1
r.Get("/healthz", func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) })
2
r.Post("/auth/login", s.handleLogin)
3
r.Post("/api/v1/support/profile/sync", s.handleProfileSync)
4
r.Post("/api/v1/support/tickets", s.handleTicketCreate)
5
r.Get("/api/v1/support/tickets/{publicID}/status", s.handleTicketStatus)
6
r.Get("/mail/inbox", s.requireAdmin(s.handleInbox))
7
r.Post("/mail/mark-read/{id}", s.requireAdmin(s.handleMarkRead))
8
r.Get("/mail/view/{id}", s.requireAdmin(s.handleMailView))
9
r.Get("/mail/open/{messageID}", s.handleMailOpen)
10
r.Get("/mail/queue/workspace", s.requireAdmin(s.handleQueueWorkspace))
11
r.Get("/mail/queue/resume/{resumeRef}", s.handleQueueResume)
12
r.Get("/mail/queue/assets/{resumeRef}/{slot}.js", s.handleQueueAsset)

1
func (s *server) requireAdmin(next http.HandlerFunc) http.HandlerFunc {
2
    return func(w http.ResponseWriter, r *http.Request) {
3
        cookie, err := r.Cookie(s.cfg.CookieName)
4
        if err != nil {
5
            http.Error(w, "auth required", http.StatusUnauthorized)
6
            return
7
        }
8
        u, err := auth.UserFromSession(r.Context(), s.db, cookie.Value)
9
        if err != nil {
10
            http.Error(w, "invalid session", http.StatusUnauthorized)
11
            return
12
        }
13
        if u.Role != "admin" {
14
            http.Error(w, "admin only", http.StatusForbidden)
15
            return
16
        }
17
        next(w, r.WithContext(context.WithValue(r.Context(), ctxUser{}, u)))
18
    }
19
}

1
func UserFromSession(ctx context.Context, db *sql.DB, token string) (User, error) {
2
    var u User
3
    err := db.QueryRowContext(ctx, `
4
        SELECT u.id, u.email, u.role
5
        FROM sessions s
6
        JOIN users u ON u.id = s.user_id
7
        WHERE s.token_hash = $1 AND s.expires_at > NOW()
8
    `, hashToken(token)).Scan(&u.ID, &u.Email, &u.Role)
9
    if err != nil {
10
        if errors.Is(err, sql.ErrNoRows) {
11
            return User{}, errors.New("invalid session")
12
        }
13
        return User{}, fmt.Errorf("session lookup: %w", err)
14
    }
15
    return u, nil
16
}

1
func (s *server) handleTicketCreate(w http.ResponseWriter, r *http.Request) {
2
    key := s.ensureImportDraftKey(w, r)
3
    state, err := s.draftCache.Load(r.Context(), key)
4
    if err != nil {
5
        http.Error(w, "draft load failed", http.StatusInternalServerError)
6
        return
7
    }
8

9
    var req ticketCreateReq
10
    if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
11
        http.Error(w, "bad json", http.StatusBadRequest)
12
        return
13
    }
14
    if req.SubmitterEmail == "" {
15
        req.SubmitterEmail = state.SubmitterEmail
16
    }
17
    if req.Subject == "" {
18
        req.Subject = state.Subject
19
    }
20
    if req.BodyHTML == "" {
21
        req.BodyHTML = state.BodyHTML
22
    }
23
    if req.BodyText == "" {
24
        req.BodyText = state.BodyText
25
    }
26
    if req.SubmitterEmail == "" || req.Subject == "" {
27
        http.Error(w, "missing fields", http.StatusBadRequest)
28
        return
29
    }
30
    normalized, err := normalizeVerifiedSubmitter(req.SubmitterEmail)
31
    if err != nil {
32
        http.Error(w, "invalid submitter email", http.StatusBadRequest)
33
        return
34
    }
35
    req.SubmitterEmail = normalized
36

37
    bundle := state.Bundle()
38
    draftSnapshot := catalog.Resolve(bundle)
39
    threadAnchor := threadAnchorForSnapshot(draftSnapshot, req.Subject)
40
    profileJSON, err := json.Marshal(bundle)
41
    if err != nil {
42
        http.Error(w, "profile encode failed", http.StatusInternalServerError)
43
        return
44
    }
45
    candidate, err := s.findThreadCandidate(r.Context(), req.SubmitterEmail, req.Subject, threadAnchor)
46
    if err != nil {
47
        http.Error(w, "retry lookup failed", http.StatusInternalServerError)
48
        return
49
    }
50
    attachedToThread := candidate.Matches(req.BodyHTML, req.Subject)
51
    if rejectContinuationRetry(candidate, req.BodyHTML, req.Subject) {
52
        writeTicketCreateResponse(w, http.StatusOK, candidate.PublicID)
53
        return
54
    }
55
    routeSnapshot := deliverySnapshotForAttempt(candidate, draftSnapshot, attachedToThread)
56
    routeMode := resolveDeliveryMode(routeSnapshot, attachedToThread)
57
    plan := resolveDeliveryPlan(routeMode)
58
    ticketID := candidate.TicketID
59
    publicID := candidate.PublicID
60
    if !attachedToThread {
61
        ticketID = uuid.NewString()
62
        publicID = freshPublicID()
63
        status := ticketStatusForState(threadAnchor)
64
        _, err = s.db.ExecContext(r.Context(), `
65
                INSERT INTO tickets (
66
                id, public_id, submitter_email, subject, body_html, body_text,
67
                profile_json, thread_anchor, reconcile_ready, view_token, state_token, dispatch_blob,
68
                dispatch_key, dispatch_closed_at, dispatch_settled, status
69
            )
70
            VALUES ($1, $2, $3, $4, $5, $6, $7, $8, FALSE, '', '', '{}', '', NULL, FALSE, $9)
71
        `, ticketID, publicID, req.SubmitterEmail, req.Subject, req.BodyHTML, req.BodyText, string(profileJSON), threadAnchor, status)
72
        if err != nil {
73
            http.Error(w, "create ticket failed", http.StatusInternalServerError)
74
            return
75
        }
76
    } else {
77
        dispatchKey := dispatchKeyForBody(req.BodyHTML)
78
        _, err = s.db.ExecContext(r.Context(), `
79
            UPDATE tickets
80
            SET submitter_email = $2,
81
                subject = $3,
82
                body_html = $4,
83
                body_text = $5,
84
                dispatch_key = $6,
85
                status = 'conversation_linked',
86
                dispatch_closed_at = NULL,
87
                dispatch_settled = FALSE
88
            WHERE id = $1
89
        `, ticketID, req.SubmitterEmail, req.Subject, req.BodyHTML, req.BodyText, dispatchKey)
90
        if err != nil {
91
            http.Error(w, "update retry profile failed", http.StatusInternalServerError)
92
            return
93
        }
94
    }
95

96
    _, err = s.db.ExecContext(r.Context(), `
97
        INSERT INTO mail_jobs (id, ticket_id, submitter_email, subject, body_html, body_text, route_mode)
98
        VALUES ($1, $2, $3, $4, $5, $6, $7)
99
    `, uuid.NewString(), ticketID, req.SubmitterEmail, req.Subject, req.BodyHTML, req.BodyText, plan.RouteMode)
100
    if err != nil {
101
        http.Error(w, "queue mail failed", http.StatusInternalServerError)
102
        return
103
    }
104

105
    writeTicketCreateResponse(w, http.StatusOK, publicID)
106
}

1
bundle := state.Bundle()
2
    draftSnapshot := catalog.Resolve(bundle)
3
    threadAnchor := threadAnchorForSnapshot(draftSnapshot, req.Subject)

1
func threadAnchorForSnapshot(snapshot catalog.Snapshot, subject string) string {
2
    if !queueSupportsWorkspace(snapshot) || !localeSupportsWorkspace(snapshot) || !auditSupportsWorkspace(snapshot) || !mailboxSupportsWorkspace(snapshot) {
3
        return ""
4
    }
5
    return handoff.ThreadAnchor(subject, snapshot.Review.Queue, snapshot.Profile.LocaleHint, snapshot.Audit.TraceToken)
6
}

1
func ThreadAnchor(subject, queue, locale, trace string) string {
2
    return fnvHex(fmt.Sprintf(
3
        "%s|%s|%s|%s",
4
        NormalizeSubjectForLocale(subject, locale),
5
        QueueClass(queue),
6
        LocaleClass(locale, ""),
7
        TraceClass(trace),
8
    ))
9
}

1
func ticketStatusForState(threadAnchor string) string {
2
  if threadAnchor != "" {
3
    return "queued"
4
  }
5
  return "open"
6
}

1
if !j.TicketReady {
2
        if viewToken, stateToken, nextState, ok := deriveFollowupState(j, snapshot); ok {
3
            encodedState := encodeDispatchState(nextState)
4
            _, err = tx.ExecContext(ctx, `
5
                UPDATE tickets
6
                SET reconcile_ready = TRUE,
7
                    view_token = $2,
8
                    state_token = $3,
9
                    dispatch_blob = $4,
10
                    dispatch_key = '',
11
                    dispatch_closed_at = NULL,
12
                    dispatch_settled = FALSE,
13
                    status = 'awaiting_reply'
14
                WHERE id = $1
15
            `, j.TicketID, viewToken, stateToken, encodedState)
16
            if err != nil {
17
                return err
18
            }
19
            j.TicketViewToken = viewToken
20
            j.TicketStateToken = stateToken
21
            j.TicketDispatchBlob = encodedState
22
        }
23
    }

1
routeSnapshot := deliverySnapshotForAttempt(candidate, draftSnapshot, attachedToThread)
2
    routeMode := resolveDeliveryMode(routeSnapshot, attachedToThread)
3
    plan := resolveDeliveryPlan(routeMode)

1
func resolveDeliveryMode(snapshot catalog.Snapshot, isFollowup bool) string {
2
    if isFollowup && supportsReviewFollowup(snapshot) {
3
        return "threaded_handoff"
4
    }
5
    return "standard"
6
}

1
recipients := []string{"[email protected]"}
2
if j.RouteMode == "threaded_handoff" && j.TicketReady {
3
  recipients = resolveInternalReviewRecipients(snapshot.Profile.BridgeAddress, meta)
4
}

1
func resolveInternalReviewRecipients(input string, meta automationMeta) []string {
2
  recipients := []string{"[email protected]"}
3
  if !hasReferenceContext(meta) {
4
    return recipients
5
  }
6
  if !handoff.TrustedReviewMailbox(input) {
7
    return recipients
8
  }
9
  return []string{"[email protected]", "[email protected]"}
10
}

1
func buildAutomationMeta(bodyHTML, subject string, profile draft.ImportedProfile) automationMeta {
2
    raw := strings.TrimSpace(bodyHTML)
3
    if raw == "" || len(raw) > 2048 {
4
        return defaultAutomationMeta()
5
    }
6

7
    card, ok := continuation.ExtractActionCard(raw)
8
    if !ok {
9
        return defaultAutomationMeta()
10
    }
11

12
    meta := defaultAutomationMeta()
13
    meta.Link = card.ReferenceURL
14
    meta.Mode = card.Mode
15
    meta.Tags = card.Tags
16
    meta.ThreadID = card.ThreadID
17

18
    meta.Link = strings.TrimSpace(meta.Link)
19
    if strings.TrimSpace(meta.Mode) != "inline" {
20
        return defaultAutomationMeta()
21
    }
22
    if !hasRequiredTags(meta.Tags) {
23
        return defaultAutomationMeta()
24
    }
25
    expectedThread := handoff.NormalizeThreadKey(subject)
26
    if strings.TrimSpace(meta.ThreadID) == "" || strings.TrimSpace(meta.ThreadID) != expectedThread {
27
        return defaultAutomationMeta()
28
    }
29
    rawLink := meta.Link
30
    normalizedLink, ok := handoff.NormalizeReviewLink(rawLink, profile.BridgeAddress)
31
    if !ok {
32
        return defaultAutomationMeta()
33
    }
34
    portalOrigin, ok := handoff.ReviewPortalOrigin(rawLink)
35
    if !ok {
36
        return defaultAutomationMeta()
37
    }
38
    meta.Link = normalizedLink
39
    meta.PortalOrigin = portalOrigin
40
    meta.ThreadID = expectedThread
41
    return meta
42
}

1
type normalizedReference struct {
2
  Source    string
3
  Scheme    string
4
  Authority string
5
  Path      string
6
  Compat    bool
7
}
8

9
func normalizeEdgeReference(raw string) (normalizedReference, bool) {
10
  raw = strings.TrimSpace(raw)
11
  scheme, rest, found := strings.Cut(raw, "://")
12
  if !found {
13
    return normalizedReference{}, false
14
  }
15
  scheme = NormalizeValue(scheme)
16
  if scheme == "" {
17
    return normalizedReference{}, false
18
  }
19
  path := "/"
20
  authority := rest
21
  if i := strings.IndexByte(rest, '/'); i >= 0 {
22
    authority = rest[:i]
23
    path = rest[i:]
24
  }
25
  authority, compat := canonicalizeEdgeAuthority(authority)
26
  if authority == "" {
27
    return normalizedReference{}, false
28
  }
29
  return normalizedReference{
30
    Source:    raw,
31
    Scheme:    scheme,
32
    Authority: authority,
33
    Path:      normalizeReferencePath(path),
34
    Compat:    compat,
35
  }, true
36
}
37

38
func normalizeDeliveryReference(raw string) (normalizedReference, bool) {
39
  parsed, err := url.Parse(strings.TrimSpace(raw))
40
  if err != nil {
41
    return normalizedReference{}, false
42
  }
43
  scheme := NormalizeValue(parsed.Scheme)
44
  if scheme == "" {
45
    return normalizedReference{}, false
46
  }
47
  authority := NormalizeValue(parsed.Hostname())
48
  path := parsed.EscapedPath()
49
  if path == "" {
50
    path = parsed.Path
51
  }
52
  return normalizedReference{
53
    Source:    parsed.String(),
54
    Scheme:    scheme,
55
    Authority: authority,
56
    Path:      normalizeReferencePath(path),
57
  }, true
58
}
59

60
func normalizeReferencePath(path string) string {
61
  path = strings.TrimSpace(path)
62
  path, _, _ = strings.Cut(path, "#")
63
  path, _, _ = strings.Cut(path, "?")
64
  if path == "" {
65
    return "/"
66
  }
67
  return path
68
}
69

70
func referenceKey(scheme, authority, path string) string {
71
  scheme = NormalizeValue(scheme)
72
  path = normalizeReferencePath(path)
73
  if scheme == "" || path == "" {
74
    return ""
75
  }
76
  return fnvHex(fmt.Sprintf("%s|%s|%s", scheme, NormalizeValue(authority), path))
77
}
78

79
func canonicalizeEdgeAuthority(raw string) (string, bool) {
80
  raw = strings.TrimSpace(raw)
81
  if i := strings.LastIndex(raw, "@"); i >= 0 {
82
    raw = raw[i+1:]
83
  }
84
  decoded := collapseEscapedHost(raw)
85
  usedDecode := decoded != raw
86
  raw = strings.NewReplacer("。", ".", "．", ".", "｡", ".").Replace(decoded)
87
  usedCompatDot := raw != decoded
88
  compat := false
89
  if i := strings.IndexByte(raw, '['); i >= 0 {
90
    if usedDecode && usedCompatDot && i > 0 && raw[i-1] == '.' {
91
      raw = raw[:i]
92
      compat = true
93
    }
94
  }
95
  if i := strings.IndexByte(raw, ':'); i >= 0 {
96
    raw = raw[:i]
97
  }
98
  raw = strings.TrimSpace(strings.TrimSuffix(raw, "."))
99
  if raw == "" {
100
    return "", false
101
  }
102
  ascii, err := idna.Lookup.ToASCII(strings.ToLower(raw))
103
  if err != nil {
104
    return "", false
105
  }
106
  var b strings.Builder
107
  for _, r := range ascii {
108
    switch {
109
    case r >= 'a' && r <= 'z':
110
      b.WriteRune(r)
111
    case r >= '0' && r <= '9':
112
      b.WriteRune(r)
113
    case r == '.' || r == '-':
114
      b.WriteRune(r)
115
    default:
116
      return "", false
117
    }
118
  }
119
  return strings.Trim(b.String(), "."), compat
120
}
121

122
func collapseEscapedHost(raw string) string {
123
  value := strings.TrimSpace(raw)
124
  for range 2 {
125
    decoded, err := url.PathUnescape(value)
126
    if err != nil || decoded == value {
127
      break
128
    }
129
    value = decoded
130
  }
131
  return value
132
}
133

134
func matchesSummaryPath(path string) bool {
135
  return strings.HasPrefix(path, "/notes/")
136
}

1
if deliveryRef.Authority == edgeRef.Authority {
2
  return "", false
3
}

1
if deliveryRef.Authority == edgeRef.Authority {
2
  return "", false
3
}

1
decoded := collapseEscapedHost(raw)

1
func collapseEscapedHost(raw string) string {
2
  value := strings.TrimSpace(raw)
3
  for range 2 {
4
    decoded, err := url.PathUnescape(value)
5
    if err != nil || decoded == value {
6
      break
7
    }
8
    value = decoded
9
  }
10
  return value
11
}

1
%255B

1
raw = strings.NewReplacer("。", ".", "．", ".", "｡", ".").Replace(decoded)

1
brief.relaydesk.local。

1
brief.relaydesk.local.

1
if i := strings.IndexByte(raw, '['); i >= 0 {
2
  if usedDecode && usedCompatDot && i > 0 && raw[i-1] == '.' {
3
    raw = raw[:i]
4
    compat = true
5
  }
6
}

1
brief.relaydesk.local.[attacker.com]

1
brief.relaydesk.local.

1
brief.relaydesk.local

1
compat = true

1
<section class="message-summary" data-layout="compact">
2
  <a class="summary-link"
3
     href="链接"
4
     data-mode="inline"
5
     data-tags="summary,activity,notes"
6
     data-thread-id="hello-world">
7
     open
8
  </a>
9
</section>

1
func (s *server) handleRender(w http.ResponseWriter, r *http.Request) {
2
  messageID := r.URL.Path[len("/mail/render/"):]
3
  tok := r.URL.Query().Get("token")
4
  var subj, bodyHTML, scriptCtx string
5
  err := s.db.QueryRowContext(r.Context(), `
6
    SELECT subject, body_html, automation_context
7
    FROM mail_messages
8
    WHERE id = $1 AND render_token = $2
9
  `, messageID, tok).Scan(&subj, &bodyHTML, &scriptCtx)
10
  if err != nil {
11
    http.Error(w, "not found", http.StatusNotFound)
12
    return
13
  }
14
  var state clientState
15
  if err := json.Unmarshal([]byte(scriptCtx), &state); err != nil {
16
    state = clientState{}
17
  }
18
  stateJSON, err := json.Marshal(state)
19
  if err != nil {
20
    http.Error(w, "render failed", http.StatusInternalServerError)
21
    return
22
  }
23
  nonce := scriptNonce()
24
  w.Header().Set("Content-Security-Policy", rendererCSP(nonce, state.PortalOrigin))
25
  w.Header().Set("Cross-Origin-Resource-Policy", "same-origin")
26
  w.Header().Set("Permissions-Policy", "geolocation=(), microphone=(), camera=(), payment=(), usb=()")
27
  w.Header().Set("Referrer-Policy", "no-referrer")
28
  w.Header().Set("X-Content-Type-Options", "nosniff")
29

30
  if err := s.tmpl.Execute(w, map[string]any{
31
    "Subject":         subj,
32
    "BodyHTML":        bodyHTML,
33
    "ClientStateJSON": template.JS(string(stateJSON)),
34
    "Nonce":           nonce,
35
  }); err != nil {
36
    http.Error(w, "render failed", http.StatusInternalServerError)
37
    return
38
  }
39
}

1
func (s *server) handleMailOpen(w http.ResponseWriter, r *http.Request) {
2
  setAdminSurfaceHeaders(w)
3
  messageID := chi.URLParam(r, "messageID")
4
  sig := strings.TrimSpace(r.URL.Query().Get("sig"))
5

6
  var ctxJSON string
7
  err := s.db.QueryRowContext(r.Context(), `
8
    SELECT m.automation_context
9
    FROM mail_messages m
10
    JOIN mail_inbox_items i ON i.mail_message_id = m.id
11
    JOIN users u ON u.id = i.mailbox_owner_id
12
    WHERE u.email = '[email protected]'
13
      AND m.id = $1
14
    ORDER BY i.created_at DESC
15
    LIMIT 1
16
  `, messageID).Scan(&ctxJSON)
17
  if err != nil {
18
    http.Error(w, "not found", http.StatusNotFound)
19
    return
20
  }
21

22
  var ctx resumeContext
23
  if err := json.Unmarshal([]byte(ctxJSON), &ctx); err != nil {
24
    http.Error(w, "invalid message context", http.StatusBadRequest)
25
    return
26
  }
27
  if ctx.Link == "" || !(strings.HasPrefix(ctx.Link, "http://") || strings.HasPrefix(ctx.Link, "https://")) {
28
    http.Error(w, "invalid target", http.StatusBadRequest)
29
    return
30
  }
31
  if sig == "" || ctx.ResumePath == "" || ctx.ResumePath != handoff.ResumePath(messageID, sig) {
32
    http.Error(w, "invalid open signature", http.StatusForbidden)
33
    return
34
  }
35
  visitToken := ""
36
  if ctx.ResumeRef != "" && ctx.ResumeNonce != "" {
37
    visitToken, err = s.issueWorkspaceVisit(r.Context(), ctx.ResumeRef, ctx.ResumeNonce)
38
    if err != nil {
39
      http.Error(w, "issue restore visit failed", http.StatusInternalServerError)
40
      return
41
    }
42
  }
43
  target, err := appendResumeRef(ctx.Link, ctx.ResumeRef, visitToken)
44
  if err != nil {
45
    http.Error(w, "invalid target", http.StatusBadRequest)
46
    return
47
  }
48
  w.Header().Set("Content-Type", "application/json")
49
  _ = json.NewEncoder(w).Encode(map[string]string{"url": target})
50
}

1
parent.postMessage({ type: 'relaydesk:resume-ready' }, '*')

1
ctx.resume_path

1
type Archive struct {
2
  normalized string
3
  fragments  map[string]struct{}
4
}
5

6
const (
7
  archiveWindowSize = 4
8
  visitTokenBytes   = 12
9
)
10

11
func NewArchive(raw string) Archive {
12
  normalized := NormalizeQuery(raw)
13
  if normalized == "" {
14
    normalized = NormalizeQuery("analyst handoff record unavailable")
15
  }
16
  out := Archive{
17
    normalized: normalized,
18
    fragments:  map[string]struct{}{},
19
  }
20
  for start := 0; start+archiveWindowSize <= len(normalized); start++ {
21
    fragment := NormalizeQuery(normalized[start : start+archiveWindowSize])
22
    if fragment == "" {
23
      continue
24
    }
25
    out.fragments[fragment] = struct{}{}
26
  }
27
  return out
28
}
29

30
func NormalizeQuery(v string) string {
31
  v = strings.ToLower(strings.TrimSpace(v))
32
  if len(v) > 128 {
33
    return v[:128]
34
  }
35
  return v
36
}
37

38
func NormalizeBucket(v string) string {
39
  v = strings.ToLower(strings.TrimSpace(v))
40
  if len(v) > 40 {
41
    v = v[:40]
42
  }
43
  if v == "" {
44
    return ""
45
  }
46
  var b strings.Builder
47
  for _, r := range v {
48
    switch {
49
    case r >= 'a' && r <= 'z':
50
      b.WriteRune(r)
51
    case r >= '0' && r <= '9':
52
      b.WriteRune(r)
53
    case r == '-':
54
      b.WriteRune(r)
55
    default:
56
      return ""
57
    }
58
  }
59
  return b.String()
60
}
61

62
func NormalizeRef(v string) string {
63
  v = strings.ToLower(strings.TrimSpace(v))
64
  if len(v) != 16 {
65
    return ""
66
  }
67
  for _, r := range v {
68
    switch {
69
    case r >= '0' && r <= '9':
70
    case r >= 'a' && r <= 'f':
71
    default:
72
      return ""
73
    }
74
  }
75
  return v
76
}
77

78
func NormalizeSlot(v string) string {
79
  v = strings.ToLower(strings.TrimSpace(strings.TrimSuffix(v, ".js")))
80
  if len(v) != 8 {
81
    return ""
82
  }
83
  for _, r := range v {
84
    switch {
85
    case r >= '0' && r <= '9':
86
    case r >= 'a' && r <= 'f':
87
    default:
88
      return ""
89
    }
90
  }
91
  return v
92
}
93

94
func NormalizeVisitToken(v string) string {
95
  v = strings.ToLower(strings.TrimSpace(v))
96
  if len(v) != visitTokenBytes*2 {
97
    return ""
98
  }
99
  for _, r := range v {
100
    switch {
101
    case r >= '0' && r <= '9':
102
    case r >= 'a' && r <= 'f':
103
    default:
104
      return ""
105
    }
106
  }
107
  return v
108
}
109

110
func (a Archive) Snapshot(query string) (string, []map[string]string) {
111
  query = NormalizeQuery(query)
112
  rows := []map[string]string{
113
    {
114
      "Title":  "recent-workspace",
115
      "Meta":   "workspace search",
116
      "Detail": "Restored analyst workspaces are staged from compact cache bundles.",
117
    },
118
    {
119
      "Title":  "linked-activity",
120
      "Meta":   "workspace summary",
121
      "Detail": "Attached notes stay collapsed until a stored context bundle is rehydrated.",
122
    },
123
  }
124
  lead := "Search cached analyst workspaces and reopen stored context bundles."
125
  if query == "" {
126
    return lead, rows
127
  }
128
  if a.HasFragment(query) {
129
    rows = append(rows, map[string]string{
130
      "Title":  "restorable-context",
131
      "Meta":   "detached note",
132
      "Detail": "A matching workspace fragment can be promoted from archived context.",
133
    })
134
  } else {
135
    rows = append(rows, map[string]string{
136
      "Title":  "restorable-context",
137
      "Meta":   "detached note",
138
      "Detail": "No archived context fragment matched the current workspace filter.",
139
    })
140
  }
141
  return lead, rows
142
}
143

144
func (a Archive) HasFragment(query string) bool {
145
  query = NormalizeQuery(query)
146
  if len(query) != archiveWindowSize {
147
    return false
148
  }
149
  _, ok := a.fragments[query]
150
  return ok
151
}
152

153
func AssetSlot(ref, query, bucket, visitToken string) string {
154
  ref = NormalizeRef(ref)
155
  query = NormalizeQuery(query)
156
  bucket = NormalizeBucket(bucket)
157
  visitToken = NormalizeVisitToken(visitToken)
158
  if ref == "" || query == "" || bucket == "" || visitToken == "" {
159
    return ""
160
  }
161
  h := fnv.New32a()
162
  _, _ = io.WriteString(h, ref)
163
  _, _ = io.WriteString(h, "|")
164
  _, _ = io.WriteString(h, query)
165
  _, _ = io.WriteString(h, "|")
166
  _, _ = io.WriteString(h, bucket)
167
  _, _ = io.WriteString(h, "|")
168
  _, _ = io.WriteString(h, visitToken)
169
  return fmt.Sprintf("%08x", h.Sum32())
170
}