gina 0.6.13 → 0.6.14

package/framework/{v0.6.13 → v0.6.14}/lib/cmd/secrets/check.js

@@ -1,4 +1,3 @@
-var fs      = require('fs');
 var console = lib.logger;
 
 var CmdHelper = require('./../helper');
@@ -66,31 +65,17 @@ var CmdHelper = require('./../helper');
  * @param {object} cmd - The cmd dispatcher object (lib/cmd/index.js)
  */
 function Check(opt, cmd) {
-    var self = { format: 'text', anyUnset: false, scopeName: null, envName: null, envFile: null, envMap: null };
+    var self = { format: 'text', anyUnset: false, anyError: false, scopeName: null, envName: null, envFile: null, envMap: null };
 
     var secrets = lib.secrets;
     var merge   = lib.merge;
 
-    /**
-     * Matches any `${…}` token the substitution pass did not resolve. Mirrors
-     * the guard in `lib/secrets/src/main.js` so this command rejects exactly
-     * what the runtime would reject.
-     *
-     * @inner
-     * @constant
-     * @type {RegExp}
-     */
-    var UNRESOLVED_TOKEN = /\$\{[^}]*\}/;
-
-    /**
-     * Config files are JSON. The loader globs every `.json` in a config
-     * dir; this matches that, then drops dotfiles and `* copy` siblings.
-     *
-     * @inner
-     * @constant
-     * @type {RegExp}
-     */
-    var JSON_EXT = /\.json$/;
+    // The declaration guards (entry shape, `secret:` placeholder, unresolved
+    // token, empty path segment) are consumed via secrets.validateFilePaths —
+    // the RUNTIME's own implementation (lib/secrets/src/declaration.js), not a
+    // local mirror. A hand-kept copy lived here and drifted twice (#B408: the
+    // trim and empty-segment guards never reached it, so this gate green-lit
+    // configs boot refuses); the local UNRESOLVED_TOKEN constant retired with it.
 
     /**
      * Parses `--format`, resolves project + optional bundle via CmdHelper,
@@ -105,6 +90,7 @@ function Check(opt, cmd) {
         if ( !isCmdConfigured() ) return false;
 
         self.anyUnset = false;
+        self.anyError = false;
 
         for (var i = 3, len = process.argv.length; i < len; i++) {
             var arg = process.argv[i];
@@ -154,7 +140,11 @@ function Check(opt, cmd) {
                 return;
             }
             checkAll();
-            process.exit(self.anyUnset ? 1 : 0);
+            // #B409 — declaration errors fail the gate too: the runtime
+            // refuses to boot on them, so an exit keyed on unset keys alone
+            // green-lit a config that cannot start whenever the environment
+            // happened to carry the keys.
+            process.exit((self.anyUnset || self.anyError) ? 1 : 0);
             return;
         }
 
@@ -176,12 +166,16 @@ function Check(opt, cmd) {
             checkProjectOnly(self.projectName);
         }
 
-        process.exit(self.anyUnset ? 1 : 0);
+        // #B409 — same widening as the checkAll branch above.
+        process.exit((self.anyUnset || self.anyError) ? 1 : 0);
     };
 
     /**
-     * Reads a JSON file with comment tolerance via `requireJSON`. Returns
-     * `null` on any I/O or parse error.
+     * Delegates to `lib.secrets.readJsonSafe` rather than reading here: the
+     * scoped-settings and env.json reads below must tolerate exactly the
+     * comment shapes the shared walk tolerates, or the two sides could
+     * disagree about what a config file contains — the drift class the
+     * shared sources module exists to prevent.
      *
      * @inner
      * @private
@@ -189,12 +183,7 @@ function Check(opt, cmd) {
      * @returns {object|null}
      */
     var readJsonSafe = function (filePath) {
-        try {
-            if ( !fs.existsSync(filePath) ) return null;
-            return requireJSON(filePath);
-        } catch (e) {
-            return null;
-        }
+        return secrets.readJsonSafe(filePath);
     };
 
     /**
@@ -223,7 +212,7 @@ function Check(opt, cmd) {
 
     /**
      * Reads one named config file with the `--scope` overlay applied, using
-     * the same merge direction as `collectKeysFromConfigDir` (scope wins,
+     * the same merge direction as the shared config-source walk (scope wins,
      * base back-fills, `override=false` stated explicitly).
      *
      * @inner
@@ -353,11 +342,16 @@ function Check(opt, cmd) {
      * readable files into one map, later entries winning — the same ordering
      * `lib/secrets/backends/file.js` applies.
      *
-     * Validation mirrors `secrets.selectBackend` so this command accepts and
-     * rejects exactly what a boot would: a non-string or empty entry, a
-     * `${secret:…}` placeholder (unresolvable by definition — the backend that
-     * would resolve it is the one being built), and any token the dictionary
-     * did not know.
+     * Validation is `secrets.validateFilePaths` — the SAME implementation
+     * `secrets.selectBackend` runs at boot (lib/secrets/src/declaration.js),
+     * so this command accepts and rejects exactly what a boot would, by
+     * construction rather than by mirroring: a non-string or whitespace-only
+     * entry, a `${secret:…}` placeholder (unresolvable by definition — the
+     * backend that would resolve it is the one being built), any token the
+     * dictionary did not know, and an empty path segment (`//`). It runs on
+     * the POST-substitution values, as the runtime's does, and BEFORE any
+     * layer is read — the runtime reads no file on an invalid declaration,
+     * so neither does this report (#B408).
      *
      * @inner
      * @private
@@ -383,17 +377,6 @@ function Check(opt, cmd) {
         if (!raw.length) return out;
         out.declared = true;
 
-        for (var i = 0; i < raw.length; i++) {
-            if (typeof raw[i] !== 'string' || raw[i] === '') {
-                out.errors.push('`settings.secrets.file` must be a non-empty string or an array of them');
-                return out;
-            }
-            if (raw[i].indexOf('${secret:') > -1) {
-                out.errors.push('`settings.secrets.file` cannot contain a `${secret:…}` placeholder');
-                return out;
-            }
-        }
-
         var resolved;
         try {
             resolved = whisper(buildReps(projectPath, manifest, bundleName), JSON.clone(raw));
@@ -402,20 +385,27 @@ function Check(opt, cmd) {
             return out;
         }
 
+        // The runtime's own declaration guards, run before any layer read —
+        // one shared implementation, so this gate cannot drift lax again
+        // (#B408). On the unresolved-token verdict, append the CLI-only hint:
+        // the runtime reads --scope/--env from whatever launches the bundle,
+        // which an offline report cannot see (§14.3), so under-reading stays
+        // stricter than the runtime, never laxer.
+        var declErrors = secrets.validateFilePaths(resolved);
+        if (declErrors.length) {
+            var declMsg = declErrors[0].message;
+            if (declErrors[0].code === 'file-unresolved-token') {
+                declMsg += ' — pass --scope/--env if it names one, since the runtime'
+                    + ' reads those from whatever launches the bundle';
+            }
+            out.errors.push(declMsg);
+            return out;
+        }
+
         var map    = Object.create(null);
         var origin = Object.create(null);
         for (var p = 0; p < resolved.length; p++) {
             var path = resolved[p];
-            if (UNRESOLVED_TOKEN.test(path)) {
-                // Skip the whole tier rather than stat a literally-named path.
-                // Under-reading can only make this gate stricter than the
-                // runtime; guessing could make it laxer, which is the failure
-                // this command exists to prevent.
-                out.errors.push('unresolved token in `' + path + '`'
-                    + ' — pass --scope/--env if it names one, since the runtime'
-                    + ' reads those from whatever launches the bundle');
-                return out;
-            }
             var layerRead = secrets.readEnvFile(path);
             out.layers.push({
                 path       : path,
@@ -449,7 +439,9 @@ function Check(opt, cmd) {
     };
 
     /**
-     * Loads `<projectPath>/manifest.json`. Returns `null` on failure.
+     * Delegates to `lib.secrets.loadManifest` — the same manifest read the
+     * shared config-source walk performs, so this command and the walk
+     * cannot disagree about what the manifest says.
      *
      * @inner
      * @private
@@ -457,13 +449,13 @@ function Check(opt, cmd) {
      * @returns {object|null}
      */
     var loadManifest = function (projectPath) {
-        return readJsonSafe(_(projectPath + '/manifest.json', true));
+        return secrets.loadManifest(projectPath);
     };
 
     /**
-     * Resolves a bundle's source-dir (relative to the project root) from
-     * the manifest, mirroring `bundle:openapi`. Falls back to the bundle
-     * name when `src` is absent.
+     * Delegates to `lib.secrets.resolveBundleSrc` — the same src lookup the
+     * shared walk uses, kept identical so the settings read below targets
+     * the directory the walk enumerated.
      *
      * @inner
      * @private
@@ -472,92 +464,106 @@ function Check(opt, cmd) {
      * @returns {string}
      */
     var resolveBundleSrc = function (manifest, bundleName) {
-        if ( manifest && manifest.bundles && manifest.bundles[bundleName] && manifest.bundles[bundleName].src ) {
-            return manifest.bundles[bundleName].src;
-        }
-        return bundleName;
+        return secrets.resolveBundleSrc(manifest, bundleName);
     };
 
-    /**
-     * Lists the `.json` files in `dir`, skipping dotfiles and `* copy`
-     * siblings. Empty when the dir is absent.
-     *
-     * @inner
-     * @private
-     * @param {string} dir - Absolute config directory
-     * @returns {string[]}
-     */
-    var listJsonFiles = function (dir) {
-        if ( !fs.existsSync(dir) ) return [];
-        var entries;
-        try { entries = fs.readdirSync(dir); } catch (e) { return []; }
-        var out = [];
-        for (var i = 0; i < entries.length; i++) {
-            var name = entries[i];
-            if ( /^\./.test(name) ) continue;
-            if ( /\s+copy/i.test(name) ) continue;
-            if ( !JSON_EXT.test(name) ) continue;
-            out.push(name);
-        }
-        out.sort();
-        return out;
-    };
+    // The config-dir walk itself (dir globbing, scope overlay, key
+    // enumeration) moved to lib/secrets' sources module, consumed by the
+    // checkers below via secrets.getProjectRequiredKeys — see that module's
+    // header for the walk semantics and the sharing rationale (#B263).
 
     /**
-     * Reads every `.json` under `absDir`, enumerates its required secret
-     * keys, and adds them to `keySet` (a null-proto set). Mutates `keySet`.
-     *
-     * When `--scope=<s>` is active, the sibling `<absDir>_<scope>/` dir is
-     * read-only deep-merged over the base per config file (scope wins) before
-     * enumeration — mirroring a deploy's per-scope overlay — so the keys are
-     * the *effective* ones that scope will require. Read-only introspection;
-     * never touches the runtime config loader.
+     * Resolves the declared `settings.secrets.exec` tier: whispers the spec,
+     * validates it through the SAME shared implementation the runtime uses
+     * (`secrets.validateExecSpec`), then RUNS the declared command through the
+     * runtime's own fetch (`secrets.fetchExecMap` — same timeout default, same
+     * SIGKILL bound, same output contract), so this gate's verdict matches a
+     * boot's by construction. A validate-only mirror was rejected at design
+     * time: it would report every exec-supplied key UNSET — the #B263
+     * false-RED shape this command was built to prevent.
      *
      * @inner
      * @private
-     * @param {string} absDir - Absolute base config directory to read
-     * @param {object} keySet - Mutable null-proto set; key name -> true
+     * @param {string} projectPath
+     * @param {object|null} manifest
+     * @param {string} bundleName
+     * @param {object} execSpec - The declared (pre-substitution) `settings.secrets.exec` value
+     * @returns {{tier:string, declared:boolean, layers:Array, map:(object|null), origin:(object|null), errors:string[], exec:(object|null)}}
      */
-    var collectKeysFromConfigDir = function (absDir, keySet) {
-        var scopeAbsDir = self.scopeName ? (absDir + '_' + self.scopeName) : null;
-        var baseNames   = listJsonFiles(absDir);
-        var scopeNames  = scopeAbsDir ? listJsonFiles(scopeAbsDir) : [];
-
-        var names = baseNames.slice();
-        for (var s = 0; s < scopeNames.length; s++) {
-            if (names.indexOf(scopeNames[s]) < 0) names.push(scopeNames[s]);
-        }
-
-        for (var f = 0; f < names.length; f++) {
-            var name         = names[f];
-            var baseContent  = (baseNames.indexOf(name) > -1) ? readJsonSafe(_(absDir + '/' + name, true)) : null;
-            var scopeContent = (scopeAbsDir && scopeNames.indexOf(name) > -1) ? readJsonSafe(_(scopeAbsDir + '/' + name, true)) : null;
-            // scope deep-merges over base (scope wins); override=false is explicit (not
-            // merge's default) so scope precedence stays correct even if lib/merge's
-            // default override ever changes.
-            var effective    = scopeContent ? merge(JSON.clone(scopeContent), baseContent || {}, false) : baseContent;
-            if (!effective) continue;
-            var keys = secrets.getRequiredKeys(effective);
-            for (var k = 0; k < keys.length; k++) {
-                keySet[keys[k]] = true;
+    var resolveSecretsExecTier = function (projectPath, manifest, bundleName, execSpec) {
+        var out = { tier: 'exec', declared: true, layers: [], map: null, origin: null, errors: [], exec: null };
+
+        var resolvedSpec;
+        try {
+            resolvedSpec = whisper(buildReps(projectPath, manifest, bundleName), JSON.clone(execSpec));
+        } catch (whisperErr) {
+            out.errors.push('could not substitute tokens in `settings.secrets.exec`: ' + whisperErr.message);
+            return out;
+        }
+
+        var specErrors = secrets.validateExecSpec(resolvedSpec);
+        if (specErrors.length) {
+            var specMsg = specErrors[0].message;
+            if (specErrors[0].code === 'exec-command-unresolved-token') {
+                specMsg += ' — pass --scope/--env if it names one, since the runtime'
+                    + ' reads those from whatever launches the bundle';
             }
+            out.errors.push(specMsg);
+            return out;
+        }
+
+        var map;
+        try {
+            map = secrets.fetchExecMap(resolvedSpec);
+        } catch (fetchErr) {
+            // The runtime REFUSES to boot on this — reporting it softer would
+            // green-light a config that cannot start (#B267's reasoning,
+            // exec edition).
+            out.errors.push(fetchErr.message + ' — the runtime REFUSES to boot on this');
+            return out;
         }
+
+        out.map  = map;
+        out.exec = { command: resolvedSpec.command, keys: Object.keys(map).length };
+        return out;
     };
 
     /**
-     * Computes the shared-config key set once per project. The loader
-     * merges `shared/config/` into every bundle, so these keys are
-     * required by each bundle.
+     * Resolves whichever secrets tier the bundle declares — the file chain or
+     * the exec bridge — after the shared block-level validation
+     * (`secrets.validateBlock`: block shape, unknown-key refusal, file/exec
+     * exclusivity), which runs BEFORE either tier is touched, exactly as the
+     * runtime's `selectBackend` does. Same result shape as
+     * `resolveSecretsFileChain`, plus `tier` (`null` | `'file'` | `'exec'`)
+     * and, for the exec tier, an `exec: {command, keys}` descriptor.
      *
      * @inner
      * @private
      * @param {string} projectPath
-     * @returns {object} Null-proto set; key name -> true
+     * @param {object|null} manifest
+     * @param {string} bundleName
+     * @returns {{tier:(string|null), declared:boolean, layers:Array, map:(object|null), origin:(object|null), errors:string[], exec:(object|null)}}
      */
-    var computeSharedKeys = function (projectPath) {
-        var keySet = Object.create(null);
-        collectKeysFromConfigDir(_(projectPath + '/shared/config', true), keySet);
-        return keySet;
+    var resolveSecretsChain = function (projectPath, manifest, bundleName) {
+        var out = { tier: null, declared: false, layers: [], map: null, origin: null, errors: [], exec: null };
+
+        var settings = readEffectiveSettings(projectPath, manifest, bundleName);
+        var block = (settings && typeof settings === 'object') ? settings.secrets : undefined;
+        if (typeof block === 'undefined' || block === null) return out;
+
+        var blockErrors = secrets.validateBlock(block);
+        if (blockErrors.length) {
+            out.declared = true;
+            out.errors.push(blockErrors[0].message);
+            return out;
+        }
+        if (typeof block.exec !== 'undefined' && block.exec !== null) {
+            return resolveSecretsExecTier(projectPath, manifest, bundleName, block.exec);
+        }
+        var fileOut = resolveSecretsFileChain(projectPath, manifest, bundleName);
+        fileOut.tier = fileOut.declared ? 'file' : null;
+        fileOut.exec = null;
+        return fileOut;
     };
 
     /**
@@ -590,7 +596,14 @@ function Check(opt, cmd) {
         if (chain && chain.map) {
             var value = chain.map[key];
             if (typeof value === 'string' && value !== '') {
-                return { set: true, source: 'file', from: chain.origin[key] };
+                // The declared tier — file or exec; `sourceLabel` passes any
+                // non-'file' source through verbatim, so 'exec' labels ride
+                // for free. `from` is a per-layer path, a file-tier concept.
+                return {
+                    set: true,
+                    source: (chain.tier === 'exec') ? 'exec' : 'file',
+                    from: chain.origin ? chain.origin[key] : null
+                };
             }
         }
         return { set: false, source: null, from: null };
@@ -598,9 +611,11 @@ function Check(opt, cmd) {
 
     /**
      * Builds a check report for one bundle: every required key with its
-     * `SET`/`UNSET` status against both tiers, plus the resolved
-     * `settings.secrets.file` chain that formed the lower one. Flips
-     * `self.anyUnset` when a key is missing.
+     * `SET`/`UNSET` status against both tiers, plus whichever declared tier
+     * formed the lower one — the resolved `settings.secrets.file` chain or
+     * the `settings.secrets.exec` fetch (mutually exclusive by validation).
+     * Flips `self.anyUnset` when a key is missing and `self.anyError` when
+     * the declaration itself would refuse the boot (#B409).
      *
      * The chain is resolved per bundle, not per project: `settings.json` is a
      * per-bundle file and a declared path may embed `${bundle}`.
@@ -610,20 +625,18 @@ function Check(opt, cmd) {
      * @param {string} projectPath
      * @param {object|null} manifest
      * @param {string} bundleName
-     * @param {object} sharedKeys - Pre-computed shared key set
+     * @param {Object<string, string[]>} entryByKey - The bundle's walk entry map (shared keys already folded in)
      * @returns {{bundle:string, totalKeys:number, set:number, unset:number, keys:Array<{key:string, set:boolean, source:(string|null), from:(string|null)}>, secretsFile:object}}
      */
-    var checkBundle = function (projectPath, manifest, bundleName, sharedKeys) {
-        var keySet = Object.create(null);
-        for (var sk in sharedKeys) {
-            keySet[sk] = true;
-        }
-        var bundleSrc = resolveBundleSrc(manifest, bundleName);
-        collectKeysFromConfigDir(_(projectPath + '/' + bundleSrc + '/config', true), keySet);
+    var checkBundle = function (projectPath, manifest, bundleName, entryByKey) {
+        var chain = resolveSecretsChain(projectPath, manifest, bundleName);
 
-        var chain = resolveSecretsFileChain(projectPath, manifest, bundleName);
+        // #B409 — a declaration/fetch error means the runtime refuses to
+        // boot this bundle, so the gate must exit non-zero regardless of
+        // whether the environment happens to carry the keys.
+        if (chain.errors.length) { self.anyError = true; }
 
-        var keys     = Object.keys(keySet).sort();
+        var keys     = Object.keys(entryByKey).sort();
         var statuses = [];
         var setCount = 0;
         for (var k = 0; k < keys.length; k++) {
@@ -638,11 +651,19 @@ function Check(opt, cmd) {
             unset     : keys.length - setCount,
             keys      : statuses,
             secretsFile : {
-                declared     : chain.declared,
+                declared     : (chain.declared && chain.tier !== 'exec'),
                 assumedScope : self.scopeAssumed || null,
                 assumedEnv   : self.envName || null,
                 layers       : chain.layers,
-                errors       : chain.errors
+                errors       : (chain.tier === 'exec') ? [] : chain.errors
+            },
+            secretsExec : {
+                declared     : (chain.tier === 'exec'),
+                assumedScope : self.scopeAssumed || null,
+                assumedEnv   : self.envName || null,
+                command      : (chain.exec) ? chain.exec.command : null,
+                keys         : (chain.exec) ? chain.exec.keys : 0,
+                errors       : (chain.tier === 'exec') ? chain.errors : []
             }
         };
     };
@@ -657,14 +678,13 @@ function Check(opt, cmd) {
         var report = { projects: [] };
         var names  = Object.keys(self.projects).sort();
         for (var i = 0; i < names.length; i++) {
-            var pp = self.projects[names[i]];
-            var mf = loadManifest(pp.path);
-            if (!mf || !mf.bundles) continue;
-            var sharedKeys = computeSharedKeys(pp.path);
-            var entry  = { project: names[i], bundles: [] };
-            var bnames = Object.keys(mf.bundles).sort();
-            for (var b = 0; b < bnames.length; b++) {
-                entry.bundles.push(checkBundle(pp.path, mf, bnames[b], sharedKeys));
+            var pp     = self.projects[names[i]];
+            var walked = secrets.getProjectRequiredKeys(pp.path, { scope: self.scopeName });
+            if (!walked) continue;
+            var mf    = loadManifest(pp.path); // still read here: the secrets-file chain needs it
+            var entry = { project: names[i], bundles: [] };
+            for (var b = 0; b < walked.bundles.length; b++) {
+                entry.bundles.push(checkBundle(pp.path, mf, walked.bundles[b].bundle, walked.bundles[b].byKey));
             }
             report.projects.push(entry);
         }
@@ -679,18 +699,17 @@ function Check(opt, cmd) {
      * @param {string} projectName
      */
     var checkProjectOnly = function (projectName) {
-        var project  = self.projects[projectName];
-        var manifest = loadManifest(project.path);
-        if (!manifest || !manifest.bundles) {
+        var project = self.projects[projectName];
+        var walked  = secrets.getProjectRequiredKeys(project.path, { scope: self.scopeName });
+        if (!walked) {
             console.error('Project @' + projectName + ' has no manifest.json or no bundles registered.');
             process.exit(1);
             return;
         }
-        var sharedKeys = computeSharedKeys(project.path);
-        var bundles    = Object.keys(manifest.bundles).sort();
-        var report     = { project: projectName, bundles: [] };
-        for (var i = 0; i < bundles.length; i++) {
-            report.bundles.push(checkBundle(project.path, manifest, bundles[i], sharedKeys));
+        var manifest = loadManifest(project.path); // still read here: the secrets-file chain needs it
+        var report   = { project: projectName, bundles: [] };
+        for (var i = 0; i < walked.bundles.length; i++) {
+            report.bundles.push(checkBundle(project.path, manifest, walked.bundles[i].bundle, walked.bundles[i].byKey));
         }
         emit(report);
     };
@@ -704,10 +723,10 @@ function Check(opt, cmd) {
      * @param {string} bundleName
      */
     var checkBundleOnly = function (projectName, bundleName) {
-        var project    = self.projects[projectName];
-        var manifest   = loadManifest(project.path);
-        var sharedKeys = computeSharedKeys(project.path);
-        var report     = { project: projectName, bundles: [checkBundle(project.path, manifest, bundleName, sharedKeys)] };
+        var project  = self.projects[projectName];
+        var walked   = secrets.getProjectRequiredKeys(project.path, { scope: self.scopeName, bundle: bundleName });
+        var manifest = loadManifest(project.path); // still read here: the secrets-file chain needs it
+        var report   = { project: projectName, bundles: [checkBundle(project.path, manifest, bundleName, walked.bundles[0].byKey)] };
         emit(report);
     };
 
@@ -763,6 +782,7 @@ function Check(opt, cmd) {
     var emitTextBundle = function (br) {
         console.log('  ' + br.bundle + ':');
         emitTextChain(br.secretsFile);
+        emitTextExec(br.secretsExec);
         if (br.totalKeys === 0) {
             console.log('    No ${secret:KEY} placeholders found in config.');
             return;
@@ -820,6 +840,38 @@ function Check(opt, cmd) {
         }
     };
 
+    /**
+     * Renders the exec tier's line(s), mirroring `emitTextChain`'s shape for
+     * the file chain: the assumed scope/env (same reasoning — launch-time
+     * values this process cannot read), then either the errors — each one a
+     * verdict the runtime would refuse the boot on — or the fetch summary.
+     * Only the command's argv and a key COUNT are ever printed: the fetched
+     * values are the secrets payload and never reach the report.
+     *
+     * @inner
+     * @private
+     * @param {object} se - The `secretsExec` block from `checkBundle`
+     */
+    var emitTextExec = function (se) {
+        if (!se || !se.declared) return;
+
+        var assumed = [];
+        if (se.assumedScope) assumed.push('scope=' + se.assumedScope);
+        if (se.assumedEnv) assumed.push('env=' + se.assumedEnv);
+        console.log('    settings.secrets.exec'
+            + (assumed.length ? ' (assuming ' + assumed.join(', ') + ')' : '') + ':');
+
+        for (var e = 0; e < se.errors.length; e++) {
+            console.log('      ! ' + se.errors[e]);
+        }
+        if (se.errors.length) {
+            console.log('      ! exec tier skipped — keys below are checked against the environment only');
+            return;
+        }
+        console.log('      [exec] `' + (se.command ? se.command.join(' ') : '') + '`   fetched ('
+            + se.keys + ' keys)');
+    };
+
     /**
      * Names the tier a key was satisfied from. An empty label for `UNSET`
      * keeps the column honest — there is no source to name.