FROM node:20-slim

WORKDIR /app

# Install dependencies in their own layer so this only re-runs when
# package*.json actually changes, speeding up rebuilds. Using `npm
# install` rather than `npm ci` since this repo doesn't ship a
# package-lock.json — if you generate one locally (recommended:
# `npm install` once, then commit package-lock.json), switch this to
# `npm ci --omit=dev` for fully reproducible, faster builds.
COPY package*.json ./
RUN npm install --omit=dev

# Copy the rest of the application source
COPY . .

# Hugging Face Spaces (Docker SDK) route external traffic to whatever
# port is declared as "app_port" in the Space's README.md metadata —
# 7860 is Hugging Face's own default, so we match it here. If you set a
# different app_port in your Space's README, update PORT to match.
ENV NODE_ENV=production
ENV PORT=7860
EXPOSE 7860

# Run as the non-root "node" user (built into the official Node image)
# rather than root, as one more layer of defense-in-depth.
RUN chown -R node:node /app
USER node

HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
  CMD node -e "require('http').get('http://localhost:7860/api/health', r => process.exit(r.statusCode === 200 ? 0 : 1)).on('error', () => process.exit(1))"

CMD ["node", "src/server.js"]