/**
 * Ticket / document links ops can store: a file this backend issued
 * (`/api/uploads/...`, no traversal) or an external https:// link.
 * Blocks `javascript:` / `data:` / `http:` so a stored value can't
 * become script or a downgrade link when opened from the UI.
 */
export const DOCUMENT_URL_PATTERN =
  /^(\/api\/uploads\/(?!.*\.\.)[A-Za-z0-9._\-/]+|https:\/\/[^\s<>"']+)$/;

export const DOCUMENT_URL_MESSAGE =
  'Must be an uploaded file link (/api/uploads/…) or an https:// URL';