// Single source of truth for resolving ANTHROPIC_API_KEY.
//
// Lookup order:
//   1. Encrypted secrets vault (lib/secrets.js, name = 'ANTHROPIC_API_KEY', scope 'global').
//   2. process.env.ANTHROPIC_API_KEY (legacy / migration window).
//
// Returns the key string, or null if neither source has it.
//
// We swallow vault errors so a corrupt secrets table / missing master key does
// not break the env-var fallback path. The caller decides what to do with null.

import { getSecret } from './secrets.js';

export function resolveAnthropicApiKey() {
  try {
    const fromVault = getSecret('ANTHROPIC_API_KEY');
    if (fromVault) return fromVault;
  } catch {
    // Vault read failed (missing master key, decrypt error, db not ready in a
    // test harness). Fall through to env.
  }
  return process.env.ANTHROPIC_API_KEY || null;
}
