@intentius/chant-lexicon-gcp 0.38.0 → 0.41.0

package/src/composites/pubsub-pipeline.ts

@@ -31,7 +31,7 @@ export interface PubSubPipelineProps {
   };
 }
 
-export const PubSubPipeline = Composite<PubSubPipelineProps>((props) => {
+export const PubSubPipeline = Composite((props: PubSubPipelineProps) => {
   const {
     name,
     ackDeadlineSeconds = 10,

package/src/composites/secure-project.ts

@@ -41,7 +41,7 @@ export interface SecureProjectProps {
   };
 }
 
-export const SecureProject = Composite<SecureProjectProps>((props) => {
+export const SecureProject = Composite((props: SecureProjectProps) => {
   const {
     name,
     orgId,

package/src/composites/vpc-network.ts

@@ -68,7 +68,7 @@ export interface VpcNetworkProps {
  * });
  * ```
  */
-export const VpcNetwork = Composite<VpcNetworkProps>((props) => {
+export const VpcNetwork = Composite((props: VpcNetworkProps) => {
   const {
     name,
     autoCreateSubnetworks = false,

package/src/op/activities/floci-gcp.test.ts

@@ -5,7 +5,9 @@ import {
   flociGcpExistsCommand,
   flociGcpHealthUrl,
   flociGcpEndpoint,
+  FLOCI_GCP_EMULATOR,
 } from "./floci-gcp";
+import { endpointEnvVars } from "@intentius/chant/op";
 
 describe("floci-gcp lifecycle commands (typed emulator, not shell)", () => {
   test("run command uses defaults and maps the port", () => {
@@ -27,3 +29,26 @@ describe("floci-gcp lifecycle commands (typed emulator, not shell)", () => {
     expect(flociGcpEndpoint(4588)).toBe("http://localhost:4588");
   });
 });
+
+describe("floci-gcp emulator capability (#1431)", () => {
+  // The bug: `env` returned {}, so `chant emulator up --lexicon gcp` booted the
+  // emulator and left GCP_ENDPOINT_URL unset — pointing describeResources and
+  // observeResourcesDeep, which read that variable and nothing else, at real GCP.
+  test("injects the endpoint under the variable the READ path honours", () => {
+    expect(FLOCI_GCP_EMULATOR.env("http://localhost:4588")).toEqual({
+      GCP_ENDPOINT_URL: "http://localhost:4588",
+    });
+  });
+
+  test("injects whatever endpoint it is given, not a hardcoded port", () => {
+    expect(FLOCI_GCP_EMULATOR.env("http://localhost:4599")).toEqual({
+      GCP_ENDPOINT_URL: "http://localhost:4599",
+    });
+  });
+
+  // `endpointEnvVars` derives its list by probing `env`, so an empty `env` also
+  // meant core believed gcp had no endpoint variable at all.
+  test("core can now derive gcp's endpoint variable from the capability", () => {
+    expect(endpointEnvVars(FLOCI_GCP_EMULATOR)).toEqual(["GCP_ENDPOINT_URL"]);
+  });
+});

package/src/op/activities/floci-gcp.ts

@@ -30,16 +30,31 @@ export const FLOCI_GCP_SPEC: EmulatorSpec = {
 };
 
 /**
- * The gcp plugin's emulator capability (#1345).
+ * The gcp plugin's emulator capability (#1345, corrected in #1431).
  *
- * `env` is deliberately empty: `gcpApply` reaches the emulator through an
- * explicit `endpoint` argument rather than an ambient variable, so there is no
- * var to inject and claiming one would be worse than claiming none. The
- * endpoint is still reported by `chant emulator up --json`.
+ * The apply and read paths reach the emulator differently, and the capability
+ * exists for the one that cannot be told where to look:
+ *
+ *  - **apply** — `gcpApply` takes an explicit `endpoint` argument. Nothing to
+ *    inject; the caller already holds it.
+ *  - **read** — `describeResources` and `observeResourcesDeep` take it from
+ *    `GCP_ENDPOINT_URL` and nothing else (`../../describe-resources.ts`,
+ *    `../../deep-observe.ts`). A reader given no variable talks to real GCP.
+ *
+ * `env` was empty because when #1345 declared this capability the second bullet
+ * was not yet true: GCP was observed through Config Connector over kubectl, so
+ * there genuinely was no variable to inject. #1209 moved observation onto the
+ * applier's own direct-REST transport about two hours later, and nothing
+ * re-read this comment. The result was an emulator that booted, reported its
+ * endpoint, and left every `--live` read pointed at production.
+ *
+ * Injecting it makes `chant emulator up --lexicon gcp` mean the same thing for
+ * gcp that it already means for aws and azure: the estate's reads land on the
+ * emulator you just started.
  */
 export const FLOCI_GCP_EMULATOR: EmulatorCapability = {
   spec: FLOCI_GCP_SPEC,
-  env: () => ({}),
+  env: (endpoint) => ({ GCP_ENDPOINT_URL: endpoint }),
 };
 
 const gcp = emulatorLifecycle(FLOCI_GCP_SPEC);

package/src/op/activities/gcp-apply.test.ts

@@ -1,4 +1,6 @@
 import { describe, test, expect } from "vitest";
+import { writeFileSync, unlinkSync } from "node:fs";
+import { describeApplyConformance } from "@intentius/chant-test-utils";
 import {
   bucketInsertBody,
   pubSubTopicBody,
@@ -12,6 +14,9 @@ import {
   referencedNames,
   orderByReferences,
   pruneOrphans,
+  gcpApply,
+  gcpDelete,
+  toApplyResult,
   chantOwnershipLabels,
   isChantOwned,
   pubSubSubscriptionBody,
@@ -454,12 +459,47 @@ describe("ownership + prune (#706)", () => {
       return { status: 200, text: "" }; // DELETE
     };
     const resolve = () => ({ base: "http://x", project: "p" });
-    const pruned = await pruneOrphans(desired, resolve, http);
+    const { pruned, notPrunable } = await pruneOrphans(desired, resolve, http);
     expect(pruned).toEqual([{ kind: "StorageBucket", name: "orphan", deleted: true }]);
+    expect(notPrunable).toEqual([]);
     expect(calls.filter((c) => c.method === "DELETE")).toEqual([
       { method: "DELETE", url: "http://x/storage/v1/b/orphan" },
     ]);
   });
+
+  // #1447. A kind the prune could not consider was `continue`, so `pruned: []`
+  // came back — which reads as "there was nothing to prune", not "I did not
+  // look at this kind". Same conflation the read path fixed in #1089/#1201.
+  test("a kind with no list capability is reported, not silently skipped", async () => {
+    // IAMServiceAccount is mapped but has no `list` spec.
+    const desired: GcpResource[] = [{ kind: "IAMServiceAccount", metadata: { name: "sa" } }];
+    const calls: string[] = [];
+    const http: GcpHttp = async (method) => {
+      calls.push(method);
+      return { status: 200, text: "{}" };
+    };
+    const { pruned, notPrunable } = await pruneOrphans(desired, () => ({ base: "http://x", project: "p" }), http);
+    expect(pruned).toEqual([]);
+    expect(notPrunable).toEqual([{ kind: "IAMServiceAccount", reason: "no-list-capability" }]);
+    // Reported without touching the transport at all.
+    expect(calls).toEqual([]);
+  });
+
+  // Not in #1447's list, same class: a failed LIST was also `continue`. A 403 or
+  // a 500 meant the kind went unconsidered and the result said nothing.
+  test("a failed list is reported, with the status, not silently skipped", async () => {
+    const desired: GcpResource[] = [{ kind: "StorageBucket", metadata: { name: "keep" } }];
+    const deletes: string[] = [];
+    const http: GcpHttp = async (method, url) => {
+      if (method === "DELETE") deletes.push(url);
+      return method === "GET" ? { status: 403, text: "forbidden" } : { status: 200, text: "" };
+    };
+    const { pruned, notPrunable } = await pruneOrphans(desired, () => ({ base: "http://x", project: "p" }), http);
+    expect(pruned).toEqual([]);
+    expect(notPrunable).toEqual([{ kind: "StorageBucket", reason: "list-failed", detail: "403: forbidden" }]);
+    // And nothing was deleted on the strength of a list that failed.
+    expect(deletes).toEqual([]);
+  });
 });
 
 describe("parseManifest (#711)", () => {
@@ -473,3 +513,196 @@ describe("parseManifest (#711)", () => {
     expect(docs.map((d) => d.kind)).toEqual(["StorageBucket", "PubSubTopic"]);
   });
 });
+
+/**
+ * #1447 — a resource `MAPPERS` has no entry for was dropped with a
+ * `console.log`, and the return value looked exactly like a complete apply.
+ * `ApplyOp` reported success over a partial one.
+ *
+ * The GCP lexicon serializes many more kinds than the six `MAPPERS` covers, so
+ * this is not a hypothetical: anything else in the manifest was silently not
+ * applied.
+ */
+describe("gcpApply / gcpDelete report what they did not attempt (#1447)", () => {
+  /** A manifest with one kind chant can apply and one it cannot. */
+  const manifest = (): string => {
+    const path = `/tmp/chant-1447-${process.pid}-${Math.random().toString(36).slice(2)}.json`;
+    writeFileSync(
+      path,
+      JSON.stringify([
+        { kind: "StorageBucket", metadata: { name: "mapped" }, spec: { location: "US" } },
+        { kind: "SQLInstance", metadata: { name: "unmapped" }, spec: {} },
+      ]),
+    );
+    return path;
+  };
+
+  const ok: GcpHttp = async (method) =>
+    method === "GET" ? { status: 404, text: "" } : { status: 200, text: "{}" };
+
+  test("an unmapped kind lands in notAttempted, not in applied", async () => {
+    const path = manifest();
+    try {
+      const res = await gcpApply({ manifestPath: path, endpoint: "http://x", project: "p" }, undefined, ok);
+      expect(res.applied.map((a) => a.name)).toEqual(["mapped"]);
+      expect(res.notAttempted).toEqual([
+        { kind: "SQLInstance", name: "unmapped", reason: "unsupported-kind" },
+      ]);
+    } finally {
+      unlinkSync(path);
+    }
+  });
+
+  // The distinction the old shape could not express: without notAttempted, this
+  // result and one from a manifest that never declared SQLInstance are identical.
+  test("a fully-applied manifest reports notAttempted empty", async () => {
+    const path = `/tmp/chant-1447-full-${process.pid}.json`;
+    writeFileSync(path, JSON.stringify([{ kind: "StorageBucket", metadata: { name: "only" }, spec: {} }]));
+    try {
+      const res = await gcpApply({ manifestPath: path, endpoint: "http://x", project: "p" }, undefined, ok);
+      expect(res.applied).toHaveLength(1);
+      expect(res.notAttempted).toEqual([]);
+      expect(res.notPrunable).toEqual([]);
+    } finally {
+      unlinkSync(path);
+    }
+  });
+
+  // The delete side matters more: a caller reading only `deleted` would believe
+  // the manifest was fully torn down.
+  test("gcpDelete reports the resources it never attempted to delete", async () => {
+    const path = manifest();
+    try {
+      const res = await gcpDelete({ manifestPath: path, endpoint: "http://x", project: "p" }, undefined, ok);
+      expect(res.deleted.map((d) => d.name)).toEqual(["mapped"]);
+      expect(res.notAttempted).toEqual([
+        { kind: "SQLInstance", name: "unmapped", reason: "unsupported-kind" },
+      ]);
+    } finally {
+      unlinkSync(path);
+    }
+  });
+
+  // A malformed manifest is a different fact from an unsupported kind — one is a
+  // bug in the input, the other a known gap in coverage. Only the second belongs
+  // in notAttempted.
+  test("a manifest entry with no kind throws instead of being skipped", async () => {
+    const path = `/tmp/chant-1447-nokind-${process.pid}.json`;
+    writeFileSync(path, JSON.stringify([{ metadata: { name: "kindless" } }]));
+    try {
+      await expect(
+        gcpApply({ manifestPath: path, endpoint: "http://x", project: "p" }, undefined, ok),
+      ).rejects.toThrow(/no "kind".*kindless.*malformed manifest/s);
+    } finally {
+      unlinkSync(path);
+    }
+  });
+});
+
+/**
+ * The shared apply-contract suite (#1446), run against gcp's own mocked
+ * transport. gcp is the reference adopter because #1447 already gave it the
+ * not-attempted facts; this proves the seam carries them.
+ *
+ * Assertion 3 ("accounts for every resource in the plan") is the one that fails
+ * on pre-#1447 gcp — an unmapped kind was in the plan and in no bucket.
+ */
+describeApplyConformance({
+  lexicon: "gcp",
+  scenarios: [
+    {
+      name: "a manifest with one mapped and one unmapped kind",
+      plan: [
+        { kind: "StorageBucket", name: "mapped" },
+        { kind: "SQLInstance", name: "unmapped" },
+      ],
+      run: async () => {
+        const path = `/tmp/chant-1446-gcp-${process.pid}.json`;
+        writeFileSync(
+          path,
+          JSON.stringify([
+            { kind: "StorageBucket", metadata: { name: "mapped" }, spec: { location: "US" } },
+            { kind: "SQLInstance", metadata: { name: "unmapped" }, spec: {} },
+          ]),
+        );
+        try {
+          const http: GcpHttp = async (method) =>
+            method === "GET" ? { status: 404, text: "" } : { status: 200, text: "{}" };
+          return toApplyResult(
+            await gcpApply({ manifestPath: path, endpoint: "http://x", project: "p" }, undefined, http),
+          );
+        } finally {
+          unlinkSync(path);
+        }
+      },
+      expectApplied: ["StorageBucket/mapped"],
+      expectNotAttempted: ["SQLInstance/unmapped"],
+    },
+  ],
+  pruneScenarios: [
+    {
+      name: "an owned orphan beside a foreign resource in the same project",
+      ownedOrphan: "orphan",
+      foreign: "foreign",
+      run: async () => {
+        const deletes: string[] = [];
+        const live = {
+          items: [
+            { name: "keep", labels: { "managed-by": "chant" } },
+            { name: "orphan", labels: { "managed-by": "chant" } },
+            { name: "foreign", labels: { "managed-by": "terraform" } },
+          ],
+        };
+        const path = `/tmp/chant-1446-gcp-prune-${process.pid}.json`;
+        writeFileSync(
+          path,
+          JSON.stringify([{ kind: "StorageBucket", metadata: { name: "keep" }, spec: {} }]),
+        );
+        try {
+          const http: GcpHttp = async (method, url) => {
+            if (method === "DELETE") deletes.push(url);
+            if (method === "GET" && url.includes("/b?")) return { status: 200, text: JSON.stringify(live) };
+            if (method === "GET") return { status: 200, text: "{}" }; // `keep` already exists
+            return { status: 200, text: "{}" };
+          };
+          const result = toApplyResult(
+            await gcpApply(
+              { manifestPath: path, endpoint: "http://x", project: "p", prune: true },
+              undefined,
+              http,
+            ),
+          );
+          return { result, deletes };
+        } finally {
+          unlinkSync(path);
+        }
+      },
+    },
+  ],
+  idempotenceScenarios: [
+    {
+      name: "the same manifest applied twice",
+      run: async () => {
+        const path = `/tmp/chant-1446-gcp-idem-${process.pid}.json`;
+        writeFileSync(
+          path,
+          JSON.stringify([{ kind: "StorageBucket", metadata: { name: "b" }, spec: { location: "US" } }]),
+        );
+        try {
+          let exists = false;
+          const http: GcpHttp = async (method) => {
+            if (method === "GET") return exists ? { status: 200, text: "{}" } : { status: 404, text: "" };
+            exists = true;
+            return { status: 200, text: "{}" };
+          };
+          const args = { manifestPath: path, endpoint: "http://x", project: "p" };
+          const first = toApplyResult(await gcpApply(args, undefined, http));
+          const second = toApplyResult(await gcpApply(args, undefined, http));
+          return { first, second };
+        } finally {
+          unlinkSync(path);
+        }
+      },
+    },
+  ],
+});

package/src/op/activities/gcp-apply.ts

@@ -1,23 +1,40 @@
 import { readFileSync } from "node:fs";
 import { parseYAML } from "@intentius/chant/yaml";
 import { safeHeartbeat, sleep } from "@intentius/chant/op";
+import { hasOwnershipMarker, OWNERSHIP_MANAGED_BY_VALUE } from "@intentius/chant/ownership";
+import { GCP_RESOURCE_OWNERSHIP_KEYS } from "../../ownership";
+import {
+  applyResult,
+  type ApplyResult,
+  type AppliedResource,
+  type NotAttemptedResource,
+} from "@intentius/chant/apply";
 
 const PROJECT_ID_ANNOTATION = "cnrm.cloud.google.com/project-id";
 
-// Ownership marker stamped as a GCP resource label so `prune` can identify what
-// chant created (GCP label keys can't hold the k8s `app.kubernetes.io/managed-by`
-// slash/dot form, so this is the GCP-valid equivalent).
-const OWNERSHIP_LABEL_KEY = "managed-by";
-const OWNERSHIP_LABEL_VALUE = "chant";
-
-/** The GCP labels chant stamps on resources it creates. */
+/**
+ * The GCP labels chant stamps on resources it creates.
+ *
+ * Only the managed-by marker, not stack/env: this applier has no ownership
+ * marker to hand — the serializer stamps those from project config onto the
+ * Config Connector object. Same shape the fly serializer uses when no ownership
+ * context is set.
+ */
 export function chantOwnershipLabels(): Record<string, string> {
-  return { [OWNERSHIP_LABEL_KEY]: OWNERSHIP_LABEL_VALUE };
+  return { [GCP_RESOURCE_OWNERSHIP_KEYS.managedBy]: OWNERSHIP_MANAGED_BY_VALUE };
 }
 
-/** True when a live resource's labels carry chant's ownership marker. */
+/**
+ * True when a live resource's labels carry chant's ownership marker.
+ *
+ * Resolves through core's `hasOwnershipMarker` against the lexicon's declared
+ * GCP-resource channel (#1446) rather than comparing a string literal inline,
+ * so the stamp and the prune filter cannot drift. The key itself is unchanged
+ * and deliberately GCP-valid — see `../../ownership.ts` for why this surface
+ * cannot use core's `LABEL_OWNERSHIP_KEYS`.
+ */
 export function isChantOwned(labels: Record<string, string> | null | undefined): boolean {
-  return labels?.[OWNERSHIP_LABEL_KEY] === OWNERSHIP_LABEL_VALUE;
+  return hasOwnershipMarker(labels ?? undefined, GCP_RESOURCE_OWNERSHIP_KEYS);
 }
 
 /** Merge the ownership marker into a create/update body's `labels`. */
@@ -533,6 +550,25 @@ export async function waitForOperation(
   throw new Error(`operation did not complete within timeout: ${pollUrl}`);
 }
 
+/**
+ * A manifest entry with no `kind` is malformed, not unsupported (#1447).
+ *
+ * The old guard skipped it in silence, which put a hand-written or truncated
+ * manifest in the same bucket as a kind chant simply has no mapper for. One is
+ * a bug in the input and the other is a known gap in coverage; only the second
+ * belongs in `notAttempted`. Throws so the first surfaces.
+ */
+function requireKind(resource: GcpResource, manifestPath: string): boolean {
+  if (!resource.kind) {
+    const name = resource.metadata?.name;
+    throw new Error(
+      `${manifestPath}: manifest entry has no "kind"${name ? ` (metadata.name: ${name})` : ""} — ` +
+        `a CNRM resource must declare one. This is a malformed manifest, not an unsupported kind.`,
+    );
+  }
+  return true;
+}
+
 /** Parse a built manifest into CNRM resource objects — YAML (multi-doc) or JSON. Pure. */
 export function parseManifest(content: string, path: string): GcpResource[] {
   if (/\.json$/i.test(path)) {
@@ -561,17 +597,90 @@ export interface GcpApplyArgs {
   prune?: boolean;
 }
 
+/**
+ * Normalize a gcp apply/delete result into core's apply envelope (#1446).
+ *
+ * The lexicon keeps its own richer shape — `created`/`updated` per resource,
+ * the CNRM `kind` — and this projects it onto the shared tri-state so a caller
+ * can read any applier's result the same way. Core's contract is the interface;
+ * it is not a replacement for what this applier knows.
+ */
+export function toApplyResult(result: {
+  applied?: Array<{ kind: string; name: string; created: boolean; updated: boolean }>;
+  deleted?: Array<{ kind: string; name: string; deleted: boolean }>;
+  pruned?: Array<{ kind: string; name: string; deleted: boolean }>;
+  notAttempted?: GcpNotAttempted[];
+  notPrunable?: GcpNotPrunable[];
+}): ApplyResult {
+  const applied: AppliedResource[] = (result.applied ?? []).map((a) => ({
+    kind: a.kind,
+    name: a.name,
+    action: a.created ? "created" : a.updated ? "updated" : "unchanged",
+  }));
+  const notAttempted: NotAttemptedResource[] = [
+    ...(result.notAttempted ?? []).map((n) => ({ kind: n.kind, name: n.name, reason: n.reason })),
+    // A kind the prune could not consider has no single resource name — the
+    // whole kind went unexamined, which `not-prunable` is the reason for.
+    ...(result.notPrunable ?? []).map((n) => ({
+      kind: n.kind,
+      name: "*",
+      reason: "not-prunable" as const,
+      ...(n.detail ? { detail: n.detail } : {}),
+    })),
+  ];
+  // `gcpDelete` reports deletions as `deleted`; they are prunes in the shared
+  // vocabulary — the applier removed something the plan no longer wants.
+  return applyResult(applied, result.pruned ?? result.deleted ?? [], notAttempted);
+}
+
+/**
+ * A resource this run did not attempt, and why (#1447).
+ *
+ * The read path learned this in #1089/#1201: a read that never happened is not
+ * the same fact as a resource that is not there, and collapsing the two made
+ * "absent" mean both. `observation.ts` puts it as "a warn on stderr is not a
+ * signal in a change set" — and a `console.log` on stdout is not a signal in an
+ * apply result, for the same reason. So the skips ride the return value.
+ */
+export interface GcpNotAttempted {
+  kind: string;
+  name: string;
+  /** `MAPPERS` has no entry for this kind, so no REST call exists to make. */
+  reason: "unsupported-kind";
+}
+
+/** A kind an owned-only prune could not consider, and why (#1447). */
+export interface GcpNotPrunable {
+  kind: string;
+  /**
+   * - `no-list-capability` — the mapper cannot enumerate live resources of this
+   *   kind, so an owned orphan of it is never even a delete candidate.
+   * - `list-failed` — the list call itself failed. Transient or not, it means
+   *   this kind was not considered, which `pruned: []` alone would report as
+   *   "nothing to prune".
+   */
+  reason: "no-list-capability" | "list-failed";
+  /** Status and body for `list-failed`, so the caller can tell apart a 403 from a 500. */
+  detail?: string;
+}
+
 /**
  * Owned-only prune: for each manifested kind with `list` support, delete the
  * chant-owned live resources whose name is not in `desiredByKind`. Foreign
  * resources (no ownership label) are left alone.
+ *
+ * Returns what it could not consider alongside what it deleted — a kind with no
+ * `list`, or whose list call failed, is reported rather than dropped (#1447).
  */
 export async function pruneOrphans(
   desired: GcpResource[],
   resolve: (mapper: ResourceMapper, resource?: GcpResource) => { base: string; project: string },
   http: GcpHttp = defaultHttp,
   signal?: AbortSignal,
-): Promise<Array<{ kind: string; name: string; deleted: boolean }>> {
+): Promise<{
+  pruned: Array<{ kind: string; name: string; deleted: boolean }>;
+  notPrunable: GcpNotPrunable[];
+}> {
   const desiredByKind = new Map<string, Set<string>>();
   for (const r of desired) {
     if (!r.kind) continue;
@@ -581,12 +690,21 @@ export async function pruneOrphans(
   }
 
   const pruned: Array<{ kind: string; name: string; deleted: boolean }> = [];
+  const notPrunable: GcpNotPrunable[] = [];
   for (const [kind, keep] of desiredByKind) {
     const mapper = MAPPERS[kind];
-    if (!mapper?.list) continue;
+    if (!mapper?.list) {
+      console.log(`prune: cannot list kind ${kind} — owned orphans of it are not considered`);
+      notPrunable.push({ kind, reason: "no-list-capability" });
+      continue;
+    }
     const ctx = resolve(mapper, desired.find((r) => r.kind === kind));
     const res = await http("GET", mapper.list.url(ctx), undefined, signal);
-    if (res.status >= 300) continue;
+    if (res.status >= 300) {
+      console.log(`prune: listing kind ${kind} failed (${res.status}) — not considered`);
+      notPrunable.push({ kind, reason: "list-failed", detail: `${res.status}: ${res.text}` });
+      continue;
+    }
     for (const item of mapper.list.items(parseJson(res.text))) {
       if (!isChantOwned(item.labels) || keep.has(item.name)) continue;
       safeHeartbeat({ step: "prune", kind, name: item.name });
@@ -595,7 +713,7 @@ export async function pruneOrphans(
       pruned.push(result);
     }
   }
-  return pruned;
+  return { pruned, notPrunable };
 }
 
 /**
@@ -603,8 +721,13 @@ export async function pruneOrphans(
  * resource directly to its GCP REST API, targeting a local floci-gcp emulator or
  * real GCP by endpoint override. Unlike AWS/Azure/k8s, GCP has no native deploy
  * service to shell out to, so chant maps each `kind` to a REST call itself (the
- * `MAPPERS` dispatch table). Unknown kinds are skipped. Uses longInfra profile.
- * `http` is injectable for tests.
+ * `MAPPERS` dispatch table). Uses longInfra profile. `http` is injectable for
+ * tests.
+ *
+ * A kind `MAPPERS` does not cover is **reported, not dropped** — it comes back
+ * in `notAttempted` (#1447). Before that, it was a `console.log` and a
+ * populated `applied` array, so a caller could not tell a partial apply from a
+ * complete one and `ApplyOp` reported success either way.
  */
 export async function gcpApply(
   args: GcpApplyArgs,
@@ -613,6 +736,10 @@ export async function gcpApply(
 ): Promise<{
   applied: Array<{ kind: string; name: string; created: boolean; updated: boolean }>;
   pruned: Array<{ kind: string; name: string; deleted: boolean }>;
+  /** Declared resources no REST call was made for. Empty on a complete apply. */
+  notAttempted: GcpNotAttempted[];
+  /** Kinds the prune could not consider. Empty when `prune` is off. */
+  notPrunable: GcpNotPrunable[];
 }> {
   const resources = orderByReferences(parseManifest(readFileSync(args.manifestPath, "utf8"), args.manifestPath));
   const resolve = (mapper: ResourceMapper, resource?: GcpResource) => ({
@@ -621,10 +748,13 @@ export async function gcpApply(
   });
 
   const applied: Array<{ kind: string; name: string; created: boolean; updated: boolean }> = [];
+  const notAttempted: GcpNotAttempted[] = [];
   for (const r of resources) {
-    const mapper = r.kind ? MAPPERS[r.kind] : undefined;
+    const mapper = requireKind(r, args.manifestPath) ? MAPPERS[r.kind as string] : undefined;
     if (!mapper) {
-      if (r.kind) console.log(`skip: no mapper for kind ${r.kind}`);
+      const kind = r.kind as string;
+      console.log(`skip: no mapper for kind ${kind}`);
+      notAttempted.push({ kind, name: r.metadata?.name ?? "?", reason: "unsupported-kind" });
       continue;
     }
     const ctx = resolve(mapper, r);
@@ -635,8 +765,10 @@ export async function gcpApply(
     applied.push(result);
   }
 
-  const pruned = args.prune ? await pruneOrphans(resources, resolve, http, signal) : [];
-  return { applied, pruned };
+  const prune = args.prune
+    ? await pruneOrphans(resources, resolve, http, signal)
+    : { pruned: [], notPrunable: [] };
+  return { applied, pruned: prune.pruned, notAttempted, notPrunable: prune.notPrunable };
 }
 
 /**
@@ -679,15 +811,24 @@ export async function gcpDelete(
   args: GcpApplyArgs,
   signal?: AbortSignal,
   http: GcpHttp = defaultHttp,
-): Promise<{ deleted: Array<{ kind: string; name: string; deleted: boolean }> }> {
+): Promise<{
+  deleted: Array<{ kind: string; name: string; deleted: boolean }>;
+  /** Declared resources no delete was attempted for — the delete-side twin of
+   * `gcpApply`'s field, and the more consequential one: a caller reading only
+   * `deleted` would believe the manifest was fully torn down (#1447). */
+  notAttempted: GcpNotAttempted[];
+}> {
   // Delete in reverse dependency order: a referrer goes before the resource it
   // references.
   const resources = orderByReferences(parseManifest(readFileSync(args.manifestPath, "utf8"), args.manifestPath)).reverse();
   const deleted: Array<{ kind: string; name: string; deleted: boolean }> = [];
+  const notAttempted: GcpNotAttempted[] = [];
   for (const r of resources) {
-    const mapper = r.kind ? MAPPERS[r.kind] : undefined;
+    const mapper = requireKind(r, args.manifestPath) ? MAPPERS[r.kind as string] : undefined;
     if (!mapper) {
-      if (r.kind) console.log(`skip: no mapper for kind ${r.kind}`);
+      const kind = r.kind as string;
+      console.log(`skip: no mapper for kind ${kind}`);
+      notAttempted.push({ kind, name: r.metadata?.name ?? "?", reason: "unsupported-kind" });
       continue;
     }
     const base = (args.endpoint ?? mapper.defaultHost).replace(/\/$/, "");
@@ -697,5 +838,5 @@ export async function gcpDelete(
     console.log(`${result.deleted ? "deleted" : "absent"}: ${result.kind}/${result.name} (${base})`);
     deleted.push(result);
   }
-  return { deleted };
+  return { deleted, notAttempted };
 }

package/src/op/activities/index.ts

@@ -27,6 +27,9 @@ export {
   referencedNames,
   orderByReferences,
   pruneOrphans,
+  toApplyResult,
+  type GcpNotAttempted,
+  type GcpNotPrunable,
   chantOwnershipLabels,
   isChantOwned,
   resolveGcpProject,