336 Commits

Author	SHA1	Message	Date
Ilia Denisov	471fadc6a4	fix(ui): offline in-game — usable dictionary check + hide (not disable) resign/chat ... Two fixes from contour testing of the offline-in-game UX: - The dictionary word check was unusable offline (Check button disabled) when the panel was reached while already offline: CheckScreen fetched the variant + pinned version over the network in onMount, which fails offline, leaving the default variant so input sanitising stripped every letter. Seed both from the cached game (present once the board has opened) so the input and the on-device dawg fallback work without a round-trip; the network refresh still runs when online and on a cold deep-link. - The resign and chat controls were only functionally disabled (chat) or not gated at all (resign) offline, so they still looked active. Hide both while offline, matching the frozen social controls. Tests: the in-game offline e2e now asserts the drawer action icons are hidden (not disabled); a new e2e guards the offline dictionary flow. Docs updated.	2026-07-14 09:38:42 +02:00
Ilia Denisov	564abdcf88	chore: fix broken telegram links	2026-07-14 09:06:03 +02:00
Ilia Denisov	c522e77599	fix(ui): lazy-load the offline word-check helper to keep it out of the entry bundle ... CheckScreen's static import of dict/check pulled the dawg loader/reader into the app entry bundle, pushing it 0.8 KB over the 130 KB budget (CI bundle-size gate). The dict subsystem is lazy everywhere else, so import localWordCheck dynamically in the offline branch — it loads only when an offline check actually runs. Main entry back to 129.0 KB.	2026-07-14 08:59:41 +02:00
Ilia Denisov	28afcff551	feat(ui): explicit offline state inside an online game (+ offline word check) ... When an online game loses the connection the game screen now says so and freezes instead of silently greying out: a "connection lost" banner appears and the rack, the move controls, the add-friend/block controls and the chat/dictionary entry all disable (a started move stays a draft, committed by the player on reconnect). It is driven off the net-state machine (netState.offline), so it also covers the Telegram/VK mini-apps, where a lost connection was previously mute in-game. If the player is already in the dictionary when the drop happens, the word check falls back to the game's pinned on-device dictionary (exact when that dawg is cached; "unavailable offline" otherwise) and the network-only complaint + external look-up hide. Chat, when already open, keeps its existing read-only degrade (send/nudge disable). New pure helper localWordCheck is unit-tested; the in-game gating gets an e2e.	2026-07-14 08:53:18 +02:00
Ilia Denisov	25381f70a3	fix(net): detect a silently-dead live stream via a heartbeat watchdog ... An idle live stream whose connection dies without an error (airplane mode cutting the radio) left the net-state machine stuck "online": the streaming fetch neither errored nor delivered, no unary call was made, and the OS `navigator` offline hint is unreliable in the Telegram/VK WebViews — so the "Connecting…"/offline state only surfaced on the next foreground resync, not while idle. The gateway already pushes a keep-alive `heartbeat` every 10s, so add a client-side watchdog (streamwatchdog.ts) that resets on every delivered event and, after ~25s of silence, treats the stream as dropped (reportOffline + reconnect). It is background-aware (paused while suspended) so a throttled foreground return does not false-trip. The mock client mirrors the heartbeat so an idle e2e session stays online.	2026-07-14 08:27:38 +02:00
Ilia Denisov	cc34622630	feat(vk): show a launch diagnostic on a direct /vk/ open instead of a guest ... Opening the dedicated /vk/ entry directly in an ordinary browser (no signed VK launch) fell through to the web flow and silently started a throwaway guest, which is wrong for a VK-only entry. Mirror the existing /telegram/ launch-error behaviour: render a compact, shareable, privacy-safe diagnostic screen instead. - Boot: a new branch `onVKPath() && !insideVK()` sets app.launchError and stops the fall-through, the VK counterpart of the /telegram/ diagnostic guard. - Diagnostic (passive, no VK Bridge round-trip): reads the URL launch-parameter NAMES (never the `sign` value — auth material), whether the URL was signed, `vk_platform`, the iframe/referrer context, plus the shared client-environment lines. VK signs the launch URL at load, so — unlike Telegram's initData — the parameters never arrive late; hence the VK screen offers Share only, no Retry. - Generalise the screen: TelegramLaunchError.svelte -> LaunchError.svelte, which renders a neutral pre-formatted report and a per-platform title, with Retry gated on a `retry` flag (Telegram true, VK false). app.launchError is now a neutral LaunchDiag { platform, report, retry }. - New lib/launchdiag.ts holds the shared pieces both platforms reuse: the LaunchDiag shape, the client-environment lines, and the query field-NAME reader (moved out of telegram.ts so VK does not duplicate them). Tests: pure vkDiagLines units, incl. a guard that the `sign` value never leaks into the report. i18n: launch.errorTitleVk (en/ru). Docs: FUNCTIONAL (+ru) user story and ARCHITECTURE entry-path note.	2026-07-13 23:25:26 +02:00
Ilia Denisov	fe5a3d6d3b	fix(login): stop a rate-limit from latching a phantom offline on the login screen ... A fresh email login that hit the per-IP email rate limit stranded the user in an unrecoverable "offline" state that survived a full PWA restart, even though the network was fine. Root cause: the gateway email class (auth.email.request + auth.email.login, keyed per IP, 5/10min burst 2) trips on the third event, which in the natural "request code -> wrong code -> correct code" sequence is the correct-code login. The gateway returns ResourceExhausted; the client mapped it to 'rate_limited', which retry.ts classified as retryable + a connection code, so exec() called reportOffline(). That pushes the net-state machine into connecting, whose recovery probe is an authenticated profile.get -- but the login screen has no session, so the probe can never succeed and the machine latches offline. The transport kill switch (assertOnline) then refuses the very login that would fix it, and because the IP's email bucket refills only 1 token / 120s, each fresh attempt after a restart is rate-limited again -> offline again. Fix (client, narrow -- the trigger): - A rate-limit is no longer treated as connectivity. retry.ts no longer marks 'rate_limited' retryable or a connection code, so exec() never reports it offline; it surfaces as the existing error.rate_limited "slow down" message. Not auto-retrying it also stops the ~20s button freeze and avoids feeding the gateway's ban tripwire with 6 extra rejections per attempt. Fix (server): - Raise the email-code burst 2 -> 4 so the honest request + a mistyped code + the correct one is not throttled mid-login. Defence-in-depth over the backend's own per-code guards (5-attempt cap + 15-min TTL + send throttle). Tests: retry classification units updated to the new semantics; a gateway regression guard asserts the honest three-event email flow passes under the default policy. gateway/README.md rate-limit note updated. The deeper gap (the net-state recovery probe is session-gated, so any real transport failure on the session-less login/confirm screens still cannot self-heal) is left as a known residual, deferred by the owner.	2026-07-13 22:48:59 +02:00
Ilia Denisov	a067a2fd01	chore(android): de-anchor ANDROID_PLAN.md from the docs, re-enable the APK workflow ... Reword every code comment and doc that referenced ANDROID_PLAN.md or its stage anchors (§E, G-step-0, O1) so the living docs no longer depend on the plan file: .claude/CLAUDE.md, deploy/README.md, docs/ARCHITECTURE.md, docs/TESTING.md, ui/README.md, ui/android/.gitignore, ui/e2e/native.spec.ts, ui/src/lib/netstate.ts. Re-enable the manual signed-APK workflow (android-build.yaml.disabled -> android-build.yaml; the CI host already has the Android SDK; workflow_dispatch-only, so it does not auto-run on this PR). Add docs/ICONS.md — the single-master icon/logo format reference (web, PWA, Android, future iOS, store listings).	2026-07-13 14:05:43 +02:00
Ilia Denisov	25b5ed5516	fix(legal): translate the offer price-list headings in the English view ... The price list is spliced in Russian; the client-side offer transliteration turned its section headings and column headers into transliteration too. Translate the known backend-projected strings (the two section headings and the column headers Наименование/Рубли/Голоса в VK/Stars в Telegram/«Фишки») to English and transliterate only the product names, as requested.	2026-07-13 13:49:01 +02:00
Ilia Denisov	de5ab9186c	feat(legal): bilingual (RU + EN) legal pages with a language + theme switcher ... Add English versions of the privacy policy, EULA and offer (ui/legal/*_en.md) and render each legal page as one self-contained bilingual document: both language bodies plus a header language toggle and theme toggle (no back), a small inline ES5 script that switches language client-side (no reload, default Russian + persisted) and applies the theme (system default + persisted override) — mirroring the landing. The offer's English view transliterates the Russian product names spliced from the live catalog. renderLegalHtml now takes both language sources; renderOffer splices the price list into both; the renderer bakes and reads the _en sources and pre-renders the static pages at boot. Also wrap the /offer/ contour probe in the same retry+timeout as the legal probe (the offer page is now bilingual and larger). Docs + renderer/ui tests updated.	2026-07-13 13:22:56 +02:00
Ilia Denisov	7df078f5ed	fix(legal): wrap the privacy table's first column, top-align cells ... The shared legal-page template inherited the offer's shrink-to-fit product-name column (width:1% + white-space:nowrap), which stopped the privacy data table's long prose first column from wrapping and blew the table out horizontally. Scope that rule to the offer (body.offer) and top-align all legal-table cells for the multi-line privacy rows.	2026-07-13 13:00:40 +02:00
Ilia Denisov	0f3b4dbcff	feat(legal): host the privacy policy and EULA at /privacy/ and /eula/ ... Author ui/legal/{privacy,eula}_ru.md, reworked from the source documents: the seller INN is unified (290210610742), contacts unified to the Telegram bot + email + postal address, the EULA governing-law clause leads with Russian law + jurisdiction as residence tiers, the single-binding-language clause is dropped, data collection is scoped to voluntary/support provision, and "Компания" is no longer shout-cased. Serve both as static pages through the render sidecar, reusing a shared renderLegalHtml generalised from renderOfferHtml: new GET /privacy/ and GET /eula/ (301 from the slashless form), the markdown baked into the image, no backend fetch. Route them at the edge via the @legal caddy matcher with a CI probe asserting each page's canonical URL + the seller INN, so a missing route cannot silently fall through to the landing. Add the two links to the landing footer. Docs baked in: ARCHITECTURE (renderer legal pages + edge routing), FUNCTIONAL (+_ru) footer, renderer/README routes. Tests: renderer legal.test.mjs, ui renderLegalHtml unit, landing footer e2e.	2026-07-13 12:08:27 +02:00
Ilia Denisov	2d1fadb50c	feat(offline): implicit net-state model, two-tier version gate, unified lobby ... Land the offline-model redesign (ANDROID_PLAN.md O1-O7): replace the explicit offline toggle with a single detected net-state machine, unify the lobby, and add a two-tier client-version gate. Contour-safe: both version vars empty => dormant, the wire change is additive, so web/pwa/vk/tg behaviour is unchanged unless the gate is deliberately configured. O1 net-state reducer (test-first). O2 store + wiring (connection/offline shims; +@capacitor/network). O3 remove the offline toggle + migrate the pref. O4 two-tier gate: hard update_required degrades to an offline Update/Play-offline notice (not terminal); soft GATEWAY_RECOMMENDED_CLIENT_VERSION -> X-Update-Recommended nudge. O5 unified lobby (device-local + greyed-from-cache server games; self-set identity; closes G-step-0). O6 create flows (with-friends online/offline segment + offline dict guard). O7 docs. Telegram/VK stay online-only (contour review): the offline model is channel-gated via offlineCapable() (native + plain web; false in the mini-apps). offlineMode.active is hard-gated on it, so the whole model (blue chrome, unified/greyed lobby, transport kill switch, device-local vs_ai/hotseat create) stays inert in Telegram/VK regardless of the detected net state (closing a version-lock path that could have flipped them offline); and New Game's with-friends hides the online/offline segment there, leaving the remote invite alone. ARCHITECTURE already declared "Telegram/VK are exempt" - this makes the code match. Deploy/CI: wire the version gate through the deploy (GATEWAY_MIN_CLIENT_VERSION + GATEWAY_RECOMMENDED_CLIENT_VERSION as plain unprefixed vars via compose + ci.yaml + prod-deploy.yaml + write-prod-env.sh + .env.example) so the gate is live when set (test-contour commit-hash version fails open; empty => dormant). Disable the manual android-build CI workflow for now (rename .disabled). Bump the app bundle budget 127->130 KB for the added always-loaded wiring. Fix the UI Docker stage (gateway/Dockerfile): install --ignore-scripts so the Alpine/musl SPA build no longer tries to native-build sharp (a local android:assets tool, unused in the image); esbuild's binary is an optional dep so Vite still builds. Tests: gateway go green (two-tier gate over a real HTTP handler); docker build of the landing + gateway targets green locally; compose --no-interpolate confirms the gateway env; two new telegram.spec.ts e2e (offline signal keeps the chrome online + quick-match opponent choice visible => server enqueue; with-friends shows no pass-and-play), RED-verified; svelte-check 0/0, vitest 617, e2e 248 (chromium + webkit), build + bundle-size 127.8/130.	2026-07-13 02:50:41 +02:00
Ilia Denisov	ca2c6487cf	feat(android): manual signed-APK CI workflow ... Add .gitea/workflows/android-build.yaml (workflow_dispatch + confirm=build, master-only; mirrors prod-deploy): builds the native SPA, bundles the offline dicts, assembles a release APK as a run artifact. JDK 21 via setup-java; the Android SDK is host-provisioned (host-executor runner) with a fail-fast verify that also checks the runner user's access. Signing degrades gracefully — no keystore => unsigned release APK, not a failure. Wire ui/android/app/build.gradle: versionCode/versionName from the release tag (-P props; '=' assignment, not the command form that binds .toInteger() to the DSL setter's null return), plus a guarded signingConfigs.release from env. Rename VITE_STORE_URL -> VITE_RUSTORE_URL (empty until publish). Bake the E as-built into ANDROID_PLAN.md.	2026-07-12 20:27:07 +02:00
Ilia Denisov	49c53794f4	fix(ui): native header top safe-area under edge-to-edge ... The earlier safe-area fix reached the bottom bars (they apply --tg-safe-bottom) but not the header: its top inset lived only in a Telegram-fullscreen-scoped rule, so on the native build the header .bar had just 5px top padding and its content sat under the status bar (measured: the title at y=11px behind the 54px bar; the back button untappable). Give .bar a top inset from the SystemBars plugin's --safe-area-inset-top (native-only via the plugin var; unset -> 0 on web/PWA/Telegram/VK, so no regression; tg-fullscreen still overrides via specificity). Verified on-device (Pixel_10 / API 37): the title moved from y=11 to y=65, clear of the status bar.	2026-07-12 19:22:12 +02:00
Ilia Denisov	4a0689a4ac	fix(ui): native safe-area under Android 15+ edge-to-edge (WebView < 140) ... targetSdk 36 forces edge-to-edge, so the WebView draws behind the system bars. On Android WebView < 140, env(safe-area-inset-*) wrongly reports 0, so the app chrome (which only read env()) drew under the status bar (top nav untappable) and the gesture-nav home indicator (the game's centre Hint button intercepted; side buttons fine). Capacitor 8's SystemBars core plugin (built into @capacitor/core, insetsHandling:'css' by default) injects the correct --safe-area-inset-* values on every WebView; consume them ahead of env(): --tg-safe-*: var(--safe-area-inset-*, env(safe-area-inset-*, 0px)) Web / PWA / Telegram / VK are unchanged (--safe-area-inset-* is unset there, so it falls back to env()). Verified on-device (Pixel_10 / API 37) via the injected var — the emulator's auto-updated WebView 149 hides the env() bug, so the visual alone won't reproduce it.	2026-07-12 18:58:07 +02:00
Ilia Denisov	0eb72ba955	feat(ui): hide Telegram/VK link buttons on the native build ... The native (Capacitor) sign-in surface is guest + email only: VK ID web-login is a full-page redirect to id.vk.com that cannot return into the WebView, and the Telegram Login Widget is unreliable there. Profile now gates telegramLinkable/vkLinkable on !nativeShell (clientChannel android/ ios), hiding both LINK buttons on native; email and account management — including an existing link's redirect-free UNLINK — stay. Native tg/vk login (native SDKs / deep-link OAuth) is a separate later stage. Covered by e2e/native.spec.ts (the reconcile test opens Profile and asserts no Link Telegram / Link VK buttons, email present).	2026-07-12 18:09:11 +02:00
Ilia Denisov	e077258567	feat(ui): offline-first native boot + lazy server-guest reconciliation ... Native (Capacitor) cold boot with no cached session now enters as a device-local guest in auto-offline mode and lands straight in the lobby (never /login), so the app opens and plays local vs_ai / hotseat with the APK's bundled dictionaries and zero network. When the gateway becomes reachable, reconcileServerGuest silently mints + adopts a server guest and clears the auto-offline, lighting up online features. Web / PWA / Telegram / VK are byte-for-byte unchanged. - transport: exec gains { silent, allowOffline } so background reconciliation bypasses the offline kill switch (like the reachability probe) and never raises the terminal update overlay (a too-old client stays a local guest); new authGuestSilent on the client interface, the real transport and the mock. - app: native no-session boot branch; reconcileServerGuest fired at boot, by the recovery poll and the online event; the poll routes the session-less guest through reconciliation, since checkReachable needs a token it lacks. - native: initNativeShell tolerates a missing Capacitor bridge. - e2e: new native.spec.ts (inject window.androidBridge; boot -> offline lobby, local vs_ai move, reconcile -> online, hotseat start) + playwright.config bundles the dawgs into dist-e2e/dict for the loader's bundled tier.	2026-07-12 18:03:52 +02:00
Ilia Denisov	bcd5a1d02d	feat(ui): offline-first foundations — bundled dicts + local-guest identity ... The additive groundwork for the native offline-first experience (ANDROID_PLAN.md §D). Inert until the native cold-boot lands: on the web these paths never fire, so web / VK / Telegram behaviour is unchanged. - ui/scripts/bundle-dicts.mjs copies the scrabble-dictionary release DAWGs into dist/dict/<variant>@<version>.dawg for the native pipeline (run after `pnpm build`, before `cap sync`). - The dict loader gains a bundled tier between the IndexedDB and network tiers, attempted only on a native channel (a packaged app serves ./dict/<key>.dawg from its assets). Native-gated rather than the plan's "404 on the web" because the relative path would otherwise hit the gateway's own session-gated /dict/ route. - __DICT_VERSION__ Vite define (from VITE_DICT_VERSION, default "dev") + its ambient declaration; the offline vs_ai / hotseat creates in NewGame fall back to it when a device-local guest has no profile-advertised version. - New lib/localguest.ts: a persisted device-local guest id (no DB row); the offline vs_ai human seat uses it (and the localized common.guest name) when there is no server session. svelte-check clean, vitest green, native + web builds clean. The cold-boot rewrite, reconciliation, the Profile soft-sign-in gating and the offline-first e2e follow.	2026-07-12 16:41:19 +02:00
Ilia Denisov	a57fd355ba	feat(gateway,ui): client-version gate — turn away too-old builds ... Introduce a minimum-supported-client gate so a future incompatible wire change can turn away installed builds too old to speak it, cleanly, instead of letting them crash on decode. It rides the outermost stable layer (an HTTP header), never the FlatBuffers payload. Gateway: - New internal/clientver: dependency-free parse + compare of the leading MAJOR.MINOR.PATCH (a git-describe suffix is tolerated). - GATEWAY_MIN_CLIENT_VERSION config (empty => gate dormant; validated at load). - connectsrv checks the X-Client-Version header before decoding the payload: Execute returns result_code="update_required" (before the registry lookup), Subscribe returns FailedPrecondition. It fails open on an absent or garbled header — the header is a client-controlled compatibility signal, not an access control. Client: - Attach X-Client-Version on every call. - A terminal update.svelte.ts store + a non-dismissable UpdateOverlay (native opens VITE_STORE_URL, web reloads); retry.ts maps FailedPrecondition to the update_required sentinel; a mock __update hook drives the e2e. Wire-additive and contour-safe: no FBS/proto regen, no schema migration; the gate stays dormant until GATEWAY_MIN_CLIENT_VERSION is deliberately set, so web / VK / Telegram behaviour is unchanged. The silent reconciliation seam is deferred to the offline-first work (its only caller). Tests: Go clientver/config/connectsrv gate tests, retry.test.ts, Playwright update.spec.ts.	2026-07-12 15:47:41 +02:00
Ilia Denisov	de003e862a	feat(android): resolve gateway origin on native, skip SW, hide MVP purchases ... Make the web SPA behave correctly inside the Capacitor native shell, where the bundle loads from a local origin: - New lib/origin.ts gatewayOrigin(): absolute URLs resolve to VITE_GATEWAY_URL on native (the finished-game export/share URL in Game.svelte and the Wallet site-root link), falling back to the page origin on web. transport.ts already resolved via VITE_GATEWAY_URL and is left as-is. - Skip the PWA service worker on the native channel (the assets are already local; a worker would risk serving stale content across store updates). - Hide the money-purchase UI in the MVP: new distribution.purchasesHidden() folds VITE_PAYMENTS_DISABLED and the Google Play flag. The Wallet "buy" tab shows a neutral, pointer-free note (wallet.purchasesSoon) for the RuStore MVP and keeps the RuStore stub Google-Play-only. A ?nopay mock force mirrors ?gp for the e2e. - Native env types in vite-env.d.ts. Client-only, contour-safe: no wire/proto/schema change; web/VK/Telegram unchanged. Tests: origin + purchasesHidden unit tests, a ?nopay wallet e2e. svelte-check clean, vitest green, web + native vite build clean.	2026-07-12 14:58:35 +02:00
Ilia Denisov	0f5db0ee91	feat(android): scaffold Capacitor 8 native project + hardware Back button ... Add @capacitor/{core,android,app,cli,assets} to ui/, a capacitor.config.ts (appId ru.eruditgame.app, appName Эрудит, webDir dist — bundle model, no server.url), and the generated ui/android/ Gradle project (tracked; build outputs and the machine-specific local.properties gitignored, keystore patterns un-commented so signing material can never be committed). Wire the Android hardware Back button in ui/src/lib/native.ts behind a dynamic @capacitor/app import (web/mock bundles never load it), called from App.svelte onMount and reusing routeDepth for the navigation-root check. Whitelist sharp in pnpm-workspace.yaml for @capacitor/assets icon generation. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-12 01:34:25 +02:00
Ilia Denisov	40acbcccdd	feat(offer): sort and align the §4.4 price tables, style them for both themes ... - packs sorted by ascending rouble price; - values grouped hints-only -> no-ads-only -> no-ads+hints -> tournament (the tournament group is empty until such products become sellable), ascending chip price within each group; - price columns right-aligned (GFM "---:" separators); - tables span the full content width; the name column shrinks to its content and never wraps; - muted-but-visible cell borders on the dark theme, where the section rule colour blends into the background.	2026-07-11 11:29:41 +02:00
Ilia Denisov	b6c2598710	feat(offer): live catalog price list in the public offer, served by the render sidecar ... Robokassa moderation requires the public offer to list every digital good with its price. Move /offer/ off the static landing container to the render sidecar: it splices the live catalog price list (§4.4) into the owner-edited ui/legal/offer_ru.md and renders it with the shared ui/src/lib/offer.ts — one renderer, no drift, always matching the current catalog with no redeploy. - backend: /api/v1/internal/offer/pricing (internal, off the edge allow-list) projects the active catalog into two markdown tables — chip packs priced per rail (roubles / VK votes / Telegram Stars) and chip-priced values — through payments.Money so no float reaches the page. Cached in memory: warmed at boot, marked stale on every catalog mutation, so a served render issues no query. - renderer: GET /offer/ fetches the tables and substitutes them at the <#pricing_template#> marker, then renders; offer_ru.md is baked into the image and marked is bundled from ui. GET /offer -> 301. Only /offer/ is edge-exposed. - caddy: route /offer/ to the sidecar; drop the now-dead landing /offer/ handlers and the vite emit-offer plugin. - offer: fill §4.3 (the chip-payment wording) and drop the in-page back link. - landing footer: a feedback link (the offer's Telegram contact) beside the offer link. - docs (ARCHITECTURE, FUNCTIONAL +_ru, renderer README), CI /offer/ probe, unit + integration + node tests.	2026-07-10 20:25:41 +02:00
Ilia Denisov	8ce986922a	feat(ui): wallet storefront redesign — split buy/spend, compact balance, exchange confirm ... Reworks the Wallet screen to be more compact and to separate the two flows, and fixes a reported bug. Bug: buying a value with too few chips showed the generic "Something went wrong" toast — the backend's `insufficient_chips` (409) code was propagated correctly but had no i18n mapping, so `errorKey` fell back to `error.generic`. Add `error.insufficient_chips` / `error.product_not_found`. Also disable a value's Exchange button up front when the spendable balance cannot cover it (the server stays authoritative). Redesign: - a compact **balance** row leads the screen — the context's own chips (🪙 N) then any linked other-platform chips behind that platform's logo (monospaced digits); inside a VK/TG store only that store's own segment shows; - the benefits section is renamed **Active**, moved above the store, shows one inline line (hints + ad-free) and hides when nothing is active; - the **store** splits by a two-way toggle into **Buy chips** (money packs + the watch-an-ad row at the top) and **Spend chips** (values, exchanged for chips); - a value's action reads **Exchange** and opens a single confirmation dialog (chip spends are instant, with no provider window to confirm them); the existing cross-platform store-compliance warning folds into that same dialog when the spend would draw VK/TG chips. No payments-model or wire change; the money→chips→values model is unchanged (verified: money buys only chip packs, values are chips-only — "no-ads for money" is structurally impossible). Tests: wallet e2e updated for the new layout (chromium + webkit green). Docs: FUNCTIONAL (+_ru) wallet story rewritten. App bundle budget 126 → 127 KB (always-loaded settings hub).	2026-07-10 17:46:22 +02:00
Ilia Denisov	bf46b9492d	fix(ui): one-word games must not highlight phantom cross words; review polish ... Board-highlight bug (reported on the contour): formedGeometry walked cross words unconditionally, so in a single-word (one-word-per-turn) game a staged tile sitting next to a committed tile lit up a green "cross word" the engine ignores — and which need not even be a real word (the reported "БО lights up green in a one-word ПОПА play"). Gate the cross-word walk on the game's multipleWordsPerTurn flag. The score (8) was already correct — a premium square under the main word. Also, from review: - the turn strip reads the staged play's "WORD+WORD = N" while composing a legal move, reverting to the turn / result text otherwise; - the Exchange/Pass dialog shows the bag count ("In the bag: N" / "Bag is empty") right-aligned in the title row, via a new optional Modal `titleAside`; - cosmetics: half the turn strip's bottom padding (the plaques below carry their own top pad); a top gap above the landscape rack (it sat flush under the docked history); more horizontal padding on tab count badges so a 2-3 digit bag count clears the pill ends; - admin console: the game Summary now shows the single-word / multiple-words rule. Tests: formed single-word case added; full unit (584) + e2e (chromium + webkit, 113 each) green; backend build + adminconsole templates parse. Docs (FUNCTIONAL +_ru, UI_DESIGN) updated.	2026-07-10 15:58:05 +02:00
Ilia Denisov	77a690fcf6	feat(ui): move in-game status to the board — highlight, score badge, full-width rack ... Remove the under-board status strip and relocate its signals: - bag count -> a badge on the exchange/pass control + the foot of the move table - whose-turn / win-lose -> a thin strip above the score plaques - the tentative-move caption -> the board itself: staged tiles tint green (legal) or pink (illegal), the board tiles a formed word runs through go a shade darker, and an orange score badge sits on the main word (digit sized like a tile value, clamped on-board) The word geometry (covered cells + badge anchor) is a new pure client-side helper (ui/src/lib/formed.ts), independent of the move evaluator, so it works on the local or network preview path alike; the badge's number still comes from the preview score. Rack: a seven-column grid filling the tray width in both layouts — square, full-width tiles — with the confirm control in the fixed 7th slot. Settings: a touch-only "Zoom the board" toggle (default on, device-local) gates the tile-placement auto-zoom; taking a hint while zoomed in now zooms out so the highlighted hint word is never left off-screen. Docs (FUNCTIONAL +_ru, UI_DESIGN, ARCHITECTURE) and e2e/unit tests updated.	2026-07-10 14:58:32 +02:00
Ilia Denisov	e40adfb0c7	fix(games): carry game kind on live events + fix the New Game lock funnel ... Address review of the active-game limit lock: - Live-event GameViews (opponent_moved, match_found, game_started, ...) did not carry game_kind, so a lobby patch from an event zeroed a game's kind and the client's per-kind count under-counted — a capped kind read as free (a disabled start instead of the lock, and a wrong per-kind result). Thread Kind through notify.GameSummary → the event GameView. - New Game screen refreshes the lobby games on mount so the per-kind count reflects the current set, not a stale cached snapshot. - The guest funnel's login button routes to the profile screen (the account controls), not settings. - Copy: the guest prompt is "sign in to use all the game's features"; the durable notice is "finish your active games to start a new one". Regression tests: the notify opponent-moved payload carries kind; the client lock locks only the reached kind (vs_ai at cap leaves random open).	2026-07-10 10:55:48 +02:00
Ilia Denisov	3306a016a0	feat(ui): per-kind active-game limit lock on the New Game screen ... Carry the caller's per-tier active-game caps and each game's kind on the wire (Profile.game_limits + GameView.kind, additive FBS + gateway transcode + client codec, committed regen). The New Game screen counts the player's active games per kind from the lobby and locks a capped start: an outline button with a lock that opens a funnel modal instead of a game -- a sign-in prompt for a guest, a "finish a current game first" notice for a signed-in account (native Telegram popup, in-app modal elsewhere). The lock lifts via the existing profile refetch after a guest->durable upgrade. Remove the lobby's old at_game_limit New-Game tab disable + notice: the flag (now the random-kind cap) conflicted with the per-kind lock -- it hid the screen where the lock lives and wrongly blocked an unfulfilled kind. The New Game tab is always enabled; the per-kind start lock is the only gate. The at_game_limit wire field stays (unused by the client) for a later cleanup. Tests: client lock logic + codec kind/game_limits roundtrip + gateway transcode encode + native popup builders (unit); a mock e2e for the lock badge and the modal.	2026-07-10 10:09:45 +02:00
Ilia Denisov	82648a4398	fix(game): show granted/bought hints in-game — finish the D31 wire removal ... The in-game hint badge ignored the payments hint wallet: loading a game clobbered app.profile.hintBalance with the deprecated StateView.wallet_balance (zeroed in the D31 domain removal but left in the protocol as a dead 0, then synced over the real balance at game load). Finish the removal honestly. StateView carries the per-game allowance alone (hints_remaining); the purchasable wallet lives solely on the profile and the client adds it (lib/hints). Removed StateView.wallet_balance across every layer — backend StateView/DTO, notify.PlayerState (live events), gateway StateResp + wire.StateView, the client model/codec/mock/localgame — and dropped the now-unused wallet arg from hintsRemaining. The FBS field is tombstoned `(deprecated)` (not deleted) so the vtable slots after it stay stable across a rolling deploy; no accessor is generated. HintResult keeps wallet_balance (the real post-spend payments balance the client adopts into the profile). The StateView type no longer has walletBalance, so the clobber cannot return without a compile error. Tests: hintsRemaining (2-arg); hints.hintsLeft (allowance + live wallet, no strip); the game state/hint integration (allowance-only HintsRemaining); gateway transcode; FBS regen.	2026-07-10 06:26:49 +02:00
Ilia Denisov	7ce8101cfa	test(ads): lock the hint-pushed ad restarting the vs_ai gap (no over-serving)	2026-07-10 03:43:57 +02:00
Ilia Denisov	b5c8a04f0b	fix(ads): share one interstitial cooldown timer across kinds ... Cooldowns were tracked per kind ({move,hint}), so a hint ad and a move ad did not see each other: after a hinted move's ad the move timer was still zero, and the next plain move fired an ad immediately — two ads within a minute, under the cooldown. Track a single shared last-shown time; the kind only selects the required gap (hint 1m, move 5m, vs_ai 30m) measured from the last interstitial of any kind. A hint can still fire on its shorter gap (D30's "independent" hint cooldown), but never stacks a second ad within a cooldown. Tests: a hint uses the shorter shared gap; a move does not stack onto a just-shown hint ad.	2026-07-10 03:36:18 +02:00
Ilia Denisov	2ce80c241d	fix(ads): fire the hint interstitial on the confirmed move, not on the hint ... Taking a hint fired the post-move interstitial immediately, when the hint's preview tiles landed — interrupting the turn and reverting the board to the rack on the ad's close while the hint stayed spent. Move the trigger to the move confirmation: a hint applied this turn marks it (hintUsedThisTurn), and the confirmed play fires the hint-kind interstitial (its own cooldown) instead of the plain move one; the marker clears on any turn boundary (applyMoveResult) so a hint-then-pass does not leak into the next move. e2e: taking a hint fires no ad; confirming a move does.	2026-07-10 03:12:30 +02:00
Ilia Denisov	13be7c3d9a	feat(ads): VK post-move interstitial + retire deprecated hint_balance/paid_account ... Interstitial video after a confirmed play or a hint, VK-only, offline banner-only. The gate is client-mirrored: the backend puts the config cooldowns (global 5m / vs_ai 30m / hint 1m) and a suppressed flag (the no-ads / no_banner gate, same as the banner) on Profile.ads via adsFor; the client self-gates on a per-kind last-shown time in localStorage, with the VITE_ADS_STUB contour "ad fired" toast. Never fires after a pass, exchange or resign. maybeShowInterstitial + vkShowInterstitial; the codec and gateway transcode carry the ads block. Also retires the deprecated accounts.hint_balance / paid_account domain usage (expand-contract, code only — the columns stay for a later DROP so image rollback stays DB-safe): drop the Account fields and their scan, the dead account.SpendHint, account.GrantHints and the admin grant-hints action; the in-game hint display now comes wholly from the payments hint benefit. Banner eligibility and account merge no longer read the legacy flags. Tests: ads.test.ts (the client-mirrored gate), the codec ads round-trip, the gateway ads transcode test, and a profile ads-config integration test (cooldowns + suppressed under no-ads / no_banner). Docs: PAYMENTS §10 (+ru) interstitial, the decision amends, backend README, the plan.	2026-07-10 02:48:10 +02:00
Ilia Denisov	9acf6ab3b4	fix(payments): VK-iOS freeze is purchase-only; remove the rewarded diagnostic ... Testing the rewarded slice surfaced a contradiction: rewarded ads let a VK-iOS user earn vk chips, but the blanket VK-iOS "spend freeze" then blocked spending them (the wallet showed "5 (view-only)"). Apple's ToS forbids only BUYING in-app values on VK-iOS (money -> chips), not spending or earning them — so the freeze is corrected to purchase-only: vkFrozen() now gates only CreateOrder (the money-in step), not spendableSources (spending). VK-wallet chips — earned via rewarded ads or bought on the same account elsewhere (VK Android) — now spend on VK-iOS too. (Owner's ToS finding.) Also: the temporary contour diagnostic confirmed VK returns only {result:true} for a rewarded view (no token/signature) — client-attested is final, no hardening possible — so the diagnostic (the log and the diag wire field) is removed. Docs: PAYMENTS(+ru) VK-iOS freeze + D17 amend + PLAN E6. Tests updated (gate / wallet VK-iOS now spendable).	2026-07-10 01:27:26 +02:00
Ilia Denisov	dbd76d53e8	feat(ads): rewarded video (VK) — client-attested credit + daily/hourly caps ... The first ads slice: a voluntary rewarded video credits chips. VK Mini App ads (VKWebAppShowNativeAds) expose only a client-side watch result — no server-to-server verify — so the credit is client-attested, guarded by a server daily + hourly cap (config reward_daily_cap / reward_hourly_cap, default 50 / 10). The caps are both anti-abuse (bounding a forger who skips the ad and calls the endpoint directly) and an economic conversion lever (limiting free chips so a player who wants more buys). D29 amended to VK's reality. Backend: CreditReward (VK-only, order-less, idempotent on a client nonce, floored by the caps; payout from config rewarded_payout_chips, default 0 = off) + the wallet.reward edge op returning the updated wallet (reward_chips gates the "watch for chips" CTA). Additive migration (two config columns). Client: the ads-network abstraction (lib/ads.ts, VK impl) + the VK bridge (vkRewardedReady / vkShowRewarded) + the Wallet CTA + i18n. A contour test stub (VITE_ADS_STUB -> a toast instead of a real ad; prod always real) and a temporary diagnostic that logs the raw VK data, so we confirm on the contour exactly what VK returns (harden to signature-verify if it carries one). Tests: backend integration (credit, nonce idempotency, hourly cap, disabled, non-VK refusal) + codec unit (reward wire). Docs: PAYMENTS(+ru) §10, D29 amend, PLAN E6. Bundle: shared budget 30->31 (reward i18n strings).	2026-07-10 00:41:42 +02:00
Ilia Denisov	55dbb1005e	fix(ui): scope the wallet buy-button busy dim to the tapped button ... Tapping one pack's Buy dimmed every buy button at once (the shared busy flag drove disabled + the :disabled opacity on all of them), so it looked like both packs reacted to one tap. Track the in-flight product id (busyId): the concurrency guard stays global, but the pressed/dimmed look is now scoped to the tapped button. Payments were never affected.	2026-07-09 22:26:28 +02:00
Ilia Denisov	6e03ce0131	feat(payments): Telegram Stars payment rail ... Accept real money via Telegram Stars (XTR) — the third intake rail alongside Robokassa (direct) and VK Votes. Only the bot reaches Telegram, so the rail funnels through the reverse mTLS bot-link: - the gateway mints the invoice on a CreateInvoice command (the bot calls createInvoiceLink, XTR; the link goes to WebApp.openInvoice); - the bot gates each pre_checkout_query via a ValidatePreCheckout unary (the order must exist, be still creditable and not already paid — the reusable-invoice double-pay guard; the decline reason is localised to the order account's language); - a completed successful_payment is queued in a durable pure-Go SQLite outbox and forwarded via a ForwardPayment unary, credited once (idempotent on telegram_payment_charge_id, honours an expired order), re-driven on restart and every 30s. The rail is wired by TELEGRAM_STARS_OUTBOX_DIR (default /data) but stays inert until a chip pack carries an XTR price, so seeding a Stars price in the admin is the go-live. Tests: backend integration (order->forward->credit once, duplicate, pre_checkout gate) + bot outbox unit (idempotent, restart re-drive) + executor createInvoice. Docs: PAYMENTS(+ru) §9, ARCHITECTURE, the platform/telegram README, PLAN.	2026-07-09 21:35:29 +02:00
Ilia Denisov	8230253142	fix(ui): derive the VK-iOS store link from the deployment origin ... Replace the hardcoded erudit-game.ru host with location.origin, so the iOS store note's "other version" link points at this deployment's own site root (prod or the contour) without a hardcoded host or build-arg wiring.	2026-07-09 20:26:25 +02:00
Ilia Denisov	e33b9864c8	fix(ui): point the VK-iOS "other version" link at the site root ... The landing at / lists every version's entry; /app/ dropped the player straight into the web game. Link the iOS store note to the root instead.	2026-07-09 20:18:42 +02:00
Ilia Denisov	f6aa0ba4b0	fix(ui): correct the VK-iOS purchase block + add an iOS store note ... The VK-iOS detection used platformSubtype(), which is server-derived for VK and so never reported iOS on the client — the pack CTA stayed active and a tap hit a 403 with a generic error. Read the device family from the signed vk_platform launch param (normalizeSubtype(vkPlatform())) instead. Under the store header on VK-iOS, add a note that purchases are prohibited by Apple policy, linking to the web version (opened through VK's external-link route).	2026-07-09 20:11:35 +02:00
Ilia Denisov	f48ebf2151	fix(ui): VK-iOS shows the pack CTA disabled with a toast, not a failed buy ... Money purchases are not permitted in the VK iOS app (Apple ToS), and the backend already refuses them (the CreateOrder VK-iOS freeze). Show the pack "Buy" muted there and explain on tap ("purchases are not available on this platform"), instead of letting the tap hit a 403 and a generic error toast. The storefront still lists the packs.	2026-07-09 19:57:10 +02:00
Ilia Denisov	3bb9f10fad	feat(payments): VK Votes payment rail ... Wire the VK Mini Apps ("голоса") rail end to end, reusing the intake engine. The wallet.order endpoint branches by rail: a VK context opens a pending order (provider vk) and returns its id, which the client passes to VKWebAppShowOrderBox. VK's two-phase payment callback is verified at the gateway with the app protected key (GATEWAY_VK_APP_SECRET) and proxied to a backend intake handler: get_item returns the ordered pack's title and vote price; a chargeable order_status_change credits the vk segment exactly once (the same Fund, idempotent on VK's own order id) and records a succeeded event, so the dispatcher push refreshes the wallet. Integration test for the VK order->credit path.	2026-07-09 19:27:57 +02:00
Ilia Denisov	3367cc2bf1	feat(payments): payment-event dispatcher + the provider-return UX ... Deliver payment_events to connected clients as an in-app wallet-refresh push: a background dispatcher drains undispatched events and publishes a KindNotification "payment" signal, marking each delivered; the client bumps a wallet-refresh counter the open Wallet screen watches, re-fetching in place. A return-focus refetch is the fallback. The Robokassa Success/Fail return now serves a self-closing page (the payment opens in a separate window) so the customer drops back into the live app instead of a cold start. Integration test for the event drain/mark queue.	2026-07-09 18:26:06 +02:00
Ilia Denisov	936a70ab94	feat(ui): wire the chip-pack purchase to Robokassa ... Replace the disabled "Soon" pack action with a real purchase: the Wallet opens a money order (wallet.order) and sends the player to the provider's hosted-payment page (window.open via openExternalUrl); the chips are credited later by the verified server callback. Add a public-offer link under the packs (paying accepts the offer). Codec order round-trip unit test + a mock-e2e purchase test; the Google Play stub and the chip-spend paths are unchanged.	2026-07-09 17:43:02 +02:00
Ilia Denisov	2a6dc5a304	feat(gateway): wire the wallet.order edge call for the direct rail ... Add the WalletOrderRequest / WalletOrderResponse FlatBuffers messages and the wallet.order Connect op: the gateway decodes the order request, forwards it to the backend POST /wallet/order and returns the created order id plus the provider launch URL the client opens. Regenerate the committed Go and TS FlatBuffers code.	2026-07-09 17:30:39 +02:00
Ilia Denisov	625fc3135a	feat(ui): serve the public offer at /offer/ with a landing footer link ... The offer is the legal document a purchase accepts, needed before real-money intake goes live. Convert the source PDF to an editable ui/legal/offer_ru.md and render it to a standalone static dist/offer/index.html at build (a vite emit-offer plugin using marked); the landing container serves it at /offer/, with a bare /offer redirecting in. Add a small centered "Публичная оферта" footer link on the landing (ru/en) and a CI probe asserting /offer/ serves the page rather than silently falling through to the landing shell.	2026-07-09 16:03:50 +02:00
Ilia Denisov	4aa6174968	feat(payments): wallet screen with balances, benefits and storefront ... Add the "Кошелёк" section to the settings hub: context-visible chip balances, active benefits (no-ads term/forever, hints) and a storefront of chip-priced values and money-priced chip packs. Guests have no wallet; the Google Play build hides the money purchases behind a RuStore stub; a web purchase that would draw VK/Telegram chips warns first. Add the catalog read path the storefront needs — a context-projected GET /api/v1/user/wallet/catalog (payments service + store, gateway op wallet.catalog, FBS Catalog/CatalogProduct/CatalogAtom, client decode) — plus the client leg for the existing wallet.get/buy ops. Value spends reuse the existing spend path; the chip-pack purchase (money order flow) arrives with payment intake, so its action is a disabled placeholder for now. Covered by Go unit (catalog projection) + integration (/wallet/catalog over Postgres), vitest (formatting, spendable selection, web-spend warning, GP flag, codec + gateway encode round-trips) and Playwright mock e2e (render, guest-hidden, GP stub, warning) on Chromium + WebKit.	2026-07-08 12:37:32 +02:00
Ilia Denisov	1c06d1d0d1	feat(payments): chip wallet, store-compliance gate and benefit application ... Stand up the internal chip/benefit mechanic behind the narrow payments interface: context-aware balances and benefits, an atomic chip spend, admin grants as zero-price value sales, the one-directional store-compliance gate (VK/TG same- origin only, web draws direct→vk→tg, VK-iOS frozen, untrusted fail-closed), and per-origin hint and no-ads application with term stacking. Reads are served from an in-process, account-keyed write-through cache (mirroring the suspension gate), so hot paths issue no query to the payments schema. Flip the online-game hint wallet and the ad-banner suppression from the deprecated accounts.hint_balance / paid_account columns to the payments benefit (a hint balance no longer suppresses the banner — only a no-ads benefit does), and fold chip segments and benefits by origin on account merge, inside the merge tx. Add the GET/POST /api/v1/user/wallet edge chain (REST → Connect → FlatBuffers) plus its codec unit test; no wallet UI yet. Bring the frozen owner decisions log into the repo at docs/PAYMENTS_DECISIONS_ru.md (it was untracked under .vscode) and reference it from PLAN.md; record the read-cache design and the present-sources interface in PLAN.md and docs/PAYMENTS.md (+ RU mirror).	2026-07-08 06:06:40 +02:00
Ilia Denisov	92633f935e	feat(payments): trusted platform signal on the session ... Record the execution platform (kind vk|telegram|direct + device subtype ios|android|web) on each session, captured at creation and carried gateway->backend as a trusted X-Platform header, so the upcoming store-compliance gate has an unforgeable execution context. - backend.sessions gains nullable platform_kind/platform_subtype columns (migration 00011, CHECK-constrained, jet regenerated); session.Platform captures them at mint, resolve returns them, middleware exposes platform(c). kind is derived from the establish endpoint, never a client field; the account-merge session mint inherits the caller's platform. - gateway derives the platform (VK subtype from the signed vk_platform via vkauth, Telegram/direct best-effort from the client) and injects X-Platform on every authenticated backend call through the request context. - ui submits a best-effort device subtype on the telegram/guest/email login requests (new FBS subtype field); VK is server-derived from the signed params. - an unattributed session is untrusted (view-only); VK/TG self-heal on the next cold-start re-mint, direct/email on re-login. Signal plumbing only, no user-visible change; X-Platform is inert until the gate consumes it.	2026-07-08 03:31:51 +02:00