build: esmole Dockerfile

Build from repo root so @dbmole/core resolves; tsup bundles core into
dist while undici/MCP SDK/zod/ssh2 ship as pruned node_modules.

Mark ssh2 external in tsup: it is pulled in transitively by the bundled
core and ships an optional native crypto addon (pure-JS fallback). Inlining
would force esbuild to resolve a .node binary that need not exist on the
target; node-gyp also cannot reliably build it on alpine. Externalizing lets
ssh2 resolve from node_modules at runtime.

npm nests undici under packages/esmole-mcp/node_modules, so the runtime
stage copies both the root and the per-package node_modules.

.dockerignore

@@ -0,0 +1,8 @@
+**/node_modules
+**/dist
+**/coverage
+.git
+docs
+.remember
+**/test
+*.md

packages/esmole-mcp/Dockerfile

@@ -0,0 +1,27 @@
+# build stage — install the whole workspace so @dbmole/core resolves, build esmole
+FROM node:22-alpine AS build
+WORKDIR /repo
+COPY package.json package-lock.json tsconfig.base.json ./
+COPY packages/core/package.json packages/core/
+COPY packages/dbmole-mcp/package.json packages/dbmole-mcp/
+COPY packages/esmole-mcp/package.json packages/esmole-mcp/
+RUN npm ci
+COPY packages/core packages/core
+COPY packages/esmole-mcp packages/esmole-mcp
+# tsup bundles @dbmole/core into dist (noExternal); the remaining runtime deps
+# (undici, MCP SDK, zod, ssh2) stay external and are served from node_modules.
+RUN npm run build --workspace esmole-mcp && npm prune --omit=dev
+
+# runtime stage — dist (core bundled in) + pruned production node_modules
+FROM node:22-alpine AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+# Root hoists most prod deps (MCP SDK, zod, ssh2); npm nests a few per-package
+# (undici). Copy both so every external the bundle requires resolves under
+# /app/node_modules at runtime.
+COPY --from=build /repo/node_modules ./node_modules
+COPY --from=build /repo/packages/esmole-mcp/node_modules ./node_modules
+COPY --from=build /repo/packages/esmole-mcp/dist ./dist
+RUN mkdir -p /home/node/.config/esmole && chown -R node:node /home/node/.config
+USER node
+ENTRYPOINT ["node", "dist/index.js"]

packages/esmole-mcp/tsup.config.ts

@@ -6,5 +6,10 @@ export default defineConfig({
     target: 'node20',
     clean: true,
     noExternal: [/@dbmole\/core/],
+    // ssh2 (pulled in transitively by the bundled @dbmole/core) ships a native
+    // crypto addon with a pure-JS fallback. Keep it external so esbuild never
+    // tries to inline its optional .node binary, which need not exist on the
+    // target. ssh2 resolves from node_modules at runtime and falls back to JS.
+    external: ['ssh2'],
     banner: { js: '#!/usr/bin/env node' }
 })