fix: safe randomUUID helper for non-secure browser contexts (#1593)

* fix(db): use safe randomUUID helper for non-secure browser contexts (#1541)

* fix(db-sqlite-persistence-core): use safe randomUUID helper (#1541)

* fix(browser-db-sqlite-persistence): use safe randomUUID helper (#1541)

* fix(electron-db-sqlite-persistence): use safe randomUUID helper (#1541)

* fix(offline-transactions): use safe randomUUID helper (#1541)

* ci: apply automated fixes

* refactor: rename randomUUID helper to safeRandomUUID and add crypto-undefined test

---------

Co-authored-by: Kevin De Porre <kevin-dp@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

Author: kevin-dp

.changeset/safe-random-uuid.md

@@ -0,0 +1,9 @@
+---
+'@tanstack/db': patch
+'@tanstack/browser-db-sqlite-persistence': patch
+'@tanstack/offline-transactions': patch
+'@tanstack/db-sqlite-persistence-core': patch
+'@tanstack/electron-db-sqlite-persistence': patch
+---
+
+Use a safe `randomUUID` helper that falls back to `crypto.getRandomValues` when `crypto.randomUUID` is unavailable (non-secure browser contexts such as dev servers reached via a LAN IP over HTTP). Fixes #1541.

packages/browser-db-sqlite-persistence/src/browser-coordinator.ts

@@ -1,3 +1,4 @@
+import { safeRandomUUID } from '@tanstack/db-sqlite-persistence-core'
 import type {
   ApplyLocalMutationsResponse,
   PersistedCollectionCoordinator,
@@ -118,7 +119,7 @@ export type BrowserCollectionCoordinatorOptions = {
 // ---------------------------------------------------------------------------
 
 export class BrowserCollectionCoordinator implements PersistedCollectionCoordinator {
-  private readonly nodeId = crypto.randomUUID()
+  private readonly nodeId = safeRandomUUID()
   private readonly dbName: string
   private adapter: AdapterWithPullSince | null
   private readonly channel: BroadcastChannel
@@ -205,7 +206,7 @@ export class BrowserCollectionCoordinator implements PersistedCollectionCoordina
       error?: string
     }>(collectionId, {
       type: `rpc:ensureRemoteSubset:req`,
-      rpcId: crypto.randomUUID(),
+      rpcId: safeRandomUUID(),
       options,
     })
 
@@ -233,7 +234,7 @@ export class BrowserCollectionCoordinator implements PersistedCollectionCoordina
       error?: string
     }>(collectionId, {
       type: `rpc:ensurePersistedIndex:req`,
-      rpcId: crypto.randomUUID(),
+      rpcId: safeRandomUUID(),
       signature,
       spec,
     })
@@ -252,16 +253,16 @@ export class BrowserCollectionCoordinator implements PersistedCollectionCoordina
     if (this.isLeader(collectionId)) {
       return this.handleApplyLocalMutations(collectionId, {
         type: `rpc:applyLocalMutations:req`,
-        rpcId: crypto.randomUUID(),
-        envelopeId: crypto.randomUUID(),
+        rpcId: safeRandomUUID(),
+        envelopeId: safeRandomUUID(),
         mutations,
       })
     }
 
     return this.sendRPC<ApplyLocalMutationsResponse>(collectionId, {
       type: `rpc:applyLocalMutations:req`,
-      rpcId: crypto.randomUUID(),
-      envelopeId: crypto.randomUUID(),
+      rpcId: safeRandomUUID(),
+      envelopeId: safeRandomUUID(),
       mutations,
     })
   }
@@ -273,14 +274,14 @@ export class BrowserCollectionCoordinator implements PersistedCollectionCoordina
     if (this.isLeader(collectionId)) {
       return this.handlePullSince(collectionId, {
         type: `rpc:pullSince:req`,
-        rpcId: crypto.randomUUID(),
+        rpcId: safeRandomUUID(),
         fromRowVersion,
       })
     }
 
     return this.sendRPC<PullSinceResponse>(collectionId, {
       type: `rpc:pullSince:req`,
-      rpcId: crypto.randomUUID(),
+      rpcId: safeRandomUUID(),
       fromRowVersion,
     })
   }
@@ -663,7 +664,7 @@ export class BrowserCollectionCoordinator implements PersistedCollectionCoordina
 
     // Build and apply the persisted transaction
     const tx = {
-      txId: crypto.randomUUID(),
+      txId: safeRandomUUID(),
       term,
       seq,
       rowVersion,

packages/db-sqlite-persistence-core/src/index.ts

@@ -1,3 +1,5 @@
 export * from './persisted'
 export * from './errors'
 export * from './sqlite-core-adapter'
+// Re-export for use in non-secure browser contexts (see #1541)
+export { safeRandomUUID } from '@tanstack/db'

packages/db-sqlite-persistence-core/src/persisted.ts

@@ -1,4 +1,8 @@
-import { compileSingleRowExpression, toBooleanPredicate } from '@tanstack/db'
+import {
+  compileSingleRowExpression,
+  safeRandomUUID,
+  toBooleanPredicate,
+} from '@tanstack/db'
 import {
   InvalidPersistedCollectionConfigError,
   InvalidPersistedCollectionCoordinatorError,
@@ -440,7 +444,7 @@ type SyncControlFns<T extends object, TKey extends string | number> = {
 export class SingleProcessCoordinator implements PersistedCollectionCoordinator {
   private readonly nodeId: string
 
-  constructor(nodeId: string = crypto.randomUUID()) {
+  constructor(nodeId: string = safeRandomUUID()) {
     this.nodeId = nodeId
   }
 
@@ -467,7 +471,7 @@ export class SingleProcessCoordinator implements PersistedCollectionCoordinator
   public pullSince(): Promise<PullSinceResponse> {
     return Promise.resolve({
       type: `rpc:pullSince:res`,
-      rpcId: crypto.randomUUID(),
+      rpcId: safeRandomUUID(),
       ok: true,
       latestTerm: 1,
       latestSeq: 0,
@@ -1387,7 +1391,7 @@ class PersistedCollectionRuntime<
         this.createTxCommittedPayload({
           term: streamPosition.term,
           seq: streamPosition.seq,
-          txId: crypto.randomUUID(),
+          txId: safeRandomUUID(),
           latestRowVersion: streamPosition.rowVersion,
           changedRows: [],
           deletedKeys: [],
@@ -1427,7 +1431,7 @@ class PersistedCollectionRuntime<
     streamPosition: { term: number; seq: number; rowVersion: number },
   ): PersistedTx {
     return {
-      txId: crypto.randomUUID(),
+      txId: safeRandomUUID(),
       term: streamPosition.term,
       seq: streamPosition.seq,
       rowVersion: streamPosition.rowVersion,
@@ -1471,7 +1475,7 @@ class PersistedCollectionRuntime<
     streamPosition: { term: number; seq: number; rowVersion: number },
   ): PersistedTx {
     return {
-      txId: crypto.randomUUID(),
+      txId: safeRandomUUID(),
       term: streamPosition.term,
       seq: streamPosition.seq,
       rowVersion: streamPosition.rowVersion,
@@ -2607,7 +2611,7 @@ export function persistedCollectionOptions<
 
     const { schemaVersion, ...syncOptions } = options
     const collectionId =
-      syncOptions.id ?? `persisted-collection:${crypto.randomUUID()}`
+      syncOptions.id ?? `persisted-collection:${safeRandomUUID()}`
     const persistence = resolvePersistenceForCollection(
       syncOptions.persistence,
       {
@@ -2635,7 +2639,7 @@ export function persistedCollectionOptions<
 
   const { schemaVersion, ...localOnlyOptions } = options
   const collectionId =
-    localOnlyOptions.id ?? `persisted-collection:${crypto.randomUUID()}`
+    localOnlyOptions.id ?? `persisted-collection:${safeRandomUUID()}`
   const persistence = resolvePersistenceForCollection(
     localOnlyOptions.persistence,
     {

packages/db/src/collection/index.ts

@@ -1,3 +1,4 @@
+import { safeRandomUUID } from '../utils/uuid'
 import {
   CollectionConfigurationError,
   CollectionRequiresConfigError,
@@ -329,7 +330,7 @@ export class CollectionImpl<
     if (config.id) {
       this.id = config.id
     } else {
-      this.id = crypto.randomUUID()
+      this.id = safeRandomUUID()
     }
 
     // Set default values for optional config properties

packages/db/src/collection/mutations.ts

@@ -1,4 +1,5 @@
 import { withArrayChangeTracking, withChangeTracking } from '../proxy'
+import { safeRandomUUID } from '../utils/uuid'
 import { createTransaction, getActiveTransaction } from '../transactions'
 import {
   DeleteKeyNotFoundError,
@@ -193,7 +194,7 @@ export class CollectionMutationsManager<
       const globalKey = this.generateGlobalKey(key, item)
 
       const mutation: PendingMutation<TOutput, `insert`> = {
-        mutationId: crypto.randomUUID(),
+        mutationId: safeRandomUUID(),
         original: {},
         modified: validatedData,
         // Pick the values from validatedData based on what's passed in - this is for cases
@@ -366,7 +367,7 @@ export class CollectionMutationsManager<
         const globalKey = this.generateGlobalKey(modifiedItemId, modifiedItem)
 
         return {
-          mutationId: crypto.randomUUID(),
+          mutationId: safeRandomUUID(),
           original: originalItem,
           modified: modifiedItem,
           // Pick the values from modifiedItem based on what's passed in - this is for cases
@@ -497,7 +498,7 @@ export class CollectionMutationsManager<
         `delete`,
         CollectionImpl<TOutput, TKey, TUtils, TSchema, TInput>
       > = {
-        mutationId: crypto.randomUUID(),
+        mutationId: safeRandomUUID(),
         original: this.state.get(key)!,
         modified: this.state.get(key)!,
         changes: this.state.get(key)!,

packages/db/src/index.ts

@@ -80,6 +80,9 @@ export {
   type EffectQueryInput,
 } from './query/effect.js'
 
+// UUID helper (safe in non-secure browser contexts, see #1541)
+export { safeRandomUUID } from './utils/uuid.js'
+
 // Re-export some stuff explicitly to ensure the type & value is exported
 export type { Collection } from './collection/index.js'
 export { IR }

packages/db/src/local-only.ts

@@ -1,3 +1,4 @@
+import { safeRandomUUID } from './utils/uuid'
 import type {
   BaseCollectionConfig,
   CollectionConfig,
@@ -182,7 +183,7 @@ export function localOnlyCollectionOptions<
   const { initialData, onInsert, onUpdate, onDelete, id, ...restConfig } =
     config
 
-  const collectionId = id ?? crypto.randomUUID()
+  const collectionId = id ?? safeRandomUUID()
 
   // Create the sync configuration with transaction confirmation capability
   const syncResult = createLocalOnlySync<T, TKey>(initialData)

packages/db/src/local-storage.ts

@@ -1,3 +1,4 @@
+import { safeRandomUUID } from './utils/uuid'
 import {
   InvalidStorageDataFormatError,
   InvalidStorageObjectFormatError,
@@ -149,7 +150,7 @@ function validateJsonSerializable(
  * @returns A unique identifier string for tracking data versions
  */
 function generateUuid(): string {
-  return crypto.randomUUID()
+  return safeRandomUUID()
 }
 
 /**

packages/db/src/transactions.ts

@@ -1,4 +1,5 @@
 import { createDeferred } from './deferred'
+import { safeRandomUUID } from './utils/uuid'
 import './duplicate-instance-check'
 import {
   MissingMutationFunctionError,
@@ -224,7 +225,7 @@ class Transaction<T extends object = Record<string, unknown>> {
     if (typeof config.mutationFn === `undefined`) {
       throw new MissingMutationFunctionError()
     }
-    this.id = config.id ?? crypto.randomUUID()
+    this.id = config.id ?? safeRandomUUID()
     this.mutationFn = config.mutationFn
     this.state = `pending`
     this.mutations = []