FROM node:20-slim AS frontend-builder

WORKDIR /usr/src/app/frontend

COPY frontend/package.json frontend/package-lock.json ./
RUN npm ci

COPY frontend/ ./
ARG WEEKEND_WELLNESS_DISABLED_SESSIONS=""
ENV WEEKEND_WELLNESS_DISABLED_SESSIONS=${WEEKEND_WELLNESS_DISABLED_SESSIONS}
ENV NODE_OPTIONS=--max_old_space_size=2048
RUN npm run build
RUN test -f /usr/src/app/frontend/out/eventflow/wellness-weekends.html \
    || test -f /usr/src/app/frontend/out/eventflow/wellness-weekends/index.html
RUN test -f /usr/src/app/frontend/out/index.html


FROM node:20-slim AS backend-deps

WORKDIR /usr/src/app

RUN apt-get update && apt-get install -y --no-install-recommends \
      python3 make g++ \
    && rm -rf /var/lib/apt/lists/*

COPY package.json package-lock.json ./
RUN npm ci --omit=dev


FROM node:20-slim AS python-deps

WORKDIR /usr/src/app

RUN apt-get update && apt-get install -y --no-install-recommends \
      python3 python3-pip curl ca-certificates libgomp1 \
    && rm -rf /var/lib/apt/lists/*

# Python Real-ESRGAN via PyTorch CPU. Keep this isolated from the web runtime
# build so frontend/backend toolchains do not bloat the final image layers.
RUN pip3 install --no-cache-dir --break-system-packages \
      torch --index-url https://download.pytorch.org/whl/cpu \
    && pip3 install --no-cache-dir --break-system-packages \
      basicsr realesrgan

RUN mkdir -p /usr/local/share/realesrgan-python/models \
    && ( \
         curl -fsSL --retry 3 \
           "https://github.com/xinntao/Real-ESRGAN/releases/download/v0.2.5.0/RealESRGAN_x2plus.pth" \
           -o /usr/local/share/realesrgan-python/models/RealESRGAN_x2plus.pth \
         && curl -fsSL --retry 3 \
           "https://github.com/xinntao/Real-ESRGAN/releases/download/v0.2.2.4/RealESRGAN_x4plus_anime_6B.pth" \
           -o /usr/local/share/realesrgan-python/models/RealESRGAN_x4plus_anime_6B.pth \
         && echo "✅ Real-ESRGAN PyTorch models downloaded" \
       ) || echo "⚠️  Real-ESRGAN model download failed — upscaling will fall back to Lanczos3"


FROM node:20-slim

WORKDIR /usr/src/app

RUN apt-get update && apt-get install -y --no-install-recommends \
      python3 python3-pip curl ca-certificates ffmpeg libgomp1 \
    && rm -rf /var/lib/apt/lists/*

# Install AWS RDS CA bundle for TLS verification.
RUN curl -fsSL https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem \
  -o /usr/local/share/ca-certificates/rds-ca-bundle.crt \
  && curl -fsSL https://truststore.pki.rds.amazonaws.com/ap-southeast-1/ap-southeast-1-bundle.pem \
  -o /usr/local/share/ca-certificates/rds-ca-ap-southeast-1.crt \
  && update-ca-certificates

ENV NODE_ENV=production
ENV NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt
ENV ESRGAN_PYTHON_MODELS_PATH=/usr/local/share/realesrgan-python/models
ENV PORT=8080

# Backend runtime dependencies only. Build-only toolchains stay in backend-deps.
COPY --from=backend-deps /usr/src/app/node_modules ./node_modules
COPY package.json package-lock.json tsconfig.json ./

# Python ML runtime copied from an isolated stage so the final image does not
# also retain frontend tooling and backend build layers.
COPY --from=python-deps /usr/local/lib/python3.11 /usr/local/lib/python3.11
COPY --from=python-deps /usr/local/share/realesrgan-python/models /usr/local/share/realesrgan-python/models

# Frontend runtime assets only. The final image does not include frontend
# source or frontend/node_modules.
COPY --from=frontend-builder /usr/src/app/frontend/out ./frontend/out
COPY --from=frontend-builder /usr/src/app/frontend/public ./frontend/public

COPY index.js .
COPY instrument.js .
COPY webhook.js .
COPY db.js .
COPY swagger.js .
COPY agents/ ./agents/
COPY lib/ ./lib/
COPY routes/ ./routes/
COPY middleware/ ./middleware/
COPY validation/ ./validation/
COPY services/ ./services/
COPY utils/ ./utils/
COPY tools/ ./tools/
COPY public/ ./public/
COPY knowledge/ ./knowledge/
COPY infrastructure/ ./infrastructure/
COPY use-cases/ ./use-cases/
COPY data/ ./data/

RUN mkdir -p /tmp/dropbox-downloads /tmp/excel-exports \
    && mkdir -p /usr/src/app/use-cases/event-checkin/data

# Back up static tedx-xinyi assets so the entrypoint can seed the persistent
# volume on first mount without losing built-in files.
RUN cp -r /usr/src/app/frontend/public/tedx-xinyi /usr/src/app/tedx-xinyi-static

COPY entrypoint.sh /usr/src/app/entrypoint.sh
RUN chmod +x /usr/src/app/entrypoint.sh

EXPOSE 8080

HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
  CMD node -e "require('http').get('http://127.0.0.1:8080/health', (r) => { process.exit(r.statusCode === 200 ? 0 : 1); }).on('error', () => process.exit(1))"

ENTRYPOINT ["/usr/src/app/entrypoint.sh"]
CMD ["node", "index.js"]