From 60665fea33cc2d1402e086f59130c85cf3037edf Mon Sep 17 00:00:00 2001
From: TeoSlayer <teodor@vulturelabs.io>
Date: Mon, 22 Jun 2026 17:36:35 +0300
Subject: [PATCH] Generate message IDs with CSPRNG instead of Date.now+random

---
 plugin/src/wire.ts | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/plugin/src/wire.ts b/plugin/src/wire.ts
index 1c49182..66d4e5e 100644
--- a/plugin/src/wire.ts
+++ b/plugin/src/wire.ts
@@ -5,6 +5,8 @@
 // fragmentation. If text exceeds that, the sender splits into N envelopes
 // sharing the same `id` and assembles via (`seq`, `total`).
 
+import { randomUUID } from "node:crypto";
+
 export const WIRE_VERSION = 1 as const;
 
 /** Maximum bytes for a single envelope's JSON encoding. */
@@ -202,13 +204,9 @@ export async function verifyEnvelope(env: Envelope, secret: string): Promise<boo
   return timingSafeEqual(providedBuf, expected);
 }
 
-/** Generate a short, monotonically-tending message id (24 base36 chars). */
+/** Generate a cryptographically-random, collision-resistant message id. */
 export function newId(): string {
-  const t = Date.now().toString(36).padStart(9, "0");
-  const r = Math.floor(Math.random() * 36 ** 12)
-    .toString(36)
-    .padStart(12, "0");
-  return `${t}${r}`;
+  return randomUUID();
 }
 
 /**