# tcef-notifications — imagen de producción (fase 3, Docker Compose).
# Multi-stage: build TS con devDeps, runtime solo con deps de producción.
# Secretos SIEMPRE por entorno/ficheros montados — nunca dentro de la imagen.

FROM node:22-alpine AS build
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci
COPY tsconfig.json ./
COPY scripts ./scripts
COPY src ./src
RUN npm run build && npm prune --omit=dev

FROM node:22-alpine
ENV NODE_ENV=production
WORKDIR /app
COPY --from=build --chown=node:node /app/node_modules ./node_modules
COPY --from=build --chown=node:node /app/dist ./dist
COPY --chown=node:node package.json ./
USER node
# Deuda: el servicio no expone endpoint HTTP de salud; healthcheck por proceso.
HEALTHCHECK --interval=30s --timeout=5s --start-period=15s \
  CMD pgrep -f "dist/index.js" > /dev/null || exit 1
CMD ["node", "--enable-source-maps", "dist/index.js"]