FROM dhi.io/node:24.22.1-debian13-dev@sha256:20cf36e12660c68b1e28887d1e71a7f2494bcea9d034709368e0afce77728eb0 AS build
LABEL maintainer="Penpot <docker@penpot.app>"

ENV DEBIAN_FRONTEND=noninteractive

ARG BUNDLE_PATH="./bundle-mcp/"
COPY $BUNDLE_PATH /opt/penpot/mcp/

WORKDIR /opt/penpot/mcp

# pnpm ships as a system binary (same tarball + SHA pin as
# docker/devenv/Dockerfile); ./setup expects it on PATH.
# Corepack is gone from Node 25+, so nothing here may use it.
ARG PNPM_VERSION=12.15.0
RUN set -eux; \
    apt-get -qq update; \
    apt-get -qqy --no-install-recommends install curl ca-certificates gzip; \
    rm -rf /var/lib/apt/lists/*; \
    ARCH="$(dpkg --print-architecture)"; \
    case "${ARCH}" in \
       aarch64|arm64) \
         PNPM_ARCH='arm64'; \
         PNPM_SHA256='d7ce93a2c7d847d3a34bd3f559b60c14f578b1320c17cc352a2c5c5fdf956117'; \
         ;; \
       amd64|x86_64) \
         PNPM_ARCH='x64'; \
         PNPM_SHA256='55b5ed0092bd11176c1669598e231ae52e7cedac59de6efd0d415730f37d0598'; \
         ;; \
       *) \
         echo "Unsupported arch: ${ARCH}"; \
         exit 1; \
         ;; \
    esac; \
    curl -LfsSo /tmp/pnpm.tar.gz "https://github.com/pnpm/pnpm/releases/download/v${PNPM_VERSION}/pnpm-linux-${PNPM_ARCH}.tar.gz"; \
    echo "${PNPM_SHA256} */tmp/pnpm.tar.gz" | sha256sum -c -; \
    mkdir -p /usr/local/bin; \
    tar -xzf /tmp/pnpm.tar.gz -C /usr/local/bin pnpm; \
    chmod 755 /usr/local/bin/pnpm; \
    rm -f /tmp/pnpm.tar.gz; \
    pnpm --version;

RUN ./setup


FROM dhi.io/node:24.22.1-debian13@sha256:32a2fa6af5209698a9354cef0b19ada3dbfac3090b1010b70afa9f1a298ba2d9 AS image
LABEL maintainer="Penpot <docker@penpot.app>"

ENV LANG=en_US.UTF-8 \
    LC_ALL=en_US.UTF-8 \
    PENPOT_MCP_SERVER_HOST=0.0.0.0

COPY --from=build --chown=node:node /opt/penpot/mcp /opt/penpot/mcp

WORKDIR /opt/penpot/mcp
USER node

CMD ["node", "index.js", "--multi-user"]