Private/Config/Get-SecretRotationTargetConfig.ps1

function Get-SecretRotationTargetConfig {
    <#
    .SYNOPSIS
        Validates and returns one named target's configuration block.
    .DESCRIPTION
        Throws, listing the available target names, when TargetName is not present under
        Config.targets - callers should not need to duplicate this validation themselves.
    .PARAMETER Config
        The parsed configuration object returned by Read-SecretRotationConfigFile.
    .PARAMETER TargetName
        The target name to resolve (a key under Config.targets).
    .OUTPUTS
        PSCustomObject.
    .EXAMPLE
        Get-SecretRotationTargetConfig -Config (Read-SecretRotationConfigFile) -TargetName 'corp-ad-svcaccount1'
    #>

    [CmdletBinding()]
    [OutputType([PSCustomObject])]
    param(
        [Parameter(Mandatory)]
        [PSCustomObject] $Config,

        [Parameter(Mandatory)]
        [string] $TargetName
    )

    # Not @(...) alone: PSObject.Properties.Name collapses to a bare scalar with exactly one
    # target and to $null with zero targets - @($null) has Count 1, not 0. Filtering through
    # Where-Object normalizes every case (0, 1, or many targets) to a real, correctly-counted array.
    $available = @($Config.targets.PSObject.Properties.Name | Where-Object { $_ })
    if ($TargetName -notin $available) {
        throw "Target '$TargetName' not found. Available targets: $($available -join ', ')"
    }
    $Config.targets.$TargetName
}