, set once in chant.config. */
+
+const ANNOTATION = "cnrm.cloud.google.com/project-id";
+
+function build(entities: Record<string, unknown>, config?: Record<string, unknown>): string {
+  const out = gcpSerializer.serialize(new Map(Object.entries(entities)) as Map<string, Declarable>, undefined, config ? { config } : undefined);
+  return typeof out === "string" ? out : out.primary;
+}
+
+describe("gcp.project in chant.config (#4252)", () => {
+  let saved: NodeJS.ProcessEnv;
+  beforeEach(() => {
+    saved = { ...process.env };
+    process.env.GCP_PROJECT_ID = "env-id";
+    process.env.GOOGLE_CLOUD_PROJECT = "env-google";
+  });
+  afterEach(() => {
+    process.env = saved;
+  });
+
+  test("the build writes it as each resource's project-id annotation and resolves GCP.ProjectId from it", () => {
+    const yaml = build(
+      {
+        assets: new StorageBucket({ metadata: { name: "assets" }, location: "US" } as never),
+        web: new CloudRunService({ metadata: { name: "web" }, location: "us-central1", projectRef: { external: GCP.ProjectId } } as never),
+      },
+      { gcp: { project: "cfg-project" } },
+    );
+    const docs = parseManifest(yaml, "test");
+    expect(docs.find((d) => d.metadata?.name === "assets")?.metadata?.annotations?.[ANNOTATION]).toBe("cfg-project");
+    expect((docs.find((d) => d.metadata?.name === "web")?.spec as { projectRef: unknown }).projectRef).toEqual({ external: "cfg-project" });
+  });
+
+  test("without it the build writes no annotation, as before", () => {
+    const yaml = build({ assets: new StorageBucket({ metadata: { name: "assets" }, location: "US" } as never) });
+    expect(parseManifest(yaml, "test")[0].metadata?.annotations?.[ANNOTATION]).toBeUndefined();
+  });
+
+  test("a defaultAnnotations project wins over the config's", () => {
+    const yaml = build(
+      {
+        assets: new StorageBucket({ metadata: { name: "assets" }, location: "US" } as never),
+        annotations: defaultAnnotations({ [ANNOTATION]: "declared-project" }),
+      },
+      { gcp: { project: "cfg-project" } },
+    );
+    expect(parseManifest(yaml, "test")[0].metadata?.annotations?.[ANNOTATION]).toBe("declared-project");
+  });
+
+  test("apply and read both take it ahead of GCP_PROJECT_ID and GOOGLE_CLOUD_PROJECT, and a projectRef ahead of it", () => {
+    const yaml = build(
+      {
+        assets: new StorageBucket({ metadata: { name: "assets" }, location: "US" } as never),
+        other: new StorageBucket({ metadata: { name: "other" }, location: "US", projectRef: { external: "own-project" } } as never),
+      },
+      { gcp: { project: "cfg-project" } },
+    );
+    const docs = parseManifest(yaml, "test");
+    expect(resolveGcpProject(docs.find((d) => d.metadata?.name === "assets")!)).toBe("cfg-project");
+    expect(resolveGcpProject(docs.find((d) => d.metadata?.name === "other")!)).toBe("own-project");
+
+    const manifest = manifestProjectAnnotations(yaml);
+    expect(resolveReadProject("StorageBucket", "assets", undefined, manifest, { metadata: { name: "assets" } })).toBe("cfg-project");
+    expect(resolveReadProject("StorageBucket", "other", undefined, manifest, { projectRef: { external: "own-project" } })).toBe("own-project");
+  });
+
+  test("with nothing declared, read falls back to GCP_PROJECT_ID, then GOOGLE_CLOUD_PROJECT", () => {
+    const none = new Map<string, string>();
+    expect(resolveReadProject("StorageBucket", "b", undefined, none, {})).toBe("env-id");
+    delete process.env.GCP_PROJECT_ID;
+    expect(resolveReadProject("StorageBucket", "b", undefined, none, {})).toBe("env-google");
+    delete process.env.GOOGLE_CLOUD_PROJECT;
+    expect(() => resolveReadProject("StorageBucket", "b", undefined, none, {})).toThrow(/gcp\.project in chant\.config/);
+  });
+});
+
+describe("gcp.project under --sandbox (#4252)", () => {
+  let dir: string;
+  beforeEach(async () => {
+    const d = join(tmpdir(), `chant-4252-${Date.now()}-${Math.random()}`);
+    await mkdir(d, { recursive: true });
+    dir = await realpath(d);
+    resetSandboxConfigEvaluationForTests();
+  });
+  afterEach(async () => {
+    resetSandboxConfigEvaluationForTests();
+    await rm(dir, { recursive: true, force: true });
+  });
+
+  test("the config crosses from the sandboxed child as data, and the build reads it from there, not from process.env", async () => {
+    await writeFile(join(dir, "chant.config.ts"), `export default { lexicons: ["gcp"], gcp: { project: "sandboxed-project" } };\n`);
+    armSandboxConfigEvaluation();
+    const { config } = await loadChantConfig(dir);
+    expect((config as { gcp?: { project?: string } }).gcp?.project).toBe("sandboxed-project");
+
+    const saved = process.env.GCP_PROJECT_ID;
+    delete process.env.GCP_PROJECT_ID;
+    try {
+      const yaml = build({ assets: new StorageBucket({ metadata: { name: "assets" }, location: "US" } as never) }, config as Record<string, unknown>);
+      expect(parseManifest(yaml, "test")[0].metadata?.annotations?.[ANNOTATION]).toBe("sandboxed-project");
+    } finally {
+      if (saved !== undefined) process.env.GCP_PROJECT_ID = saved;
+    }
+  });
+});
+
+describe("the live read takes gcp.project with no project env var (#4252)", () => {
+  let saved: NodeJS.ProcessEnv;
+  const fetchMock = vi.fn();
+  beforeEach(() => {
+    saved = { ...process.env };
+    delete process.env.GCP_PROJECT_ID;
+    delete process.env.GOOGLE_CLOUD_PROJECT;
+    delete process.env.GCP_ENDPOINT_URL;
+    fetchMock.mockReset();
+    fetchMock.mockImplementation(async (url: string) => new Response(JSON.stringify({ name: "projects/p/topics/assets" }), { status: 200 }));
+    vi.stubGlobal("fetch", fetchMock);
+  });
+  afterEach(() => {
+    process.env = saved;
+    vi.unstubAllGlobals();
+  });
+
+  async function read(config: Record<string, unknown> | undefined, props: Record<string, unknown>) {
+    const yaml = build({ assets: new PubSubTopic(props as never) }, config);
+    return describeResources({
+      environment: "local",
+      buildOutput: yaml,
+      entityNames: ["assets"],
+      entities: new Map([["assets", { entityType: "GCP::Pubsub::Topic", props }]]),
+    });
+  }
+
+  test("only gcp.project in config: the read targets that project", async () => {
+    const result = await read({ gcp: { project: "three-cloud" } }, { metadata: { name: "assets" } });
+    expect(result.unobserved?.assets).toBeUndefined();
+    expect(result.resources.assets).toBeDefined();
+    expect(String(fetchMock.mock.calls[0]?.[0])).toContain("three-cloud");
+  });
+
+  test("only a project-id annotation on the resource: the read targets that project", async () => {
+    const result = await read(undefined, { metadata: { name: "assets", annotations: { [ANNOTATION]: "annotated" } } });
+    expect(result.unobserved?.assets).toBeUndefined();
+    expect(String(fetchMock.mock.calls[0]?.[0])).toContain("annotated");
+  });
+
+  test("neither: no-binding, naming every place a project can come from", async () => {
+    const result = await read(undefined, { metadata: { name: "assets" } });
+    expect(result.unobserved?.assets?.reason).toBe("no-binding");
+    expect(result.unobserved?.assets?.detail).toMatch(/gcp\.project in chant\.config/);
+  });
+});