Overview

What this PR does

PR #408, perf(server): move prisma CLI to devDependencies, makes a one-line change to packages/server/package.json: it moves the prisma npm package (the Prisma command-line tool, version 7.4.2, roughly 38 MB on disk) out of the dependencies block and into devDependencies.

-    "prisma": "7.4.2",
     "prom-client": "^15.1.3",
     ...
+    "prisma": "7.4.2",
     "regenerator-transform": "^0.15.2"

Nothing else changes. No application code, no schema, no runtime behavior. This is a packaging/build-hygiene change aimed at the sandbox hosting infrastructure, not at anything a clinic user, patient, or Dentolize end-customer will ever see.

Why it exists

Dentolize runs many short-lived preview sandboxes — one per active branch — so reviewers and QA can click through a real, running instance of a feature before it merges. Each sandbox builds Docker images for the server, and whatsapp-official services (see the gap noted below regarding the auth-api image the PR description mentions).

The prisma CLI is a large dev-only tool (schema migrations, prisma studio, prisma db push). It is not needed to run the server at runtime — the server only needs the generated @prisma/client library, which is declared as a separate dependency and is unaffected by this change. Historically prisma sat in dependencies anyway, so every sandbox image build carried the full CLI even though nothing at runtime calls it.

The stated goal: stop paying that ~38 MB tax on every sandbox image, on every branch, as the first step ("Phase A") of a broader initiative to shrink sandbox image sizes.

What this walkthrough covers

Because this PR has no UI, the usual "click through the feature" tour doesn't apply. Instead, this walkthrough:

• Explains the change and the reasoning behind it in plain language

(Feature breakdown).

• Shows real terminal evidence, captured from the live sandbox

running this exact PR, of what the change actually does and doesn't achieve on the current codebase (Walkthrough).

• Is honest about a gap between the PR's stated rationale and what the

repository's Dockerfile actually does today — see below.

A gap worth knowing about

The PR description says the sandbox runtime "runs yarn install --production, which currently pulls the prisma CLI into every branch's server, auth-api, and whatsapp images." Checking the repository's Dockerfile against that claim surfaces two discrepancies:

1. There is no auth-api image on this branch. The Dockerfile's own

header comment (Dockerfile:5) says the auth-server target was dropped because there's no auth-server package here. The live sandbox for this PR confirms it — no auth-api/auth-server container is running.

1. The server image doesn't use --production at all, and does so

deliberately. Dockerfile:303-308 explains that --production is unreliable with Yarn 1 workspaces on this repo (it has been seen to skip packages that are genuinely needed), so the server image build trades size for correctness and installs dependencies and devDependencies together. That means moving prisma from one section to the other doesn't remove it from the server image at all — confirmed live in the Walkthrough.

None of this means the PR is wrong to land — see Feature breakdown for where the change does have a real, if narrower, effect. It does mean the "~2.1 GB steady-state disk saved" figure in the PR description does not hold for the current Dockerfile as written.