[devzain15]

Summary

Browsers only expose crypto.randomUUID in secure contexts, so on a plain http dev site (for example Herd's http://*.test) sending a remote message threw Uncaught TypeError: crypto.randomUUID is not a function, and opening a commit photo hit the same call. Both now work in insecure contexts: the uuid comes from crypto.randomUUID when the browser has it, and is otherwise built as an RFC 4122 v4 uuid from crypto.getRandomValues, which is available everywhere.

Closes #620.

Changes

• resources/js/lib/utils.ts: new randomUuid() helper that prefers the native function and otherwise assembles a v4 uuid (version nibble 4, variant bits 10) from 16 random bytes.
• resources/js/lib/chat.ts and resources/js/lib/commit-photo.ts: the four crypto.randomUUID() call sites use the helper. Production behaviour on https is unchanged.
• tests/Unit/RandomUuid.test.ts: covers the native path and the fallback's shape and uniqueness, stubbing crypto.randomUUID only for the duration of each test.

Validation

Local, Node 22.22.2:

• node --experimental-strip-types --test tests/Unit/RandomUuid.test.ts: 2 passed.
• bun run test:unit: 129 passed, 1 failed. The failure is SeriesStash.test.ts, which shells out to vitest and fails on Cannot find package '@/actions/...' because the Wayfinder-generated modules are absent in this environment; unrelated to this change.
• bun run test:lint: no errors in the changed files; vp fmt --check on the four changed files is clean. The remaining errors are all TS2307 for the missing generated @/actions and @/routes modules.
• bun run test:types: 257 errors, all TS2307 for the same missing generated modules.
• PHP checks (composer test:lint, test:type-coverage, pest) could not run locally (PHP 8.4 installed, repo needs 8.5; no vendor). The diff touches no PHP, so hosted CI is the authority for those.

No UI, layout or mobile interaction changes, so visual and device verification do not apply.

Independent review

Reviewed by a separate read-only Claude Code agent, base 8adba04 (upstream production), head = this branch's single commit. Verdict: PASS on correctness (v4 version nibble and variant bits, 36-char layout, native path preferred), regressions (no remaining direct crypto.randomUUID calls, no other tests depend on it, node --test isolates files per process), architecture and style (minimal helper beside the other pure helpers in utils.ts, sorted imports, matches existing test conventions), and tests. The reviewer re-ran the new test (2 passed), vp fmt --check and tsc on the test tsconfig, and verified the native crypto.randomUUID is intact after the test file runs. Limits: the reviewer had the same environment as above (no generated Wayfinder modules, no PHP).

Limitations

The fallback path was exercised only in Node's test runner by removing crypto.randomUUID, not in a browser served over plain http.

[devzain15]

@paulinevos