/**
 * `Authorization: Bearer <token>` parsing, split out from `tokens.ts` because
 * this file must stay free of `node:crypto` (or any other Node-only import).
 * `src/lib/auth/csrf.ts` is imported by `src/middleware.ts`, which runs on the
 * Edge runtime — pulling in `node:crypto` transitively (even for an unrelated
 * export) crashes middleware at evaluation time, not just at type-check time.
 * `tokens.ts` re-exports this for the Node-side callers (`session.ts`).
 */
export function bearerTokenFrom(headers: { get(name: string): string | null }): string | null {
  const header = headers.get("authorization");
  if (!header) return null;
  const match = /^Bearer\s+(.+)$/i.exec(header.trim());
  return match ? match[1].trim() || null : null;
}
