/**
 * A client's session id. Opaque on purpose: it is a bearer token, and the only
 * thing a client should ever do with it is send it back on reconnect.
 *
 * It used to be `++lastId` — 1, 2, 3 — while the type claimed to be a string
 * literal. That made every session trivially guessable, and `SessionServer`
 * handed a session to whoever named its id. It is now 122 bits from the platform
 * CSPRNG.
 */
export type ClientId = string & { readonly __clientId: unique symbol };

/**
 * `crypto.randomUUID` is global on every runtime this package targets: Node 19+,
 * Bun, Deno and Cloudflare Workers. It is only ever called server-side, so the
 * browsers' secure-context requirement does not come into it.
 */
export function createClientId(): ClientId {
  return crypto.randomUUID() as ClientId;
}