@intentius/chant-lexicon-gcp 0.39.0 → 0.41.0

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "99b2ae36e1f0b8a8630ca7ca10b22d68fd9ad271939798bf7f39948a1b581d39",
+    "manifest.json": "7f3bd8b2a8cc81d44953c0e383b432c07b72f5d75405fc7a15d59736f39c7bee",
     "meta.json": "475f10909854d059a2e2d4fb541c058803422e38b9c64bd4d6858c0623eedb8c",
     "types/index.d.ts": "5433b54c04b57d6fda8f3d81ef92ed0aca87f7e8e5dd3ea92d8de6e62a3ccfab",
     "rules/hardcoded-project.ts": "228631d3159e1ffcce2359c66073d4ae59bb0285f378e46e446f416aec50481c",
@@ -37,5 +37,5 @@
     "skills/chant-gcp-patterns.md": "a7ef31c1eb2f7244d3f73952c300472ef94c1eb09bd7a1003281b89299b6b704",
     "skills/chant-gcp-gke.md": "be277019da9a722c851e47cd2dfb9c9536668948c3535fb20db7697e934c4e2b"
   },
-  "composite": "dd43cae524aba69f7713ccfd5f43c6c40a66d0a2d3656d99366335b550485964"
+  "composite": "be374ea7036813fbbfde4ff5d70f9797355c64073d13fdc67c68d7ca805479e4"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gcp",
-  "version": "0.39.0",
+  "version": "0.41.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GCP",
   "intrinsics": [],

package/dist/op/activities/gcp-apply.d.ts

@@ -1,6 +1,22 @@
-/** The GCP labels chant stamps on resources it creates. */
+import { type ApplyResult } from "@intentius/chant/apply";
+/**
+ * The GCP labels chant stamps on resources it creates.
+ *
+ * Only the managed-by marker, not stack/env: this applier has no ownership
+ * marker to hand — the serializer stamps those from project config onto the
+ * Config Connector object. Same shape the fly serializer uses when no ownership
+ * context is set.
+ */
 export declare function chantOwnershipLabels(): Record<string, string>;
-/** True when a live resource's labels carry chant's ownership marker. */
+/**
+ * True when a live resource's labels carry chant's ownership marker.
+ *
+ * Resolves through core's `hasOwnershipMarker` against the lexicon's declared
+ * GCP-resource channel (#1446) rather than comparing a string literal inline,
+ * so the stamp and the prune filter cannot drift. The key itself is unchanged
+ * and deliberately GCP-valid — see `../../ownership.ts` for why this surface
+ * cannot use core's `LABEL_OWNERSHIP_KEYS`.
+ */
 export declare function isChantOwned(labels: Record<string, string> | null | undefined): boolean;
 /** Minimal shape of a serialized CNRM resource (`*.cnrm.cloud.google.com`). */
 export interface GcpResource {
@@ -215,26 +231,94 @@ export interface GcpApplyArgs {
      */
     prune?: boolean;
 }
+/**
+ * Normalize a gcp apply/delete result into core's apply envelope (#1446).
+ *
+ * The lexicon keeps its own richer shape — `created`/`updated` per resource,
+ * the CNRM `kind` — and this projects it onto the shared tri-state so a caller
+ * can read any applier's result the same way. Core's contract is the interface;
+ * it is not a replacement for what this applier knows.
+ */
+export declare function toApplyResult(result: {
+    applied?: Array<{
+        kind: string;
+        name: string;
+        created: boolean;
+        updated: boolean;
+    }>;
+    deleted?: Array<{
+        kind: string;
+        name: string;
+        deleted: boolean;
+    }>;
+    pruned?: Array<{
+        kind: string;
+        name: string;
+        deleted: boolean;
+    }>;
+    notAttempted?: GcpNotAttempted[];
+    notPrunable?: GcpNotPrunable[];
+}): ApplyResult;
+/**
+ * A resource this run did not attempt, and why (#1447).
+ *
+ * The read path learned this in #1089/#1201: a read that never happened is not
+ * the same fact as a resource that is not there, and collapsing the two made
+ * "absent" mean both. `observation.ts` puts it as "a warn on stderr is not a
+ * signal in a change set" — and a `console.log` on stdout is not a signal in an
+ * apply result, for the same reason. So the skips ride the return value.
+ */
+export interface GcpNotAttempted {
+    kind: string;
+    name: string;
+    /** `MAPPERS` has no entry for this kind, so no REST call exists to make. */
+    reason: "unsupported-kind";
+}
+/** A kind an owned-only prune could not consider, and why (#1447). */
+export interface GcpNotPrunable {
+    kind: string;
+    /**
+     * - `no-list-capability` — the mapper cannot enumerate live resources of this
+     *   kind, so an owned orphan of it is never even a delete candidate.
+     * - `list-failed` — the list call itself failed. Transient or not, it means
+     *   this kind was not considered, which `pruned: []` alone would report as
+     *   "nothing to prune".
+     */
+    reason: "no-list-capability" | "list-failed";
+    /** Status and body for `list-failed`, so the caller can tell apart a 403 from a 500. */
+    detail?: string;
+}
 /**
  * Owned-only prune: for each manifested kind with `list` support, delete the
  * chant-owned live resources whose name is not in `desiredByKind`. Foreign
  * resources (no ownership label) are left alone.
+ *
+ * Returns what it could not consider alongside what it deleted — a kind with no
+ * `list`, or whose list call failed, is reported rather than dropped (#1447).
  */
 export declare function pruneOrphans(desired: GcpResource[], resolve: (mapper: ResourceMapper, resource?: GcpResource) => {
     base: string;
     project: string;
-}, http?: GcpHttp, signal?: AbortSignal): Promise<Array<{
-    kind: string;
-    name: string;
-    deleted: boolean;
-}>>;
+}, http?: GcpHttp, signal?: AbortSignal): Promise<{
+    pruned: Array<{
+        kind: string;
+        name: string;
+        deleted: boolean;
+    }>;
+    notPrunable: GcpNotPrunable[];
+}>;
 /**
  * The native GCP applier (#706) — read a built CNRM manifest and apply each
  * resource directly to its GCP REST API, targeting a local floci-gcp emulator or
  * real GCP by endpoint override. Unlike AWS/Azure/k8s, GCP has no native deploy
  * service to shell out to, so chant maps each `kind` to a REST call itself (the
- * `MAPPERS` dispatch table). Unknown kinds are skipped. Uses longInfra profile.
- * `http` is injectable for tests.
+ * `MAPPERS` dispatch table). Uses longInfra profile. `http` is injectable for
+ * tests.
+ *
+ * A kind `MAPPERS` does not cover is **reported, not dropped** — it comes back
+ * in `notAttempted` (#1447). Before that, it was a `console.log` and a
+ * populated `applied` array, so a caller could not tell a partial apply from a
+ * complete one and `ApplyOp` reported success either way.
  */
 export declare function gcpApply(args: GcpApplyArgs, signal?: AbortSignal, http?: GcpHttp): Promise<{
     applied: Array<{
@@ -248,6 +332,10 @@ export declare function gcpApply(args: GcpApplyArgs, signal?: AbortSignal, http?
         name: string;
         deleted: boolean;
     }>;
+    /** Declared resources no REST call was made for. Empty on a complete apply. */
+    notAttempted: GcpNotAttempted[];
+    /** Kinds the prune could not consider. Empty when `prune` is off. */
+    notPrunable: GcpNotPrunable[];
 }>;
 /**
  * Idempotently delete one resource: `DELETE` its resource URL. A 404 means it is
@@ -274,5 +362,9 @@ export declare function gcpDelete(args: GcpApplyArgs, signal?: AbortSignal, http
         name: string;
         deleted: boolean;
     }>;
+    /** Declared resources no delete was attempted for — the delete-side twin of
+     * `gcpApply`'s field, and the more consequential one: a caller reading only
+     * `deleted` would believe the manifest was fully torn down (#1447). */
+    notAttempted: GcpNotAttempted[];
 }>;
 //# sourceMappingURL=gcp-apply.d.ts.map

package/dist/op/activities/gcp-apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/gcp-apply.ts"],"names":[],"mappings":"AAYA,2DAA2D;AAC3D,wBAAgB,oBAAoB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE7D;AAED,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEvF;AAQD,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACtC,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,8DAA8D;AAC9D,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,IAAI,CAAC,EAAE;QACL,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,wBAAwB,CAAC,EAAE,OAAO,CAAC;QACnC,UAAU,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QACnC,aAAa,CAAC,EAAE,KAAK,CAAC;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAC;KAClG,CAAC;CACH;AAED,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE;QAAE,wBAAwB,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IACtE,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAClC,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACvG;AAED,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAID;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/D,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,OAAO,GAAG,KAAK,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;CAClE;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,OAAO,CAAC,kBAAkB,EAAE,OAAO,EAAE,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IACjG,8DAA8D;IAC9D,MAAM,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC;IACxC,8EAA8E;IAC9E,KAAK,CAAC,aAAa,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;CACnD;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,kCAAkC;IAClC,GAAG,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IACpD,4EAA4E;IAC5E,KAAK,CAAC,YAAY,EAAE,OAAO,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAC/F;AAED,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC7B,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC/E,iFAAiF;IACjF,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,oFAAoF;IACpF,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CAcnE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,gBAAgB,CAsB1E;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,GAAG,eAAe,CAOtE;AAED,eAAO,MAAM,mBAAmB,EAAE,cAmBjC,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,cA0B/B,CAAC;AAEF,kEAAkE;AAClE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,GAAG;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAKjF;AAED,eAAO,MAAM,qBAAqB,EAAE,cAuBnC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWtG;AAED,eAAO,MAAM,wBAAwB,EAAE,cAStC,CAAC;AAEF,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGzE;AAED,eAAO,MAAM,yBAAyB,EAAE,cAuBvC,CAAC;AAEF,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGpG;AAED,eAAO,MAAM,uBAAuB,EAAE,cAerC,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAOlD,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,EAAE,CAiB/D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAuBzE;AAID,kGAAkG;AAClG,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAQrG;AAED,6FAA6F;AAC7F,MAAM,MAAM,OAAO,GAAG,CACpB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAY/C;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EACtC,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAwB7E;AA4BD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,aAAa,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAU1E;AAED,MAAM,WAAW,YAAY;IAC3B,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;IACrB,4GAA4G;IAC5G,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,OAAO,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,WAAW,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAC9F,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,CAyBlE;AAED;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnF,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACjE,CAAC,CAwBD;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EACtC,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAiB3D;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAmB/E"}
+{"version":3,"file":"gcp-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/gcp-apply.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,KAAK,WAAW,EAGjB,MAAM,wBAAwB,CAAC;AAIhC;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEvF;AAQD,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACtC,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,8DAA8D;AAC9D,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,IAAI,CAAC,EAAE;QACL,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,wBAAwB,CAAC,EAAE,OAAO,CAAC;QACnC,UAAU,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QACnC,aAAa,CAAC,EAAE,KAAK,CAAC;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAC;KAClG,CAAC;CACH;AAED,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE;QAAE,wBAAwB,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IACtE,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAClC,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACvG;AAED,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAID;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/D,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,OAAO,GAAG,KAAK,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;CAClE;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,OAAO,CAAC,kBAAkB,EAAE,OAAO,EAAE,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IACjG,8DAA8D;IAC9D,MAAM,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC;IACxC,8EAA8E;IAC9E,KAAK,CAAC,aAAa,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;CACnD;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,kCAAkC;IAClC,GAAG,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IACpD,4EAA4E;IAC5E,KAAK,CAAC,YAAY,EAAE,OAAO,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAC/F;AAED,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC7B,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC/E,iFAAiF;IACjF,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,oFAAoF;IACpF,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CAcnE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,gBAAgB,CAsB1E;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,GAAG,eAAe,CAOtE;AAED,eAAO,MAAM,mBAAmB,EAAE,cAmBjC,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,cA0B/B,CAAC;AAEF,kEAAkE;AAClE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,GAAG;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAKjF;AAED,eAAO,MAAM,qBAAqB,EAAE,cAuBnC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWtG;AAED,eAAO,MAAM,wBAAwB,EAAE,cAStC,CAAC;AAEF,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGzE;AAED,eAAO,MAAM,yBAAyB,EAAE,cAuBvC,CAAC;AAEF,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGpG;AAED,eAAO,MAAM,uBAAuB,EAAE,cAerC,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAOlD,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,EAAE,CAiB/D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAuBzE;AAID,kGAAkG;AAClG,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAQrG;AAED,6FAA6F;AAC7F,MAAM,MAAM,OAAO,GAAG,CACpB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAY/C;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EACtC,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAwB7E;AA4BD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,aAAa,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD,OAAO,CAAC,IAAI,CAAC,CAkBf;AAqBD,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAU1E;AAED,MAAM,WAAW,YAAY;IAC3B,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;IACrB,4GAA4G;IAC5G,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACpC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACpF,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAClE,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjE,YAAY,CAAC,EAAE,eAAe,EAAE,CAAC;IACjC,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC;CAChC,GAAG,WAAW,CAoBd;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,MAAM,EAAE,oBAAoB,GAAG,aAAa,CAAC;IAC7C,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,OAAO,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,WAAW,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAC9F,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IACT,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChE,WAAW,EAAE,cAAc,EAAE,CAAC;CAC/B,CAAC,CAkCD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnF,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChE,+EAA+E;IAC/E,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,qEAAqE;IACrE,WAAW,EAAE,cAAc,EAAE,CAAC;CAC/B,CAAC,CA6BD;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EACtC,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAiB3D;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjE;;2EAEuE;IACvE,YAAY,EAAE,eAAe,EAAE,CAAC;CACjC,CAAC,CAsBD"}

package/dist/op/activities/index.d.ts

@@ -4,7 +4,7 @@
  * (`gcpApply`), which maps CNRM resources to GCP REST calls since GCP has no
  * native deployment service to shell out to.
  */
-export { gcpApply, gcpDelete, applyResource, deleteResource, waitForOperation, longRunningOperation, bucketInsertBody, pubSubTopicBody, pubSubSubscriptionBody, cloudRunServiceBody, secretBody, serviceAccountBody, storageBucketMapper, pubSubTopicMapper, pubSubSubscriptionMapper, cloudRunServiceMapper, secretManagerSecretMapper, gcpServiceAccountMapper, MAPPERS, referencedNames, orderByReferences, pruneOrphans, chantOwnershipLabels, isChantOwned, resolveGcpProject, parseManifest, } from "./gcp-apply.js";
+export { gcpApply, gcpDelete, applyResource, deleteResource, waitForOperation, longRunningOperation, bucketInsertBody, pubSubTopicBody, pubSubSubscriptionBody, cloudRunServiceBody, secretBody, serviceAccountBody, storageBucketMapper, pubSubTopicMapper, pubSubSubscriptionMapper, cloudRunServiceMapper, secretManagerSecretMapper, gcpServiceAccountMapper, MAPPERS, referencedNames, orderByReferences, pruneOrphans, toApplyResult, type GcpNotAttempted, type GcpNotPrunable, chantOwnershipLabels, isChantOwned, resolveGcpProject, parseManifest, } from "./gcp-apply.js";
 export type { GcpApplyArgs, GcpResource, CnrmStorageBucket, BucketInsertBody, PubSubTopicBody, ResourceMapper, OperationSpec, ListSpec, ApplyPlan, GcpHttp, } from "./gcp-apply.js";
 export { flociGcpUp, flociGcpDown, flociGcpRunCommand, flociGcpRmCommand, flociGcpExistsCommand, flociGcpHealthUrl, flociGcpEndpoint, } from "./floci-gcp.js";
 export type { FlociGcpUpArgs, FlociGcpDownArgs } from "./floci-gcp.js";

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,UAAU,EACV,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,wBAAwB,EACxB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,EACvB,OAAO,EACP,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,iBAAiB,EACjB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,aAAa,EACb,QAAQ,EACR,SAAS,EACT,OAAO,GACR,MAAM,aAAa,CAAC;AAIrB,OAAO,EACL,UAAU,EACV,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,UAAU,EACV,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,wBAAwB,EACxB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,EACvB,OAAO,EACP,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,oBAAoB,EACpB,YAAY,EACZ,iBAAiB,EACjB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,aAAa,EACb,QAAQ,EACR,SAAS,EACT,OAAO,GACR,MAAM,aAAa,CAAC;AAIrB,OAAO,EACL,UAAU,EACV,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC"}

package/dist/ownership.d.ts

@@ -0,0 +1,36 @@
+/**
+ * GCP's ownership marker channels (#1446).
+ *
+ * The gcp lexicon marks ownership on **two different surfaces**, and they
+ * legitimately use different key vocabularies:
+ *
+ * 1. **The Config Connector object** — what the serializer emits. Its
+ *    `metadata.labels` are Kubernetes labels, so it uses core's shared
+ *    `LABEL_OWNERSHIP_KEYS` (`app.kubernetes.io/managed-by`). That is the key
+ *    `plugin.ts` registers as the lexicon's `ownershipChannel` and the one the
+ *    read paths resolve through.
+ *
+ * 2. **The GCP resource itself** — what `gcpApply` PUTs to the REST API. GCP
+ *    label keys may not contain `/` or `.`, so `app.kubernetes.io/managed-by`
+ *    is not a legal key there. Hence {@link GCP_RESOURCE_OWNERSHIP_KEYS}.
+ *
+ * This is worth stating because the split looks like the bug #1446 found in the
+ * azure applier, and is not. Azure's serializer and applier both write ARM tags
+ * — one surface, and they had drifted onto two keys for no reason. Here the two
+ * surfaces are real and each key is the only legal one for its target.
+ *
+ * What #1446 changes is that the applier's predicate resolves through core's
+ * `hasOwnershipMarker` against a declared channel, rather than comparing a
+ * string literal inline. The key does not move; the drift risk does.
+ */
+import type { ChannelKeys } from "@intentius/chant/ownership";
+/**
+ * Ownership keys for labels on a live GCP resource — the surface `gcpApply`
+ * writes and `pruneOrphans` reads.
+ *
+ * GCP label keys are lowercase alphanumerics, `-` and `_` only, so this is the
+ * GCP-valid equivalent of core's label convention rather than that convention
+ * itself.
+ */
+export declare const GCP_RESOURCE_OWNERSHIP_KEYS: ChannelKeys;
+//# sourceMappingURL=ownership.d.ts.map

package/dist/ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../src/ownership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,EAAE,WAIzC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gcp",
-  "version": "0.39.0",
+  "version": "0.41.0",
   "description": "Google Cloud lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -76,7 +76,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.39.0",
+    "@intentius/chant": "^0.41.0",
     "typescript": "^5.9.3"
   }
 }

package/src/op/activities/gcp-apply.test.ts

@@ -1,4 +1,6 @@
 import { describe, test, expect } from "vitest";
+import { writeFileSync, unlinkSync } from "node:fs";
+import { describeApplyConformance } from "@intentius/chant-test-utils";
 import {
   bucketInsertBody,
   pubSubTopicBody,
@@ -12,6 +14,9 @@ import {
   referencedNames,
   orderByReferences,
   pruneOrphans,
+  gcpApply,
+  gcpDelete,
+  toApplyResult,
   chantOwnershipLabels,
   isChantOwned,
   pubSubSubscriptionBody,
@@ -454,12 +459,47 @@ describe("ownership + prune (#706)", () => {
       return { status: 200, text: "" }; // DELETE
     };
     const resolve = () => ({ base: "http://x", project: "p" });
-    const pruned = await pruneOrphans(desired, resolve, http);
+    const { pruned, notPrunable } = await pruneOrphans(desired, resolve, http);
     expect(pruned).toEqual([{ kind: "StorageBucket", name: "orphan", deleted: true }]);
+    expect(notPrunable).toEqual([]);
     expect(calls.filter((c) => c.method === "DELETE")).toEqual([
       { method: "DELETE", url: "http://x/storage/v1/b/orphan" },
     ]);
   });
+
+  // #1447. A kind the prune could not consider was `continue`, so `pruned: []`
+  // came back — which reads as "there was nothing to prune", not "I did not
+  // look at this kind". Same conflation the read path fixed in #1089/#1201.
+  test("a kind with no list capability is reported, not silently skipped", async () => {
+    // IAMServiceAccount is mapped but has no `list` spec.
+    const desired: GcpResource[] = [{ kind: "IAMServiceAccount", metadata: { name: "sa" } }];
+    const calls: string[] = [];
+    const http: GcpHttp = async (method) => {
+      calls.push(method);
+      return { status: 200, text: "{}" };
+    };
+    const { pruned, notPrunable } = await pruneOrphans(desired, () => ({ base: "http://x", project: "p" }), http);
+    expect(pruned).toEqual([]);
+    expect(notPrunable).toEqual([{ kind: "IAMServiceAccount", reason: "no-list-capability" }]);
+    // Reported without touching the transport at all.
+    expect(calls).toEqual([]);
+  });
+
+  // Not in #1447's list, same class: a failed LIST was also `continue`. A 403 or
+  // a 500 meant the kind went unconsidered and the result said nothing.
+  test("a failed list is reported, with the status, not silently skipped", async () => {
+    const desired: GcpResource[] = [{ kind: "StorageBucket", metadata: { name: "keep" } }];
+    const deletes: string[] = [];
+    const http: GcpHttp = async (method, url) => {
+      if (method === "DELETE") deletes.push(url);
+      return method === "GET" ? { status: 403, text: "forbidden" } : { status: 200, text: "" };
+    };
+    const { pruned, notPrunable } = await pruneOrphans(desired, () => ({ base: "http://x", project: "p" }), http);
+    expect(pruned).toEqual([]);
+    expect(notPrunable).toEqual([{ kind: "StorageBucket", reason: "list-failed", detail: "403: forbidden" }]);
+    // And nothing was deleted on the strength of a list that failed.
+    expect(deletes).toEqual([]);
+  });
 });
 
 describe("parseManifest (#711)", () => {
@@ -473,3 +513,196 @@ describe("parseManifest (#711)", () => {
     expect(docs.map((d) => d.kind)).toEqual(["StorageBucket", "PubSubTopic"]);
   });
 });
+
+/**
+ * #1447 — a resource `MAPPERS` has no entry for was dropped with a
+ * `console.log`, and the return value looked exactly like a complete apply.
+ * `ApplyOp` reported success over a partial one.
+ *
+ * The GCP lexicon serializes many more kinds than the six `MAPPERS` covers, so
+ * this is not a hypothetical: anything else in the manifest was silently not
+ * applied.
+ */
+describe("gcpApply / gcpDelete report what they did not attempt (#1447)", () => {
+  /** A manifest with one kind chant can apply and one it cannot. */
+  const manifest = (): string => {
+    const path = `/tmp/chant-1447-${process.pid}-${Math.random().toString(36).slice(2)}.json`;
+    writeFileSync(
+      path,
+      JSON.stringify([
+        { kind: "StorageBucket", metadata: { name: "mapped" }, spec: { location: "US" } },
+        { kind: "SQLInstance", metadata: { name: "unmapped" }, spec: {} },
+      ]),
+    );
+    return path;
+  };
+
+  const ok: GcpHttp = async (method) =>
+    method === "GET" ? { status: 404, text: "" } : { status: 200, text: "{}" };
+
+  test("an unmapped kind lands in notAttempted, not in applied", async () => {
+    const path = manifest();
+    try {
+      const res = await gcpApply({ manifestPath: path, endpoint: "http://x", project: "p" }, undefined, ok);
+      expect(res.applied.map((a) => a.name)).toEqual(["mapped"]);
+      expect(res.notAttempted).toEqual([
+        { kind: "SQLInstance", name: "unmapped", reason: "unsupported-kind" },
+      ]);
+    } finally {
+      unlinkSync(path);
+    }
+  });
+
+  // The distinction the old shape could not express: without notAttempted, this
+  // result and one from a manifest that never declared SQLInstance are identical.
+  test("a fully-applied manifest reports notAttempted empty", async () => {
+    const path = `/tmp/chant-1447-full-${process.pid}.json`;
+    writeFileSync(path, JSON.stringify([{ kind: "StorageBucket", metadata: { name: "only" }, spec: {} }]));
+    try {
+      const res = await gcpApply({ manifestPath: path, endpoint: "http://x", project: "p" }, undefined, ok);
+      expect(res.applied).toHaveLength(1);
+      expect(res.notAttempted).toEqual([]);
+      expect(res.notPrunable).toEqual([]);
+    } finally {
+      unlinkSync(path);
+    }
+  });
+
+  // The delete side matters more: a caller reading only `deleted` would believe
+  // the manifest was fully torn down.
+  test("gcpDelete reports the resources it never attempted to delete", async () => {
+    const path = manifest();
+    try {
+      const res = await gcpDelete({ manifestPath: path, endpoint: "http://x", project: "p" }, undefined, ok);
+      expect(res.deleted.map((d) => d.name)).toEqual(["mapped"]);
+      expect(res.notAttempted).toEqual([
+        { kind: "SQLInstance", name: "unmapped", reason: "unsupported-kind" },
+      ]);
+    } finally {
+      unlinkSync(path);
+    }
+  });
+
+  // A malformed manifest is a different fact from an unsupported kind — one is a
+  // bug in the input, the other a known gap in coverage. Only the second belongs
+  // in notAttempted.
+  test("a manifest entry with no kind throws instead of being skipped", async () => {
+    const path = `/tmp/chant-1447-nokind-${process.pid}.json`;
+    writeFileSync(path, JSON.stringify([{ metadata: { name: "kindless" } }]));
+    try {
+      await expect(
+        gcpApply({ manifestPath: path, endpoint: "http://x", project: "p" }, undefined, ok),
+      ).rejects.toThrow(/no "kind".*kindless.*malformed manifest/s);
+    } finally {
+      unlinkSync(path);
+    }
+  });
+});
+
+/**
+ * The shared apply-contract suite (#1446), run against gcp's own mocked
+ * transport. gcp is the reference adopter because #1447 already gave it the
+ * not-attempted facts; this proves the seam carries them.
+ *
+ * Assertion 3 ("accounts for every resource in the plan") is the one that fails
+ * on pre-#1447 gcp — an unmapped kind was in the plan and in no bucket.
+ */
+describeApplyConformance({
+  lexicon: "gcp",
+  scenarios: [
+    {
+      name: "a manifest with one mapped and one unmapped kind",
+      plan: [
+        { kind: "StorageBucket", name: "mapped" },
+        { kind: "SQLInstance", name: "unmapped" },
+      ],
+      run: async () => {
+        const path = `/tmp/chant-1446-gcp-${process.pid}.json`;
+        writeFileSync(
+          path,
+          JSON.stringify([
+            { kind: "StorageBucket", metadata: { name: "mapped" }, spec: { location: "US" } },
+            { kind: "SQLInstance", metadata: { name: "unmapped" }, spec: {} },
+          ]),
+        );
+        try {
+          const http: GcpHttp = async (method) =>
+            method === "GET" ? { status: 404, text: "" } : { status: 200, text: "{}" };
+          return toApplyResult(
+            await gcpApply({ manifestPath: path, endpoint: "http://x", project: "p" }, undefined, http),
+          );
+        } finally {
+          unlinkSync(path);
+        }
+      },
+      expectApplied: ["StorageBucket/mapped"],
+      expectNotAttempted: ["SQLInstance/unmapped"],
+    },
+  ],
+  pruneScenarios: [
+    {
+      name: "an owned orphan beside a foreign resource in the same project",
+      ownedOrphan: "orphan",
+      foreign: "foreign",
+      run: async () => {
+        const deletes: string[] = [];
+        const live = {
+          items: [
+            { name: "keep", labels: { "managed-by": "chant" } },
+            { name: "orphan", labels: { "managed-by": "chant" } },
+            { name: "foreign", labels: { "managed-by": "terraform" } },
+          ],
+        };
+        const path = `/tmp/chant-1446-gcp-prune-${process.pid}.json`;
+        writeFileSync(
+          path,
+          JSON.stringify([{ kind: "StorageBucket", metadata: { name: "keep" }, spec: {} }]),
+        );
+        try {
+          const http: GcpHttp = async (method, url) => {
+            if (method === "DELETE") deletes.push(url);
+            if (method === "GET" && url.includes("/b?")) return { status: 200, text: JSON.stringify(live) };
+            if (method === "GET") return { status: 200, text: "{}" }; // `keep` already exists
+            return { status: 200, text: "{}" };
+          };
+          const result = toApplyResult(
+            await gcpApply(
+              { manifestPath: path, endpoint: "http://x", project: "p", prune: true },
+              undefined,
+              http,
+            ),
+          );
+          return { result, deletes };
+        } finally {
+          unlinkSync(path);
+        }
+      },
+    },
+  ],
+  idempotenceScenarios: [
+    {
+      name: "the same manifest applied twice",
+      run: async () => {
+        const path = `/tmp/chant-1446-gcp-idem-${process.pid}.json`;
+        writeFileSync(
+          path,
+          JSON.stringify([{ kind: "StorageBucket", metadata: { name: "b" }, spec: { location: "US" } }]),
+        );
+        try {
+          let exists = false;
+          const http: GcpHttp = async (method) => {
+            if (method === "GET") return exists ? { status: 200, text: "{}" } : { status: 404, text: "" };
+            exists = true;
+            return { status: 200, text: "{}" };
+          };
+          const args = { manifestPath: path, endpoint: "http://x", project: "p" };
+          const first = toApplyResult(await gcpApply(args, undefined, http));
+          const second = toApplyResult(await gcpApply(args, undefined, http));
+          return { first, second };
+        } finally {
+          unlinkSync(path);
+        }
+      },
+    },
+  ],
+});

package/src/op/activities/gcp-apply.ts

@@ -1,23 +1,40 @@
 import { readFileSync } from "node:fs";
 import { parseYAML } from "@intentius/chant/yaml";
 import { safeHeartbeat, sleep } from "@intentius/chant/op";
+import { hasOwnershipMarker, OWNERSHIP_MANAGED_BY_VALUE } from "@intentius/chant/ownership";
+import { GCP_RESOURCE_OWNERSHIP_KEYS } from "../../ownership";
+import {
+  applyResult,
+  type ApplyResult,
+  type AppliedResource,
+  type NotAttemptedResource,
+} from "@intentius/chant/apply";
 
 const PROJECT_ID_ANNOTATION = "cnrm.cloud.google.com/project-id";
 
-// Ownership marker stamped as a GCP resource label so `prune` can identify what
-// chant created (GCP label keys can't hold the k8s `app.kubernetes.io/managed-by`
-// slash/dot form, so this is the GCP-valid equivalent).
-const OWNERSHIP_LABEL_KEY = "managed-by";
-const OWNERSHIP_LABEL_VALUE = "chant";
-
-/** The GCP labels chant stamps on resources it creates. */
+/**
+ * The GCP labels chant stamps on resources it creates.
+ *
+ * Only the managed-by marker, not stack/env: this applier has no ownership
+ * marker to hand — the serializer stamps those from project config onto the
+ * Config Connector object. Same shape the fly serializer uses when no ownership
+ * context is set.
+ */
 export function chantOwnershipLabels(): Record<string, string> {
-  return { [OWNERSHIP_LABEL_KEY]: OWNERSHIP_LABEL_VALUE };
+  return { [GCP_RESOURCE_OWNERSHIP_KEYS.managedBy]: OWNERSHIP_MANAGED_BY_VALUE };
 }
 
-/** True when a live resource's labels carry chant's ownership marker. */
+/**
+ * True when a live resource's labels carry chant's ownership marker.
+ *
+ * Resolves through core's `hasOwnershipMarker` against the lexicon's declared
+ * GCP-resource channel (#1446) rather than comparing a string literal inline,
+ * so the stamp and the prune filter cannot drift. The key itself is unchanged
+ * and deliberately GCP-valid — see `../../ownership.ts` for why this surface
+ * cannot use core's `LABEL_OWNERSHIP_KEYS`.
+ */
 export function isChantOwned(labels: Record<string, string> | null | undefined): boolean {
-  return labels?.[OWNERSHIP_LABEL_KEY] === OWNERSHIP_LABEL_VALUE;
+  return hasOwnershipMarker(labels ?? undefined, GCP_RESOURCE_OWNERSHIP_KEYS);
 }
 
 /** Merge the ownership marker into a create/update body's `labels`. */
@@ -533,6 +550,25 @@ export async function waitForOperation(
   throw new Error(`operation did not complete within timeout: ${pollUrl}`);
 }
 
+/**
+ * A manifest entry with no `kind` is malformed, not unsupported (#1447).
+ *
+ * The old guard skipped it in silence, which put a hand-written or truncated
+ * manifest in the same bucket as a kind chant simply has no mapper for. One is
+ * a bug in the input and the other is a known gap in coverage; only the second
+ * belongs in `notAttempted`. Throws so the first surfaces.
+ */
+function requireKind(resource: GcpResource, manifestPath: string): boolean {
+  if (!resource.kind) {
+    const name = resource.metadata?.name;
+    throw new Error(
+      `${manifestPath}: manifest entry has no "kind"${name ? ` (metadata.name: ${name})` : ""} — ` +
+        `a CNRM resource must declare one. This is a malformed manifest, not an unsupported kind.`,
+    );
+  }
+  return true;
+}
+
 /** Parse a built manifest into CNRM resource objects — YAML (multi-doc) or JSON. Pure. */
 export function parseManifest(content: string, path: string): GcpResource[] {
   if (/\.json$/i.test(path)) {
@@ -561,17 +597,90 @@ export interface GcpApplyArgs {
   prune?: boolean;
 }
 
+/**
+ * Normalize a gcp apply/delete result into core's apply envelope (#1446).
+ *
+ * The lexicon keeps its own richer shape — `created`/`updated` per resource,
+ * the CNRM `kind` — and this projects it onto the shared tri-state so a caller
+ * can read any applier's result the same way. Core's contract is the interface;
+ * it is not a replacement for what this applier knows.
+ */
+export function toApplyResult(result: {
+  applied?: Array<{ kind: string; name: string; created: boolean; updated: boolean }>;
+  deleted?: Array<{ kind: string; name: string; deleted: boolean }>;
+  pruned?: Array<{ kind: string; name: string; deleted: boolean }>;
+  notAttempted?: GcpNotAttempted[];
+  notPrunable?: GcpNotPrunable[];
+}): ApplyResult {
+  const applied: AppliedResource[] = (result.applied ?? []).map((a) => ({
+    kind: a.kind,
+    name: a.name,
+    action: a.created ? "created" : a.updated ? "updated" : "unchanged",
+  }));
+  const notAttempted: NotAttemptedResource[] = [
+    ...(result.notAttempted ?? []).map((n) => ({ kind: n.kind, name: n.name, reason: n.reason })),
+    // A kind the prune could not consider has no single resource name — the
+    // whole kind went unexamined, which `not-prunable` is the reason for.
+    ...(result.notPrunable ?? []).map((n) => ({
+      kind: n.kind,
+      name: "*",
+      reason: "not-prunable" as const,
+      ...(n.detail ? { detail: n.detail } : {}),
+    })),
+  ];
+  // `gcpDelete` reports deletions as `deleted`; they are prunes in the shared
+  // vocabulary — the applier removed something the plan no longer wants.
+  return applyResult(applied, result.pruned ?? result.deleted ?? [], notAttempted);
+}
+
+/**
+ * A resource this run did not attempt, and why (#1447).
+ *
+ * The read path learned this in #1089/#1201: a read that never happened is not
+ * the same fact as a resource that is not there, and collapsing the two made
+ * "absent" mean both. `observation.ts` puts it as "a warn on stderr is not a
+ * signal in a change set" — and a `console.log` on stdout is not a signal in an
+ * apply result, for the same reason. So the skips ride the return value.
+ */
+export interface GcpNotAttempted {
+  kind: string;
+  name: string;
+  /** `MAPPERS` has no entry for this kind, so no REST call exists to make. */
+  reason: "unsupported-kind";
+}
+
+/** A kind an owned-only prune could not consider, and why (#1447). */
+export interface GcpNotPrunable {
+  kind: string;
+  /**
+   * - `no-list-capability` — the mapper cannot enumerate live resources of this
+   *   kind, so an owned orphan of it is never even a delete candidate.
+   * - `list-failed` — the list call itself failed. Transient or not, it means
+   *   this kind was not considered, which `pruned: []` alone would report as
+   *   "nothing to prune".
+   */
+  reason: "no-list-capability" | "list-failed";
+  /** Status and body for `list-failed`, so the caller can tell apart a 403 from a 500. */
+  detail?: string;
+}
+
 /**
  * Owned-only prune: for each manifested kind with `list` support, delete the
  * chant-owned live resources whose name is not in `desiredByKind`. Foreign
  * resources (no ownership label) are left alone.
+ *
+ * Returns what it could not consider alongside what it deleted — a kind with no
+ * `list`, or whose list call failed, is reported rather than dropped (#1447).
  */
 export async function pruneOrphans(
   desired: GcpResource[],
   resolve: (mapper: ResourceMapper, resource?: GcpResource) => { base: string; project: string },
   http: GcpHttp = defaultHttp,
   signal?: AbortSignal,
-): Promise<Array<{ kind: string; name: string; deleted: boolean }>> {
+): Promise<{
+  pruned: Array<{ kind: string; name: string; deleted: boolean }>;
+  notPrunable: GcpNotPrunable[];
+}> {
   const desiredByKind = new Map<string, Set<string>>();
   for (const r of desired) {
     if (!r.kind) continue;
@@ -581,12 +690,21 @@ export async function pruneOrphans(
   }
 
   const pruned: Array<{ kind: string; name: string; deleted: boolean }> = [];
+  const notPrunable: GcpNotPrunable[] = [];
   for (const [kind, keep] of desiredByKind) {
     const mapper = MAPPERS[kind];
-    if (!mapper?.list) continue;
+    if (!mapper?.list) {
+      console.log(`prune: cannot list kind ${kind} — owned orphans of it are not considered`);
+      notPrunable.push({ kind, reason: "no-list-capability" });
+      continue;
+    }
     const ctx = resolve(mapper, desired.find((r) => r.kind === kind));
     const res = await http("GET", mapper.list.url(ctx), undefined, signal);
-    if (res.status >= 300) continue;
+    if (res.status >= 300) {
+      console.log(`prune: listing kind ${kind} failed (${res.status}) — not considered`);
+      notPrunable.push({ kind, reason: "list-failed", detail: `${res.status}: ${res.text}` });
+      continue;
+    }
     for (const item of mapper.list.items(parseJson(res.text))) {
       if (!isChantOwned(item.labels) || keep.has(item.name)) continue;
       safeHeartbeat({ step: "prune", kind, name: item.name });
@@ -595,7 +713,7 @@ export async function pruneOrphans(
       pruned.push(result);
     }
   }
-  return pruned;
+  return { pruned, notPrunable };
 }
 
 /**
@@ -603,8 +721,13 @@ export async function pruneOrphans(
  * resource directly to its GCP REST API, targeting a local floci-gcp emulator or
  * real GCP by endpoint override. Unlike AWS/Azure/k8s, GCP has no native deploy
  * service to shell out to, so chant maps each `kind` to a REST call itself (the
- * `MAPPERS` dispatch table). Unknown kinds are skipped. Uses longInfra profile.
- * `http` is injectable for tests.
+ * `MAPPERS` dispatch table). Uses longInfra profile. `http` is injectable for
+ * tests.
+ *
+ * A kind `MAPPERS` does not cover is **reported, not dropped** — it comes back
+ * in `notAttempted` (#1447). Before that, it was a `console.log` and a
+ * populated `applied` array, so a caller could not tell a partial apply from a
+ * complete one and `ApplyOp` reported success either way.
  */
 export async function gcpApply(
   args: GcpApplyArgs,
@@ -613,6 +736,10 @@ export async function gcpApply(
 ): Promise<{
   applied: Array<{ kind: string; name: string; created: boolean; updated: boolean }>;
   pruned: Array<{ kind: string; name: string; deleted: boolean }>;
+  /** Declared resources no REST call was made for. Empty on a complete apply. */
+  notAttempted: GcpNotAttempted[];
+  /** Kinds the prune could not consider. Empty when `prune` is off. */
+  notPrunable: GcpNotPrunable[];
 }> {
   const resources = orderByReferences(parseManifest(readFileSync(args.manifestPath, "utf8"), args.manifestPath));
   const resolve = (mapper: ResourceMapper, resource?: GcpResource) => ({
@@ -621,10 +748,13 @@ export async function gcpApply(
   });
 
   const applied: Array<{ kind: string; name: string; created: boolean; updated: boolean }> = [];
+  const notAttempted: GcpNotAttempted[] = [];
   for (const r of resources) {
-    const mapper = r.kind ? MAPPERS[r.kind] : undefined;
+    const mapper = requireKind(r, args.manifestPath) ? MAPPERS[r.kind as string] : undefined;
     if (!mapper) {
-      if (r.kind) console.log(`skip: no mapper for kind ${r.kind}`);
+      const kind = r.kind as string;
+      console.log(`skip: no mapper for kind ${kind}`);
+      notAttempted.push({ kind, name: r.metadata?.name ?? "?", reason: "unsupported-kind" });
       continue;
     }
     const ctx = resolve(mapper, r);
@@ -635,8 +765,10 @@ export async function gcpApply(
     applied.push(result);
   }
 
-  const pruned = args.prune ? await pruneOrphans(resources, resolve, http, signal) : [];
-  return { applied, pruned };
+  const prune = args.prune
+    ? await pruneOrphans(resources, resolve, http, signal)
+    : { pruned: [], notPrunable: [] };
+  return { applied, pruned: prune.pruned, notAttempted, notPrunable: prune.notPrunable };
 }
 
 /**
@@ -679,15 +811,24 @@ export async function gcpDelete(
   args: GcpApplyArgs,
   signal?: AbortSignal,
   http: GcpHttp = defaultHttp,
-): Promise<{ deleted: Array<{ kind: string; name: string; deleted: boolean }> }> {
+): Promise<{
+  deleted: Array<{ kind: string; name: string; deleted: boolean }>;
+  /** Declared resources no delete was attempted for — the delete-side twin of
+   * `gcpApply`'s field, and the more consequential one: a caller reading only
+   * `deleted` would believe the manifest was fully torn down (#1447). */
+  notAttempted: GcpNotAttempted[];
+}> {
   // Delete in reverse dependency order: a referrer goes before the resource it
   // references.
   const resources = orderByReferences(parseManifest(readFileSync(args.manifestPath, "utf8"), args.manifestPath)).reverse();
   const deleted: Array<{ kind: string; name: string; deleted: boolean }> = [];
+  const notAttempted: GcpNotAttempted[] = [];
   for (const r of resources) {
-    const mapper = r.kind ? MAPPERS[r.kind] : undefined;
+    const mapper = requireKind(r, args.manifestPath) ? MAPPERS[r.kind as string] : undefined;
     if (!mapper) {
-      if (r.kind) console.log(`skip: no mapper for kind ${r.kind}`);
+      const kind = r.kind as string;
+      console.log(`skip: no mapper for kind ${kind}`);
+      notAttempted.push({ kind, name: r.metadata?.name ?? "?", reason: "unsupported-kind" });
       continue;
     }
     const base = (args.endpoint ?? mapper.defaultHost).replace(/\/$/, "");
@@ -697,5 +838,5 @@ export async function gcpDelete(
     console.log(`${result.deleted ? "deleted" : "absent"}: ${result.kind}/${result.name} (${base})`);
     deleted.push(result);
   }
-  return { deleted };
+  return { deleted, notAttempted };
 }

package/src/op/activities/index.ts

@@ -27,6 +27,9 @@ export {
   referencedNames,
   orderByReferences,
   pruneOrphans,
+  toApplyResult,
+  type GcpNotAttempted,
+  type GcpNotPrunable,
   chantOwnershipLabels,
   isChantOwned,
   resolveGcpProject,

package/src/ownership.ts

@@ -0,0 +1,41 @@
+/**
+ * GCP's ownership marker channels (#1446).
+ *
+ * The gcp lexicon marks ownership on **two different surfaces**, and they
+ * legitimately use different key vocabularies:
+ *
+ * 1. **The Config Connector object** — what the serializer emits. Its
+ *    `metadata.labels` are Kubernetes labels, so it uses core's shared
+ *    `LABEL_OWNERSHIP_KEYS` (`app.kubernetes.io/managed-by`). That is the key
+ *    `plugin.ts` registers as the lexicon's `ownershipChannel` and the one the
+ *    read paths resolve through.
+ *
+ * 2. **The GCP resource itself** — what `gcpApply` PUTs to the REST API. GCP
+ *    label keys may not contain `/` or `.`, so `app.kubernetes.io/managed-by`
+ *    is not a legal key there. Hence {@link GCP_RESOURCE_OWNERSHIP_KEYS}.
+ *
+ * This is worth stating because the split looks like the bug #1446 found in the
+ * azure applier, and is not. Azure's serializer and applier both write ARM tags
+ * — one surface, and they had drifted onto two keys for no reason. Here the two
+ * surfaces are real and each key is the only legal one for its target.
+ *
+ * What #1446 changes is that the applier's predicate resolves through core's
+ * `hasOwnershipMarker` against a declared channel, rather than comparing a
+ * string literal inline. The key does not move; the drift risk does.
+ */
+
+import type { ChannelKeys } from "@intentius/chant/ownership";
+
+/**
+ * Ownership keys for labels on a live GCP resource — the surface `gcpApply`
+ * writes and `pruneOrphans` reads.
+ *
+ * GCP label keys are lowercase alphanumerics, `-` and `_` only, so this is the
+ * GCP-valid equivalent of core's label convention rather than that convention
+ * itself.
+ */
+export const GCP_RESOURCE_OWNERSHIP_KEYS: ChannelKeys = {
+  managedBy: "managed-by",
+  stack: "chant-stack",
+  env: "chant-env",
+};