# renderer — the render sidecar (finished-game image + public offer page)

An internal Node service that runs shared `ui/src/lib` renderers server-side — bundled verbatim at
image build time (`src/entry.ts` → esbuild → `dist/gameimage.mjs`) so there is one renderer and no
drift from the browser. It serves two surfaces: the finished-game export **PNG** (on
[skia-canvas](https://github.com/samizdatco/skia-canvas), pixel-identical to the design the owner
signed off) and the public **offer page**.

## Interface

- `POST /render` — `{game, moves, alphabet, labels, dateLocale, hostname, scale?}` →
  `image/png`. `game`/`moves` are the ui-model shapes (`GameView` / `MoveRecord[]`);
  `alphabet` is the per-variant `(index, letter, value)` table tile values are drawn
  from; `labels` localizes the non-play moves (pass/exchange/resign/timeout);
  `hostname` + `dateLocale` feed the footer. Internal-only.
- `GET /offer/` — the public offer page as `text/html`: the owner-edited `ui/legal/offer_ru.md`
  (baked into the image, read at boot) with the live catalog **price list** (§4.4) fetched as
  markdown from the backend's internal `/api/v1/internal/offer/pricing` (`RENDERER_BACKEND_URL`)
  and spliced in at the `<#pricing_template#>` marker, then rendered by the shared
  `ui/src/lib/offer.ts`. `GET /offer` → 301 `/offer/`. **The only edge-exposed route** — caddy
  routes `/offer/` here; a backend outage yields a 502, never a stale price list.
- `GET /healthz` — liveness (the compose healthcheck the backend's `depends_on` gates on).

The service renders and nothing else: for the PNG, authentication, the participant check and the
signed public download URL all live in the backend (`backend/internal/server/export.go`), the path
being client → gateway `/dl/*` → backend → this sidecar; for the offer, the catalog projection and
its cache live in the backend (`backend/internal/payments/offer.go`) and no user input reaches the
page.

## Development

```sh
pnpm install          # skia-canvas + esbuild MUST stay approved in pnpm-workspace.yaml
                      # (allowBuilds) or the native binary is silently never fetched
pnpm test             # bundles, then node --test (PNG smoke + offer splice)
# local run on :8090 (RENDERER_PORT overrides). For /offer/, point at the offer source and a
# reachable backend (else the boot read / the price fetch fail):
RENDERER_OFFER_MD=../ui/legal/offer_ru.md RENDERER_BACKEND_URL=http://localhost:8080 node src/server.mjs
```

The runtime image (`renderer/Dockerfile`, `node:22-slim`) bakes in Liberation Sans (the
UI font stack's Linux face) and Noto Color Emoji (the scoresheet 🏆); skia-canvas picks
both up through fontconfig. The fixture `testdata/request.json` is a real 35-move
self-played Russian Scrabble game.