@hansjm10/volt-coding-agent 0.0.0-bootstrap.0 → 0.1.0

package/examples/remote/firebase-push-relay/functions/core.test.js

@@ -0,0 +1,273 @@
+const assert = require("node:assert/strict");
+const { test } = require("node:test");
+const {
+	DEFAULT_ALLOWED_FIREBASE_APP_ID,
+	MAX_REQUEST_BYTES,
+	RequestError,
+	assertVerifiedAppCheck,
+	getAllowedFirebaseAppIds,
+	getConfiguredRelayUrl,
+	getPushTargetId,
+	hashToken,
+	isPushTargetExpired,
+	parseLiveActivityUpdate,
+	parseNotification,
+	parsePushTargetRegistration,
+	parsePushTargetRevocation,
+	readJsonBody,
+	revokePushTargetTransaction,
+} = require("./core.js");
+
+function expectRequestError(operation, status, message) {
+	assert.throws(operation, (error) => {
+		assert.ok(error instanceof RequestError);
+		assert.equal(error.status, status);
+		assert.equal(error.publicMessage, message);
+		return true;
+	});
+}
+
+test("accepts a fresh limited-use App Check token for the production app", () => {
+	const appId = assertVerifiedAppCheck(
+		{
+			alreadyConsumed: false,
+			appId: DEFAULT_ALLOWED_FIREBASE_APP_ID,
+			token: { jti: "one-time-attestation-id" },
+		},
+		getAllowedFirebaseAppIds({}),
+	);
+	assert.equal(appId, DEFAULT_ALLOWED_FIREBASE_APP_ID);
+});
+
+test("rejects replayed, ordinary, and wrong-app App Check tokens", () => {
+	const allowed = getAllowedFirebaseAppIds({});
+	expectRequestError(
+		() =>
+			assertVerifiedAppCheck(
+				{ alreadyConsumed: true, appId: DEFAULT_ALLOWED_FIREBASE_APP_ID, token: { jti: "replayed-token-id" } },
+				allowed,
+			),
+		401,
+		"app_check_token_replayed",
+	);
+	expectRequestError(
+		() =>
+			assertVerifiedAppCheck(
+				{ alreadyConsumed: false, appId: DEFAULT_ALLOWED_FIREBASE_APP_ID, token: {} },
+				allowed,
+			),
+		401,
+		"app_check_limited_use_token_required",
+	);
+	expectRequestError(
+		() =>
+			assertVerifiedAppCheck(
+				{ alreadyConsumed: false, appId: "other-app", token: { jti: "wrong-application-token" } },
+				allowed,
+			),
+		403,
+		"app_check_app_not_allowed",
+	);
+});
+
+test("uses a deterministic bounded document id for each FCM token", () => {
+	const first = getPushTargetId("fcm-token-value-0001");
+	assert.equal(first, getPushTargetId("fcm-token-value-0001"));
+	assert.notEqual(first, getPushTargetId("fcm-token-value-0002"));
+	assert.match(first, /^fcm_[A-Za-z0-9_-]{43}$/);
+});
+
+test("never derives the public relay URL from request headers", () => {
+	assert.equal(getConfiguredRelayUrl({}), "https://us-central1-volt-3fae7.cloudfunctions.net/pushRelay");
+	assert.equal(
+		getConfiguredRelayUrl({ PUSH_RELAY_URL: "https://push.volt.example/relay/" }),
+		"https://push.volt.example/relay",
+	);
+	assert.throws(() => getConfiguredRelayUrl({ PUSH_RELAY_URL: "http://attacker.example/relay" }), /HTTPS/);
+	assert.throws(
+		() => getConfiguredRelayUrl({ PUSH_RELAY_URL: "https://push.volt.example/relay?redirect=evil" }),
+		/query/,
+	);
+});
+
+test("rejects oversized and structurally abusive JSON before route parsing", () => {
+	expectRequestError(
+		() => readJsonBody({ body: { value: "ok" }, headers: {} }),
+		415,
+		"content_type_must_be_json",
+	);
+	expectRequestError(
+		() =>
+			readJsonBody({
+				body: { value: "ok" },
+				headers: { "content-length": String(MAX_REQUEST_BYTES + 1), "content-type": "application/json" },
+			}),
+		413,
+		"request_body_too_large",
+	);
+	expectRequestError(
+		() =>
+			readJsonBody({
+				body: { values: Array.from({ length: 33 }, () => 1) },
+				headers: { "content-type": "application/json" },
+			}),
+		400,
+		"request_arrays_too_large",
+	);
+	let nested = { value: true };
+	for (let index = 0; index < 9; index += 1) nested = { nested };
+	expectRequestError(
+		() => readJsonBody({ body: nested, headers: { "content-type": "application/json" } }),
+		400,
+		"request_body_too_deep",
+	);
+});
+
+test("registration and notification schemas reject unknown and oversized values", () => {
+	assert.deepEqual(
+		parsePushTargetRegistration({ provider: "fcm", platform: "ios", token: "fcm-token-value-0001", enabled: true }),
+		{ provider: "fcm", platform: "ios", token: "fcm-token-value-0001", enabled: true },
+	);
+	expectRequestError(
+		() =>
+			parsePushTargetRegistration({
+				provider: "fcm",
+				platform: "ios",
+				token: "fcm-token-value-0001",
+				enabled: true,
+				redirect: "https://attacker.example",
+			}),
+		400,
+		"registration_has_unknown_field",
+	);
+	expectRequestError(
+		() =>
+			parseNotification({
+				pushTargetId: "fcm_12345678901234567890",
+				pushTargetAuthToken: "a".repeat(32),
+				eventId: "event-1",
+				kind: "completed",
+				title: "Volt",
+				body: "x".repeat(1025),
+				data: {},
+			}),
+		400,
+		"body_has_invalid_length",
+	);
+});
+
+test("status and revoke credentials use the same strict target schema", () => {
+	assert.deepEqual(
+		parsePushTargetRevocation({
+			pushTargetId: "fcm_12345678901234567890",
+			pushTargetAuthToken: "a".repeat(43),
+		}),
+		{
+			pushTargetId: "fcm_12345678901234567890",
+			pushTargetAuthToken: "a".repeat(43),
+		},
+	);
+	expectRequestError(
+		() =>
+			parsePushTargetRevocation({
+				pushTargetId: "fcm_12345678901234567890",
+				pushTargetAuthToken: "short",
+				redirect: "https://attacker.example",
+			}),
+		400,
+		"revocation_has_unknown_field",
+	);
+});
+
+test("revocation rechecks credentials inside the delete transaction", async () => {
+	const oldCredential = "a".repeat(43);
+	const newCredential = "b".repeat(43);
+	const pushTargetRef = { path: "voltPushTargets/fcm_target" };
+	let attempt = 0;
+	let committedDeleteCount = 0;
+	const firestore = {
+		async runTransaction(operation) {
+			const firstAttemptDeletes = [];
+			await operation({
+				delete: (ref) => firstAttemptDeletes.push(ref),
+				get: async () => ({
+					data: () => ({ pushTargetAuthTokenHash: hashToken(oldCredential) }),
+					exists: true,
+				}),
+			});
+			attempt += 1;
+			assert.equal(firstAttemptDeletes.length, 1);
+
+			// Simulate Firestore retrying after a concurrent registration replaced
+			// this deterministic document ID with a new credential. The stale
+			// delete from the conflicted attempt is not committed.
+			const secondAttemptDeletes = [];
+			const result = await operation({
+				delete: (ref) => secondAttemptDeletes.push(ref),
+				get: async () => ({
+					data: () => ({ pushTargetAuthTokenHash: hashToken(newCredential) }),
+					exists: true,
+				}),
+			});
+			committedDeleteCount += secondAttemptDeletes.length;
+			return result;
+		},
+	};
+
+	await assert.rejects(
+		revokePushTargetTransaction(firestore, pushTargetRef, oldCredential),
+		(error) => error instanceof RequestError && error.status === 401,
+	);
+	assert.equal(attempt, 1);
+	assert.equal(committedDeleteCount, 0);
+});
+
+test("Live Activity input is typed, bounded, and fresh", () => {
+	const now = 2_000_000_000;
+	const parsed = parseLiveActivityUpdate(
+		{
+			pushTargetId: "fcm_12345678901234567890",
+			pushTargetAuthToken: "a".repeat(32),
+			activityId: "activity-1",
+			activityPushToken: "activity-token-value",
+			eventId: "event-1",
+			kind: "tool_update",
+			contentState: {
+				status: "running",
+				statusText: "Running",
+				recentTools: [{ name: "Read", symbolName: "doc", status: "completed" }],
+				updatedAtEpochSeconds: now,
+			},
+		},
+		now,
+	);
+	assert.equal(parsed.contentState.updatedAtEpochSeconds, now);
+	expectRequestError(
+		() =>
+			parseLiveActivityUpdate(
+				{
+					pushTargetId: "fcm_12345678901234567890",
+					pushTargetAuthToken: "a".repeat(32),
+					activityId: "activity-1",
+					activityPushToken: "activity-token-value",
+					eventId: "event-1",
+					kind: "tool_update",
+					contentState: {
+						status: "running",
+						statusText: "Running",
+						recentTools: [],
+						updatedAtEpochSeconds: now - 86_401,
+					},
+				},
+				now,
+			),
+		400,
+		"updatedAtEpochSeconds_out_of_range",
+	);
+});
+
+test("missing and elapsed expiry timestamps are invalid", () => {
+	assert.equal(isPushTargetExpired({}, 10_000), true);
+	assert.equal(isPushTargetExpired({ expiresAt: { seconds: 9 } }, 10_000), true);
+	assert.equal(isPushTargetExpired({ expiresAt: { seconds: 11 } }, 10_000), false);
+});

package/examples/remote/firebase-push-relay/functions/index.js

@@ -0,0 +1,413 @@
+const { randomBytes } = require("node:crypto");
+const { getAppCheck } = require("firebase-admin/app-check");
+const { initializeApp, getApps } = require("firebase-admin/app");
+const { FieldValue, Timestamp, getFirestore } = require("firebase-admin/firestore");
+const { getMessaging } = require("firebase-admin/messaging");
+const { onRequest } = require("firebase-functions/v2/https");
+const {
+	RequestError,
+	assertRequestEnvelope,
+	assertVerifiedAppCheck,
+	getAllowedFirebaseAppIds,
+	getBoundedPositiveInteger,
+	getConfiguredRelayUrl,
+	getHeader,
+	getPushTargetId,
+	getPushTargetTtlMs,
+	hashToken,
+	isPushTargetExpired,
+	parseLiveActivityUpdate,
+	parseNotification,
+	parsePushTargetRegistration,
+	parsePushTargetRevocation,
+	readJsonBody,
+	revokePushTargetTransaction,
+	timingSafeTokenHashMatches,
+} = require("./core.js");
+
+const DEFAULT_COLLECTION = "voltPushTargets";
+const DEFAULT_LIVE_ACTIVITY_APNS_TOPIC = "com.hansjm10.volt.push-type.liveactivity";
+const DEFAULT_REGION = "us-central1";
+const DELIVERY_QUOTA_WINDOW_MS = 60_000;
+const DEFAULT_DELIVERIES_PER_TARGET_PER_MINUTE = 30;
+const DEFAULT_REGISTRATIONS_PER_INSTANCE_PER_MINUTE = 30;
+const INVALID_TARGET_ERROR_CODES = new Set([
+	"messaging/invalid-registration-token",
+	"messaging/mismatched-credential",
+	"messaging/registration-token-not-registered",
+]);
+
+if (getApps().length === 0) {
+	initializeApp();
+}
+
+const allowedFirebaseAppIds = getAllowedFirebaseAppIds();
+const publicRelayUrl = getConfiguredRelayUrl();
+const pushTargetTtlMs = getPushTargetTtlMs();
+const maxDeliveriesPerTargetPerMinute = getBoundedPositiveInteger(
+	process.env.DELIVERIES_PER_TARGET_PER_MINUTE,
+	1,
+	600,
+	DEFAULT_DELIVERIES_PER_TARGET_PER_MINUTE,
+);
+const maxRegistrationsPerInstancePerMinute = getBoundedPositiveInteger(
+	process.env.REGISTRATIONS_PER_INSTANCE_PER_MINUTE,
+	1,
+	120,
+	DEFAULT_REGISTRATIONS_PER_INSTANCE_PER_MINUTE,
+);
+const registrationWindows = new Map();
+
+exports.pushRelay = onRequest(
+	{
+		concurrency: 20,
+		cors: false,
+		invoker: "public",
+		maxInstances: 10,
+		memory: "256MiB",
+		region: process.env.FUNCTION_REGION || DEFAULT_REGION,
+		timeoutSeconds: 15,
+	},
+	async (request, response) => {
+		response.set("cache-control", "no-store");
+		response.set("x-content-type-options", "nosniff");
+		try {
+			await routeRequest(request, response);
+		} catch (error) {
+			if (response.headersSent) return;
+			if (error instanceof RequestError) {
+				response.status(error.status).json({ error: error.publicMessage });
+				return;
+			}
+			console.error("push relay request failed", getSafeErrorLog(error));
+			response.status(500).json({ error: "internal_error" });
+		}
+	},
+);
+
+async function routeRequest(request, response) {
+	if (request.method !== "POST") {
+		response.set("allow", "POST");
+		throw new RequestError(405, "method_not_allowed");
+	}
+	assertRequestEnvelope(request);
+	const routePath = normalizeRoutePath(request.path || request.originalUrl || request.url || "/");
+	if (routePath === "/v1/push-targets") {
+		await registerPushTarget(request, response);
+		return;
+	}
+	if (routePath === "/v1/push-targets/revoke") {
+		await revokePushTarget(request, response);
+		return;
+	}
+	if (routePath === "/v1/push-targets/status") {
+		await getPushTargetStatus(request, response);
+		return;
+	}
+	if (routePath === "/v1/notifications") {
+		await sendNotification(request, response);
+		return;
+	}
+	if (routePath === "/v1/live-activities") {
+		await sendLiveActivityUpdate(request, response);
+		return;
+	}
+	throw new RequestError(404, "not_found");
+}
+
+async function registerPushTarget(request, response) {
+	const appId = await verifyRegistrationAppCheck(request);
+	enforceRegistrationRateLimit(appId);
+	const registration = parsePushTargetRegistration(readJsonBody(request));
+	const pushTargetId = getPushTargetId(registration.token);
+	const pushTargetAuthToken = randomBytes(32).toString("base64url");
+	const tokenHash = hashToken(registration.token);
+	const nowMs = Date.now();
+	const now = Timestamp.fromMillis(nowMs);
+	await getPushTargetsCollection().doc(pushTargetId).set({
+		appId,
+		createdAt: now,
+		enabled: registration.enabled,
+		expiresAt: Timestamp.fromMillis(nowMs + pushTargetTtlMs),
+		platform: registration.platform,
+		provider: registration.provider,
+		token: registration.token,
+		tokenHash,
+		pushTargetAuthTokenHash: hashToken(pushTargetAuthToken),
+		updatedAt: now,
+	});
+	response.status(201).json({
+		pushTargetId,
+		pushTargetAuthToken,
+		relayUrl: publicRelayUrl,
+		tokenHash,
+		expiresAtEpochSeconds: Math.floor((nowMs + pushTargetTtlMs) / 1000),
+	});
+}
+
+async function verifyRegistrationAppCheck(request) {
+	const appCheckToken = getHeader(request, "x-firebase-appcheck");
+	if (appCheckToken === undefined || appCheckToken.length > 8192) {
+		throw new RequestError(401, "app_check_limited_use_token_required");
+	}
+	let verification;
+	try {
+		verification = await getAppCheck().verifyToken(appCheckToken, { consume: true });
+	} catch {
+		throw new RequestError(401, "app_check_invalid");
+	}
+	return assertVerifiedAppCheck(verification, allowedFirebaseAppIds);
+}
+
+function enforceRegistrationRateLimit(appId) {
+	const now = Date.now();
+	const existing = registrationWindows.get(appId);
+	if (existing === undefined || existing.startedAtMs + DELIVERY_QUOTA_WINDOW_MS <= now) {
+		registrationWindows.set(appId, { count: 1, startedAtMs: now });
+		return;
+	}
+	if (existing.count >= maxRegistrationsPerInstancePerMinute) {
+		throw new RequestError(429, "registration_rate_limited");
+	}
+	existing.count += 1;
+}
+
+async function revokePushTarget(request, response) {
+	const revocation = parsePushTargetRevocation(readJsonBody(request));
+	const pushTargetRef = getPushTargetsCollection().doc(revocation.pushTargetId);
+	const status = await revokePushTargetTransaction(
+		getFirestore(),
+		pushTargetRef,
+		revocation.pushTargetAuthToken,
+	);
+	response.status(200).json({ status });
+}
+
+async function getPushTargetStatus(request, response) {
+	const credential = parsePushTargetRevocation(readJsonBody(request));
+	const snapshot = await getPushTargetsCollection().doc(credential.pushTargetId).get();
+	if (!snapshot.exists) {
+		throw new RequestError(404, "push_target_not_found");
+	}
+	const pushTarget = snapshot.data();
+	if (!isAuthorizedTargetCredential(pushTarget, credential.pushTargetAuthToken)) {
+		throw new RequestError(401, "unauthorized");
+	}
+	if (!isValidEnabledPushTarget(pushTarget) || isPushTargetExpired(pushTarget)) {
+		throw new RequestError(410, "push_target_invalid");
+	}
+	const expiresAtMs = getFirestoreTimestampMillis(pushTarget.expiresAt);
+	if (expiresAtMs === undefined) {
+		throw new RequestError(410, "push_target_invalid");
+	}
+	response.status(200).json({
+		status: "active",
+		expiresAtEpochSeconds: Math.floor(expiresAtMs / 1000),
+	});
+}
+
+async function sendNotification(request, response) {
+	const notification = parseNotification(readJsonBody(request));
+	const authorizedTarget = await reserveAuthorizedPushTarget(notification);
+	const { pushTarget, pushTargetRef } = authorizedTarget;
+
+	try {
+		const messageId = await getMessaging().send({
+			data: notification.data,
+			notification: {
+				body: notification.body,
+				title: notification.title,
+			},
+			token: pushTarget.token,
+		});
+		await markPushSent(pushTargetRef, notification, messageId);
+		response.status(200).json({ status: "sent", messageId });
+	} catch (error) {
+		if (isInvalidTargetError(error)) {
+			await disablePushTarget(pushTargetRef, getErrorCode(error) || "messaging/invalid-target");
+			throw new RequestError(410, "push_target_invalid");
+		}
+		respondFcmSendFailed(response, "notification", notification, error);
+	}
+}
+
+async function sendLiveActivityUpdate(request, response) {
+	const liveActivity = parseLiveActivityUpdate(readJsonBody(request));
+	const authorizedTarget = await reserveAuthorizedPushTarget(liveActivity);
+	const { pushTarget, pushTargetRef } = authorizedTarget;
+
+	if (liveActivity.tokenEnvironment === "development" && process.env.LIVE_ACTIVITY_ALLOW_DEVELOPMENT !== "1") {
+		throw new RequestError(422, "live_activity_environment_unsupported");
+	}
+
+	try {
+		const messageId = await getMessaging().send({
+			token: pushTarget.token,
+			apns: {
+				liveActivityToken: liveActivity.activityPushToken,
+				headers: {
+					"apns-priority": "10",
+					"apns-push-type": "liveactivity",
+					"apns-topic": getLiveActivityApnsTopic(),
+				},
+				payload: {
+					aps: liveActivityApsPayload(liveActivity),
+				},
+			},
+		});
+		await markPushSent(pushTargetRef, liveActivity, messageId);
+		response.status(200).json({ status: "sent", messageId });
+	} catch (error) {
+		if (isInvalidTargetError(error)) {
+			await pushTargetRef.update({
+				lastLiveActivityInvalidAt: FieldValue.serverTimestamp(),
+				lastLiveActivityInvalidReason: getErrorCode(error) || "messaging/invalid-live-activity-target",
+				updatedAt: FieldValue.serverTimestamp(),
+			});
+			throw new RequestError(410, "push_target_invalid");
+		}
+		respondFcmSendFailed(response, "live-activity", liveActivity, error);
+	}
+}
+
+async function reserveAuthorizedPushTarget(request) {
+	const pushTargetRef = getPushTargetsCollection().doc(request.pushTargetId);
+	return getFirestore().runTransaction(async (transaction) => {
+		const snapshot = await transaction.get(pushTargetRef);
+		if (!snapshot.exists) {
+			throw new RequestError(404, "push_target_not_found");
+		}
+		const pushTarget = snapshot.data();
+		if (!isValidEnabledPushTarget(pushTarget)) {
+			throw new RequestError(410, "push_target_invalid");
+		}
+		if (isPushTargetExpired(pushTarget)) {
+			throw new RequestError(410, "push_target_expired");
+		}
+		if (!isAuthorizedTargetCredential(pushTarget, request.pushTargetAuthToken)) {
+			throw new RequestError(401, "unauthorized");
+		}
+
+		const nowMs = Date.now();
+		const windowStartedAtMs = getFirestoreTimestampMillis(pushTarget.deliveryWindowStartedAt);
+		const inCurrentWindow =
+			windowStartedAtMs !== undefined && windowStartedAtMs + DELIVERY_QUOTA_WINDOW_MS > nowMs;
+		const deliveryWindowCount = inCurrentWindow && Number.isSafeInteger(pushTarget.deliveryWindowCount)
+			? pushTarget.deliveryWindowCount
+			: 0;
+		if (deliveryWindowCount >= maxDeliveriesPerTargetPerMinute) {
+			throw new RequestError(429, "push_target_rate_limited");
+		}
+		transaction.update(pushTargetRef, {
+			deliveryWindowCount: deliveryWindowCount + 1,
+			deliveryWindowStartedAt: inCurrentWindow
+				? pushTarget.deliveryWindowStartedAt
+				: Timestamp.fromMillis(nowMs),
+			updatedAt: Timestamp.fromMillis(nowMs),
+		});
+		return { pushTarget, pushTargetRef };
+	});
+}
+
+function isValidEnabledPushTarget(value) {
+	return (
+		isRecord(value) &&
+		value.enabled === true &&
+		value.provider === "fcm" &&
+		value.platform === "ios" &&
+		typeof value.token === "string" &&
+		value.token.length >= 16 &&
+		value.token.length <= 4096
+	);
+}
+
+function isAuthorizedTargetCredential(pushTarget, authToken) {
+	return (
+		isRecord(pushTarget) &&
+		typeof authToken === "string" &&
+		timingSafeTokenHashMatches(authToken, pushTarget.pushTargetAuthTokenHash)
+	);
+}
+
+function getFirestoreTimestampMillis(value) {
+	if (isRecord(value) && typeof value.toMillis === "function") {
+		const millis = value.toMillis();
+		return Number.isFinite(millis) ? millis : undefined;
+	}
+	return undefined;
+}
+
+async function markPushSent(pushTargetRef, request, messageId) {
+	await pushTargetRef.update({
+		lastEventId: request.eventId,
+		lastKind: request.kind,
+		lastMessageId: messageId,
+		lastSentAt: FieldValue.serverTimestamp(),
+		updatedAt: FieldValue.serverTimestamp(),
+	});
+}
+
+async function disablePushTarget(pushTargetRef, reason) {
+	await pushTargetRef.update({
+		disabledAt: FieldValue.serverTimestamp(),
+		disabledReason: reason,
+		enabled: false,
+		updatedAt: FieldValue.serverTimestamp(),
+	});
+}
+
+function liveActivityApsPayload(liveActivity) {
+	const aps = {
+		"content-state": liveActivity.contentState,
+		event: liveActivity.activityEvent,
+		timestamp: Math.floor(Date.now() / 1000),
+	};
+	if (liveActivity.staleDateEpochSeconds !== undefined) {
+		aps["stale-date"] = liveActivity.staleDateEpochSeconds;
+	}
+	if (liveActivity.dismissalDateEpochSeconds !== undefined) {
+		aps["dismissal-date"] = liveActivity.dismissalDateEpochSeconds;
+	}
+	return aps;
+}
+
+function getLiveActivityApnsTopic() {
+	return process.env.LIVE_ACTIVITY_APNS_TOPIC || DEFAULT_LIVE_ACTIVITY_APNS_TOPIC;
+}
+
+function respondFcmSendFailed(response, route, request, error) {
+	const code = getErrorCode(error) || "unknown";
+	console.error(`FCM ${route} send failed`, {
+		eventId: request.eventId.slice(0, 128),
+		kind: request.kind.slice(0, 64),
+		...getSafeErrorLog(error),
+	});
+	response.status(502).json({ error: "fcm_send_failed", code });
+}
+
+function normalizeRoutePath(rawPath) {
+	let routePath = rawPath.split("?", 1)[0] || "/";
+	if (routePath.startsWith("/pushRelay/")) {
+		routePath = routePath.slice("/pushRelay".length);
+	}
+	return routePath.replace(/\/+$/, "") || "/";
+}
+
+function isInvalidTargetError(error) {
+	const code = getErrorCode(error);
+	return Boolean(code && INVALID_TARGET_ERROR_CODES.has(code));
+}
+
+function getErrorCode(error) {
+	return isRecord(error) && typeof error.code === "string" ? error.code : undefined;
+}
+
+function getSafeErrorLog(error) {
+	const code = getErrorCode(error);
+	const name = error instanceof Error ? error.name.slice(0, 64) : "UnknownError";
+	return { ...(code === undefined ? {} : { code: code.slice(0, 96) }), name };
+}
+
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}