fix(trigger): use the shared logger and correct the clearing docs

Review follow-ups. The required-sync failure path used `console.error`, which
the repo's logging rule forbids outside the CLI package; it now goes through
`createLogger`.

The architecture rule and `normalizeSecretValue` both still described the
preserve-on-absence behavior that the previous commit replaced, so they told a
maintainer the opposite of what the resolver does when a key leaves the secret.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017BBuD7nBqVURAah8t6jfND

Author: waleedlatif1

.claude/rules/sim-architecture.md

@@ -69,8 +69,10 @@ that list and set it in the secret. The repo still cannot see what else the dash
 
 Two constraints on that list. `syncEnvVars` strips every `TRIGGER_`-prefixed key before it
 publishes, so such a variable can only be set in the dashboard (`assertSyncableKeys` fails the
-build rather than letting one look synced). And a key absent from the secret is left untouched
-rather than blanked, so removing it from the secret does not remove it from a worker.
+build rather than letting one look synced). And the secret is authoritative: after a successful
+read, a key it does not carry — absent, `null`, or blank — is published as `''`, so deleting a
+credential from the secret revokes it in the worker too. Nothing is cleared when the read failed
+or the environment is unmapped, since there is then no authoritative view to clear against.
 
 So before replacing a worker's HTTP call to our own API with an in-process call, ask what env
 that work reads *on the app side*. Anything gated by a `require*Capability` helper is the sharp

apps/sim/lib/core/config/trigger-env-sync.test.ts

@@ -1,7 +1,7 @@
 /**
  * @vitest-environment node
  */
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { mockFetchSecretMap } = vi.hoisted(() => ({ mockFetchSecretMap: vi.fn() }))
 
@@ -24,11 +24,6 @@ function byName(vars: { name: string; value: string; isSecret: boolean }[]) {
 describe('resolveTriggerEnvVars', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    process.env.SIM_TRIGGER_ENV_SYNC_REQUIRED = undefined
-  })
-
-  afterEach(() => {
-    process.env.SIM_TRIGGER_ENV_SYNC_REQUIRED = undefined
   })
 
   it('reads the secret mapped to the environment', async () => {
@@ -100,7 +95,7 @@ describe('resolveTriggerEnvVars', () => {
   })
 
   it('fails the resolve instead of publishing a partial env when sync is required', async () => {
-    process.env.SIM_TRIGGER_ENV_SYNC_REQUIRED = '1'
+    vi.stubEnv('SIM_TRIGGER_ENV_SYNC_REQUIRED', '1')
 
     await expect(
       resolveTriggerEnvVars('prod', async () => {

apps/sim/lib/core/config/trigger-env-sync.ts

@@ -165,8 +165,10 @@ function unavailable(reason: string): SyncedEnvVar[] {
 
 /**
  * Coerces a secret entry to an env var value, matching how container boot
- * hydrates `process.env`. An absent or empty value is treated as unset so a
- * blank secret entry cannot overwrite a working dashboard value with `''`.
+ * hydrates `process.env`. `undefined` means the secret does not configure this
+ * key, which the caller publishes as `''` to clear any value a previous deploy
+ * left in the worker. A blank entry is reported the same way as an absent one,
+ * so blanking a key in the secret revokes it exactly like deleting it.
  */
 function normalizeSecretValue(value: unknown): string | undefined {
   if (value === undefined || value === null) return undefined

apps/sim/trigger.config.ts

@@ -2,6 +2,7 @@ import { OTLPLogExporter } from '@opentelemetry/exporter-logs-otlp-http'
 import { OTLPMetricExporter } from '@opentelemetry/exporter-metrics-otlp-http'
 import { OTLPTraceExporter } from '@opentelemetry/exporter-trace-otlp-http'
 import { resourceFromAttributes } from '@opentelemetry/resources'
+import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import {
   additionalFiles,
@@ -110,7 +111,7 @@ export default defineConfig({
           // deploy continue having published nothing — so rejecting is not a
           // way to fail. Only an explicit non-zero exit is, and this path is
           // reached only when SIM_TRIGGER_ENV_SYNC_REQUIRED asked for it.
-          console.error(getErrorMessage(error))
+          createLogger('TriggerConfig').error(getErrorMessage(error))
           process.exit(1)
         }
       }),