Function resolve 

pub fn resolve(
    env_var: &str,
    key_file_name: &str,
    definition_dir: &Path,
    secrets: &BTreeMap<String, String>,
) -> Result<String, CredentialMissing>

Resolve a credential from the environment, the resolved secrets, or a scoped key file next to the definition. The env var wins so CI can inject without a file; the secrets map is the project’s canonical store; the file is a scoped fallback.