# Build stage: install all deps (build needs onnxruntime-web files from
# node_modules) and emit the self-contained dist/ (scripts/build.ts).
FROM oven/bun:1 AS build
WORKDIR /app

COPY package.json bun.lock bunfig.toml ./
RUN bun install --frozen-lockfile

COPY src ./src
COPY scripts ./scripts
RUN bun run build

# Runtime stage: production deps only. src/ and scripts/ are still needed —
# src/index.ts is the server entrypoint and imports scripts/generate-icons.
FROM oven/bun:1 AS runtime
WORKDIR /app
ENV NODE_ENV=production
ENV DB_PATH=/app/data/app.db
# Runtime feature flags (D-015) — override at `docker run -e` / compose time.
# AUTH_ENABLED=false disables login/register (the auth API 404s and the
# client hides the Sign in UI). Defaults to enabled.
ENV AUTH_ENABLED=true

COPY package.json bun.lock bunfig.toml ./
RUN bun install --frozen-lockfile --production

COPY src ./src
COPY scripts ./scripts
COPY --from=build /app/dist ./dist

# SQLite lives under /app/data — mount a volume there to persist users/sessions.
RUN mkdir -p /app/data && chown -R bun:bun /app/data
USER bun

ENV PORT=3000
EXPOSE $PORT
CMD ["bun", "src/index.ts"]