/**
 * Drive folder + file ids: shared validation pattern.
 *
 * The Drive query language delimits with single quotes
 * (`q: "'<folderId>' in parents and trashed = false"`), so any character
 * outside the alphanumeric / underscore / hyphen set used by real Drive ids
 * is a sign of either a malformed input or an attempt to escape the query.
 *
 * `GoogleDriveSourceSchema.rootFolderId` enforces this at config-load
 * time (the D0021 "parse, don't validate" boundary). Ref values
 * (`DriveFileDocRef.fileId`, `DriveFolderDocRef.folderId`) flow in
 * from YAML task files / future Content Lake `ailf.task` documents
 * that don't yet Zod-parse Drive-ref shapes (tracked under W0218 /
 * W0220) — so the adapter applies the same check at the runtime trust
 * boundary, immediately before the value flows into the Drive API.
 *
 * Both checks share this pattern + `assertDriveId` so the rule lives
 * exactly once.
 */
export const DRIVE_ID_PATTERN = /^[A-Za-z0-9_-]+$/;
export function assertDriveId(label, value) {
    if (!DRIVE_ID_PATTERN.test(value)) {
        throw new Error(`Invalid Google Drive ${label}: expected /^[A-Za-z0-9_-]+$/ but got ${JSON.stringify(value)}`);
    }
}
