@intentius/chant-lexicon-gcp 0.37.2 → 0.38.0

package/src/deep-observe.ts

@@ -123,12 +123,19 @@ import type {
   UnobservedEntity,
 } from "@intentius/chant/lexicon";
 import { deepObservation, normalizeDeepProperties } from "@intentius/chant/deep-observation";
-import { hasOwnershipMarker, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
-import { classifyKubectlFailure } from "@intentius/chant/kubectl-context";
-import { buildOwnershipSets, pruneByOwnership, type OwnershipSets, type ManagedFieldsEntryLike } from "@intentius/chant/managed-fields";
-import { deriveGVK, execConfigConnectorGet, resolveGcpKubectlContext } from "./describe-resources";
+import { hasOwnershipMarker, type ChannelKeys } from "@intentius/chant/ownership";
+import { deriveGVK } from "./describe-resources";
+import { getResource, mapperForKind, GcpReadError, isNotFound, type GcpReadClientOptions } from "./api/read-client";
+import { resolveGcpProject } from "./op/activities/gcp-apply";
 import { gcpDeepNormalizationHooks } from "./deep-observe-hooks";
 
+/** The labels the applier stamps — see describe-resources.ts. */
+const GCP_OWNERSHIP_LABEL_KEYS: ChannelKeys = {
+  managedBy: "managed-by",
+  stack: "chant-stack",
+  env: "chant-env",
+};
+
 // Re-exported so a dynamic importer of this module (plugin.ts's
 // `observeResourcesDeep`, a test) can get the reader and its hooks from one
 // place. `plugin.ts`'s own `deepNormalizationHooks` field imports the hooks
@@ -145,48 +152,44 @@ export interface GcpDeepObserveOptions {
 }
 
 /**
- * Matches chant's field-manager naming scheme (chant #1075: bare `chant`, or
- * `chant:<stack>`) — the same convention `@intentius/chant-k8s-client`'s
- * `isChantFieldManager` checks. Restated here rather than imported: gcp must
- * never depend on that package (chant #1074/#1177's structural boundary — the
- * k8s lexicon reads live cluster state through a typed client, gcp shells
- * kubectl, and the two stay independently deployable). This is a two-branch
- * string comparison with nothing to drift out of sync; the piece that
- * genuinely could — the managed-fields ownership walk — is shared through
- * `@intentius/chant/managed-fields`, not reimplemented here. See the module
- * doc for why this rarely matches anything on GCP's real deploy path today,
- * and why that's fine.
- */
-function isGcpChantFieldManager(manager: string | undefined): boolean {
-  if (!manager) return false;
-  return manager === "chant" || manager.startsWith("chant:");
-}
-
-/**
- * The managed-fields prune, composed with the static rules, for one
- * resource's normalization call — the same layering k8s's `perResourceHooks`
- * uses, sharing the actual rule (`pruneByOwnership`) rather than restating it.
+ * Reshape a GCP REST body into the CNRM shape the declared source is written in.
+ *
+ * This is the half of the port that is not transport (#1209). chant's GCP
+ * source declares Config Connector custom resources — `{ metadata: { name },
+ * spec: { location, storageClass } }` — while the REST APIs return their own
+ * flat shape, `{ name, location, storageClass }`. Diffing one against the other
+ * makes every field drift twice: once as `spec.location: US -> <absent>` and
+ * again as `location: <undeclared> -> US`.
+ *
+ * Verified against floci-gcp before this existed: a bucket that matched its
+ * declaration exactly reported **7 property drifts**, all of them shape.
+ *
+ * chant has met this before. #1207 records it for AWS: Cloud Control returns
+ * the CloudFormation resource model and lines up for free, while the EC2 API
+ * returns the EC2 shape and needs mapping onto the declared shape before the
+ * diff can compare. GCP is the EC2 case.
+ *
+ * The mapping is CNRM's own convention rather than a per-kind table: identity
+ * and labels live under `metadata`, everything else is `spec`. That holds for
+ * every kind the applier can write, and a per-kind table would be a second
+ * place to forget a field.
  */
-function perResourceHooks(sets: OwnershipSets): DeepNormalizationHooks {
+export function restToCnrmShape(body: Record<string, unknown>): Record<string, unknown> {
+  const metadata: Record<string, unknown> = {};
+  const spec: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(body)) {
+    if (key === "name" || key === "labels" || key === "annotations") metadata[key] = value;
+    else spec[key] = value;
+  }
   return {
-    prune(node) {
-      if (gcpDeepNormalizationHooks.prune?.(node)) return true;
-      return pruneByOwnership(node, sets);
-    },
-    orderKey: gcpDeepNormalizationHooks.orderKey,
+    ...(Object.keys(metadata).length ? { metadata } : {}),
+    ...(Object.keys(spec).length ? { spec } : {}),
   };
 }
 
-/** `metadata.managedFields` off a raw `kubectl get -o json` object — a plain decode, no client-side type coercion. */
-function managedFieldsOfRaw(obj: Record<string, unknown>): ManagedFieldsEntryLike[] {
-  const metadata = obj.metadata;
-  if (!metadata || typeof metadata !== "object") return [];
-  const entries = (metadata as Record<string, unknown>).managedFields;
-  if (!Array.isArray(entries)) return [];
-  return entries.filter((e): e is ManagedFieldsEntryLike => !!e && typeof e === "object");
-}
-
-/** The live object minus the envelope fields that live outside `properties` on {@link DeepResourceObservation} (mirrors k8s's `propertiesTreeOf`). */
+/** The live payload minus the fields that live outside `properties` on
+ * {@link DeepResourceObservation}. A REST body has no `apiVersion`, but `kind`
+ * shows up on some (GCS returns `storage#bucket`), so both are dropped. */
 function propertiesTreeOf(obj: Record<string, unknown>): Record<string, unknown> {
   const { apiVersion: _apiVersion, kind: _kind, ...rest } = obj;
   return rest;
@@ -204,25 +207,22 @@ export async function observeResourcesDeepGcp(options: GcpDeepObserveOptions): P
   const resources: Record<string, DeepResourceObservation> = {};
   const unobserved: Record<string, UnobservedEntity> = {};
 
-  // Resolve the cluster identity once, before touching any resource — a
-  // declared-but-mismatched binding throws here (chant #1100), aborting the
-  // whole read rather than letting the per-entity try/catch below absorb it
-  // as an ordinary "not found". Core turns the throw into NOT-OBSERVED for
-  // every declared entity.
-  const ctxArg = await resolveGcpKubectlContext(options.environment);
+  const endpoint = process.env.GCP_ENDPOINT_URL;
 
-  for (const [entityName, { entityType, props }] of options.entities) {
+  const reads = [...options.entities].map(async ([entityName, { entityType, props }]) => {
     const gvk = deriveGVK(entityType);
-    if (!gvk) {
+    if (!gvk || !mapperForKind(gvk.kind)) {
       unobserved[entityName] = {
         type: entityType,
         reason: "unsupported-kind",
-        detail: `cannot derive a Config Connector GVK from ${entityType}`,
+        detail: gvk
+          ? `no REST mapper for ${gvk.kind} — chant cannot apply this kind either`
+          : `cannot derive a GCP kind from ${entityType}`,
       };
-      continue;
+      return;
     }
 
-    const metadata = props.metadata as { name?: string; namespace?: string } | undefined;
+    const metadata = props.metadata as { name?: string; annotations?: Record<string, string> } | undefined;
     const name = metadata?.name;
     if (!name) {
       unobserved[entityName] = {
@@ -230,47 +230,67 @@ export async function observeResourcesDeepGcp(options: GcpDeepObserveOptions): P
         reason: "read-failed",
         detail: "declared entity has no metadata.name to query by",
       };
-      continue;
+      return;
     }
 
+    let client: GcpReadClientOptions;
     try {
-      const obj = await execConfigConnectorGet(gvk, name, metadata.namespace, ctxArg);
-      const objMetadata = obj.metadata as { labels?: Record<string, string>; uid?: string } | undefined;
+      client = {
+        project: resolveGcpProject({ kind: gvk.kind, metadata }),
+        ...(endpoint ? { endpoint } : {}),
+      };
+    } catch (err) {
+      unobserved[entityName] = {
+        type: entityType,
+        reason: "no-binding",
+        detail: err instanceof Error ? err.message : String(err),
+      };
+      return;
+    }
 
-      // owned filter: withhold resources not carrying chant's marker label.
-      // Withheld is not absent (#1089) — the CR exists, it just isn't chant's.
-      if (options.owned && !hasOwnershipMarker(objMetadata?.labels, LABEL_OWNERSHIP_KEYS)) {
+    try {
+      const obj = await getResource(client, gvk.kind, name, props);
+      const labels = obj.labels as Record<string, string> | null | undefined;
+
+      // owned filter: withhold what does not carry chant's marker. Withheld is
+      // not absent (#1089). Where the payload has no labels at all there is
+      // nothing to filter on, so the resource passes through — the same
+      // detect-only degradation the thin path takes.
+      if (options.owned && labels != null && !hasOwnershipMarker(labels, GCP_OWNERSHIP_LABEL_KEYS)) {
         unobserved[entityName] = {
           type: entityType,
           reason: "filtered",
           detail: "live resource carries no chant ownership marker and --owned was requested",
         };
-        continue;
+        return;
       }
 
-      const liveRoot = propertiesTreeOf(obj);
-      const sets = buildOwnershipSets(managedFieldsOfRaw(obj), liveRoot, props, isGcpChantFieldManager);
-
       resources[entityName] = {
         type: entityType,
-        physicalId: objMetadata?.uid,
-        properties: normalizeDeepProperties(liveRoot, {
+        physicalId: (obj.id as string | undefined) ?? (obj.selfLink as string | undefined),
+        properties: normalizeDeepProperties(restToCnrmShape(propertiesTreeOf(obj)), {
           entityType,
           side: "live",
-          hooks: perResourceHooks(sets),
+          // The static table is the whole prune now — there is no per-resource
+          // ownership pass, because a REST payload carries no field ownership
+          // to drive one (see ./deep-observe-hooks.ts).
+          hooks: gcpDeepNormalizationHooks,
         }),
       };
     } catch (err) {
-      // A NotFound is a real absence, same as the thin read — records
-      // nothing here, since restating it would turn one finding into two.
-      // Anything else (auth, connectivity, a mismatched context) proves
-      // nothing and is a hole rather than an absence (#1089).
-      const outcome = classifyKubectlFailure(err);
-      if (outcome.kind === "unobserved") {
-        unobserved[entityName] = { type: entityType, reason: outcome.reason, detail: outcome.detail };
-      }
+      // A 404 is a real absence, same as the thin read — recorded there, not
+      // restated here. Anything else proves nothing and is a hole (#1089).
+      if (isNotFound(err)) return;
+      const status = err instanceof GcpReadError ? err.status : undefined;
+      unobserved[entityName] = {
+        type: entityType,
+        reason: status === 401 || status === 403 ? "no-credentials" : "read-failed",
+        detail: err instanceof Error ? err.message : String(err),
+      };
     }
-  }
+  });
+
+  await Promise.all(reads);
 
   return deepObservation(resources, unobserved);
 }

package/src/describe-resources.test.ts

@@ -1,243 +1,156 @@
-import { describe, test, expect, vi, beforeEach } from "vitest";
-
-const execMock = vi.fn();
-vi.mock("node:child_process", async () => {
-  const actual = await vi.importActual<typeof import("node:child_process")>("node:child_process");
-  return { ...actual, exec: (cmd: string, cb: (err: Error | null, out: { stdout: string; stderr: string }) => void) => {
-    Promise.resolve(execMock(cmd)).then(
-      (out) => cb(null, out),
-      (err) => cb(err as Error, { stdout: "", stderr: "" }),
-    );
-  } };
-});
-
-const loadChantConfigMock = vi.fn();
-vi.mock("@intentius/chant/config", () => ({
-  loadChantConfig: (...args: unknown[]) => loadChantConfigMock(...args),
-}));
-
-const { describeResources } = await import("./describe-resources");
+import { describe, test, expect, vi, beforeEach, afterEach } from "vitest";
+import { describeResources, statusFromRest } from "./describe-resources";
+
+/**
+ * The transport is `fetch` now, not a kubectl spawn (#1209), so these stub the
+ * global rather than `node:child_process`. Stubbing fetch also keeps the URL
+ * under test: a reader that composed its own paths instead of reusing the
+ * applier's mapper would show up here as a changed URL.
+ */
+const fetchMock = vi.fn();
+
+function reply(status: number, body: unknown) {
+  return { status, text: async () => (typeof body === "string" ? body : JSON.stringify(body)) };
+}
 
 function makeEntities(records: Array<{ name: string; entityType: string; props: Record<string, unknown> }>) {
   return new Map(records.map((r) => [r.name, { entityType: r.entityType, props: r.props }]));
 }
 
-describe("gcp describeResources (Config Connector)", () => {
-  beforeEach(() => {
-    execMock.mockReset();
-    loadChantConfigMock.mockReset();
-    // No binding declared by default — matches every test below except the
-    // dedicated cluster-binding tests, which override this per case.
-    loadChantConfigMock.mockResolvedValue({ config: {} });
-  });
-
-  test("queries kubectl with the derived CC GVK and maps the response", async () => {
-    let receivedCmd = "";
-    execMock.mockImplementation((cmd: string) => {
-      receivedCmd = cmd;
-      return {
-        stdout: JSON.stringify({
-          metadata: { name: "data-bucket", namespace: "config-control", uid: "uid-1", creationTimestamp: "2026-05-01T00:00:00Z" },
-          status: { conditions: [{ type: "Ready", status: "True" }] },
-        }),
-        stderr: "",
-      };
-    });
-
-    const entities = makeEntities([
-      { name: "dataBucket", entityType: "GCP::Storage::Bucket", props: { metadata: { name: "data-bucket", namespace: "config-control" } } },
-    ]);
-
-    const result = await describeResources({ environment: "prod", buildOutput: "", entityNames: ["dataBucket"], entities });
-
-    // Resource name follows: <lowerKind>.<service>.cnrm.cloud.google.com
-    expect(receivedCmd).toContain("storagebucket.storage.cnrm.cloud.google.com");
-    expect(receivedCmd).toContain("data-bucket");
-    expect(receivedCmd).toContain("-n config-control");
+const bucket = (name: string) => ({
+  name: "bucket-entity",
+  entityType: "GCP::Storage::Bucket",
+  props: { metadata: { name }, spec: { location: "US" } },
+});
 
-    expect(result.resources["dataBucket"]).toMatchObject({
-      type: "GCP::Storage::Bucket",
-      physicalId: "uid-1",
-      status: "READY",
-    });
+async function read(entities: ReturnType<typeof makeEntities>, opts: { owned?: boolean } = {}) {
+  return describeResources({
+    environment: "local",
+    buildOutput: "",
+    entityNames: [...entities.keys()],
+    entities,
+    ...opts,
   });
+}
 
-  test("Compute resource derives correct GVK with service prefix", async () => {
-    let receivedCmd = "";
-    execMock.mockImplementation((cmd: string) => {
-      receivedCmd = cmd;
-      return {
-        stdout: JSON.stringify({
-          metadata: { name: "subnet-1", uid: "uid", creationTimestamp: "t" },
-          status: { conditions: [{ type: "Ready", status: "True" }] },
-        }),
-        stderr: "",
-      };
-    });
-
-    const entities = makeEntities([
-      { name: "sub", entityType: "GCP::Compute::Subnetwork", props: { metadata: { name: "subnet-1" } } },
-    ]);
-
-    await describeResources({ environment: "prod", buildOutput: "", entityNames: ["sub"], entities });
-
-    expect(receivedCmd).toContain("computesubnetwork.compute.cnrm.cloud.google.com");
+describe("gcp describeResources — direct REST (#1209)", () => {
+  beforeEach(() => {
+    fetchMock.mockReset();
+    vi.stubGlobal("fetch", fetchMock);
+    process.env.GOOGLE_CLOUD_PROJECT = "my-project";
+    process.env.GCP_ENDPOINT_URL = "http://localhost:4588";
   });
 
-  test("Ready=False maps to the condition's reason", async () => {
-    execMock.mockResolvedValue({
-      stdout: JSON.stringify({
-        metadata: { name: "x", uid: "uid", creationTimestamp: "t" },
-        status: { conditions: [{ type: "Ready", status: "False", reason: "DependencyNotFound", message: "..." }] },
-      }),
-      stderr: "",
-    });
-
-    const entities = makeEntities([
-      { name: "x", entityType: "GCP::Storage::Bucket", props: { metadata: { name: "x" } } },
-    ]);
-
-    const result = await describeResources({ environment: "prod", buildOutput: "", entityNames: ["x"], entities });
-
-    expect(result.resources["x"].status).toBe("DependencyNotFound");
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    delete process.env.GCP_ENDPOINT_URL;
+    delete process.env.GOOGLE_CLOUD_PROJECT;
   });
 
-  test("missing Ready condition falls back to PRESENT", async () => {
-    execMock.mockResolvedValue({
-      stdout: JSON.stringify({
-        metadata: { name: "x", uid: "uid", creationTimestamp: "t" },
-        status: {},
-      }),
-      stderr: "",
-    });
-
-    const entities = makeEntities([
-      { name: "x", entityType: "GCP::Storage::Bucket", props: { metadata: { name: "x" } } },
-    ]);
-
-    const result = await describeResources({ environment: "prod", buildOutput: "", entityNames: ["x"], entities });
+  test("reads through the applier's mapper URL, against the endpoint override", async () => {
+    fetchMock.mockResolvedValue(reply(200, { id: "b/my-bucket", labels: { "managed-by": "chant" } }));
+    const out = await read(makeEntities([bucket("my-bucket")]));
 
-    expect(result.resources["x"].status).toBe("PRESENT");
+    // floci-gcp, and the storage path the applier writes to — not a URL this
+    // reader composed for itself.
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(fetchMock.mock.calls[0][0]).toBe("http://localhost:4588/storage/v1/b/my-bucket");
+    expect(out.resources["bucket-entity"]).toMatchObject({ type: "GCP::Storage::Bucket", physicalId: "b/my-bucket" });
   });
 
-  test("kubectl-not-found leaves entity out of result (a confirmed absence)", async () => {
-    execMock.mockImplementation(() => { throw new Error('Error from server (NotFound): storagebucket "x" not found'); });
-
-    const entities = makeEntities([
-      { name: "x", entityType: "GCP::Storage::Bucket", props: { metadata: { name: "x" } } },
-    ]);
-
-    const result = await describeResources({ environment: "prod", buildOutput: "", entityNames: ["x"], entities });
-
-    expect(result.resources).toEqual({});
-    expect(result.unobserved ?? {}).toEqual({});
+  test("a 404 is a real absence — reported as neither present nor a hole", async () => {
+    fetchMock.mockResolvedValue(reply(404, { error: "not found" }));
+    const out = await read(makeEntities([bucket("gone")]));
+    expect(out.resources["bucket-entity"]).toBeUndefined();
+    expect(out.unobserved?.["bucket-entity"]).toBeUndefined();
   });
 
-  test("an unreachable cluster is unobserved, not absent (#1089)", async () => {
-    execMock.mockImplementation(() => {
-      throw Object.assign(new Error("kubectl failed"), {
-        stderr: "Unable to connect to the server: dial tcp: i/o timeout",
-      });
-    });
-
-    const entities = makeEntities([
-      { name: "x", entityType: "GCP::Storage::Bucket", props: { metadata: { name: "x" } } },
-    ]);
-
-    const result = await describeResources({ environment: "prod", buildOutput: "", entityNames: ["x"], entities });
-
-    expect(result.resources).toEqual({});
-    expect(result.unobserved?.x?.reason).toBe("no-binding");
+  test("a 403 is a hole, not an absence (#1089)", async () => {
+    fetchMock.mockResolvedValue(reply(403, { error: "denied" }));
+    const out = await read(makeEntities([bucket("secret")]));
+    expect(out.resources["bucket-entity"]).toBeUndefined();
+    expect(out.unobserved?.["bucket-entity"]?.reason).toBe("no-credentials");
   });
 
-  test("non-GCP entity types are unobserved — no GVK to query (#1089)", async () => {
-    const entities = makeEntities([
-      { name: "x", entityType: "AWS::S3::Bucket", props: { metadata: { name: "x" } } },
-    ]);
+  test("an unreachable endpoint is a hole", async () => {
+    fetchMock.mockRejectedValue(new Error("ECONNREFUSED"));
+    const out = await read(makeEntities([bucket("x")]));
+    expect(out.unobserved?.["bucket-entity"]?.reason).toBe("read-failed");
+  });
 
-    const result = await describeResources({ environment: "prod", buildOutput: "", entityNames: ["x"], entities });
+  test("a kind the applier has no mapper for is unsupported-kind, not absent", async () => {
+    const out = await read(
+      makeEntities([{ name: "e", entityType: "GCP::Compute::Address", props: { metadata: { name: "addr" } } }]),
+    );
+    expect(out.unobserved?.e?.reason).toBe("unsupported-kind");
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
 
-    expect(result.resources).toEqual({});
-    expect(result.unobserved?.x?.reason).toBe("unsupported-kind");
-    expect(execMock).not.toHaveBeenCalled();
+  test("an entity with no metadata.name has nothing to query by", async () => {
+    const out = await read(makeEntities([{ name: "e", entityType: "GCP::Storage::Bucket", props: {} }]));
+    expect(out.unobserved?.e?.reason).toBe("read-failed");
+    expect(fetchMock).not.toHaveBeenCalled();
   });
 
-  test("entity without metadata.name is unobserved — nothing was queried", async () => {
+  test("reads concurrently, where the kubectl path was one spawn after another", async () => {
+    fetchMock.mockResolvedValue(reply(200, {}));
     const entities = makeEntities([
-      { name: "broken", entityType: "GCP::Storage::Bucket", props: {} },
+      { name: "a", entityType: "GCP::Storage::Bucket", props: { metadata: { name: "a" } } },
+      { name: "b", entityType: "GCP::Storage::Bucket", props: { metadata: { name: "b" } } },
+      { name: "c", entityType: "GCP::Storage::Bucket", props: { metadata: { name: "c" } } },
     ]);
-
-    const result = await describeResources({ environment: "prod", buildOutput: "", entityNames: ["broken"], entities });
-
-    expect(result.resources).toEqual({});
-    expect(result.unobserved?.broken?.reason).toBe("read-failed");
-    expect(execMock).not.toHaveBeenCalled();
+    await read(entities);
+    expect(fetchMock).toHaveBeenCalledTimes(3);
   });
 
-  // chant #1100 — GCP-via-CNRM resolves the same environment→cluster binding
-  // as the K8s lexicon (bound-and-matching, bound-and-mismatched loud
-  // refusal, unbound unchanged), since it observes through the same kubectl
-  // path against the same cluster.
-  describe("cluster binding (chant #1100)", () => {
-    function bucketEntities() {
-      return makeEntities([
-        { name: "dataBucket", entityType: "GCP::Storage::Bucket", props: { metadata: { name: "data-bucket" } } },
-      ]);
-    }
-
-    const bucketStdout = JSON.stringify({
-      metadata: { name: "data-bucket", uid: "uid-1", creationTimestamp: "2026-05-01T00:00:00Z" },
-      status: { conditions: [{ type: "Ready", status: "True" }] },
+  describe("--owned", () => {
+    test("withholds a resource whose labels carry no chant marker", async () => {
+      fetchMock.mockResolvedValue(reply(200, { id: "b/theirs", labels: { team: "other" } }));
+      const out = await read(makeEntities([bucket("theirs")]), { owned: true });
+      expect(out.unobserved?.["bucket-entity"]?.reason).toBe("filtered");
     });
 
-    test("bound and ambient context matches: observes explicitly via --context", async () => {
-      loadChantConfigMock.mockResolvedValue({ config: { k8s: { profiles: { prod: { context: "prod-cnrm" } } } } });
-      let receivedCmd = "";
-      execMock.mockImplementation((cmd: string) => {
-        if (cmd.includes("current-context")) return { stdout: "prod-cnrm\n", stderr: "" };
-        receivedCmd = cmd;
-        return { stdout: bucketStdout, stderr: "" };
-      });
-
-      const result = await describeResources({ environment: "prod", buildOutput: "", entityNames: ["dataBucket"], entities: bucketEntities() });
+    test("keeps one carrying the marker the APPLIER stamps, not the CNRM label", async () => {
+      // gcp-apply stamps `managed-by: chant` — GCP label keys cannot hold the
+      // k8s `app.kubernetes.io/managed-by` form the kubectl path looked for.
+      fetchMock.mockResolvedValue(reply(200, { id: "b/ours", labels: { "managed-by": "chant" } }));
+      const out = await read(makeEntities([bucket("ours")]), { owned: true });
+      expect(out.resources["bucket-entity"]?.ownership).toBe("owned");
+    });
 
-      expect(receivedCmd).toContain("--context prod-cnrm");
-      expect(result.resources["dataBucket"]).toMatchObject({ type: "GCP::Storage::Bucket", physicalId: "uid-1", status: "READY" });
+    test("degrades to detect-only for a kind whose payload has no labels at all", async () => {
+      // A Pub/Sub topic carries none. Withholding everything it cannot prove
+      // would report a live estate as empty; the AWS thin path takes the same
+      // posture when describe-stack-resources returns no tags.
+      fetchMock.mockResolvedValue(reply(200, { name: "projects/my-project/topics/t" }));
+      const out = await read(
+        makeEntities([{ name: "t", entityType: "GCP::PubSub::Topic", props: { metadata: { name: "t" } } }]),
+        { owned: true },
+      );
+      expect(out.unobserved?.t).toBeUndefined();
+      expect(out.resources.t?.ownership).toBe("unknown");
     });
+  });
+});
 
-    test("bound and ambient context mismatches: refuses loudly instead of observing the wrong cluster", async () => {
-      loadChantConfigMock.mockResolvedValue({ config: { k8s: { profiles: { prod: { context: "prod-cnrm" } } } } });
-      execMock.mockImplementation((cmd: string) => {
-        if (cmd.includes("current-context")) return { stdout: "staging-cnrm\n", stderr: "" };
-        throw new Error(`unexpected cmd (should have refused before any kubectl get): ${cmd}`);
-      });
+describe("statusFromRest", () => {
+  test("PRESENT when the payload carries no state — the common case", () => {
+    // A bucket that answers a GET simply exists. Same sentinel the Azure
+    // reader emits for a resource with no provisioningState.
+    expect(statusFromRest({})).toBe("PRESENT");
+  });
 
-      await expect(
-        describeResources({ environment: "prod", buildOutput: "", entityNames: ["dataBucket"], entities: bucketEntities() }),
-      ).rejects.toThrow(/environment "prod".*"prod-cnrm".*"staging-cnrm"/s);
+  test("an explicit state wins", () => {
+    expect(statusFromRest({ state: "ACTIVE" })).toBe("ACTIVE");
+  });
 
-      expect(execMock).toHaveBeenCalledTimes(1);
-    });
+  test("a Ready condition reads like the CNRM path did", () => {
+    expect(statusFromRest({ status: { conditions: [{ type: "Ready", status: "True" }] } })).toBe("READY");
+    expect(statusFromRest({ status: { conditions: [{ type: "Ready", status: "False", reason: "Failed" }] } })).toBe("Failed");
+    expect(statusFromRest({ status: { conditions: [{ type: "Ready", status: "False" }] } })).toBe("NOT_READY");
+  });
 
-    test("unbound: ambient context is used unchanged, but the fallback is visible (not silent)", async () => {
-      loadChantConfigMock.mockResolvedValue({ config: {} });
-      const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
-      let receivedCmd = "";
-      execMock.mockImplementation((cmd: string) => {
-        receivedCmd = cmd;
-        return { stdout: bucketStdout, stderr: "" };
-      });
-
-      const result = await describeResources({ environment: "prod", buildOutput: "", entityNames: ["dataBucket"], entities: bucketEntities() });
-
-      expect(receivedCmd).not.toContain("--context");
-      expect(receivedCmd).not.toContain("current-context");
-      expect(result.resources["dataBucket"]).toMatchObject({ type: "GCP::Storage::Bucket", physicalId: "uid-1", status: "READY" });
-
-      const bindingWarning = warnSpy.mock.calls.find((c) => String(c[0]).includes("no cluster binding"));
-      expect(bindingWarning?.[0]).toContain('environment "prod"');
-      expect(bindingWarning?.[0]).toContain("k8s.profiles.prod.context");
-      warnSpy.mockRestore();
-    });
+  test("falls back to listing conditions when there is no Ready", () => {
+    expect(statusFromRest({ status: { conditions: [{ type: "Synced", status: "True" }] } })).toBe("Synced=True");
   });
 });