function deriveFromBaseUrl() {
  const base = process.env.NUXT_PUBLIC_BASE_URL || 'http://localhost:3100'
  try {
    const u = new URL(base)
    return {
      origin: `${u.protocol}//${u.host}`,
      rpId: u.hostname
    }
  } catch {
    return { origin: 'http://localhost:3100', rpId: 'localhost' }
  }
}

export function getWebAuthnConfig() {
  const derived = deriveFromBaseUrl()

  const rpId = process.env.WEBAUTHN_RP_ID || derived.rpId
  const rpName = process.env.WEBAUTHN_RP_NAME || 'Harheimer TC'
  const origin = process.env.WEBAUTHN_ORIGIN || derived.origin

  const requireUV = (process.env.WEBAUTHN_REQUIRE_UV || '').toLowerCase() === 'true'

  return { rpId, rpName, origin, requireUV }
}