@intentius/chant 0.52.1 → 0.53.0

package/src/cli/commands/import-agents.ts

@@ -0,0 +1,196 @@
+/**
+ * `chant import --agents` — re-express this machine's agent configuration as
+ * chant code.
+ *
+ * Shares its front half with `chant audit --agents` (the same scan, the same
+ * normalized sites) and its back half with every other import path (a lexicon's
+ * `templateGenerator()` turning IR into TypeScript). The only new step is the
+ * middle: `LexiconPlugin.agentConfigImporter()`, which maps sites onto the
+ * lexicon's own resource types.
+ *
+ * The command is loud about what it changed. Re-expression here is lossy in
+ * three specific ways — a skipped runtime, a defaulted model, a redacted
+ * secret — and each one is something the user would otherwise find only by
+ * diffing the generated code against their real config. Printing them is not
+ * politeness; it is the difference between generated code you can trust and
+ * generated code you have to re-verify by hand.
+ */
+
+import { existsSync, mkdirSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join, resolve } from "path";
+import { scanAgentConfigs } from "../../agents/discover";
+import type { AgentRuntime, AgentScope } from "../../agents/types";
+import type { AgentImportOutcome } from "../../agents/importer";
+import type { LexiconPlugin } from "../../lexicon";
+import { loadPlugin } from "../plugins";
+
+/** The lexicon used when `--lexicon` isn't given: the one that models agent workloads. */
+export const DEFAULT_AGENT_LEXICON = "fountain";
+
+/**
+ * Loads the lexicon plugin. Injectable so this command can be unit-tested
+ * without a built lexicon package on disk — the same seam `audit.ts` uses for
+ * its `ChecksProvider`.
+ */
+export type PluginLoader = (name: string) => Promise<LexiconPlugin>;
+
+export interface ImportAgentsOptions {
+  /** Lexicon to re-express into. Defaults to {@link DEFAULT_AGENT_LEXICON}. */
+  lexicon?: string;
+  /** Injectable plugin loader (testing). Defaults to the real one. */
+  pluginLoader?: PluginLoader;
+  /** Output directory. Defaults to `./infra/agents`. */
+  output?: string;
+  force?: boolean;
+  scopes?: readonly AgentScope[];
+  runtimes?: readonly AgentRuntime[];
+  projectRoots?: string[];
+  home?: string;
+  platform?: NodeJS.Platform;
+}
+
+export interface ImportAgentsResult {
+  success: boolean;
+  generatedFiles: string[];
+  /** Sites found, mapped, and deliberately not mapped. */
+  summary: { discovered: number; mapped: number };
+  outcome?: AgentImportOutcome;
+  warnings: string[];
+  error?: string;
+}
+
+/**
+ * Scan, re-express, and write.
+ *
+ * Refuses to overwrite existing files without `--force`, matching `chant
+ * import` — generated agent code is likely to be edited by hand after the
+ * first run, and silently reverting those edits would be the worst possible
+ * behavior for a command whose whole purpose is capturing hand-tuned config.
+ */
+export async function importAgentsCommand(opts: ImportAgentsOptions = {}): Promise<ImportAgentsResult> {
+  const lexiconName = opts.lexicon ?? DEFAULT_AGENT_LEXICON;
+  const outputDir = resolve(opts.output ?? join("infra", "agents"));
+  const warnings: string[] = [];
+
+  const scan = scanAgentConfigs({
+    scopes: opts.scopes,
+    runtimes: opts.runtimes,
+    projectRoots: opts.projectRoots,
+    home: opts.home ?? homedir(),
+    platform: opts.platform,
+  });
+
+  if (scan.sites.length === 0) {
+    return {
+      success: false,
+      generatedFiles: [],
+      summary: { discovered: 0, mapped: 0 },
+      warnings,
+      error: "No agent configuration found to import.",
+    };
+  }
+
+  let plugin: LexiconPlugin;
+  try {
+    plugin = await (opts.pluginLoader ?? loadPlugin)(lexiconName);
+  } catch (err) {
+    return {
+      success: false,
+      generatedFiles: [],
+      summary: { discovered: scan.sites.length, mapped: 0 },
+      warnings,
+      error:
+        `Could not load the ${lexiconName} lexicon: ${err instanceof Error ? err.message : String(err)}\n` +
+        `Install it with: npm i @intentius/chant-lexicon-${lexiconName}`,
+    };
+  }
+
+  const importer = plugin.agentConfigImporter?.();
+  if (!importer) {
+    return {
+      success: false,
+      generatedFiles: [],
+      summary: { discovered: scan.sites.length, mapped: 0 },
+      warnings,
+      error: `The ${lexiconName} lexicon cannot express agent configuration (no agentConfigImporter). Try --lexicon ${DEFAULT_AGENT_LEXICON}.`,
+    };
+  }
+
+  const generator = plugin.templateGenerator?.();
+  if (!generator) {
+    return {
+      success: false,
+      generatedFiles: [],
+      summary: { discovered: scan.sites.length, mapped: 0 },
+      warnings,
+      error: `The ${lexiconName} lexicon has no templateGenerator, so it cannot emit TypeScript.`,
+    };
+  }
+
+  const outcome = importer.toTemplateIR(scan.sites);
+
+  for (const skip of outcome.skipped) warnings.push(`Skipped ${skip.siteId}: ${skip.reason}`);
+  if (outcome.unmappedModel.length > 0) {
+    warnings.push(
+      `No model was pinned in the local config for ${outcome.unmappedModel.join(", ")}; a default was written. Edit it before applying.`,
+    );
+  }
+  if (outcome.redactedSecrets.length > 0) {
+    warnings.push(
+      `Literal credentials in ${outcome.redactedSecrets.join(", ")} were replaced with \`\${VAR}\` references — the values were NOT copied into the generated code. Supply them via a Vault or the environment.`,
+    );
+  }
+
+  if (outcome.ir.resources.length === 0) {
+    return {
+      success: false,
+      generatedFiles: [],
+      summary: { discovered: scan.sites.length, mapped: 0 },
+      outcome,
+      warnings,
+      error: `Found ${scan.sites.length} agent config(s), but none could be expressed as ${lexiconName} resources.`,
+    };
+  }
+
+  const files = generator.generate(outcome.ir);
+
+  const existing = files.map((f) => join(outputDir, f.path)).filter((p) => existsSync(p));
+  if (existing.length > 0 && !opts.force) {
+    return {
+      success: false,
+      generatedFiles: [],
+      summary: { discovered: scan.sites.length, mapped: outcome.ir.resources.length },
+      outcome,
+      warnings,
+      error: `Refusing to overwrite ${existing.join(", ")}. Re-run with --force to replace.`,
+    };
+  }
+
+  const generatedFiles: string[] = [];
+  try {
+    mkdirSync(outputDir, { recursive: true });
+    for (const file of files) {
+      const full = join(outputDir, file.path);
+      writeFileSync(full, file.content, "utf-8");
+      generatedFiles.push(full);
+    }
+  } catch (err) {
+    return {
+      success: false,
+      generatedFiles,
+      summary: { discovered: scan.sites.length, mapped: outcome.ir.resources.length },
+      outcome,
+      warnings,
+      error: `Failed to write generated files: ${err instanceof Error ? err.message : String(err)}`,
+    };
+  }
+
+  return {
+    success: true,
+    generatedFiles,
+    summary: { discovered: scan.sites.length, mapped: outcome.ir.resources.length },
+    outcome,
+    warnings,
+  };
+}

package/src/cli/handlers/carve-emit.ts

@@ -1,5 +1,6 @@
 import { carveEmit, formatCarveEmit } from "../commands/carve-emit";
 import { liveImportFromPlugins } from "../commands/import";
+import { carveEmitLexicons, resolveEmitProvider } from "../../terraform/carve-provider";
 import { loadPlugins } from "../plugins";
 import { formatError } from "../format";
 import type { CommandContext } from "../registry";
@@ -16,10 +17,16 @@ export async function runCarveEmit(ctx: CommandContext): Promise<number> {
   const { args } = ctx;
 
   // Load plugins only for the live path; the offline --state path needs none.
+  // Which lexicon comes from the carve provider seam (#2016), resolved off the
+  // selected address's type without parsing the estate — so a second provider
+  // needs no edit here. A type no provider emits falls back to every lexicon
+  // emit can adopt into, and carveEmit refuses the type properly afterwards.
   let plugins = ctx.plugins;
   if (!args.statePath && args.env) {
+    const tfType = args.selectAddress?.split(".")[0] ?? "";
+    const lexicon = resolveEmitProvider(tfType)?.lexicon;
     try {
-      plugins = await loadPlugins(["aws"]);
+      plugins = await loadPlugins(lexicon ? [lexicon] : carveEmitLexicons());
     } catch {
       // fall through with whatever ctx provided; carveEmit surfaces a clear error
     }

package/src/cli/handlers/carve.ts

@@ -3,17 +3,18 @@ import { formatError } from "../format";
 import type { CommandContext } from "../registry";
 
 /**
- * `chant carve advise --from <terraform-dir> [--json] [--report <path>]`
+ * `chant carve advise --from <terraform-dir | cdk.out> [--json] [--report <path>]`
  *
- * Read-only. Reuses `--from` (shared with migrate/import) for the estate dir.
- * Loads no chant project and no lexicon plugins — pure analysis of a foreign
- * Terraform tree.
+ * Read-only. Reuses `--from` (shared with migrate/import) for the source dir,
+ * and works out which source it is by looking at the directory (#1056) rather
+ * than adding a second flag. Loads no chant project and no lexicon plugins —
+ * pure analysis of a foreign tree.
  */
 export async function runCarveAdvise(ctx: CommandContext): Promise<number> {
   const { args } = ctx;
 
   const result = await carveAdvise({
-    from: args.migrateFrom, // `--from <terraform-dir>`
+    from: args.migrateFrom, // `--from <terraform-dir | cdk.out>`
     statePath: args.statePath, // `--state <tfstate>`
     reportFile: args.reportFile, // `--report <path>`
   });
@@ -21,7 +22,7 @@ export async function runCarveAdvise(ctx: CommandContext): Promise<number> {
   if (!result.ok) {
     console.error(formatError({
       message: result.error ?? "carve advise failed",
-      hint: "chant carve advise --from ./path/to/terraform",
+      hint: "chant carve advise --from ./path/to/terraform   (or ./cdk.out)",
     }));
     return 1;
   }
@@ -38,7 +39,7 @@ export async function runCarveAdvise(ctx: CommandContext): Promise<number> {
 export async function runCarveUnknown(_ctx: CommandContext): Promise<number> {
   console.error(formatError({
     message: "Unknown carve subcommand",
-    hint: "chant carve advise --from <terraform-dir>   (read-only peelability report)",
+    hint: "chant carve advise --from <terraform-dir | cdk.out>   (read-only peelability report)",
   }));
   return 1;
 }

package/src/cli/handlers/lifecycle.test.ts

@@ -53,7 +53,7 @@ vi.mock("../../config", async () => {
   };
 });
 
-const { runLifecycleDiff, runLifecyclePlan, runLifecycleSnapshot, runLifecycleShow, runLifecycleLog, runLifecycleTeardown, runLifecycleUnknown } = await import("./lifecycle");
+const { runLifecycleDiff, runLifecyclePlan, runLifecycleSnapshot, runLifecycleShow, runLifecycleLog, runLifecycleTeardown, runLifecycleWhoami, runLifecycleUnknown } = await import("./lifecycle");
 
 function makeArgs(overrides: Partial<ParsedArgs>): ParsedArgs {
   return {
@@ -1673,3 +1673,189 @@ describe("runLifecycleTeardown (#1222 — plan only)", () => {
     expect(parsed.entries).toHaveLength(1);
   });
 });
+
+describe("runLifecycleWhoami (#1982)", () => {
+  let stdoutBuf: string[];
+  let stderrBuf: string[];
+
+  beforeEach(() => {
+    stdoutBuf = [];
+    stderrBuf = [];
+    vi.spyOn(console, "log").mockImplementation((s: string) => { stdoutBuf.push(s); });
+    vi.spyOn(console, "error").mockImplementation((s: string) => { stderrBuf.push(s); });
+    loadChantConfigMock.mockReset();
+    loadChantConfigMock.mockResolvedValue({ config: { environments: ["prod"] } });
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    delete process.env.AWS_ENDPOINT_URL;
+  });
+
+  function whoamiCtx(plugins: LexiconPlugin[], overrides: Partial<ParsedArgs> = {}) {
+    return {
+      args: makeArgs({ command: "lifecycle", path: "whoami", extraPositional: "prod", ...overrides }),
+      plugins,
+      serializers: plugins.map((p) => p.serializer),
+    };
+  }
+
+  const awsIdentity = createMockPlugin({
+    name: "aws",
+    describeIdentity: async () => ({
+      identity: "arn:aws:sts::491500000000:assumed-role/deploy/ci",
+      scope: "491500000000 us-east-1",
+      source: "env AWS_ACCESS_KEY_ID",
+      endpoint: "https://sts.us-east-1.amazonaws.com/",
+    }),
+  });
+
+  test("missing environment arg → exit 1", async () => {
+    const exit = await runLifecycleWhoami(whoamiCtx([], { extraPositional: undefined }));
+    expect(exit).toBe(1);
+    expect(stderrBuf.join("\n")).toContain("Environment is required");
+  });
+
+  test("environment not in config → exit 1", async () => {
+    const exit = await runLifecycleWhoami(whoamiCtx([], { extraPositional: "nope" }));
+    expect(exit).toBe(1);
+    expect(stderrBuf.join("\n")).toContain('Unknown environment "nope"');
+  });
+
+  test("one row per configured lexicon, and --json emits the same rows", async () => {
+    const plugins: LexiconPlugin[] = [
+      awsIdentity,
+      createMockPlugin({
+        name: "k8s",
+        describeIdentity: async () => ({ unresolved: { reason: "no-binding", detail: "no context" } }),
+      }),
+      createMockPlugin({ name: "github" }),
+    ];
+
+    expect(await runLifecycleWhoami(whoamiCtx(plugins))).toBe(0);
+    const table = stdoutBuf.join("\n");
+    expect(table).toContain("arn:aws:sts::491500000000:assumed-role/deploy/ci");
+    expect(table).toContain("k8s");
+    expect(table).toContain("github");
+
+    stdoutBuf.length = 0;
+    expect(await runLifecycleWhoami(whoamiCtx(plugins, { json: true }))).toBe(0);
+    const parsed = JSON.parse(stdoutBuf.join("\n")) as {
+      environment: string;
+      identities: Array<{ lexicon: string; status: string; identity?: string; reason?: string }>;
+    };
+    expect(parsed.environment).toBe("prod");
+    expect(parsed.identities.map((r) => [r.lexicon, r.status])).toEqual([
+      ["aws", "reported"],
+      ["k8s", "unresolved"],
+      ["github", "not-reported"],
+    ]);
+    expect(parsed.identities[1].reason).toBe("no-binding");
+  });
+
+  test("a lexicon that implements nothing reads as 'not reported', never an empty identity", async () => {
+    const exit = await runLifecycleWhoami(whoamiCtx([createMockPlugin({ name: "helm" })]));
+    expect(exit).toBe(0);
+    expect(stdoutBuf.join("\n")).toContain("not reported");
+  });
+
+  test("an unresolved identity exits 0 by default and nonzero only under --strict", async () => {
+    const plugins: LexiconPlugin[] = [
+      createMockPlugin({
+        name: "aws",
+        describeIdentity: async () => ({ unresolved: { reason: "no-credentials" } }),
+      }),
+    ];
+    expect(await runLifecycleWhoami(whoamiCtx(plugins))).toBe(0);
+    expect(await runLifecycleWhoami(whoamiCtx(plugins, { strict: true }))).toBe(1);
+  });
+
+  test("--strict does not fail on a lexicon that simply does not implement the capability", async () => {
+    const exit = await runLifecycleWhoami(whoamiCtx([createMockPlugin({ name: "github" })], { strict: true }));
+    expect(exit).toBe(0);
+  });
+
+  test("the positional lexicon filter narrows the report", async () => {
+    const plugins: LexiconPlugin[] = [awsIdentity, createMockPlugin({ name: "k8s" })];
+    expect(await runLifecycleWhoami(whoamiCtx(plugins, { extraPositional2: "aws", json: true }))).toBe(0);
+    const parsed = JSON.parse(stdoutBuf.join("\n")) as { identities: Array<{ lexicon: string }> };
+    expect(parsed.identities.map((r) => r.lexicon)).toEqual(["aws"]);
+  });
+
+  test("an unconfigured lexicon filter → exit 1", async () => {
+    const exit = await runLifecycleWhoami(whoamiCtx([awsIdentity], { extraPositional2: "gcp" }));
+    expect(exit).toBe(1);
+    expect(stderrBuf.join("\n")).toContain('Lexicon "gcp" is not configured');
+  });
+
+  test("the environment's declared endpoint is applied for the identity query, exactly as for a live read", async () => {
+    // #1166 parity: without this, whoami reports the identity of real AWS
+    // while `describeResources` reads the emulator — the wrong-target answer
+    // this command exists to surface.
+    loadChantConfigMock.mockResolvedValue({
+      config: { environments: [{ name: "prod", endpoint: "http://localhost:4566" }] },
+    });
+    let seenEndpoint: string | undefined;
+    const plugins: LexiconPlugin[] = [
+      createMockPlugin({
+        name: "aws",
+        emulator: awsEmulatorStub,
+        describeIdentity: async () => {
+          seenEndpoint = process.env.AWS_ENDPOINT_URL;
+          return { identity: "arn:x", scope: "s", source: "env" };
+        },
+      }),
+    ];
+    expect(await runLifecycleWhoami(whoamiCtx(plugins))).toBe(0);
+    expect(seenEndpoint).toBe("http://localhost:4566");
+    // Restored after the call, so it never leaks into a later invocation.
+    expect(process.env.AWS_ENDPOINT_URL).toBeUndefined();
+  });
+
+  test("a single declared stack region is handed to the lexicon; disagreeing regions are not guessed", async () => {
+    const seen: Array<string | undefined> = [];
+    const plugin = createMockPlugin({
+      name: "aws",
+      describeIdentity: async (options) => {
+        seen.push(options.region);
+        return { identity: "arn:x", scope: "s", source: "env" };
+      },
+    });
+    loadChantConfigMock.mockResolvedValue({
+      config: { environments: ["prod"], stacks: [{ name: "a", src: "src/a", region: "eu-west-1" }] },
+    });
+    await runLifecycleWhoami(whoamiCtx([plugin]));
+    loadChantConfigMock.mockResolvedValue({
+      config: {
+        environments: ["prod"],
+        stacks: [
+          { name: "a", src: "src/a", region: "eu-west-1" },
+          { name: "b", src: "src/b", region: "us-east-1" },
+        ],
+      },
+    });
+    await runLifecycleWhoami(whoamiCtx([plugin]));
+    expect(seen).toEqual(["eu-west-1", undefined]);
+  });
+
+  test("no credential value survives into the rendered rows", async () => {
+    process.env.CHANT_TEST_API_TOKEN = "tok_averyrealtokenvalue";
+    try {
+      const plugins: LexiconPlugin[] = [
+        createMockPlugin({
+          name: "aws",
+          describeIdentity: async () => ({
+            identity: "arn:aws:iam::1:user/ci",
+            scope: "us-east-1",
+            source: "tok_averyrealtokenvalue",
+          }),
+        }),
+      ];
+      expect(await runLifecycleWhoami(whoamiCtx(plugins, { json: true }))).toBe(0);
+      expect(stdoutBuf.join("\n")).not.toContain("tok_averyrealtokenvalue");
+      expect(stdoutBuf.join("\n")).toContain("[redacted]");
+    } finally {
+      delete process.env.CHANT_TEST_API_TOKEN;
+    }
+  });
+});

package/src/cli/handlers/lifecycle.ts

@@ -30,6 +30,7 @@ import {
   type NormalizedObservation,
   type UnobservedEntity,
 } from "../../observation";
+import { describeIdentities, identityStatusText, type IdentityRow } from "../../identity";
 import { discoverComponents } from "../../components/discover";
 import { cfnDeployStacks } from "./components";
 import { affectedStacks } from "../../lifecycle/affected";
@@ -1583,13 +1584,136 @@ export async function runLifecycleLog(ctx: CommandContext): Promise<number> {
   return 0;
 }
 
+/**
+ * The region core hands `describeIdentity` — the one the environment's stacks
+ * declare, when they declare exactly one (#1261's `stacks[].region`).
+ *
+ * Stacks that declare none, or that disagree, resolve to `undefined`, and the
+ * lexicon then resolves the region its own read path would. Guessing one of
+ * several would report a binding half the estate does not use, which is the
+ * failure this command exists to prevent.
+ */
+function singleDeclaredRegion(targets: readonly StackTarget[]): string | undefined {
+  const regions = new Set(targets.map((t) => t.region).filter((r): r is string => Boolean(r)));
+  return regions.size === 1 ? [...regions][0] : undefined;
+}
+
+/**
+ * chant lifecycle whoami <environment> [lexicon] [--json] [--strict]
+ *
+ * Read-only pre-flight (#1982): who chant would act as in each configured
+ * lexicon, and what that principal is scoped to, before it acts. Never
+ * mutates, never gates — `--strict` is the only way this exits non-zero on an
+ * unresolved row, and a lexicon that answers for nothing is reported as such
+ * rather than as an empty identity.
+ */
+export async function runLifecycleWhoami(ctx: CommandContext): Promise<number> {
+  const { args, plugins } = ctx;
+  const environment = args.extraPositional;
+  const lexiconFilter = args.extraPositional2;
+
+  if (!environment) {
+    console.error(formatError({
+      message: "Environment is required: chant lifecycle whoami <environment> [lexicon] [--json] [--strict]",
+    }));
+    return 1;
+  }
+
+  const projectPath = resolve(".");
+  const { config } = await loadChantConfig(projectPath);
+  const declaredEnvNames = environmentNames(config.environments);
+  if (declaredEnvNames && !matchesDeclaredEnvironment(config.environments, environment)) {
+    console.error(formatError({
+      message: `Unknown environment "${environment}"`,
+      hint: `Defined environments: ${declaredEnvNames.join(", ")}`,
+    }));
+    return 1;
+  }
+
+  const targetPlugins = lexiconFilter ? plugins.filter((p) => p.name === lexiconFilter) : plugins;
+  if (targetPlugins.length === 0) {
+    console.error(formatError({
+      message: `Lexicon "${lexiconFilter}" is not configured for this project`,
+      hint: `Configured: ${plugins.map((p) => p.name).join(", ") || "(none)"}`,
+    }));
+    return 1;
+  }
+
+  // The environment's declared endpoint applies here exactly as it does to a
+  // `--live` read (#1166). Without it whoami would report the identity of real
+  // AWS while `describeResources` reads the emulator — the wrong-target answer
+  // this command exists to make visible.
+  const endpointResult = applyLiveEndpoint(config.environments, environment, targetPlugins);
+  if (endpointResult.notice) console.error(formatWarning({ message: endpointResult.notice }));
+
+  const region = singleDeclaredRegion(resolveStackTargets(args, config));
+  let rows: IdentityRow[];
+  try {
+    rows = await describeIdentities(targetPlugins, {
+      environment,
+      ...(region ? { region } : {}),
+      cwd: projectPath,
+    });
+  } finally {
+    endpointResult.restore();
+  }
+
+  if (args.json) {
+    console.log(JSON.stringify({ environment, identities: rows }, null, 2));
+  } else {
+    printIdentityTable(rows);
+  }
+
+  // Never a gate by default: an unresolved identity is a report, and a
+  // pre-flight command that fails the build has stopped being pre-flight.
+  const unresolved = rows.filter((r) => r.status === "unresolved");
+  if (args.strict && unresolved.length > 0) {
+    console.error(formatError({
+      message: `--strict: ${unresolved.length} lexicon(s) could not resolve an identity: ${unresolved.map((r) => r.lexicon).join(", ")}`,
+    }));
+    return 1;
+  }
+  return 0;
+}
+
+function printIdentityTable(rows: IdentityRow[]): void {
+  if (rows.length === 0) {
+    console.error(formatWarning({ message: "No lexicons are configured for this project" }));
+    return;
+  }
+  const width = (pick: (r: IdentityRow) => string): number =>
+    Math.max(...rows.map((r) => pick(r).length));
+  const lexWidth = Math.max(width((r) => r.lexicon), "LEXICON".length);
+  const idWidth = Math.max(width((r) => r.identity ?? identityStatusText(r)), "IDENTITY".length);
+  const scopeWidth = Math.max(width((r) => r.scope ?? ""), "SCOPE".length);
+
+  console.log(
+    "LEXICON".padEnd(lexWidth + 2) + "IDENTITY".padEnd(idWidth + 2) + "SCOPE".padEnd(scopeWidth + 2) + "SOURCE",
+  );
+  for (const row of rows) {
+    const identity = row.status === "reported" ? (row.identity ?? "") : identityStatusText(row);
+    console.log(
+      row.lexicon.padEnd(lexWidth + 2) +
+        identity.padEnd(idWidth + 2) +
+        (row.scope ?? "").padEnd(scopeWidth + 2) +
+        (row.source ?? ""),
+    );
+  }
+  // The resolved address and the reason's detail are both sentences, so they
+  // go under the table rather than widening a column every row pays for.
+  for (const row of rows) {
+    if (row.endpoint) console.error(`  ${row.lexicon}: resolved endpoint ${row.endpoint}`);
+    if (row.detail) console.error(`  ${row.lexicon}: ${row.detail}`);
+  }
+}
+
 /**
  * Fallback for unknown state subcommands.
  */
 export async function runLifecycleUnknown(ctx: CommandContext): Promise<number> {
   console.error(formatError({
     message: `Unknown state subcommand: ${ctx.args.extraPositional ?? ctx.args.path}`,
-    hint: "Available: chant lifecycle snapshot, chant lifecycle show, chant lifecycle diff, chant lifecycle plan, chant lifecycle teardown, chant lifecycle log",
+    hint: "Available: chant lifecycle snapshot, chant lifecycle show, chant lifecycle diff, chant lifecycle plan, chant lifecycle whoami, chant lifecycle teardown, chant lifecycle log",
   }));
   return 1;
 }