@reclaimprotocol/agent 0.1.35 → 0.1.37

package/src/proof/zk-files.ts

@@ -1,84 +1,376 @@
-// Lazy download of the @reclaimprotocol/zk-symmetric-crypto circuit resources
-// the proof engines need (the downloader fetches every engine — stwo, snarkjs,
-// gnark — as one bundle). These are ~280MB and are NOT fetched in a
-// `postinstall` (that blocked the MCP server's first launch past the connect
-// timeout — see the install notes). Instead we fetch them on the first proof,
-// once, so the server starts immediately and only `run_proof` pays the cost.
-
-import { spawn } from 'node:child_process'
-import { existsSync } from 'node:fs'
+// Download of the @reclaimprotocol/zk-symmetric-crypto circuit resources the
+// proof engines read from disk. Never a `postinstall`: that blocked the MCP
+// server's first launch past the connect timeout. Instead the MCP server starts
+// the download in the background at launch (`startZkFilesDownload`), and every
+// proof awaits it (`ensureZkFiles`) as the safety net.
+//
+// Proofs default to the stwo engine. Its resources are ~1.5MB, so we fetch only
+// `resources/stwo` file by file from the package's pinned commit and check each
+// file's git blob hash against the listing for that commit. When that fails
+// (GitHub API rate limit, a changed layout), we fall back to the package's own
+// downloader, which fetches the whole repository archive (~350MB).
+// (In zk-symmetric-crypto 5.1.x the stwo prover loads its WASM from the npm
+// package itself; `resources/stwo` is kept as the readiness signal.)
+
+import { badGateway, internal } from '@hapi/boom'
+import assert from 'node:assert'
+import { spawn as nodeSpawn, type StdioOptions } from 'node:child_process'
+import { createHash } from 'node:crypto'
+import { existsSync, statSync } from 'node:fs'
+import {
+	mkdir,
+	mkdtemp,
+	rename,
+	rm,
+	writeFile
+} from 'node:fs/promises'
 import { createRequire } from 'node:module'
 import { dirname, join } from 'node:path'
+import { pathToFileURL } from 'node:url'
 
-const require = createRequire(import.meta.url)
+const REPO = 'reclaimprotocol/zk-symmetric-crypto'
+/** The stwo resource dir; its presence means the circuits are ready. */
+const STWO_DIR = join('resources', 'stwo')
+/** Where the package's downloader writes the archive, relative to its cwd. */
+const ARCHIVE_PATH = join('zk-symmetric-crypto-download', 'repo.zip')
 
-let inFlight: Promise<void> | undefined
+export type ZkFilesState =
+	| { status: 'idle' }
+	| {
+		status: 'downloading'
+		/** `stwo-files`: the ~1.5MB stwo files. `full-archive`: the ~350MB
+		 *  repository archive (fallback). */
+		method: 'stwo-files' | 'full-archive'
+		elapsedMs: number
+		bytesDownloaded?: number
+		totalBytes?: number
+	}
+	| { status: 'ready' }
+	| { status: 'failed', reason: string }
+
+/** Minimal child process surface `download-files.js` is driven through. */
+export interface ChildLike {
+	once(event: 'exit', listener: (code: number | null) => void): unknown
+	once(event: 'error', listener: (err: Error) => void): unknown
+}
+
+interface Progress {
+	method: 'stwo-files' | 'full-archive'
+	startedAt: number
+	bytesDownloaded?: number
+	totalBytes?: number
+	/** The archive file whose size is the progress (full-archive only). */
+	archivePath?: string
+}
+
+export interface ZkFilesDeps {
+	/** The zk-symmetric-crypto package root, or undefined when not installed. */
+	resolvePackageDir?: () => string | undefined
+	/** The pinned repository commit the package's resources come from. */
+	readCommit?: (pkgDir: string) => Promise<string>
+	fetch?: typeof fetch
+	spawn?: (
+		command: string,
+		args: string[],
+		options: { cwd: string, stdio: StdioOptions },
+	) => ChildLike
+	/** Progress lines. Defaults to stderr: stdout carries MCP JSON-RPC. */
+	log?: (message: string) => void
+}
 
 /**
- * Ensure the zk circuit resources are on disk before a proof runs. Idempotent
- * and concurrency-safe: the download runs at most once per process, and a
- * failed attempt clears the latch so a later proof can retry.
- *
- * Resolves silently when the resources are already present (the warm npx cache,
- * or after a manual `npm run download:zk-files`) and when
- * `@reclaimprotocol/zk-symmetric-crypto` isn't installed at all (SDK-only
- * consumers have nothing to prove).
- *
- * All output goes to stderr (fd 2): the MCP server speaks JSON-RPC over stdout,
- * so a stray write to fd 1 mid-session would corrupt the protocol.
+ * Build a downloader with its own state. The module exports one default
+ * instance; tests build their own with injected `spawn` and `fetch`.
  */
-export function ensureZkFiles() {
-	inFlight ??= download().catch((err) => {
-		inFlight = undefined
-		throw err
+export function makeZkFiles(deps: ZkFilesDeps = {}) {
+	const resolvePackageDir = deps.resolvePackageDir ?? resolveZkPackageDir
+	const readCommit = deps.readCommit ?? readPinnedCommit
+	const fetchFn = deps.fetch ?? fetch
+	const spawn = deps.spawn ?? nodeSpawn
+	const log = deps.log ?? ((message: string) => {
+		process.stderr.write(`[reclaim-agent] ${message}\n`)
 	})
-	return inFlight
-}
 
-async function download() {
-	let mainPath: string
-	try {
-		mainPath = require.resolve('@reclaimprotocol/zk-symmetric-crypto')
-	} catch{
-		return
+	let inFlight: Promise<void> | undefined
+	let failure: string | undefined
+	let ready = false
+	let progress: Progress | undefined
+
+	return { ensure, start, state }
+
+	/**
+	 * Ensure the circuit resources are on disk. Idempotent and
+	 * concurrency-safe: one download runs at a time per process, and a failed
+	 * attempt clears the latch so a later call retries.
+	 */
+	function ensure() {
+		inFlight ??= download()
+			.then(() => {
+				ready = true
+				failure = undefined
+			}, (err: unknown) => {
+				inFlight = undefined
+				failure = messageOf(err)
+				throw err
+			})
+			.finally(() => {
+				progress = undefined
+			})
+		return inFlight
 	}
 
-	// mainPath is <pkg>/lib/index.js → resources live at <pkg>/resources, the
-	// downloader at <pkg>/lib/scripts/download-files.js. Proofs default to the
-	// stwo (WASM) engine, so its resource dir being present is the signal that
-	// the circuits are ready (the downloader fetches all engines together).
-	const libDir = dirname(mainPath)
-	const pkgDir = dirname(libDir)
-	if(existsSync(join(pkgDir, 'resources', 'stwo'))) {
-		return
+	/** Start `ensure` in the background; `state` reports the outcome. */
+	function start() {
+		ensure().catch(() => {})
 	}
 
-	const downloadScript = join(libDir, 'scripts', 'download-files.js')
-	if(!existsSync(downloadScript)) {
-		throw new Error(
-			'zk circuit downloader not found in '
-			+ '@reclaimprotocol/zk-symmetric-crypto; '
-			+ 'run `npm run download:zk-files` and retry.',
+	function state(): ZkFilesState {
+		if(ready) {
+			return { status: 'ready' }
+		}
+
+		if(progress) {
+			const bytesDownloaded = progress.archivePath
+				? fileSize(progress.archivePath)
+				: progress.bytesDownloaded
+			return {
+				status: 'downloading',
+				method: progress.method,
+				elapsedMs: Date.now() - progress.startedAt,
+				...(bytesDownloaded !== undefined ? { bytesDownloaded } : {}),
+				...(progress.totalBytes !== undefined
+					? { totalBytes: progress.totalBytes }
+					: {}),
+			}
+		}
+
+		if(failure !== undefined) {
+			return { status: 'failed', reason: failure }
+		}
+
+		return { status: 'idle' }
+	}
+
+	async function download() {
+		const pkgDir = resolvePackageDir()
+		// SDK-only consumers don't install the package: nothing to prove.
+		if(!pkgDir || existsSync(join(pkgDir, STWO_DIR))) {
+			return
+		}
+
+		try {
+			progress = { method: 'stwo-files', startedAt: Date.now() }
+			await fetchStwoFiles(pkgDir, progress)
+		} catch(err) {
+			const stwoError = messageOf(err)
+			log(
+				`fetching the stwo proof files failed (${stwoError}); `
+				+ 'downloading the full circuit archive (~350MB, one-time)…',
+			)
+			progress = {
+				method: 'full-archive',
+				startedAt: Date.now(),
+				archivePath: join(pkgDir, ARCHIVE_PATH),
+			}
+			try {
+				await runArchiveDownloader(pkgDir)
+			} catch(archiveErr) {
+				throw badGateway(
+					`stwo files: ${stwoError}; full archive: ${messageOf(archiveErr)}`,
+				)
+			}
+		}
+
+		assert(
+			existsSync(join(pkgDir, STWO_DIR)),
+			internal(
+				`zk circuit download finished but ${join(pkgDir, STWO_DIR)} `
+				+ 'is missing; run `npm run download:zk-files` and retry.',
+			),
 		)
 	}
 
-	process.stderr.write(
-		'[reclaim-agent] downloading zkTLS proof circuits '
-		+ '(~280MB, one-time)…\n',
-	)
-	// stdio fd 1→2: send the downloader's stdout to our stderr so its progress
-	// never lands on the MCP server's JSON-RPC stdout.
-	await new Promise<void>((resolve, reject) => {
-		const child = spawn(process.execPath, [downloadScript], {
-			stdio: ['ignore', 2, 2],
-		})
-		child.on('error', reject)
-		child.on('exit', (code) => {
-			if(code === 0) {
-				resolve()
-			} else {
-				reject(new Error(`zk download exited ${code}`))
+	/**
+	 * Fetch `resources/stwo` at the pinned commit, file by file, into a temp
+	 * dir inside the package, then rename it into place (same filesystem).
+	 */
+	async function fetchStwoFiles(pkgDir: string, stats: Progress) {
+		const commit = await readCommit(pkgDir)
+		assert(/^[0-9a-f]{40}$/.test(commit), internal('invalid pinned commit'))
+		const files = await listStwoFiles(commit)
+		stats.bytesDownloaded = 0
+		stats.totalBytes = files.reduce((sum, f) => sum + f.size, 0)
+		log(
+			`downloading zkTLS stwo proof files (${stats.totalBytes} bytes, `
+			+ 'one-time)…',
+		)
+
+		const tmp = await mkdtemp(join(pkgDir, '.stwo-download-'))
+		try {
+			for(const file of files) {
+				const res = await fetchFn(
+					`https://raw.githubusercontent.com/${REPO}/${commit}/`
+					+ `resources/stwo/${file.name}`,
+				)
+				assert(
+					res.ok,
+					badGateway(`stwo file ${file.name}: HTTP ${res.status}`),
+				)
+				const bytes = new Uint8Array(await res.arrayBuffer())
+				assert(
+					gitBlobSha(bytes) === file.sha,
+					badGateway(`stwo file ${file.name} failed its integrity check`),
+				)
+				await writeFile(join(tmp, file.name), bytes)
+				stats.bytesDownloaded = (stats.bytesDownloaded ?? 0) + bytes.length
 			}
+
+			const dest = join(pkgDir, STWO_DIR)
+			await mkdir(dirname(dest), { recursive: true })
+			// Another process may have finished first; its copy is as good.
+			await rename(tmp, dest).catch((err: unknown) => {
+				if(!existsSync(dest)) {
+					throw err
+				}
+			})
+		} finally {
+			await rm(tmp, { recursive: true, force: true })
+		}
+	}
+
+	/** The file listing of `resources/stwo` at `commit`, with blob hashes. */
+	async function listStwoFiles(commit: string) {
+		const res = await fetchFn(
+			`https://api.github.com/repos/${REPO}/contents/resources/stwo`
+			+ `?ref=${commit}`,
+			{ headers: { Accept: 'application/vnd.github+json' } },
+		)
+		assert(res.ok, badGateway(`stwo file listing: HTTP ${res.status}`))
+		const listing: unknown = await res.json()
+		assert(
+			Array.isArray(listing) && listing.length > 0,
+			badGateway('stwo file listing is empty'),
+		)
+		return listing.map((entry: unknown) => {
+			assert(
+				typeof entry === 'object' && entry !== null
+				&& 'type' in entry && entry.type === 'file'
+				&& 'name' in entry && typeof entry.name === 'string'
+				&& /^[\w.-]+$/.test(entry.name) && !entry.name.startsWith('.')
+				&& 'size' in entry && typeof entry.size === 'number'
+				&& 'sha' in entry && typeof entry.sha === 'string',
+				badGateway('unexpected entry in the stwo file listing'),
+			)
+			return { name: entry.name, size: entry.size, sha: entry.sha }
 		})
-	})
+	}
+
+	/**
+	 * Run the package's `download-files.js`. Its temp paths are relative, so
+	 * cwd is the package dir: the archive and extracted tree then sit on the
+	 * same filesystem as the final `rename()` (no EXDEV) and never land in the
+	 * developer's project.
+	 */
+	async function runArchiveDownloader(pkgDir: string) {
+		const script = join(pkgDir, 'lib', 'scripts', 'download-files.js')
+		assert(
+			existsSync(script),
+			internal(
+				'zk circuit downloader not found in '
+				+ '@reclaimprotocol/zk-symmetric-crypto; '
+				+ 'run `npm run download:zk-files` and retry.',
+			),
+		)
+
+		await new Promise<void>((resolve, reject) => {
+			// stdio fd 1→2: the downloader's progress must never reach the MCP
+			// server's JSON-RPC stdout.
+			const child = spawn(process.execPath, [script], {
+				cwd: pkgDir,
+				stdio: ['ignore', 2, 2],
+			})
+			child.once('error', reject)
+			child.once('exit', (code) => {
+				if(code === 0) {
+					resolve()
+				} else {
+					reject(internal(`zk circuit download exited with code ${code}`))
+				}
+			})
+		})
+	}
+}
+
+const DEFAULT = makeZkFiles()
+
+/**
+ * Ensure the zk circuit resources are on disk before a proof runs. Resolves
+ * at once when they're present or the package isn't installed.
+ */
+export function ensureZkFiles() {
+	return DEFAULT.ensure()
+}
+
+/** Start the download in the background (MCP server launch). */
+export function startZkFilesDownload() {
+	DEFAULT.start()
+}
+
+/** Where the download stands: idle, downloading, ready, or failed. */
+export function zkFilesState() {
+	return DEFAULT.state()
+}
+
+/**
+ * The zk-symmetric-crypto copy attestor-core loads (it may be nested under
+ * attestor-core), else the hoisted one.
+ */
+function resolveZkPackageDir() {
+	const require = createRequire(import.meta.url)
+	for(const from of [
+		() => createRequire(require.resolve('@reclaimprotocol/attestor-core')),
+		() => require,
+	]) {
+		try {
+			// <pkg>/lib/index.js → <pkg>
+			return dirname(dirname(
+				from().resolve('@reclaimprotocol/zk-symmetric-crypto'),
+			))
+		} catch{
+			// try the next resolution root
+		}
+	}
+
+	return undefined
+}
+
+async function readPinnedCommit(pkgDir: string) {
+	const mod: { GIT_COMMIT_HASH?: unknown } = await import(
+		pathToFileURL(join(pkgDir, 'lib', 'index.js')).href
+	)
+	assert(
+		typeof mod.GIT_COMMIT_HASH === 'string',
+		internal('zk-symmetric-crypto exports no GIT_COMMIT_HASH'),
+	)
+	return mod.GIT_COMMIT_HASH
+}
+
+/** Git's blob object id: sha1 of `blob <size>\0<content>`. */
+function gitBlobSha(bytes: Uint8Array) {
+	return createHash('sha1')
+		.update(`blob ${bytes.length}\0`)
+		.update(bytes)
+		.digest('hex')
+}
+
+function fileSize(path: string) {
+	try {
+		return statSync(path).size
+	} catch{
+		return undefined
+	}
+}
+
+function messageOf(err: unknown) {
+	return err instanceof Error ? err.message : String(err)
 }

package/src/provider/draft.ts

@@ -1,12 +1,15 @@
+import { badRequest } from '@hapi/boom'
+import assert from 'node:assert'
 import { isOprfHashable, OPRF_MAX_BYTES, synthesizeMatcher } from './matcher.ts'
 import { normalizeCandidates } from './normalize.ts'
-import type {
-	CapturedRequest,
-	OprfMode,
-	ReclaimProvider,
-	ResponseMatch,
-	ResponseRedaction,
-	SecretParamRef,
+import {
+	type CapturedRequest,
+	DYNAMIC_GEO,
+	type OprfMode,
+	type ReclaimProvider,
+	type ResponseMatch,
+	type ResponseRedaction,
+	type SecretParamRef,
 } from './schema.ts'
 import {
 	secretUrlCharBudget,
@@ -433,3 +436,208 @@ export function draftProvider(
 
 	return { provider, secretRefs, extractions }
 }
+
+/** Fields `update_draft` may replace on a drafted provider. */
+export interface DraftEdit {
+	responseMatches?: ResponseMatch[]
+	responseRedactions?: ResponseRedaction[]
+	paramValues?: Record<string, string>
+	/** ISO country the request goes out from, or `{{DYNAMIC_GEO}}` /
+	 *  `{{DYNAMIC_GEO_SECRET}}` for the verifying user's own country. */
+	geoLocation?: string
+}
+
+const GEO_TEMPLATES = new Set([DYNAMIC_GEO, '{{DYNAMIC_GEO_SECRET}}'])
+
+const MATCH_TYPES = new Set(['contains', 'regex'])
+const OPRF_MODES = new Set(['oprf', 'oprf-raw', 'oprf-mpc'])
+
+/**
+ * Apply an agent's edit to a drafted provider: validate the new matchers the
+ * way the attestor reads them (regexes compile with its `sgi` flags, every
+ * redaction has a selector, a hashed redaction has exactly one named group),
+ * then run the same portability gate as {@link draftProvider} so an edit can't
+ * bake a captured value in as a literal. Returns the updated provider, its
+ * extractions (re-paired with the redaction that names each param), and
+ * advisory warnings (for example, a `{{param}}` nothing resolves).
+ */
+export function editDraftProvider(
+	provider: ReclaimProvider,
+	extractions: Extraction[],
+	edit: DraftEdit,
+): {
+	provider: ReclaimProvider
+	extractions: Extraction[]
+	warnings: string[]
+} {
+	const matches = edit.responseMatches ?? provider.responseMatches
+	const redactions = edit.responseRedactions
+		?? provider.responseRedactions ?? []
+	const paramValues = edit.paramValues ?? provider.paramValues ?? {}
+	const geoLocation = GEO_TEMPLATES.has(edit.geoLocation ?? '')
+		? edit.geoLocation
+		: edit.geoLocation?.toUpperCase()
+	assert(
+		geoLocation === undefined || GEO_TEMPLATES.has(geoLocation)
+		|| /^[A-Z]{2}$/.test(geoLocation),
+		badRequest(
+			'geoLocation must be a 2-letter ISO country code, {{DYNAMIC_GEO}}, '
+			+ 'or {{DYNAMIC_GEO_SECRET}}',
+		),
+	)
+	assert(
+		matches.length > 0,
+		badRequest('responseMatches must have at least one entry'),
+	)
+	for(const [i, m] of matches.entries()) {
+		assert(
+			MATCH_TYPES.has(m.type) && typeof m.value === 'string' && m.value,
+			badRequest(
+				`responseMatches[${i}] needs type "contains" or "regex" and a `
+				+ 'non-empty value',
+			),
+		)
+		if(m.type === 'regex') {
+			assertRegex(m.value, `responseMatches[${i}].value`)
+		}
+	}
+
+	for(const [i, r] of redactions.entries()) {
+		assert(
+			r.xPath || r.jsonPath || r.regex,
+			badRequest(`responseRedactions[${i}] needs an xPath, jsonPath, or regex`),
+		)
+		if(r.regex) {
+			assertRegex(r.regex, `responseRedactions[${i}].regex`)
+		}
+
+		assert(
+			!r.hash || (OPRF_MODES.has(r.hash) && groupNames(r.regex).length === 1),
+			badRequest(
+				`responseRedactions[${i}] is hashed (${r.hash}), so it needs a hash `
+				+ 'of oprf, oprf-raw, or oprf-mpc and a regex with exactly one named '
+				+ 'capture group',
+			),
+		)
+	}
+
+	// An edit can't lower privacy: a draft that redacts keeps redacting, and
+	// every group it hashed stays hashed with the same mode.
+	const original = provider.responseRedactions ?? []
+	assert(
+		!original.length || redactions.length,
+		badRequest(
+			'responseRedactions can\'t be emptied: the attestor would see the '
+			+ 'whole response',
+		),
+	)
+	for(const r of original.filter((o) => o.hash)) {
+		for(const name of groupNames(r.regex)) {
+			const kept = redactions.find((e) => groupNames(e.regex).includes(name))
+			assert(
+				kept?.hash === r.hash,
+				badRequest(
+					`capture group ${name} is ${r.hash}-hashed in the draft; keep a `
+					+ 'redaction for it with the same hash',
+				),
+			)
+		}
+	}
+
+	const groups = matcherGroups(matches, redactions)
+	// A group the draft never extracted has a value nothing below checks, and
+	// no extraction would track it: new data points need a fresh draft.
+	const known = new Set([
+		...extractions.map((e) => e.name),
+		...matcherGroups(
+			provider.responseMatches,
+			provider.responseRedactions ?? [],
+		),
+	])
+	const unknown = [...groups].filter((name) => !known.has(name))
+	assert(
+		!unknown.length,
+		badRequest(
+			`capture group(s) ${unknown.join(', ')} are not drafted extractions; `
+			+ 'propose a new draft to add a data point',
+		),
+	)
+
+	// Always the captured values, so editing a paramValues entry can't hide
+	// one from the portability gate; edited values are checked as well.
+	const targets: DraftTarget[] = [
+		...extractions.map(({ name, value }) => ({ name, value })),
+		...Object.entries(paramValues)
+			.filter(([name, value]) => !extractions
+				.some((e) => e.name === name && e.value === value))
+			.map(([name, value]) => ({ name, value })),
+	]
+	assertPortableMatches(matches, redactions, targets)
+
+	// Same OPRF gate as draftProvider, against the URL as the attestor signs it.
+	const hashed = redactions.flatMap(({ regex, hash }) => hash
+		? groupNames(regex).flatMap((name) => targets
+			.filter((t) => t.name === name)
+			.map((t) => ({ ...t, hash })))
+		: [])
+	const url = provider.url
+		.replace(/\{\{([^{}]+)\}\}/g, (t, name: string) => paramValues[name] ?? t)
+	assertNoOprfUrlConflict(url, hashed, hashed.map((t) => t.hash))
+
+	const { responseRedactions: _r, paramValues: _p, ...rest } = provider
+	void _r
+	void _p
+	const next: ReclaimProvider = {
+		...rest,
+		responseMatches: matches,
+		...(redactions.length ? { responseRedactions: redactions } : {}),
+		...(Object.keys(paramValues).length ? { paramValues } : {}),
+		...(geoLocation ? { geoLocation } : {}),
+	}
+	const warnings = matches
+		.flatMap((m) => [...m.value.matchAll(/\{\{([^{}]+)\}\}/g)].map((t) => t[1]))
+		.filter((name) => !(name in paramValues) && !groups.has(name))
+		.map((name) => `{{${name}}} has no paramValues entry or named capture `
+			+ 'group, so the attestor would look for it literally.')
+	const nextExtractions = extractions.map((e) => {
+		const redaction = redactions
+			.find((r) => groupNames(r.regex).includes(e.name))
+		// The captured value, never an edited one, so a later edit's gate still
+		// sees it.
+		return {
+			name: e.name,
+			value: e.value,
+			...(redaction ? { redaction } : {}),
+		}
+	})
+	return { provider: next, extractions: nextExtractions, warnings }
+}
+
+/** Named capture groups across regex matches and redactions. */
+function matcherGroups(
+	matches: ResponseMatch[],
+	redactions: ResponseRedaction[],
+) {
+	return new Set([
+		...matches.flatMap((m) => m.type === 'regex' ? groupNames(m.value) : []),
+		...redactions.flatMap((r) => groupNames(r.regex)),
+	])
+}
+
+/** Named capture groups in `regex` (none when absent). */
+function groupNames(regex: string | undefined): string[] {
+	return [...(regex ?? '').matchAll(/\(\?<([A-Za-z_][A-Za-z0-9_]*)>/g)]
+		.map((m) => m[1])
+}
+
+/** Throw a 400 unless `regex` compiles the way the attestor compiles it. */
+function assertRegex(regex: string, where: string) {
+	let error: string | undefined
+	try {
+		new RegExp(regex, 'sgi')
+	} catch(err) {
+		error = err instanceof Error ? err.message : String(err)
+	}
+
+	assert(!error, badRequest(`${where} is not a valid regex: ${error}`))
+}