@dragonmastery/tamer 0.35.1 → 0.35.3

package/dist/tamer.mjs

@@ -7808,7 +7808,8 @@ function defaultWorkerSecretsLoadFile(workerDir, env) {
 }
 /**
 * When loading for a worker, only `secrets.required` names are imported.
-* Returns keys to upsert; throws if the file contains undeclared names.
+* Extra keys in the file that aren't declared are logged as a warning but
+* do not block loading.
 */
 function filterSecretsLoadEntriesForWorker(fileEntries, required$1) {
 	const requiredSet = new Set(required$1);
@@ -7816,10 +7817,11 @@ function filterSecretsLoadEntriesForWorker(fileEntries, required$1) {
 	const entries = {};
 	for (const [name, value] of Object.entries(fileEntries)) if (requiredSet.has(name)) entries[name] = value;
 	else extras.push(name);
-	if (extras.length > 0) throw new Error(`secrets load: file contains key(s) not in worker secrets.required: ${extras.sort().join(", ")}`);
+	if (extras.length > 0) console.warn(`secrets load: ignoring key(s) not in worker secrets.required: ${extras.sort().join(", ")}`);
 	return {
 		entries,
-		missing: required$1.filter((name) => !(name in fileEntries)).sort()
+		missing: required$1.filter((name) => !(name in fileEntries)).sort(),
+		extras
 	};
 }
 /**
@@ -8168,8 +8170,17 @@ const STATUS_LABEL = {
 	removed_from_vault: "removed from vault",
 	undeclared_on_worker: "not in secrets.required"
 };
-function isDeclaredIssue(status) {
-	return status !== "in_sync" && status !== "undeclared_on_worker";
+/**
+* Only `declared_no_value` (secret declared in config but missing from vault)
+* is a hard failure — that's the "you forgot to set a secret" case that
+* should block CI before deploy.
+*
+* `never_deployed` and `rotated_not_deployed` are normal pre-deploy states:
+* the secret IS in the vault, deploy will push it. They're reported
+* informationally but don't fail the command.
+*/
+function isDeclaredFailure(status) {
+	return status === "declared_no_value" || status === "removed_from_vault";
 }
 function sortEntries(entries) {
 	return [...entries].sort((a, b) => secretDerivedName(a.worker, a.name).localeCompare(secretDerivedName(b.worker, b.name)));
@@ -8216,13 +8227,16 @@ async function runSecretsVerify(options) {
 		for (const entry of onWorkerOnly) printEntry(entry);
 		console.log("");
 	}
-	const declaredIssues = declared.filter((e) => isDeclaredIssue(e.status)).length;
-	if (declaredIssues === 0) {
-		const suffix = onWorkerOnly.length > 0 ? ` (${onWorkerOnly.length} on worker but not in config — informational only)` : "";
-		console.log(`All declared secrets in sync.${suffix}\n`);
+	const failures = declared.filter((e) => isDeclaredFailure(e.status));
+	const pending = declared.filter((e) => !isDeclaredFailure(e.status) && e.status !== "in_sync");
+	if (failures.length === 0) {
+		const parts = ["All declared secrets are in the vault."];
+		if (pending.length > 0) parts.push(`${pending.length} will be pushed on next deploy.`);
+		if (onWorkerOnly.length > 0) parts.push(`${onWorkerOnly.length} on worker but not in config (informational only).`);
+		console.log(`${parts.join(" ")}\n`);
 		return 0;
 	}
-	console.log(`${declaredIssues} declared secret(s) need attention.\n`);
+	console.log(`${failures.length} declared secret(s) missing from vault — run \`tamer secrets set\` or \`tamer secrets load\` before deploying.\n`);
 	return 1;
 }