FROM oven/bun:1.4.0 AS source
WORKDIR /app
COPY package.json bun.lock ./
COPY apps/web/package.json apps/web/package.json
COPY apps/worker/package.json apps/worker/package.json
COPY packages/contracts/package.json packages/contracts/package.json
COPY packages/database/package.json packages/database/package.json
COPY packages/email/package.json packages/email/package.json
COPY packages/storage/package.json packages/storage/package.json
RUN bun install --frozen-lockfile --network-concurrency 8
COPY . .

FROM source AS builder
ARG NEXT_PUBLIC_APP_URL
ENV NEXT_PUBLIC_APP_URL=$NEXT_PUBLIC_APP_URL NEXT_TELEMETRY_DISABLED=1
# Build-only placeholders; never copy production secrets into image layers.
RUN DATABASE_URL=postgres://build:build@127.0.0.1:5432/build BETTER_AUTH_SECRET=build-only-placeholder-secret-not-for-runtime BETTER_AUTH_URL=$NEXT_PUBLIC_APP_URL bun run --filter @album/web build

FROM oven/bun:1.4.0 AS web
WORKDIR /app
ENV NODE_ENV=production HOSTNAME=0.0.0.0 PORT=3000 NEXT_TELEMETRY_DISABLED=1
COPY --from=builder --chown=bun:bun /app/apps/web/.next/standalone ./
COPY --from=builder --chown=bun:bun /app/apps/web/.next/static ./apps/web/.next/static
COPY --from=builder --chown=bun:bun /app/apps/web/public ./apps/web/public
COPY --from=builder --chown=bun:bun /app/scripts/check-production-env.ts ./scripts/check-production-env.ts
USER bun
EXPOSE 3000
CMD ["sh", "-c", "bun scripts/check-production-env.ts && exec bun apps/web/server.js"]

FROM source AS worker
ENV NODE_ENV=production
USER bun
CMD ["sh", "-c", "bun scripts/check-production-env.ts && exec bun apps/worker/src/index.ts"]

FROM worker AS migrate
WORKDIR /app/packages/database
CMD ["bun", "src/migrate.ts"]
