shelving 1.267.0 → 1.267.1

package/cloudflare/CloudflareKVProvider.js

@@ -79,5 +79,8 @@ export class CloudflareKVProvider extends DBProvider {
     }
 }
 function _getKey(collection, id) {
-    return `${collection}:${id}`;
+    // Percent-encode both parts so the `:` separator is unambiguous: without this, an `id` containing `:`
+    // (e.g. collection `a` + id `b:c`) collides with a different collection/id pair (collection `a:b` + id `c`).
+    // Plain identifiers (letters, digits, `-`, `_`, `.`) are left unchanged, so keys for typical names/UUIDs are stable.
+    return `${encodeURIComponent(collection)}:${encodeURIComponent(id)}`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "shelving",
-	"version": "1.267.0",
+	"version": "1.267.1",
 	"author": "Dave Houlbrooke <dave@shax.com>",
 	"repository": {
 		"type": "git",
@@ -9,13 +9,13 @@
 	"main": "./index.js",
 	"module": "./index.js",
 	"devDependencies": {
-		"@biomejs/biome": "^2.5.1",
+		"@biomejs/biome": "^2.5.2",
 		"@google-cloud/firestore": "^8.6.0",
 		"@heroicons/react": "^2.2.0",
 		"@types/bun": "^1.3.14",
 		"@types/react": "^19.2.17",
 		"@types/react-dom": "^19.2.3",
-		"@typescript/native-preview": "^7.0.0-dev.20260627.2",
+		"@typescript/native-preview": "^7.0.0-dev.20260704.1",
 		"firebase": "^12.15.0",
 		"react": "^19.3.0-canary-fef12a01-20260413",
 		"react-dom": "^19.3.0-canary-fef12a01-20260413",

package/util/crypto.js

@@ -4,6 +4,7 @@ import { requireBytes } from "./bytes.js";
 // Constants.
 const ALGORITHM = { name: "PBKDF2", hash: "SHA-512" };
 const ITERATIONS = 500000;
+const MAX_ITERATIONS = 10000000; // Upper bound on iterations accepted from a stored hash — guards against a malicious hash forcing an arbitrarily expensive derivation (DoS). Comfortably above the 500k default.
 const SALT_LENGTH = 16; // 16 bytes = 128 bits
 const HASH_LENGTH = 64; // 64 bytes = 512 bits
 const PASSWORD_LENGTH = 6;
@@ -42,8 +43,8 @@ export async function hashPassword(password, iterations = ITERATIONS) {
             received: password.length,
             caller: hashPassword,
         });
-    if (iterations < 1)
-        throw new ValueError("Iterations must be number greater than 0", { received: iterations, caller: hashPassword });
+    if (iterations < 1 || iterations > MAX_ITERATIONS)
+        throw new ValueError(`Iterations must be between 1 and ${MAX_ITERATIONS}`, { received: iterations, caller: hashPassword });
     // Hash the password.
     const key = await _getKey(password);
     const salt = getRandomBytes(SALT_LENGTH);
@@ -70,7 +71,7 @@ export async function verifyPassword(password, hash) {
     const hashBytes = decodeBase64URLBytes(h);
     // Check iterations.
     const iterations = Number.parseInt(i, 10);
-    if (!Number.isFinite(iterations) || iterations < 1)
+    if (!Number.isFinite(iterations) || iterations < 1 || iterations > MAX_ITERATIONS)
         return false;
     // Derive the hash.
     const key = await _getKey(password);