ARG BASE_IMAGE
FROM ${BASE_IMAGE}
LABEL org.opencontainers.image.title="portfolio-privacy-coordinator" \
      org.opencontainers.image.description="Trusted closure reconciliation without raw decoder authority"
WORKDIR /opt/app
COPY package.json package-lock.json /opt/app/
RUN npm ci --omit=dev --ignore-scripts
COPY scripts/release/reconcile-scan.mjs /opt/app/scripts/release/reconcile-scan.mjs
COPY src/security /opt/app/src/security
USER 65532:65532
ENTRYPOINT ["node", "/opt/app/scripts/release/reconcile-scan.mjs", "--request", "/input/request.json"]