export function getCookieDomain(customRpId?: string): string | undefined {
  const envDomain = Deno.env.get("COOKIE_DOMAIN");
  if (envDomain) {
    return envDomain.startsWith(".") ? envDomain : `.${envDomain}`;
  }
  const targetId = customRpId || Deno.env.get("RP_ID") || "";
  if (!targetId || !targetId.includes(".") || targetId === "localhost") {
    return undefined;
  }
  const parts = targetId.split(".").filter(Boolean);
  if (parts.length >= 2) {
    return `.${parts.slice(-2).join(".")}`;
  }
  return `.${targetId}`;
}