C2(jobsync): impl — simplify: use npx -y for runtime prisma migrate

Instead of bundling prisma CLI and its deep dependency tree in the nix
image, use `npx -y prisma@6.19.0 migrate deploy` like upstream does.
npx downloads prisma at container startup — network is available at
runtime, only blocked during nix build.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

containers/jobsync/default.nix

@@ -21,10 +21,8 @@ let
 
     nodejs = pkgs.nodejs_20;
 
-    nativeBuildInputs = [ pkgs.makeWrapper ];
-
-    # Patch out Google Fonts import (nix sandbox blocks network access).
-    # Replace with a simple object that provides the CSS variable class name.
+    # Patch out Google Fonts import (nix sandbox blocks network access at
+    # build time). Replace with a simple object; app uses system sans-serif.
     postPatch = ''
       substituteInPlace src/app/layout.tsx \
         --replace-fail 'import { Inter } from "next/font/google";' "" \
@@ -34,7 +32,7 @@ let
 });' 'const inter = { variable: "" };'
     '';
 
-    # Point Prisma at nixpkgs-built engines (no network download needed)
+    # Point Prisma at nixpkgs-built engines (no network download in sandbox)
     env = {
       PRISMA_QUERY_ENGINE_LIBRARY = "${prismaEngines}/lib/libquery_engine.node";
       PRISMA_QUERY_ENGINE_BINARY = "${prismaEngines}/bin/query-engine";
@@ -57,13 +55,6 @@ let
       runHook postBuild
     '';
 
-    # Skip npm prune — prisma CLI is a devDependency but needed at runtime
-    # for `migrate deploy`, and it has a deep transitive dependency tree
-    # (@prisma/config -> effect, c12, etc.) that's impractical to save/restore
-    # individually.
-    npmPruneFlags = [ ];
-    dontNpmPrune = true;
-
     installPhase = ''
       runHook preInstall
 
@@ -77,26 +68,6 @@ let
       # Copy Prisma schema and migrations for runtime migrate deploy
       cp -r prisma $out/app/prisma
 
-      # Copy prisma and generated client (kept by dontNpmPrune)
-      cp -r node_modules/.prisma $out/app/node_modules/.prisma || true
-      cp -r node_modules/prisma $out/app/node_modules/prisma || true
-      # Copy all @prisma/* packages (engines, config, get-platform, etc.)
-      mkdir -p $out/app/node_modules/@prisma
-      for pkg in node_modules/@prisma/*; do
-        name=$(basename "$pkg")
-        # Don't overwrite @prisma/client from standalone output
-        if [ ! -d "$out/app/node_modules/@prisma/$name" ]; then
-          cp -r "$pkg" "$out/app/node_modules/@prisma/$name"
-        fi
-      done
-      # Copy transitive deps of prisma CLI (effect, c12, etc.)
-      for dep in effect @effect c12 deepmerge-ts empathic confbox defu dotenv \
-                 exsolve giget jiti ohash pathe perfect-debounce chokidar; do
-        if [ -d "node_modules/$dep" ]; then
-          cp -r "node_modules/$dep" "$out/app/node_modules/$dep" 2>/dev/null || true
-        fi
-      done
-
       # Copy entrypoint
       cp ${./entrypoint.sh} $out/app/entrypoint.sh
 

containers/jobsync/entrypoint.sh

@@ -8,8 +8,8 @@ if [ -z "$AUTH_SECRET" ]; then
   echo "AUTH_SECRET was not set — generated a temporary secret for this container."
 fi
 
-# Run Prisma migrations (use local node_modules binary, not npx)
-node node_modules/prisma/build/index.js migrate deploy
+# Run Prisma migrations (npx -y downloads prisma if not in local node_modules)
+npx -y prisma@6.19.0 migrate deploy
 
 # Start the Next.js server
 exec node server.js