const require_fullstack_secrets = require('./fullstack-secrets-CtWIYuI0.cjs');

//#region src/secrets/reconcile.ts
/**
* Reconcile missing custom secrets for a workspace.
*
* Compares current secrets against what generateFullstackCustomSecrets()
* would produce and backfills any missing keys without overwriting
* existing values.
*
* @returns ReconcileResult if keys were added, null if secrets are up-to-date
*/
function reconcileMissingSecrets(secrets, workspace) {
	const isMultiApp = Object.keys(workspace.apps).length > 1;
	if (!isMultiApp) return null;
	const expectedCustom = require_fullstack_secrets.generateFullstackCustomSecrets(workspace);
	const addedKeys = [];
	const mergedCustom = { ...secrets.custom };
	for (const [key, value] of Object.entries(expectedCustom)) if (!(key in mergedCustom)) {
		mergedCustom[key] = value;
		addedKeys.push(key);
	}
	if (addedKeys.length === 0) return null;
	return {
		secrets: {
			...secrets,
			updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
			custom: mergedCustom
		},
		addedKeys
	};
}

//#endregion
exports.reconcileMissingSecrets = reconcileMissingSecrets;
//# sourceMappingURL=reconcile-D6u4HSg8.cjs.map