Package verified Dune checkpoints for TrueNAS and HTTPS proxying

Serve built Workers directly through pinned Miniflare with persistent D1-compatible storage and startup migrations. Build and verify Docker images in CI; publish main checkpoints to GHCR for manual TrueNAS updates on port 33046. Preserve explicit public-origin checks and LAN-compatible cryptographic operation IDs.

Validation: 5,153 offline tests, typecheck, lint and build; 49 HTTP integration cases; HTTPS-origin create/join/chat/seat protection, foreign-origin rejection, exact saved-seat restart and browser asset serving. Independent persistence/proxy review completed. Clean Docker CI and actual NAS installation follow this source checkpoint.

components/seat-ai-delegation.tsx

@@ -1,4 +1,5 @@
 'use client';
+import { randomId } from '@/lib/random-id';
 
 import { useEffect, useId, useRef, useState } from 'react';
 import type { GameView } from '@/game/engine';
@@ -300,7 +301,7 @@ export function SeatAiDelegation({
                   void submit({
                     type: 'setSeatAiDelegate',
                     version: game.version,
-                    grantId: crypto.randomUUID(),
+                    grantId: randomId(),
                     delegateId,
                     difficulty,
                   })

components/table-talk.tsx

@@ -1,4 +1,5 @@
 'use client';
+import { randomId } from '@/lib/random-id';
 import { useEffect, useId, useRef, useState } from 'react';
 import type { GameView } from '@/game/engine';
 import { faction } from '@/game/catalog';
@@ -152,7 +153,7 @@ export function TableTalk({ game }: { game: GameView }) {
   async function submit() {
     if (sending.current || !ready) return;
     const draft = record ?? {
-      id: crypto.randomUUID(),
+      id: randomId(),
       recipientId: recipient || null,
       text,
     };