# The builder runs on the BUILD host's native platform and cross-compiles for
# the target: bun compiles openwork-server via --target and the web build is
# arch-independent. This avoids emulating the whole toolchain under QEMU
# (node's libuv crashes under qemu-x86_64: uv__io_poll EEXIST assert).
FROM --platform=$BUILDPLATFORM node:22-bookworm-slim AS openwork-builder

WORKDIR /src

RUN apt-get update \
  && apt-get install -y --no-install-recommends ca-certificates curl git unzip \
  && npm install -g bun \
  && corepack enable \
  && rm -rf /var/lib/apt/lists/*

COPY . .

RUN pnpm install --frozen-lockfile --filter openwork-server... --filter @openwork/app...

ARG TARGETARCH

RUN set -eux; \
  arch="${TARGETARCH:-$(dpkg --print-architecture)}"; \
  case "$arch" in \
    amd64) target="bun-linux-x64" ;; \
    arm64) target="bun-linux-arm64" ;; \
    *) echo "unsupported architecture: $arch" >&2; exit 1 ;; \
  esac; \
  pnpm --filter openwork-server build; \
  pnpm --filter openwork-server exec bun ./script/build.ts --outdir dist/bin --target "$target"; \
  install -m 0755 "apps/server/dist/bin/openwork-server-${target}" /tmp/openwork-server; \
  pnpm --filter @openwork/app build:web

FROM node:22-bookworm-slim

ARG OPENWORK_SERVER_VERSION=0.18.1
ARG OPENCODE_VERSION
ARG OPENCODE_DOWNLOAD_URL=

RUN apt-get update \
  && apt-get install -y --no-install-recommends ca-certificates curl tar unzip \
  && rm -rf /var/lib/apt/lists/*

COPY --from=openwork-builder /tmp/openwork-server /usr/local/bin/openwork-server
COPY --from=openwork-builder /src/apps/app/dist /opt/openwork/web
COPY --from=openwork-builder /src/apps/server/dist/opencode-plugins /opt/openwork/opencode-plugins

RUN set -eux; \
  test -n "$OPENCODE_VERSION"; \
  arch="$(dpkg --print-architecture)"; \
  case "$arch" in \
    amd64) asset="opencode-linux-x64-baseline.tar.gz" ;; \
    arm64) asset="opencode-linux-arm64.tar.gz" ;; \
    *) echo "unsupported architecture: $arch" >&2; exit 1 ;; \
  esac; \
  url="$OPENCODE_DOWNLOAD_URL"; \
  if [ -z "$url" ]; then \
    url="https://github.com/anomalyco/opencode/releases/download/v${OPENCODE_VERSION}/${asset}"; \
  fi; \
  tmpdir="$(mktemp -d)"; \
  curl -fsSL "$url" -o "$tmpdir/$asset"; \
  tar -xzf "$tmpdir/$asset" -C "$tmpdir"; \
  binary="$(find "$tmpdir" -type f -name opencode | head -n 1)"; \
  test -n "$binary"; \
  install -m 0755 "$binary" /usr/local/bin/opencode; \
  rm -rf "$tmpdir"

# Runtime asserts run the target-arch binaries. Keep them on in CI (native
# amd64 runners); disable only for local cross-builds, where bun binaries die
# with "Illegal instruction" under qemu-x86_64 even though they run fine on
# real hardware.
ARG RUNTIME_ASSERTS=1
RUN if [ "$RUNTIME_ASSERTS" = "1" ]; then \
    test -f /opt/openwork/opencode-plugins/openwork-extensions-preview.js \
    && test -f /opt/openwork/opencode-plugins/openwork-capabilities-knowledge.js \
    && test -f /opt/openwork/opencode-plugins/openwork-office-attachments.js \
    && test -f /opt/openwork/opencode-plugins/openwork-anthropic-adaptive-thinking.js \
    && test -f /opt/openwork/opencode-plugins/openwork-anthropic-tool-schema.js \
    && test "$(openwork-server --version)" = "$OPENWORK_SERVER_VERSION" \
    && opencode --version; \
  else \
    echo "RUNTIME_ASSERTS disabled (cross-build); binaries must be verified on target hardware"; \
  fi

CMD ["sleep", "infinity"]
