# Multi-stage build for the SvelteKit (adapter-node) client.
#
# Build context is this `client/` directory. We use `build:docker` (plain
# `vite build`) rather than `build` so the image never needs `../lexicons/`:
# the generated lexicon client under src/lib/lexicon/ is committed, so lexgen
# is unnecessary here.
#
# PUBLIC_API_URL and PUBLIC_SERVICE_DID come from `$env/static/public`, which is
# inlined at BUILD time — they must be passed as build args (see below), not set
# at runtime. At RUNTIME, adapter-node needs ORIGIN set to the app's public URL
# (used for CSRF / form-action origin checks) and honours PORT (default 3000).
#
# Example:
#   docker build -t puzzlemethis-client \
#     --build-arg PUBLIC_API_URL=https://api.example.com \
#     --build-arg PUBLIC_SERVICE_DID=did:web:api.example.com ./client
#   docker run -p 3000:3000 -e ORIGIN=https://puzzles.example.com puzzlemethis-client

# node 24 (npm 11): npm 10 rejects this lockfile — @emnapi/* resolve as
# bundled deps of @tailwindcss/oxide-wasm32-wasi, which npm 10 can't verify.
FROM node:24-slim AS build
WORKDIR /app

# Install deps against the lockfile first for better layer caching.
COPY package.json package-lock.json ./
RUN npm ci

COPY . .

# Baked into the client bundle at build time ($env/static/public).
ARG PUBLIC_API_URL
ARG PUBLIC_SERVICE_DID
ARG PUBLIC_CREATE_ACCOUNT_PDS
ENV PUBLIC_API_URL=$PUBLIC_API_URL
ENV PUBLIC_SERVICE_DID=$PUBLIC_SERVICE_DID
ENV PUBLIC_CREATE_ACCOUNT_PDS=$PUBLIC_CREATE_ACCOUNT_PDS


RUN npm run build:docker

# --- runtime image -----------------------------------------------------------
FROM node:24-slim
WORKDIR /app
ENV NODE_ENV=production

# Only production dependencies are needed to run `node build`.
COPY package.json package-lock.json ./
RUN npm ci --omit=dev

COPY --from=build /app/build ./build

EXPOSE 3000
# ORIGIN must be provided at runtime (e.g. -e ORIGIN=https://puzzles.example.com).
CMD ["node", "build"]
