@nitra/cfr 0.5.0 → 0.6.0

package/README.md

@@ -93,10 +93,16 @@ heard of, and never will until someone points it out.
 
 `kcc-inventory` is that someone. Per namespace (any namespace carrying the
 annotation `cnrm.cloud.google.com/project-id`), it compares what's live in
-the GCP project against what's declared under KCC, for
-`IAMServiceAccount`, `IAMServiceAccountKey`, `ArtifactRegistryRepository`,
-`ContainerCluster`, `ContainerNodePool`, `StorageBucket`, `ComputeAddress`,
-`DNSManagedZone`, `DNSRecordSet`, and `IAMPolicyMember`.
+the GCP project against what's declared under KCC. Besides IAM, GKE,
+Artifact Registry, buckets, addresses and Cloud DNS, it includes Cloud Run
+(`RunService`, `RunJob`), `CloudSchedulerJob`, `EventarcTrigger`, Pub/Sub,
+Secret Manager, VPC Access, KMS, and the Cloud Run HTTP(S) load-balancer
+chain (network, subnetwork, backend service, serverless NEG, URL map,
+target HTTPS proxy, global forwarding rule, and SSL certificates).
+
+Location-scoped resources use the canonical `location/name` ID, preventing
+resources with the same name in different regions from being merged. IAM
+bindings on a `RunService` are normalized to the same identity.
 
 Read-only — it reports, it doesn't touch anything.
 
@@ -189,6 +195,10 @@ carries the same stale-cache/GKE-managed notes described above.
 Same requirements as `kcc-inventory` — no `gcloud`/`kubectl` needed, GKE
 only, `--include-system` to see GCP-managed noise.
 
+## Changelog
+
+See [CHANGELOG.md](https://github.com/nitra/cfr/blob/main/CHANGELOG.md).
+
 ## License
 
 MIT

package/lib/get-resources.mjs

@@ -1,5 +1,5 @@
 // Сирий збір фактів для одного KCC namespace: що є "живого" в GCP-проєкті і
-// що заявлено як Config Connector CR у цьому namespace — для кожного з 10
+// що заявлено як Config Connector CR у цьому namespace — для кожного з
 // видів ресурсів. Жодного diff-у, жодного форматування, жодного I/O в
 // консоль: тільки звернення до GCP REST API (gcp-rest.mjs) і Kubernetes
 // REST API (k8s-rest.mjs), і нормалізація результату в плаский список.
@@ -24,6 +24,23 @@ export const KIND_ORDER = [
   'ComputeAddress',
   'DNSManagedZone',
   'DNSRecordSet',
+  'RunService',
+  'RunJob',
+  'CloudSchedulerJob',
+  'EventarcTrigger',
+  'PubSubTopic',
+  'PubSubSubscription',
+  'SecretManagerSecret',
+  'VPCAccessConnector',
+  'ComputeNetwork',
+  'ComputeSubnetwork',
+  'KMSCryptoKey',
+  'ComputeBackendService',
+  'ComputeNetworkEndpointGroup',
+  'ComputeURLMap',
+  'ComputeTargetHTTPSProxy',
+  'ComputeGlobalForwardingRule',
+  'ComputeSSLCertificate',
   'IAMPolicyMember',
 ];
 
@@ -62,7 +79,7 @@ async function listRegionalAddressIds(project) {
     for (const [scopeKey, val] of Object.entries(data.items || {})) {
       if (!val.addresses) continue;
       const region = scopeKey.replace(/^regions\//, '');
-      for (const a of val.addresses) out.push(`${a.name}/${region}`);
+      for (const a of val.addresses) out.push(`${region}/${a.name}`);
     }
     pageToken = data.nextPageToken;
   } while (pageToken);
@@ -71,13 +88,46 @@ async function listRegionalAddressIds(project) {
 
 async function listGlobalAddressIds(project) {
   const items = await paginate(`${COMPUTE_API}/projects/${project}/global/addresses`, { pageSize: 500 }, 'items');
-  return items.map((a) => `${a.name}/global`);
+  return items.map((a) => `global/${a.name}`);
 }
 
 function stripPrefix(s, prefix) {
   return s.startsWith(prefix) ? s.slice(prefix.length) : s;
 }
 
+// Один ID для всіх location/region/zone ресурсів: location/name. Це не дає
+// однаковим іменам у різних регіонах зливатися в один inventory запис.
+function assetScopedId(asset, collection) {
+  const m = (asset.name || '').match(new RegExp(`/(?:locations|regions|zones)/([^/]+)/${collection}/([^/]+)$`));
+  return m && `${m[1]}/${m[2]}`;
+}
+
+function kccScopedId(item, { defaultLocation, name = (i) => i.spec && i.spec.resourceID } = {}) {
+  const spec = item.spec || {};
+  const resourceName = name(item) || (item.metadata && item.metadata.name);
+  const location = spec.location || spec.region || spec.zone || defaultLocation;
+  return location && resourceName ? `${location}/${resourceName}` : null;
+}
+
+function resourceId(item) {
+  return (item.spec && item.spec.resourceID) || (item.metadata && item.metadata.name);
+}
+
+function liveScopedIds(assets, type, collection) {
+  return assets.filter((a) => a.assetType === type).map((a) => assetScopedId(a, collection)).filter(Boolean);
+}
+
+function assetGlobalOrScopedId(asset, collection) {
+  const scoped = assetScopedId(asset, collection);
+  if (scoped) return scoped;
+  const global = (asset.name || '').match(new RegExp(`/global/${collection}/([^/]+)$`));
+  return global && `global/${global[1]}`;
+}
+
+function liveGlobalOrScopedIds(assets, type, collection) {
+  return assets.filter((a) => a.assetType === type).map((a) => assetGlobalOrScopedId(a, collection)).filter(Boolean);
+}
+
 // --- фільтри GCP-системного шуму (див. includeSystem) ----------------------
 
 const SA_SYSTEM = [
@@ -121,6 +171,8 @@ function assetResId(entry, project) {
   const mAr = res.match(/\/repositories\/([^/]+)$/);
   if (mAr && assetType === 'artifactregistry.googleapis.com/Repository') return `ar/${mAr[1]}`;
   if (assetType === 'storage.googleapis.com/Bucket') return 'bucket/' + stripPrefix(res, '//storage.googleapis.com/');
+  const mRunService = res.match(/\/projects\/[^/]+\/locations\/([^/]+)\/services\/([^/]+)$/);
+  if (mRunService && assetType === 'run.googleapis.com/Service') return `run-service/${mRunService[1]}/${mRunService[2]}`;
   return 'other/' + stripPrefix(res, '//');
 }
 
@@ -141,7 +193,7 @@ function kccSaId(ref, project) {
   return '?';
 }
 
-function kccPolicyMemberId(item, project) {
+function kccPolicyMemberId(item, project, runServiceRefs) {
   const ref = (item.spec && item.spec.resourceRef) || {};
   switch (ref.kind) {
     case 'Project':
@@ -152,6 +204,12 @@ function kccPolicyMemberId(item, project) {
       return 'ar/' + kccArId(ref);
     case 'StorageBucket':
       return 'bucket/' + (ref.external || ref.name || '?');
+    case 'RunService': {
+      const external = ref.external || '';
+      const m = external.match(/projects\/[^/]+\/locations\/([^/]+)\/services\/([^/]+)$/);
+      if (m) return `run-service/${m[1]}/${m[2]}`;
+      return runServiceRefs.get(ref.name) || `run-service/?/${ref.name || '?'}`;
+    }
     default:
       return 'other/' + (ref.external || ref.name || '?');
   }
@@ -227,39 +285,36 @@ export async function collectNamespace(namespace, { includeSystem = false } = {}
   )).map((n) => n.split('/').pop()), 'kcc');
 
   // --- ArtifactRegistryRepository -------------------------------------------
-  let liveAr = byType('artifactregistry.googleapis.com/Repository')
-    .map((a) => {
-      const m = (a.name || '').match(/\/repositories\/([^/]+)$/);
-      return m && m[1];
-    })
-    .filter(Boolean);
+  let liveAr = liveScopedIds(assets, 'artifactregistry.googleapis.com/Repository', 'repositories');
   if (!includeSystem) liveAr = liveAr.filter((r) => !isSystem(AR_SYSTEM, r));
   push('ArtifactRegistryRepository', liveAr, 'gcp');
   push('ArtifactRegistryRepository', await kccField(
     'ArtifactRegistryRepository', namespace,
-    (i) => i.spec && i.spec.resourceID,
+    (i) => kccScopedId(i),
   ), 'kcc');
 
   // --- ContainerCluster + ContainerNodePool ---------------------------------
-  push('ContainerCluster', byType('container.googleapis.com/Cluster').map((a) => a.displayName), 'gcp');
-  push('ContainerCluster', await kccField(
-    'ContainerCluster', namespace,
-    (i) => i.spec && i.spec.resourceID,
-  ), 'kcc');
+  push('ContainerCluster', liveScopedIds(assets, 'container.googleapis.com/Cluster', 'clusters'), 'gcp');
+  const containerClusterItems = await listCustomObjects('ContainerCluster', namespace);
+  push('ContainerCluster', containerClusterItems.map((i) => kccScopedId(i)).filter(Boolean), 'kcc');
+  const clusterRefs = new Map(containerClusterItems.map((i) => [i.metadata && i.metadata.name, kccScopedId(i)]));
 
   const livePool = [];
   for (const a of byType('container.googleapis.com/NodePool')) {
     const m = (a.name || '').match(/\/clusters\/([^/]+)\/nodePools\/([^/]+)$/);
     if (!m) continue;
     const [, cluster, pool] = m;
-    if (includeSystem || !NODEPOOL_SYSTEM.test(pool)) livePool.push(`${cluster}/${pool}`);
+    const location = (a.name || '').match(/\/locations\/([^/]+)\/clusters\/[^/]+\/nodePools\/[^/]+$/)?.[1];
+    if (includeSystem || !NODEPOOL_SYSTEM.test(pool)) livePool.push(location ? `${location}/${cluster}/${pool}` : `${cluster}/${pool}`);
   }
   push('ContainerNodePool', livePool, 'gcp');
   push('ContainerNodePool', await kccField(
     'ContainerNodePool', namespace,
     (i) => {
       const ref = (i.spec && i.spec.clusterRef) || {};
-      return `${ref.name || ref.external}/${i.spec && i.spec.resourceID}`;
+      const external = ref.external || '';
+      const m = external.match(/\/locations\/([^/]+)\/clusters\/([^/]+)$/);
+      return m ? `${m[1]}/${m[2]}/${resourceId(i)}` : `${clusterRefs.get(ref.name) || ref.name || external}/${resourceId(i)}`;
     },
   ), 'kcc');
 
@@ -286,14 +341,14 @@ export async function collectNamespace(namespace, { includeSystem = false } = {}
   const liveAddrIds = new Set([...regionalAddrIds, ...globalAddrIds]);
   const staleAddrCount0 = byType('compute.googleapis.com/Address', 'compute.googleapis.com/GlobalAddress').length;
   const liveAddr = byType('compute.googleapis.com/Address', 'compute.googleapis.com/GlobalAddress')
-    .map((a) => `${a.displayName}/${a.location === 'global' ? 'global' : a.location}`)
+    .map((a) => `${a.location === 'global' ? 'global' : a.location}/${a.displayName}`)
     .filter((id) => liveAddrIds.has(id));
   const staleAddrCount = staleAddrCount0 - liveAddr.length;
   if (staleAddrCount) diagnostics.push({ kind: 'ComputeAddress', type: 'stale-cache', count: staleAddrCount });
   push('ComputeAddress', liveAddr, 'gcp');
   push('ComputeAddress', await kccField(
     'ComputeAddress', namespace,
-    (i) => `${i.spec && i.spec.resourceID}/${(i.spec && i.spec.location) || 'global'}`,
+    (i) => kccScopedId(i, { defaultLocation: 'global' }),
   ), 'kcc');
 
   // --- DNSManagedZone + DNSRecordSet -------------------------------------------
@@ -352,6 +407,72 @@ export async function collectNamespace(namespace, { includeSystem = false } = {}
     },
   ), 'kcc');
 
+  // --- Cloud Run та його тригери/залежності ---------------------------------
+  push('RunService', liveScopedIds(assets, 'run.googleapis.com/Service', 'services'), 'gcp');
+  const runServiceItems = await listCustomObjects('RunService', namespace);
+  push('RunService', runServiceItems.map((i) => kccScopedId(i)).filter(Boolean), 'kcc');
+
+  push('RunJob', liveScopedIds(assets, 'run.googleapis.com/Job', 'jobs'), 'gcp');
+  push('RunJob', await kccField('RunJob', namespace, (i) => kccScopedId(i)), 'kcc');
+
+  push('CloudSchedulerJob', liveScopedIds(assets, 'cloudscheduler.googleapis.com/Job', 'jobs'), 'gcp');
+  push('CloudSchedulerJob', await kccField('CloudSchedulerJob', namespace, (i) => kccScopedId(i)), 'kcc');
+
+  push('EventarcTrigger', liveScopedIds(assets, 'eventarc.googleapis.com/Trigger', 'triggers'), 'gcp');
+  push('EventarcTrigger', await kccField('EventarcTrigger', namespace, (i) => kccScopedId(i)), 'kcc');
+
+  push('PubSubTopic', byType('pubsub.googleapis.com/Topic').map((a) => a.displayName), 'gcp');
+  push('PubSubTopic', await kccField('PubSubTopic', namespace, resourceId), 'kcc');
+  push('PubSubSubscription', byType('pubsub.googleapis.com/Subscription').map((a) => a.displayName), 'gcp');
+  push('PubSubSubscription', await kccField('PubSubSubscription', namespace, resourceId), 'kcc');
+
+  push('SecretManagerSecret', byType('secretmanager.googleapis.com/Secret').map((a) => a.displayName), 'gcp');
+  push('SecretManagerSecret', await kccField('SecretManagerSecret', namespace, resourceId), 'kcc');
+
+  push('VPCAccessConnector', liveScopedIds(assets, 'vpcaccess.googleapis.com/Connector', 'connectors'), 'gcp');
+  push('VPCAccessConnector', await kccField('VPCAccessConnector', namespace, (i) => kccScopedId(i)), 'kcc');
+  push('ComputeNetwork', liveGlobalOrScopedIds(assets, 'compute.googleapis.com/Network', 'networks'), 'gcp');
+  push('ComputeNetwork', await kccField('ComputeNetwork', namespace, (i) => kccScopedId(i, { defaultLocation: 'global' })), 'kcc');
+  push('ComputeSubnetwork', liveScopedIds(assets, 'compute.googleapis.com/Subnetwork', 'subnetworks'), 'gcp');
+  push('ComputeSubnetwork', await kccField('ComputeSubnetwork', namespace, (i) => kccScopedId(i)), 'kcc');
+
+  // KMS key ідентифікується не лише ім'ям: keyRing теж є частиною URI.
+  const cryptoKeyId = (a) => {
+    const m = (a.name || '').match(/\/locations\/([^/]+)\/keyRings\/([^/]+)\/cryptoKeys\/([^/]+)$/);
+    return m && `${m[1]}/${m[2]}/${m[3]}`;
+  };
+  push('KMSCryptoKey', byType('cloudkms.googleapis.com/CryptoKey').map(cryptoKeyId).filter(Boolean), 'gcp');
+  push('KMSCryptoKey', await kccField('KMSCryptoKey', namespace, (i) => {
+    const ref = (i.spec && i.spec.keyRingRef) || {};
+    const m = (ref.external || '').match(/\/locations\/([^/]+)\/keyRings\/([^/]+)$/);
+    return m ? `${m[1]}/${m[2]}/${resourceId(i)}` : null;
+  }), 'kcc');
+
+  // --- HTTP(S) LB, що часто стоїть перед Cloud Run ---------------------------
+  push('ComputeBackendService', liveGlobalOrScopedIds(assets, 'compute.googleapis.com/BackendService', 'backendServices'), 'gcp');
+  push('ComputeBackendService', await kccField('ComputeBackendService', namespace, (i) => kccScopedId(i, { defaultLocation: 'global' })), 'kcc');
+  const isServerlessNeg = (a) => (a.additionalAttributes && a.additionalAttributes.networkEndpointType) === 'SERVERLESS'
+    || (a.resource && a.resource.data && a.resource.data.networkEndpointType) === 'SERVERLESS';
+  push('ComputeNetworkEndpointGroup', byType('compute.googleapis.com/NetworkEndpointGroup')
+    .filter(isServerlessNeg).map((a) => assetGlobalOrScopedId(a, 'networkEndpointGroups')).filter(Boolean), 'gcp');
+  push('ComputeNetworkEndpointGroup', await kccField('ComputeNetworkEndpointGroup', namespace, (i) => {
+    const type = i.spec && i.spec.networkEndpointType;
+    return type === 'SERVERLESS' ? kccScopedId(i, { defaultLocation: 'global' }) : null;
+  }), 'kcc');
+  push('ComputeURLMap', liveGlobalOrScopedIds(assets, 'compute.googleapis.com/UrlMap', 'urlMaps'), 'gcp');
+  push('ComputeURLMap', await kccField('ComputeURLMap', namespace, (i) => kccScopedId(i, { defaultLocation: 'global' })), 'kcc');
+  push('ComputeTargetHTTPSProxy', liveGlobalOrScopedIds(assets, 'compute.googleapis.com/TargetHttpsProxy', 'targetHttpsProxies'), 'gcp');
+  push('ComputeTargetHTTPSProxy', await kccField('ComputeTargetHTTPSProxy', namespace, (i) => kccScopedId(i, { defaultLocation: 'global' })), 'kcc');
+  push('ComputeGlobalForwardingRule', byType('compute.googleapis.com/ForwardingRule')
+    .map((a) => assetGlobalOrScopedId(a, 'forwardingRules')).filter((id) => id && id.startsWith('global/')), 'gcp');
+  push('ComputeGlobalForwardingRule', await kccField('ComputeGlobalForwardingRule', namespace, (i) => kccScopedId(i, { defaultLocation: 'global' })), 'kcc');
+  push('ComputeSSLCertificate', liveGlobalOrScopedIds(assets, 'compute.googleapis.com/SslCertificate', 'sslCertificates'), 'gcp');
+  const sslKcc = await Promise.all([
+    kccField('ComputeSSLCertificate', namespace, (i) => kccScopedId(i, { defaultLocation: 'global' })),
+    kccField('ComputeManagedSSLCertificate', namespace, (i) => kccScopedId(i, { defaultLocation: 'global' })),
+  ]);
+  push('ComputeSSLCertificate', sslKcc.flat(), 'kcc');
+
   // --- IAMPolicyMember ---------------------------------------------------------
   // search-all-iam-policies — усі біндинги проєкту одразу, на будь-якому
   // типі ресурсу, не тільки на трьох раніше підтримуваних (Project/SA/AR).
@@ -369,10 +490,11 @@ export async function collectNamespace(namespace, { includeSystem = false } = {}
   }
   push('IAMPolicyMember', liveIam, 'gcp');
 
+  const runServiceRefs = new Map(runServiceItems.map((i) => [i.metadata && i.metadata.name, kccScopedId(i)]));
   push('IAMPolicyMember', await kccField(
     'IAMPolicyMember', namespace,
     (item) => {
-      const rid = kccPolicyMemberId(item, project);
+      const rid = kccPolicyMemberId(item, project, runServiceRefs);
       const spec = item.spec || {};
       return `${rid}/${spec.role}/${spec.member}`;
     },
@@ -396,10 +518,10 @@ The mechanism kcc-inventory is built on, callable on its own: per KCC
 namespace (namespace carrying the annotation
 cnrm.cloud.google.com/project-id), lists every resource found live in the
 GCP project (source: gcp) and every one declared as a Config Connector
-custom resource in that namespace (source: kcc), for IAMServiceAccount,
-IAMServiceAccountKey, ArtifactRegistryRepository, ContainerCluster,
-ContainerNodePool, StorageBucket, ComputeAddress, DNSManagedZone,
-DNSRecordSet, and IAMPolicyMember. No drift/orphan diff — that's
+custom resource in that namespace. It covers IAM, Artifact Registry, GKE,
+Cloud Run (services and jobs), Scheduler, Eventarc, Pub/Sub, Secret Manager,
+VPC Access, selected network/LB resources, KMS, Cloud DNS, and
+IAMPolicyMember. No drift/orphan diff — that's
 \`cfr kcc-inventory\`.
 
 By default GCP-managed system noise is filtered out (Google-owned service

package/lib/k8s-rest.mjs

@@ -112,10 +112,8 @@ export async function listNamespaces() {
 }
 
 // group + множина для кожного виду KCC-ресурсу, який сканує
-// get-resources.mjs. Версія скрізь v1beta1 — перевірено по всіх десяти
-// CRD на живому кластері (kubectl get crd ... -o jsonpath спрацьовує), і
-// це стандарт самого KCC, не наш вибір.
-const CRD_GVR = {
+// get-resources.mjs. Версія скрізь v1beta1 — стандарт KCC, не наш вибір.
+export const CRD_GVR = {
   IAMServiceAccount: { group: 'iam.cnrm.cloud.google.com', plural: 'iamserviceaccounts' },
   IAMServiceAccountKey: { group: 'iam.cnrm.cloud.google.com', plural: 'iamserviceaccountkeys' },
   ArtifactRegistryRepository: { group: 'artifactregistry.cnrm.cloud.google.com', plural: 'artifactregistryrepositories' },
@@ -125,6 +123,24 @@ const CRD_GVR = {
   ComputeAddress: { group: 'compute.cnrm.cloud.google.com', plural: 'computeaddresses' },
   DNSManagedZone: { group: 'dns.cnrm.cloud.google.com', plural: 'dnsmanagedzones' },
   DNSRecordSet: { group: 'dns.cnrm.cloud.google.com', plural: 'dnsrecordsets' },
+  RunService: { group: 'run.cnrm.cloud.google.com', plural: 'runservices' },
+  RunJob: { group: 'run.cnrm.cloud.google.com', plural: 'runjobs' },
+  CloudSchedulerJob: { group: 'cloudscheduler.cnrm.cloud.google.com', plural: 'cloudschedulerjobs' },
+  EventarcTrigger: { group: 'eventarc.cnrm.cloud.google.com', plural: 'eventarctriggers' },
+  PubSubTopic: { group: 'pubsub.cnrm.cloud.google.com', plural: 'pubsubtopics' },
+  PubSubSubscription: { group: 'pubsub.cnrm.cloud.google.com', plural: 'pubsubsubscriptions' },
+  SecretManagerSecret: { group: 'secretmanager.cnrm.cloud.google.com', plural: 'secretmanagersecrets' },
+  VPCAccessConnector: { group: 'vpcaccess.cnrm.cloud.google.com', plural: 'vpcaccessconnectors' },
+  ComputeNetwork: { group: 'compute.cnrm.cloud.google.com', plural: 'computenetworks' },
+  ComputeSubnetwork: { group: 'compute.cnrm.cloud.google.com', plural: 'computesubnetworks' },
+  KMSCryptoKey: { group: 'kms.cnrm.cloud.google.com', plural: 'kmscryptokeys' },
+  ComputeBackendService: { group: 'compute.cnrm.cloud.google.com', plural: 'computebackendservices' },
+  ComputeNetworkEndpointGroup: { group: 'compute.cnrm.cloud.google.com', plural: 'computenetworkendpointgroups' },
+  ComputeURLMap: { group: 'compute.cnrm.cloud.google.com', plural: 'computeurlmaps' },
+  ComputeTargetHTTPSProxy: { group: 'compute.cnrm.cloud.google.com', plural: 'computetargethttpsproxies' },
+  ComputeGlobalForwardingRule: { group: 'compute.cnrm.cloud.google.com', plural: 'computeglobalforwardingrules' },
+  ComputeSSLCertificate: { group: 'compute.cnrm.cloud.google.com', plural: 'computesslcertificates' },
+  ComputeManagedSSLCertificate: { group: 'compute.cnrm.cloud.google.com', plural: 'computemanagedsslcertificates' },
   IAMPolicyMember: { group: 'iam.cnrm.cloud.google.com', plural: 'iampolicymembers' },
 };
 

package/lib/kcc-inventory.mjs

@@ -14,10 +14,9 @@ Usage:
 Compares, per KCC namespace (namespace carrying the annotation
 cnrm.cloud.google.com/project-id), what actually exists in the GCP project
 against what's declared as Config Connector custom resources in that
-namespace — for IAMServiceAccount, IAMServiceAccountKey,
-ArtifactRegistryRepository, ContainerCluster, ContainerNodePool,
-StorageBucket, ComputeAddress, DNSManagedZone, DNSRecordSet, and
-IAMPolicyMember.
+namespace. It covers IAM, Artifact Registry, GKE, Cloud Run, Scheduler,
+Eventarc, Pub/Sub, Secret Manager, VPC Access, selected network/LB
+resources, KMS, Cloud DNS, and IAMPolicyMember.
 
 Reports two directions per kind:
   DRIFT   — live in GCP, not declared under KCC (adopt it or delete it)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nitra/cfr",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "A handful of small k8s/GitOps CLI utilities: `check` verifies every YAML file in a Kustomize directory is listed in kustomization.yaml's explicit resources: (and vice versa); `kcc-inventory` diffs a GCP Config Connector namespace against the live project to find drift; `get-resources` is that same scan without the diff.",
   "keywords": [
     "kustomize",
@@ -36,7 +36,7 @@
     "access": "public"
   },
   "scripts": {
-    "test": "node --test test/cli.test.mjs"
+    "test": "node --test test/*.test.mjs"
   },
   "dependencies": {
     "google-auth-library": "^10.9.1",