@ultimat3/query 1.2.0 → 3.0.0

package/src/stable.ts

@@ -13,8 +13,15 @@ export function stableStringify(value: unknown): string {
   switch (typeof value) {
     case 'string':
       return JSON.stringify(value);
+    // A bare token, never `'null'` and never a quoted string: this output is only ever hashed, so
+    // an unquoted word cannot collide with the `string` branch (which always quotes) while
+    // `'null'` collided with JSON `null` itself — `{ n: NaN }`, `{ n: Infinity }` and `{ n: null }`
+    // fingerprinted identically and shared one cache entry and one cursor scope. `-0` is spelled
+    // out for the same reason: `String(-0)` is `"0"`, so `-0` and `0` were one key too.
     case 'number':
-      return Number.isFinite(value) ? String(value) : 'null';
+      if (Number.isNaN(value)) return 'NaN';
+      if (!Number.isFinite(value)) return value > 0 ? 'Infinity' : '-Infinity';
+      return Object.is(value, -0) ? '-0' : String(value);
     case 'boolean':
       return String(value);
     case 'bigint':
@@ -35,18 +42,22 @@ export function stableStringify(value: unknown): string {
   return `{${entries.join(',')}}`;
 }
 
-/** FNV-1a/32 as hex. Identity of a query shape, never a security boundary. */
-export function fnv1a(input: string): string {
-  let hash = 0x811c9dc5;
-  for (let i = 0; i < input.length; i += 1) {
-    hash ^= input.charCodeAt(i);
-    hash = Math.imul(hash, 0x01000193) >>> 0;
-  }
-  return hash.toString(16).padStart(8, '0');
-}
-
+/**
+ * SHA-256, first 16 hex characters — the same primitive and the same width `@ultimat3/realtime`'s
+ * `stableDigest` and `@ultimat3/entity`'s `planScope` already chose, and for the same reason.
+ *
+ * A fingerprint is a SHARING key, not a checksum: it decides which read-cache entry two callers
+ * are served from and which scope a cursor is bound to, over input a client chooses. FNV-1a/32 —
+ * what this was — is 4x10^9 values, brute-forceable offline in seconds, so an attacker could mint
+ * an input that lands on another read's entry or another page's scope. It identifies, and here
+ * identifying IS the boundary.
+ *
+ * The canonical form above is unchanged, so the only thing that moved is the hash: a cursor issued
+ * before this fails its scope check as `X_CURSOR_INVALID` — cleanly, with "request the first page
+ * again" as its fix — and a warm read cache is cold once.
+ */
 export function fingerprint(value: unknown): string {
-  return fnv1a(stableStringify(value));
+  return new Bun.CryptoHasher('sha256').update(stableStringify(value)).digest('hex').slice(0, 16);
 }
 
 /** Column read that works for interfaces without an index signature. */

package/src/tags.ts

@@ -1,17 +0,0 @@
-/**
- * Cache tags stay opaque here — they belong to @ultimat3/cache. This package only
- * needs the wire string per tag so a read's key can be found by the invalidation
- * graph an action's `invalidates` drives.
- */
-
-import type { CacheTag } from '@ultimat3/cache';
-import { serializeTag } from '@ultimat3/cache';
-
-export function tagKey(value: CacheTag): string {
-  return serializeTag(value);
-}
-
-/** Sorted + de-duplicated: descriptor output must not depend on declaration order. */
-export function tagKeys(tags: readonly CacheTag[]): readonly string[] {
-  return [...new Set(tags.map(tagKey))].sort();
-}