# syntax=docker/dockerfile:1.7
FROM node:22-bookworm-slim

RUN apt-get update \
  && apt-get install -y --no-install-recommends g++ make python3 \
  && rm -rf /var/lib/apt/lists/*

RUN corepack enable

WORKDIR /app

ARG DEN_API_VERSION=dev
ENV DEN_API_VERSION=${DEN_API_VERSION}
ENV PORT=8788

COPY package.json pnpm-lock.yaml pnpm-workspace.yaml /app/
COPY patches /app/patches
COPY packages/types/package.json /app/packages/types/package.json
COPY packages/automations/package.json /app/packages/automations/package.json
COPY packages/codemode/package.json /app/packages/codemode/package.json
COPY packages/email/package.json /app/packages/email/package.json
COPY packages/enterprise-mcp-client/package.json /app/packages/enterprise-mcp-client/package.json
COPY packages/install-config/package.json /app/packages/install-config/package.json
COPY packages/connect-link/package.json /app/packages/connect-link/package.json
COPY packages/headless-threads/package.json /app/packages/headless-threads/package.json
COPY packages/mcp-apps/package.json /app/packages/mcp-apps/package.json
# apps/desktop/package.json is copied below for version metadata, and it depends
# on @openwork/paths, so the package must exist for workspace resolution.
COPY packages/paths/package.json /app/packages/paths/package.json
# The root workspace declares the shared evaluator helpers as dev dependencies.
# Their manifests must be present even though the Den API image does not build
# or ship their source.
COPY evals/packages/behaviors/package.json /app/evals/packages/behaviors/package.json
COPY evals/packages/cdp/package.json /app/evals/packages/cdp/package.json
COPY evals/packages/labs/package.json /app/evals/packages/labs/package.json
COPY evals/packages/matchers/package.json /app/evals/packages/matchers/package.json
COPY ee/packages/utils/package.json /app/ee/packages/utils/package.json
COPY ee/packages/den-db/package.json /app/ee/packages/den-db/package.json
COPY ee/packages/telemetry-contracts/package.json /app/ee/packages/telemetry-contracts/package.json
COPY ee/packages/telemetry/package.json /app/ee/packages/telemetry/package.json
COPY ee/apps/den-api/package.json /app/ee/apps/den-api/package.json

RUN pnpm install --frozen-lockfile --trust-lockfile

COPY packages/types /app/packages/types
COPY packages/automations /app/packages/automations
COPY packages/codemode /app/packages/codemode
COPY packages/email /app/packages/email
COPY packages/enterprise-mcp-client /app/packages/enterprise-mcp-client
COPY packages/install-config /app/packages/install-config
COPY packages/connect-link /app/packages/connect-link
COPY packages/headless-threads /app/packages/headless-threads
COPY packages/mcp-apps /app/packages/mcp-apps
COPY packages/paths /app/packages/paths
COPY ee/packages/utils /app/ee/packages/utils
COPY ee/packages/den-db /app/ee/packages/den-db
COPY ee/packages/telemetry-contracts /app/ee/packages/telemetry-contracts
COPY ee/packages/telemetry /app/ee/packages/telemetry
COPY ee/apps/den-api /app/ee/apps/den-api
COPY apps/desktop/package.json /app/apps/desktop/package.json

# Source-map upload is build-only; runtime Sentry still requires its own backend and DSN configuration.
ARG DEN_UPLOAD_SENTRY_SOURCEMAPS=0
ARG DEN_SENTRY_UPLOAD_BUILD_ID=disabled
RUN --mount=type=secret,id=sentry_auth_token,required=false \
  --mount=type=secret,id=sentry_org,required=false \
  --mount=type=secret,id=sentry_project,required=false \
  --mount=type=secret,id=sentry_url,required=false \
  --mount=type=secret,id=sentry_release,required=false \
  --mount=type=secret,id=sentry_dist,required=false \
  set -eu; \
  if [ "$DEN_UPLOAD_SENTRY_SOURCEMAPS" = "1" ]; then \
    if [ ! -s /run/secrets/sentry_auth_token ] || [ ! -s /run/secrets/sentry_org ] || [ ! -s /run/secrets/sentry_project ] || [ ! -s /run/secrets/sentry_release ]; then \
      echo "Sentry source-map upload requested but required BuildKit secrets are incomplete" >&2; \
      exit 1; \
    fi; \
    export DEN_UPLOAD_SENTRY_SOURCEMAPS; \
    export SENTRY_AUTH_TOKEN="$(cat /run/secrets/sentry_auth_token)"; \
    export SENTRY_ORG="$(cat /run/secrets/sentry_org)"; \
    export SENTRY_PROJECT="$(cat /run/secrets/sentry_project)"; \
    export SENTRY_RELEASE="$(cat /run/secrets/sentry_release)"; \
    if [ -s /run/secrets/sentry_url ]; then export SENTRY_URL="$(cat /run/secrets/sentry_url)"; fi; \
    if [ -s /run/secrets/sentry_dist ]; then export SENTRY_DIST="$(cat /run/secrets/sentry_dist)"; fi; \
    : "$DEN_SENTRY_UPLOAD_BUILD_ID"; \
  fi; \
  pnpm --dir /app/ee/apps/den-api run build

EXPOSE 8788

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 CMD node -e "fetch('http://127.0.0.1:' + (process.env.PORT || '8788') + '/health').then((res) => process.exit(res.ok ? 0 : 1)).catch(() => process.exit(1))"

CMD ["node", "/app/ee/apps/den-api/dist/main.js"]