v5.0.0: protocol v5 and the browser frontend

Protocol v5 replaces newline lines with bounded [u32 len][text] frames and REQ/RES/EVT envelopes. Requests carry correlation ids and the server replays the last 256 replies per connection, so a gateway retry cannot double-debit and a late reply cannot clobber a newer request. HELLO/PONG carry server time; crash rounds announce started_at and push coalesced 10 Hz ticks. Crash now commits sha256(seed) before a round and reveals the seed when it ends, so clients recompute the crash point.

Adds the webd/ gateway: one blocking thread, one ClientCore and one pinned upstream TLS connection per session, an HttpOnly session cookie, takeover, and a 60-second grace window. The browser sends Command JSON and renders View JSON; it never speaks the game protocol or stores credentials.

Adds the vanilla TypeScript browser app at /play/ (login, lobby, all four games, history, notices, crash verification), the nginx /play and /ws routes, and the headless DOM smoke test. webd and the app stay out of the TUI/GUI/server build graph.

The client/server version moves to 5.0.0 in lockstep; v4 peers are refused at HELLO.

1 files changed, 11 insertions, 8 deletions

diff --git a/gui/src/app.rs b/gui/src/app.rs
index af64e5e..df8fec3 100644
--- a/gui/src/app.rs
+++ b/gui/src/app.rs
@@ -16,6 +16,7 @@ use zagan_bet::client::database;
 use zagan_bet::client::paths;
 use zagan_bet::client::view::{Command, LobbyView, View};
 use zagan_bet::history::PlayRecord;
+use zagan_bet::protocol::Packet;
 use zagan_bet::version::{VERSION, is_newer};
 
 use crate::net::{Command as NetCommand, Connected, Event, Failure, Network};
@@ -280,8 +281,8 @@ impl ZaganApp {
                         }
                     }
                 }
-                Effect::SendLine(line) => {
-                    self.net.send(NetCommand::Send(line));
+                Effect::SendRequest { id, payload } => {
+                    self.net.send(NetCommand::Send { id, payload });
                     self.awaiting = Some(Instant::now());
                 }
                 Effect::Disconnect => {
@@ -355,17 +356,18 @@ impl ZaganApp {
                     failure,
                     message,
                 } => self.failed(addr, failure, message),
-                Event::Line(line) => {
-                    if self.core.is_async(&line) {
-                        if let Some(effects) = self.core.handle_async_line(&line) {
+                Event::Packet(packet) => match packet {
+                    Packet::Event { body, .. } => {
+                        if let Some(effects) = self.core.handle_async_line(&body) {
                             self.apply(ctx, effects);
                         }
-                    } else {
+                    }
+                    Packet::Reply { id, body } => {
                         self.awaiting = None;
-                        let effects = self.core.handle_reply(&line);
+                        let effects = self.core.handle_reply_id(id, &body);
                         self.apply(ctx, effects);
                     }
-                }
+                },
                 Event::Closed => {
                     self.session = None;
                     self.awaiting = None;
@@ -384,6 +386,7 @@ impl ZaganApp {
         self.core
             .set_host_info(Some(connected.addr.clone()), connected.fingerprint.clone());
         self.core.set_logged_in(connected.user.clone());
+        self.core.set_server_time(connected.server_time);
         self.login.error = connected.auth_error.clone();
         self.login.user = connected.user.clone().unwrap_or_default();