@camstack/system 1.2.179 → 1.2.181

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-C7qWwrK1.js");
+const require_dist = require("./dist-whe0b4_3.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -27,7 +27,7 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DO8KbxCe.js");
 const require_tls$1 = require("./tls-BxQlomxd.js");
-const require_manifest_system_deps = require("./manifest-system-deps-PAIfmNun.js");
+const require_manifest_system_deps = require("./manifest-system-deps-y5vZBO6q.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let zod = require("zod");
@@ -3678,8 +3678,362 @@ var AddonManifest = class {
 	}
 };
 //#endregion
+//#region src/kernel/deps/closure-dedupe.ts
+/**
+* Closure dedupe — stop copying into every addon the libraries the server
+* closure already provides.
+*
+* `installRuntimeDependencies` materialises each addon's declared
+* `camstack.runtimeDependencies` (and their whole transitive tree) under
+* `<addonsDir>/<pkg>/node_modules`. Measured on the live hub (2026-09-04):
+* 196 MB across 23 addons, largely re-copies of libraries sitting one
+* directory away in `/data/server-root/current/node_modules` — `mediabunny`
+* (11 MB) twice, `werift` (~5 MB) three times, plus their shared subtrees
+* (`@noble`, `@peculiar`, `werift-*`).
+*
+* The fix: after an addon tree's npm install completes, every top-level
+* `node_modules` entry the closure ALSO provides at a compatible version is
+* replaced by a SYMLINK into the closure's `node_modules`. Symlinks preserve
+* standard Node resolution for BOTH module systems at ANY depth (verified on
+* the hub: `require()` and `import()` through a symlink on `/data/addons`
+* both resolve), and a dependency the closure later drops fails LOUDLY
+* (dangling link → `Cannot find module`) instead of silently degrading.
+*
+* Version compatibility is the sharp edge, measured live: the closure ships
+* `zod@4.5.4` while `@apocaliss92/nodelink-js` (provider-reolink) requires
+* `zod@^3` and carries `3.25.76`. A link there would silently downgrade a
+* dependent to an incompatible major — worse than the disk it saves. So a
+* link happens ONLY when the closure version satisfies EVERY requirement
+* range recorded for that package in the addon's own tree, under a
+* deliberately conservative range parser (exact / caret / tilde; anything
+* else refuses). Identical versions always link.
+*
+* Everything here is dependency-free on purpose (no `semver` package in the
+* kernel): the parser handles only the forms it can prove, and refusal keeps
+* the addon's own copy — never a wrong resolution.
+*/
+function parseVersion(value) {
+	const m = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(value.trim());
+	if (!m) return null;
+	return {
+		major: Number(m[1]),
+		minor: Number(m[2]),
+		patch: Number(m[3]),
+		prerelease: m[4] ?? null
+	};
+}
+/** -1 / 0 / 1 over the numeric triple only (callers gate prereleases first). */
+function compareTriple(a, b) {
+	if (a.major !== b.major) return a.major < b.major ? -1 : 1;
+	if (a.minor !== b.minor) return a.minor < b.minor ? -1 : 1;
+	if (a.patch !== b.patch) return a.patch < b.patch ? -1 : 1;
+	return 0;
+}
+/**
+* Does `version` satisfy `range`, for the range forms this module is willing
+* to vouch for?
+*
+* Supported: exact (`1.2.3`, `=1.2.3`), caret (`^1.2.3`, incl. the 0.x rules)
+* and tilde (`~1.2.3`). EVERYTHING else — `*`, `>=`, unions, hyphen ranges,
+* dist-tags, bases with prereleases — returns false: an unprovable range must
+* keep the addon's own copy, never borrow the closure's.
+*
+* A prerelease `version` satisfies only an exact string match — semver range
+* semantics around prereleases are precisely the kind of subtlety a
+* hand-rolled parser must refuse rather than approximate.
+*/
+function closureSatisfiesRange(range, version) {
+	const trimmedRange = range.trim();
+	const v = parseVersion(version);
+	if (v === null) return false;
+	if (v.prerelease !== null) return trimmedRange === version.trim() || trimmedRange === `=${version.trim()}`;
+	const exactBase = parseVersion(trimmedRange.startsWith("=") ? trimmedRange.slice(1) : trimmedRange);
+	if (exactBase !== null) return exactBase.prerelease === null && compareTriple(v, exactBase) === 0;
+	const operator = trimmedRange[0];
+	if (operator !== "^" && operator !== "~") return false;
+	const base = parseVersion(trimmedRange.slice(1));
+	if (base === null || base.prerelease !== null) return false;
+	if (operator === "~") return v.major === base.major && v.minor === base.minor && compareTriple(v, base) >= 0;
+	if (base.major > 0) return v.major === base.major && compareTriple(v, base) >= 0;
+	if (base.minor > 0) return v.major === 0 && v.minor === base.minor && compareTriple(v, base) >= 0;
+	return compareTriple(v, base) === 0;
+}
+/**
+* Belt over the range check: the closure copy must live in the same major
+* line as the copy npm actually materialised (same minor while major is 0).
+* The range check should already guarantee this; if the two ever disagree
+* the safe answer is "do not link".
+*/
+function sameCompatLine(a, b) {
+	const pa = parseVersion(a);
+	const pb = parseVersion(b);
+	if (pa === null || pb === null) return false;
+	if (pa.major !== pb.major) return false;
+	if (pa.major === 0) return pa.minor === pb.minor;
+	return true;
+}
+/**
+* Decide, per top-level entry, whether the closure's copy can serve in place
+* of the addon's own. Identical versions always link; otherwise every
+* recorded requirement range must accept the closure version, and the two
+* copies must share a compat line. Anything unprovable keeps the local copy.
+*/
+function planClosureDedupe(input) {
+	const links = [];
+	const keeps = [];
+	for (const candidate of input.candidates) {
+		if (candidate.name.startsWith("@camstack/")) {
+			keeps.push({
+				name: candidate.name,
+				reason: "camstack-package"
+			});
+			continue;
+		}
+		if (input.neverLink.has(candidate.name)) {
+			keeps.push({
+				name: candidate.name,
+				reason: "never-link"
+			});
+			continue;
+		}
+		const closureVersion = input.closureVersions.get(candidate.name);
+		if (closureVersion === void 0) {
+			keeps.push({
+				name: candidate.name,
+				reason: "not-in-closure"
+			});
+			continue;
+		}
+		if (closureVersion === candidate.version) {
+			links.push({
+				name: candidate.name,
+				closureVersion
+			});
+			continue;
+		}
+		const ranges = input.requirements.get(candidate.name) ?? [];
+		if (ranges.length > 0 && ranges.every((range) => closureSatisfiesRange(range, closureVersion)) && sameCompatLine(closureVersion, candidate.version)) links.push({
+			name: candidate.name,
+			closureVersion
+		});
+		else keeps.push({
+			name: candidate.name,
+			reason: "version-incompatible"
+		});
+	}
+	return {
+		links,
+		keeps
+	};
+}
+function readTreeManifest(pkgJsonPath) {
+	let raw;
+	try {
+		raw = require_dist.asJsonObject(require_dist.parseJsonUnknown(node_fs.readFileSync(pkgJsonPath, "utf-8")));
+	} catch {
+		return null;
+	}
+	if (raw === null) return null;
+	const ranges = /* @__PURE__ */ new Map();
+	for (const key of [
+		"dependencies",
+		"optionalDependencies",
+		"peerDependencies"
+	]) {
+		const deps = require_dist.asJsonObject(raw[key]);
+		if (deps === null) continue;
+		for (const [name, range] of Object.entries(deps)) if (typeof range === "string" && !ranges.has(name)) ranges.set(name, range);
+	}
+	const version = require_dist.asString(raw["version"]);
+	return {
+		version: version.length > 0 ? version : null,
+		ranges
+	};
+}
+/** Top-level entries of a node_modules dir (scoped names flattened). */
+function listTopLevelEntries(nodeModulesDir) {
+	let entries;
+	try {
+		entries = node_fs.readdirSync(nodeModulesDir, { withFileTypes: true });
+	} catch {
+		return [];
+	}
+	const names = [];
+	for (const entry of entries) {
+		if (entry.name.startsWith(".")) continue;
+		if (entry.name.startsWith("@")) {
+			let inner;
+			try {
+				inner = node_fs.readdirSync(node_path.join(nodeModulesDir, entry.name), { withFileTypes: true });
+			} catch {
+				continue;
+			}
+			for (const sub of inner) if (!sub.name.startsWith(".")) names.push(`${entry.name}/${sub.name}`);
+		} else names.push(entry.name);
+	}
+	return names;
+}
+/**
+* Read an addon tree's dedupe-relevant state: which top-level packages exist
+* (and their versions), and which requirement ranges apply to each. A
+* dependent's range for `X` is recorded only when that dependent resolves to
+* the TOP-LEVEL `X` — a nested override copy (`dep/node_modules/X`) means the
+* flat copy is not what that dependent loads, so its range must not block the
+* flat copy's dedupe.
+*/
+function collectAddonTreeState(addonDir) {
+	const nodeModulesDir = node_path.join(addonDir, "node_modules");
+	const requirements = /* @__PURE__ */ new Map();
+	const addRange = (name, range) => {
+		const existing = requirements.get(name);
+		if (existing === void 0) requirements.set(name, [range]);
+		else existing.push(range);
+	};
+	const rootManifest = readTreeManifest(node_path.join(addonDir, "package.json"));
+	if (rootManifest !== null) for (const [name, range] of rootManifest.ranges) addRange(name, range);
+	const candidates = [];
+	const existingLinks = [];
+	for (const name of listTopLevelEntries(nodeModulesDir)) {
+		const entryDir = node_path.join(nodeModulesDir, name);
+		let isLink = false;
+		try {
+			isLink = node_fs.lstatSync(entryDir).isSymbolicLink();
+		} catch {
+			continue;
+		}
+		if (isLink) {
+			let target = "";
+			try {
+				target = node_fs.readlinkSync(entryDir);
+			} catch {}
+			existingLinks.push({
+				name,
+				target
+			});
+		}
+		const manifest = readTreeManifest(node_path.join(entryDir, "package.json"));
+		if (manifest === null) continue;
+		if (!isLink && manifest.version !== null) candidates.push({
+			name,
+			version: manifest.version
+		});
+		for (const [depName, range] of manifest.ranges) {
+			if (node_fs.existsSync(node_path.join(entryDir, "node_modules", depName))) continue;
+			addRange(depName, range);
+		}
+	}
+	return {
+		candidates,
+		requirements,
+		existingLinks
+	};
+}
+/** Read `name → version` from a closure node_modules for the given names. */
+function readClosureVersions(closureNodeModulesDir, names) {
+	const versions = /* @__PURE__ */ new Map();
+	for (const name of names) {
+		const manifest = readTreeManifest(node_path.join(closureNodeModulesDir, name, "package.json"));
+		if (manifest !== null && manifest.version !== null) versions.set(name, manifest.version);
+	}
+	return versions;
+}
+/**
+* Where the running node's server closure keeps its node_modules, or null
+* when there is none to dedupe against (dev workspace, tests without a
+* closure). `CAMSTACK_FRAMEWORK_DIR` is set by the starter/launcher on every
+* deployed node — the same directory the framework resolver hook and
+* NODE_PATH extension already point at.
+*/
+function resolveClosureNodeModulesDir(explicitDir) {
+	const frameworkDir = explicitDir ?? process.env["CAMSTACK_FRAMEWORK_DIR"];
+	if (frameworkDir === void 0 || frameworkDir.length === 0) return null;
+	const nodeModulesDir = explicitDir ?? node_path.join(frameworkDir, "node_modules");
+	return node_fs.existsSync(nodeModulesDir) ? nodeModulesDir : null;
+}
+function symlinkType() {
+	return process.platform === "win32" ? "junction" : "dir";
+}
+/**
+* Replace each planned entry with a symlink into the closure. Probes symlink
+* support once (Windows without developer mode cannot create them — in that
+* case every copy is kept, which is exactly today's behaviour). Each link
+* re-verifies the closure version right before the swap so a closure updated
+* mid-flight can only cause a KEEP, never a wrong link.
+*
+* Returns the names actually linked.
+*/
+function executeClosureDedupe(addonDir, closureNodeModulesDir, plan, logger) {
+	if (plan.links.length === 0) return [];
+	const nodeModulesDir = node_path.join(addonDir, "node_modules");
+	const probePath = node_path.join(nodeModulesDir, ".closure-link-probe");
+	try {
+		node_fs.mkdirSync(nodeModulesDir, { recursive: true });
+		node_fs.rmSync(probePath, { force: true });
+		node_fs.symlinkSync(closureNodeModulesDir, probePath, symlinkType());
+		node_fs.rmSync(probePath, { force: true });
+	} catch (err) {
+		logger.warn("closure dedupe skipped — symlinks unavailable on this volume", { meta: {
+			addonDir,
+			error: require_dist.errMsg(err)
+		} });
+		return [];
+	}
+	const linked = [];
+	for (const link of plan.links) {
+		const target = node_path.join(closureNodeModulesDir, link.name);
+		const manifest = readTreeManifest(node_path.join(target, "package.json"));
+		if (manifest === null || manifest.version !== link.closureVersion) {
+			logger.warn("closure dedupe — closure changed under the plan; keeping own copy", { meta: {
+				name: link.name,
+				planned: link.closureVersion,
+				found: manifest?.version ?? null
+			} });
+			continue;
+		}
+		const entryDir = node_path.join(nodeModulesDir, link.name);
+		try {
+			node_fs.rmSync(entryDir, {
+				recursive: true,
+				force: true
+			});
+			node_fs.mkdirSync(node_path.dirname(entryDir), { recursive: true });
+			node_fs.symlinkSync(target, entryDir, symlinkType());
+			linked.push(link.name);
+		} catch (err) {
+			logger.warn("closure dedupe — link failed; entry removed copy may need reinstall", { meta: {
+				name: link.name,
+				error: require_dist.errMsg(err)
+			} });
+		}
+	}
+	return linked;
+}
+/**
+* Is `linkTarget` (as read from `readlink`) a path inside the closure's
+* node_modules? Only such links belong to this mechanism — workspace/npm
+* `file:` links must never be touched by dedupe maintenance.
+*/
+function isClosureLinkTarget(linkTarget, closureNodeModulesDir) {
+	if (linkTarget.length === 0) return false;
+	const normalized = node_path.resolve(linkTarget);
+	const root = node_path.resolve(closureNodeModulesDir);
+	return normalized === root || normalized.startsWith(`${root}${node_path.sep}`);
+}
+//#endregion
 //#region src/kernel/addon-installer.ts
 var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
+/**
+* Names declared in `camstack.nativeDependencies` — per-addon natives that
+* the closure dedupe must never replace with a link (their install path owns
+* ABI/prebuild handling; see `deps/manifest-native-deps.ts`).
+*/
+function readNativeDependencyNames(pkg) {
+	if (pkg === void 0) return /* @__PURE__ */ new Set();
+	const camstack = require_dist.asJsonObject(pkg["camstack"]);
+	if (camstack === null) return /* @__PURE__ */ new Set();
+	const native = require_dist.asJsonObject(camstack["nativeDependencies"]);
+	return native === null ? /* @__PURE__ */ new Set() : new Set(Object.keys(native));
+}
 function parseInstallSource(value) {
 	switch (value) {
 		case "npm":
@@ -3776,6 +4130,8 @@ var AddonInstaller = class AddonInstaller {
 	installSource;
 	logger;
 	isPackageResolvable;
+	/** Test seam — production resolves via `CAMSTACK_FRAMEWORK_DIR`. */
+	closureNodeModulesDir;
 	/**
 	* Central manifest of installed addons. Tracks version + source +
 	* timestamps + last-backup pointer per package, written atomically
@@ -3797,6 +4153,7 @@ var AddonInstaller = class AddonInstaller {
 		this.logger = logger;
 		this.manifest = new AddonManifest(config.addonsDir);
 		this.isPackageResolvable = config.isPackageResolvable;
+		this.closureNodeModulesDir = config.closureNodeModulesDir;
 		if (config.installSource) this.installSource = config.installSource;
 		else this.installSource = "npm";
 	}
@@ -3984,6 +4341,140 @@ var AddonInstaller = class AddonInstaller {
 		return changes;
 	}
 	/**
+	* Make every INSTALLED addon's runtime dependencies resolvable — doing the
+	* least work that achieves it. Runs at boot on hub and agent, which is what
+	* turns a restore back into a working node: a system backup archives no
+	* node_modules (D338), so before this pass every restored non-bootstrap
+	* addon failed its first import until someone redeployed it by hand.
+	*
+	* Per addon, in order:
+	*  1. drop closure links that no longer hold (dangling, or the closure
+	*     moved to a version the addon tree's recorded ranges refuse) — those
+	*     addons get a reinstall;
+	*  2. a declared dep that already resolves in the addon tree costs nothing;
+	*  3. a missing declared dep the closure provides at a COMPATIBLE version
+	*     becomes a link — no npm, no network;
+	*  4. only an addon left with a genuinely unresolvable dep gets an npm
+	*     install (then dedupe + native ensure, same tail as a fresh install).
+	*
+	* "Only when necessary" is the contract: an addon whose deps are all
+	* satisfied is not touched at all. Failures are per-addon and non-fatal —
+	* a dep that cannot be re-fetched leaves that addon exactly as broken as
+	* it already was, but LOUDLY, and never blocks the rest of the boot.
+	*/
+	async ensureAddonRuntimeDeps() {
+		const closureNodeModules = resolveClosureNodeModulesDir(this.closureNodeModulesDir);
+		const linked = [];
+		const reinstalled = [];
+		const failed = [];
+		const installedPackages = this.listInstalled();
+		for (const pkg of installedPackages) {
+			try {
+				if (node_fs.lstatSync(pkg.dir).isSymbolicLink()) continue;
+			} catch {
+				continue;
+			}
+			try {
+				const outcome = this.ensureOneAddonDeps(pkg.dir, pkg.name, closureNodeModules);
+				for (const dep of outcome.linked) linked.push(`${pkg.name}:${dep}`);
+				if (outcome.needsInstall) {
+					await this.reinstallAddonDeps(pkg.dir, pkg.name);
+					reinstalled.push(pkg.name);
+				}
+			} catch (err) {
+				failed.push(pkg.name);
+				this.logger.error(`${pkg.name} — runtime dependencies could NOT be ensured; the addon will fail to load until its deps install`, { meta: {
+					dir: pkg.dir,
+					error: require_dist.errMsg(err)
+				} });
+			}
+		}
+		return {
+			checked: installedPackages.length,
+			linked,
+			reinstalled,
+			failed
+		};
+	}
+	/**
+	* One addon's dependency audit (steps 1–3 of `ensureAddonRuntimeDeps`).
+	* Pure decision + link creation; the npm fallback is the caller's.
+	*/
+	ensureOneAddonDeps(addonDir, packageName, closureNodeModules) {
+		const pkgView = readPackageJson(node_path.join(addonDir, "package.json"));
+		const declared = pkgView === null ? null : require_dist.asJsonObject(pkgView.raw["dependencies"]);
+		const declaredEntries = declared === null ? [] : Object.entries(declared);
+		const state = collectAddonTreeState(addonDir);
+		const nodeModulesDir = node_path.join(addonDir, "node_modules");
+		let needsInstall = false;
+		if (closureNodeModules !== null) for (const link of state.existingLinks) {
+			if (!isClosureLinkTarget(link.target, closureNodeModules)) continue;
+			const linkDir = node_path.join(nodeModulesDir, link.name);
+			const targetManifest = node_fs.existsSync(node_path.join(linkDir, "package.json"));
+			const ranges = state.requirements.get(link.name) ?? [];
+			let holds = targetManifest;
+			if (holds && ranges.length > 0) {
+				const version = readClosureVersions(closureNodeModules, [link.name]).get(link.name);
+				holds = version !== void 0 && ranges.every((range) => closureSatisfiesRange(range, version));
+			}
+			if (!holds) {
+				this.logger.warn(`${packageName} — closure link for ${link.name} no longer holds; reinstalling this addon's deps`, { meta: { target: link.target } });
+				node_fs.rmSync(linkDir, { force: true });
+				needsInstall = true;
+			}
+		}
+		const linked = [];
+		for (const [depName, range] of declaredEntries) {
+			if (typeof range !== "string") continue;
+			if (node_fs.existsSync(node_path.join(nodeModulesDir, depName, "package.json"))) continue;
+			const closureVersion = closureNodeModules === null ? void 0 : readClosureVersions(closureNodeModules, [depName]).get(depName);
+			if (closureNodeModules !== null && closureVersion !== void 0 && closureSatisfiesRange(range, closureVersion)) {
+				if (executeClosureDedupe(addonDir, closureNodeModules, {
+					links: [{
+						name: depName,
+						closureVersion
+					}],
+					keeps: []
+				}, this.logger).length === 1) {
+					this.logger.info(`${packageName} — ${depName} linked from the server closure`, { meta: { closureVersion } });
+					linked.push(depName);
+					continue;
+				}
+			}
+			needsInstall = true;
+		}
+		return {
+			linked,
+			needsInstall
+		};
+	}
+	/**
+	* npm-install an installed addon's runtime deps IN PLACE (the restore /
+	* repair path — the tree is not yet running at boot), then the same tail
+	* every fresh install gets: closure dedupe + native deps + prebuild ensure.
+	* Closure links are stripped first so npm reifies against plain missing
+	* dirs instead of symlinks it does not own.
+	*/
+	async reinstallAddonDeps(addonDir, packageName) {
+		const closureNodeModules = resolveClosureNodeModulesDir(this.closureNodeModulesDir);
+		if (closureNodeModules !== null) {
+			const state = collectAddonTreeState(addonDir);
+			for (const link of state.existingLinks) if (isClosureLinkTarget(link.target, closureNodeModules)) node_fs.rmSync(node_path.join(addonDir, "node_modules", link.name), { force: true });
+		}
+		this.logger.info(`${packageName} — reinstalling runtime dependencies`, { meta: { addonDir } });
+		await require_manifest_system_deps.runNpm([
+			"install",
+			"--omit=dev",
+			"--omit=peer",
+			"--no-audit",
+			"--no-fund",
+			"--no-package-lock",
+			...this.registry ? ["--registry", this.registry] : []
+		], this.npmRunOptions(addonDir, 24e4));
+		this.dedupeTreeAgainstClosure(addonDir, packageName);
+		await this.installNativeDependencies(addonDir, packageName);
+	}
+	/**
 	* Install a single addon — on-demand installer used by AddonPackageService
 	* (admin UI "Install addon" / "Reinstall" buttons).
 	*
@@ -4091,6 +4582,7 @@ var AddonInstaller = class AddonInstaller {
 			logger: this.logger,
 			bundledSourceDir: sourceDir
 		});
+		this.dedupeTreeAgainstClosure(targetDir, packageName);
 		this.logger.info(`${packageName} — copied from ${sourceDir}`);
 		return {
 			name: pkgData.name,
@@ -4394,6 +4886,40 @@ var AddonInstaller = class AddonInstaller {
 			logger: this.logger
 		});
 	}
+	/**
+	* Stop copying what the server closure already provides: replace each
+	* top-level `node_modules` entry the closure serves at a COMPATIBLE version
+	* with a symlink into the closure (see `deps/closure-dedupe.ts` for the
+	* plan rules and the live measurements). Runs LAST in tree
+	* materialisation — after the runtime-dep npm install AND the native-dep
+	* steps — so no later npm invocation can fight the links.
+	*
+	* Non-fatal by design: dedupe is an optimisation, and its failure mode is
+	* "the addon keeps its own copies", which is exactly today's behaviour. A
+	* refusal on version grounds is logged loudly — that line is the answer to
+	* "why does this addon still carry its own zod".
+	*/
+	dedupeTreeAgainstClosure(pkgDir, packageName) {
+		const closureNodeModules = resolveClosureNodeModulesDir(this.closureNodeModulesDir);
+		if (closureNodeModules === null) return;
+		try {
+			const state = collectAddonTreeState(pkgDir);
+			if (state.candidates.length === 0) return;
+			const pkgView = readPackageJson(node_path.join(pkgDir, "package.json"));
+			const plan = planClosureDedupe({
+				candidates: state.candidates,
+				closureVersions: readClosureVersions(closureNodeModules, state.candidates.map((c) => c.name)),
+				requirements: state.requirements,
+				neverLink: readNativeDependencyNames(pkgView?.raw)
+			});
+			const linked = executeClosureDedupe(pkgDir, closureNodeModules, plan, this.logger);
+			if (linked.length > 0) this.logger.info(`${packageName} — ${linked.length} node_modules entr${linked.length === 1 ? "y" : "ies"} now resolve from the server closure`, { meta: { linked } });
+			const refused = plan.keeps.filter((k) => k.reason === "version-incompatible");
+			if (refused.length > 0) this.logger.info(`${packageName} — kept own copy where the closure version is incompatible`, { meta: { kept: refused.map((k) => k.name) } });
+		} catch (err) {
+			this.logger.warn(`${packageName} — closure dedupe failed (copies kept)`, { meta: { error: require_dist.errMsg(err) } });
+		}
+	}
 	/** Install addon from a tgz file (uploaded or downloaded) */
 	async installFromTgz(tgzPath) {
 		const stagingRoot = node_path.join(this.addonsDir, ".staging");
@@ -4419,6 +4945,7 @@ var AddonInstaller = class AddonInstaller {
 			const targetDir = node_path.join(this.addonsDir, pkgView.name);
 			await this.installRuntimeDependencies(pkgDir, pkgView.name);
 			await this.installNativeDependencies(pkgDir, pkgView.name);
+			this.dedupeTreeAgainstClosure(pkgDir, pkgView.name);
 			await this.evictInstallDir(targetDir);
 			ensureDir(node_path.dirname(targetDir));
 			await node_fs.promises.rename(pkgDir, targetDir);
@@ -4551,6 +5078,7 @@ var AddonInstaller = class AddonInstaller {
 		if (!node_fs.existsSync(addonDir)) throw new Error(`Cannot update ${packageName}: install dir ${addonDir} missing`);
 		await this.installRuntimeDependencies(stagedPath, packageName);
 		await this.installNativeDependencies(stagedPath, packageName);
+		this.dedupeTreeAgainstClosure(stagedPath, packageName);
 		const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
 		const backupRoot = node_path.join(this.addonsDir, ".backups", packageName);
 		ensureDir(backupRoot);