@gjsify/cli 0.23.0 → 0.24.2

package/lib/utils/gjs-bundle-guard.js

@@ -0,0 +1,103 @@
+// Build-time guard: a `--app gjs` bundle must not keep bare `node:` imports.
+//
+// Stock GJS has NO `node:` module loader. A single surviving
+// `import … from "node:fs"` makes it abort the ENTIRE module graph before one
+// line executes:
+//
+//   Gjs-WARNING **: JS ERROR: ImportError: Unsupported URI scheme for importing: node
+//   Gjs-CRITICAL **: Failed to resolve imports for module: '…/dist/cli.gjs.mjs'
+//
+// `--app gjs` maps every Node builtin to its `@gjsify/*` polyfill, so a healthy
+// bundle has ZERO of them. But when an alias TARGET cannot be resolved — the
+// classic case being a workspace checkout whose `@gjsify/*` packages have no
+// built `lib/`, so `exports["."]` points at a file that does not exist — the
+// bundler falls back to treating the import as external and re-emits the
+// ORIGINAL `node:*` specifier. That is a WARNING, not an error: the build
+// "succeeds" and writes a bundle that cannot load anywhere. It cost three red
+// CI jobs to notice, because nothing between `gjsify build` and CI ever
+// executes the emitted GJS bundle (tsc, lint, format and the unit/e2e suites
+// all run the Node entry).
+//
+// The pre-commit hook makes it worse rather than better: it rebuilds and
+// AUTO-STAGES `dist/cli.gjs.mjs`, so a developer whose checkout cannot resolve
+// the polyfills commits a broken artifact without ever seeing it.
+//
+// So the refusal belongs at build time, in `gjsify build --app gjs` itself —
+// not in a git hook and not in one package's `build:gjs-bundle` script. The
+// invariant is a property of the ARTIFACT, and every showcase, every downstream
+// app (buchhaltung, bauplaner, Learn6502) and CI all produce it through this
+// one code path. A hook would protect only commits in this repo; a per-package
+// script would protect one package.
+//
+// ## The oracle is the module graph, NOT the emitted text
+//
+// The first cut of this guard grepped the output for `from "node:…"`. That is
+// wrong, and CI caught it: `@gjsify/process`'s own test bundle names a case
+//
+//   await it(`named-import hrtime (from "node:process") preserves .bigint`, …)
+//
+// so the phrase appears verbatim inside a STRING, in a bundle that loads and
+// runs under GJS perfectly well. The same trap sits in `@gjsify/cli`'s own
+// bundle, which embeds `giNodeShimSource()`'s `--app node` codegen template
+// (`import { createRequire } from 'node:module';`). Telling a statement from a
+// quoted lookalike needs a JS lexer — but the bundler already did that work:
+// every chunk carries the list of external specifiers it actually imports. That
+// list is exact, engine-independent (npm `rolldown` returns it directly,
+// `@gjsify/rolldown-native` forwards it through `synthRolldownOutput`), and
+// free.
+//
+// Scope is STATIC imports, which is precisely the failure mode above: they are
+// resolved when GJS links the module, so one bad specifier kills the whole
+// bundle. A dynamic `import('node:x')` throws lazily at its call site instead —
+// a real bug, but not "the artifact cannot load", and not what this gate is
+// for.
+/**
+ * Bare `node:` specifiers a `--app gjs` bundle may keep as static imports.
+ *
+ * Deliberately EMPTY. Every Node builtin has an `@gjsify/*` polyfill that
+ * `--app gjs` aliases to, so there is no specifier that both survives into the
+ * module graph and loads under GJS. Reading the graph instead of the text is
+ * what keeps this list empty — the entries an earlier text-scanning version
+ * needed (`node:module`, `node:process`) were quoted lookalikes, never imports.
+ *
+ * Add an entry ONLY with a comment naming why GJS can resolve it. Each one is a
+ * specifier this guard can no longer catch for real.
+ */
+export const GJS_ALLOWED_NODE_IMPORTS = [];
+/**
+ * The distinct bare `node:` specifiers `chunks` statically import, minus the
+ * allowlist. Sorted, so the error message and any test are stable.
+ */
+export function findDisallowedNodeImports(chunks, allowed = GJS_ALLOWED_NODE_IMPORTS) {
+    const found = new Set();
+    for (const chunk of chunks) {
+        for (const specifier of chunk.imports ?? []) {
+            if (!specifier.startsWith('node:'))
+                continue;
+            if (allowed.includes(specifier))
+                continue;
+            found.add(specifier);
+        }
+    }
+    return [...found].sort();
+}
+/**
+ * Throw when a built `--app gjs` bundle statically imports Node builtins.
+ *
+ * @param chunks   the emitted chunks, as reported by the bundler
+ * @param outfile  path of the bundle, for the error message
+ */
+export function assertGjsBundleLoadable(chunks, outfile) {
+    const offenders = findDisallowedNodeImports(chunks);
+    if (offenders.length === 0)
+        return;
+    throw new Error(`gjsify build --app gjs: ${outfile} still imports ${offenders.length} bare \`node:\` module(s), ` +
+        'which stock GJS cannot resolve — it would fail at load with ' +
+        '"ImportError: Unsupported URI scheme for importing: node".\n' +
+        offenders.map((s) => `  - ${s}`).join('\n') +
+        '\n\nThese should have been aliased to their `@gjsify/*` polyfills. The usual cause is that the ' +
+        'alias TARGET could not be resolved, so the bundler externalised the import instead (look for ' +
+        'UNRESOLVED_IMPORT warnings above): e.g. a workspace checkout whose `@gjsify/*` packages have no ' +
+        'built `lib/`. Build the workspace first (`gjsify run build:infra`), or fix the resolution, then ' +
+        'rebuild.');
+}

package/lib/utils/install-backend-native.js

@@ -571,7 +571,6 @@ function findVisible(requesterPath, name, byPath) {
         candidates.push(`${requesterPath}/node_modules/${name}`);
         // Walk up: strip the last `/node_modules/<pkg>` segment and try again.
         let p = requesterPath;
-        // eslint-disable-next-line no-constant-condition
         while (true) {
             // Find the deepest `/node_modules/<pkg>` in `p`, strip it.
             const idx = p.lastIndexOf('/node_modules/');

package/lib/utils/install-global.d.ts

@@ -86,22 +86,6 @@ export interface LinkedBin {
  *   simplicity and so we don't need to discriminate by runtime here.
  */
 export declare function linkGlobalBins(packageNames: string[], layout: GlobalLayout): LinkedBin[];
-/**
- * Build the POSIX-sh `export` lines that prepend the given prebuild
- * directories to GI_TYPELIB_PATH and the host's shared-library search path.
- * Any pre-existing value inherited from the user's environment is preserved as
- * a suffix so user-installed typelibs/libraries still resolve.
- *
- * The library variable is host-dependent — `LD_LIBRARY_PATH` on Linux,
- * `DYLD_LIBRARY_PATH` on macOS (dyld never reads the ELF one), so a launcher
- * written on a Mac used to export a variable nothing consults, leaving every
- * `darwin-arm64` prebuild unloadable. `platform` is a parameter so both
- * branches are unit-testable from either host.
- *
- * Returns the empty string when no prebuilds were found — avoids emitting an
- * inert assignment in the launcher.
- */
-export declare function buildLauncherEnvPreamble(prebuildsDirs: string[], platform?: string): string;
 /** Returns `true` if `binDir` is on the user's PATH. */
 export declare function binDirOnPath(binDir: string): boolean;
 /**

package/lib/utils/install-global.js

@@ -23,8 +23,8 @@
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
-import { detectNativePackages, libraryPathVar } from './detect-native-packages.js';
-import { buildLauncherShims, parseShebang } from './bin-shim.js';
+import { detectNativePackages } from './detect-native-packages.js';
+import { buildLauncherShims, buildNativeEnvPreamble, parseShebang } from './bin-shim.js';
 /**
  * Compute the canonical global install layout for the current user. Honours
  * `XDG_DATA_HOME` (per the XDG Base Directory Spec) plus
@@ -143,18 +143,25 @@ export async function installGjsEnginePackages(prefix, version, opts = {}) {
 export function linkGlobalBins(packageNames, layout) {
     fs.mkdirSync(layout.binDir, { recursive: true });
     const created = [];
-    // Discover @gjsify/* packages with native prebuilds (Vala/GObject typelibs
-    // + shared libs) under the global prefix. The launcher bakes their
-    // directories into GI_TYPELIB_PATH / LD_LIBRARY_PATH so `imports.gi.X`
-    // resolves at CLI startup — required for e.g. @gjsify/terminal-native,
-    // without which process.stdout.isTTY / columns / colors all fall back to
-    // the conservative env-only defaults (no colors, 80-col wrap).
+    // The launcher exports GI_TYPELIB_PATH / <loader path> for the @gjsify/*
+    // native prebuilds (Vala/GObject typelibs + shared libs) installed in this
+    // prefix, so `imports.gi.X` resolves at CLI startup — required for the
+    // bundler engine `@gjsify/rolldown-native` (without which `gjsify build`
+    // hard-fails under GJS) and for e.g. `@gjsify/terminal-native`, without
+    // which isTTY / columns / colors fall back to conservative defaults.
     //
-    // `runGjsBundle()` does the same dance for `gjsify run <bundle>` at
-    // runtime; here we do it at install time because the global launcher
-    // invokes the CLI bundle directly, with no opportunity to set env first.
+    // `runGjsBundle()` does the same dance for `gjsify run <bundle>` at runtime;
+    // here it has to be the launcher, because the typelib lookup happens inside
+    // the GJS runtime before the bundle's first line runs.
+    //
+    // The preamble SCANS the prefix at launch time rather than embedding what
+    // was there at install time — see `buildNativeEnvPreamble` for why a
+    // snapshot is the wrong shape. `nativePrebuildDirs` is still computed: the
+    // Windows `.cmd`/`.ps1` shims take the baked list, and a hit in an
+    // ANCESTOR's node_modules (which the walk finds and a single-root scan
+    // cannot) is embedded verbatim.
     const nativePrebuildDirs = detectNativePackages(layout.prefix).map((p) => p.prebuildsDir);
-    const envPreamble = buildLauncherEnvPreamble(nativePrebuildDirs);
+    const envPreamble = buildNativeEnvPreamble(layout.prefix, nativePrebuildDirs);
     for (const pkgName of packageNames) {
         const pkgDir = path.join(layout.prefix, 'node_modules', pkgName);
         const pkgJsonPath = path.join(pkgDir, 'package.json');
@@ -237,30 +244,6 @@ export function linkGlobalBins(packageNames, layout) {
 function shQuote(s) {
     return `'${s.replace(/'/g, `'\\''`)}'`;
 }
-/**
- * Build the POSIX-sh `export` lines that prepend the given prebuild
- * directories to GI_TYPELIB_PATH and the host's shared-library search path.
- * Any pre-existing value inherited from the user's environment is preserved as
- * a suffix so user-installed typelibs/libraries still resolve.
- *
- * The library variable is host-dependent — `LD_LIBRARY_PATH` on Linux,
- * `DYLD_LIBRARY_PATH` on macOS (dyld never reads the ELF one), so a launcher
- * written on a Mac used to export a variable nothing consults, leaving every
- * `darwin-arm64` prebuild unloadable. `platform` is a parameter so both
- * branches are unit-testable from either host.
- *
- * Returns the empty string when no prebuilds were found — avoids emitting an
- * inert assignment in the launcher.
- */
-export function buildLauncherEnvPreamble(prebuildsDirs, platform = process.platform) {
-    if (prebuildsDirs.length === 0)
-        return '';
-    const { name: libVar } = libraryPathVar(platform);
-    const joined = shQuote(prebuildsDirs.join(':'));
-    return (`GI_TYPELIB_PATH=${joined}\${GI_TYPELIB_PATH:+":$GI_TYPELIB_PATH"}\n` +
-        `${libVar}=${joined}\${${libVar}:+":$${libVar}"}\n` +
-        `export GI_TYPELIB_PATH ${libVar}\n`);
-}
 /** Parse a bin file's `#!` line; `null` when unreadable or not a shebang. */
 function readShebangOf(file) {
     try {

package/lib/utils/normalize-bundler-options.js

@@ -24,7 +24,6 @@ export function normalizeBundlerOptions(configData) {
         raw['define'] !== null) {
         if (!warnedDefineOnce) {
             warnedDefineOnce = true;
-            // eslint-disable-next-line no-console
             console.warn("[gjsify] WARNING: 'bundler.define' is not a valid Rolldown option and would be " +
                 "silently ignored — it has been auto-mapped to 'bundler.transform.define'. " +
                 "Move 'define' under 'bundler.transform.define' in your config to suppress " +
@@ -46,7 +45,6 @@ export function normalizeBundlerOptions(configData) {
         return fromBundler;
     if (!warnedOnce) {
         warnedOnce = true;
-        // eslint-disable-next-line no-console
         console.warn("[gjsify] DEPRECATION: the 'esbuild' config key is deprecated and will be removed in 0.5.0. " +
             "Rename it to 'bundler' (typed as RolldownOptions). See the migration notes in the gjsify CHANGELOG.");
     }

package/lib/utils/oxc-resolve.js

@@ -46,7 +46,7 @@
 // lives in the Node launcher, so a native oxlint bridge could only run the
 // Rust rule subset. Lint stays Node-spawned until that trade-off is decided
 // (tracked in STATUS.md Open TODOs).
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { createRequire } from 'node:module';
 import { pathToFileURL } from 'node:url';
@@ -89,7 +89,12 @@ function oxcBindingSuffix() {
         // glibc systems have `/lib/ld-linux-*`, musl has `/lib/ld-musl-*`.
         let libc = 'gnu';
         try {
-            const { readdirSync } = require('node:fs');
+            // `readdirSync` is imported STATICALLY at the top of this file. It
+            // used to be a lazy `require('node:fs')` inside this try — a bare
+            // `require` in an ESM module, so it threw ReferenceError, the catch
+            // below swallowed it, and `libc` silently stayed 'gnu': a musl host
+            // would be told to install the WRONG binding package. Same defect
+            // class as commands/affected.ts, and even quieter.
             const libEntries = readdirSync('/lib');
             if (libEntries.some((e) => e.startsWith('ld-musl-'))) {
                 libc = 'musl';

package/lib/utils/run-node.d.ts

@@ -6,6 +6,22 @@ import { type ExampleRuntime } from './runtimes.js';
  * not available under the GJS-bundled CLI.
  */
 export declare function resolveNodeGi(startDir: string): string | null;
+/**
+ * Resolve `@gjsify/node-gi` for a bundle we are about to launch: from the
+ * BUNDLE's own directory first, then from `cwd`.
+ *
+ * The bundle's directory is the correct base and cwd is the fallback, for the
+ * same reason {@link computeNativeEnvForBundle} walks both: `@gjsify/node-gi` is
+ * kept EXTERNAL, so what has to be satisfiable is the RUNTIME's resolution of a
+ * bare specifier from inside the bundle — which Node performs relative to the
+ * importing file, never relative to cwd. A dlx-cache layout
+ * (`~/.cache/gjsify/dlx/<sha>/node_modules/<pkg>/dist/bundle.mjs`) has node-gi
+ * sitting right beside the bundle and nothing at all under the user's cwd, so a
+ * cwd-only probe rejected a run that would have worked. The cwd probe is kept
+ * because a project-local `node_modules` legitimately satisfies a bundle built
+ * into a `dist/` outside it (a `--outfile /tmp/…` build from a project root).
+ */
+export declare function resolveNodeGiForBundle(bundlePath: string, cwd: string): string | null;
 /** Pick the node executable: the current one when on Node, else PATH `node`. */
 export declare function nodeBinary(): string;
 export interface RunNodeBundleOptions {

package/lib/utils/run-node.js

@@ -5,10 +5,12 @@
 // through `@gjsify/node-gi` (the Axis-5 reverse bridge). Two things have to be
 // true at runtime:
 //
-//   1. `@gjsify/node-gi` must resolve from the project — it is kept EXTERNAL by
-//      the bundler (a native addon), so it has to physically exist in the
-//      consumer's node_modules. We verify this up front and emit a clear hint
-//      instead of letting Node throw `ERR_MODULE_NOT_FOUND` deep in the bundle.
+//   1. `@gjsify/node-gi` must resolve FROM THE BUNDLE — it is kept EXTERNAL by
+//      the bundler (a native addon), so it has to physically exist in a
+//      node_modules the bundle's own directory can reach (that is where Node
+//      will look), with the CWD as a fallback. We verify this up front and emit
+//      a clear hint instead of letting Node throw `ERR_MODULE_NOT_FOUND` deep in
+//      the bundle. See `resolveNodeGiForBundle`.
 //   2. `gi://Gtk` / `gi://Adw` etc. must resolve. System typelibs come from the
 //      default GI search path, but any `@gjsify/*` Vala bridge a story pulls in
 //      ships its typelib in `prebuilds/` — so we reuse the SAME
@@ -21,7 +23,7 @@
 // `gjs`, which cannot run a `--app node` bundle).
 import { spawn } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
-import { join, resolve } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { isNode } from '@gjsify/rolldown-plugin-gjsify/runtime';
 import { computeNativeEnvForBundle } from './run-gjs.js';
 import { RUNTIMES } from './runtimes.js';
@@ -43,6 +45,25 @@ export function resolveNodeGi(startDir) {
         dir = parent;
     }
 }
+/**
+ * Resolve `@gjsify/node-gi` for a bundle we are about to launch: from the
+ * BUNDLE's own directory first, then from `cwd`.
+ *
+ * The bundle's directory is the correct base and cwd is the fallback, for the
+ * same reason {@link computeNativeEnvForBundle} walks both: `@gjsify/node-gi` is
+ * kept EXTERNAL, so what has to be satisfiable is the RUNTIME's resolution of a
+ * bare specifier from inside the bundle — which Node performs relative to the
+ * importing file, never relative to cwd. A dlx-cache layout
+ * (`~/.cache/gjsify/dlx/<sha>/node_modules/<pkg>/dist/bundle.mjs`) has node-gi
+ * sitting right beside the bundle and nothing at all under the user's cwd, so a
+ * cwd-only probe rejected a run that would have worked. The cwd probe is kept
+ * because a project-local `node_modules` legitimately satisfies a bundle built
+ * into a `dist/` outside it (a `--outfile /tmp/…` build from a project root).
+ */
+export function resolveNodeGiForBundle(bundlePath, cwd) {
+    const resolvedBundle = resolve(bundlePath);
+    return resolveNodeGi(dirname(resolvedBundle)) ?? resolveNodeGi(cwd);
+}
 /** Pick the node executable: the current one when on Node, else PATH `node`. */
 export function nodeBinary() {
     return isNode() && process.execPath ? process.execPath : 'node';
@@ -55,7 +76,7 @@ export function nodeBinary() {
  */
 export async function runNodeBundle(bundlePath, extraArgs = [], options = {}) {
     const cwd = process.cwd();
-    if (!resolveNodeGi(cwd)) {
+    if (!resolveNodeGiForBundle(bundlePath, cwd)) {
         throw new Error('Cannot run the storybook on Node: `@gjsify/node-gi` is not installed.\n' +
             'Add @gjsify/node-gi as a dependency to run the storybook on Node, e.g.:\n' +
             '  "devDependencies": { "@gjsify/node-gi": "^0.13.0" }');
@@ -113,7 +134,7 @@ export function bundleRequiresNodeGi(bundlePath) {
 export async function runRuntimeBundle(runtime, bundlePath, extraArgs = [], options = {}) {
     const cwd = process.cwd();
     const resolvedBundle = resolve(bundlePath);
-    if (bundleRequiresNodeGi(resolvedBundle) && !resolveNodeGi(cwd)) {
+    if (bundleRequiresNodeGi(resolvedBundle) && !resolveNodeGiForBundle(resolvedBundle, cwd)) {
         throw new Error(`Cannot run this bundle on ${runtime}: it uses gi:// via \`@gjsify/node-gi\`, which is not installed.\n` +
             'Add @gjsify/node-gi as a dependency to run gi:// code off GJS, e.g.:\n' +
             '  "dependencies": { "@gjsify/node-gi": "^0.13.0" }');

package/lib/utils/runtimes.d.ts

@@ -37,6 +37,27 @@ export declare function isRuntimeOnPath(probe: string): boolean;
 export declare function isRuntimeAvailable(runtime: ExampleRuntime): boolean;
 /** Which of gjs/node/bun/deno are runnable on this host. */
 export declare function availableRuntimes(): ExampleRuntime[];
+/**
+ * The default `--runtime` for running a prebuilt EXAMPLE/SHOWCASE: `gjs`
+ * whenever gjs is runnable here, else the host runtime.
+ *
+ * This is deliberately NOT a plain `hostRuntime()`. A showcase's canonical
+ * artifact is its `--app gjs` bundle (`gjsify.main`) — that is what every
+ * showcase ships, what the `gjs` path installs via `gjsify dlx`, and what the
+ * docs call the default. Following the host instead means `npx @gjsify/cli
+ * showcase <name>` (host = node) silently asks for the `--app node` bundle,
+ * which most showcases do not ship and which additionally needs
+ * `@gjsify/node-gi` in the consumer's project — so the FIRST-RUN experience of
+ * the primary documented entry point failed on a missing file.
+ *
+ * Same rule `gjsify run` already applies in its bare-file path, where a
+ * `--app gjs` bundle stays on gjs regardless of host (`isLikelyGjsBundle`);
+ * here the "is it a gjs artifact" question is answered by the command instead
+ * of by sniffing the file. `--runtime` still overrides explicitly, and a host
+ * WITHOUT gjs (a plain Node/bun/deno box) keeps following the host so the
+ * node-capable showcases stay runnable there.
+ */
+export declare function defaultExampleRuntime(): ExampleRuntime;
 interface ExampleGjsifyField {
     example?: {
         runtimes?: unknown;

package/lib/utils/runtimes.js

@@ -64,6 +64,29 @@ export function isRuntimeAvailable(runtime) {
 export function availableRuntimes() {
     return EXAMPLE_RUNTIMES.filter((rt) => isRuntimeAvailable(rt));
 }
+/**
+ * The default `--runtime` for running a prebuilt EXAMPLE/SHOWCASE: `gjs`
+ * whenever gjs is runnable here, else the host runtime.
+ *
+ * This is deliberately NOT a plain `hostRuntime()`. A showcase's canonical
+ * artifact is its `--app gjs` bundle (`gjsify.main`) — that is what every
+ * showcase ships, what the `gjs` path installs via `gjsify dlx`, and what the
+ * docs call the default. Following the host instead means `npx @gjsify/cli
+ * showcase <name>` (host = node) silently asks for the `--app node` bundle,
+ * which most showcases do not ship and which additionally needs
+ * `@gjsify/node-gi` in the consumer's project — so the FIRST-RUN experience of
+ * the primary documented entry point failed on a missing file.
+ *
+ * Same rule `gjsify run` already applies in its bare-file path, where a
+ * `--app gjs` bundle stays on gjs regardless of host (`isLikelyGjsBundle`);
+ * here the "is it a gjs artifact" question is answered by the command instead
+ * of by sniffing the file. `--runtime` still overrides explicitly, and a host
+ * WITHOUT gjs (a plain Node/bun/deno box) keeps following the host so the
+ * node-capable showcases stay runnable there.
+ */
+export function defaultExampleRuntime() {
+    return isRuntimeAvailable('gjs') ? 'gjs' : hostRuntime();
+}
 /**
  * Read a package's declared example runtimes. Returns the (validated) list, or
  * `null` when the package declares none — the "unconstrained / permissive" case.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/cli",
-    "version": "0.23.0",
+    "version": "0.24.2",
     "description": "CLI for Gjsify",
     "type": "module",
     "main": "lib/index.js",
@@ -130,19 +130,19 @@
         "cli"
     ],
     "dependencies": {
-        "@gjsify/buffer": "^0.23.0",
-        "@gjsify/create-app": "^0.23.0",
-        "@gjsify/node-globals": "^0.23.0",
-        "@gjsify/node-polyfills": "^0.23.0",
-        "@gjsify/npm-registry": "^0.23.0",
-        "@gjsify/resolve-npm": "^0.23.0",
-        "@gjsify/rolldown-plugin-gjsify": "^0.23.0",
-        "@gjsify/rolldown-plugin-pnp": "^0.23.0",
-        "@gjsify/semver": "^0.23.0",
-        "@gjsify/tar": "^0.23.0",
-        "@gjsify/tsc": "^0.23.0",
-        "@gjsify/web-polyfills": "^0.23.0",
-        "@gjsify/workspace": "^0.23.0",
+        "@gjsify/buffer": "^0.24.2",
+        "@gjsify/create-app": "^0.24.2",
+        "@gjsify/node-globals": "^0.24.2",
+        "@gjsify/node-polyfills": "^0.24.2",
+        "@gjsify/npm-registry": "^0.24.2",
+        "@gjsify/resolve-npm": "^0.24.2",
+        "@gjsify/rolldown-plugin-gjsify": "^0.24.2",
+        "@gjsify/rolldown-plugin-pnp": "^0.24.2",
+        "@gjsify/semver": "^0.24.2",
+        "@gjsify/tar": "^0.24.2",
+        "@gjsify/tsc": "^0.24.2",
+        "@gjsify/web-polyfills": "^0.24.2",
+        "@gjsify/workspace": "^0.24.2",
         "cosmiconfig": "^9.0.2",
         "get-tsconfig": "^4.14.0",
         "pkg-types": "^2.3.1",
@@ -150,13 +150,13 @@
         "yargs": "^18.0.0"
     },
     "devDependencies": {
-        "@gjsify/unit": "^0.23.0",
+        "@gjsify/unit": "^0.24.2",
         "@types/yargs": "^17.0.35",
         "typescript": "^6.0.3"
     },
     "peerDependencies": {
-        "@gjsify/oxfmt-native": "^0.23.0",
-        "@gjsify/rolldown-native": "^0.23.0"
+        "@gjsify/oxfmt-native": "^0.24.2",
+        "@gjsify/rolldown-native": "^0.24.2"
     },
     "peerDependenciesMeta": {
         "@gjsify/oxfmt-native": {