/**
 * Canvas document + resource ids: shared validation pattern.
 *
 * Ids flow into URL path segments (`…/documents/{id}?format=markdown`), so
 * any character outside the alphanumeric / underscore / hyphen set used by
 * real Canvas ids signals either a malformed input or an attempt to alter
 * the request path.
 *
 * `CanvasSourceSchema` enforces this at config-load time (the D0021
 * "parse, don't validate" boundary). Ref values (`CanvasDocRef.documentId`,
 * untagged id-refs) flow in from YAML task files that don't yet Zod-parse
 * adapter ref shapes (tracked under W0218 / W0220) — so the adapter applies
 * the same check at the runtime trust boundary, immediately before the
 * value flows into the Canvas API. Both checks share this pattern +
 * `assertCanvasId` so the rule lives exactly once.
 */
export const CANVAS_ID_PATTERN = /^[A-Za-z0-9_-]+$/;
export function assertCanvasId(label, value) {
    if (!CANVAS_ID_PATTERN.test(value)) {
        throw new Error(`Invalid Canvas ${label}: expected /^[A-Za-z0-9_-]+$/ but got ${JSON.stringify(value)}`);
    }
}
