fix(gateway): preserve AsyncEventQueue error state & use crypto random for client IDs

[kevinchennewbee]

Summary

This PR fixes two bugs in src/web/client/GatewayBrowserClient.ts:

1. AsyncEventQueue silently swallows errors after first read (Closes #128)

Root cause: In next(), the error field was cleared (this.error = undefined) immediately after the first consumer read it. Any subsequent retry or reconnection attempt would receive { done: true } instead of the original error, making the failure invisible.

Fix: The error is no longer cleared on read — it is preserved so that all consumers (including retries) see the rejection. The queue's close() and throw() methods still function as before.

2. Non-cryptographic Math.random() used for security-sensitive client IDs (Closes #136)

Root cause: The fallback ID generation used Math.random(), which is predictable and unsuitable for tokens that may be used in authentication or session identification contexts.

Fix: Replaced with crypto.getRandomValues() (available in all modern browsers and Node.js 19+). A 16-byte hex string is generated from cryptographically secure random bytes.

Changes

• GatewayBrowserClient.ts — AsyncEventQueue.next(): removed this.error = undefined
• GatewayBrowserClient.ts — generateClientId(): replaced Math.random() with crypto.getRandomValues()

Test plan

• Verify AsyncEventQueue error is visible to multiple consumers (read error twice, both should reject)
• Verify generateClientId() produces hex-suffixed IDs in browser and Node.js environments
• Confirm no TypeScript errors: npx tsc --noEmit -p tsconfig.json

🤖 Generated with [Qoder][https://qoder.com]

[kevinchennewbee]

Hi! Two small but impactful fixes in GatewayBrowserClient.ts:

AsyncEventQueue error swallowing (#128): The next() method was clearing this.error after the first read, so any retry or reconnection logic would see { done: true } instead of the actual error. This made WebSocket stream failures silently disappear. The fix preserves the error so all consumers (including retries) see the rejection.

Non-crypto random for client IDs (#136): generateClientId() fell back to Math.random() which is predictable and unsuitable for session tokens. Replaced with crypto.getRandomValues() — available in all modern runtimes — producing a 16-byte hex string from secure random bytes.

Both changes are localized and don't alter the public API. Let me know if anything needs tweaking!