The build stage can fetch a git dependency, and only it can

Dockerfile

@@ -16,6 +16,12 @@
 # as long as nobody could rebuild it to notice. Changing the operating system under every module is
 # a separate decision from making this buildable, and is not being taken here.
 FROM node:22-bookworm-slim AS build
+# git, because a dependency named by a git URL is fetched by git and this image does not carry it.
+# Only in the build stage: what it is needed for happens here, and a runtime that can clone is a
+# runtime that can be made to clone.
+RUN apt-get update \
+      && apt-get install -y --no-install-recommends git ca-certificates \
+      && rm -rf /var/lib/apt/lists/*
 WORKDIR /app
 COPY package.json package-lock.json ./
 # Development dependencies included: the compiler is one of them, and so is the toolkit's own — it
@@ -25,11 +31,13 @@ RUN npm install --no-audit --no-fund
 COPY tsconfig.json ./
 COPY src ./src
 RUN npm run build
+# Dropped after compiling rather than reinstalled in the next stage, which would need git there too.
+RUN npm prune --omit=dev
 
 # Everything the modules compile against and run on, and nothing that only the build needed.
 FROM node:22-bookworm-slim
 WORKDIR /app
-COPY package.json package-lock.json ./
+COPY package.json ./
-RUN npm install --omit=dev --no-audit --no-fund && npm cache clean --force
+COPY --from=build /app/node_modules ./node_modules
 COPY --from=build /app/dist ./dist
 ENTRYPOINT ["node", "dist/main.js"]