/** Return a normalized Spotify web URL when the untrusted value is safe to link. */
export function parseSpotifyUrl(value: string): string | null {
  try {
    const url = new URL(value)
    const usesHttps = url.protocol === 'https:'
    const usesSpotifyHost = url.host === 'open.spotify.com'
    const hasCredentials = Boolean(url.username || url.password)
    if (!usesHttps || !usesSpotifyHost || hasCredentials) return null
    return url.href
  } catch {
    return null
  }
}
