bonecode 1.0.0

package/bone/output/session/src/tests.ts

@@ -0,0 +1,326 @@
+// Generated by BoneScript compiler. DO NOT EDIT.
+// Regression tests derived from capability declarations.
+// Run: npx ts-node src/tests.ts
+
+import * as http from "http";
+
+const BASE_URL = process.env.TEST_BASE_URL || "http://localhost:3000";
+const AUTH_TOKEN = process.env.TEST_AUTH_TOKEN || "";
+
+let passed = 0;
+let failed = 0;
+
+async function request(method: string, path: string, body?: any): Promise<{ status: number; data: any }> {
+  const url = new URL(path, BASE_URL);
+  const res = await fetch(url.toString(), {
+    method,
+    headers: {
+      "Content-Type": "application/json",
+      ...(AUTH_TOKEN ? { "Authorization": `Bearer ${AUTH_TOKEN}` } : {}),
+    },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  const data = await res.json().catch(() => ({}));
+  return { status: res.status, data };
+}
+
+async function test(name: string, fn: () => Promise<void>): Promise<void> {
+  try {
+    await fn();
+    console.log(`  ✓ ${name}`);
+    passed++;
+  } catch (e: any) {
+    console.log(`  ✗ ${name}: ${e.message}`);
+    failed++;
+  }
+}
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) throw new Error(message);
+}
+
+(async () => {
+// ─── ProjectService Tests ─────────────────────────────────────────────────────
+
+console.log("\nProjectService — CRUD");
+
+let __project_id: string;
+
+await test("POST /projects — creates entity", async () => {
+  const { status, data } = await request("POST", "/projects", {"root_commit_hash":"test_value","worktree":"test_value","vcs":"test_value","name":"test_value","sandboxes":{}});
+  assert(status === 201, `Expected 201, got ${status}: ${JSON.stringify(data)}`);
+  assert(data.id, "Response must have id");
+  __project_id = data.id;
+});
+
+await test("GET /projects/:id — reads entity", async () => {
+  const { status, data } = await request("GET", `/projects/${__project_id}`);
+  assert(status === 200, `Expected 200, got ${status}`);
+  assert(data.id === __project_id, "ID must match");
+});
+
+await test("GET /projects — lists entities", async () => {
+  const { status, data } = await request("GET", "/projects");
+  assert(status === 200, `Expected 200, got ${status}`);
+  assert(Array.isArray(data.items), "Response must have items array");
+  assert(typeof data.total === "number", "Response must have total");
+});
+
+await test("GET /projects — rejects unauthenticated", async () => {
+  const res = await fetch(`${BASE_URL}/projects`);
+  assert(res.status === 401, `Expected 401, got ${res.status}`);
+});
+
+await test("DELETE /projects/:id — deletes entity", async () => {
+  const { status } = await request("DELETE", `/projects/${__project_id}`);
+  assert(status === 204, `Expected 204, got ${status}`);
+});
+
+await test("GET /projects/:id — returns 404 after delete", async () => {
+  const { status } = await request("GET", `/projects/${__project_id}`);
+  assert(status === 404, `Expected 404, got ${status}`);
+});
+
+// ─── SessionService Tests ─────────────────────────────────────────────────────
+
+console.log("\nSessionService — CRUD");
+
+let __session_id: string;
+
+await test("POST /sessions — creates entity", async () => {
+  const { status, data } = await request("POST", "/sessions", {"slug":"test_value","project_id":"00000000-0000-0000-0000-000000000001","workspace_id":null,"parent_id":null,"directory":"test_value","title":"test_value","version":"test_value","share_url":null,"summary_additions":null,"summary_deletions":null,"summary_files":null,"summary_diffs":null,"revert_data":null,"permission_ruleset":null});
+  assert(status === 201, `Expected 201, got ${status}: ${JSON.stringify(data)}`);
+  assert(data.id, "Response must have id");
+  __session_id = data.id;
+});
+
+await test("GET /sessions/:id — reads entity", async () => {
+  const { status, data } = await request("GET", `/sessions/${__session_id}`);
+  assert(status === 200, `Expected 200, got ${status}`);
+  assert(data.id === __session_id, "ID must match");
+});
+
+await test("GET /sessions — lists entities", async () => {
+  const { status, data } = await request("GET", "/sessions");
+  assert(status === 200, `Expected 200, got ${status}`);
+  assert(Array.isArray(data.items), "Response must have items array");
+  assert(typeof data.total === "number", "Response must have total");
+});
+
+await test("GET /sessions — rejects unauthenticated", async () => {
+  const res = await fetch(`${BASE_URL}/sessions`);
+  assert(res.status === 401, `Expected 401, got ${res.status}`);
+});
+
+await test("POST /sessions/archive-session — capability executes", async () => {
+  const { status, data } = await request("POST", "/sessions/archive-session", {
+    session_id: __session_id,
+  });
+  // Capability may return 200 (success) or 422 (precondition failed) — both are valid
+  assert([200, 422].includes(status), `Expected 200 or 422, got ${status}: ${JSON.stringify(data)}`);
+});
+
+await test("POST /sessions/archive-session — returns 401 without auth", async () => {
+  const res = await fetch(`${BASE_URL}/sessions/archive-session`, { method: "POST" });
+  assert(res.status === 401, `Expected 401, got ${res.status}`);
+});
+
+await test("POST /sessions/delete-session — capability executes", async () => {
+  const { status, data } = await request("POST", "/sessions/delete-session", {
+    session_id: __session_id,
+  });
+  // Capability may return 200 (success) or 422 (precondition failed) — both are valid
+  assert([200, 422].includes(status), `Expected 200 or 422, got ${status}: ${JSON.stringify(data)}`);
+});
+
+await test("POST /sessions/delete-session — returns 401 without auth", async () => {
+  const res = await fetch(`${BASE_URL}/sessions/delete-session`, { method: "POST" });
+  assert(res.status === 401, `Expected 401, got ${res.status}`);
+});
+
+await test("POST /sessions/add-message — capability executes", async () => {
+  const { status, data } = await request("POST", "/sessions/add-message", {
+    session_id: __session_id,
+  });
+  // Capability may return 200 (success) or 422 (precondition failed) — both are valid
+  assert([200, 422].includes(status), `Expected 200 or 422, got ${status}: ${JSON.stringify(data)}`);
+});
+
+await test("POST /sessions/add-message — returns 401 without auth", async () => {
+  const res = await fetch(`${BASE_URL}/sessions/add-message`, { method: "POST" });
+  assert(res.status === 401, `Expected 401, got ${res.status}`);
+});
+
+await test("POST /sessions/update-part — capability executes", async () => {
+  const { status, data } = await request("POST", "/sessions/update-part", {
+    session_id: __session_id,
+  });
+  // Capability may return 200 (success) or 422 (precondition failed) — both are valid
+  assert([200, 422].includes(status), `Expected 200 or 422, got ${status}: ${JSON.stringify(data)}`);
+});
+
+await test("POST /sessions/update-part — returns 401 without auth", async () => {
+  const res = await fetch(`${BASE_URL}/sessions/update-part`, { method: "POST" });
+  assert(res.status === 401, `Expected 401, got ${res.status}`);
+});
+
+await test("POST /sessions/compact-session — capability executes", async () => {
+  const { status, data } = await request("POST", "/sessions/compact-session", {
+    session_id: __session_id,
+  });
+  // Capability may return 200 (success) or 422 (precondition failed) — both are valid
+  assert([200, 422].includes(status), `Expected 200 or 422, got ${status}: ${JSON.stringify(data)}`);
+});
+
+await test("POST /sessions/compact-session — returns 401 without auth", async () => {
+  const res = await fetch(`${BASE_URL}/sessions/compact-session`, { method: "POST" });
+  assert(res.status === 401, `Expected 401, got ${res.status}`);
+});
+
+// State machine: Session
+await test("PUT /sessions/:id — rejects invalid state transition", async () => {
+  const { status, data } = await request("PUT", `/sessions/${__session_id}`, {
+    state: "__invalid_state__",
+  });
+  assert(status === 422, `Expected 422 for invalid transition, got ${status}`);
+  assert(data.error?.code === "INVALID_TRANSITION", "Error code must be INVALID_TRANSITION");
+});
+
+await test("DELETE /sessions/:id — deletes entity", async () => {
+  const { status } = await request("DELETE", `/sessions/${__session_id}`);
+  assert(status === 204, `Expected 204, got ${status}`);
+});
+
+await test("GET /sessions/:id — returns 404 after delete", async () => {
+  const { status } = await request("GET", `/sessions/${__session_id}`);
+  assert(status === 404, `Expected 404, got ${status}`);
+});
+
+// ─── MessageService Tests ─────────────────────────────────────────────────────
+
+console.log("\nMessageService — CRUD");
+
+let __message_id: string;
+
+await test("POST /messages — creates entity", async () => {
+  const { status, data } = await request("POST", "/messages", {"session_id":"00000000-0000-0000-0000-000000000001","role":"test_value","model_id":null,"provider_id":null,"tokens_input":null,"tokens_output":null,"cost_usd":null,"error":null});
+  assert(status === 201, `Expected 201, got ${status}: ${JSON.stringify(data)}`);
+  assert(data.id, "Response must have id");
+  __message_id = data.id;
+});
+
+await test("GET /messages/:id — reads entity", async () => {
+  const { status, data } = await request("GET", `/messages/${__message_id}`);
+  assert(status === 200, `Expected 200, got ${status}`);
+  assert(data.id === __message_id, "ID must match");
+});
+
+await test("GET /messages — lists entities", async () => {
+  const { status, data } = await request("GET", "/messages");
+  assert(status === 200, `Expected 200, got ${status}`);
+  assert(Array.isArray(data.items), "Response must have items array");
+  assert(typeof data.total === "number", "Response must have total");
+});
+
+await test("GET /messages — rejects unauthenticated", async () => {
+  const res = await fetch(`${BASE_URL}/messages`);
+  assert(res.status === 401, `Expected 401, got ${res.status}`);
+});
+
+await test("DELETE /messages/:id — deletes entity", async () => {
+  const { status } = await request("DELETE", `/messages/${__message_id}`);
+  assert(status === 204, `Expected 204, got ${status}`);
+});
+
+await test("GET /messages/:id — returns 404 after delete", async () => {
+  const { status } = await request("GET", `/messages/${__message_id}`);
+  assert(status === 404, `Expected 404, got ${status}`);
+});
+
+// ─── PartService Tests ─────────────────────────────────────────────────────
+
+console.log("\nPartService — CRUD");
+
+let __part_id: string;
+
+await test("POST /parts — creates entity", async () => {
+  const { status, data } = await request("POST", "/parts", {"message_id":"00000000-0000-0000-0000-000000000001","session_id":"00000000-0000-0000-0000-000000000001","part_type":"test_value","data":{},"order_index":1});
+  assert(status === 201, `Expected 201, got ${status}: ${JSON.stringify(data)}`);
+  assert(data.id, "Response must have id");
+  __part_id = data.id;
+});
+
+await test("GET /parts/:id — reads entity", async () => {
+  const { status, data } = await request("GET", `/parts/${__part_id}`);
+  assert(status === 200, `Expected 200, got ${status}`);
+  assert(data.id === __part_id, "ID must match");
+});
+
+await test("GET /parts — lists entities", async () => {
+  const { status, data } = await request("GET", "/parts");
+  assert(status === 200, `Expected 200, got ${status}`);
+  assert(Array.isArray(data.items), "Response must have items array");
+  assert(typeof data.total === "number", "Response must have total");
+});
+
+await test("GET /parts — rejects unauthenticated", async () => {
+  const res = await fetch(`${BASE_URL}/parts`);
+  assert(res.status === 401, `Expected 401, got ${res.status}`);
+});
+
+await test("DELETE /parts/:id — deletes entity", async () => {
+  const { status } = await request("DELETE", `/parts/${__part_id}`);
+  assert(status === 204, `Expected 204, got ${status}`);
+});
+
+await test("GET /parts/:id — returns 404 after delete", async () => {
+  const { status } = await request("GET", `/parts/${__part_id}`);
+  assert(status === 404, `Expected 404, got ${status}`);
+});
+
+// ─── PermissionService Tests ─────────────────────────────────────────────────────
+
+console.log("\nPermissionService — CRUD");
+
+let __permission_id: string;
+
+await test("POST /permissions — creates entity", async () => {
+  const { status, data } = await request("POST", "/permissions", {"session_id":"00000000-0000-0000-0000-000000000001","tool_name":"test_value","pattern":null,"decision":"test_value","expires_at":null});
+  assert(status === 201, `Expected 201, got ${status}: ${JSON.stringify(data)}`);
+  assert(data.id, "Response must have id");
+  __permission_id = data.id;
+});
+
+await test("GET /permissions/:id — reads entity", async () => {
+  const { status, data } = await request("GET", `/permissions/${__permission_id}`);
+  assert(status === 200, `Expected 200, got ${status}`);
+  assert(data.id === __permission_id, "ID must match");
+});
+
+await test("GET /permissions — lists entities", async () => {
+  const { status, data } = await request("GET", "/permissions");
+  assert(status === 200, `Expected 200, got ${status}`);
+  assert(Array.isArray(data.items), "Response must have items array");
+  assert(typeof data.total === "number", "Response must have total");
+});
+
+await test("GET /permissions — rejects unauthenticated", async () => {
+  const res = await fetch(`${BASE_URL}/permissions`);
+  assert(res.status === 401, `Expected 401, got ${res.status}`);
+});
+
+await test("DELETE /permissions/:id — deletes entity", async () => {
+  const { status } = await request("DELETE", `/permissions/${__permission_id}`);
+  assert(status === 204, `Expected 204, got ${status}`);
+});
+
+await test("GET /permissions/:id — returns 404 after delete", async () => {
+  const { status } = await request("GET", `/permissions/${__permission_id}`);
+  assert(status === 404, `Expected 404, got ${status}`);
+});
+
+console.log(`\n════════════════════════════════════════`);
+console.log(`Results: ${passed} passed, ${failed} failed`);
+console.log("═".repeat(40));
+if (failed > 0) process.exit(1);
+})().catch(e => { console.error(e); process.exit(1); });

package/bone/output/session/src/websocket.ts

@@ -0,0 +1,201 @@
+// Generated by BoneScript compiler. DO NOT EDIT.
+// WebSocket server for realtime channels
+
+import { WebSocketServer, WebSocket } from "ws";
+import { IncomingMessage, Server } from "http";
+import jwt from "jsonwebtoken";
+import { eventBus } from "./events";
+import { logger } from "./logger";
+
+const JWT_SECRET = process.env.JWT_SECRET || "bonescript-dev-secret-change-in-production";
+
+// Redis pub/sub for multi-instance WebSocket broadcasting
+let redisSub: any = null;
+let redisPub: any = null;
+if (process.env.REDIS_URL) {
+  try {
+    const { createClient } = require("redis");
+    redisSub = createClient({ url: process.env.REDIS_URL });
+    redisPub = createClient({ url: process.env.REDIS_URL });
+    Promise.all([redisSub.connect(), redisPub.connect()]).then(() => {
+      logger.info("redis_connected", { event: "startup" });
+    }).catch((e: any) => {
+      logger.error("redis_connect_failed", { event: "startup", metadata: { error: e.message } });
+      redisSub = null; redisPub = null;
+    });
+  } catch { redisSub = null; redisPub = null; }
+}
+interface Client {
+  socket: WebSocket;
+  user_id: string;
+  channel: string;
+  topics: Set<string>;
+}
+
+const clients: Map<string, Set<Client>> = new Map();
+
+const CHANNELS: Record<string, { ordering: string; persistence: string; max_size: number }> = {
+  "session_events": {
+    ordering: "causal",
+    persistence: "last_1000",
+    max_size: 100000,
+  },
+  "part_stream": {
+    ordering: "fifo",
+    persistence: "last_100",
+    max_size: 10000,
+  },
+};
+
+const messageBuffers: Map<string, any[]> = new Map();
+
+function getBuffer(channel: string): any[] {
+  const buf = messageBuffers.get(channel);
+  if (buf) return buf;
+  const fresh: any[] = [];
+  messageBuffers.set(channel, fresh);
+  return fresh;
+}
+
+function persistMessage(channel: string, msg: any) {
+  const cfg = CHANNELS[channel];
+  if (!cfg || cfg.persistence === "none") return;
+  const buf = getBuffer(channel);
+  buf.push(msg);
+
+  // Honor persistence config (last_N, full)
+  const match = cfg.persistence.match(/^last_(\d+)$/);
+  if (match) {
+    const limit = parseInt(match[1], 10);
+    while (buf.length > limit) buf.shift();
+  } else if (buf.length > cfg.max_size) {
+    buf.shift();
+  }
+}
+
+export function setupWebSocketServer(httpServer: Server): WebSocketServer {
+  const wss = new WebSocketServer({ server: httpServer, path: "/ws" });
+
+  wss.on("connection", (socket: WebSocket, req: IncomingMessage) => {
+    const url = new URL(req.url || "/", `http://${req.headers.host}`);
+    const channel = url.searchParams.get("channel") || "";
+    const token = url.searchParams.get("token") || "";
+
+    if (!CHANNELS[channel]) {
+      socket.send(JSON.stringify({ type: "error", message: "Unknown channel: " + channel }));
+      socket.close();
+      return;
+    }
+
+    let userId: string;
+    try {
+      const decoded = jwt.verify(token, JWT_SECRET) as { sub: string };
+      userId = decoded.sub;
+    } catch {
+      socket.send(JSON.stringify({ type: "error", message: "Authentication failed" }));
+      socket.close();
+      return;
+    }
+
+    const client: Client = { socket, user_id: userId, channel, topics: new Set() };
+    const set = clients.get(channel) || new Set();
+    set.add(client);
+    clients.set(channel, set);
+
+    console.log(`[ws] User ${userId} connected to ${channel} (${set.size} active)`);
+
+    // Send buffered history
+    const history = messageBuffers.get(channel) || [];
+    for (const msg of history) {
+      socket.send(JSON.stringify(msg));
+    }
+
+    socket.send(JSON.stringify({ type: "connected", channel, history_size: history.length }));
+
+    socket.on("message", (data) => {
+      try {
+        const msg = JSON.parse(data.toString());
+
+        if (msg.type === "subscribe" && msg.topic) {
+          client.topics.add(msg.topic);
+          return;
+        }
+        if (msg.type === "unsubscribe" && msg.topic) {
+          client.topics.delete(msg.topic);
+          return;
+        }
+
+        // Broadcast
+        const broadcast = {
+          type: msg.type || "message",
+          payload: msg.payload || msg,
+          from: userId,
+          timestamp: new Date().toISOString(),
+        };
+
+        persistMessage(channel, broadcast);
+        broadcastToChannel(channel, broadcast, client);
+      } catch (e: any) {
+        socket.send(JSON.stringify({ type: "error", message: e.message }));
+      }
+    });
+
+    socket.on("close", () => {
+      const set = clients.get(channel);
+      if (set) set.delete(client);
+      console.log(`[ws] User ${userId} disconnected from ${channel}`);
+    });
+
+    // Heartbeat
+    const heartbeat = setInterval(() => {
+      if (socket.readyState === WebSocket.OPEN) {
+        socket.ping();
+      } else {
+        clearInterval(heartbeat);
+      }
+    }, 30000);
+  });
+
+  // Bridge: forward eventBus events to WebSocket clients
+  // Channel 'session_events' bridge
+  // Channel 'part_stream' bridge
+
+  // Subscribe to Redis channels for cross-instance delivery
+  if (redisSub) {
+    redisSub.subscribe("ws:session_events", (message: string) => {
+      const set = clients.get("session_events");
+      if (!set) return;
+      for (const client of set) {
+        if (client.socket.readyState === WebSocket.OPEN) client.socket.send(message);
+      }
+    }).catch(() => {});
+    redisSub.subscribe("ws:part_stream", (message: string) => {
+      const set = clients.get("part_stream");
+      if (!set) return;
+      for (const client of set) {
+        if (client.socket.readyState === WebSocket.OPEN) client.socket.send(message);
+      }
+    }).catch(() => {});
+  }
+  return wss;
+}
+
+function broadcastToChannel(channel: string, message: any, exclude?: Client) {
+  const set = clients.get(channel);
+  const data = JSON.stringify(message);
+  // Broadcast to local clients
+  if (set) {
+    for (const client of set) {
+      if (client === exclude) continue;
+      if (client.socket.readyState === WebSocket.OPEN) {
+        client.socket.send(data);
+      }
+    }
+  }
+  // Publish to Redis for cross-instance delivery
+  if (redisPub) {
+    redisPub.publish(`ws:${channel}`, data).catch(() => {});
+  }
+}
+
+export { broadcastToChannel };

package/bone/output/session/tsconfig.json

@@ -0,0 +1,25 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "module": "commonjs",
+    "lib": [
+      "ES2020",
+      "DOM"
+    ],
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "declaration": true,
+    "sourceMap": true
+  },
+  "include": [
+    "src/**/*"
+  ],
+  "exclude": [
+    "node_modules",
+    "dist"
+  ]
+}

package/bone/output/workspace/.dockerignore

@@ -0,0 +1,7 @@
+node_modules
+dist
+.env
+*.log
+.git
+*.bone
+*.bone.map

package/bone/output/workspace/.env.example

@@ -0,0 +1,36 @@
+# WorkspaceDomain Environment Variables
+# Copy this file to .env and fill in real values. Never commit .env to source control.
+
+# --- Required in production ---
+# Generate with: node -e "console.log(require('crypto').randomBytes(48).toString('hex'))"
+JWT_SECRET=
+
+# --- Database ---
+DATABASE_URL=postgresql://postgres:postgres@localhost:5432/workspace_domain
+
+# --- Redis (optional, used by some domain templates) ---
+REDIS_URL=redis://localhost:6379
+
+# --- Server ---
+PORT=3000
+NODE_ENV=development
+
+# --- CORS ---
+# Comma-separated list of allowed origins. Leave empty to disallow all cross-origin requests.
+# Example: ALLOWED_ORIGINS=https://app.example.com,https://admin.example.com
+ALLOWED_ORIGINS=
+
+# --- Event delivery mode ---
+# in_process: in-memory, fast, no durability guarantees (default for development)
+# durable: Postgres-backed transactional outbox (recommended for production)
+EVENT_MODE=in_process
+EVENT_WORKER_INTERVAL_MS=1000
+
+# --- Request timeout ---
+REQUEST_TIMEOUT_MS=30000
+
+# --- Notifications ---
+# NOTIFY_PROVIDER=log|resend|sendgrid (default: log)
+NOTIFY_PROVIDER=log
+NOTIFY_API_KEY=
+NOTIFY_FROM_EMAIL=noreply@example.com

package/bone/output/workspace/.github/workflows/ci.yaml

@@ -0,0 +1,58 @@
+# Generated by BoneScript compiler.
+name: CI/CD
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_DB: workspace_domain_test
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Type check
+        run: npx tsc --noEmit
+
+      - name: Run migrations
+        run: npm run migrate
+        env:
+          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/workspace_domain_test
+
+      - name: Run tests
+        run: npx ts-node src/tests.ts
+        env:
+          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/workspace_domain_test
+          JWT_SECRET: test-secret
+          TEST_BASE_URL: http://localhost:3000
+
+  build:
+    needs: test
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main'
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build Docker image
+        run: docker build -t workspace-domain:${{ github.sha }} .
+      - name: Tag as latest
+        run: docker tag workspace-domain:${{ github.sha }} workspace-domain:latest

package/bone/output/workspace/Dockerfile

@@ -0,0 +1,22 @@
+# Generated by BoneScript compiler.
+FROM node:20-alpine AS builder
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci --only=production
+COPY . .
+RUN npm run build
+
+FROM node:20-alpine AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+COPY --from=builder /app/dist ./dist
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/package.json ./
+
+# Health check
+HEALTHCHECK --interval=10s --timeout=5s --start-period=30s --retries=3 \
+  CMD wget -qO- http://localhost:3000/health/live || exit 1
+
+EXPOSE 3000
+USER node
+CMD ["node", "dist/index.js"]