FROM node:22-slim

RUN apt-get update && apt-get install -y --no-install-recommends \
    git ca-certificates \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app
# PINNED — do not float this back to `@bitwarden/cli` (kb#180, 2026-07-30).
# An unpinned rebuild pulled 2026.7.0, whose WASM cipher deserializer rejects
# any stored login object with `"uri": null` ("invalid type: JsValue(Object({...})),
# expected a string") — the MATRIX_ADOLF_GATEWAY_TOKEN item in this vault has
# exactly that shape. `bw list` then exits 1, server.js's init fails, and the
# container crash-loops on restart. 2026.2.0 parses that item fine and is the
# version the host CLI runs. Re-test against the live vault before bumping.
RUN npm install -g @bitwarden/cli@2026.2.0
COPY package.json ./
RUN npm install --production
COPY src/ ./src/
COPY start.sh ./
RUN chmod +x start.sh
CMD ["./start.sh"]