export function safeReturnTo(value: string | null): string {
	if (!value || !value.startsWith('/') || value.startsWith('//') || /[\\\s]/.test(value)) {
		return '/account';
	}
	const url = new URL(value, 'https://local.invalid');
	if (
		url.origin !== 'https://local.invalid' ||
		/^\/(api\/auth|login|register|logout)(\/|$)/.test(url.pathname)
	) {
		return '/account';
	}
	return url.pathname + url.search + url.hash;
}