Server dependencies

Node resolves packages with its normal rules. Place package.json, lockfile, and node_modules beside the server script or in a parent directory visible to the deployed entry point.

Pure JavaScript packages work normally. Native addons must use Node-API (N-API) and provide a build compatible with the server platform and embedded Node 22. Legacy NAN or raw V8 ABI addons are unsupported.

npm ci --omit=dev

Use npm ci against a committed lockfile for repeatable production installs. Do not deploy TypeScript, linters, or @vimp-mp/types as runtime dependencies; compile first and keep them in devDependencies.

Test native packages on the same OS and architecture as production. A package that falls back to local compilation needs a compiler toolchain on the deploy host, while a prebuilt Node-API package may not.

Pin database drivers, password hashing libraries, and other native dependencies especially carefully because a native crash shares the server process.