FROM node:22-bookworm-slim

ARG BUILD_SHA=unknown

RUN userdel -r node 2>/dev/null || true && useradd -m -u 1000 user
USER user

ENV HOME=/home/user
WORKDIR /home/user/app

COPY --chown=user package*.json ./
RUN npm ci

COPY --chown=user . .
RUN npx tsc -p tsconfig.json && npm prune --omit=dev

ENV NODE_ENV=production
ENV PORT=7860
ENV BUILD_SHA=$BUILD_SHA

EXPOSE 7860

CMD ["node", "--enable-source-maps", "dist/server.js"]