# Native helpers (frame gate + source bus): std-only Rust, built reproducibly on a pinned toolchain
# (apps/media-worker/scripts/build-helpers.sh; same rustc ⇒ same SHA256SUMS). musl on Alpine, so
# the binaries are static and need nothing from the runtime image.
FROM rust:1.97.1-alpine AS helpers
WORKDIR /build
COPY apps/media-worker/src/gate/rust apps/media-worker/src/gate/rust
COPY apps/media-worker/scripts/build-helpers.sh apps/media-worker/scripts/build-helpers.sh
RUN sh apps/media-worker/scripts/build-helpers.sh /out

FROM node:22-alpine
WORKDIR /app
RUN corepack enable
RUN apk add --no-cache ffmpeg font-dejavu \
  && mkdir -p /usr/share/fonts/truetype/dejavu \
  && ln -sf "$(find /usr/share/fonts -name 'DejaVuSans-Bold.ttf' | head -1)" /usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf
COPY pnpm-workspace.yaml package.json tsconfig.base.json ./
COPY apps/media-worker/package.json apps/media-worker/
RUN pnpm install --filter @tactical-media-broadcast-hub/media-worker... --no-frozen-lockfile
COPY apps/media-worker apps/media-worker
COPY --from=helpers /out /opt/media-helpers
# src/gate/binary.ts resolves the helpers here; nothing is compiled at runtime.
ENV MEDIA_HELPER_DIR=/opt/media-helpers
CMD ["pnpm", "--filter", "@tactical-media-broadcast-hub/media-worker", "dev"]