collectRoleSecrets function

Map<String, String> collectRoleSecrets(ModelRolesConfig rolesConfig, SecureKeyCache keys, { Map<String, String>? env, })

Collects the secrets snapshot for the model-roles resolver: every provider catalog env name plus its rotation stack (NAME, NAME_2, NAME_3, ...), plus any base name referenced by an explicit apiKeyName in the roles config. The platform secure store backs up base names where the environment has none (env wins; rotation stacks stay env-only — secure storage holds base names only).

Implementation

Map<String, String> collectRoleSecrets(
  ModelRolesConfig rolesConfig,
  SecureKeyCache keys, {
  Map<String, String>? env,
}) {
  final baseNames = <String>{
    for (final spec in providerCatalog.values) ...spec.apiKeyEnvNames,
    ...roleKeyNames(rolesConfig),
  };
  final secrets = <String, String>{};
  final environment = env ?? Platform.environment;
  for (final base in baseNames) {
    final suffix = RegExp('^${RegExp.escape(base)}_\\d+\$');
    for (final entry in environment.entries) {
      if (entry.key == base || suffix.hasMatch(entry.key)) {
        if (entry.value.isNotEmpty) secrets[entry.key] = entry.value;
      }
    }
    if (!secrets.containsKey(base)) {
      final stored = keys.read(base);
      if (stored != null) secrets[base] = stored;
    }
  }
  return secrets;
}