# ── Mozimo — TanStack Start (Vite) ──────────────────────────
# Three-stage build:
#   deps    — reproducible dependency install (npm ci, cache-mounted)
#   builder — production build (vite build → dist/)
#   runner  — lean runtime: production deps + dist + a plain Node server
#             (no build tooling ships in the final image)

ARG NODE_VERSION=24

# ── deps ────────────────────────────────────────────────────
FROM node:${NODE_VERSION}-trixie-slim AS deps
WORKDIR /app
COPY package.json package-lock.json ./
RUN --mount=type=cache,target=/root/.npm \
    npm ci --no-audit --no-fund

# ── builder ─────────────────────────────────────────────────
FROM node:${NODE_VERSION}-trixie-slim AS builder
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
RUN npm run build

# ── runner ──────────────────────────────────────────────────
FROM node:${NODE_VERSION}-trixie-slim AS runner
LABEL org.opencontainers.image.title="Mozimo" \
      org.opencontainers.image.description="Mozimo — luxury chocolate storefront (TanStack Start + Vite)"
WORKDIR /app

ENV NODE_ENV=production \
    HOST=0.0.0.0 \
    PORT=3000

# Install production dependencies only (react + @tanstack/* — no vite,
# tailwind, eslint or typescript ship in the runtime image).
# The cache mount never lands in image layers, so no cache cleaning needed.
COPY package.json package-lock.json ./
RUN --mount=type=cache,target=/root/.npm \
    npm ci --omit=dev --no-audit --no-fund

COPY --from=builder --chown=root:root /app/dist ./dist
COPY --chmod=0644 server.mjs ./

# Run as the unprivileged `node` user shipped with the base image.
USER node

EXPOSE 3000

HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
  CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/',{redirect:'manual'}).then(r=>process.exit(r.status<500?0:1)).catch(()=>process.exit(1))"

# Exec form: node runs as PID 1 and server.mjs handles SIGTERM gracefully.
CMD ["node", "server.mjs"]