The problem lies around the following piece of code:

	if FINGERPRINT then
		return pad (FINGERPRINT, BLOCK_SIZE)
	end
...

Here, FINGERPRINT might contain invalid characters (that is, characters out of the hexadecimal value range).

The solution is to catch such thing on tests. Our test must validate if the CUID fields contain valid hexadecimal characters.

😃

The library contains the maximum number representable under base-36 by 4 digits (i.e, 1679616 = 36 ** 4), but our internal machinery only converts to base-16 by 4 digits values (the maximum representable value here is 65536 = 16 ** 4).

The following pieces of code contain such problems, the former regarding base-36:

local DISCRETE_VALUES = 1679616 -- 36 ^ BLOCK_SIZE --

And this latter regarding base-16:

local function to_hex (number)
	return string.format ("%x", math.floor (number))
end

We need to extend the range of conversion to match the range of representation, therefore, we need
a new function called to_base36 instead of to_hex here.

We're not obliged to stick to base-36 following CUID specification, but I want to comply how much possible with that.

Due to security concerns (which also exist in database auto-increment ids, uuid/guid, and most other id standrads), the Cuid standard is now deprecated in favor of Cuid2.

The next release (planned to be v0.4-1) will bring the following features:

• API-level custom fingerprints (rather than just sole environment variables).
• Slugs (shorter CUIDs) for URL disambiguation, for instance.

The planned API-level fingerprint customization is the following:

local cuid = require 'cuid'
local fingerprint_text = "It's me, Mario!"
local id = cuid.generate (fingerprint_text)

Where the cuid.generate accepts fingerprint_text as an optional argument.
So, it could be called as well:

local id = cuid.generate ( )

And thus, no prior/previous API is broken (in the case, v0.3-1). This default case for CUID
generation will try to figure out a fingerprint out of the LUA_CUID_FINGERPRINT
environment variable, if defined. Otherwise, there's an internal machinery (a.k.a black magic)
which final users (library clients) must not rely upon.