FROM denoland/deno:2.6.5 AS builder
WORKDIR /app
COPY deno.json .
COPY deno.lock .
COPY src/ src/
RUN deno compile --allow-net --allow-read --allow-write --allow-env --output reconciler src/main.ts

FROM gcr.io/distroless/cc-debian12:nonroot
COPY --from=builder /app/reconciler /usr/local/bin/reconciler
ENTRYPOINT ["reconciler"]