roleKeyNames function

Set<String> roleKeyNames(ModelRolesConfig rolesConfig)

The explicit apiKeyNames referenced by a roles config (the secure-store preload set; the catalog names are always preloaded), plus the endpoint-scoped FA_KEY_<HOST> slot of every chain entry pinned to a custom endpoint (gh-1000 AC5 — the same source a manual provider switch resolves; the catalog env names describe default endpoints only).

Implementation

Set<String> roleKeyNames(ModelRolesConfig rolesConfig) {
  final refs = [
    for (final chain in rolesConfig.roles.values) ...chain,
    for (final override in rolesConfig.pathOverrides)
      for (final chain in override.roles.values) ...chain,
  ];
  return {
    for (final ref in refs) ...[
      if (ref.apiKeyName != null) ref.apiKeyName!,
      // gh-1570 incident REG: the resolver's fallbacks probe the whole
      // cross-version slot family, so the snapshot must carry it — the
      // endpoint-scoped candidates of every custom-endpoint ref (the
      // unpinned leg, mirroring ModelRolesResolver
      // ._endpointScopedKeyNames exactly) plus, for an explicitly pinned
      // ref, the pin's own endpoint family (the empty-pin fallback set —
      // the 1.0.556 → 1.0.564 lockout shape).
      if (_refNeedsEndpointSlot(ref))
        ...CustomProviderRegistry.keySlotCandidates(ref.baseUrl!),
      if (ref.apiKeyName != null && ref.baseUrl != null)
        ...CustomProviderRegistry.keySlotCandidates(ref.baseUrl!),
    ],
  };
}