// Shared resolution of a host's PUBLIC ORIGIN — the pinned base URL every host// uses to build absolute outbound links (OAuth redirect_uri, MCP OAuth metadata,// connect/approval URLs, email links). One implementation so the hosts don't// drift (selfhost had the platform-detect chain; cloud/cloudflare did not).//// SECURITY: this is for SERVER-SIDE OUTBOUND urls, so the origin must come from// a TRUSTED source — an operator-set env var, or a platform-injected deploy-time// var — NEVER from the request `Host`/`X-Forwarded-Host` (host-header injection// would let an attacker poison those links). The request origin may still be// used for CSRF/origin validation and client-side display; that is each host's// concern, not this module's. /** A read-only environment record (process.env, or a Worker `env` binding). */export type EnvRecord = Record<string, string | undefined>; /** * The public origin a platform-as-a-service injects for this deployment, e.g. * Railway's `RAILWAY_PUBLIC_DOMAIN`. Ordering mirrors `@t3-oss/env-core`'s * `getPlatformOrigin` preset (MIT) — all platform-SET (not client-set) values, * so building absolute URLs from them is safe. Returns an origin (`https://host`, * no trailing slash) or undefined. The generic `PUBLIC_URL`/`APP_URL` from that * preset are deliberately omitted: `PUBLIC_URL` is a *path* in some toolchains * (CRA), not an origin. Cloudflare Workers receive none of these, so it returns * undefined there — expected; the Worker falls back to its own request origin. */export const getPlatformOrigin = (env: EnvRecord): string | undefined => {  const host =    env.RAILWAY_PUBLIC_DOMAIN ??    env.RENDER_EXTERNAL_HOSTNAME ??    env.VERCEL_PROJECT_PRODUCTION_URL ??    env.VERCEL_URL ??    env.HEROKU_APP_DEFAULT_DOMAIN_NAME ??    env.WEBSITE_HOSTNAME ?? // Azure App Service    env.WEBSITE_DEFAULT_HOSTNAME ??    (env.FLY_APP_NAME ? `${env.FLY_APP_NAME}.fly.dev` : undefined) ??    (env.SITE_NAME ? `${env.SITE_NAME}.netlify.app` : undefined);  const url =    env.RENDER_EXTERNAL_URL ??    env.DEPLOY_PRIME_URL ?? // Netlify (deploy/branch previews)    env.URL ?? // Netlify (primary site URL)    env.CF_PAGES_URL ??    (host ? `https://${host}` : undefined);  return url?.replace(/\/+$/, "");}; /** * Resolve a deployment's pinned public origin: an explicit operator-set value * wins, else a platform-injected origin, else undefined (the caller supplies its * own fallback — a `localhost:PORT` for a Node host, a production constant or the * per-request origin for a Worker — and decides whether to warn). */export const resolvePublicOrigin = (options: {  readonly explicit?: string | undefined;  readonly env: EnvRecord;}): string | undefined => {  const explicit = options.explicit?.trim();  if (explicit) return explicit;  return getPlatformOrigin(options.env);}; /** * True unless this is explicitly local dev or a test run. A staging/demo deploy * often leaves `NODE_ENV` unset, and silently using a localhost fallback there is * the footgun we want surfaced — so warn by default. */export const shouldWarnMissingPublicOrigin = (nodeEnv: string | undefined): boolean =>  nodeEnv !== "development" && nodeEnv !== "test"; /** The one-time warning shown when a host falls back for its public origin. */export const missingPublicOriginWarning = (options: {  readonly varName: string;  readonly fallback: string;}): string =>  `[executor] ${options.varName} is not set and no platform origin was detected; ` +  `falling back to ${options.fallback}. OAuth redirects, MCP metadata, and connect ` +  `links will use this — set ${options.varName} to your public origin ` +  `(e.g. https://your-instance.example.com).`;