scrabble-game/renderer

renderer — the render sidecar (finished-game image + public legal pages)

An internal Node service that runs shared ui/src/lib renderers server-side — bundled verbatim at image build time (src/entry.ts → esbuild → dist/gameimage.mjs) so there is one renderer and no drift from the browser. It serves two surfaces: the finished-game export PNG (on skia-canvas, pixel-identical to the design the owner signed off) and the public legal pages (the offer, the privacy policy and the EULA).

Interface

• POST /render — {game, moves, alphabet, labels, dateLocale, hostname, scale?} → image/png. game/moves are the ui-model shapes (GameView / MoveRecord[]); alphabet is the per-variant (index, letter, value) table tile values are drawn from; labels localizes the non-play moves (pass/exchange/resign/timeout); hostname + dateLocale feed the footer. Internal-only.
• GET /offer/ — the public offer page as text/html: the owner-edited ui/legal/offer_ru.md (baked into the image, read at boot) with the live catalog price list (§4.4) fetched as markdown from the backend's internal /api/v1/internal/offer/pricing (RENDERER_BACKEND_URL) and spliced in at the <#pricing_template#> marker, then rendered by the shared ui/src/lib/offer.ts renderLegalHtml. GET /offer → 301 /offer/. Caddy routes /offer/ here; a backend outage yields a 502, never a stale price list.
• GET /privacy/ — the privacy policy, and GET /eula/ the end-user licence agreement, both as text/html: the owner-edited ui/legal/privacy_ru.md / ui/legal/eula_ru.md (baked in, read at boot), rendered by the same shared renderLegalHtml. Static — no backend fetch. GET /privacy / GET /eula → 301 to the trailing-slash form. Caddy routes these here too.
• GET /healthz — liveness (the compose healthcheck the backend's depends_on gates on).

The service renders and nothing else: for the PNG, authentication, the participant check and the signed public download URL all live in the backend (backend/internal/server/export.go), the path being client → gateway /dl/* → backend → this sidecar; for the offer, the catalog projection and its cache live in the backend (backend/internal/payments/offer.go) and no user input reaches the page.

Development

pnpm install          # skia-canvas + esbuild MUST stay approved in pnpm-workspace.yaml
                      # (allowBuilds) or the native binary is silently never fetched
pnpm test             # bundles, then node --test (PNG smoke + offer/legal render)
# local run on :8090 (RENDERER_PORT overrides). The server reads all three legal sources at boot, so
# point each at its ui/legal source (the baked paths do not exist in a local checkout); /offer/ also
# needs a reachable backend for the price fetch:
RENDERER_OFFER_MD=../ui/legal/offer_ru.md RENDERER_PRIVACY_MD=../ui/legal/privacy_ru.md \
  RENDERER_EULA_MD=../ui/legal/eula_ru.md RENDERER_BACKEND_URL=http://localhost:8080 node src/server.mjs

The runtime image (renderer/Dockerfile, node:22-slim) bakes in Liberation Sans (the UI font stack's Linux face) and Noto Color Emoji (the scoresheet 🏆); skia-canvas picks both up through fontconfig. The fixture testdata/request.json is a real 35-move self-played Russian Scrabble game.