# MM-Work module tenant container: the TypeScript server plus the module bundle it serves.

# The module bundle. The GitHub Packages token (for @mutmutco/mmwork-ds) arrives as a BuildKit secret
# and is never written into a layer; compose passes it from the registry's requiredBuildSecrets.
FROM node:24-bookworm-slim AS module-build
WORKDIR /module
COPY module/package.json module/package-lock.json module/.npmrc ./
RUN --mount=type=secret,id=NODE_AUTH_TOKEN,env=NODE_AUTH_TOKEN npm ci --no-audit --no-fund
COPY module/src ./src
COPY module/vite.config.mjs ./
RUN npm run build

# The server.
FROM node:24-bookworm-slim AS server-build
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --no-audit --no-fund
COPY tsconfig.json ./
COPY src ./src
RUN npm run build && npm prune --omit=dev

FROM node:24-bookworm-slim AS runtime
WORKDIR /app
ENV NODE_ENV=production
COPY --from=server-build /app/package.json ./package.json
COPY --from=server-build /app/node_modules ./node_modules
COPY --from=server-build /app/dist ./dist
COPY --from=module-build /module/dist/module.js ./module/dist/module.js
USER node
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
CMD ["node", "dist/index.js"]