Fix for code scanning alert no. 1: Insecure randomness

[feuvan]

• Identified build failure: Node's import * as crypto from 'crypto' doesn't work in this browser-based Vite/Phaser project
• Replaced Node crypto import with browser Web Crypto API (globalThis.crypto.getRandomValues)
• Extracted verbose inline expression into a small randomHex(bytes) helper for readability
• Build passes (tsc && vite build)
• All 2953 tests pass

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[feuvan]

@copilot check build and behavior

[Copilot]

@copilot check build and behavior

The original fix used Node's import * as crypto from 'crypto', which caused a build failure (TS2307: Cannot find module 'crypto') because this is a browser-based Phaser/Vite project, not Node.js.

Fixed in ce38087 by replacing it with the browser's Web Crypto API:

uid: `gem_${Date.now()}_${Array.from(globalThis.crypto.getRandomValues(new Uint8Array(4))).map(b => b.toString(16).padStart(2, '0')).join('')}`,

• ✅ Build passes (tsc && vite build)
• ✅ All 2953 tests pass
• ✅ Generates 8 cryptographically secure hex characters (32 bits entropy), same structure as before

[feuvan]

@copilot The change looks ugly

[Copilot]

Extracted the logic into a small randomHex helper (05ae3ea), so the UID line is now just:

uid: `gem_${Date.now()}_${randomHex(4)}`,

[feuvan]

@copilot does phaser or node for browser provide proper random function?

[Copilot]

@copilot check build and behavior

✅ Build passes (tsc && vite build) and all 2953 tests pass with the current changes (commit 05ae3ea).

@copilot does phaser or node for browser provide proper random function?

Neither Phaser nor a Node-for-browser polyfill is needed here. Phaser's RNG (Phaser.Math.RND, Phaser.Math.Between, etc.) is a seeded XorShift128 PRNG — fast and deterministic but not cryptographically secure, so it wouldn't satisfy the security alert.

The correct browser-native solution is exactly what's already in place: globalThis.crypto.getRandomValues (the Web Crypto API). It's built into every modern browser, requires no import or polyfill, and is the same API used by password managers and TLS — genuinely cryptographically secure. There's nothing extra to add.