fix(eve): send optimistic messages without crypto.randomUUID

.changeset/optimistic-send-non-secure-origin.md

@@ -0,0 +1,5 @@
+---
+"eve": patch
+---
+
+Sending a message from a web client served over plain HTTP on a host other than `localhost` no longer fails with `crypto.randomUUID is not a function`. Thanks @KingAmo for reporting this in #5415.

packages/eve/src/client/optimistic-message-submissions.ts

@@ -5,6 +5,8 @@ import type { SessionView } from "#protocol/session-projection/tables.js";
 
 type Submission = LocalSubmission & { readonly deliveryId?: string };
 
+let submissionSequence = 0;
+
 /** Local message echoes until their deliveries arrive, including failed sends. */
 export class OptimisticMessageSubmissions {
   readonly #optimistic: boolean;
@@ -23,7 +25,8 @@ export class OptimisticMessageSubmissions {
 
   submit(input: SendTurnPayload, turnId?: string): string | undefined {
     if (input.message === undefined) return undefined;
-    const id = crypto.randomUUID();
+    // Browsers expose `randomUUID` only in secure contexts, so plain-HTTP origins lack it.
+    const id = crypto.randomUUID?.() ?? `submission_${(submissionSequence += 1).toString()}`;
     this.#submissions.set(id, { id, message: summarizeMessage(input.message), turnId });
     this.#publish();
     return id;

packages/eve/src/client/session-store.test.ts

@@ -37,6 +37,7 @@ function store(options: SessionStoreInit = {}) {
 afterEach(() => {
   for (const current of stores.splice(0)) detachSessionStore(current);
   vi.restoreAllMocks();
+  vi.unstubAllGlobals();
 });
 
 /** An append-only agent stream, independent of when its POST acknowledgements arrive. */
@@ -644,6 +645,20 @@ describe("SessionStore acceptance and observation", () => {
     expect(current.snapshot.error).toBeInstanceOf(Error);
     expect(current.snapshot.messages[0]?.metadata?.status).toBe("failed");
   });
+
+  // Browsers expose `crypto.randomUUID` only in secure contexts (#5415).
+  it("sends where crypto.randomUUID is not exposed, as on a plain-HTTP origin", async () => {
+    const server = agent();
+    const webCrypto = globalThis.crypto;
+    vi.stubGlobal("crypto", { getRandomValues: webCrypto.getRandomValues.bind(webCrypto) });
+    const current = store({ initialSession });
+    await current.send({ message: "sunny." });
+    await current.send({ message: "sunny.", turnPolicy: "queue" });
+    expect(server.posts).toEqual(["/eve/v1/session/session_1", "/eve/v1/session/session_1"]);
+    const [first, second] = current.snapshot.messages;
+    expect(texts(current)).toEqual(["user: sunny.", "user: sunny."]);
+    expect(first?.id).not.toBe(second?.id);
+  });
 });
 
 describe("SessionStore Stop during submission", () => {