// The origin the BROWSER sees for a document request — what origin-derived UI// (the connect card's MCP URL, the API client's base) must be built from.//// On Cloudflare `request.url` already carries the external `https://` origin,// so this is a no-op there. Behind a TLS-terminating reverse proxy that// forwards plain HTTP upstream — `tailscale serve` for the dev-share workflow,// or an nginx/Caddy front — `request.url` is `http://` while the browser is on// `https://`; honoring the proxy's `X-Forwarded-Proto`/`-Host` recovers the// real origin (otherwise the HTTPS page would seed an `http://` API base and// the browser blocks it as mixed content).//// Trusting these headers is safe: the result only shapes the origin rendered// back to that same requester, never a cross-tenant decision (org access is// enforced server-side regardless of the URL the client was handed).//// Pure (no `cloudflare:workers`) so it unit-tests without the worker runtime.export const browserOriginFromRequest = (request: Request): string => {  const url = new URL(request.url);  const proto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim();  const host = request.headers.get("x-forwarded-host")?.split(",")[0]?.trim();  if (!proto && !host) return url.origin;  return `${proto || url.protocol.replace(":", "")}://${host || url.host}`;};