FROM    public.ecr.aws/lambda/nodejs:22 AS builder

RUN     dnf -y install shadow-utils
RUN     npm install -g pnpm

RUN     /usr/sbin/useradd -c "lambda user" -m -d /home/lambdauser -s /bin/bash lambdauser
RUN     chown -R lambdauser:lambdauser /var/task

USER    lambdauser
COPY    --chown=lambdauser:lambdauser package.json pnpm-lock.yaml ./
RUN     pnpm install --frozen-lockfile

COPY    --chown=lambdauser:lambdauser tsconfig.json tsconfig.build.json ./
COPY    --chown=lambdauser:lambdauser src ./src

RUN     pnpm build

# Production stage - only runtime dependencies
FROM    public.ecr.aws/lambda/nodejs:22

RUN     dnf -y install shadow-utils && \
        dnf clean all && \
        rm -rf /var/cache/yum

RUN     npm install -g pnpm

RUN     /usr/sbin/useradd -c "lambda user" -m -d /home/lambdauser -s /bin/bash lambdauser
RUN     chown -R lambdauser:lambdauser /var/task

USER    lambdauser

# Copy package files and install production dependencies only
COPY    --chown=lambdauser:lambdauser package.json pnpm-lock.yaml ./
RUN     pnpm install --frozen-lockfile --prod && \
        pnpm store prune && \
        rm -rf /home/lambdauser/.local/share/pnpm

# Copy built application from builder
COPY    --from=builder --chown=lambdauser:lambdauser /var/task/dist ./dist

# For testing, use the handler directly without Datadog wrapper
CMD    [ "dist/app.handler" ]