From a977c3cad933aaea1299a374eee72f0d319d88ee Mon Sep 17 00:00:00 2001
From: Ian Gulliver <git@flamingcow.io>
Date: Wed, 21 Oct 2026 09:05:33 -0700
Subject: [PATCH] Audit of fe2a202

---
 internal/ids/ids.go          | 61 ++++++++++++++----------------------
 internal/store/migrateids.go |  7 +++--
 2 files changed, 28 insertions(+), 40 deletions(-)

diff --git a/internal/ids/ids.go b/internal/ids/ids.go
index 75124d6..6266737 100644
--- a/internal/ids/ids.go
+++ b/internal/ids/ids.go
@@ -4,7 +4,6 @@ import (
 	"crypto/rand"
 	"crypto/sha256"
 	"encoding/binary"
-	"fmt"
 	"strings"
 )
 
@@ -13,36 +12,29 @@ const (
 	randomLength = 11
 )
 
+type Prefix string
+
 const (
-	Project            = "prj"
-	Task               = "tsk"
-	Session            = "ses"
-	Snapshot           = "snp"
-	Review             = "rev"
-	InboxItem          = "inb"
-	InboxResponse      = "rsp"
-	Blob               = "blb"
-	LeadNote           = "not"
-	WorkflowDefinition = "wfd"
-	WorkflowRun        = "run"
-	Send               = "snd"
-	Client             = "cli"
-	ClientRequest      = "req"
-	Transfer           = "xfr"
-	Terminal           = "trm"
-	SavedCommand       = "cmd"
+	Project            Prefix = "prj"
+	Task               Prefix = "tsk"
+	Session            Prefix = "ses"
+	Snapshot           Prefix = "snp"
+	Review             Prefix = "rev"
+	InboxItem          Prefix = "inb"
+	InboxResponse      Prefix = "rsp"
+	Blob               Prefix = "blb"
+	LeadNote           Prefix = "not"
+	WorkflowDefinition Prefix = "wfd"
+	WorkflowRun        Prefix = "run"
+	Send               Prefix = "snd"
+	Client             Prefix = "cli"
+	ClientRequest      Prefix = "req"
+	Transfer           Prefix = "xfr"
+	Terminal           Prefix = "trm"
+	SavedCommand       Prefix = "cmd"
 )
 
-var prefixes = map[string]bool{
-	Project: true, Task: true, Session: true, Snapshot: true, Review: true,
-	InboxItem: true, InboxResponse: true, Blob: true, LeadNote: true,
-	WorkflowDefinition: true, WorkflowRun: true, Send: true,
-	Client: true, ClientRequest: true, Transfer: true,
-	Terminal: true, SavedCommand: true,
-}
-
-func New(prefix string) string {
-	check(prefix)
+func New(prefix Prefix) string {
 	out := make([]byte, randomLength)
 	buf := make([]byte, 1)
 	for i := 0; i < len(out); {
@@ -53,11 +45,10 @@ func New(prefix string) string {
 		out[i] = alphabet[int(buf[0])%len(alphabet)]
 		i++
 	}
-	return prefix + string(out)
+	return string(prefix) + string(out)
 }
 
-func Derive(prefix string, parts ...string) string {
-	check(prefix)
+func Derive(prefix Prefix, parts ...string) string {
 	sum := sha256.Sum256([]byte(strings.Join(parts, "\x00")))
 	n := binary.BigEndian.Uint64(sum[:8])
 	out := make([]byte, randomLength)
@@ -65,11 +56,5 @@ func Derive(prefix string, parts ...string) string {
 		out[i] = alphabet[n%uint64(len(alphabet))]
 		n /= uint64(len(alphabet))
 	}
-	return prefix + string(out)
-}
-
-func check(prefix string) {
-	if !prefixes[prefix] {
-		panic(fmt.Sprintf("no id prefix %q", prefix))
-	}
+	return string(prefix) + string(out)
 }
diff --git a/internal/store/migrateids.go b/internal/store/migrateids.go
index d745b83..b0c6a7e 100644
--- a/internal/store/migrateids.go
+++ b/internal/store/migrateids.go
@@ -102,7 +102,10 @@ func migratePrefixIDs(tx *sql.Tx, dataDir string) error {
 }
 
 func idRenames(tx *sql.Tx) (map[string]string, error) {
-	sources := []struct{ prefix, query string }{
+	sources := []struct {
+		prefix ids.Prefix
+		query  string
+	}{
 		{ids.Project, `SELECT id FROM projects`},
 		{ids.Task, `SELECT id FROM tasks`},
 		{ids.WorkflowRun, `SELECT DISTINCT workflow_run FROM tasks`},
@@ -133,7 +136,7 @@ func idRenames(tx *sql.Tx) (map[string]string, error) {
 				return nil, err
 			}
 			_, mapped := renames[old]
-			if old == "" || mapped || strings.HasPrefix(old, src.prefix) {
+			if old == "" || mapped || strings.HasPrefix(old, string(src.prefix)) {
 				continue
 			}
 			renames[old] = ids.Derive(src.prefix, old)