/** Non-throwing referer URL parse — returns null for attacker-controlled garbage. */
export function tryParseRefererUrl(referer: string): URL | null {
  try {
    const url = new URL(referer);
    if (!url.hostname) return null;
    return url;
  } catch (error) {
    if (error instanceof TypeError) return null;
    throw error;
  }
}