@dragonmastery/tamer 0.31.4 → 0.31.5

package/dist/tamer.mjs

@@ -8041,13 +8041,7 @@ function secretsDrift(entries) {
 					detail: "removed from vault"
 				});
 				break;
-			case "undeclared_on_worker":
-				drift.unrecordedInState.push({
-					logicalName: e.name,
-					derivedName,
-					detail: "undeclared on worker"
-				});
-				break;
+			case "undeclared_on_worker": break;
 		}
 	}
 	return drift;
@@ -8102,8 +8096,20 @@ const STATUS_LABEL = {
 	never_deployed: "never deployed",
 	rotated_not_deployed: "rotated, not deployed",
 	removed_from_vault: "removed from vault",
-	undeclared_on_worker: "undeclared on worker"
+	undeclared_on_worker: "not in secrets.required"
 };
+function isDeclaredIssue(status) {
+	return status !== "in_sync" && status !== "undeclared_on_worker";
+}
+function sortEntries(entries) {
+	return [...entries].sort((a, b) => secretDerivedName(a.worker, a.name).localeCompare(secretDerivedName(b.worker, b.name)));
+}
+function printEntry(entry) {
+	const label = STATUS_LABEL[entry.status];
+	const id = secretDerivedName(entry.worker, entry.name);
+	const workerFlag = entry.onWorker ? "on worker" : "not on worker";
+	console.log(`  ${id}  ${label} (${workerFlag})`);
+}
 async function runSecretsVerify(options) {
 	const ctx = await createSecretsContext({
 		env: options.env,
@@ -8123,21 +8129,31 @@ async function runSecretsVerify(options) {
 		vault: vaultReaderFromVault(ctx.vault),
 		state: ctx.state
 	});
+	const declared = sortEntries(entries.filter((e) => e.status !== "undeclared_on_worker"));
+	const onWorkerOnly = sortEntries(entries.filter((e) => e.status === "undeclared_on_worker"));
 	console.log(`\nSecrets verify — env ${ctx.env}\n`);
-	if (entries.length === 0) {
+	if (declared.length === 0 && onWorkerOnly.length === 0) {
 		console.log("  (no declared secrets)\n");
 		return 0;
 	}
-	let issues = 0;
-	for (const entry of entries.sort((a, b) => secretDerivedName(a.worker, a.name).localeCompare(secretDerivedName(b.worker, b.name)))) {
-		const label = STATUS_LABEL[entry.status];
-		const id = secretDerivedName(entry.worker, entry.name);
-		const workerFlag = entry.onWorker ? "on worker" : "not on worker";
-		console.log(`  ${id}  ${label} (${workerFlag})`);
-		if (entry.status !== "in_sync") issues += 1;
+	if (declared.length > 0) {
+		console.log("  Declared in config (secrets.required):\n");
+		for (const entry of declared) printEntry(entry);
+		console.log("");
+	}
+	if (onWorkerOnly.length > 0) {
+		console.log("  On worker, not in secrets.required (outside Tamer management — add to config or remove from worker):\n");
+		for (const entry of onWorkerOnly) printEntry(entry);
+		console.log("");
+	}
+	const declaredIssues = declared.filter((e) => isDeclaredIssue(e.status)).length;
+	if (declaredIssues === 0) {
+		const suffix = onWorkerOnly.length > 0 ? ` (${onWorkerOnly.length} on worker but not in config — informational only)` : "";
+		console.log(`All declared secrets in sync.${suffix}\n`);
+		return 0;
 	}
-	console.log(issues === 0 ? "\nAll declared secrets in sync.\n" : `\n${issues} secret(s) need attention.\n`);
-	return issues === 0 ? 0 : 1;
+	console.log(`${declaredIssues} declared secret(s) need attention.\n`);
+	return 1;
 }
 
 //#endregion