Function deriveCacheDigest

src/api/providers/fetchers/modelCache.ts:99–106

* Derive a short, irreversible, truncated digest of a cache input. * * The output is deliberately far smaller than the entropy of a real API key: collisions * across the handful of keys/servers a single user configures are negligible (birthday bound * ~ n^2 / 2^(8*bytes)), while the truncated ou

(value: string, bytes: number)

 * cache filename cannot be reversed to identify the API key it was derived from.
 */
function deriveCacheDigest(value: string, bytes: number): string {
	const memoKey = `${bytes}:${value}`
	const cached = cacheDigestCache.get(memoKey)
	if (cached) return cached
	const digest = pbkdf2Sync(value, CACHE_DIGEST_SALT, CACHE_DIGEST_ITERATIONS, bytes, "sha256").toString("hex")
	cacheDigestCache.set(memoKey, digest)
	return digest
}

// 4 bytes (8 hex chars) = 32 bits for the per-API-key discriminator embedded in the cache key.
const API_KEY_DISCRIMINATOR_BYTES = 4