From 6871aa223653e030c8720afc2daadb478e82447e Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Thu, 22 Oct 2026 19:19:19 -0400
Subject: [PATCH] security: check crypto.randomUUID availability in canMove

---
 apps/effectcraft-web/js/host.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/apps/effectcraft-web/js/host.js b/apps/effectcraft-web/js/host.js
index 658a5199..12cb90bf 100644
--- a/apps/effectcraft-web/js/host.js
+++ b/apps/effectcraft-web/js/host.js
@@ -494,7 +494,11 @@ export async function cacheRead(name) {
 /// resolves with its size.
 export async function cacheWrite(fullName, bytes) {
   const [dir, name] = await entryDir(fullName);
-  const canMove = typeof FileSystemHandle !== "undefined" && "move" in FileSystemHandle.prototype;
+  const canMove =
+    typeof FileSystemHandle !== "undefined" &&
+    "move" in FileSystemHandle.prototype &&
+    typeof crypto !== "undefined" &&
+    typeof crypto.randomUUID === "function";
   const tmp = canMove ? `${name}.tmp.${crypto.randomUUID()}` : name;
   const fh = await dir.getFileHandle(tmp, { create: true });
   if (fh.createSyncAccessHandle) {