/** Build Authentik executor `query` param from a reset-password URL. */
export function buildRecoveryFlowQuery(searchParams: URLSearchParams): string | undefined {
  const nested = searchParams.get("query")?.trim()
  if (nested) return nested

  const token = searchParams.get("flow_token")?.trim()
  if (token) {
    return `flow_token=${encodeURIComponent(token)}`
  }

  const parts: string[] = []
  searchParams.forEach((value, key) => {
    if (key === "returnTo") return
    parts.push(`${encodeURIComponent(key)}=${encodeURIComponent(value)}`)
  })
  return parts.length > 0 ? parts.join("&") : undefined
}