# KNELPDF - TSYS Group fleet document-production system.
# "Document production across all outputs": PDF (xelatex/lualatex/typst/
# weasyprint), books (mdbook), sites (hugo), papers/slides (quarto),
# diagrams (mermaid via headless chromium, plantuml, graphviz, gnuplot).
#
# NO Node.js (founder ruling 2026-09-07): mermaid renders through bundled
# mermaid.min.js + headless chromium, not mermaid-cli. Quarto is a
# self-contained binary (bundles its own Deno) - accepted as "not
# Node.js"; veto by deleting layer 4b's quarto lines if not.
#
# Layer order: least-changing at the bottom, most-volatile at the top.
# Bump a pin = edit its ARG, rebuild; layers above rebuild, below don't.

FROM debian:bookworm-slim@sha256:88200866dfff7ea7f5cbcb6ec7c8a701889efe6fe859fe64d6990e4b07ea4171

ARG PANDOC_VERSION=3.11
ARG PANDOC_DEB=pandoc-3.11-1-amd64.deb
ARG QUARTO_VERSION=1.10.18
ARG QUARTO_DEB=quarto-1.10.18-linux-amd64.deb
ARG TYPST_VERSION=0.15.1
ARG HUGO_VERSION=0.165.0
ARG MDBOOK_VERSION=0.5.4
ARG MDBOOK_MERMAID_VERSION=0.17.1
ARG PLANTUML_VERSION=1.2026.8
ARG MERMAID_VERSION=11.17.2
ARG REVEALJS_VERSION=6.0.1
ARG EISVOGEL_VERSION=3.5.1
ARG WEASYPRINT_VERSION=69.0

# --- layer 2: system packages, fonts, charting, python runtime ----------
RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      ca-certificates curl xz-utils unzip zip jq \
      chromium \
      default-jre-headless \
      fonts-dejavu fonts-noto-core fonts-liberation fonts-lato \
      graphviz gnuplot-nox librsvg2-bin \
      qpdf ghostscript \
      python3 python3-pip python3-venv \
      libpango-1.0-0 libpangoft2-1.0-0 \
 && rm -rf /var/lib/apt/lists/*

# --- layer 3: texlive-full (every feature; huge, rarely changes) --------
RUN apt-get update \
 && apt-get install -y --no-install-recommends texlive-full \
 && rm -rf /var/lib/apt/lists/*

# --- layer 4a: weasyprint (python venv, pinned) -------------------------
RUN python3 -m venv /opt/weasy \
 && /opt/weasy/bin/pip install --no-cache-dir "weasyprint==${WEASYPRINT_VERSION}" \
 && ln -s /opt/weasy/bin/weasyprint /usr/local/bin/weasyprint

# --- layer 4b: pandoc + quarto (deb-installed, self-contained) ----------
RUN apt-get update \
 && curl -fsSL -o /tmp/pandoc.deb \
      "https://github.com/jgm/pandoc/releases/download/${PANDOC_VERSION}/${PANDOC_DEB}" \
 && curl -fsSL -o /tmp/quarto.deb \
      "https://github.com/quarto-dev/quarto-cli/releases/download/v${QUARTO_VERSION}/${QUARTO_DEB}" \
 && apt-get install -y /tmp/pandoc.deb /tmp/quarto.deb \
 && rm -f /tmp/pandoc.deb /tmp/quarto.deb \
 && rm -rf /var/lib/apt/lists/*

# --- layer 4c: single-binary downloads (rust/go) ------------------------
RUN curl -fsSL "https://github.com/typst/typst/releases/download/v${TYPST_VERSION}/typst-x86_64-unknown-linux-musl.tar.xz" \
      | tar xJ -C /tmp \
 && mv /tmp/typst-x86_64-unknown-linux-musl/typst /usr/local/bin/typst \
 && curl -fsSL "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-amd64.tar.gz" \
      | tar xz -C /tmp hugo \
 && mv /tmp/hugo /usr/local/bin/hugo \
 && curl -fsSL "https://github.com/rust-lang/mdbook/releases/download/v${MDBOOK_VERSION}/mdbook-v${MDBOOK_VERSION}-x86_64-unknown-linux-gnu.tar.gz" \
      | tar xz -C /usr/local/bin mdbook \
 && curl -fsSL "https://github.com/badboy/mdbook-mermaid/releases/download/v${MDBOOK_MERMAID_VERSION}/mdbook-mermaid-v${MDBOOK_MERMAID_VERSION}-x86_64-unknown-linux-gnu.tar.gz" \
      | tar xz -C /usr/local/bin mdbook-mermaid \
 && rm -rf /tmp/typst-x86_64-unknown-linux-musl

# --- layer 4d: web/diagram assets (jar, js, template) -------------------
RUN mkdir -p /opt/plantuml /opt/mermaid /opt/reveal.js /usr/local/share/pandoc/templates \
 && curl -fsSL -o /opt/plantuml/plantuml.jar \
      "https://github.com/plantuml/plantuml/releases/download/v${PLANTUML_VERSION}/plantuml-${PLANTUML_VERSION}.jar" \
 && printf '#!/bin/sh\nexec java -jar /opt/plantuml/plantuml.jar "$@"\n' \
      > /usr/local/bin/plantuml && chmod +x /usr/local/bin/plantuml \
 && curl -fsSL "https://registry.npmjs.org/mermaid/-/mermaid-${MERMAID_VERSION}.tgz" \
      | tar xz -C /tmp package/dist/mermaid.min.js \
 && mv /tmp/package/dist/mermaid.min.js /opt/mermaid/mermaid.min.js \
 && curl -fsSL -o /tmp/reveal.zip \
      "https://github.com/hakimel/reveal.js/releases/download/${REVEALJS_VERSION}/reveal.js-${REVEALJS_VERSION}.zip" \
 && unzip -q /tmp/reveal.zip -d /tmp/rv \
 && if [ -d "/tmp/rv/reveal.js-${REVEALJS_VERSION}" ]; then \
      mv "/tmp/rv/reveal.js-${REVEALJS_VERSION}"/* /opt/reveal.js/; \
    else mv /tmp/rv/* /opt/reveal.js/; fi \
 && rm -rf /tmp/reveal.zip /tmp/rv /tmp/package \
 && curl -fsSL -o /usr/local/share/pandoc/templates/eisvogel.latex \
      "https://raw.githubusercontent.com/Wandmalfarbe/pandoc-latex-template/v${EISVOGEL_VERSION}/eisvogel.latex"

# --- layer 5: local scripts (most volatile) -----------------------------
COPY scripts/knelpdf-mermaid /usr/local/bin/knelpdf-mermaid
RUN chmod +x /usr/local/bin/knelpdf-mermaid

# Fleet rule: NO ENTRYPOINT - keeps `sh -c` composition working.
CMD ["pandoc", "--version"]