"""Cross-cutting secret resolution. Tries config -> env -> keyring -> error."""

from __future__ import annotations

import os

from .config import Config
from .errors import MyDeepAgentError
from .keys import get_api_key


def resolve_openrouter_api_key(config: Config) -> str:
    """Resolve the OpenRouter API key with priority: config -> env -> keyring -> error."""
    if config.openrouter_api_key:
        return config.openrouter_api_key
    env_key = os.environ.get("MYDEEPAGENT_OPENROUTER_API_KEY") or os.environ.get(
        "OPENROUTER_API_KEY"
    )
    if env_key:
        return env_key
    kr_key = get_api_key("openrouter")
    if kr_key:
        return kr_key
    raise MyDeepAgentError.human_required(
        "backend_auth_failed",
        message="OpenRouter API key is not configured",
        recovery_hint="run `mydeepagent login openrouter` to register one in the OS keyring",
    )