FROM public.ecr.aws/x8v8d7g8/mars-base:latest

WORKDIR /app

ENV NODE_ENV=development

# Git time-travel: clone, then make the repo's default branch point AT the base
# commit with no future history — a real branch checkout (not a detached HEAD),
# future commits/tags gc'd away so the reference solution can't leak from history.
ARG BASE_SHA=50016c77c808f9ca80391cf1abc96cc5416cf57d
RUN git clone https://github.com/open-circle/valibot . \
 && DEFAULT="$(git remote show origin | sed -n 's/.*HEAD branch: //p')" \
 && git checkout -B "$DEFAULT" "$BASE_SHA" \
 && git remote remove origin \
 && for b in $(git for-each-ref --format='%(refname:short)' refs/heads | grep -vx "$DEFAULT"); do git branch -D "$b" || true; done \
 && for t in $(git tag); do git merge-base --is-ancestor "$t" HEAD 2>/dev/null || git tag -d "$t"; done \
 && git reflog expire --expire=now --all \
 && git gc --prune=now \
 && (git submodule update --init --recursive || true)

# Dependency-drift pin: the repo has no packageManager field, so an unpinned
# corepack pulls latest pnpm (11.x), where ignored build scripts are a hard
# install error (ERR_PNPM_IGNORED_BUILDS). Pin the era-correct pnpm (10.x only
# warns) and keep corepack offline-deterministic at verify time.
ENV COREPACK_DEFAULT_TO_LATEST=0
RUN corepack enable && corepack prepare pnpm@10.11.0 --activate && pnpm install --frozen-lockfile

# v1.1 node-id scoring: vitest's built-in JUnit reporter is used at verify time
# (`--reporter=junit --outputFile=...`), then converted to CTRF JSON with the
# OFFICIAL ctrf-io converter (junit-to-ctrf, pinned). npm -g installs to the
# system prefix (/usr/lib/node_modules, node v24 system-wide) — zero contact
# with /app's pnpm manifest/lockfile, verified via git status --porcelain.
# The build-time --version smoke check fails the build loudly if node is too
# old for the converter (engines node>=20).
# The tsc --noEmit type checks stay an exit-code gate (no node ids exist for them).
RUN npm install -g junit-to-ctrf@0.0.14 && junit-to-ctrf --version

# Disable git commit hooks (husky etc.): dev-workflow tooling, not task content.
# Broken hook environments otherwise block the agent's (and oracle's) commits.
RUN cd /app && git config core.hooksPath /dev/null

CMD ["/bin/bash"]
