indraq_cli 2.1.0 → 2.2.0

package/CHANGELOG_v2.1.0.md

@@ -1,27 +1,27 @@
-# IndraQ CLI v2.1.0
-
-## Highlights
-
-- Added unlimited named provider scopes for AWS, NPM, Jenkins DEV/PROD and GHCR.
-- Provider scopes are organization-owned and created only by admins.
-- Added USE/MANAGE scope membership with manager-limited delegation.
-- User creation now asks which manageable scopes to provision and supports multiple scopes at once.
-- Users see only assigned scopes and can safely describe account/server metadata without secrets.
-- Added per-user provider defaults and per-project/environment scope links.
-- Added self-service AWS key rotation and NPM/Jenkins password rotation.
-- Added audited scope add/remove/default/credential operations with mandatory reasons.
-- Jenkins project access uses exact Role Strategy Item Roles with Discover/Read/Build/Cancel/Workspace only.
-- Jenkins + GHCR are mandatory for deploy; Route53 and NPM are optional.
-- Optional DNS/NPM supports Skip, Create/reconcile and Link existing.
-- `--env` is explicitly an IndraQ project/resource environment selector, not a `.env` loader.
-- Cloud API endpoint changed to `https://cli.indraq.com`.
-- NPM networking/TLS/auth errors provide actionable diagnostics instead of only `fetch failed`.
-- Rewritten README and command help around the scope model.
-
-## Database
-
-Adds `cloud-api/sql/008_provider_scopes.sql`.
-
-## Compatibility
-
-`indraq provider configure` remains as an admin compatibility alias for `indraq scope create`.
+# IndraQ CLI v2.1.0
+
+## Highlights
+
+- Added unlimited named provider scopes for AWS, NPM, Jenkins DEV/PROD and GHCR.
+- Provider scopes are organization-owned and created only by admins.
+- Added USE/MANAGE scope membership with manager-limited delegation.
+- User creation now asks which manageable scopes to provision and supports multiple scopes at once.
+- Users see only assigned scopes and can safely describe account/server metadata without secrets.
+- Added per-user provider defaults and per-project/environment scope links.
+- Added self-service AWS key rotation and NPM/Jenkins password rotation.
+- Added audited scope add/remove/default/credential operations with mandatory reasons.
+- Jenkins project access uses exact Role Strategy Item Roles with Discover/Read/Build/Cancel/Workspace only.
+- Jenkins + GHCR are mandatory for deploy; Route53 and NPM are optional.
+- Optional DNS/NPM supports Skip, Create/reconcile and Link existing.
+- `--env` is explicitly an IndraQ project/resource environment selector, not a `.env` loader.
+- Cloud API endpoint changed to `https://cli.indraq.com`.
+- NPM networking/TLS/auth errors provide actionable diagnostics instead of only `fetch failed`.
+- Rewritten README and command help around the scope model.
+
+## Database
+
+Adds `cloud-api/sql/008_provider_scopes.sql`.
+
+## Compatibility
+
+`indraq provider configure` remains as an admin compatibility alias for `indraq scope create`.

package/CHANGELOG_v2.2.0.md

@@ -0,0 +1,52 @@
+# IndraQ CLI v2.2.0
+
+## Scope-first deployment completion
+
+- Prebuild now requires shared admin-created environments; the project-local custom IPv4 deployment target path was removed.
+- `prebuild` no longer exposes legacy `--host-port`, `--networks`, `--volumes`, or `--flags` options.
+- Required GHCR and Jenkins scopes are linked to `project_environment_scopes` during setup and reused afterwards.
+- `indraq deploy --env <env>` uses saved scope bindings without prompting on every deployment.
+- `--select-scopes` is the explicit deployment-time override.
+
+## Credential security
+
+- `USE` members can no longer resolve the organization AWS/NPM/Jenkins management credential.
+- AWS resolution returns the user's own IndraQ-managed IAM access key.
+- NPM/Jenkins resolution returns the user's own encrypted native-account password.
+- AWS key rotation and NPM/Jenkins password rotation are performed server-side with the scope management credential.
+- GHCR remains a deliberate shared deployment credential scoped to assigned members and used by the CLI through an isolated temporary Docker login.
+
+## Projects and authorization
+
+- Managers are no longer implicit WRITE users for every organization project.
+- Non-admin project visibility is limited to the creator or explicit project membership.
+- Added `project rename`, `project archive`, `project restore`, and permanent `project delete`.
+- Archived projects are blocked from scope mutation, infrastructure mutation, credential resolution for deployment, prebuild, and deploy until restored.
+- Manager resource-grant inspection is limited to projects the manager can actually manage.
+
+## User/scope operations
+
+- Added `indraq user scopes [username]`.
+- NPM/Jenkins scope-native account records now retain the user's encrypted password for personal resolution and self-rotation.
+- Existing Jenkins Role Strategy Item Role synchronization remains the project-pipeline authorization mechanism.
+
+## Database
+
+Added `cloud-api/sql/009_scope_user_secrets_and_project_lifecycle.sql`:
+
+- `scope_external_accounts.encrypted_secret`
+- `projects.archived_at`
+- `projects.archived_by`
+
+## Strict TypeScript build compatibility fix — 2026-09-10
+
+- Fixed 12 `exactOptionalPropertyTypes` build errors reported with the real AWS SDK 3.1123.0 declarations.
+- Removed hand-written callback parameter shapes for AWS SDK `ResourceRecord`, `Tag`, `HostedZone`, and `AttachedPolicy` values and now let TypeScript infer the SDK-native callback types.
+- Affected files:
+  - `src/modules/aws/commands/dns.command.ts`
+  - `src/modules/aws/commands/healthcheck.command.ts`
+  - `src/modules/aws/services/route53-lookup.service.ts`
+  - `src/modules/prebuild/commands/prebuild.command.ts`
+  - `src/modules/scopes/commands/scope.command.ts`
+  - `src/modules/users/providers/aws-user.provider.ts`
+- Runtime behavior is unchanged; this is a source/type compatibility correction.

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 IndraQ Innovations
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 IndraQ Innovations
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -5,7 +5,7 @@
 
   **One CLI for provider access, project infrastructure and deployments.**
 
-  ![version](https://img.shields.io/badge/version-2.1.0-blue)
+  ![version](https://img.shields.io/badge/version-2.2.0-blue)
   ![node](https://img.shields.io/badge/Node.js-%3E%3D22-green)
   ![typescript](https://img.shields.io/badge/TypeScript-5.x-blue)
   ![license](https://img.shields.io/badge/license-MIT-lightgrey)
@@ -19,7 +19,7 @@
 
 IndraQ is an internal engineering CLI that connects your team to shared infrastructure without making every developer carry organization administrator credentials.
 
-Instead of configuring “one AWS”, “one Jenkins”, or “one NPM” globally, v2.1 introduces **provider scopes**. A scope is one named account or server such as:
+Instead of configuring “one AWS”, “one Jenkins”, or “one NPM” globally, v2.2 uses **provider scopes** as the only normal deployment credential path. A scope is one named account or server such as:
 
 - `AWS — IndraQ Production`
 - `AWS — Client ABC`
@@ -55,7 +55,7 @@ flowchart LR
 
 Teams often manage several servers, customers and cloud accounts at once. A single provider credential creates ambiguity and unnecessary privilege. Scopes solve both problems.
 
-| Problem | v2.1 behavior |
+| Problem | v2.2 behavior |
 |---|---|
 | Several AWS accounts | Unlimited named AWS scopes |
 | Several Jenkins servers | Unlimited named DEV/PROD Jenkins scopes |
@@ -228,7 +228,13 @@ indraq prebuild --env dev
 ```bash
 indraq deploy:dev
 # or
-indraq deploy build --env staging
+indraq deploy --env staging
+```
+
+Normal deploys reuse the scopes already saved for that project/environment. Use `--select-scopes` only when you intentionally want to review or change those bindings:
+
+```bash
+indraq deploy --env dev --select-scopes
 ```
 
 ---
@@ -352,7 +358,7 @@ indraq project scopes --env prod
 
 ## Prebuild and deploy
 
-`prebuild` reconciles the project before deployment.
+`prebuild` reconciles the project before deployment. It uses an admin-defined shared environment and saved project scope bindings; it does not offer a project-local custom IPv4 fallback.
 
 ```mermaid
 flowchart TD
@@ -398,9 +404,9 @@ This is useful for projects that existed before IndraQ or where DNS/proxy is man
 ## What `--env` means
 
 ```bash
-indraq deploy build --env dev
-indraq deploy build --env staging
-indraq deploy build --env prod
+indraq deploy --env dev
+indraq deploy --env staging
+indraq deploy --env prod
 ```
 
 The flag selects **IndraQ resource state**:
@@ -523,6 +529,7 @@ Provider identities are removed first. Cloud identity is deleted last. Projects
 | Command | Use |
 |---|---|
 | `indraq user list` | List organization users |
+| `indraq user scopes [email]` | Show your own or a manageable user's assigned scopes |
 | `indraq user create [username]` | Create user + select scopes |
 | `indraq user update [username]` | Password/role operations |
 | `indraq user delete [username]` | Hard delete after scope cleanup |
@@ -540,6 +547,10 @@ Provider identities are removed first. Cloud identity is deleted last. Projects
 | `indraq project scopes --env <env>` | Select project provider scopes |
 | `indraq project add user` | Add project member + synchronize access |
 | `indraq project delete user` | Remove project member |
+| `indraq project rename [name]` | Rename the current project |
+| `indraq project archive` | Archive the current project and block normal deployment access |
+| `indraq project restore` | Restore an archived project |
+| `indraq project delete` | Permanently delete current project metadata |
 | `indraq access add user` | Add selected resource grants |
 | `indraq access delete user` | Remove selected resource grants |
 
@@ -550,7 +561,8 @@ Provider identities are removed first. Cloud identity is deleted last. Projects
 | `indraq prebuild --env <env>` | Reconcile infrastructure |
 | `indraq deploy:dev` | Dev deploy |
 | `indraq deploy:prod` | Prod deploy |
-| `indraq deploy build --env <env>` | Named environment deploy |
+| `indraq deploy --env <env>` | Named environment deploy using saved scope bindings |
+| `indraq deploy --env <env> --select-scopes` | Explicitly review/change project scope bindings before deploy |
 | `indraq jenkins pipelines --stage dev` | List visible pipelines |
 | `indraq jenkins run [job] --stage dev` | Run pipeline with discovered parameters |
 | `indraq jenkins create-deployment` | Bootstrap deployment pipeline |
@@ -633,7 +645,7 @@ Key rules:
 
 ### `fetch failed` while configuring NPM
 
-v2.1 surfaces the underlying network/TLS/authentication error where possible. Verify the URL uses the correct scheme and hostname, then compare with the web login. A browser login does not necessarily prove Node.js trusts the same TLS certificate chain.
+v2.2 surfaces the underlying network/TLS/authentication error where possible. Verify the URL uses the correct scheme and hostname, then compare with the web login. A browser login does not necessarily prove Node.js trusts the same TLS certificate chain.
 
 ### Jenkins says Role Strategy is not active
 
@@ -661,7 +673,7 @@ Run prebuild and choose **Skip** for Route53.
 
 ---
 
-## Cloud API upgrade for v2.1
+## Cloud API upgrade for v2.2
 
 The CLI and Cloud API must be upgraded together.
 
@@ -671,11 +683,12 @@ Apply migrations through:
 cloud-api/sql/001_*.sql
 ...
 cloud-api/sql/008_provider_scopes.sql
+cloud-api/sql/009_scope_user_secrets_and_project_lifecycle.sql
 ```
 
-Then build/restart the Cloud API. The v2.1 migration adds provider scopes, memberships, personal defaults, project/environment bindings and scope-native identity mappings.
+Migration `009` adds encrypted per-user NPM/Jenkins secrets and project archive metadata (`archived_at`, `archived_by`). v2.2 also hardens project/resource authorization and prevents normal `USE` members from resolving shared provider-management credentials.
 
-See [UPGRADE_v2.0_to_v2.1.md](UPGRADE_v2.0_to_v2.1.md) for the release checklist.
+See [UPGRADE_v2.1_to_v2.2.md](UPGRADE_v2.1_to_v2.2.md) and [RELEASE_CHECKS_v2.2.0.md](RELEASE_CHECKS_v2.2.0.md).
 
 ---
 
@@ -700,7 +713,7 @@ npm --prefix cloud-api run build
 <div align="center">
   <img src="docs/assets/indraq-mark.png" alt="IndraQ mark" width="70" />
 
-  **IndraQ CLI v2.1.0**
+  **IndraQ CLI v2.2.0**
 
   Scope-based infrastructure access. Durable projects. Safer deployments.
 </div>

package/RELEASE_CHECKS_v2.2.0.md

@@ -0,0 +1,27 @@
+# IndraQ CLI v2.2.0 Release Checks
+
+## Completed in the release workspace
+
+- `npm run build` passed under the project's real strict TypeScript configuration. The sandbox used declaration-only shims for unavailable package typings because DNS could not reach `registry.npmjs.org`; strictness was not disabled for this final build.
+- `npm --prefix cloud-api run build` passed under its real TypeScript configuration using the same temporary declaration-only offline shim approach.
+- `npm test` passed all configured regression suites after rebuilding `dist/`.
+- The prebuild integration regression executes the rebuilt `dist/modules/prebuild/...` implementation and validates create/reuse/repair behavior.
+- v2.2 regression checks cover the scope-secret boundary, personal AWS/NPM/Jenkins credential paths, project membership visibility, archive blocking, project lifecycle commands, saved scope deployment, and Jenkins Item Role preservation.
+- `npm pack --dry-run` completed successfully in the offline build workspace before temporary shims were removed.
+- All emitted CLI + Cloud API JavaScript is syntax-checked during final packaging.
+
+## Publication / deployment gate
+
+On a machine with npm registry access, run one clean dependency-backed verification before publishing:
+
+```bash
+rm -rf node_modules cloud-api/node_modules
+npm ci
+npm --prefix cloud-api ci
+npm run build
+npm run build:cloud
+npm test
+npm pack --dry-run
+```
+
+The registry-access check is an environment/reproducibility gate; it does not change the v2.2 source included in this archive.

package/UPGRADE_v2.0_to_v2.1.md

@@ -1,68 +1,68 @@
-# Upgrade: IndraQ CLI v2.0 → v2.1
-
-v2.1 changes provider credentials from one-user/one-provider assumptions to organization provider scopes.
-
-## 1. Back up Cloud DB
-
-Back up the production IndraQ Cloud database before applying the migration.
-
-## 2. Deploy the v2.1 Cloud API
-
-Apply migrations in numeric order, including:
-
-```text
-cloud-api/sql/008_provider_scopes.sql
-```
-
-Build and restart the Cloud API.
-
-## 3. Install/link CLI v2.1
-
-```bash
-npm install
-npm run build
-npm test
-npm link
-indraq --version
-```
-
-Expected: `2.1.0`.
-
-## 4. Create scopes
-
-Admins create named scopes for each real provider account/server:
-
-```bash
-indraq scope create aws
-indraq scope create npm
-indraq scope create jenkins-dev
-indraq scope create jenkins-prod
-indraq scope create ghcr
-```
-
-## 5. Add managers/users
-
-Use `indraq scope add-user`. Admins may grant MANAGE to managers. Managers may grant USE to normal users only inside scopes they manage.
-
-## 6. Link project environments
-
-For every actively deployed project/environment:
-
-```bash
-indraq project scopes --env dev
-indraq project scopes --env prod
-```
-
-Jenkins and GHCR are required. AWS/NPM can stay unlinked.
-
-## 7. Reconcile
-
-```bash
-indraq prebuild --env dev
-```
-
-For existing DNS/proxy resources choose Link existing or Skip instead of creating duplicates.
-
-## 8. Jenkins
-
-Jenkins must use Role-Based Strategy. IndraQ grants project pipelines through Item Roles; do not manually give normal users Overall/Administer.
+# Upgrade: IndraQ CLI v2.0 → v2.1
+
+v2.1 changes provider credentials from one-user/one-provider assumptions to organization provider scopes.
+
+## 1. Back up Cloud DB
+
+Back up the production IndraQ Cloud database before applying the migration.
+
+## 2. Deploy the v2.1 Cloud API
+
+Apply migrations in numeric order, including:
+
+```text
+cloud-api/sql/008_provider_scopes.sql
+```
+
+Build and restart the Cloud API.
+
+## 3. Install/link CLI v2.1
+
+```bash
+npm install
+npm run build
+npm test
+npm link
+indraq --version
+```
+
+Expected: `2.1.0`.
+
+## 4. Create scopes
+
+Admins create named scopes for each real provider account/server:
+
+```bash
+indraq scope create aws
+indraq scope create npm
+indraq scope create jenkins-dev
+indraq scope create jenkins-prod
+indraq scope create ghcr
+```
+
+## 5. Add managers/users
+
+Use `indraq scope add-user`. Admins may grant MANAGE to managers. Managers may grant USE to normal users only inside scopes they manage.
+
+## 6. Link project environments
+
+For every actively deployed project/environment:
+
+```bash
+indraq project scopes --env dev
+indraq project scopes --env prod
+```
+
+Jenkins and GHCR are required. AWS/NPM can stay unlinked.
+
+## 7. Reconcile
+
+```bash
+indraq prebuild --env dev
+```
+
+For existing DNS/proxy resources choose Link existing or Skip instead of creating duplicates.
+
+## 8. Jenkins
+
+Jenkins must use Role-Based Strategy. IndraQ grants project pipelines through Item Roles; do not manually give normal users Overall/Administer.

package/UPGRADE_v2.1_to_v2.2.md

@@ -0,0 +1,62 @@
+# Upgrade: IndraQ CLI v2.1 → v2.2
+
+Upgrade the CLI and Cloud API together.
+
+## 1. Back up the Cloud database
+
+Take a PostgreSQL backup before deploying the new Cloud API.
+
+## 2. Deploy Cloud API v0.7.0
+
+The Cloud API migration runner automatically applies SQL files in numeric order. On first v0.7.0 startup it will apply:
+
+```text
+009_scope_user_secrets_and_project_lifecycle.sql
+```
+
+This adds encrypted per-user NPM/Jenkins scope secrets and project archive metadata.
+
+## 3. Upgrade the CLI
+
+```bash
+npm install
+npm run build
+npm link
+indraq --version
+```
+
+Expected CLI version: `2.2.0`.
+
+## 4. Re-provision old NPM/Jenkins memberships when necessary
+
+v2.1 scope-native NPM/Jenkins rows did not store a personal encrypted password. If a v2.1 member receives an "identity is not fully provisioned" message after upgrade, a scope manager should remove and re-add that member, or have the member rotate the password after the native account is repaired.
+
+AWS scope credentials already have a dedicated encrypted per-user credential table and do not require this migration step.
+
+## 5. Save project scope bindings
+
+For each environment, run once if bindings are missing:
+
+```bash
+indraq project scopes --env dev
+indraq prebuild --env dev
+```
+
+Normal deploys then use:
+
+```bash
+indraq deploy --env dev
+```
+
+Use `--select-scopes` only when intentionally changing the saved bindings.
+
+## 6. Project lifecycle
+
+```bash
+indraq project rename <name>
+indraq project archive
+indraq project restore
+indraq project delete
+```
+
+Archive blocks infrastructure/deployment mutation until the project is restored. Permanent delete remains manager/admin restricted and requires WRITE access to the project.

package/cloud-api/.dockerignore

@@ -1,18 +1,18 @@
-node_modules
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-pnpm-debug.log*
-*.log
-.git
-.gitignore
-.indraq
-dist
-build
-.next
-coverage
-.cache
-.vite
-.turbo
-.DS_Store
-Thumbs.db
+node_modules
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+*.log
+.git
+.gitignore
+.indraq
+dist
+build
+.next
+coverage
+.cache
+.vite
+.turbo
+.DS_Store
+Thumbs.db

package/cloud-api/.env.example

@@ -1,14 +1,14 @@
-PORT=4010
-DATABASE_URL=postgresql://indraq:change-me@127.0.0.1:5432/indraq_cloud
-JWT_SECRET=replace-with-64-random-characters
-MASTER_KEY=replace-with-64-hex-characters
-BOOTSTRAP_ADMIN_EMAIL=admin@example.com
-BOOTSTRAP_ADMIN_PASSWORD=change-this-immediately
-
-# Password-reset email (required for `indraq password reset`)
-SMTP_HOST=smtp.example.com
-SMTP_PORT=587
-SMTP_SECURE=false
-SMTP_USER=
-SMTP_PASS=
-SMTP_FROM=IndraQ <no-reply@example.com>
+PORT=4010
+DATABASE_URL=postgresql://indraq:change-me@127.0.0.1:5432/indraq_cloud
+JWT_SECRET=replace-with-64-random-characters
+MASTER_KEY=replace-with-64-hex-characters
+BOOTSTRAP_ADMIN_EMAIL=admin@example.com
+BOOTSTRAP_ADMIN_PASSWORD=change-this-immediately
+
+# Password-reset email (required for `indraq password reset`)
+SMTP_HOST=smtp.example.com
+SMTP_PORT=587
+SMTP_SECURE=false
+SMTP_USER=
+SMTP_PASS=
+SMTP_FROM=IndraQ <no-reply@example.com>

package/cloud-api/Dockerfile

@@ -1,19 +1,19 @@
-FROM node:22-alpine AS build
-WORKDIR /myapp
-# Copy the complete project context. .dockerignore controls all exclusions.
-COPY . .
-RUN if [ -f package-lock.json ]; then npm ci; else npm install; fi
-RUN npm run build
-RUN npm prune --omit=dev
-
-FROM node:22-alpine AS runtime
-WORKDIR /myapp
-RUN apk add --no-cache curl
-ENV NODE_ENV=production PORT=4010
-# Copy the complete filtered project from the build stage, including generated
-# build output and production node_modules. No project filenames are guessed.
-COPY --from=build --chown=node:node /myapp ./
-USER node
-EXPOSE 4010
-HEALTHCHECK --interval=30s --timeout=3s CMD curl -fsS http://127.0.0.1:4010/health >/dev/null || exit 1
-CMD ["npm", "start"]
+FROM node:22-alpine AS build
+WORKDIR /myapp
+# Copy the complete project context. .dockerignore controls all exclusions.
+COPY . .
+RUN if [ -f package-lock.json ]; then npm ci; else npm install; fi
+RUN npm run build
+RUN npm prune --omit=dev
+
+FROM node:22-alpine AS runtime
+WORKDIR /myapp
+RUN apk add --no-cache curl
+ENV NODE_ENV=production PORT=4010
+# Copy the complete filtered project from the build stage, including generated
+# build output and production node_modules. No project filenames are guessed.
+COPY --from=build --chown=node:node /myapp ./
+USER node
+EXPOSE 4010
+HEALTHCHECK --interval=30s --timeout=3s CMD curl -fsS http://127.0.0.1:4010/health >/dev/null || exit 1
+CMD ["npm", "start"]