5 files changed, 271 insertions, 6 deletions

diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index 99129ad..b18d462 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Upload web/ and verify every published artifact over the public URL.
+# Upload web/ and verify every published artifact (GUI app and installers,
+# terminal client and server) over the public URL.
 #
 # Usage:
 #   ./scripts/deploy.sh user@host:/srv/zagan.bet https://zagan.bet/
@@ -50,7 +51,11 @@ done
 [ -f web/index.php ] || die "web/index.php is missing"
 
 shopt -s nullglob
-artifacts=(web/bin/client/zagan-bet-* web/bin/server/zagan-bet-*)
+artifacts=(
+  web/bin/gui/zagan-bet-*
+  web/bin/client/zagan-bet-*
+  web/bin/server/zagan-bet-*
+)
 shopt -u nullglob
 [ ${#artifacts[@]} -gt 0 ] || die "no artifacts in web/bin; run scripts/publish.sh first"
 
diff --git a/scripts/installers/linux.sh.in b/scripts/installers/linux.sh.in
new file mode 100644
index 0000000..5b53c02
--- /dev/null
+++ b/scripts/installers/linux.sh.in
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# Zagan-Bet desktop installer for Linux.
+#
+# Verifies the app against its published SHA-256, installs it for the current
+# user and adds a launcher. Put the downloaded app next to this script, or run
+# the script on its own and it will fetch the matching binary.
+set -euo pipefail
+
+VERSION="__VERSION__"
+BINARY="__BINARY__"
+SHA256="__SHA256__"
+URL="__URL__"
+
+say() { printf '%s\n' "$*"; }
+die() { printf 'install: %s\n' "$*" >&2; exit 1; }
+
+command -v sha256sum >/dev/null 2>&1 || die "sha256sum is required"
+
+here=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+source_file=""
+for candidate in "$here/$BINARY" "./$BINARY" "$HOME/Downloads/$BINARY"; do
+  if [ -f "$candidate" ]; then
+    source_file=$candidate
+    break
+  fi
+done
+
+cleanup=""
+if [ -z "$source_file" ]; then
+  command -v curl >/dev/null 2>&1 || die "put $BINARY next to this installer, or install curl"
+  cleanup=$(mktemp) || die "cannot create a temporary file"
+  say "Downloading $BINARY..."
+  curl -fsSL --max-time 300 "$URL" -o "$cleanup" || die "download failed"
+  source_file=$cleanup
+fi
+trap 'if [ -n "$cleanup" ]; then rm -f "$cleanup"; fi' EXIT
+
+actual=$(sha256sum "$source_file" | awk '{print $1}')
+[ "$actual" = "$SHA256" ] || die "checksum mismatch: expected $SHA256, got $actual"
+
+bin_dir="${XDG_BIN_HOME:-$HOME/.local/bin}"
+data_dir="${XDG_DATA_HOME:-$HOME/.local/share}"
+app="$bin_dir/zagan-bet-gui"
+desktop_dir="$data_dir/applications"
+icon_dir="$data_dir/icons/hicolor/scalable/apps"
+
+mkdir -p "$bin_dir" "$desktop_dir" "$icon_dir"
+install -m 0755 "$source_file" "$app"
+
+cat > "$icon_dir/zagan-bet.svg" <<'ICON'
+__ICON__
+ICON
+
+cat > "$desktop_dir/zagan-bet.desktop" <<DESKTOP
+[Desktop Entry]
+Type=Application
+Name=Zagan-Bet
+Comment=Slots, roulette, blackjack and crash
+Exec=$app
+Icon=zagan-bet
+Terminal=false
+Categories=Game;
+DESKTOP
+chmod 0644 "$desktop_dir/zagan-bet.desktop" "$icon_dir/zagan-bet.svg"
+
+if command -v update-desktop-database >/dev/null 2>&1; then
+  update-desktop-database "$desktop_dir" >/dev/null 2>&1 || true
+fi
+if command -v gtk-update-icon-cache >/dev/null 2>&1; then
+  gtk-update-icon-cache -q "$data_dir/icons/hicolor" >/dev/null 2>&1 || true
+fi
+
+say "Installed Zagan-Bet $VERSION to $app"
+say "A launcher was added to your applications menu."
+case ":$PATH:" in
+  *":$bin_dir:"*) ;;
+  *) say "Add $bin_dir to PATH to start it as 'zagan-bet-gui'." ;;
+esac
diff --git a/scripts/installers/windows.ps1.in b/scripts/installers/windows.ps1.in
new file mode 100644
index 0000000..fd2b8b3
--- /dev/null
+++ b/scripts/installers/windows.ps1.in
@@ -0,0 +1,75 @@
+# Zagan-Bet desktop installer for Windows.
+#
+# Verifies the app against its published SHA-256, installs it for the current
+# user and adds a Start-menu shortcut. Put the downloaded app next to this
+# script, or run the script on its own and it will fetch the matching binary.
+#
+# Run it with:
+#   powershell -ExecutionPolicy Bypass -File .\zagan-bet-gui-*-install.ps1
+$ErrorActionPreference = "Stop"
+
+$Version = "__VERSION__"
+$Binary  = "__BINARY__"
+$Sha256  = "__SHA256__"
+$Url     = "__URL__"
+
+function Stop-Install([string]$Message) {
+    Write-Host "install: $Message" -ForegroundColor Red
+    exit 1
+}
+
+$here = Split-Path -Parent $MyInvocation.MyCommand.Path
+$candidates = @(
+    (Join-Path $here $Binary),
+    (Join-Path (Get-Location) $Binary),
+    (Join-Path $env:USERPROFILE "Downloads\$Binary")
+)
+$sourceFile = $null
+foreach ($candidate in $candidates) {
+    if (Test-Path -LiteralPath $candidate) {
+        $sourceFile = $candidate
+        break
+    }
+}
+
+$temporary = $null
+if (-not $sourceFile) {
+    $temporary = Join-Path ([System.IO.Path]::GetTempPath()) $Binary
+    Write-Host "Downloading $Binary..."
+    try {
+        Invoke-WebRequest -Uri $Url -OutFile $temporary -UseBasicParsing
+    } catch {
+        Stop-Install "download failed: $_"
+    }
+    $sourceFile = $temporary
+}
+
+try {
+    $actual = (Get-FileHash -LiteralPath $sourceFile -Algorithm SHA256).Hash.ToLowerInvariant()
+    if ($actual -ne $Sha256.ToLowerInvariant()) {
+        Stop-Install "checksum mismatch: expected $Sha256, got $actual"
+    }
+
+    $installDir = Join-Path $env:LOCALAPPDATA "Programs\Zagan-Bet"
+    New-Item -ItemType Directory -Force -Path $installDir | Out-Null
+    $target = Join-Path $installDir "zagan-bet-gui.exe"
+    Copy-Item -LiteralPath $sourceFile -Destination $target -Force
+
+    $startMenu = Join-Path $env:APPDATA "Microsoft\Windows\Start Menu\Programs"
+    New-Item -ItemType Directory -Force -Path $startMenu | Out-Null
+    $shortcutPath = Join-Path $startMenu "Zagan-Bet.lnk"
+    $shell = New-Object -ComObject WScript.Shell
+    $shortcut = $shell.CreateShortcut($shortcutPath)
+    $shortcut.TargetPath = $target
+    $shortcut.WorkingDirectory = $installDir
+    $shortcut.IconLocation = "$target,0"
+    $shortcut.Description = "Slots, roulette, blackjack and crash"
+    $shortcut.Save()
+
+    Write-Host "Installed Zagan-Bet $Version to $target"
+    Write-Host "A Start-menu shortcut was created."
+} finally {
+    if ($temporary -and (Test-Path -LiteralPath $temporary)) {
+        Remove-Item -LiteralPath $temporary -Force
+    }
+}
diff --git a/scripts/publish.sh b/scripts/publish.sh
index 8240859..3a04631 100755
--- a/scripts/publish.sh
+++ b/scripts/publish.sh
@@ -3,14 +3,22 @@
 # download page expects:
 #
 #   zagan-bet-client-<version>-<platform>-<arch>[.exe]
-#   zagan-bet-server-<version>-<platform>-<arch>
+#   zagan-bet-server-<version>-<platform>-<arch>[.exe]
+#   zagan-bet-gui-<version>-<platform>-<arch>[.exe]
+#   zagan-bet-gui-<version>-<platform>-<arch>-install.sh
+#   zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
 #
-# Cargo always writes target/<triple>/release/<bin>, so the rename happens here
-# after each build. The version comes from Cargo.toml.
+# Cargo always writes target/<triple>/<profile>/<bin>, so the rename happens
+# here after each build. The version comes from Cargo.toml.
+#
+# The GUI uses the workspace's `gui-release` profile (small, stripped, LTO).
+# The public git repository is the GPL source for these binaries, so publish
+# from a clean tree (or set ALLOW_DIRTY=1 for a preview).
 #
 # Usage:
 #   ./scripts/publish.sh
 #   DEST=/srv/www/bin ./scripts/publish.sh
+#   URL_BASE=https://staging.example/ ./scripts/publish.sh
 set -euo pipefail
 
 ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
@@ -23,6 +31,21 @@ if [ -z "${VERSION:-}" ]; then
 fi
 
 DEST=${DEST:-web/bin}
+URL_BASE=${URL_BASE:-https://zagan.2137697.xyz}
+
+if [ "${ALLOW_DIRTY:-0}" != "1" ] && [ -n "$(git status --porcelain)" ]; then
+  echo "the working tree is dirty; commit the release first (or ALLOW_DIRTY=1)" >&2
+  exit 1
+fi
+
+command -v python3 >/dev/null || {
+  echo "python3 is required to render the installers" >&2
+  exit 1
+}
+
+hash_of() {
+  sha256sum "$1" | awk '{print $1}'
+}
 
 publish() {
   local triple=$1 kind=$2 platform=$3 arch=$4
@@ -47,11 +70,46 @@ publish() {
   echo "    $DEST/$kind/$artifact ($(du -h "$DEST/$kind/$artifact" | cut -f1))"
 }
 
+publish_gui() {
+  local triple=$1 platform=$2 arch=$3
+  local ext=""
+  if [ "$platform" = windows ]; then
+    ext=".exe"
+  fi
+
+  local artifact="zagan-bet-gui-$VERSION-$platform-$arch$ext"
+  local source="target/$triple/gui-release/zagan-bet-gui$ext"
+
+  echo "==> $artifact"
+  cargo build -p zagan-bet-gui --profile gui-release --quiet --target "$triple"
+
+  mkdir -p "$DEST/gui"
+  install -m 0755 "$source" "$DEST/gui/$artifact"
+  local sha
+  sha=$(hash_of "$DEST/gui/$artifact")
+  echo "    $DEST/gui/$artifact ($(du -h "$DEST/gui/$artifact" | cut -f1))"
+
+  if [ "$platform" = linux ]; then
+    python3 scripts/render-installer.py \
+      scripts/installers/linux.sh.in \
+      "$DEST/gui/zagan-bet-gui-$VERSION-linux-$arch-install.sh" \
+      "$VERSION" "$artifact" "$sha" "$URL_BASE/bin/gui/$artifact"
+  elif [ "$platform" = windows ]; then
+    python3 scripts/render-installer.py \
+      scripts/installers/windows.ps1.in \
+      "$DEST/gui/zagan-bet-gui-$VERSION-windows-$arch-install.ps1" \
+      "$VERSION" "$artifact" "$sha" "$URL_BASE/bin/gui/$artifact"
+  fi
+}
+
+publish_gui x86_64-unknown-linux-gnu linux x86_64
+publish_gui x86_64-pc-windows-gnu windows x86_64
+
 publish x86_64-unknown-linux-gnu client linux x86_64
 publish i686-unknown-linux-gnu   client linux i686
 publish x86_64-pc-windows-gnu    client windows x86_64
 publish x86_64-unknown-linux-gnu server linux x86_64
-publish x86_64-pc-windows-gnu    server windows x86_64
+publish x86_64-pc-windows-gnu    server windows x86_64
 
 echo
 echo "published $VERSION to $DEST"
diff --git a/scripts/render-installer.py b/scripts/render-installer.py
new file mode 100644
index 0000000..1a00551
--- /dev/null
+++ b/scripts/render-installer.py
@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+"""Fill an installer template with one published artifact's details.
+
+Usage: render-installer.py <template> <output> <version> <binary> <sha256> <url>
+
+The Linux template embeds the application icon so the installer works offline.
+"""
+
+from __future__ import annotations
+
+import pathlib
+import sys
+
+
+def main(argv: list[str]) -> int:
+    if len(argv) != 7:
+        print(
+            "usage: render-installer.py <template> <output> <version> "
+            "<binary> <sha256> <url>",
+            file=sys.stderr,
+        )
+        return 2
+
+    template, output, version, binary, sha256, url = argv[1:]
+    root = pathlib.Path(__file__).resolve().parent.parent
+    icon = (root / "gui" / "assets" / "zagan-bet.svg").read_text()
+
+    text = pathlib.Path(template).read_text()
+    replacements = {
+        "__VERSION__": version,
+        "__BINARY__": binary,
+        "__SHA256__": sha256,
+        "__URL__": url,
+        "__ICON__": icon.rstrip("\n"),
+    }
+    for placeholder, value in replacements.items():
+        text = text.replace(placeholder, value)
+
+    destination = pathlib.Path(output)
+    destination.write_text(text)
+    if destination.suffix == ".sh":
+        destination.chmod(0o755)
+
+    print(f"    {destination} ({destination.stat().st_size} bytes)")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv))