feat(rum): use xxHash instead of SHA-256 for debug ID generation

SHA-256 was chosen for FIPS compliance, which isn't a requirement here.
Debug IDs only need to be deterministic and cheap to compute, so xxhash-wasm
replaces the cryptographic hash while keeping the same UUID-v4 output shape.

Author: buranmert

.yarn/cache/xxhash-wasm-npm-1.1.0-3ea0978f68-cad149dabd.zip

@@ -821,6 +821,7 @@ wide-align,npm,ISC,Rebecca Turner (http://re-becca.org/)
 wrap-ansi,npm,MIT,Sindre Sorhus (sindresorhus.com)
 wrappy,npm,ISC,Isaac Z. Schlueter (https://github.com/npm/wrappy)
 write-file-atomic,npm,ISC,GitHub Inc. (https://github.com/npm/write-file-atomic)
+xxhash-wasm,npm,MIT,Michael Jungo (https://www.npmjs.com/package/xxhash-wasm)
 y18n,npm,ISC,Ben Coe (https://github.com/yargs/y18n)
 yallist,npm,ISC,Isaac Z. Schlueter (http://blog.izs.me/)
 yaml,npm,ISC,Eemeli Aro (https://eemeli.org/yaml/)

LICENSES-3rdparty.csv

@@ -39,7 +39,8 @@
     "dependencies": {
         "@datadog/js-instrumentation-wasm": "1.0.8",
         "@dd/core": "workspace:*",
-        "chalk": "2.3.1"
+        "chalk": "2.3.1",
+        "xxhash-wasm": "1.1.0"
     },
     "devDependencies": {
         "@datadog/browser-rum": "6.26.0",

packages/plugins/rum/package.json

@@ -0,0 +1,36 @@
+// Unless explicitly stated otherwise all files in this repository are licensed under the MIT License.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2019-Present Datadog, Inc.
+
+import { initDebugIdHasher, stringToUUID } from '@dd/rum-plugin/debugId';
+
+describe('RUM Plugin - debugId', () => {
+    describe('stringToUUID', () => {
+        test('Should throw if the hasher is not initialized.', () => {
+            expect(() => stringToUUID('some-input')).toThrow(
+                '[stringToUUID] Hasher not initialized: call `initDebugIdHasher()` first.',
+            );
+        });
+
+        describe('once initialized', () => {
+            beforeAll(async () => {
+                await initDebugIdHasher();
+            });
+
+            test('Should produce a UUID-v4-shaped identifier.', () => {
+                const uuid = stringToUUID('some-input');
+                expect(uuid).toMatch(
+                    /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/,
+                );
+            });
+
+            test('Should be deterministic for the same input.', () => {
+                expect(stringToUUID('some-input')).toBe(stringToUUID('some-input'));
+            });
+
+            test('Should differ for different inputs.', () => {
+                expect(stringToUUID('some-input')).not.toBe(stringToUUID('other-input'));
+            });
+        });
+    });
+});

packages/plugins/rum/src/debugId.test.ts

@@ -2,14 +2,29 @@
 // This product includes software developed at Datadog (https://www.datadoghq.com/).
 // Copyright 2019-Present Datadog, Inc.
 
-import { createHash } from 'crypto';
+import xxhash from 'xxhash-wasm';
+import type { XXHashAPI } from 'xxhash-wasm';
 
 const VARIANT_CHARS = ['8', '9', 'a', 'b'] as const;
+// Arbitrary fixed seed so the second half is independent from the first (which uses the default seed).
+const SECOND_HALF_SEED = BigInt('0x9e3779b97f4a7c15');
 
-// SHA-256(input) truncated to 128 bits → deterministic UUID-v4-shaped identifier.
-// SHA-256 is used instead of MD5 for FIPS 140-2/3 compliance.
+let hasher: XXHashAPI | undefined;
+
+// Must be awaited (e.g. during a build's `buildStart`) before any synchronous `stringToUUID` call.
+export const initDebugIdHasher = async (): Promise<void> => {
+    hasher = hasher ?? (await xxhash());
+};
+
+// xxHash64(input) || xxHash64(input, seed) → 128 bits, reshaped into a deterministic UUID-v4-shaped identifier.
+// xxHash instead of a cryptographic hash: debug IDs only need to be deterministic and cheap to compute.
 export const stringToUUID = (input: string): string => {
-    const hash = createHash('sha256').update(input).digest('hex').slice(0, 32);
+    if (!hasher) {
+        throw new Error('[stringToUUID] Hasher not initialized: call `initDebugIdHasher()` first.');
+    }
+    const firstHalf = hasher.h64(input).toString(16).padStart(16, '0');
+    const secondHalf = hasher.h64(input, SECOND_HALF_SEED).toString(16).padStart(16, '0');
+    const hash = `${firstHalf}${secondHalf}`;
     const withVersion = `${hash.slice(0, 12)}4${hash.slice(13)}`;
     const variantIndex = withVersion.charCodeAt(16) % 4;
     const withVariant = `${withVersion.slice(0, 16)}${VARIANT_CHARS[variantIndex]}${withVersion.slice(17)}`;

packages/plugins/rum/src/debugId.ts

@@ -8,6 +8,7 @@ import path from 'path';
 
 import type { RumInitConfiguration, RumPublicApi } from './browserSdkTypes';
 import { CONFIG_KEY, PLUGIN_NAME } from './constants';
+import { initDebugIdHasher } from './debugId';
 import { getSourceCodeContextSnippet } from './getSourceCodeContextSnippet';
 import { getPrivacyPlugin } from './privacy';
 import { getInjectionValue } from './sdk';
@@ -33,6 +34,14 @@ export const getPlugins: GetPlugins = ({ options, context }) => {
     const sourceCodeContext = validatedOptions.sourceCodeContext;
 
     if (sourceCodeContext) {
+        if (sourceCodeContext.debugId) {
+            // The hasher backing `stringToUUID` needs to be ready before any chunk is processed.
+            plugins.push({
+                name: 'datadog-rum-debug-id-hasher-plugin',
+                buildStart: initDebugIdHasher,
+            });
+        }
+
         context.inject({
             type: 'code',
             position: InjectPosition.BEFORE,

packages/plugins/rum/src/index.ts

@@ -64,7 +64,8 @@
         "p-queue": "6.6.2",
         "pretty-bytes": "5.6.0",
         "simple-git": "3.36.0",
-        "unplugin": "2.3.11"
+        "unplugin": "2.3.11",
+        "xxhash-wasm": "1.1.0"
     },
     "devDependencies": {
         "@babel/core": "7.24.5",

packages/published/esbuild-plugin/package.json

@@ -67,7 +67,8 @@
         "p-queue": "6.6.2",
         "pretty-bytes": "5.6.0",
         "simple-git": "3.36.0",
-        "unplugin": "2.3.11"
+        "unplugin": "2.3.11",
+        "xxhash-wasm": "1.1.0"
     },
     "devDependencies": {
         "@babel/core": "7.24.5",

packages/published/rollup-plugin/package.json

@@ -64,7 +64,8 @@
         "p-queue": "6.6.2",
         "pretty-bytes": "5.6.0",
         "simple-git": "3.36.0",
-        "unplugin": "2.3.11"
+        "unplugin": "2.3.11",
+        "xxhash-wasm": "1.1.0"
     },
     "devDependencies": {
         "@babel/core": "7.24.5",

packages/published/rspack-plugin/package.json

@@ -64,7 +64,8 @@
         "p-queue": "6.6.2",
         "pretty-bytes": "5.6.0",
         "simple-git": "3.36.0",
-        "unplugin": "2.3.11"
+        "unplugin": "2.3.11",
+        "xxhash-wasm": "1.1.0"
     },
     "devDependencies": {
         "@babel/core": "7.24.5",