From 14f7004b381efeb8a52cd014e3565ffc689e45a5 Mon Sep 17 00:00:00 2001 From: Nick Aldewereld Date: Wed, 8 Jul 2026 10:30:03 +0200 Subject: [PATCH] refactor(notes): use non-monotonic ULIDs for note ids In monotonic mode, ids minted within the same millisecond are a deterministic +1 of the previous random suffix rather than fresh entropy. Sortability isn't needed for a capability id, so keep the full 80 bits of randomness per id. --- packages/app-server/src/modules/shared/utils/random.ts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/packages/app-server/src/modules/shared/utils/random.ts b/packages/app-server/src/modules/shared/utils/random.ts index 961ae784..a20d78c9 100644 --- a/packages/app-server/src/modules/shared/utils/random.ts +++ b/packages/app-server/src/modules/shared/utils/random.ts @@ -2,7 +2,11 @@ import { ulidFactory } from 'ulid-workers'; export { generateId }; -const createUlid = ulidFactory(); +// monotonic: false — in monotonic mode ids created within the same millisecond +// are a deterministic +1 of the previous random suffix instead of fresh entropy, +// making burst-created ids partly predictable. We don't need sortability for a +// capability id, so keep the full 80 bits of randomness per id. +const createUlid = ulidFactory({ monotonic: false }); function generateId() { return createUlid().toLowerCase();