# `Excessibility.SQLFingerprint`
[🔗](https://github.com/lessthanseventy/excessibility/blob/v0.20.0/lib/excessibility/sql_fingerprint.ex#L1)

Normalizes SQL into a stable, value-free shape and derives a fingerprint.

Postgres-oriented (the Ecto reference adapter). Ecto emits parameterized SQL
(`$1`, `$2` …) with bind values already separated, so normalization only has
to canonicalize whitespace/case, fold `IN (...)` arity, and scrub the few
inline literals that appear in fragments. The fingerprint is derived from the
normalized string, so grouping (N+1, compare) depends on this being correct —
see the leak-guard tests.

# `fingerprint`

Fingerprint SQL as `"sha256:<16 hex>"`.

# `normalize`

Normalize SQL to a stable, value-free string. The generic folds here are
dialect-agnostic; any dialect-specific normalization is applied last via
`c:Excessibility.Dialect.normalize_extras/1` (no-op for Postgres today).

The literal-aware `scan/3` runs first, on the **original-case** SQL: Postgres
dollar-quote tags (`$TAG$`) and E-string escapes are case-sensitive, so
lowercasing before scanning could turn look-alike text inside a literal into a
false closing delimiter and leak literal contents (see #166). The scan folds
every string / dollar-quoted / E-string literal to `?` and strips comments, so
only value-free tokens remain; downcasing the scanned result is then safe.

---

*Consult [api-reference.md](api-reference.md) for complete listing*