FROM node:24-slim@sha256:a81a03dd965b4052269a57fac857004022b522a4bf06e7a739e25e18bce45af2 AS builder

WORKDIR /app

COPY package.json package-lock.json* ./
RUN npm ci

COPY . .
RUN npm run build

# Run stage
FROM node:24-slim@sha256:a81a03dd965b4052269a57fac857004022b522a4bf06e7a739e25e18bce45af2 AS runner

# Run as non-root user (node user exists in official image)
USER node
WORKDIR /app

ENV HOST=0.0.0.0

# Copy app as node user (builder stage ran as root)
COPY --from=builder --chown=node:node /app/.output ./.output

EXPOSE 3000 8089

CMD ["node", ".output/server/index.mjs"]