FROM python:3.13-slim-trixie@sha256:c33f0bc4364a6881bed1ec0cc2665e6c53c87a43e774aaeab88e6f17af105e4f AS wheel
WORKDIR /build
COPY src/ ./src/
COPY tools/schema_validator.py tools/policy_plane.py ./tools/
COPY okengine-mcp/output_contract_enforce.py okengine-mcp/converge.py ./okengine-mcp/
COPY scripts/cron/id_lib.py scripts/cron/schema_lib.py scripts/cron/id_index.py scripts/cron/okf_migrate.py ./scripts/cron/
COPY scripts/build_engine_wheel.py ./scripts/build_engine_wheel.py
COPY config/base-schema.yaml ./config/base-schema.yaml
RUN python scripts/build_engine_wheel.py --out /wheel

FROM python:3.13-slim-trixie@sha256:c33f0bc4364a6881bed1ec0cc2665e6c53c87a43e774aaeab88e6f17af105e4f

WORKDIR /app
COPY okengine-projection/requirements.txt .
COPY --from=wheel /wheel/ /wheel/
RUN pip install --no-cache-dir -r requirements.txt /wheel/*.whl
COPY db/projection-schema.sql /app/db/projection-schema.sql
COPY okengine-projection/service.py /app/service.py
ENV WIKI_PATH=/opt/vault PYTHONUNBUFFERED=1
USER 10000:10000
CMD ["python", "/app/service.py"]
