# ── Mozimo — TanStack Start (Vite) + PocketBase ─────────────
# Three-stage build:
#   deps    — reproducible dependency install (npm ci, cache-mounted)
#   builder — production build (vite build → dist/)
#   runner  — lean runtime: production deps + dist + a plain Node server
#             and PocketBase, started together by entrypoint.sh
#
# Ports: 3000 = web (SSR), 8090 = PocketBase (cms.<host> → here)

ARG NODE_VERSION=26

# ── deps ────────────────────────────────────────────────────
FROM node:${NODE_VERSION}-trixie-slim AS deps
WORKDIR /app
COPY package.json package-lock.json ./
RUN --mount=type=cache,target=/root/.npm \
    npm ci --no-audit --no-fund

# ── builder ─────────────────────────────────────────────────
FROM node:${NODE_VERSION}-trixie-slim AS builder
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
RUN npm run build

# ── runner ──────────────────────────────────────────────────
FROM node:${NODE_VERSION}-trixie-slim AS runner
LABEL org.opencontainers.image.title="Mozimo" \
    org.opencontainers.image.description="Mozimo — luxury chocolate storefront (TanStack Start + PocketBase headless CMS)"
WORKDIR /app

ARG PB_VERSION=0.40.2
ARG TARGETARCH
RUN apt-get update \
    && apt-get install -y --no-install-recommends unzip ca-certificates \
    && rm -rf /var/lib/apt/lists/* \
    && case "$TARGETARCH" in \
         arm64) PB_ARCH=arm64 ;; \
         arm)   PB_ARCH=arm ;; \
         *)     PB_ARCH=amd64 ;; \
       esac \
    && node -e "const{writeFileSync}=require('fs');fetch('https://github.com/pocketbase/pocketbase/releases/download/v${PB_VERSION}/pocketbase_${PB_VERSION}_linux_${PB_ARCH}.zip').then(r=>{if(!r.ok)throw new Error('download failed: '+r.status);return r.arrayBuffer()}).then(b=>{writeFileSync('/tmp/pb.zip',Buffer.from(b))})" \
    && unzip -o /tmp/pb.zip pocketbase -d /usr/local/bin/ \
    && chmod 0755 /usr/local/bin/pocketbase \
    && rm /tmp/pb.zip \
    && mkdir -p /app/pb_data \
    && chown node:node /app/pb_data

ENV NODE_ENV=production \
    HOST=0.0.0.0 \
    PORT=3000 \
    PB_PORT=8090 \
    PB_URL=http://127.0.0.1:8090 \
    SHOPIFY_TOKEN_CACHE=/app/pb_data/shopify-token.json

# Install production dependencies only (react + @tanstack/* — no vite,
# tailwind, eslint or typescript ship in the runtime image).
COPY package.json package-lock.json ./
RUN --mount=type=cache,target=/root/.npm \
    npm ci --omit=dev --no-audit --no-fund

COPY --from=builder --chown=root:root /app/dist ./dist
COPY --chmod=0644 server.mjs entrypoint.sh scripts/pb-seed.mjs ./

# Run as the unprivileged `node` user shipped with the base image.
USER node

EXPOSE 3000 8090

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
    CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/',{redirect:'manual'}).then(r=>process.exit(r.status<500?0:1)).catch(()=>process.exit(1))"

# entrypoint.sh starts PocketBase + the SSR server and forwards signals.
ENTRYPOINT ["bash", "entrypoint.sh"]