@dragonmastery/tamer 0.35.2 → 0.35.3

package/dist/tamer.mjs

@@ -8170,8 +8170,17 @@ const STATUS_LABEL = {
 	removed_from_vault: "removed from vault",
 	undeclared_on_worker: "not in secrets.required"
 };
-function isDeclaredIssue(status) {
-	return status !== "in_sync" && status !== "undeclared_on_worker";
+/**
+* Only `declared_no_value` (secret declared in config but missing from vault)
+* is a hard failure — that's the "you forgot to set a secret" case that
+* should block CI before deploy.
+*
+* `never_deployed` and `rotated_not_deployed` are normal pre-deploy states:
+* the secret IS in the vault, deploy will push it. They're reported
+* informationally but don't fail the command.
+*/
+function isDeclaredFailure(status) {
+	return status === "declared_no_value" || status === "removed_from_vault";
 }
 function sortEntries(entries) {
 	return [...entries].sort((a, b) => secretDerivedName(a.worker, a.name).localeCompare(secretDerivedName(b.worker, b.name)));
@@ -8218,13 +8227,16 @@ async function runSecretsVerify(options) {
 		for (const entry of onWorkerOnly) printEntry(entry);
 		console.log("");
 	}
-	const declaredIssues = declared.filter((e) => isDeclaredIssue(e.status)).length;
-	if (declaredIssues === 0) {
-		const suffix = onWorkerOnly.length > 0 ? ` (${onWorkerOnly.length} on worker but not in config — informational only)` : "";
-		console.log(`All declared secrets in sync.${suffix}\n`);
+	const failures = declared.filter((e) => isDeclaredFailure(e.status));
+	const pending = declared.filter((e) => !isDeclaredFailure(e.status) && e.status !== "in_sync");
+	if (failures.length === 0) {
+		const parts = ["All declared secrets are in the vault."];
+		if (pending.length > 0) parts.push(`${pending.length} will be pushed on next deploy.`);
+		if (onWorkerOnly.length > 0) parts.push(`${onWorkerOnly.length} on worker but not in config (informational only).`);
+		console.log(`${parts.join(" ")}\n`);
 		return 0;
 	}
-	console.log(`${declaredIssues} declared secret(s) need attention.\n`);
+	console.log(`${failures.length} declared secret(s) missing from vault — run \`tamer secrets set\` or \`tamer secrets load\` before deploying.\n`);
 	return 1;
 }