@intentius/chant 0.45.0 → 0.46.0

package/src/cli/commands/build.test.ts

@@ -309,6 +309,137 @@ export const testEntity = {
     });
   });
 
+  describe("#1221 — dynamic-env legality against declared environments", () => {
+    const thisDir = dirname(fileURLToPath(import.meta.url));
+    const runtimePath = resolvePath(thisDir, "../../runtime");
+    const paramsPath = resolvePath(thisDir, "../../params");
+
+    // Serializer exposing the physical name (from params.env interpolation)
+    // next to the ownership marker, so one test can assert both are disjoint
+    // across two builds.
+    const namingSerializer: Serializer = {
+      name: "aws",
+      rulePrefix: "TEST",
+      serialize: (entities, _outputs, context) =>
+        JSON.stringify(
+          [...entities.values()].map((e) => ({
+            name: (e as unknown as { props: { name: string } }).props.name,
+            marker: context?.ownership,
+          })),
+        ),
+    };
+
+    async function writeProject(environments: string) {
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `
+          export default {
+            environments: ${environments},
+            ownership: { stack: "billing", env: { param: "env" } },
+            buildParams: {
+              env: { type: "string", default: "dev" },
+            },
+          };
+        `,
+      );
+      await writeFile(
+        join(testDir, "resources.ts"),
+        `
+          import { createResource } from ${JSON.stringify(runtimePath)};
+          export const Bucket = createResource("Test::Bucket", "aws", { arn: "Arn" });
+        `,
+      );
+      await writeFile(
+        join(testDir, "main.ts"),
+        `
+          import { Bucket } from "./resources";
+          import { params } from ${JSON.stringify(paramsPath)};
+          export const uploads = new Bucket({ name: \`billing-\${params.env}-uploads\` });
+        `,
+      );
+    }
+
+    function built(): Array<{ name: string; marker?: { stack: string; env?: string } }> {
+      return JSON.parse(readFileSync(outputFile, "utf-8"));
+    }
+
+    async function buildWithEnv(env: string) {
+      return buildCommand({
+        path: testDir,
+        output: outputFile,
+        format: "json",
+        serializers: [namingSerializer],
+        params: { env },
+      });
+    }
+
+    test("--param env=pr-42 is legal when a pr-* pattern entry is declared", async () => {
+      await writeProject(`["dev", "prod", "pr-*"]`);
+      const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+      try {
+        const result = await buildWithEnv("pr-42");
+        expect(result.errors).toEqual([]);
+        expect(result.success).toBe(true);
+        expect(built()).toEqual([{ name: "billing-pr-42-uploads", marker: { stack: "billing", env: "pr-42" } }]);
+      } finally {
+        errorSpy.mockRestore();
+      }
+    });
+
+    test("--param env outside the declared entries (no pattern covers it) fails the build", async () => {
+      await writeProject(`["dev", "prod"]`);
+      const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+      try {
+        const result = await buildWithEnv("pr-42");
+        expect(result.success).toBe(false);
+        expect(result.errors.some((e) => e.includes('Unknown environment "pr-42"'))).toBe(true);
+      } finally {
+        errorSpy.mockRestore();
+      }
+    });
+
+    test("a literal entry still matches by equality", async () => {
+      await writeProject(`["dev", "prod", "pr-*"]`);
+      const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+      try {
+        const result = await buildWithEnv("prod");
+        expect(result.errors).toEqual([]);
+        expect(built()).toEqual([{ name: "billing-prod-uploads", marker: { stack: "billing", env: "prod" } }]);
+      } finally {
+        errorSpy.mockRestore();
+      }
+    });
+
+    test("two builds with different --param env yield disjoint names and disjoint markers", async () => {
+      await writeProject(`["dev", "prod", "pr-*"]`);
+      const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+      try {
+        expect((await buildWithEnv("pr-1")).success).toBe(true);
+        const first = built();
+        expect((await buildWithEnv("pr-2")).success).toBe(true);
+        const second = built();
+        expect(first).toEqual([{ name: "billing-pr-1-uploads", marker: { stack: "billing", env: "pr-1" } }]);
+        expect(second).toEqual([{ name: "billing-pr-2-uploads", marker: { stack: "billing", env: "pr-2" } }]);
+        expect(first[0].name).not.toBe(second[0].name);
+        expect(first[0].marker?.env).not.toBe(second[0].marker?.env);
+      } finally {
+        errorSpy.mockRestore();
+      }
+    });
+
+    test("a project with no declared environments accepts any dynamic value, as before", async () => {
+      await writeProject(`undefined`);
+      const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+      try {
+        const result = await buildWithEnv("anything-goes");
+        expect(result.errors).toEqual([]);
+        expect(built()).toEqual([{ name: "billing-anything-goes-uploads", marker: { stack: "billing", env: "anything-goes" } }]);
+      } finally {
+        errorSpy.mockRestore();
+      }
+    });
+  });
+
   test("#1064 — a declared build-time parameter binds to params.<name> and folds to a literal", async () => {
     const thisDir = dirname(fileURLToPath(import.meta.url));
     const runtimePath = resolvePath(thisDir, "../../runtime");

package/src/cli/commands/build.ts

@@ -4,9 +4,11 @@ import {
   resolveOwnershipMarker,
   resolveOwnershipEnv,
   ownershipEnvDisagreement,
+  isOwnershipParamRef,
   resolveFoldEnabled,
   resolveSandboxEnabled,
 } from "../../config";
+import { unknownEnvError } from "../../env";
 import type { OwnershipMarker } from "../../ownership";
 import { resolveCliBuildParams } from "../build-params-cli";
 import type { Serializer, SerializerResult } from "../../serializer";
@@ -258,6 +260,24 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   const disagreement = ownershipEnvDisagreement(config, paramsResolution.provenance);
   if (disagreement) warnings.push(formatWarning({ message: disagreement }));
 
+  // #1221 — dynamic-env legality. `--env` is validated against the declared
+  // `environments` in cli/main.ts; a param-bound `ownership.env` supplied via
+  // `--param env=<value>` reached here unchecked, so `--param env=pord`
+  // stamped a marker for an environment the project never declared. Same
+  // check, same site of truth: literal entries match by equality, entries
+  // containing `*` (e.g. `"pr-*"`) match as glob patterns, so an unbounded
+  // family like per-PR environments is declarable without listing each name.
+  if (isOwnershipParamRef(config.ownership?.env)) {
+    const dynamicEnvErr = unknownEnvError(env, config.environments);
+    if (dynamicEnvErr) {
+      errors.push(formatError({
+        message: dynamicEnvErr,
+        hint: 'Declare it in chant.config `environments` (a "pr-*" pattern entry covers a dynamic family), or pass a declared value.',
+      }));
+      return { success: false, resourceCount: 0, fileCount: 0, errors, warnings };
+    }
+  }
+
   // #1039 — thread each loaded plugin's registered intrinsics (e.g. AWS's
   // `Sub`) through to the fold path, so a file using a registered intrinsic
   // tagged template folds instead of unconditionally falling back to run.

package/src/cli/commands/check-lexicon.test.ts

@@ -1,7 +1,9 @@
 import { describe, test, expect } from "vitest";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
-import { checkLexicon } from "./check-lexicon";
+import { checkLexicon, coverageReportCheck } from "./check-lexicon";
+import { loadLexiconFromDir } from "./check-lexicon-plugin";
+import type { LexiconPlugin } from "../../lexicon";
 
 // chant #1067 — check-lexicon.ts had zero tests before this issue, despite
 // being the tool meant to gate every lexicon's completeness. This locks in
@@ -32,3 +34,45 @@ describe("checkLexicon", () => {
     expect(matches?.pass).toBe(true);
   });
 });
+
+// chant #1330 — fountain's spec-coverage gate lived only in its own
+// coverage.test.ts, a convention rather than a check-lexicon contract. These
+// lock in the tier-1 check over the plugin's coverageReport() member: red on
+// an unaccounted kind, vacuous pass without the member, red on a throw, and
+// green against the real fountain lexicon in this repo.
+describe("coverageReportCheck", () => {
+  test("fails when the report leaves a kind unaccounted", async () => {
+    const plugin = {
+      coverageReport: async () => ({ unaccountedKinds: ["SandboxRequest"] }),
+    } as unknown as LexiconPlugin;
+    const item = await coverageReportCheck(plugin);
+    expect(item.tier).toBe(1);
+    expect(item.pass).toBe(false);
+    expect(item.detail).toContain("SandboxRequest");
+  });
+
+  test("passes vacuously when the plugin has no coverageReport", async () => {
+    const item = await coverageReportCheck({} as LexiconPlugin);
+    expect(item.pass).toBe(true);
+    expect(item.detail).toBeUndefined();
+  });
+
+  test("fails when the report throws", async () => {
+    const plugin = {
+      coverageReport: async () => {
+        throw new Error("snapshot missing");
+      },
+    } as unknown as LexiconPlugin;
+    const item = await coverageReportCheck(plugin);
+    expect(item.pass).toBe(false);
+    expect(item.detail).toContain("snapshot missing");
+  });
+
+  test("is green on the current fountain lexicon", async () => {
+    const loaded = await loadLexiconFromDir(join(repoRoot, "lexicons", "fountain"));
+    expect(loaded.plugin).toBeDefined();
+    const item = await coverageReportCheck(loaded.plugin);
+    expect(item.pass).toBe(true);
+    expect(item.detail).toBe("all spec kinds accounted for");
+  });
+});

package/src/cli/commands/check-lexicon.ts

@@ -6,6 +6,7 @@ import { auditDocsClassification, auditDocsReachability } from "./check-lexicon-
 import { auditMcpNames, lexiconNameFor } from "./check-lexicon-mcp";
 import { loadLexiconFromDir, registers, safeList } from "./check-lexicon-plugin";
 import { RULE_CATALOG } from "../../audit/catalog";
+import type { LexiconPlugin } from "../../lexicon";
 
 // ── Types ────────────────────────────────────────────────────────────
 
@@ -66,6 +67,45 @@ function countSubdirs(dir: string): number {
     .length;
 }
 
+/**
+ * #1330 — gate on the plugin's own spec-coverage accounting.
+ *
+ * fountain's `coverage.test.ts` asserts `unaccountedKinds == []` in CI, but a
+ * lexicon-local test is a convention, not a check-lexicon contract — the same
+ * class of gap #1342 closed for LSP providers. `coverageReport()` gives core
+ * the one fact to gate on: which upstream spec kinds are neither modeled nor
+ * on the lexicon's exclusion list. A lexicon without the member passes
+ * vacuously, the same conditional shape as the docs-reachability and
+ * Diátaxis checks; a report that throws fails, for the same reason `safeList`
+ * treats a throw as worse than absence.
+ */
+export async function coverageReportCheck(plugin: LexiconPlugin | undefined): Promise<CheckItem> {
+  const report = plugin?.coverageReport;
+  const hasReport = typeof report === "function";
+  let unaccounted: string[] = [];
+  let error: string | undefined;
+  if (hasReport) {
+    try {
+      unaccounted = (await report.call(plugin))?.unaccountedKinds ?? [];
+    } catch (e) {
+      error = e instanceof Error ? e.message : String(e);
+    }
+  }
+  return {
+    name: "coverageReport() leaves no spec kind unaccounted",
+    tier: 1,
+    pass: !hasReport || (error === undefined && unaccounted.length === 0),
+    detail:
+      error !== undefined
+        ? `threw: ${error}`
+        : unaccounted.length > 0
+          ? `${unaccounted.length} unaccounted: ${unaccounted.join(", ")}`
+          : hasReport
+            ? "all spec kinds accounted for"
+            : undefined,
+  };
+}
+
 // ── Check runner ─────────────────────────────────────────────────────
 
 /**
@@ -389,6 +429,11 @@ export async function checkLexicon(dir: string): Promise<CheckResult> {
         : undefined,
   });
 
+  // #1330 — fountain's spec-coverage gate lived in a lexicon-local vitest
+  // assertion, a convention rather than a check-lexicon contract. The plugin
+  // now states the fact directly via `coverageReport()`.
+  items.push(await coverageReportCheck(plugin));
+
   // ── Tier 2: Recommended ────────────────────────────────────────
 
   const pluginContent = readOr(join(dir, "src/plugin.ts"));

package/src/cli/commands/lexicon-surface-diff.ts

@@ -9,6 +9,12 @@
  *
  * The snapshot file is written to `<lexicon-dir>/surface.snapshot.json`.
  * Pass `--update-snapshot` to commit the fresh snapshot after a successful run.
+ *
+ * An update run is exempt from the `surface-matches-snapshot` validate check
+ * and from nothing else (#1825): that check fails on the stale baseline the
+ * run exists to replace, and with an `"always"` gate (#1475) the documented
+ * re-baseline flow would deadlock. Any other failing step still refuses the
+ * write, so a broken generate cannot be baselined.
  */
 
 import { existsSync, readFileSync } from "fs";
@@ -78,6 +84,9 @@ export async function runSurfaceDiff(opts: SurfaceDiffOptions): Promise<RegenRes
     skipLint: opts.skipLint,
     skipExamples: !opts.runExamples,
     pinnedDigestPath: opts.pinnedDigestPath,
+    // The update run skips only the surface-matches-snapshot validate check —
+    // the staleness it is about to fix (#1825).
+    updatingSnapshot: opts.updateSnapshot,
   });
 
   // Update snapshot when requested and the run succeeded

package/src/cli/commands/lexicon-surface-diff.update.test.ts

@@ -0,0 +1,112 @@
+/**
+ * `--update-snapshot` against a failing snapshot gate (#1825).
+ *
+ * Since #1475 the k8s/azure gates run in "always" mode, so a stale baseline
+ * fails validate on every run — including the update run whose whole purpose
+ * is to replace that baseline. These tests run the real pipeline (no mocks)
+ * against a fixture lexicon whose validate script behaves like an "always"
+ * gate: it fails while the committed snapshot is stale, unless the run is
+ * exempted via CHANT_SNAPSHOT_UPDATE.
+ */
+
+import { describe, test, expect } from "vitest";
+import { mkdtempSync, rmSync, writeFileSync, readFileSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { runSurfaceDiff } from "./lexicon-surface-diff";
+import { SNAPSHOT_FILENAME } from "../../codegen/lexicon-regen";
+import { parseSnapshot } from "../../codegen/surface-snapshot";
+
+const STALE_SNAPSHOT = JSON.stringify({
+  schemaVersion: 1,
+  generatedAt: "2026-01-01T00:00:00.000Z",
+  entries: { Queue: { kind: "resource", resourceType: "X::Y::Queue", attrs: [], props: [] } },
+});
+
+const GENERATE_SCRIPT = `node -e "
+const fs = require('fs');
+const path = require('path');
+const dir = path.join(process.cwd(), 'src', 'generated');
+fs.mkdirSync(dir, { recursive: true });
+fs.writeFileSync(path.join(dir, 'lexicon-test.json'), JSON.stringify({Widget:{kind:'resource',resourceType:'X::Y::Widget',attrs:{Id:'Id'}}}));
+fs.writeFileSync(path.join(dir, 'index.d.ts'), 'export declare class Widget { constructor(props: { Name?: string; }); readonly Id: string; }');
+"`;
+
+// Emulates a checkSurfaceSnapshot: "always" gate: fail while the committed
+// snapshot does not describe the generated surface, unless the run carries the
+// update exemption.
+const GATED_VALIDATE_SCRIPT = `node -e "
+if (process.env.CHANT_SNAPSHOT_UPDATE === '1') process.exit(0);
+const fs = require('fs');
+const path = require('path');
+const snap = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'surface.snapshot.json'), 'utf-8'));
+process.exit(snap.entries && snap.entries.Widget ? 0 : 1);
+"`;
+
+function makeLexiconDir(validateScript: string): string {
+  const dir = mkdtempSync(join(tmpdir(), "chant-sd-update-"));
+  const pkg = {
+    name: "@intentius/chant-lexicon-test",
+    version: "0.1.0",
+    type: "module",
+    scripts: {
+      generate: GENERATE_SCRIPT,
+      validate: validateScript,
+    },
+  };
+  writeFileSync(join(dir, "package.json"), JSON.stringify(pkg, null, 2));
+  writeFileSync(join(dir, SNAPSHOT_FILENAME), STALE_SNAPSHOT);
+  return dir;
+}
+
+const baseOpts = { skipBundle: true, skipBuild: true, skipLint: true };
+
+describe("surface-diff --update-snapshot vs. an \"always\" snapshot gate (#1825)", () => {
+  test("without --update-snapshot the stale snapshot still fails validate", async () => {
+    const dir = makeLexiconDir(GATED_VALIDATE_SCRIPT);
+    try {
+      const result = await runSurfaceDiff({ lexiconDir: dir, ...baseOpts });
+      expect(result.ok).toBe(false);
+      expect(result.failures.some((f) => f.step === "validate")).toBe(true);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("stale snapshot + healthy codegen: the update succeeds and the snapshot matches after", async () => {
+    const dir = makeLexiconDir(GATED_VALIDATE_SCRIPT);
+    try {
+      const result = await runSurfaceDiff({ lexiconDir: dir, ...baseOpts, updateSnapshot: true });
+      expect(result.ok).toBe(true);
+      expect(result.failures).toEqual([]);
+
+      // The baseline now describes the generated surface, not the stale one.
+      const written = parseSnapshot(readFileSync(join(dir, SNAPSHOT_FILENAME), "utf-8"));
+      expect(written.entries.Widget).toBeDefined();
+      expect(written.entries.Queue).toBeUndefined();
+
+      // A second run against the fresh baseline is green with no exemption.
+      const rerun = await runSurfaceDiff({ lexiconDir: dir, ...baseOpts });
+      expect(rerun.ok).toBe(true);
+      expect(rerun.changed).toBe(false);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("stale snapshot + another failing validate check: the update refuses", async () => {
+    // A validate that fails even with the exemption stands in for any check
+    // other than surface-matches-snapshot. The exemption covers only the
+    // staleness check, so a broken generate cannot be baselined.
+    const dir = makeLexiconDir("node -e \"process.exit(1)\"");
+    try {
+      const result = await runSurfaceDiff({ lexiconDir: dir, ...baseOpts, updateSnapshot: true });
+      expect(result.ok).toBe(false);
+      expect(result.failures.some((f) => f.step === "validate")).toBe(true);
+      // The stale baseline is untouched.
+      expect(readFileSync(join(dir, SNAPSHOT_FILENAME), "utf-8")).toBe(STALE_SNAPSHOT);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});

package/src/cli/commands/lint.ts

@@ -20,6 +20,8 @@ import { GENERATED_MARKER } from "../../discovery/files";
 
 // Import config loader
 import { loadConfig, resolveRulesForFile, resolveConfiguredSeverity, findProjectRoot } from "../../lint/config";
+import { loadChantConfig } from "../../config";
+import type { LintProjectConfig } from "../../lint/rule";
 
 /**
  * Type guard to check if a value conforms to the LintRule interface.
@@ -447,6 +449,17 @@ export async function lintCommand(options: LintOptions): Promise<LintResult> {
   const config = loadConfig(projectRoot);
   const hasOverrides = config.overrides && config.overrides.length > 0;
 
+  // chant #1221 — the project's chant.config slice for config-aware rules
+  // (COR021 reads `environments` + `ownership`), threaded into every
+  // runLint() call below via LintContext.projectConfig. Best-effort: a
+  // directory with no project config lints with those rules silent.
+  let projectConfig: LintProjectConfig | undefined;
+  try {
+    projectConfig = (await loadChantConfig(projectRoot)).config as LintProjectConfig;
+  } catch {
+    projectConfig = undefined;
+  }
+
   // Load all rules from lexicon plugins (core "chant" + lexicon-specific)
   const loaded = await loadAllPluginRules(projectRoot);
   let allRules = loaded.rules;
@@ -470,7 +483,7 @@ export async function lintCommand(options: LintOptions): Promise<LintResult> {
   let diagnostics: LintDiagnostic[];
   let suppressed: Array<LintDiagnostic & { reason?: string }> = [];
   if (options.rules) {
-    const result = await runLint(files, options.rules, undefined, intrinsics);
+    const result = await runLint(files, options.rules, undefined, intrinsics, projectConfig);
     diagnostics = result.diagnostics;
     suppressed = result.suppressed;
   } else if (hasOverrides) {
@@ -478,13 +491,13 @@ export async function lintCommand(options: LintOptions): Promise<LintResult> {
     for (const file of files) {
       const relativePath = relative(projectRoot, file);
       const { rules: fileRules, ruleOptions } = getDefaultRules(projectRoot, relativePath, allRules);
-      const result = await runLint([file], fileRules, ruleOptions, intrinsics);
+      const result = await runLint([file], fileRules, ruleOptions, intrinsics, projectConfig);
       diagnostics.push(...result.diagnostics);
       suppressed.push(...result.suppressed);
     }
   } else {
     const { rules, ruleOptions } = getDefaultRules(projectRoot, undefined, allRules);
-    const result = await runLint(files, rules, ruleOptions, intrinsics);
+    const result = await runLint(files, rules, ruleOptions, intrinsics, projectConfig);
     diagnostics = result.diagnostics;
     suppressed = result.suppressed;
   }
@@ -518,7 +531,7 @@ export async function lintCommand(options: LintOptions): Promise<LintResult> {
 
     // Re-lint after fixes to get updated diagnostics
     if (options.rules) {
-      const postResult = await runLint(files, options.rules, undefined, intrinsics);
+      const postResult = await runLint(files, options.rules, undefined, intrinsics, projectConfig);
       diagnostics = postResult.diagnostics;
       suppressed = postResult.suppressed;
     } else if (hasOverrides) {
@@ -527,13 +540,13 @@ export async function lintCommand(options: LintOptions): Promise<LintResult> {
       for (const file of files) {
         const relativePath = relative(projectRoot, file);
         const { rules: fileRules, ruleOptions } = getDefaultRules(projectRoot, relativePath, allRules);
-        const postResult = await runLint([file], fileRules, ruleOptions, intrinsics);
+        const postResult = await runLint([file], fileRules, ruleOptions, intrinsics, projectConfig);
         diagnostics.push(...postResult.diagnostics);
         suppressed.push(...postResult.suppressed);
       }
     } else {
       const { rules, ruleOptions } = getDefaultRules(projectRoot, undefined, allRules);
-      const postResult = await runLint(files, rules, ruleOptions, intrinsics);
+      const postResult = await runLint(files, rules, ruleOptions, intrinsics, projectConfig);
       diagnostics = postResult.diagnostics;
       suppressed = postResult.suppressed;
     }

package/src/cli/handlers/graph.ts

@@ -8,7 +8,7 @@ import { mergeProjectOps } from "../../graph-ops";
 import { reconstructEdges, mergeCatalogs, containmentGroups, type ReferenceCatalog, type ContainmentPair } from "../../graph-refs";
 import { observeResources } from "../../lifecycle/observe";
 import { replaySnapshots, hasSnapshot } from "../../lifecycle/replay";
-import { loadChantConfig, environmentNames, loadChantConfigUpward, type ChantConfig } from "../../config";
+import { loadChantConfig, environmentNames, matchesDeclaredEnvironment, loadChantConfigUpward, type ChantConfig } from "../../config";
 import { applyLiveEndpoint } from "../../live-endpoint";
 import { applyDetail, detailInertNotice, type DetailLevel } from "../../graph-detail";
 import { applyLens, parseLens } from "../../graph-lens";
@@ -210,7 +210,7 @@ async function runGraphLive(
   // observation plugins — load them here, mirroring the lifecycle handlers.
   const plugins = ctx.plugins.length > 0 ? ctx.plugins : await loadPlugins(await resolveProjectLexicons(projectPath));
   const declaredEnvNames = environmentNames(config.environments);
-  if (declaredEnvNames && !declaredEnvNames.includes(environment)) {
+  if (declaredEnvNames && !matchesDeclaredEnvironment(config.environments, environment)) {
     console.error(formatError({
       message: `Unknown environment "${environment}"`,
       hint: `Defined environments: ${declaredEnvNames.join(", ")}`,