{"record":{"id":"d839a7dbb5727dbf","repo":"koala73/worldmonitor","slug":"company-monitoring-field-invalid","errorCode":null,"errorMessage":"COMPANY_MONITORING_${field}_INVALID","messagePattern":"COMPANY_MONITORING_(.+?)_INVALID","errorType":"exception","errorClass":"ConvexError","httpStatus":null,"severity":"warning","filePath":"convex/companyMonitoring/admission.ts","lineNumber":27,"sourceCode":"  COMPANY_MONITORING_DEFAULT_CONFIDENCE_FLOORS,\n  COMPANY_MONITORING_RETRY_POLICY,\n  COMPANY_MONITORING_SOURCE_POLICY_VERSION,\n  evaluateCompanyMonitoringClassifierTransportFailure,\n  evaluateCompanyMonitoringClassification,\n} from \"../../scripts/lib/company-monitoring-classification.mjs\";\nimport { fingerprint, randomFence } from \"./_shared\";\nimport {\n  companyMonitoringCandidateEvidenceSnapshotDigest as candidateEvidenceSnapshotDigest,\n  companyMonitoringEvidenceShape as evidenceShape,\n} from \"./admissionSnapshot\";\n\nconst ADMISSION_LEASE_MS = 5 * 60 * 1000;\nconst ADMISSION_ID = /^[A-Za-z0-9._:-]{1,128}$/;\nconst ADMISSION_MODEL_VERSION = /^[^\\u0000-\\u001f\\u007f]{1,200}$/u;\n\nfunction admissionIdentifier(value: string, field: string) {\n  if (!ADMISSION_ID.test(value)) {\n    throw new ConvexError(`COMPANY_MONITORING_${field}_INVALID`);\n  }\n  return value;\n}\n\nfunction admissionModelVersion(value: string) {\n  if (\n    value !== value.trim() ||\n    !ADMISSION_MODEL_VERSION.test(value)\n  ) {\n    throw new ConvexError(\"COMPANY_MONITORING_MODEL_VERSION_INVALID\");\n  }\n  return value;\n}\n\nfunction canonicalValue(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(canonicalValue);\n  if (value && typeof value === \"object\") {\n    const row = value as Record<string, unknown>;","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/koala73/worldmonitor/blob/ffec79ac339946fd2d24e85845da5755dcaa534b/convex/companyMonitoring/admission.ts#L9-L45","documentation":"Thrown by admissionIdentifier (admission.ts:25-29) when a workerId, leaseToken, or classificationRunId does not match the ADMISSION_ID regex /^[A-Za-z0-9._:-]{1,128}$/. The ConvexError message is COMPANY_MONITORING_<FIELD>_INVALID, where field is one of ADMISSION_WORKER_ID, ADMISSION_LEASE, or CLASSIFICATION_RUN_ID. This validates admission-pipeline identifiers before they are persisted, ensuring they are compact, printable, and bounded.","triggerScenarios":"An admission mutation (leaseAdmissionCandidate, resolveAdmissionCandidate, etc.) is called with a workerId/leaseToken/classificationRunId containing spaces, slashes, unicode, or exceeding 128 characters. A system-generated classificationRunId (e.g. 'system-reject-...') is sliced to 128 chars but still contains an invalid character. A worker passes a UUID with hyphens in unexpected positions or a free-form string.","commonSituations":"A worker process generates ids with characters outside the allowed alphabet (e.g. base64 with '+'/'='/'/'). A classificationRunId built from a candidate id + suffix exceeds 128 chars before slicing. A test passes a descriptive string with spaces. A worker id includes unicode from a misconfigured hostname.","solutions":["Generate worker/lease/run ids from the allowed alphabet only: A-Z, a-z, 0-9, and the separators . _ : -. Prefer ULID, a hex hash, or a slugified id.","Ensure the id is between 1 and 128 characters — truncate generated ids (like the system-<decision>-<candidateId> pattern at admission.ts:138) before passing, not after.","Strip or reject disallowed characters at the worker before invoking the admission mutation."],"exampleFix":"// before — worker passes a raw hostname with invalid chars\nconst workerId = os.hostname(); // e.g. 'worker_prod us-1'\n// after — slug to allowed alphabet\nconst workerId = (os.hostname() || 'worker').replace(/[^A-Za-z0-9._:-]/g, '-').slice(0, 128);","handlingStrategy":"validation","validationCode":"const ADMISSION_ID = /^[A-Za-z0-9._:-]{1,128}$/;\nfunction isValidAdmissionId(value: unknown): value is string {\n  return typeof value === \"string\" && ADMISSION_ID.test(value);\n}\n// before calling an admission mutation:\nif (!isValidAdmissionId(workerId)) workerId = slugify(workerId).slice(0, 128) || crypto.randomUUID();","typeGuard":"function isValidAdmissionId(value: unknown): value is string {\n  const ADMISSION_ID = /^[A-Za-z0-9._:-]{1,128}$/;\n  return typeof value === \"string\" && ADMISSION_ID.test(value);\n}","tryCatchPattern":null,"preventionTips":["Generate workerId, leaseToken, and classificationRunId from the allowed alphabet (A-Za-z0-9._:-) only.","Truncate generated ids to 128 chars before passing, not after the mutation rejects them.","Slugify any hostname-derived worker id to strip invalid characters (spaces, slashes, unicode)."],"tags":["validation","input-sanitization","convex","company-monitoring","admission"],"backgroundTag":null,"analyzedSha":"ffec79ac339946fd2d24e85845da5755dcaa534b","analyzedAt":"2026-08-12T11:24:56.012Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}