FROM public.ecr.aws/x8v8d7g8/mars-base:latest

WORKDIR /app


RUN apt-get update && apt-get install -y \
        curl \
        gnupg \
        lsb-release \
        netcat-openbsd \
    && rm -rf /var/lib/apt/lists/*


RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
    && apt-get install -y nodejs \
    && rm -rf /var/lib/apt/lists/*


RUN curl -fsSL https://www.mongodb.org/static/pgp/server-7.0.asc \
        | gpg --dearmor -o /usr/share/keyrings/mongodb-server-7.0.gpg \
    && DISTRO_ID=$(. /etc/os-release && echo "$ID") \
    && DISTRO_CODENAME=$(lsb_release -cs) \
    && if [ "$DISTRO_ID" = "debian" ]; then COMPONENT="main"; else COMPONENT="multiverse"; fi \
    && echo "deb [ arch=amd64,arm64 signed-by=/usr/share/keyrings/mongodb-server-7.0.gpg ] \
https://repo.mongodb.org/apt/${DISTRO_ID} ${DISTRO_CODENAME}/mongodb-org/7.0 ${COMPONENT}" \
        > /etc/apt/sources.list.d/mongodb-org-7.0.list \
    && apt-get update && apt-get install -y mongodb-org \
    && rm -rf /var/lib/apt/lists/*


# Git time-travel: clone, then make the repo's default branch point AT the base
# commit with no future history — a real branch checkout (not a detached HEAD),
# future commits/tags gc'd away so the reference solution can't leak from history.
ARG BASE_SHA=68dafce
RUN git clone https://github.com/eicrud/eicrud . \
 && DEFAULT="$(git remote show origin | sed -n 's/.*HEAD branch: //p')" \
 && git checkout -B "$DEFAULT" "$BASE_SHA" \
 && git remote remove origin \
 && for b in $(git for-each-ref --format='%(refname:short)' refs/heads | grep -vx "$DEFAULT"); do git branch -D "$b" || true; done \
 && for t in $(git tag); do git merge-base --is-ancestor "$t" HEAD 2>/dev/null || git tag -d "$t"; done \
 && git reflog expire --expire=now --all \
 && git gc --prune=now \
 && (git submodule update --init --recursive || true)



RUN npm pkg delete scripts.prepare && npm install --include=dev


ENV PATH="/app/node_modules/.bin:${PATH}"



RUN cd shared && npm install --include=dev && npm run compile


RUN mkdir -p /app/cli/node_modules/@eicrud \
    && ln -s /app/shared /app/cli/node_modules/@eicrud/shared \
    && cd cli && npm install --include=dev && npm run compile && npm link


RUN eicrud export dtos \
    && eicrud export superclient \
    && eicrud export openapi -o-jqs \
    && npm run setup:oapi:client


RUN mkdir -p /data/db


# v1.1 node-id scoring via CTRF: official CTRF reporter for jest
# (github.com/ctrf-io/jest-ctrf-json-reporter), pinned and installed OUT-OF-TREE
# under /opt/jest-ctrf so /app stays byte-identical (no package.json /
# package-lock.json / node_modules mutation; the anti-cheat tripwire on those
# files stays valid). The verifier loads it by absolute path via
# --reporters=/opt/jest-ctrf/node_modules/jest-ctrf-json-reporter.
# CRITICAL: 0.0.11's index.js loads dist/environment.js which hard-requires
# jest-environment-node at module load, so it MUST be co-installed here, pinned
# to the repo's jest version (30.1.2) — verified failure without it.
RUN mkdir -p /opt/jest-ctrf \
 && cd /opt/jest-ctrf \
 && npm install --no-audit --no-fund jest-ctrf-json-reporter@0.0.11 jest-environment-node@30.1.2 \
 && node -e "require('/opt/jest-ctrf/node_modules/jest-ctrf-json-reporter')" \
 && node -e "require.resolve('/opt/jest-ctrf/node_modules/jest-ctrf-json-reporter/dist/index.js')"


# Restore the tracked files the setup steps above mutated (`npm pkg delete
# scripts.prepare` edits package.json; `npm install` may rewrite
# package-lock.json) so `git status --porcelain` is EMPTY in the image: a dirty
# baseline would pollute every model.patch and false-fire the tripwire.
# Generated dirs (test/test_exports, test/eicrud_exports, test/oapi-client,
# compiled shared/cli output) are already covered by the repo's .gitignore.
RUN git checkout -- package.json package-lock.json \
 && git status --porcelain | (! grep -q .) \
 && node -e "require.resolve('jest'); require.resolve('ts-jest')"


# Disable git commit hooks (husky etc.): dev-workflow tooling, not task content.
# Broken hook environments otherwise block the agent's (and oracle's) commits.
RUN cd /app && git config core.hooksPath /dev/null

CMD ["/bin/bash"]
