nucleus-core-ts 0.10.38 → 0.10.40

package/dist/.build-ok

@@ -1 +1 @@
-0.10.38
+0.10.40

package/dist/fe/components/VerificationFlowPage/components/VerificationFlowPage.js

@@ -4,6 +4,7 @@ import { addEdge, applyEdgeChanges, applyNodeChanges, Background, Controls, Mark
 import '@xyflow/react/dist/style.css';
 import { useEffect, useEffectEvent, useRef, useState } from 'react';
 import { cn } from '../../../utils/cn';
+import { newId } from '../../../utils/newId';
 import { DEFAULT_VERIFICATION_FLOW_LABELS, setActiveLabels } from '../labels';
 import { useVerificationFlowStore } from '../store';
 import { getVerificationFlowTheme } from '../theme';
@@ -393,7 +394,7 @@ export function VerificationFlowPage({ entityName, title, subtitle, flowListActi
         if (!flowSaveAction) return;
         let flowId = store.selectedFlowId;
         if (!flowId) {
-            flowId = crypto.randomUUID();
+            flowId = newId();
             store.setSelectedFlowId(flowId);
         }
         const name = flowName || say.defaultFlowName(entityName);

package/dist/fe/utils/newId.d.ts

@@ -0,0 +1,22 @@
+/**
+ * A v4 UUID that also exists over plain HTTP.
+ *
+ * `crypto.randomUUID` is restricted to secure contexts: HTTPS, or localhost.
+ * Serve the same bundle from `http://something.example/` and the property is
+ * simply absent, so calling it throws `TypeError: crypto.randomUUID is not a
+ * function` — and it throws at the moment a user presses a button, inside a
+ * handler nobody wrapped, which is how a whole feature goes quiet with no error
+ * on screen.
+ *
+ * That is not hypothetical. The verification flow builder minted its flow id
+ * that way, and on a preview install served over HTTP the Save button did
+ * nothing at all: the exception landed before the save request was built, the
+ * canvas kept its unsaved graph, and the flow tables stayed empty. It looked
+ * like a backend that refused to persist.
+ *
+ * `crypto.getRandomValues` carries no such restriction — it is available in
+ * insecure contexts — so the fallback is still cryptographically random, and
+ * only the very last resort is not. Prefer this over `crypto.randomUUID`
+ * anywhere the code can run in a browser.
+ */
+export declare function newId(): string;

package/dist/fe/utils/newId.js

@@ -0,0 +1,48 @@
+/**
+ * A v4 UUID that also exists over plain HTTP.
+ *
+ * `crypto.randomUUID` is restricted to secure contexts: HTTPS, or localhost.
+ * Serve the same bundle from `http://something.example/` and the property is
+ * simply absent, so calling it throws `TypeError: crypto.randomUUID is not a
+ * function` — and it throws at the moment a user presses a button, inside a
+ * handler nobody wrapped, which is how a whole feature goes quiet with no error
+ * on screen.
+ *
+ * That is not hypothetical. The verification flow builder minted its flow id
+ * that way, and on a preview install served over HTTP the Save button did
+ * nothing at all: the exception landed before the save request was built, the
+ * canvas kept its unsaved graph, and the flow tables stayed empty. It looked
+ * like a backend that refused to persist.
+ *
+ * `crypto.getRandomValues` carries no such restriction — it is available in
+ * insecure contexts — so the fallback is still cryptographically random, and
+ * only the very last resort is not. Prefer this over `crypto.randomUUID`
+ * anywhere the code can run in a browser.
+ */ export function newId() {
+    const c = typeof globalThis !== 'undefined' ? globalThis.crypto : undefined;
+    if (c && typeof c.randomUUID === 'function') {
+        return c.randomUUID();
+    }
+    const bytes = new Uint8Array(16);
+    if (c && typeof c.getRandomValues === 'function') {
+        c.getRandomValues(bytes);
+    } else {
+        // No Web Crypto at all (an ancient or stripped-down environment). The ids
+        // only have to be unique within one editing session, so this is enough to
+        // keep the feature working — but it is not a source of secrets, and nothing
+        // here should ever be used as one.
+        for(let i = 0; i < bytes.length; i++){
+            bytes[i] = Math.floor(Math.random() * 256);
+        }
+    }
+    // RFC 4122 §4.4: version 4, variant 10xx. `at()` rather than `bytes[i]`
+    // because the package compiles under noUncheckedIndexedAccess.
+    bytes[6] = (bytes.at(6) ?? 0) & 0x0f | 0x40;
+    bytes[8] = (bytes.at(8) ?? 0) & 0x3f | 0x80;
+    let hex = '';
+    for(let i = 0; i < bytes.length; i++){
+        if (i === 4 || i === 6 || i === 8 || i === 10) hex += '-';
+        hex += (bytes.at(i) ?? 0).toString(16).padStart(2, '0');
+    }
+    return hex;
+}