refactor: convert to npm-workspaces monorepo (engine/core-public/shared/client/server)

Restructure the single src/ tree into an npm-workspaces monorepo under
packages/, rename core -> engine, extract a types-only core-public layer,
and break the pre-existing engine -> client dependency cycle.

Structure (packages/):
  core-public  public API/wire schemas + shared enums (clean leaf)
  shared       framework-agnostic helpers (clean leaf)
  engine       deterministic simulation (was src/core)
  client       rendering/UI (was src/client)
  server       coordination (was src/server)

Dependency DAG: engine -> {core-public, shared}; client -> {core-public,
shared, engine}; server -> {core-public, engine}.

- npm workspaces: root package.json workspaces + per-package package.json;
  tsconfig.base.json holds shared options + path aliases
  (core-public/* shared/* engine/* client/* server/*) resolved uniformly by
  tsc, Vite (resolve.tsconfigPaths), Vitest, and tsx. Lockfile regenerated.
- core-public: moved Schemas/ApiSchemas/CosmeticSchemas/StatsSchemas/
  ClanApiSchemas/WorkerSchemas/Base64/PatternDecoder; extracted the enums
  (GameTypes), GameEvent type, emoji table, and GraphicsOverrides schema.
  Engine re-exports the moved enums/types so existing imports keep working.
- Broke engine -> client cycle:
  - renderNumber/renderTroops -> shared/format
  - NameBoxCalculator moved into engine
  - username validation returns translation key + params; client translates
  - applyStateUpdate moved to client (operates on the render-only PlayerState)
  - Config/UnitGrid/execution-Util/GameImpl now use structural read
    interfaces (engine/game/ReadViews: PlayerLike/UnitLike/GameLike) instead
    of importing client view classes; client imports view classes from a new
    client/view barrel; deleted the engine/game/GameView re-export shim.
- Build/deploy updated: vite.config, index.html, eslint, Dockerfile
  (copies packages/ + tsconfig.base.json before npm ci), .vscode, tests.

Verified: tsc --noEmit clean; 1364 + 65 tests pass; production vite build
succeeds; engine has zero client/server imports; core-public and shared are
dependency leaves.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/server/src/GamePreviewRoute.ts

@@ -0,0 +1,166 @@
+import type { Express, Request } from "express";
+import fsPromises from "fs/promises";
+import { parse } from "node-html-parser";
+import path from "path";
+import type { Logger } from "winston";
+import { z } from "zod";
+import { GAME_ID_REGEX, GameInfo } from "core-public/Schemas";
+import { replacer } from "engine/Util";
+import type { GameManager } from "./GameManager";
+import {
+  buildPreview,
+  escapeHtml,
+  ExternalGameInfo,
+  ExternalGameInfoSchema,
+} from "./GamePreviewBuilder";
+import { setNoStoreHeaders } from "./NoStoreHeaders";
+import { getAppShellContent, setHtmlNoCacheHeaders } from "./RenderHtml";
+import { ServerEnv } from "./ServerEnv";
+
+const requestOrigin = (req: Request): string => {
+  const protoHeader = (req.headers["x-forwarded-proto"] as string) ?? "";
+  const proto = protoHeader.split(",")[0]?.trim() || req.protocol || "https";
+  const host =
+    req.get("host") ?? `${ServerEnv.subdomain()}.${ServerEnv.domain()}`;
+
+  // Force https only for the configured public domain (and its subdomains).
+  // This avoids hardcoding hostnames while ensuring we don't force https on
+  // localhost or arbitrary custom hosts.
+  const hostname = host.split(":")[0].toLowerCase();
+  const domain = ServerEnv.domain().toLowerCase();
+  const forceHttps = hostname === domain || hostname.endsWith(`.${domain}`);
+
+  return `${forceHttps ? "https" : proto}://${host}`;
+};
+
+export function registerGamePreviewRoute(opts: {
+  app: Express;
+  gm: GameManager;
+  workerId: number;
+  log: Logger;
+  baseDir: string;
+}) {
+  const { app, gm, log, baseDir } = opts;
+
+  const gameIDSchema = z.string().regex(GAME_ID_REGEX);
+
+  const fetchPublicGameInfo = async (
+    gameID: string,
+  ): Promise<ExternalGameInfo | null> => {
+    if (!gameIDSchema.safeParse(gameID).success) return null;
+
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 1500);
+    try {
+      const apiDomain = ServerEnv.jwtIssuer();
+      const encodedID = encodeURIComponent(gameID);
+      const response = await fetch(`${apiDomain}/game/${encodedID}`, {
+        headers: {
+          "x-api-key": ServerEnv.apiKey(),
+        },
+        signal: controller.signal,
+      });
+      if (!response.ok) return null;
+      const data = await response.json();
+      const parsed = ExternalGameInfoSchema.safeParse(data);
+      if (!parsed.success) {
+        log.warn("Invalid ExternalGameInfo from API", {
+          gameID,
+          issues: parsed.error.issues,
+        });
+        return null;
+      }
+      return parsed.data;
+    } catch (error) {
+      log.warn("failed to fetch public game info", { gameID, error });
+      return null;
+    } finally {
+      clearTimeout(timeout);
+    }
+  };
+
+  app.get("/game/:id", async (req, res) => {
+    const gameID = req.params.id;
+
+    // Validate gameID format
+    if (!GAME_ID_REGEX.test(gameID)) {
+      return res.status(400).json({ error: "Invalid game ID format" });
+    }
+
+    const game = gm.game(gameID);
+
+    const lobby: GameInfo | null = game ? game.gameInfo() : null;
+
+    try {
+      const publicInfo = await fetchPublicGameInfo(gameID); // Fetch from central API (DB/Auth)
+
+      // If we have neither live lobby info nor archived public info, we can't show anything
+      if (!lobby && !publicInfo) {
+        return res.redirect(302, "/");
+      }
+
+      const origin = requestOrigin(req);
+      const meta = await buildPreview(
+        gameID,
+        origin,
+        ServerEnv.workerPath(gameID),
+        lobby,
+        publicInfo,
+      );
+
+      // Always serve HTML with meta tags for /game/:id route
+      const staticHtml = path.join(baseDir, "../../static/index.html");
+      const rootHtml = path.join(baseDir, "../../index.html");
+      let filePath: string | null = null;
+
+      try {
+        await fsPromises.access(staticHtml);
+        filePath = staticHtml;
+      } catch {
+        try {
+          await fsPromises.access(rootHtml);
+          filePath = rootHtml;
+        } catch {
+          // Neither file exists
+        }
+      }
+
+      if (filePath) {
+        const html = await getAppShellContent(filePath);
+        const root = parse(html);
+        const head = root.querySelector("head");
+        if (head) {
+          head
+            .querySelectorAll('meta[property^="og:"], meta[name^="twitter:"]')
+            .forEach((el) => el.remove());
+
+          const tagsToInject = [
+            `<meta property="og:title" content="${escapeHtml(meta.title)}" />`,
+            `<meta property="og:description" content="${escapeHtml(meta.description || meta.title)}" />`,
+            `<meta property="og:url" content="${escapeHtml(meta.joinUrl)}" />`,
+            `<meta property="og:image" content="${escapeHtml(meta.image)}" />`,
+            `<meta name="twitter:card" content="summary_large_image" />`,
+            `<meta name="twitter:title" content="${escapeHtml(meta.title)}" />`,
+            `<meta name="twitter:description" content="${escapeHtml(meta.description || meta.title)}" />`,
+            `<meta name="twitter:image" content="${escapeHtml(meta.image)}" />`,
+          ];
+
+          tagsToInject.forEach((tag) =>
+            head.insertAdjacentHTML("beforeend", tag),
+          );
+        }
+
+        setHtmlNoCacheHeaders(res);
+        return res.status(200).send(root.toString());
+      }
+
+      // Fallback to JSON if HTML file not found
+      setNoStoreHeaders(res);
+      res.setHeader("Content-Type", "application/json");
+      return res.send(JSON.stringify(lobby ?? publicInfo, replacer));
+    } catch (error) {
+      log.error("failed to render join preview", { error });
+      return res.status(500).send("Unable to render lobby preview");
+    }
+  });
+}