Function resolve 

pub async fn resolve(
    config: &mut Config,
    store: &AuthStore,
) -> Result<Vec<KeySource>, AuthError>

Fill in keys the config left unset, and report where each one came from.

Returns one KeySource per entry in config.llm, positionally - including the disabled ones, so the position in the returned slice is the position in the file. No production caller reads it: check discards it, and doctor calls source_of against the raw TOML tree instead, because config::load fails on an unset ${VAR} and that is exactly the config doctor is most useful on. It is retained for the tests, which assert the precedence rule per entry against the one function that decides it, and the positional shape is what lets them name an entry by the line the user wrote.

Disabled entries are skipped, matching every other pass over the provider list: ${VAR} expansion and field validation already leave a parked entry alone, and looking a key up for one would report a missing credential for a provider that is never contacted. For an api_key_command that also means no subprocess: some helpers are rate-limited and some prompt for a fingerprint, so spending a real credential call on a provider drep will not contact is worse than the missing-key report it avoids.

This is the one pass where a credential command runs, so each entry’s command runs exactly once per process however many files the run reviews. A short-lived credential re-minted per file would fail per file, which the chain’s demotion logic reads as an endpoint problem. There is deliberately no disk cache and no TTL behind that: drep is a short-lived process, so a credential written to disk buys nothing and adds a file worth stealing.

Once per process for every enabled entry, whether or not the chain reaches it. Deferring to first use would put credential resolution inside the request path, and “a broken credential is fatal rather than a provider drep quietly asks instead” holds precisely because resolution happens before the chain exists. An unset ${VAR} in the same position is equally fatal, one layer up, in ConfigError::EnvVarUnset. enabled = false is the control for a fallback whose helper should not be spent.