From 4dc208954786b2c3b36dfa38215d5bbc989cd6ce Mon Sep 17 00:00:00 2001
From: Evgeny Gamov <smartass@smartass.pw>
Date: Tue, 16 Jun 2026 21:38:41 +0500
Subject: [PATCH] build: esmole Dockerfile

Build from repo root so @dbmole/core resolves; tsup bundles core into
dist while undici/MCP SDK/zod/ssh2 ship as pruned node_modules.

Mark ssh2 external in tsup: it is pulled in transitively by the bundled
core and ships an optional native crypto addon (pure-JS fallback). Inlining
would force esbuild to resolve a .node binary that need not exist on the
target; node-gyp also cannot reliably build it on alpine. Externalizing lets
ssh2 resolve from node_modules at runtime.

npm nests undici under packages/esmole-mcp/node_modules, so the runtime
stage copies both the root and the per-package node_modules.
---
 .dockerignore                      |  8 ++++++++
 packages/esmole-mcp/Dockerfile     | 27 +++++++++++++++++++++++++++
 packages/esmole-mcp/tsup.config.ts |  5 +++++
 3 files changed, 40 insertions(+)
 create mode 100644 .dockerignore
 create mode 100644 packages/esmole-mcp/Dockerfile

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..1eb56ce
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,8 @@
+**/node_modules
+**/dist
+**/coverage
+.git
+docs
+.remember
+**/test
+*.md
diff --git a/packages/esmole-mcp/Dockerfile b/packages/esmole-mcp/Dockerfile
new file mode 100644
index 0000000..da53ba9
--- /dev/null
+++ b/packages/esmole-mcp/Dockerfile
@@ -0,0 +1,27 @@
+# build stage — install the whole workspace so @dbmole/core resolves, build esmole
+FROM node:22-alpine AS build
+WORKDIR /repo
+COPY package.json package-lock.json tsconfig.base.json ./
+COPY packages/core/package.json packages/core/
+COPY packages/dbmole-mcp/package.json packages/dbmole-mcp/
+COPY packages/esmole-mcp/package.json packages/esmole-mcp/
+RUN npm ci
+COPY packages/core packages/core
+COPY packages/esmole-mcp packages/esmole-mcp
+# tsup bundles @dbmole/core into dist (noExternal); the remaining runtime deps
+# (undici, MCP SDK, zod, ssh2) stay external and are served from node_modules.
+RUN npm run build --workspace esmole-mcp && npm prune --omit=dev
+
+# runtime stage — dist (core bundled in) + pruned production node_modules
+FROM node:22-alpine AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+# Root hoists most prod deps (MCP SDK, zod, ssh2); npm nests a few per-package
+# (undici). Copy both so every external the bundle requires resolves under
+# /app/node_modules at runtime.
+COPY --from=build /repo/node_modules ./node_modules
+COPY --from=build /repo/packages/esmole-mcp/node_modules ./node_modules
+COPY --from=build /repo/packages/esmole-mcp/dist ./dist
+RUN mkdir -p /home/node/.config/esmole && chown -R node:node /home/node/.config
+USER node
+ENTRYPOINT ["node", "dist/index.js"]
diff --git a/packages/esmole-mcp/tsup.config.ts b/packages/esmole-mcp/tsup.config.ts
index 2ac4f6c..e482f43 100644
--- a/packages/esmole-mcp/tsup.config.ts
+++ b/packages/esmole-mcp/tsup.config.ts
@@ -6,5 +6,10 @@ export default defineConfig({
     target: 'node20',
     clean: true,
     noExternal: [/@dbmole\/core/],
+    // ssh2 (pulled in transitively by the bundled @dbmole/core) ships a native
+    // crypto addon with a pure-JS fallback. Keep it external so esbuild never
+    // tries to inline its optional .node binary, which need not exist on the
+    // target. ssh2 resolves from node_modules at runtime and falls back to JS.
+    external: ['ssh2'],
     banner: { js: '#!/usr/bin/env node' }
 })