FROM node:24-bookworm-slim AS base
ENV PNPM_HOME=/pnpm
ENV PATH=$PNPM_HOME:$PATH
RUN corepack enable && corepack prepare pnpm@10.26.1 --activate

RUN apt-get update && apt-get install -y --no-install-recommends \
      chromium \
      fonts-noto \
      fonts-noto-color-emoji \
      fonts-noto-cjk \
      ca-certificates \
      curl \
      tini \
  && rm -rf /var/lib/apt/lists/*

ENV PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=/usr/bin/chromium
ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1

WORKDIR /app

FROM base AS deps
COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
COPY artifacts/api-server/package.json artifacts/api-server/
COPY artifacts/tx-os/package.json artifacts/tx-os/
COPY lib/api-client-react/package.json lib/api-client-react/
COPY lib/api-spec/package.json lib/api-spec/
COPY lib/api-zod/package.json lib/api-zod/
COPY lib/db/package.json lib/db/
COPY lib/object-storage-web/package.json lib/object-storage-web/
COPY scripts/package.json scripts/
RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
    pnpm install --frozen-lockfile --ignore-scripts

FROM deps AS build
# Build-time stamp. Pass these from `docker compose build` so the
# admin "System Updates" panel can show *which* code is running, not
# just whatever is hard-coded in version.json. When the args are not
# provided (e.g. someone running `docker build` by hand), we leave
# version.json untouched.
ARG GIT_SHA=""
ARG BUILD_DATE=""
COPY tsconfig.base.json* tsconfig.json* ./
COPY version.json ./
COPY lib lib
COPY scripts scripts
COPY artifacts/api-server artifacts/api-server
RUN if [ -n "$GIT_SHA" ] && [ -n "$BUILD_DATE" ] && [ "$GIT_SHA" != "unknown" ] && [ "$BUILD_DATE" != "unknown" ]; then \
      GIT_SHA="$GIT_SHA" BUILD_DATE="$BUILD_DATE" node -e "const fs=require('fs');const p='./version.json';const v=JSON.parse(fs.readFileSync(p,'utf8'));const d=String(process.env.BUILD_DATE||'').replace(/[-:]/g,'').replace(/\..*$/,'').slice(0,13);v.build=(d||'unknownDate')+'.'+(process.env.GIT_SHA||'unknownSha');fs.writeFileSync(p,JSON.stringify(v,null,2)+'\n');console.log('Stamped build:',v.build);" ; \
    else \
      echo "No GIT_SHA/BUILD_DATE provided — keeping version.json as-is" ; \
    fi
RUN pnpm --filter @workspace/api-server run build

FROM base AS runtime
WORKDIR /app
ENV NODE_ENV=production
COPY --from=build /app/node_modules ./node_modules
COPY --from=build /app/pnpm-workspace.yaml /app/pnpm-lock.yaml /app/package.json ./
COPY --from=build /app/lib ./lib
COPY --from=build /app/scripts ./scripts
COPY --from=build /app/artifacts/api-server/package.json ./artifacts/api-server/package.json
COPY --from=build /app/artifacts/api-server/dist ./artifacts/api-server/dist
COPY --from=build /app/artifacts/api-server/assets ./artifacts/api-server/assets
COPY --from=build /app/artifacts/api-server/node_modules ./artifacts/api-server/node_modules
COPY docker/migrate.sh /usr/local/bin/migrate.sh
RUN chmod +x /usr/local/bin/migrate.sh
RUN mkdir -p /app/storage && chown -R node:node /app/storage
USER node
ENTRYPOINT ["/usr/bin/tini", "--"]
CMD ["node", "--enable-source-maps", "/app/artifacts/api-server/dist/index.mjs"]