# ============================================================
# صانع (San'e) — Dockerfile
# ============================================================
# Multi-stage build for optimized production image

# Stage 1: Build
FROM node:22-alpine AS builder

WORKDIR /app

# Install pnpm
RUN npm install -g pnpm

# Copy package files
COPY package.json pnpm-lock.yaml* package-lock.json* ./

# Install dependencies
RUN pnpm install --frozen-lockfile || npm install

# Copy source
COPY tsconfig.json ./
COPY src/ ./src/
COPY skills/ ./skills/

# Build TypeScript
RUN pnpm build || npm run build

# Stage 2: Production
FROM node:22-alpine AS production

WORKDIR /app

# Install curl for healthcheck
RUN apk add --no-cache curl tzdata

# Set timezone
ENV TZ=Asia/Kuwait

# Install pnpm
RUN npm install -g pnpm

# Copy package files
COPY package.json pnpm-lock.yaml* package-lock.json* ./

# Install production dependencies only
RUN pnpm install --prod --frozen-lockfile || npm install --production

# Copy built files
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/skills ./skills

# Create data directory for WhatsApp auth
RUN mkdir -p .sane/whatsapp-auth

# Create non-root user for security
RUN addgroup -g 1001 -S sane && \
    adduser -S sane -u 1001 && \
    chown -R sane:sane /app

USER sane

# Expose gateway port
EXPOSE 18789

# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
  CMD curl -f http://localhost:18789/health || exit 1

# Start San'e
CMD ["node", "dist/index.js"]