shelving 1.266.0 → 1.267.1

package/cloudflare/CloudflareKVProvider.js

@@ -79,5 +79,8 @@ export class CloudflareKVProvider extends DBProvider {
     }
 }
 function _getKey(collection, id) {
-    return `${collection}:${id}`;
+    // Percent-encode both parts so the `:` separator is unambiguous: without this, an `id` containing `:`
+    // (e.g. collection `a` + id `b:c`) collides with a different collection/id pair (collection `a:b` + id `c`).
+    // Plain identifiers (letters, digits, `-`, `_`, `.`) are left unchanged, so keys for typical names/UUIDs are stable.
+    return `${encodeURIComponent(collection)}:${encodeURIComponent(id)}`;
 }

package/markup/rule/heading.d.ts

@@ -3,6 +3,7 @@
  * - `#` 1-6 hashes, then one or more spaces, then the title.
  * - `#` must be the first character on the line.
  * - Markdown's underline syntax is not supported (for simplification).
+ * - Each heading gets a `getSlug()` `id` derived from its text, so same-page `#anchor` links resolve to it (e.g. `## React integration` becomes `id="react-integration"`). An all-punctuation heading that slugs to nothing gets no `id`.
  *
  * @example new MarkupParser({ rules: [HEADING_RULE] }).parse("# Title")
  * @see https://shelving.cc/markup/HEADING_RULE

package/markup/rule/heading.js

@@ -1,4 +1,5 @@
 import { jsx as _jsx } from "react/jsx-runtime";
+import { getSlug } from "../../util/string.js";
 import { createMarkupRule } from "../MarkupRule.js";
 import { createLineRegExp, LINE_CONTENT_REGEXP, LINE_SPACE_REGEXP } from "../util/regexp.js";
 /**
@@ -6,6 +7,7 @@ import { createLineRegExp, LINE_CONTENT_REGEXP, LINE_SPACE_REGEXP } from "../uti
  * - `#` 1-6 hashes, then one or more spaces, then the title.
  * - `#` must be the first character on the line.
  * - Markdown's underline syntax is not supported (for simplification).
+ * - Each heading gets a `getSlug()` `id` derived from its text, so same-page `#anchor` links resolve to it (e.g. `## React integration` becomes `id="react-integration"`). An all-punctuation heading that slugs to nothing gets no `id`.
  *
  * @example new MarkupParser({ rules: [HEADING_RULE] }).parse("# Title")
  * @see https://shelving.cc/markup/HEADING_RULE
@@ -13,5 +15,7 @@ import { createLineRegExp, LINE_CONTENT_REGEXP, LINE_SPACE_REGEXP } from "../uti
 export const HEADING_RULE = createMarkupRule(createLineRegExp(`(?<prefix>#{1,6})(?:${LINE_SPACE_REGEXP}+(?<heading>${LINE_CONTENT_REGEXP}))?`), (key, { prefix, heading = "" }, parser) => {
     // The hash count picks the heading level; cast the dynamic tag to the known `h1`–`h6` set.
     const Heading = `h${prefix.length}`;
-    return _jsx(Heading, { children: parser.parse(heading.trim(), "inline") }, key);
+    const title = heading.trim();
+    // Slug the raw title (before inline parsing) for the `id`, so `#anchor` fragment links land on the heading.
+    return (_jsx(Heading, { id: getSlug(title), children: parser.parse(title, "inline") }, key));
 }, ["block"]);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "shelving",
-	"version": "1.266.0",
+	"version": "1.267.1",
 	"author": "Dave Houlbrooke <dave@shax.com>",
 	"repository": {
 		"type": "git",
@@ -9,13 +9,13 @@
 	"main": "./index.js",
 	"module": "./index.js",
 	"devDependencies": {
-		"@biomejs/biome": "^2.5.1",
+		"@biomejs/biome": "^2.5.2",
 		"@google-cloud/firestore": "^8.6.0",
 		"@heroicons/react": "^2.2.0",
 		"@types/bun": "^1.3.14",
 		"@types/react": "^19.2.17",
 		"@types/react-dom": "^19.2.3",
-		"@typescript/native-preview": "^7.0.0-dev.20260627.2",
+		"@typescript/native-preview": "^7.0.0-dev.20260704.1",
 		"firebase": "^12.15.0",
 		"react": "^19.3.0-canary-fef12a01-20260413",
 		"react-dom": "^19.3.0-canary-fef12a01-20260413",

package/util/crypto.js

@@ -4,6 +4,7 @@ import { requireBytes } from "./bytes.js";
 // Constants.
 const ALGORITHM = { name: "PBKDF2", hash: "SHA-512" };
 const ITERATIONS = 500000;
+const MAX_ITERATIONS = 10000000; // Upper bound on iterations accepted from a stored hash — guards against a malicious hash forcing an arbitrarily expensive derivation (DoS). Comfortably above the 500k default.
 const SALT_LENGTH = 16; // 16 bytes = 128 bits
 const HASH_LENGTH = 64; // 64 bytes = 512 bits
 const PASSWORD_LENGTH = 6;
@@ -42,8 +43,8 @@ export async function hashPassword(password, iterations = ITERATIONS) {
             received: password.length,
             caller: hashPassword,
         });
-    if (iterations < 1)
-        throw new ValueError("Iterations must be number greater than 0", { received: iterations, caller: hashPassword });
+    if (iterations < 1 || iterations > MAX_ITERATIONS)
+        throw new ValueError(`Iterations must be between 1 and ${MAX_ITERATIONS}`, { received: iterations, caller: hashPassword });
     // Hash the password.
     const key = await _getKey(password);
     const salt = getRandomBytes(SALT_LENGTH);
@@ -70,7 +71,7 @@ export async function verifyPassword(password, hash) {
     const hashBytes = decodeBase64URLBytes(h);
     // Check iterations.
     const iterations = Number.parseInt(i, 10);
-    if (!Number.isFinite(iterations) || iterations < 1)
+    if (!Number.isFinite(iterations) || iterations < 1 || iterations > MAX_ITERATIONS)
         return false;
     // Derive the hash.
     const key = await _getKey(password);