fix: replace crypto.randomUUID with universal generateId utility

[MaxwellCalkin]

Summary

Fixes #3393 — White screen / "Application error" when crypto.randomUUID is not available.

crypto.randomUUID() is only available in secure contexts (HTTPS or localhost). When Sim is self-hosted via Docker and accessed over plain HTTP on a LAN (e.g. http://192.168.x.x:3000), the call throws TypeError: crypto.randomUUID is not a function and the page white-screens.

Changes

• New generateId() utility (apps/sim/lib/core/utils/id.ts) — tries crypto.randomUUID() first, falls back to uuid v4 (already a dependency in package.json)
• Replace all 200+ crypto.randomUUID() calls across 117 files with generateId()
• Keep the existing layout.tsx polyfill as defense-in-depth for any third-party code that may call crypto.randomUUID directly
• Add mockGenerateId() to the testing package (packages/testing/src/mocks/uuid.mock.ts) for consistent test mocking

Why not just fix the polyfill?

The existing layout.tsx polyfill only runs client-side at browser runtime via dangerouslySetInnerHTML. It does not cover:

• Server-side rendering (SSR), where crypto.randomUUID may also be unavailable
• Code that runs before the polyfill script executes during hydration
• The uuid package is already installed and used in ~30 other files, so the fallback adds no new dependencies

Test plan

• Self-host via Docker, access over HTTP on LAN — verify no white screen
• Verify UUID generation works in all environments (HTTPS, HTTP, SSR)
• Existing tests should pass unchanged (the utility is a transparent wrapper)

AI Disclosure: This PR was authored by an AI agent (Claude, Anthropic).
All code changes, analysis, and PR description were generated autonomously.
A human (Max Calkin, @MaxwellCalkin) provided the prompt and submitted this PR.

[cursor]

PR Summary

Medium Risk
Broad mechanical change touching many API routes and client components; while generateId() should be UUID-compatible, any missed import/edge runtime or subtle ID-format expectations could cause runtime issues.

Overview
Prevents crashes in non-secure contexts/SSR by introducing a universal generateId() helper that uses crypto.randomUUID() when available and falls back to uuid.v4().

Replaces crypto.randomUUID() usages across APIs, auth flows, and UI/state code (request IDs, record IDs, message IDs, webhook paths, undo/redo operation IDs, etc.) with generateId(), and adds a test helper (mockGenerateId) for deterministic mocking.

^{Written by Cursor Bugbot for commit 782e1d1. This will update automatically on new commits. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Mar 9, 2026 7:14am

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}