Function mergeEnvVarsWithSecrets

packages/encryption/src/encryption.ts:262–284

(
  envVars: Record<string, string> | undefined,
  encryptedSecrets: Record<string, EncryptedEnvelope> | undefined,
  privateKeyPem: string | Buffer | undefined
)

 * Decrypted secrets override plaintext env vars if there are conflicts.
 */
export function mergeEnvVarsWithSecrets(
  envVars: Record<string, string> | undefined,
  encryptedSecrets: Record<string, EncryptedEnvelope> | undefined,
  privateKeyPem: string | Buffer | undefined
): Record<string, string> {
  const result: Record<string, string> = { ...(envVars ?? {}) };

  if (encryptedSecrets && Object.keys(encryptedSecrets).length > 0) {
    if (!privateKeyPem) {
      throw new EncryptionConfigurationError(
        'Private key is required to decrypt encrypted secrets'
      );
    }

    const decrypted = decryptSecrets(encryptedSecrets, privateKeyPem);

    for (const [key, value] of Object.entries(decrypted)) {
      result[key] = value;
    }
  }

  return result;
}