session/id

String -- a newly allocated, owned 64-character lowercase hex string. The ownership is in the type: release it (or hand it to a consumer that takes ownership) when done. Session IDs are long-lived (store key, cookie value, per-request state), so owning is the right default -- the previous `cstr` return advertised a bare pointer with a "caller frees" comment. On the (vanishingly unlikely) event that every randomness source fails, the function aborts rather than emit a predictable ID -- a guessable session ID is a security hole, so failing closed is the safe choice.

(let [id (session-id-new)] ...)  ;; => owned String "9f1c...". 64 hex chars