{"record":{"id":"ef4fba8af0474f4f","repo":"microsoft/aspire","slug":"aspireradius050","errorCode":"ASPIRERADIUS050","errorMessage":"Environment '{_environment.Name}' references secret store '{store.Name}', but that store is not emitted for this environment. Ensure the store is declared on this environment. Diagnostic: ASPIRERADIUS050.","messagePattern":"Environment '(.+?)' references secret store '(.+?)', but that store is not emitted for this environment\\. Ensure the store is declared on this environment\\. Diagnostic: ASPIRERADIUS050\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Publishing/RadiusInfrastructureBuilder.cs","lineNumber":5672,"sourceCode":"    /// <c>.id</c> expression.\n    /// </summary>\n    /// <exception cref=\"InvalidOperationException\">\n    /// The store is not emitted for this environment (<c>ASPIRERADIUS050</c>).\n    /// </exception>\n    private object ResolveSecretStoreReference(\n        RadiusSecretStoreResource store,\n        IReadOnlyDictionary<string, RadiusSecretStoreConstruct> storeConstructs)\n    {\n        if (storeConstructs.TryGetValue(store.Name, out var construct))\n        {\n            return BuildIdExpression(construct);\n        }\n\n        // Never fall back to the bare store name: that emits a plain string where a secret-store\n        // `.id` is expected, producing a reference Radius rejects only at deploy (or, worse, that\n        // silently resolves to nothing). Fail fast with an actionable diagnostic naming the\n        // consuming environment and the unresolved store.\n        throw new InvalidOperationException(\n            $\"Environment '{_environment.Name}' references secret store '{store.Name}', but that store is not \" +\n            \"emitted for this environment. Ensure the store is declared on this environment. \" +\n            \"Diagnostic: ASPIRERADIUS050.\");\n    }\n\n    /// <summary>\n    /// Populates a secret-store construct's <c>data</c> for the inline (Radius-created) mode: each\n    /// key's value is a reference to a valueless <c>@secure()</c> Bicep <c>param</c> (reusing\n    /// <see cref=\"GetOrAddRecipeParameter\"/>), with <c>encoding</c> emitted when the author set it\n    /// explicitly or the type default is not <c>raw</c>.\n    /// </summary>\n    private void PopulateInlineSecretStoreData(RadiusSecretStoreResource store, RadiusSecretStoreConstruct construct)\n    {\n        if (!store.Population.HasInlineData)\n        {\n            return;\n        }\n","sourceCodeStart":5654,"sourceCodeEnd":5690,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Publishing/RadiusInfrastructureBuilder.cs#L5654-L5690","documentation":"During Radius publish, an environment resource references a secret store by .id, but that store was never emitted as a resource for the same environment. The builder deliberately refuses to fall back to the bare store name (a plain string where a secret-store .id is expected), which Radius would only reject at deploy time or silently resolve to nothing. It fails fast at build/publish time with ASPIRERADIUS050 naming the environment and the unresolved store.","triggerScenarios":"Calling the Radius publisher when an environment's model references a secret store that was not added to that environment — e.g. an environment built via the Radius infrastructure builder references a store declared under a different environment, or the WithSecretStore-like wiring was done before the store resource was added to the environment's resource set.","commonSituations":"Splitting resources across multiple environments and forgetting to declare the store on the consuming one; renaming or conditionally omitting the store so the environment reference dangles; refactoring publish code so the store emission runs after/behind a condition while the environment reference is built unconditionally.","solutions":["Declare the secret store on the referenced environment so it is emitted into the same environment's resources.","Check the environment name in the message against your publish code; if the reference belongs to another environment, fix the wiring to point at a store emitted for this environment.","Look for conditional or reordered code that skips store emission and ensure the store is always emitted before the environment references it."],"exampleFix":"// before\nvar env = builder.AddRadiusEnvironment(\"env\").WithSecretStoreReference(\"missing-store\");\n// store never declared on this environment\n\n// after\nvar env = builder.AddRadiusEnvironment(\"env\");\nvar store = env.AddSealedSecretStore(\"my-store\") /* ... */;\nenv.WithSecretStoreReference(store);","handlingStrategy":"validation","validationCode":"// Before publish: verify every secret-store reference is emitted in the same environment\nforeach (var (envName, storeName) in environmentStoreReferences)\n{\n    if (!emittedStoresByEnvironment[envName].Contains(storeName))\n        throw new InvalidOperationException($\"Environment '{envName}' references undeclared secret store '{storeName}'.\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Declare the secret store on the same environment that consumes it, before building the environment resource.","When using multiple environments, keep a shared helper that wires stores and environments together so references cannot drift.","Search publish code for store references after any rename or conditional emission change."],"tags":["radius","publish","secret-store","reference"],"backgroundTag":"resource-not-found","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}