import { env } from '$env/dynamic/private';

export function publicOrigin(
  fallback: string,
  configuredOrigin: string | undefined = env.APP_ORIGIN,
): string {
  const value = configuredOrigin?.trim() || fallback;
  const url = new URL(value);
  if (url.protocol !== 'https:' && url.protocol !== 'http:') {
    throw new Error('APP_ORIGIN must use HTTP or HTTPS.');
  }
  return url.origin;
}