[CmdletBinding()]
param(
    [string]$ConfigPath = (Join-Path (Split-Path -Parent $PSScriptRoot) "server-deploy.conf")
)

$ErrorActionPreference = "Stop"
$secret = Read-Host "DeepSeek official API Key" -AsSecureString
$pointer = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secret)
try {
    $plain = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($pointer)
    if (-not $plain.StartsWith("sk-") -or $plain.Length -lt 20) {
        throw "The value does not look like a DeepSeek API key. Nothing was changed."
    }
    $lines = if (Test-Path -LiteralPath $ConfigPath) {
        @(Get-Content -LiteralPath $ConfigPath)
    } else {
        @()
    }
    $replacement = "DEEPSEEK_API_KEY=$plain"
    $found = $false
    $updated = @($lines | ForEach-Object {
        if ($_ -match '^DEEPSEEK_API_KEY=') {
            $found = $true
            $replacement
        } else {
            $_
        }
    })
    if (-not $found) {
        $updated += $replacement
    }
    Set-Content -LiteralPath $ConfigPath -Value $updated -Encoding UTF8
    Write-Host "DeepSeek key saved to the ignored local deployment config. The key was not printed." -ForegroundColor Green
} finally {
    if ($pointer -ne [IntPtr]::Zero) {
        [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($pointer)
    }
    $plain = $null
}