@intentius/chant-lexicon-gcp 0.124.37 → 0.124.38

package/dist/api/read-client.d.ts

@@ -37,7 +37,7 @@
  * quietly implying it is not there. Widening the table is #1209's stated
  * non-goal and belongs with the applier.
  */
-import { type ResourceMapper } from "../op/activities/gcp-apply.js";
+import { type GcpResource, type ResourceMapper } from "../op/activities/gcp-apply.js";
 /** Where to read, and as whom. */
 export interface GcpReadClientOptions {
     /** Endpoint override for every kind (floci-gcp `http://localhost:4588`). Omit for real GCP. */
@@ -46,6 +46,12 @@ export interface GcpReadClientOptions {
     project: string;
     /** Injectable HTTP, so tests never touch the network. */
     http?: GcpReadHttp;
+    /**
+     * The declared resources, refs resolved, as apply passes them (#4251): an
+     * IAMPolicyMember on a RunService named by `name` takes the service's region
+     * from its declaration, which a read otherwise can't know.
+     */
+    manifest?: readonly GcpResource[];
 }
 /** Injectable HTTP client — mirrors the applier's `GcpHttp`. A body is sent only for a POST read (`:getIamPolicy`). */
 export type GcpReadHttp = (method: string, url: string, body?: unknown) => Promise<{

package/dist/api/read-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read-client.d.ts","sourceRoot":"","sources":["../../src/api/read-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5F,kCAAkC;AAClC,MAAM,WAAW,oBAAoB;IACnC,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED,uHAAuH;AACvH,MAAM,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAUrH;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;IAF1B,YACE,OAAO,EAAE,MAAM,EACN,MAAM,CAAC,EAAE,MAAM,YAAA,EAIzB;CACF;AAED,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEhD;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAEtE;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAiDlC"}
+{"version":3,"file":"read-client.d.ts","sourceRoot":"","sources":["../../src/api/read-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAW,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5F,kCAAkC;AAClC,MAAM,WAAW,oBAAoB;IACnC,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CACnC;AAED,uHAAuH;AACvH,MAAM,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAUrH;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;IAF1B,YACE,OAAO,EAAE,MAAM,EACN,MAAM,CAAC,EAAE,MAAM,YAAA,EAIzB;CACF;AAED,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEhD;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAEtE;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAiDlC"}

package/dist/api/read-client.js

@@ -82,7 +82,7 @@ export async function getResource(client, kind, name, declared) {
         metadata: { name },
         spec: declared?.spec ?? declared ?? {},
     };
-    const ctx = { base, project: client.project };
+    const ctx = { base, project: client.project, ...(client.manifest ? { manifest: client.manifest } : {}) };
     if (mapper.accepts && !mapper.accepts(resource, ctx)) {
         throw new GcpReadError(`no REST read for ${kind}/${name}: its target has no endpoint chant can read`);
     }

package/dist/deep-observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAajE,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAErC,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWtF;AAUD;6EAC6E;AAC7E,UAAU,aAAa;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA0OD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASnH;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAuF5G"}
+{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAajE,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAErC,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWtF;AAUD;6EAC6E;AAC7E,UAAU,aAAa;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA0OD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASnH;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAyF5G"}

package/dist/deep-observe.js

@@ -55,7 +55,7 @@
  */
 import { deepObservation, normalizeDeepProperties } from "@intentius/chant/deep-observation";
 import { hasOwnershipMarker } from "@intentius/chant/ownership";
-import { deriveGVK, manifestProjectAnnotations, readTargets, resolveReadProject } from "./describe-resources.js";
+import { deriveGVK, manifestProjectAnnotations, readManifest, readTargets, resolveReadProject } from "./describe-resources.js";
 import { getResource, mapperForKind, GcpReadError, isNotFound } from "./api/read-client.js";
 import { gcpDeepNormalizationHooks } from "./deep-observe-hooks.js";
 /** The labels the applier stamps — see describe-resources.ts. */
@@ -365,6 +365,7 @@ export async function observeResourcesDeepGcp(options) {
     const endpoint = process.env.GCP_ENDPOINT_URL;
     const manifestProjects = manifestProjectAnnotations(options.buildOutput);
     const targets = readTargets(options.entities);
+    const manifest = readManifest(options.entities, targets);
     const reads = [...options.entities].map(async ([entityName, { entityType }]) => {
         const gvk = deriveGVK(entityType);
         if (!gvk || !mapperForKind(gvk.kind)) {
@@ -384,6 +385,7 @@ export async function observeResourcesDeepGcp(options) {
             client = {
                 project: resolveReadProject(gvk.kind, name, metadata, manifestProjects, props),
                 ...(endpoint ? { endpoint } : {}),
+                manifest,
             };
         }
         catch (err) {

package/dist/describe-resources.d.ts

@@ -36,6 +36,7 @@
  * dropped.
  */
 import type { ObservationResult } from "@intentius/chant/lexicon";
+import { type GcpResource } from "./op/activities/gcp-apply.js";
 /** The parts of a GCP REST payload this reader looks at. Every field is
  * optional because they vary by kind — a bucket has `id` and `labels`, a
  * Pub/Sub topic has neither. */
@@ -105,6 +106,18 @@ export declare function readTargets(entities: Map<string, {
     name: string;
     props: Record<string, unknown>;
 }>;
+/**
+ * The declared resources as the applier's manifest holds them (kind, CNRM
+ * name, spec), for a read that needs another declared resource: an
+ * IAMPolicyMember on a RunService takes the service's region from it (#4251).
+ */
+export declare function readManifest(entities: Map<string, {
+    entityType: string;
+    props: Record<string, unknown>;
+}>, targets: Map<string, {
+    name: string;
+    props: Record<string, unknown>;
+}>): GcpResource[];
 /**
  * Status from a REST payload.
  *

package/dist/describe-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAsC,MAAM,0BAA0B,CAAC;AAsBtG;;gCAEgC;AAChC,UAAU,eAAe;IACvB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACxF,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACtB,CAAC;CACH;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAIpF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAgB/F;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,SAAS,EAC9D,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAUR;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,GAC5E,GAAG,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAY/D;AAUD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAY3D;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAiH7B"}
+{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAsC,MAAM,0BAA0B,CAAC;AAItG,OAAO,EAAgD,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAkB3G;;gCAEgC;AAChC,UAAU,eAAe;IACvB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACxF,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACtB,CAAC;CACH;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAIpF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAgB/F;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,SAAS,EAC9D,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAUR;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,GAC5E,GAAG,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAY/D;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAC7E,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,GACrE,WAAW,EAAE,CAUf;AAUD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAY3D;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAmH7B"}

package/dist/describe-resources.js

@@ -137,6 +137,23 @@ export function readTargets(entities) {
     }
     return out;
 }
+/**
+ * The declared resources as the applier's manifest holds them (kind, CNRM
+ * name, spec), for a read that needs another declared resource: an
+ * IAMPolicyMember on a RunService takes the service's region from it (#4251).
+ */
+export function readManifest(entities, targets) {
+    const out = [];
+    for (const [logical, { entityType }] of entities) {
+        const gvk = deriveGVK(entityType);
+        const target = targets.get(logical);
+        if (!gvk || !target)
+            continue;
+        const spec = target.props.spec ?? target.props;
+        out.push({ kind: gvk.kind, metadata: { name: target.name }, spec });
+    }
+    return out;
+}
 function pruneUndefined(obj) {
     const out = {};
     for (const [k, v] of Object.entries(obj)) {
@@ -185,6 +202,7 @@ export async function describeResources(options) {
     let warnedOwnership = false;
     const manifestProjects = manifestProjectAnnotations(options.buildOutput);
     const targets = readTargets(options.entities);
+    const manifest = readManifest(options.entities, targets);
     const reads = [...options.entities].map(async ([entityName, { entityType }]) => {
         const gvk = deriveGVK(entityType);
         if (!gvk) {
@@ -212,6 +230,7 @@ export async function describeResources(options) {
             client = {
                 project: resolveReadProject(gvk.kind, name, metadata, manifestProjects, props),
                 ...(endpoint ? { endpoint } : {}),
+                manifest,
             };
         }
         catch (err) {

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "648e7fb96c2a44b72459dc70e777c22836de776eb5f5b8017f8c6057135062a3",
+    "manifest.json": "abad2dc852fe087b6167993403f8fe827512b85c33a02d66b35dab64b4b0b5f3",
     "meta.json": "75643660010c044c6f465bef2688a864ab30cc96fd9b68111969749748ac64ca",
     "types/index.d.ts": "da1ebc6bcf83e1a018a773b59714194aeeb74ae1d5c1252b737b7e730ca98bd5",
     "rules/hardcoded-project.ts": "6d5ae9efa74d73800eebe1a0a0d43c619ee0fdebe3347195df93fcbe63b34f0d",
@@ -40,5 +40,5 @@
     "skills/chant-gcp-patterns.md": "4c6809fc7c37fa1879379ad4c0e2d114dec9497bc6eb9d1bca4e79fddea4f509",
     "skills/chant-gcp-gke.md": "be277019da9a722c851e47cd2dfb9c9536668948c3535fb20db7697e934c4e2b"
   },
-  "composite": "12781f2fbe08546cbfed0496ef97a0cfc6f301c5576bfafad2cbd4bf3cac39f3"
+  "composite": "2417c2778b2c78b3a629c866e8b25766423b79094722bdec3ef566b47a151c31"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gcp",
-  "version": "0.124.37",
+  "version": "0.124.38",
   "chantVersion": ">=0.1.0",
   "namespace": "GCP",
   "intrinsics": [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gcp",
-  "version": "0.124.37",
+  "version": "0.124.38",
   "description": "Google Cloud lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -76,6 +76,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.37"
+    "@intentius/chant": "^0.124.38"
   }
 }

package/src/api/read-client.ts

@@ -47,6 +47,12 @@ export interface GcpReadClientOptions {
   project: string;
   /** Injectable HTTP, so tests never touch the network. */
   http?: GcpReadHttp;
+  /**
+   * The declared resources, refs resolved, as apply passes them (#4251): an
+   * IAMPolicyMember on a RunService named by `name` takes the service's region
+   * from its declaration, which a read otherwise can't know.
+   */
+  manifest?: readonly GcpResource[];
 }
 
 /** Injectable HTTP client — mirrors the applier's `GcpHttp`. A body is sent only for a POST read (`:getIamPolicy`). */
@@ -108,7 +114,7 @@ export async function getResource(
     spec: (declared?.spec as Record<string, unknown> | undefined) ?? declared ?? {},
   };
 
-  const ctx = { base, project: client.project };
+  const ctx = { base, project: client.project, ...(client.manifest ? { manifest: client.manifest } : {}) };
   if (mapper.accepts && !mapper.accepts(resource, ctx)) {
     throw new GcpReadError(`no REST read for ${kind}/${name}: its target has no endpoint chant can read`);
   }

package/src/deep-observe.ts

@@ -61,7 +61,7 @@ import type {
 } from "@intentius/chant/lexicon";
 import { deepObservation, normalizeDeepProperties } from "@intentius/chant/deep-observation";
 import { hasOwnershipMarker, type ChannelKeys } from "@intentius/chant/ownership";
-import { deriveGVK, manifestProjectAnnotations, readTargets, resolveReadProject } from "./describe-resources";
+import { deriveGVK, manifestProjectAnnotations, readManifest, readTargets, resolveReadProject } from "./describe-resources";
 import { getResource, mapperForKind, GcpReadError, isNotFound, type GcpReadClientOptions } from "./api/read-client";
 import { gcpDeepNormalizationHooks } from "./deep-observe-hooks";
 
@@ -388,6 +388,7 @@ export async function observeResourcesDeepGcp(options: GcpDeepObserveOptions): P
   const endpoint = process.env.GCP_ENDPOINT_URL;
   const manifestProjects = manifestProjectAnnotations(options.buildOutput);
   const targets = readTargets(options.entities);
+  const manifest = readManifest(options.entities, targets);
 
   const reads = [...options.entities].map(async ([entityName, { entityType }]) => {
     const gvk = deriveGVK(entityType);
@@ -410,6 +411,7 @@ export async function observeResourcesDeepGcp(options: GcpDeepObserveOptions): P
       client = {
         project: resolveReadProject(gvk.kind, name, metadata, manifestProjects, props),
         ...(endpoint ? { endpoint } : {}),
+        manifest,
       };
     } catch (err) {
       unobserved[entityName] = {

package/src/describe-resources.ts

@@ -40,7 +40,7 @@ import type { ObservationResult, ResourceMetadata, UnobservedEntity } from "@int
 import { observation } from "@intentius/chant/observation";
 import { hasOwnershipMarker, classifyOwnership, readOwnership, type ChannelKeys } from "@intentius/chant/ownership";
 import { getResource, mapperForKind, GcpReadError, isNotFound, type GcpReadClientOptions } from "./api/read-client";
-import { NO_PROJECT, parseManifest, projectRefProject } from "./op/activities/gcp-apply";
+import { NO_PROJECT, parseManifest, projectRefProject, type GcpResource } from "./op/activities/gcp-apply";
 import { cnrmNameOf, resolveCnrmRefs, resolveGVK } from "./serializer";
 
 /**
@@ -167,6 +167,26 @@ export function readTargets(
   return out;
 }
 
+/**
+ * The declared resources as the applier's manifest holds them (kind, CNRM
+ * name, spec), for a read that needs another declared resource: an
+ * IAMPolicyMember on a RunService takes the service's region from it (#4251).
+ */
+export function readManifest(
+  entities: Map<string, { entityType: string; props: Record<string, unknown> }>,
+  targets: Map<string, { name: string; props: Record<string, unknown> }>,
+): GcpResource[] {
+  const out: GcpResource[] = [];
+  for (const [logical, { entityType }] of entities) {
+    const gvk = deriveGVK(entityType);
+    const target = targets.get(logical);
+    if (!gvk || !target) continue;
+    const spec = (target.props.spec as Record<string, unknown> | undefined) ?? target.props;
+    out.push({ kind: gvk.kind, metadata: { name: target.name }, spec });
+  }
+  return out;
+}
+
 function pruneUndefined<T extends Record<string, unknown>>(obj: T): Record<string, unknown> {
   const out: Record<string, unknown> = {};
   for (const [k, v] of Object.entries(obj)) {
@@ -223,6 +243,7 @@ export async function describeResources(options: {
 
   const manifestProjects = manifestProjectAnnotations(options.buildOutput);
   const targets = readTargets(options.entities);
+  const manifest = readManifest(options.entities, targets);
 
   const reads = [...options.entities].map(async ([entityName, { entityType }]) => {
     const gvk = deriveGVK(entityType);
@@ -253,6 +274,7 @@ export async function describeResources(options: {
       client = {
         project: resolveReadProject(gvk.kind, name, metadata, manifestProjects, props),
         ...(endpoint ? { endpoint } : {}),
+        manifest,
       };
     } catch (err) {
       // No project resolvable — nothing was queried, so nothing is known.

package/src/project-config.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { describe, test, expect, beforeEach, afterEach, vi } from "vitest";
 import { mkdir, writeFile, rm, realpath } from "node:fs/promises";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
@@ -6,9 +6,9 @@ import type { Declarable } from "@intentius/chant/declarable";
 import { loadChantConfig } from "@intentius/chant/config";
 import { armSandboxConfigEvaluation, resetSandboxConfigEvaluationForTests } from "@intentius/chant/config-sandbox";
 import { gcpSerializer } from "./serializer";
-import { manifestProjectAnnotations, resolveReadProject } from "./describe-resources";
+import { describeResources, manifestProjectAnnotations, resolveReadProject } from "./describe-resources";
 import { parseManifest, resolveGcpProject } from "./op/activities/gcp-apply";
-import { CloudRunService, StorageBucket } from "./generated";
+import { CloudRunService, PubSubTopic, StorageBucket } from "./generated";
 import { defaultAnnotations } from "./default-labels";
 import { GCP } from "./pseudo";
 
@@ -117,3 +117,50 @@ describe("gcp.project under --sandbox (#4252)", () => {
     }
   });
 });
+
+describe("the live read takes gcp.project with no project env var (#4252)", () => {
+  let saved: NodeJS.ProcessEnv;
+  const fetchMock = vi.fn();
+  beforeEach(() => {
+    saved = { ...process.env };
+    delete process.env.GCP_PROJECT_ID;
+    delete process.env.GOOGLE_CLOUD_PROJECT;
+    delete process.env.GCP_ENDPOINT_URL;
+    fetchMock.mockReset();
+    fetchMock.mockImplementation(async (url: string) => new Response(JSON.stringify({ name: "projects/p/topics/assets" }), { status: 200 }));
+    vi.stubGlobal("fetch", fetchMock);
+  });
+  afterEach(() => {
+    process.env = saved;
+    vi.unstubAllGlobals();
+  });
+
+  async function read(config: Record<string, unknown> | undefined, props: Record<string, unknown>) {
+    const yaml = build({ assets: new PubSubTopic(props as never) }, config);
+    return describeResources({
+      environment: "local",
+      buildOutput: yaml,
+      entityNames: ["assets"],
+      entities: new Map([["assets", { entityType: "GCP::Pubsub::Topic", props }]]),
+    });
+  }
+
+  test("only gcp.project in config: the read targets that project", async () => {
+    const result = await read({ gcp: { project: "three-cloud" } }, { metadata: { name: "assets" } });
+    expect(result.unobserved?.assets).toBeUndefined();
+    expect(result.resources.assets).toBeDefined();
+    expect(String(fetchMock.mock.calls[0]?.[0])).toContain("three-cloud");
+  });
+
+  test("only a project-id annotation on the resource: the read targets that project", async () => {
+    const result = await read(undefined, { metadata: { name: "assets", annotations: { [ANNOTATION]: "annotated" } } });
+    expect(result.unobserved?.assets).toBeUndefined();
+    expect(String(fetchMock.mock.calls[0]?.[0])).toContain("annotated");
+  });
+
+  test("neither: no-binding, naming every place a project can come from", async () => {
+    const result = await read(undefined, { metadata: { name: "assets" } });
+    expect(result.unobserved?.assets?.reason).toBe("no-binding");
+    expect(result.unobserved?.assets?.detail).toMatch(/gcp\.project in chant\.config/);
+  });
+});

package/src/read-refs.test.ts

@@ -1,5 +1,6 @@
 import { describe, test, expect, vi, beforeEach, afterEach } from "vitest";
 import { describeResources } from "./describe-resources";
+import { CloudRunServiceComposite } from "./composites/cloud-run-service";
 import {
   BackendService,
   CloudRunService,
@@ -133,3 +134,62 @@ describe("gcp live read resolves .name references as the build does (#4251)", ()
     expect(out.unobserved?.publicIam).toBeUndefined();
   });
 });
+
+/**
+ * #4251, the IAM binding behold saw as pending: the public IAMPolicyMember of a
+ * CloudRunServiceComposite whose service runs outside us-central1. The binding
+ * names its service by `name`, so the read has to take the service's region from
+ * the declared service, as apply does, or it asks a region where the service
+ * isn't, gets a 404 and reports the binding absent.
+ */
+describe("the public binding of a service outside us-central1 reads as observed (#4251)", () => {
+  const policyUrl = "/v2/projects/three-cloud/locations/asia-northeast1/services/three-cloud-site:getIamPolicy";
+
+  function composite() {
+    const { service, publicIam } = CloudRunServiceComposite({
+      name: "three-cloud-site",
+      image: "gcr.io/p/site:1",
+      projectId: "three-cloud",
+      location: "asia-northeast1",
+      publicAccess: true,
+    }) as unknown as Record<string, { entityType: string; props: Record<string, unknown> }>;
+    return [
+      ["webService", { entityType: service.entityType, props: service.props }],
+      ["webPublicIam", { entityType: publicIam.entityType, props: publicIam.props }],
+    ] as Array<[string, { entityType: string; props: Record<string, unknown> }]>;
+  }
+
+  beforeEach(() => {
+    fetchMock.mockReset();
+    vi.stubGlobal("fetch", fetchMock);
+    process.env.GCP_ENDPOINT_URL = "http://localhost:4588";
+    process.env.GCP_PROJECT_ID = "three-cloud";
+    delete process.env.GCP_REGION;
+    fetchMock.mockImplementation(async (url: string) => {
+      if (url.includes(":getIamPolicy")) {
+        return url.includes(policyUrl)
+          ? reply(200, { bindings: [{ role: "roles/run.invoker", members: ["allUsers"] }] })
+          : reply(404, { error: { code: 404 } });
+      }
+      return reply(200, { name: url.split("?")[0].split("/").slice(-6).join("/") });
+    });
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    delete process.env.GCP_ENDPOINT_URL;
+    delete process.env.GCP_PROJECT_ID;
+  });
+
+  for (const order of ["service first", "binding first"]) {
+    test(`webPublicIam is observed with a physical id, ${order}`, async () => {
+      const pairs = composite();
+      const entities = new Map(order === "service first" ? pairs : [...pairs].reverse());
+      const out = await describeResources({ environment: "local", buildOutput: "", entityNames: [...entities.keys()], entities });
+      expect(out.unobserved?.webPublicIam).toBeUndefined();
+      expect(out.resources.webPublicIam?.physicalId).toBe(
+        "projects/three-cloud/locations/asia-northeast1/services/three-cloud-site#roles/run.invoker#allUsers",
+      );
+    });
+  }
+});