@intentius/chant 0.52.2 → 0.53.0

package/src/cli/handlers/carve.ts

@@ -3,17 +3,18 @@ import { formatError } from "../format";
 import type { CommandContext } from "../registry";
 
 /**
- * `chant carve advise --from <terraform-dir> [--json] [--report <path>]`
+ * `chant carve advise --from <terraform-dir | cdk.out> [--json] [--report <path>]`
  *
- * Read-only. Reuses `--from` (shared with migrate/import) for the estate dir.
- * Loads no chant project and no lexicon plugins — pure analysis of a foreign
- * Terraform tree.
+ * Read-only. Reuses `--from` (shared with migrate/import) for the source dir,
+ * and works out which source it is by looking at the directory (#1056) rather
+ * than adding a second flag. Loads no chant project and no lexicon plugins —
+ * pure analysis of a foreign tree.
  */
 export async function runCarveAdvise(ctx: CommandContext): Promise<number> {
   const { args } = ctx;
 
   const result = await carveAdvise({
-    from: args.migrateFrom, // `--from <terraform-dir>`
+    from: args.migrateFrom, // `--from <terraform-dir | cdk.out>`
     statePath: args.statePath, // `--state <tfstate>`
     reportFile: args.reportFile, // `--report <path>`
   });
@@ -21,7 +22,7 @@ export async function runCarveAdvise(ctx: CommandContext): Promise<number> {
   if (!result.ok) {
     console.error(formatError({
       message: result.error ?? "carve advise failed",
-      hint: "chant carve advise --from ./path/to/terraform",
+      hint: "chant carve advise --from ./path/to/terraform   (or ./cdk.out)",
     }));
     return 1;
   }
@@ -38,7 +39,7 @@ export async function runCarveAdvise(ctx: CommandContext): Promise<number> {
 export async function runCarveUnknown(_ctx: CommandContext): Promise<number> {
   console.error(formatError({
     message: "Unknown carve subcommand",
-    hint: "chant carve advise --from <terraform-dir>   (read-only peelability report)",
+    hint: "chant carve advise --from <terraform-dir | cdk.out>   (read-only peelability report)",
   }));
   return 1;
 }

package/src/cli/handlers/lifecycle.test.ts

@@ -53,7 +53,7 @@ vi.mock("../../config", async () => {
   };
 });
 
-const { runLifecycleDiff, runLifecyclePlan, runLifecycleSnapshot, runLifecycleShow, runLifecycleLog, runLifecycleTeardown, runLifecycleUnknown } = await import("./lifecycle");
+const { runLifecycleDiff, runLifecyclePlan, runLifecycleSnapshot, runLifecycleShow, runLifecycleLog, runLifecycleTeardown, runLifecycleWhoami, runLifecycleUnknown } = await import("./lifecycle");
 
 function makeArgs(overrides: Partial<ParsedArgs>): ParsedArgs {
   return {
@@ -1673,3 +1673,189 @@ describe("runLifecycleTeardown (#1222 — plan only)", () => {
     expect(parsed.entries).toHaveLength(1);
   });
 });
+
+describe("runLifecycleWhoami (#1982)", () => {
+  let stdoutBuf: string[];
+  let stderrBuf: string[];
+
+  beforeEach(() => {
+    stdoutBuf = [];
+    stderrBuf = [];
+    vi.spyOn(console, "log").mockImplementation((s: string) => { stdoutBuf.push(s); });
+    vi.spyOn(console, "error").mockImplementation((s: string) => { stderrBuf.push(s); });
+    loadChantConfigMock.mockReset();
+    loadChantConfigMock.mockResolvedValue({ config: { environments: ["prod"] } });
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    delete process.env.AWS_ENDPOINT_URL;
+  });
+
+  function whoamiCtx(plugins: LexiconPlugin[], overrides: Partial<ParsedArgs> = {}) {
+    return {
+      args: makeArgs({ command: "lifecycle", path: "whoami", extraPositional: "prod", ...overrides }),
+      plugins,
+      serializers: plugins.map((p) => p.serializer),
+    };
+  }
+
+  const awsIdentity = createMockPlugin({
+    name: "aws",
+    describeIdentity: async () => ({
+      identity: "arn:aws:sts::491500000000:assumed-role/deploy/ci",
+      scope: "491500000000 us-east-1",
+      source: "env AWS_ACCESS_KEY_ID",
+      endpoint: "https://sts.us-east-1.amazonaws.com/",
+    }),
+  });
+
+  test("missing environment arg → exit 1", async () => {
+    const exit = await runLifecycleWhoami(whoamiCtx([], { extraPositional: undefined }));
+    expect(exit).toBe(1);
+    expect(stderrBuf.join("\n")).toContain("Environment is required");
+  });
+
+  test("environment not in config → exit 1", async () => {
+    const exit = await runLifecycleWhoami(whoamiCtx([], { extraPositional: "nope" }));
+    expect(exit).toBe(1);
+    expect(stderrBuf.join("\n")).toContain('Unknown environment "nope"');
+  });
+
+  test("one row per configured lexicon, and --json emits the same rows", async () => {
+    const plugins: LexiconPlugin[] = [
+      awsIdentity,
+      createMockPlugin({
+        name: "k8s",
+        describeIdentity: async () => ({ unresolved: { reason: "no-binding", detail: "no context" } }),
+      }),
+      createMockPlugin({ name: "github" }),
+    ];
+
+    expect(await runLifecycleWhoami(whoamiCtx(plugins))).toBe(0);
+    const table = stdoutBuf.join("\n");
+    expect(table).toContain("arn:aws:sts::491500000000:assumed-role/deploy/ci");
+    expect(table).toContain("k8s");
+    expect(table).toContain("github");
+
+    stdoutBuf.length = 0;
+    expect(await runLifecycleWhoami(whoamiCtx(plugins, { json: true }))).toBe(0);
+    const parsed = JSON.parse(stdoutBuf.join("\n")) as {
+      environment: string;
+      identities: Array<{ lexicon: string; status: string; identity?: string; reason?: string }>;
+    };
+    expect(parsed.environment).toBe("prod");
+    expect(parsed.identities.map((r) => [r.lexicon, r.status])).toEqual([
+      ["aws", "reported"],
+      ["k8s", "unresolved"],
+      ["github", "not-reported"],
+    ]);
+    expect(parsed.identities[1].reason).toBe("no-binding");
+  });
+
+  test("a lexicon that implements nothing reads as 'not reported', never an empty identity", async () => {
+    const exit = await runLifecycleWhoami(whoamiCtx([createMockPlugin({ name: "helm" })]));
+    expect(exit).toBe(0);
+    expect(stdoutBuf.join("\n")).toContain("not reported");
+  });
+
+  test("an unresolved identity exits 0 by default and nonzero only under --strict", async () => {
+    const plugins: LexiconPlugin[] = [
+      createMockPlugin({
+        name: "aws",
+        describeIdentity: async () => ({ unresolved: { reason: "no-credentials" } }),
+      }),
+    ];
+    expect(await runLifecycleWhoami(whoamiCtx(plugins))).toBe(0);
+    expect(await runLifecycleWhoami(whoamiCtx(plugins, { strict: true }))).toBe(1);
+  });
+
+  test("--strict does not fail on a lexicon that simply does not implement the capability", async () => {
+    const exit = await runLifecycleWhoami(whoamiCtx([createMockPlugin({ name: "github" })], { strict: true }));
+    expect(exit).toBe(0);
+  });
+
+  test("the positional lexicon filter narrows the report", async () => {
+    const plugins: LexiconPlugin[] = [awsIdentity, createMockPlugin({ name: "k8s" })];
+    expect(await runLifecycleWhoami(whoamiCtx(plugins, { extraPositional2: "aws", json: true }))).toBe(0);
+    const parsed = JSON.parse(stdoutBuf.join("\n")) as { identities: Array<{ lexicon: string }> };
+    expect(parsed.identities.map((r) => r.lexicon)).toEqual(["aws"]);
+  });
+
+  test("an unconfigured lexicon filter → exit 1", async () => {
+    const exit = await runLifecycleWhoami(whoamiCtx([awsIdentity], { extraPositional2: "gcp" }));
+    expect(exit).toBe(1);
+    expect(stderrBuf.join("\n")).toContain('Lexicon "gcp" is not configured');
+  });
+
+  test("the environment's declared endpoint is applied for the identity query, exactly as for a live read", async () => {
+    // #1166 parity: without this, whoami reports the identity of real AWS
+    // while `describeResources` reads the emulator — the wrong-target answer
+    // this command exists to surface.
+    loadChantConfigMock.mockResolvedValue({
+      config: { environments: [{ name: "prod", endpoint: "http://localhost:4566" }] },
+    });
+    let seenEndpoint: string | undefined;
+    const plugins: LexiconPlugin[] = [
+      createMockPlugin({
+        name: "aws",
+        emulator: awsEmulatorStub,
+        describeIdentity: async () => {
+          seenEndpoint = process.env.AWS_ENDPOINT_URL;
+          return { identity: "arn:x", scope: "s", source: "env" };
+        },
+      }),
+    ];
+    expect(await runLifecycleWhoami(whoamiCtx(plugins))).toBe(0);
+    expect(seenEndpoint).toBe("http://localhost:4566");
+    // Restored after the call, so it never leaks into a later invocation.
+    expect(process.env.AWS_ENDPOINT_URL).toBeUndefined();
+  });
+
+  test("a single declared stack region is handed to the lexicon; disagreeing regions are not guessed", async () => {
+    const seen: Array<string | undefined> = [];
+    const plugin = createMockPlugin({
+      name: "aws",
+      describeIdentity: async (options) => {
+        seen.push(options.region);
+        return { identity: "arn:x", scope: "s", source: "env" };
+      },
+    });
+    loadChantConfigMock.mockResolvedValue({
+      config: { environments: ["prod"], stacks: [{ name: "a", src: "src/a", region: "eu-west-1" }] },
+    });
+    await runLifecycleWhoami(whoamiCtx([plugin]));
+    loadChantConfigMock.mockResolvedValue({
+      config: {
+        environments: ["prod"],
+        stacks: [
+          { name: "a", src: "src/a", region: "eu-west-1" },
+          { name: "b", src: "src/b", region: "us-east-1" },
+        ],
+      },
+    });
+    await runLifecycleWhoami(whoamiCtx([plugin]));
+    expect(seen).toEqual(["eu-west-1", undefined]);
+  });
+
+  test("no credential value survives into the rendered rows", async () => {
+    process.env.CHANT_TEST_API_TOKEN = "tok_averyrealtokenvalue";
+    try {
+      const plugins: LexiconPlugin[] = [
+        createMockPlugin({
+          name: "aws",
+          describeIdentity: async () => ({
+            identity: "arn:aws:iam::1:user/ci",
+            scope: "us-east-1",
+            source: "tok_averyrealtokenvalue",
+          }),
+        }),
+      ];
+      expect(await runLifecycleWhoami(whoamiCtx(plugins, { json: true }))).toBe(0);
+      expect(stdoutBuf.join("\n")).not.toContain("tok_averyrealtokenvalue");
+      expect(stdoutBuf.join("\n")).toContain("[redacted]");
+    } finally {
+      delete process.env.CHANT_TEST_API_TOKEN;
+    }
+  });
+});

package/src/cli/handlers/lifecycle.ts

@@ -30,6 +30,7 @@ import {
   type NormalizedObservation,
   type UnobservedEntity,
 } from "../../observation";
+import { describeIdentities, identityStatusText, type IdentityRow } from "../../identity";
 import { discoverComponents } from "../../components/discover";
 import { cfnDeployStacks } from "./components";
 import { affectedStacks } from "../../lifecycle/affected";
@@ -1583,13 +1584,136 @@ export async function runLifecycleLog(ctx: CommandContext): Promise<number> {
   return 0;
 }
 
+/**
+ * The region core hands `describeIdentity` — the one the environment's stacks
+ * declare, when they declare exactly one (#1261's `stacks[].region`).
+ *
+ * Stacks that declare none, or that disagree, resolve to `undefined`, and the
+ * lexicon then resolves the region its own read path would. Guessing one of
+ * several would report a binding half the estate does not use, which is the
+ * failure this command exists to prevent.
+ */
+function singleDeclaredRegion(targets: readonly StackTarget[]): string | undefined {
+  const regions = new Set(targets.map((t) => t.region).filter((r): r is string => Boolean(r)));
+  return regions.size === 1 ? [...regions][0] : undefined;
+}
+
+/**
+ * chant lifecycle whoami <environment> [lexicon] [--json] [--strict]
+ *
+ * Read-only pre-flight (#1982): who chant would act as in each configured
+ * lexicon, and what that principal is scoped to, before it acts. Never
+ * mutates, never gates — `--strict` is the only way this exits non-zero on an
+ * unresolved row, and a lexicon that answers for nothing is reported as such
+ * rather than as an empty identity.
+ */
+export async function runLifecycleWhoami(ctx: CommandContext): Promise<number> {
+  const { args, plugins } = ctx;
+  const environment = args.extraPositional;
+  const lexiconFilter = args.extraPositional2;
+
+  if (!environment) {
+    console.error(formatError({
+      message: "Environment is required: chant lifecycle whoami <environment> [lexicon] [--json] [--strict]",
+    }));
+    return 1;
+  }
+
+  const projectPath = resolve(".");
+  const { config } = await loadChantConfig(projectPath);
+  const declaredEnvNames = environmentNames(config.environments);
+  if (declaredEnvNames && !matchesDeclaredEnvironment(config.environments, environment)) {
+    console.error(formatError({
+      message: `Unknown environment "${environment}"`,
+      hint: `Defined environments: ${declaredEnvNames.join(", ")}`,
+    }));
+    return 1;
+  }
+
+  const targetPlugins = lexiconFilter ? plugins.filter((p) => p.name === lexiconFilter) : plugins;
+  if (targetPlugins.length === 0) {
+    console.error(formatError({
+      message: `Lexicon "${lexiconFilter}" is not configured for this project`,
+      hint: `Configured: ${plugins.map((p) => p.name).join(", ") || "(none)"}`,
+    }));
+    return 1;
+  }
+
+  // The environment's declared endpoint applies here exactly as it does to a
+  // `--live` read (#1166). Without it whoami would report the identity of real
+  // AWS while `describeResources` reads the emulator — the wrong-target answer
+  // this command exists to make visible.
+  const endpointResult = applyLiveEndpoint(config.environments, environment, targetPlugins);
+  if (endpointResult.notice) console.error(formatWarning({ message: endpointResult.notice }));
+
+  const region = singleDeclaredRegion(resolveStackTargets(args, config));
+  let rows: IdentityRow[];
+  try {
+    rows = await describeIdentities(targetPlugins, {
+      environment,
+      ...(region ? { region } : {}),
+      cwd: projectPath,
+    });
+  } finally {
+    endpointResult.restore();
+  }
+
+  if (args.json) {
+    console.log(JSON.stringify({ environment, identities: rows }, null, 2));
+  } else {
+    printIdentityTable(rows);
+  }
+
+  // Never a gate by default: an unresolved identity is a report, and a
+  // pre-flight command that fails the build has stopped being pre-flight.
+  const unresolved = rows.filter((r) => r.status === "unresolved");
+  if (args.strict && unresolved.length > 0) {
+    console.error(formatError({
+      message: `--strict: ${unresolved.length} lexicon(s) could not resolve an identity: ${unresolved.map((r) => r.lexicon).join(", ")}`,
+    }));
+    return 1;
+  }
+  return 0;
+}
+
+function printIdentityTable(rows: IdentityRow[]): void {
+  if (rows.length === 0) {
+    console.error(formatWarning({ message: "No lexicons are configured for this project" }));
+    return;
+  }
+  const width = (pick: (r: IdentityRow) => string): number =>
+    Math.max(...rows.map((r) => pick(r).length));
+  const lexWidth = Math.max(width((r) => r.lexicon), "LEXICON".length);
+  const idWidth = Math.max(width((r) => r.identity ?? identityStatusText(r)), "IDENTITY".length);
+  const scopeWidth = Math.max(width((r) => r.scope ?? ""), "SCOPE".length);
+
+  console.log(
+    "LEXICON".padEnd(lexWidth + 2) + "IDENTITY".padEnd(idWidth + 2) + "SCOPE".padEnd(scopeWidth + 2) + "SOURCE",
+  );
+  for (const row of rows) {
+    const identity = row.status === "reported" ? (row.identity ?? "") : identityStatusText(row);
+    console.log(
+      row.lexicon.padEnd(lexWidth + 2) +
+        identity.padEnd(idWidth + 2) +
+        (row.scope ?? "").padEnd(scopeWidth + 2) +
+        (row.source ?? ""),
+    );
+  }
+  // The resolved address and the reason's detail are both sentences, so they
+  // go under the table rather than widening a column every row pays for.
+  for (const row of rows) {
+    if (row.endpoint) console.error(`  ${row.lexicon}: resolved endpoint ${row.endpoint}`);
+    if (row.detail) console.error(`  ${row.lexicon}: ${row.detail}`);
+  }
+}
+
 /**
  * Fallback for unknown state subcommands.
  */
 export async function runLifecycleUnknown(ctx: CommandContext): Promise<number> {
   console.error(formatError({
     message: `Unknown state subcommand: ${ctx.args.extraPositional ?? ctx.args.path}`,
-    hint: "Available: chant lifecycle snapshot, chant lifecycle show, chant lifecycle diff, chant lifecycle plan, chant lifecycle teardown, chant lifecycle log",
+    hint: "Available: chant lifecycle snapshot, chant lifecycle show, chant lifecycle diff, chant lifecycle plan, chant lifecycle whoami, chant lifecycle teardown, chant lifecycle log",
   }));
   return 1;
 }

package/src/cli/main.ts

@@ -23,7 +23,7 @@ import { runCarveAdvise, runCarveUnknown } from "./handlers/carve";
 import { runCarveEmit } from "./handlers/carve-emit";
 import { runCarveBridge } from "./handlers/carve-bridge";
 import { runCarveApply } from "./handlers/carve-apply";
-import { runLifecycleSnapshot, runLifecycleShow, runLifecycleDiff, runLifecycleRollback, runLifecyclePlan, runLifecycleAffected, runLifecycleLog, runLifecycleTeardown, runLifecycleUnknown } from "./handlers/lifecycle";
+import { runLifecycleSnapshot, runLifecycleShow, runLifecycleDiff, runLifecycleRollback, runLifecyclePlan, runLifecycleAffected, runLifecycleLog, runLifecycleTeardown, runLifecycleWhoami, runLifecycleUnknown } from "./handlers/lifecycle";
 import { runComponentsStatus, runComponentsReleaseRecord, runComponentsExport, runComponentsUnknown } from "./handlers/components";
 import { runScenarioCheck, runScenarioUnknown } from "./handlers/scenario";
 import { runGraph } from "./handlers/graph";
@@ -461,10 +461,12 @@ Commands:
                          --all-projects)
   migrate <file>        Translate a workflow between lexicons
                         (default: --from github --to gitlab)
-  carve advise          Read-only Terraform peelability advisor: rank which
-                        --from <tf-dir>   resources are cheap to carve into native chant
+  carve advise          Read-only peelability advisor: rank which resources
+                        --from <dir>      are cheap to carve into native chant
                         (--json, --report <path>). Emits nothing, changes nothing.
-                        Needs @cdktf/hcl2json (npm install -D @cdktf/hcl2json).
+                        --from a Terraform dir needs @cdktf/hcl2json
+                        (npm install -D @cdktf/hcl2json); --from a CDK cloud
+                        assembly (cdk.out) needs nothing and ranks constructs.
   carve emit            Adopt a selected TF resource into chant source + report
                         --from <tf-dir>   its boundary. --state <tfstate> adopts offline
                         --select <addr>   (recommended for TF-managed resources); --env
@@ -556,6 +558,9 @@ Lifecycle (alias: lc):
   lifecycle plan <env>      Typed change set (create/update/delete/adopt) vs live
   lifecycle affected        Stacks a change affects (--base <ref> [--include-dependents])
                             --json: emit the ChangeSet as JSON
+  lifecycle whoami <env>    Who chant would act as in each configured lexicon,
+                            and what that principal is scoped to — read-only,
+                            before anything acts (--json, --strict)
   lifecycle teardown <env>  Plan what deleting the environment would remove —
                             marker-scoped (this project's stack + env); --yes
                             executes the plan (production-like names also need
@@ -646,7 +651,8 @@ Options:
   --from <name>         Source lexicon for migrate (default: github)
   --to <name>           Target lexicon for migrate (default: gitlab)
   --emit <fmt>          Migration output format: yaml (default) or ts
-  --strict              Escalate needs-review/validation to errors (migrate)
+  --strict              Escalate needs-review/validation to errors (migrate);
+                        exit nonzero on an unresolved identity (lifecycle whoami)
   --validate            Run external validator (glci/glab) after migrate
   --use-composites      Rewrite to composite calls when patterns match (migrate)
   --components          Target discovered Component declarations instead of
@@ -882,6 +888,7 @@ const registry: CommandDef[] = [
   { name: "lifecycle rollback", handler: runLifecycleRollback },
   { name: "lifecycle plan", requiresPlugins: true, handler: runLifecyclePlan },
   { name: "lifecycle affected", requiresPlugins: true, handler: runLifecycleAffected },
+  { name: "lifecycle whoami", requiresPlugins: true, handler: runLifecycleWhoami },
   { name: "lifecycle teardown", requiresPlugins: true, handler: runLifecycleTeardown },
   { name: "lifecycle log", handler: runLifecycleLog },
 

package/src/identity.test.ts

@@ -0,0 +1,199 @@
+import { describe, test, expect } from "vitest";
+import {
+  describeIdentities,
+  identityRowFor,
+  identityStatusText,
+  isUnresolvedIdentity,
+  redactCredentialMaterial,
+  redactIdentityRow,
+  REDACTED,
+  type IdentityPlugin,
+} from "./identity";
+
+describe("the identity tri-state (#1982)", () => {
+  test("a lexicon with no describeIdentity is not-reported, never an empty identity", async () => {
+    const rows = await describeIdentities([{ name: "github" }], { environment: "prod" }, {});
+    expect(rows).toEqual([{ lexicon: "github", status: "not-reported" }]);
+    expect(rows[0].identity).toBeUndefined();
+    expect(identityStatusText(rows[0])).toContain("not reported");
+  });
+
+  test("a resolved identity carries principal, scope, source and endpoint", async () => {
+    const plugin: IdentityPlugin = {
+      name: "aws",
+      describeIdentity: async () => ({
+        identity: "arn:aws:sts::491500000000:assumed-role/deploy/ci",
+        scope: "491500000000 us-east-1",
+        source: "env AWS_ACCESS_KEY_ID",
+        endpoint: "https://sts.us-east-1.amazonaws.com/",
+      }),
+    };
+    const [row] = await describeIdentities([plugin], { environment: "prod" }, {});
+    expect(row).toEqual({
+      lexicon: "aws",
+      status: "reported",
+      identity: "arn:aws:sts::491500000000:assumed-role/deploy/ci",
+      scope: "491500000000 us-east-1",
+      source: "env AWS_ACCESS_KEY_ID",
+      endpoint: "https://sts.us-east-1.amazonaws.com/",
+    });
+  });
+
+  test("no credentials and could-not-determine are distinguishable answers", async () => {
+    const rows = await describeIdentities(
+      [
+        { name: "aws", describeIdentity: async () => ({ unresolved: { reason: "no-credentials" } }) },
+        {
+          name: "k8s",
+          describeIdentity: async () => ({ unresolved: { reason: "read-failed", detail: "connection refused" } }),
+        },
+      ],
+      { environment: "prod" },
+      {},
+    );
+    expect(rows[0]).toEqual({ lexicon: "aws", status: "unresolved", reason: "no-credentials" });
+    expect(identityStatusText(rows[0])).toContain("no identity is configured");
+    expect(rows[1]).toEqual({
+      lexicon: "k8s",
+      status: "unresolved",
+      reason: "read-failed",
+      detail: "connection refused",
+    });
+    expect(identityStatusText(rows[1])).toContain("self-query failed");
+    // The point of the distinction: "nothing is configured" and "I could not
+    // find out" must never render as the same row.
+    expect(identityStatusText(rows[0])).not.toBe(identityStatusText(rows[1]));
+  });
+
+  test("an empty principal is refused rather than reported as an identity", () => {
+    const row = identityRowFor("gcp", { identity: "   ", scope: "acme-prod", source: "ADC" }, {});
+    expect(row.status).toBe("unresolved");
+    expect(row.reason).toBe("read-failed");
+    expect(row.identity).toBeUndefined();
+  });
+
+  test("a lexicon that throws degrades to read-failed and never fails the run", async () => {
+    const rows = await describeIdentities(
+      [
+        {
+          name: "azure",
+          describeIdentity: async () => {
+            throw new Error("az CLI is not installed");
+          },
+        },
+        { name: "aws", describeIdentity: async () => ({ identity: "arn:x", scope: "s", source: "env" }) },
+      ],
+      { environment: "prod" },
+      {},
+    );
+    expect(rows[0]).toEqual({
+      lexicon: "azure",
+      status: "unresolved",
+      reason: "read-failed",
+      detail: "az CLI is not installed",
+    });
+    expect(rows[1].status).toBe("reported");
+  });
+
+  test("rows come back in the order the lexicons were configured", async () => {
+    const names = ["k8s", "aws", "gcp", "github"];
+    const rows = await describeIdentities(
+      names.map((name) => ({ name })),
+      { environment: "prod" },
+      {},
+    );
+    expect(rows.map((r) => r.lexicon)).toEqual(names);
+  });
+
+  test("the environment, region and cwd reach the lexicon unchanged", async () => {
+    const seen: unknown[] = [];
+    await describeIdentities(
+      [
+        {
+          name: "aws",
+          describeIdentity: async (options) => {
+            seen.push(options);
+            return { identity: "arn:x", scope: "s", source: "env" };
+          },
+        },
+      ],
+      { environment: "prod", region: "eu-west-1", cwd: "/repo" },
+      {},
+    );
+    expect(seen).toEqual([{ environment: "prod", region: "eu-west-1", cwd: "/repo" }]);
+  });
+
+  test("isUnresolvedIdentity discriminates the two return shapes", () => {
+    expect(isUnresolvedIdentity({ unresolved: { reason: "no-binding" } })).toBe(true);
+    expect(isUnresolvedIdentity({ identity: "a", scope: "b", source: "c" })).toBe(false);
+  });
+});
+
+describe("no credential reaches the output (#1982)", () => {
+  test("a value held in a credential-named env var is redacted wherever it appears", () => {
+    const env = { GITHUB_TOKEN: "ghp_averyrealtokenvalue", HOME: "/Users/x" };
+    expect(redactCredentialMaterial("authorized by ghp_averyrealtokenvalue", env)).toBe(
+      `authorized by ${REDACTED}`,
+    );
+  });
+
+  test("every free-text field of a row is scrubbed, not just the identity", () => {
+    const env = { AWS_SECRET_ACCESS_KEY: "wJalrXUtnFEMIsecretKEY" };
+    const row = redactIdentityRow(
+      {
+        lexicon: "aws",
+        status: "reported",
+        identity: "wJalrXUtnFEMIsecretKEY",
+        scope: "wJalrXUtnFEMIsecretKEY",
+        source: "signed with wJalrXUtnFEMIsecretKEY",
+        endpoint: "https://sts.amazonaws.com/?k=wJalrXUtnFEMIsecretKEY",
+        detail: "wJalrXUtnFEMIsecretKEY",
+      },
+      env,
+    );
+    for (const field of [row.identity, row.scope, row.source, row.endpoint, row.detail]) {
+      expect(field).not.toContain("wJalrXUtnFEMIsecretKEY");
+      expect(field).toContain(REDACTED);
+    }
+  });
+
+  test("a short env value is not treated as a credential", () => {
+    // Redacting "dev" out of every identity would be worse than the leak.
+    expect(redactCredentialMaterial("cluster dev-a", { AUTH_TOKEN: "dev" })).toBe("cluster dev-a");
+  });
+
+  test("literal credential shapes are redacted with no env var involved", () => {
+    const jwt = "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.dBjftJeZ4CVPmB92K27u";
+    expect(redactCredentialMaterial(jwt, {})).toBe(REDACTED);
+    expect(redactCredentialMaterial("Bearer abcdefghijklmnopqrstuvwxyz012345", {})).toBe(REDACTED);
+    expect(
+      redactCredentialMaterial("-----BEGIN RSA PRIVATE KEY-----\nAAAA\n-----END RSA PRIVATE KEY-----", {}),
+    ).toBe(REDACTED);
+  });
+
+  test("real principals survive redaction unchanged", () => {
+    // A mangled principal is a wrong answer, not a safe one. Nothing here is
+    // entropy-scored, so these pass through whole.
+    const env = { AWS_SESSION_TOKEN: "FwoGZXIvYXdzEBYaDLONGSESSIONTOKEN" };
+    for (const principal of [
+      "arn:aws:sts::491500000000:assumed-role/deploy/ci",
+      "system:serviceaccount:chant:deployer",
+      "deploy@acme.iam.gserviceaccount.com",
+      "https://prod-eks-a.eu-west-1.eks.amazonaws.com",
+      "491500000000 us-east-1",
+    ]) {
+      expect(redactCredentialMaterial(principal, env)).toBe(principal);
+    }
+  });
+
+  test("an identity built out of the session token is redacted, not printed", () => {
+    const env = { AWS_SESSION_TOKEN: "FwoGZXIvYXdzEBYaDLONGSESSIONTOKEN" };
+    const row = identityRowFor(
+      "aws",
+      { identity: "FwoGZXIvYXdzEBYaDLONGSESSIONTOKEN", scope: "us-east-1", source: "env" },
+      env,
+    );
+    expect(row.identity).toBe(REDACTED);
+    expect(row.identity).not.toContain("FwoGZXIvYXdz");
+  });
+});