fix(docker): bash 3.2 compat + .docker-deps COPY + pnpm.overrides for transitive deps

- docker-prep.sh: replace declare -A with temp file (macOS bash 3.2)
- docker-prep.sh: inject pnpm.overrides so transitive @bytelyst/* deps resolve from tarballs
- backend/Dockerfile + web/Dockerfile: COPY .docker-deps/ into build context
- .npmrc.docker: remove scoped registry (tarballs handle all @bytelyst/* resolution)

.npmrc.docker

@@ -1,3 +1,3 @@
-@bytelyst:registry=http://${GITEA_NPM_HOST}:3300/api/packages/bytelyst/npm/
-//${GITEA_NPM_HOST}:3300/api/packages/bytelyst/npm/:_authToken=${GITEA_NPM_TOKEN}
 strict-ssl=false
+# @bytelyst/* packages resolved via file: tarballs from .docker-deps/
+# No registry needed when using docker-prep.sh

backend/Dockerfile

@@ -10,9 +10,10 @@ RUN npm config set strict-ssl false \
   && npm install -g pnpm@10.6.5
 
 COPY .npmrc.docker ./.npmrc
+COPY .docker-deps/ /app/.docker-deps/
 COPY backend/package.json ./package.json
 RUN --mount=type=secret,id=gitea_npm_token \
-  export GITEA_NPM_TOKEN="$(cat /run/secrets/gitea_npm_token)" && \
+  export GITEA_NPM_TOKEN="$(cat /run/secrets/gitea_npm_token 2>/dev/null || echo '')" && \
   pnpm install --ignore-scripts --lockfile=false
 
 COPY backend/tsconfig.json ./tsconfig.json

scripts/docker-prep.sh

@@ -37,7 +37,10 @@ echo "Building @bytelyst/* packages..."
 (cd "$COMMON_PLAT" && pnpm build)
 
 # Pack each package and build a mapping of name → tarball filename
-declare -A TARBALL_MAP
+# (uses a temp file instead of associative array for bash 3.2 compat)
+TARBALL_MAP_FILE=$(mktemp)
+trap 'rm -f "$TARBALL_MAP_FILE"' EXIT
+
 for pkg_dir in "$COMMON_PLAT"/packages/*/; do
   pkg_name=$(node -p "require('${pkg_dir}package.json').name" 2>/dev/null || true)
   if [[ -z "$pkg_name" ]]; then continue; fi
@@ -45,7 +48,7 @@ for pkg_dir in "$COMMON_PLAT"/packages/*/; do
   echo "  Packing $pkg_name..."
   tarball=$(cd "$pkg_dir" && pnpm pack --pack-destination "$TARBALL_DIR" 2>/dev/null | tail -1)
   filename=$(basename "$tarball")
-  TARBALL_MAP["$pkg_name"]="$filename"
+  echo "${pkg_name}=${filename}" >> "$TARBALL_MAP_FILE"
   echo "    -> $filename"
 done
 
@@ -65,11 +68,11 @@ rewrite_package_json() {
   local tmp="${pkg_file}.tmp"
   cp "$pkg_file" "$tmp"
 
-  for pkg_name in "${!TARBALL_MAP[@]}"; do
-    local tarball="${TARBALL_MAP[$pkg_name]}"
+  while IFS='=' read -r pkg_name tarball; do
+    [[ -z "$pkg_name" ]] && continue
     # Replace "^0.1.0" (or any semver) with "file:../.docker-deps/<tarball>"
     sed -i '' "s|\"${pkg_name}\": \"[^\"]*\"|\"${pkg_name}\": \"file:${rel_prefix}.docker-deps/${tarball}\"|g" "$tmp"
-  done
+  done < "$TARBALL_MAP_FILE"
 
   mv "$tmp" "$pkg_file"
   echo "  Rewrote $pkg_file"
@@ -81,6 +84,38 @@ rewrite_package_json "${REPO_DIR}/backend/package.json" "../"
 # Web package.json
 rewrite_package_json "${REPO_DIR}/web/package.json" "../"
 
+# ── Inject pnpm.overrides for transitive @bytelyst/* deps ─────────
+# Tarball packages may depend on other @bytelyst/* packages (e.g.
+# @bytelyst/fastify-core → @bytelyst/errors). Without overrides, pnpm
+# tries to fetch them from the npm registry which fails.
+inject_overrides() {
+  local pkg_file="$1"
+  local rel_prefix="$2"
+
+  if [[ ! -f "$pkg_file" ]]; then return; fi
+
+  local overrides=""
+  while IFS='=' read -r pkg_name tarball; do
+    [[ -z "$pkg_name" ]] && continue
+    if [[ -n "$overrides" ]]; then overrides="$overrides, "; fi
+    overrides="$overrides\"${pkg_name}\": \"file:${rel_prefix}.docker-deps/${tarball}\""
+  done < "$TARBALL_MAP_FILE"
+
+  if [[ -n "$overrides" ]]; then
+    node -e "
+      const fs = require('fs');
+      const p = JSON.parse(fs.readFileSync('${pkg_file}', 'utf8'));
+      p.pnpm = p.pnpm || {};
+      p.pnpm.overrides = { ...(p.pnpm.overrides || {}), ...JSON.parse('{${overrides}}') };
+      fs.writeFileSync('${pkg_file}', JSON.stringify(p, null, 2) + '\n');
+    "
+    echo "  Injected pnpm.overrides into $pkg_file"
+  fi
+}
+
+inject_overrides "${REPO_DIR}/backend/package.json" "../"
+inject_overrides "${REPO_DIR}/web/package.json" "../"
+
 echo ""
 echo "Done. Tarballs in $TARBALL_DIR"
 echo ""

web/Dockerfile

@@ -10,9 +10,10 @@ RUN npm config set strict-ssl false \
   && npm install -g pnpm@10.6.5
 
 COPY .npmrc.docker ./.npmrc
+COPY .docker-deps/ /app/.docker-deps/
 COPY web/package.json ./package.json
 RUN --mount=type=secret,id=gitea_npm_token \
-  export GITEA_NPM_TOKEN="$(cat /run/secrets/gitea_npm_token)" && \
+  export GITEA_NPM_TOKEN="$(cat /run/secrets/gitea_npm_token 2>/dev/null || echo '')" && \
   pnpm install --ignore-scripts --lockfile=false
 
 COPY web/next.config.ts ./next.config.ts