# Two-stage build needing ZERO outbound network at image-build time:
# (a) deps are installed by the CI job / dev host (`bun install`) and copied in via the
#     build context — the runner's dind daemon has broken outbound DNS for build containers,
#     so any RUN that fetches packages fails;
# (b) base images must be glibc (node:22-slim), NOT alpine/musl: native modules (@next/swc-*)
#     are prebuilt for the platform that ran `bun install` — CI job and prod host are
#     x86_64 glibc linux. Building on another platform requires reinstalling node_modules there first.
FROM node:22-slim AS build
WORKDIR /app
COPY package.json bun.lock ./
COPY node_modules ./node_modules
COPY . .
ENV NEXT_TELEMETRY_DISABLED=1
RUN npm run build

# No `output: 'standalone'`: the runtime stage keeps node_modules because sql.js is kept
# external (next.config.ts serverExternalPackages) and require('sql.js') resolves its WASM
# blob from node_modules at runtime.
FROM node:22-slim AS runtime
WORKDIR /app
ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1
# Full tree (dev+prod deps): a prod-only slimmed copy would need an extra install step,
# revisit if image size matters.
COPY --from=build /app/node_modules ./node_modules
COPY --from=build /app/.next ./.next
COPY --from=build /app/package.json ./package.json
EXPOSE 3000
CMD ["npm", "run", "start"]