import (
    "crypto/rand"
    "encoding/binary"
)

func SecureShuffleDeck(d *Deck) error {
    n := len(*d)
    bytes := make([]byte, n*8)
    // OS CSPRNG entropy — same primitives behind TLS.
    if _, err := rand.Read(bytes); err != nil { return err }

    for i := n - 1; i > 0; i-- {
        // Fisher-Yates: uniform over the remaining range.
        j := int(binary.BigEndian.Uint64(bytes[(n-1-i)*8:]) % uint64(i+1))
        (*d)[i], (*d)[j] = (*d)[j], (*d)[i]
    }
    return nil
}