2 files changed, 93 insertions, 28 deletions

diff --git a/web/README.md b/web/README.md
index e79abd4..bd87e11 100644
--- a/web/README.md
+++ b/web/README.md
@@ -1,15 +1,15 @@
 # Download page
 
-`index.php` scans `bin/client` and `bin/server` on every request and renders
-whatever builds it finds, with version, size and SHA-256. No database, no
-JavaScript, no CSS, no dependencies. The page is plain browser defaults:
-black text, blue links, monospace checksums. PHP 8.0+.
+`index.php` scans `bin/gui`, `bin/client` and `bin/server` on every request and
+renders whatever builds it finds, with version, size and SHA-256. No database, no JavaScript, no CSS, no dependencies. The page is plain
+browser defaults: black text, blue links, monospace checksums. PHP 8.0+.
 
 ## Layout
 
 ```
 web/
   index.php
+  bin/gui/       served at /bin/gui/... (app and installers)
   bin/client/    served at /bin/client/...
   bin/server/    served at /bin/server/...
 ```
@@ -22,13 +22,22 @@ The page only lists files that match the release pattern; anything else in
 those directories is ignored.
 
 ```
-zagan-bet-client-<version>-<platform>-<arch>[.exe]
-zagan-bet-server-<version>-<platform>-<arch>
+bin/gui/zagan-bet-gui-<version>-<platform>-<arch>[.exe]
+bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.sh
+bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
+bin/client/zagan-bet-client-<version>-<platform>-<arch>[.exe]
+bin/server/zagan-bet-server-<version>-<platform>-<arch>[.exe]
 ```
 
 `<version>` is `MAJOR.MINOR.PATCH`, `<platform>` is `linux`, `windows` or
 `macos`, `<arch>` is `x86_64`, `i686` or `aarch64`.
 
+The installers are generated next to their app. They embed the app's SHA-256,
+check the file (or download it) and install it for the current user: Linux
+writes `~/.local/bin/zagan-bet-gui` plus a `.desktop` launcher, Windows writes
+`%LOCALAPPDATA%\Programs\Zagan-Bet` plus a Start-menu shortcut. The source
+archives satisfy the GPL's corresponding-source requirement.
+
 ## Publishing a build
 
 From the repository root:
@@ -37,15 +46,21 @@ From the repository root:
 ./scripts/publish.sh
 ```
 
-It reads the version from `Cargo.toml`, builds all four artifacts and installs
-them under `web/bin` with the names above. Override the destination with
-`DEST=/srv/www/bin ./scripts/publish.sh`.
+It reads the version from `Cargo.toml`, builds every artifact and installs
+them under `web/bin` with the names above. The GUI is built with the
+workspace's `gui-release` profile (LTO, stripped) and the installers are
+rendered with Python 3 and the published SHA-256. Run it from a clean tree so
+the release commit is the source the page links to. Override the destination
+with `DEST=/srv/www/bin ./scripts/publish.sh`, and the download origin baked
+into the installers with `URL_BASE=https://staging.example/ ./scripts/publish.sh`.
+`ALLOW_DIRTY=1` skips the clean-tree check for a preview.
 
 Builds are per target triple, so these must be installed:
 `x86_64-unknown-linux-gnu`, `i686-unknown-linux-gnu` and
 `x86_64-pc-windows-gnu`, plus the mingw linker for the Windows build. Client
 builds always pass `--no-default-features`, which drops the server's OpenSSL
-dependency; the client is rustls-only.
+dependency; the client is rustls-only. The GUI needs Python 3 at publish time
+for the installer templates in `scripts/installers/`.
 
 Cargo itself cannot produce these names: it always writes
 `target/<triple>/release/<bin>`. The script renames after each build.
@@ -100,8 +115,9 @@ Then open <http://127.0.0.1:8899/>.
 ```
 
 `deploy.sh` rsyncs `web/` with `--delay-updates`, so a visitor never sees a
-half-written binary, then fetches the live page and every artifact it lists and
-compares the downloaded bytes with the local SHA-256. `--verify-only` skips the
+half-written binary, then fetches the live page and every artifact it lists —
+GUI apps, installers, terminal clients and servers — and compares the
+downloaded bytes with the local SHA-256. `--verify-only` skips the
 upload and only checks the live site. Old versions are left on the server;
 prune them by hand.
 
@@ -124,3 +140,6 @@ php -S 127.0.0.1:8899 -t /srv/staging
   stay downloadable until you remove them from `bin/`.
 - The checksum block is in `sha256sum` format, so visitors can save it as
   `SHA256SUMS` and run `sha256sum -c SHA256SUMS`.
+- The page links <https://git.2137697.xyz/zagan-bet.git> for the GPL
+  corresponding source; publish only from a committed release so that link
+  contains the exact source.
diff --git a/web/index.php b/web/index.php
index 7ed79da..77edf95 100644
--- a/web/index.php
+++ b/web/index.php
@@ -4,20 +4,23 @@ declare(strict_types=1);
 /**
  * zagan.bet download page.
  *
- * Scans ./bin/client and ./bin/server and renders every build it finds, with
- * its version, size and SHA-256. No database, no JavaScript, no dependencies.
+ * Scans ./bin/{gui,client,server} and renders every build it finds, with its
+ * version, size and SHA-256. The GPL source link points at the public git
+ * repository. No database, no JavaScript, no dependencies.
  *
  * Expected file names (anything else is ignored):
  *
- *   bin/client/zagan-bet-client-<version>-<platform>-<arch>
- *   bin/client/zagan-bet-client-<version>-<platform>-<arch>.exe
- *   bin/server/zagan-bet-server-<version>-<platform>-<arch>
+ *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>[.exe]
+ *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.sh
+ *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
+ *   bin/client/zagan-bet-client-<version>-<platform>-<arch>[.exe]
+ *   bin/server/zagan-bet-server-<version>-<platform>-<arch>[.exe]
  *
  * <version> is MAJOR.MINOR.PATCH, <platform> is linux|windows|macos and
  * <arch> is x86_64|i686|aarch64. Example:
  *
- *   bin/client/zagan-bet-client-3.1.1-linux-x86_64
- *   bin/server/zagan-bet-server-3.1.1-linux-x86_64
+ *   bin/gui/zagan-bet-gui-4.3.0-linux-x86_64
+ *   bin/client/zagan-bet-client-4.3.0-linux-x86_64
  *
  * SHA-256 values are cached in a JSON file keyed on size and mtime, so a file
  * is only re-read when it changes. The cache lives in the system temp
@@ -26,6 +29,10 @@ declare(strict_types=1);
  */
 
 const KINDS = [
+    'gui' => [
+        'title' => 'Desktop app',
+        'hint' => 'Windows 10 or newer, or a Linux desktop. No terminal needed.',
+    ],
     'client' => [
         'title' => 'Client',
         'hint' => 'Needs a terminal of at least 80×24 cells.',
@@ -163,7 +170,7 @@ function read_release(
     bool &$dirty
 ): ?array {
     $pattern = '/^zagan-bet-' . preg_quote($kind, '/')
-        . '-v?(\d+\.\d+\.\d+)-([a-z]+)-([a-z0-9_]+)(\.exe)?$/i';
+        . '-v?(\d+\.\d+\.\d+)-([a-z]+)-([a-z0-9_]+)(-install\.sh|-install\.ps1|\.exe)?$/i';
     if (preg_match($pattern, $entry, $matches) !== 1) {
         return null;
     }
@@ -192,10 +199,14 @@ function read_release(
         return null;
     }
 
+    $suffix = strtolower($matches[4] ?? '');
+    $variant = str_starts_with($suffix, '-install.') ? 'installer' : 'binary';
+
     return [
         'version' => $matches[1],
         'platform' => strtolower($matches[2]),
         'arch' => strtolower($matches[3]),
+        'variant' => $variant,
         'file' => $entry,
         'size' => $size,
         'mtime' => $mtime,
@@ -257,6 +268,10 @@ foreach (KINDS as $kind => $meta) {
         if ($byArch !== 0) {
             return $byArch;
         }
+        $byVariant = ($a['variant'] === 'installer' ? 1 : 0) <=> ($b['variant'] === 'installer' ? 1 : 0);
+        if ($byVariant !== 0) {
+            return $byVariant;
+        }
         return strcmp($a['file'], $b['file']);
     });
 
@@ -280,18 +295,41 @@ if ($cacheDirty) {
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>żagań.bet</title>
-<meta name="description" content="Official zagan.bet client and server downloads.">
+<meta name="description" content="Official zagan.bet desktop app, terminal client and server downloads.">
 <meta http-equiv="Content-Security-Policy" content="default-src 'none'">
 </head>
 <body>
 
 <h1>żagań.bet</h1>
-<p>Official client and server builds.</p>
+<p>Official desktop app, terminal client and server builds.</p>
 <?php if ($newest > 0): ?>
 <p>Builds published <?= e(gmdate('j M Y H:i', $newest)) ?> UTC.</p>
 <?php endif; ?>
 
-<h2>Client</h2>
+<h2>Desktop app</h2>
+<p>Windows 10 or newer, or a Linux desktop. No terminal needed.</p>
+<?php $guiBinaries = array_values(array_filter($releases['gui'], static fn (array $r): bool => $r['variant'] === 'binary')); ?>
+<?php $guiInstallers = array_values(array_filter($releases['gui'], static fn (array $r): bool => $r['variant'] === 'installer')); ?>
+<?php if ($guiBinaries === []): ?>
+<p>Nothing published yet.</p>
+<?php else: ?>
+<ul>
+<?php foreach ($guiBinaries as $release): ?>
+<li><a href="<?= e($release['href']) ?>" download><?= e(PLATFORMS[$release['platform']] ?? ucfirst($release['platform'])) ?> <?= e($release['arch']) ?><?php if (isset(ARCHES[$release['arch']])): ?> (<?= e(ARCHES[$release['arch']]) ?>)<?php endif; ?> v<?= e($release['version']) ?> — <?= e(human_size($release['size'])) ?></a></li>
+<?php endforeach; ?>
+</ul>
+<?php endif; ?>
+<?php if ($guiInstallers !== []): ?>
+<h3>Installers</h3>
+<p>The installer checks the download, installs Zagan-Bet for your user and adds it to your programs. Run it next to a downloaded app, or on its own to fetch one.</p>
+<ul>
+<?php foreach ($guiInstallers as $release): ?>
+<li><a href="<?= e($release['href']) ?>" download><?= e(PLATFORMS[$release['platform']] ?? ucfirst($release['platform'])) ?> <?= e($release['arch']) ?> installer (<?= str_ends_with($release['file'], '.ps1') ? 'PowerShell' : 'bash' ?>) v<?= e($release['version']) ?> — <?= e(human_size($release['size'])) ?></a></li>
+<?php endforeach; ?>
+</ul>
+<?php endif; ?>
+
+<h2>Terminal client</h2>
 <p>Needs a terminal of at least 80×24 cells.</p>
 <?php if ($releases['client'] === []): ?>
 <p>Nothing published yet.</p>
@@ -315,7 +353,7 @@ if ($cacheDirty) {
 </ul>
 <?php endif; ?>
 
-<?php $all = array_merge($releases['client'], $releases['server']); ?>
+<?php $all = array_merge($releases['gui'], $releases['client'], $releases['server']); ?>
 <?php if ($all !== []): ?>
 <h2>SHA-256</h2>
 <p>On Linux use <code>sha256sum &lt;file&gt;</code>. On Windows use <code>Get-FileHash &lt;file&gt;</code>.</p>
@@ -329,8 +367,17 @@ echo e($sums);
 ?></pre>
 <?php endif; ?>
 
+<h2>Source</h2>
+<p>Zagan-Bet is free software under the GNU GPL v3 or later. The source for these builds is at <a href="https://git.2137697.xyz/zagan-bet.git">https://git.2137697.xyz/zagan-bet.git</a>.</p>
+
 <h2>Running it</h2>
-<p>Client:</p>
+<p>Desktop app on Linux:</p>
+<pre><code>chmod +x zagan-bet-gui-*-linux-x86_64-install.sh
+./zagan-bet-gui-*-linux-x86_64-install.sh</code></pre>
+<p>Desktop app on Windows (PowerShell):</p>
+<pre><code>powershell -ExecutionPolicy Bypass -File .\zagan-bet-gui-*-windows-x86_64-install.ps1</code></pre>
+<p>The installers verify the SHA-256 before installing. You can also run the downloaded app directly.</p>
+<p>Terminal client:</p>
 <pre><code>chmod +x &lt;downloaded-client&gt;
 ./&lt;downloaded-client&gt;</code></pre>
 <p>Server, first run creates <code>identity.p12</code>, <code>key.pem</code> and <code>cert.pem</code>:</p>
@@ -338,8 +385,7 @@ echo e($sums);
 ./&lt;downloaded-server&gt; --init
 ./&lt;downloaded-server&gt; -i 0.0.0.0 -p 11525</code></pre>
 
-<p>Windows: run the <code>.exe</code> from Windows Terminal or another real terminal.</p>
-
-<p>When lost, execute <code>help</code> command inside zagan.bet client. Server binary supports <code>--help</code> flag</p>
+<p>Terminal client on Windows: run the <code>.exe</code> from Windows Terminal or another real terminal.</p>
+<p>Run <code>help</code> inside the terminal client; the server binary supports <code>--help</code>.</p>
 </body>
 </html>