fix(data): stop the field dialog crashing outside a secure context

[lovepixel-git]

Fixes #319.

Root cause

crypto.randomUUID() is only defined when window.isSecureContext is true. An admin reached over plain HTTP on a LAN address or a bare hostname is not a secure context, so the function is simply absent and makeOption() throws TypeError: crypto.randomUUID is not a function, crashing the page.

localhost and 127.0.0.1 are treated as secure contexts regardless of scheme, which is why this never shows up in local development and only surfaced on a Docker Compose install reached over the network.

Probed one dev server across three origins:

origin	isSecureContext	typeof crypto.randomUUID
http://localhost:3001	true	function
http://127.0.0.1:3001	true	function
http://192.168.7.112:3001	false	undefined

Change

Two browser call sites reached crypto.randomUUID() directly:

• makeOption() in src/admin/pages/data/components/NewFieldDialog/newFieldDialogModel.ts, the crash in [Bug]: Can't add field for Custom Data Table #319, on the admin/data → add table → add field path
• handleAdd() in src/admin/pages/site/panels/FrameworkScalePanel/ClassGeneratorList.tsx, the same bug, not yet reported

Both move to nanoid. That is not a new dependency or a new convention: nanoid is already the id primitive in 37 modules, including src/admin/pages/data/utils/fieldDefaults.ts and src/core/framework/scaleGroups.ts, which sit in these same two feature areas. The two crypto.randomUUID() calls were the anomaly.

I fixed the second site in the same change because it is one root cause rather than two problems. Happy to split it out if you would rather keep the PR to the reported path.

Persistence

DraftOption.id does reach storage, via DataSelectOption on select and multiSelect fields, so the id format matters. SelectOptionSchema.id is Type.String() with no format constraint, so nanoid ids validate, ids already persisted in UUID shape stay valid, and no migration is required.

Tests

New: src/__tests__/data/newFieldDialogModel.test.ts, four cases exercising makeOption() with crypto.randomUUID removed to mirror an insecure context. Covers option creation, id uniqueness across 100 generations, and TypeBox validity of the resulting select options.

Verified failing on main with the exact error from the issue, passing on this branch.

• bun run lint clean
• bun run build clean
• bun test 6534 pass, 1 fail

Unrelated pre-existing failure

That one failure is Bundle size budgets > ContentPage-*.js, at 90043 B against a 90000 B budget, 43 bytes over. It is not from this change. I stashed the fix, rebuilt clean main, and got the byte-identical 90043. It only appears after bun run build, since the budget test reads dist/, so a test run on a fresh clone will not show it. Flagging it rather than folding it in, since it is a separate problem.