# syntax=docker/dockerfile:1.7
# ------- builder stage -------
FROM node:22-alpine AS builder
WORKDIR /app

# corepack ships with node:22; pin pnpm via package.json/engines if needed.
RUN corepack enable

COPY package.json pnpm-lock.yaml* ./
# Allow first-time builds where pnpm-lock.yaml may not exist yet; the
# `|| pnpm install` fallback writes one then proceeds.
RUN pnpm install --frozen-lockfile || pnpm install

COPY tsconfig.json ./
COPY src ./src
RUN pnpm build

# Trim dev dependencies for the runtime image.
RUN pnpm prune --prod

# ------- runtime stage -------
FROM node:22-alpine AS runtime
WORKDIR /app
ENV NODE_ENV=production \
    PORT=3001 \
    DATA_DIR=/app/data

# Run as non-root. node:22-alpine already ships a `node` user (uid 1000).
RUN mkdir -p /app/data && chown -R node:node /app
USER node

COPY --chown=node:node --from=builder /app/node_modules ./node_modules
COPY --chown=node:node --from=builder /app/dist ./dist
COPY --chown=node:node package.json ./

EXPOSE 3001
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD wget -qO- --tries=1 http://127.0.0.1:3001/healthz || exit 1

CMD ["node", "dist/server.js"]
