# ---- Builder stage ----
FROM node:24-alpine AS builder

WORKDIR /repo

RUN apk add --no-cache openssl libc6-compat

# Root package + lock (for workspace install)
COPY package.json package-lock.json ./
COPY packages/sync-core/package.json ./packages/sync-core/
COPY packages/shared-schema/package.json ./packages/shared-schema/
COPY packages/super-sync-server/package.json ./packages/super-sync-server/

# Install ALL dependencies for the monorepo
# Use npm ci for reproducible builds; requires compatible lockfile
RUN npm ci --ignore-scripts

# Copy source code
COPY packages/sync-core/ ./packages/sync-core/
COPY packages/shared-schema/ ./packages/shared-schema/
COPY packages/super-sync-server/ ./packages/super-sync-server/

# Build sync-core, then shared-schema
WORKDIR /repo/packages/sync-core
RUN npm run build
RUN npm pack

WORKDIR /repo/packages/shared-schema
RUN npm run build
# Pack shared-schema to tgz for installation in production
RUN npm pack

# Build super-sync-server
WORKDIR /repo/packages/super-sync-server
RUN npx prisma generate
RUN rm -rf dist && npm run build

# ---- Runtime stage ----
FROM node:24-alpine AS production
ARG VCS_REF=unknown

LABEL org.opencontainers.image.revision=$VCS_REF

# System deps for Prisma & healthcheck + create user BEFORE copying files
RUN apk add --no-cache openssl libc6-compat wget && \
    addgroup -g 1001 -S nodejs && \
    adduser -S supersync -u 1001 -G nodejs && \
    mkdir -p /app/data && chown supersync:nodejs /app /app/data

WORKDIR /app

# Copy built artifacts from builder (note: tsconfig rootDir is "." so structure is dist/src/ and dist/scripts/)
COPY --from=builder --chown=supersync:nodejs /repo/packages/super-sync-server/dist ./dist
COPY --from=builder --chown=supersync:nodejs /repo/packages/super-sync-server/public ./public
COPY --from=builder --chown=supersync:nodejs /repo/packages/super-sync-server/prisma ./prisma
COPY --from=builder --chown=supersync:nodejs /repo/packages/super-sync-server/scripts ./scripts
COPY --from=builder --chown=supersync:nodejs /repo/packages/super-sync-server/src ./src
COPY --from=builder --chown=supersync:nodejs /repo/packages/super-sync-server/package.json ./package.json
COPY --from=builder --chown=supersync:nodejs /repo/packages/sync-core/sp-sync-core-*.tgz ./sync-core.tgz
COPY --from=builder --chown=supersync:nodejs /repo/packages/shared-schema/sp-shared-schema-*.tgz ./shared-schema.tgz

# Install dependencies and generate Prisma client in single layer
# Note: prisma CLI installed explicitly for runtime migrate deploy
# IMPORTANT: prisma version must match @prisma/client in package.json
RUN npm install ./sync-core.tgz ./shared-schema.tgz --ignore-scripts --omit=dev && \
    npm install --ignore-scripts --omit=dev && \
    npm install prisma@5.22.0 --ignore-scripts --omit=dev && \
    npx prisma generate && \
    rm -f sync-core.tgz shared-schema.tgz && \
    npm cache clean --force

USER supersync

EXPOSE 1900

ENV NODE_ENV=production
ENV PORT=1900
ENV DATA_DIR=/app/data
ENV RUN_MIGRATIONS_ON_STARTUP=false
# Keep V8 old-space below the cgroup mem_limit (768m in production compose) so
# GC starts before cgroup OOM-kill. RSS = old-space + new-space + code cache +
# native heap + ArrayBuffers, so headroom matters. 576 ≈ 75% of 768m.
ENV NODE_OPTIONS=--max-old-space-size=576

HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
  CMD wget --no-verbose --tries=1 --spider http://localhost:${PORT}/health || exit 1

CMD ["sh", "-c", "if [ \"${RUN_MIGRATIONS_ON_STARTUP:-false}\" = \"true\" ]; then sh scripts/migrate-deploy.sh || exit 1; fi; exec node dist/src/index.js"]