authHint method

String authHint(
  1. String baseUrl
)

The — ... suffix for errorLine on auth failures. Never prints key material — names and sources only. Mirrors the provider key resolution order: on the spec's DEFAULT endpoint a genuine environment value → endpoint-scoped store entry → legacy env-name store entry; on a custom endpoint only the endpoint-scoped store entries can be the source (the boot resolver never probes the catalog env names there — issue #40).

Roles mode gets the generic env-only hint ONLY for its genuine chain failures (a catalog-default endpoint). A custom endpoint under roles mode is a provider-binding failure — the hint names the saved entry, the expected key slot, and the one-line fix (gh-1000 AC2): a restored session or pinned role re-resolved onto a custom provider whose key did not follow.

Implementation

String authHint(String baseUrl) => _authHintFor(providerKind, baseUrl);