Function source_of 

pub fn source_of(
    api_key: Option<&str>,
    endpoint: Option<&str>,
    enabled: bool,
    store: &AuthStore,
) -> KeySource

Where a provider’s key will come from, given what its config names.

The precedence rule itself, in one place. resolve applies it to a loaded Config; doctor applies it to the raw TOML tree, which it has to read separately so a ${VAR} prints as itself rather than being swallowed by the variable-not-set error. Two readers of one rule is the shape config::env_var_refs_in already exists to prevent: doctor once carried a narrower copy of that scanner and reported a config as fine that check refused to load.