// Provider API keys read from function secrets.
//
// A secret pasted from a Windows file or a rich-text source can carry a BOM,
// zero-width characters or surrounding whitespace. Such a value is not a valid
// HTTP header ByteString, so every request built with it throws before leaving
// the function — the OpenAI STT fallback failed this way on every call until
// 2026-09-27 ("headers of RequestInit is not a valid ByteString"). Strip the
// invisible characters; anything still outside printable ASCII is treated as
// not configured, so the provider is skipped instead of failing each request.

const INVISIBLE = /[​-‍⁠ \s]/g
const PRINTABLE_ASCII = /^[\x21-\x7E]+$/

export function sanitizeProviderKey(raw: string | undefined | null): string {
  if (!raw) return ''
  const value = raw.replace(INVISIBLE, '')
  return PRINTABLE_ASCII.test(value) ? value : ''
}

export function readProviderKey(name: string): string {
  return sanitizeProviderKey(Deno.env.get(name))
}