@gjsify/cli 0.25.1 → 0.26.1

package/lib/utils/dlx-cache.d.ts

@@ -20,13 +20,40 @@ export declare function getValidCachedPkg(cacheDir: string, maxAgeMinutes?: numb
  * Atomically swap `<cacheDir>/pkg` to point at `prepareDir`.
  *
  * Strategy:
- *   1. Create new symlink `<cacheDir>/pkg-<rand>` → prepareDir.
- *   2. `rename(pkg-<rand>, pkg)` — POSIX guarantees rename-over-existing is atomic.
+ *   1. Create new link `<cacheDir>/pkg.tmp-<ts>-<pid>` → prepareDir.
+ *   2. `rename(pkg.tmp-…, pkg)` — POSIX guarantees rename-over-existing is atomic.
  *
  * Returns the realpath of the new live target. EBUSY/EEXIST indicates a race
  * — a parallel process won, return its realpath.
+ *
+ * WINDOWS, both halves of which shipped broken:
+ *
+ *   • Step 1 used `symlinkSync(…, 'dir')`, and a directory SYMLINK needs
+ *     elevation or Developer Mode there, so a plain
+ *     `npx @gjsify/cli@latest showcase …` died with `EPERM: operation not
+ *     permitted, symlink`. It now goes through {@link linkDirSync}, which picks
+ *     an NTFS junction — the same choice npm and yarn make, and the one
+ *     `commands/install.ts` already made for workspace links without sharing it.
+ *   • Step 2's rename-over-existing is a POSIX guarantee, not a Windows one:
+ *     `MoveFileEx` will not replace an existing DIRECTORY, and a junction is a
+ *     directory reparse point. So on the second run — when `pkg` already exists
+ *     — the rename failed with `EPERM`, the catch below read that as "race
+ *     lost", and the function returned the OLD target. That is not a crash but
+ *     it is worse than one: the cache silently never refreshed. Windows
+ *     therefore unlinks first and accepts the non-atomic window, which the
+ *     existing race handling already covers.
+ *
+ * @param opts.junctions force the Windows link strategy (TESTS ONLY). Defaults
+ *   to the host's. It is a parameter for the same reason `dirLinkTarget` takes
+ *   `linkType`: nothing in CI runs on Windows, so an injected `true` is the ONLY
+ *   way the unlink-then-rename ordering above is ever EXECUTED, and an
+ *   unexecutable Windows branch is exactly how the `'dir'` bug shipped. What the
+ *   injection proves off-host is the ORDERING and that the second swap really
+ *   refreshes; what it cannot prove is `MoveFileEx`/junction syscall behaviour.
  */
-export declare function symlinkSwap(cacheDir: string, prepareDir: string): string;
+export declare function symlinkSwap(cacheDir: string, prepareDir: string, opts?: {
+    junctions?: boolean;
+}): string;
 /** Clean up `<cacheDir>/<oldPrepareDir>` siblings older than `maxAgeMinutes`. */
 export declare function cleanupStalePrepareDirs(cacheDir: string, _maxAgeMinutes?: number): void;
 /** Resolve absolute path to the installed package's directory inside cache. */

package/lib/utils/dlx-cache.js

@@ -6,9 +6,10 @@
 //   - prepare into a fresh temp dir, then atomically swap a `pkg` symlink
 //   - TTL via lstat mtime + maxAgeMinutes (default 7 days)
 import { createHash } from 'node:crypto';
-import { lstatSync, mkdirSync, realpathSync, renameSync, rmSync, symlinkSync } from 'node:fs';
+import { lstatSync, mkdirSync, realpathSync, renameSync, rmSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join, resolve } from 'node:path';
+import { dirLinksAreJunctions, linkDirSync } from './dir-link.js';
 const ONE_MINUTE_MS = 60_000;
 const DEFAULT_TTL_MIN = 60 * 24 * 7; // 7 days
 function lexCompare(a, b) {
@@ -74,30 +75,82 @@ export function getValidCachedPkg(cacheDir, maxAgeMinutes = DEFAULT_TTL_MIN) {
  * Atomically swap `<cacheDir>/pkg` to point at `prepareDir`.
  *
  * Strategy:
- *   1. Create new symlink `<cacheDir>/pkg-<rand>` → prepareDir.
- *   2. `rename(pkg-<rand>, pkg)` — POSIX guarantees rename-over-existing is atomic.
+ *   1. Create new link `<cacheDir>/pkg.tmp-<ts>-<pid>` → prepareDir.
+ *   2. `rename(pkg.tmp-…, pkg)` — POSIX guarantees rename-over-existing is atomic.
  *
  * Returns the realpath of the new live target. EBUSY/EEXIST indicates a race
  * — a parallel process won, return its realpath.
+ *
+ * WINDOWS, both halves of which shipped broken:
+ *
+ *   • Step 1 used `symlinkSync(…, 'dir')`, and a directory SYMLINK needs
+ *     elevation or Developer Mode there, so a plain
+ *     `npx @gjsify/cli@latest showcase …` died with `EPERM: operation not
+ *     permitted, symlink`. It now goes through {@link linkDirSync}, which picks
+ *     an NTFS junction — the same choice npm and yarn make, and the one
+ *     `commands/install.ts` already made for workspace links without sharing it.
+ *   • Step 2's rename-over-existing is a POSIX guarantee, not a Windows one:
+ *     `MoveFileEx` will not replace an existing DIRECTORY, and a junction is a
+ *     directory reparse point. So on the second run — when `pkg` already exists
+ *     — the rename failed with `EPERM`, the catch below read that as "race
+ *     lost", and the function returned the OLD target. That is not a crash but
+ *     it is worse than one: the cache silently never refreshed. Windows
+ *     therefore unlinks first and accepts the non-atomic window, which the
+ *     existing race handling already covers.
+ *
+ * @param opts.junctions force the Windows link strategy (TESTS ONLY). Defaults
+ *   to the host's. It is a parameter for the same reason `dirLinkTarget` takes
+ *   `linkType`: nothing in CI runs on Windows, so an injected `true` is the ONLY
+ *   way the unlink-then-rename ordering above is ever EXECUTED, and an
+ *   unexecutable Windows branch is exactly how the `'dir'` bug shipped. What the
+ *   injection proves off-host is the ORDERING and that the second swap really
+ *   refreshes; what it cannot prove is `MoveFileEx`/junction syscall behaviour.
  */
-export function symlinkSwap(cacheDir, prepareDir) {
+export function symlinkSwap(cacheDir, prepareDir, opts = {}) {
+    const junctions = opts.junctions ?? dirLinksAreJunctions();
     const linkPath = join(cacheDir, 'pkg');
     const tmpName = `pkg.tmp-${Date.now().toString(16)}-${process.pid.toString(16)}`;
     const tmpLink = join(cacheDir, tmpName);
     // If we cannot even create the tmp link, give up (the error propagates).
-    symlinkSync(prepareDir, tmpLink, 'dir');
+    linkDirSync(tmpLink, prepareDir);
     try {
+        if (junctions) {
+            // Windows: no rename-over-a-directory. Removing first opens a window
+            // in which `pkg` is absent; a concurrent reader treats that as a cache
+            // miss and prepares its own, which is correct, just wasteful. force:true
+            // keeps a first-ever swap (nothing to remove) from throwing.
+            //
+            // maxRetries/retryDelay for the same reason `install-backend-native.ts`
+            // wraps every delete in `rmWithRetry`: on Windows a delete fails with
+            // EBUSY/EPERM while ANY process holds a handle (an antivirus scan, a
+            // concurrent reader that just realpath'd this very link), and the
+            // deletion then stays PENDING — so without the retry a transient
+            // handle sends us down the "race lost" branch and the cache silently
+            // does not refresh. Free on POSIX, where the first attempt succeeds.
+            rmSync(linkPath, { force: true, recursive: false, maxRetries: 10, retryDelay: 100 });
+        }
         renameSync(tmpLink, linkPath);
     }
     catch (err) {
         const code = err.code;
-        if (code === 'EBUSY' || code === 'EPERM' || code === 'EEXIST') {
-            // Race lost — clean up our tmp and use whoever won.
+        if (code === 'EBUSY' || code === 'EPERM' || code === 'EEXIST' || code === 'EACCES') {
+            // Race lost — clean up our tmp and use whoever won. force:true is
+            // the non-throwing spelling of "remove if still there"; any other
+            // failure on our own pid-unique link is real and should surface.
+            rmSync(tmpLink, { force: true });
             try {
-                rmSync(tmpLink);
+                return realpathSync(linkPath);
+            }
+            catch {
+                // Windows only, and only because the junction path unlinks before
+                // it renames: "race lost" can also mean the winner is INSIDE that
+                // non-atomic window, so `pkg` momentarily does not exist and this
+                // would throw ENOENT out of a function whose caller reports it to
+                // the user as `Could not resolve showcase "<name>"`. Our own
+                // prepareDir is a complete, correctly installed tree — a truthful
+                // answer for THIS run. The next run reads whichever link won.
+                return realpathSync(prepareDir);
             }
-            catch { }
-            return realpathSync(linkPath);
         }
         throw err;
     }

package/lib/utils/install-backend-native.js

@@ -458,7 +458,7 @@ specOrigins) {
  *
  * This makes the current single-root-slot behavior honest instead of silent;
  * the real fix — a per-workspace dedup pass that gives each conflicting
- * requester its own nested copy — is Phase D.8 (see STATUS.md).
+ * requester its own nested copy — is Phase D.8 (see status/open-todos.md).
  */
 function emitTopLevelConflictWarnings(topLevelRanges, root) {
     for (const [name, ranges] of topLevelRanges) {

package/lib/utils/install-lock.js

@@ -84,13 +84,11 @@ function lockingDisabled() {
  * we cannot prove abandoned; the mtime staleness budget still applies).
  */
 function isPidAlive(pid) {
-    try {
-        if (existsSync('/proc/self'))
-            return existsSync(`/proc/${pid}`);
-    }
-    catch {
-        /* fall through to the signal probe */
-    }
+    // `existsSync` never throws by contract: Node returns false on any error,
+    // and the GJS shim is a typeof guard + Gio `query_exists` (both without a
+    // throw path in the GIR). Off Linux the `if` is simply false.
+    if (existsSync('/proc/self'))
+        return existsSync(`/proc/${pid}`);
     try {
         process.kill(pid, 0);
         return true;

package/lib/utils/install-packument-cache.d.ts

@@ -3,6 +3,29 @@ export interface CachedPackument {
     etag: string;
     packument: Packument;
 }
+/**
+ * The cache key for a (registry, name) pair — exported so the filename rule
+ * below is a PROPERTY a test can assert, not a claim in a comment.
+ *
+ * THE SEPARATOR IS NOT COSMETIC. It used to be `|`, producing names like
+ * `corgi|https%3A%2F%2Fregistry.npmjs.org%2F|%40gjsify%2Fnode-gi.json` — and `|`
+ * is a Win32 RESERVED filename character, so every write failed with `EINVAL`.
+ * Nothing reported it: `atomicWrite` is best-effort on purpose (a read-only
+ * cache volume must not break an install) and `readCacheFile` reads an
+ * unreadable path as a MISS. So on Windows this cache was never broken loudly —
+ * it was silently DEAD, and the `If-None-Match` → `304` revalidation that is the
+ * entire reason this file exists never engaged once.
+ *
+ * `,` is legal on Win32 AND escaped by `encodeURIComponent`, which is what keeps
+ * a flat two-part name injective: an encoded part cannot contain the separator,
+ * so exactly one `(registry, name)` pair maps to any given filename.
+ *
+ * The shard key and the filename are derived from the SAME encoded parts. They
+ * used to disagree — the key hashed the raw pair while the name used the encoded
+ * one — which is how a reserved character in the name survived review of a
+ * function whose other half looked correct.
+ */
+export declare function packumentCacheKey(registry: string, name: string): string;
 /**
  * Read a cached packument + its ETag for `(registry, name)`. Returns `null` on
  * a miss, when the cache is disabled, or when the entry is unreadable/corrupt

package/lib/utils/install-packument-cache.js

@@ -13,19 +13,22 @@
 //
 // Layout:
 //
-//   $XDG_CACHE_HOME/gjsify/metadata/v1/<shard>/<encoded-registry>|<encoded-name>.json
+//   $XDG_CACHE_HOME/gjsify/metadata/v2/<shard>/<encoded-registry>,<encoded-name>.json
 //
 // The cache is keyed by (registry, name) — NOT name alone — so switching the
 // registry for a scope can never serve a packument from the wrong source on a
 // coincidental ETag match. `<shard>` is a 2-hex FNV-1a digest of the key, a
 // directory-fan-out step so the leaf dir never grows unbounded (same rationale
-// as the tarball cache's hex sharding). `v1` is a layout version.
+// as the tarball cache's hex sharding). `v2` is a layout version.
 //
 // Disabled with `GJSIFY_PACKUMENT_CACHE=0` (or `false`). Honours
 // `XDG_CACHE_HOME` like the tarball + dlx caches.
 import { join } from 'node:path';
 import { atomicWrite, gjsifyCacheRoot, readCacheFile } from './install-cache-fs.js';
-const CACHE_LAYOUT_VERSION = 'v1';
+// v2: the separator changed from the Win32-reserved `|` to `,` (see `pathFor`),
+// so every v1 entry is unreachable rather than merely stale — a new root retires
+// them instead of leaving orphans under the old one.
+const CACHE_LAYOUT_VERSION = 'v2';
 /** `true` unless `GJSIFY_PACKUMENT_CACHE` is `0` / `false` / empty. */
 function isEnabled() {
     const flag = process.env.GJSIFY_PACKUMENT_CACHE;
@@ -34,7 +37,7 @@ function isEnabled() {
     const trimmed = flag.trim();
     return !(trimmed === '0' || trimmed === 'false' || trimmed === '');
 }
-/** Root of the packument cache: `$XDG_CACHE_HOME/gjsify/metadata/v1`. */
+/** Root of the packument cache: `$XDG_CACHE_HOME/gjsify/metadata/v2`. */
 function cacheRoot() {
     return gjsifyCacheRoot('metadata', CACHE_LAYOUT_VERSION);
 }
@@ -47,15 +50,47 @@ function shardFor(key) {
     }
     return ((h >>> 0) & 0xff).toString(16).padStart(2, '0');
 }
-/** Filesystem path for a (registry, name) pair, or `null` when disabled. */
+/**
+ * One path part, made safe for EVERY filesystem we run on.
+ *
+ * `encodeURIComponent` alone is not enough: it deliberately leaves `*` (and
+ * `!'()`) unescaped, and `*` is one of Win32's reserved filename characters.
+ * A scoped package never contains one today, but a registry URL can, and the
+ * failure mode is the silent one described on {@link pathFor}.
+ */
+function encodePart(part) {
+    return encodeURIComponent(part).replace(/\*/g, '%2A');
+}
+/**
+ * The cache key for a (registry, name) pair — exported so the filename rule
+ * below is a PROPERTY a test can assert, not a claim in a comment.
+ *
+ * THE SEPARATOR IS NOT COSMETIC. It used to be `|`, producing names like
+ * `corgi|https%3A%2F%2Fregistry.npmjs.org%2F|%40gjsify%2Fnode-gi.json` — and `|`
+ * is a Win32 RESERVED filename character, so every write failed with `EINVAL`.
+ * Nothing reported it: `atomicWrite` is best-effort on purpose (a read-only
+ * cache volume must not break an install) and `readCacheFile` reads an
+ * unreadable path as a MISS. So on Windows this cache was never broken loudly —
+ * it was silently DEAD, and the `If-None-Match` → `304` revalidation that is the
+ * entire reason this file exists never engaged once.
+ *
+ * `,` is legal on Win32 AND escaped by `encodeURIComponent`, which is what keeps
+ * a flat two-part name injective: an encoded part cannot contain the separator,
+ * so exactly one `(registry, name)` pair maps to any given filename.
+ *
+ * The shard key and the filename are derived from the SAME encoded parts. They
+ * used to disagree — the key hashed the raw pair while the name used the encoded
+ * one — which is how a reserved character in the name survived review of a
+ * function whose other half looked correct.
+ */
+export function packumentCacheKey(registry, name) {
+    return `${encodePart(registry)},${encodePart(name)}`;
+}
 function pathFor(registry, name) {
     if (!isEnabled())
         return null;
-    const key = `${registry}|${name}`;
-    // encodeURIComponent makes both halves filesystem-safe (`/` → `%2F`, etc.)
-    // while staying a stable, reversible, single path segment.
-    const file = `${encodeURIComponent(registry)}|${encodeURIComponent(name)}.json`;
-    return join(cacheRoot(), shardFor(key), file);
+    const key = packumentCacheKey(registry, name);
+    return join(cacheRoot(), shardFor(key), `${key}.json`);
 }
 /**
  * Read a cached packument + its ETag for `(registry, name)`. Returns `null` on

package/lib/utils/install-tarball-cache.js

@@ -30,6 +30,7 @@
 // same hex bytes share the same cache entry; that is the invariant pnpm
 // relies on too. Tarballs without an integrity hash (older registries)
 // fall through to a no-op cache and download every time.
+import { Buffer } from 'node:buffer';
 import { existsSync, statSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
@@ -53,14 +54,10 @@ function parseSri(integrity) {
         return null;
     const algorithm = integrity.slice(0, dashIdx);
     const b64 = integrity.slice(dashIdx + 1).replace(/=+$/, '');
-    // Decode base64 → hex; throws on malformed input which we swallow.
-    let hex;
-    try {
-        hex = Buffer.from(b64, 'base64').toString('hex');
-    }
-    catch {
-        return null;
-    }
+    // Base64 decoding is lenient on every runtime (Node skips invalid chars,
+    // @gjsify/buffer's table decode maps them to 0): malformed input yields
+    // short/garbage output — caught by the length check below — never a throw.
+    const hex = Buffer.from(b64, 'base64').toString('hex');
     if (hex.length < 4)
         return null;
     return { algorithm, hex };

package/lib/utils/oxc-resolve.js

@@ -45,7 +45,7 @@
 // `gjsify/register-class-order` rule wired via `.oxlintrc.json` jsPlugins)
 // lives in the Node launcher, so a native oxlint bridge could only run the
 // Rust rule subset. Lint stays Node-spawned until that trade-off is decided
-// (tracked in STATUS.md Open TODOs).
+// (tracked in status/open-todos.md).
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { createRequire } from 'node:module';

package/lib/utils/prompt.js

@@ -82,7 +82,12 @@ async function runRawSession(fn) {
                 out.write(r.echo);
             if (r.interrupt) {
                 cleanup();
-                process.exit(130);
+                // `return` — a bare `process.exit()` is deferred under GJS (no
+                // atexit), so the loop kept consuming the rest of the chunk
+                // after Ctrl-C and could still resolve the pending prompt.
+                // Returning stops input handling here; the deferred exit then
+                // carries 130 on the way out.
+                return process.exit(130);
             }
             if (r.done) {
                 const { resolve } = pending;

package/lib/utils/runtimes.d.ts

@@ -26,6 +26,24 @@ export declare const RUNTIMES: Record<ExampleRuntime, RuntimeSpec>;
 export declare function isExampleRuntime(value: string): value is ExampleRuntime;
 /** The `gjsify build --app <target>` a runtime consumes (`gjs`, else `node`). */
 export declare function buildAppForRuntime(runtime: ExampleRuntime): 'gjs' | 'node';
+/**
+ * Does running an example/showcase on `runtime` require the GJS SYSTEM
+ * dependencies — i.e. a `gjs` binary on PATH?
+ *
+ * DERIVED from `buildApp`, deliberately not a second table: "consumes the
+ * `--app gjs` bundle" and "needs a gjs interpreter" are the same fact, and a
+ * hand-written second list drifts the first time a runtime is added.
+ *
+ * The caller must resolve the runtime BEFORE gating on it. `gjsify showcase`
+ * called `runMinimalChecks()` — which marks `gjs` `required` — three statements
+ * ABOVE the line resolving `args.runtime`, so `--runtime node` aborted with
+ * "Missing system dependencies: ✗ GJS" before reaching the `runtime !== 'gjs'`
+ * branch that never touches gjs. Every showcase was unreachable on a host
+ * without gjs (Windows, plain Node/bun/deno) — including the default path,
+ * since `defaultExampleRuntime()` falls back to the host runtime for exactly
+ * those hosts.
+ */
+export declare function requiresGjsSystemDeps(runtime: ExampleRuntime): boolean;
 /** Whether `<probe> --version` succeeds (i.e. the runtime binary is on PATH). */
 export declare function isRuntimeOnPath(probe: string): boolean;
 /**

package/lib/utils/runtimes.js

@@ -41,6 +41,26 @@ export function isExampleRuntime(value) {
 export function buildAppForRuntime(runtime) {
     return RUNTIMES[runtime].buildApp;
 }
+/**
+ * Does running an example/showcase on `runtime` require the GJS SYSTEM
+ * dependencies — i.e. a `gjs` binary on PATH?
+ *
+ * DERIVED from `buildApp`, deliberately not a second table: "consumes the
+ * `--app gjs` bundle" and "needs a gjs interpreter" are the same fact, and a
+ * hand-written second list drifts the first time a runtime is added.
+ *
+ * The caller must resolve the runtime BEFORE gating on it. `gjsify showcase`
+ * called `runMinimalChecks()` — which marks `gjs` `required` — three statements
+ * ABOVE the line resolving `args.runtime`, so `--runtime node` aborted with
+ * "Missing system dependencies: ✗ GJS" before reaching the `runtime !== 'gjs'`
+ * branch that never touches gjs. Every showcase was unreachable on a host
+ * without gjs (Windows, plain Node/bun/deno) — including the default path,
+ * since `defaultExampleRuntime()` falls back to the host runtime for exactly
+ * those hosts.
+ */
+export function requiresGjsSystemDeps(runtime) {
+    return buildAppForRuntime(runtime) === 'gjs';
+}
 /** Whether `<probe> --version` succeeds (i.e. the runtime binary is on PATH). */
 export function isRuntimeOnPath(probe) {
     try {

package/lib/utils/stdin.js

@@ -75,14 +75,13 @@ function readStdinTextGioFile() {
         throw new Error('Gio.File.load_contents("/dev/stdin") returned false');
     return new TextDecoder().decode(contents);
 }
-/** The GJS `imports.gi` namespace, or `undefined` when not running on GJS. */
+/**
+ * The GJS `imports.gi` namespace, or `undefined` when not running on GJS.
+ * Same optional-chained probe as `isGjs()` — off GJS `imports` is simply
+ * absent and the read yields `undefined`; there is no throw path.
+ */
 function giNamespace() {
-    try {
-        return globalThis.imports?.gi;
-    }
-    catch {
-        return undefined;
-    }
+    return globalThis.imports?.gi;
 }
 /**
  * Read the whole of stdin as UTF-8. Works on Node and under the GJS bundle.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/cli",
-    "version": "0.25.1",
+    "version": "0.26.1",
     "description": "CLI for Gjsify",
     "type": "module",
     "main": "lib/index.js",
@@ -130,19 +130,19 @@
         "cli"
     ],
     "dependencies": {
-        "@gjsify/buffer": "^0.25.1",
-        "@gjsify/create-app": "^0.25.1",
-        "@gjsify/node-globals": "^0.25.1",
-        "@gjsify/node-polyfills": "^0.25.1",
-        "@gjsify/npm-registry": "^0.25.1",
-        "@gjsify/resolve-npm": "^0.25.1",
-        "@gjsify/rolldown-plugin-gjsify": "^0.25.1",
-        "@gjsify/rolldown-plugin-pnp": "^0.25.1",
-        "@gjsify/semver": "^0.25.1",
-        "@gjsify/tar": "^0.25.1",
-        "@gjsify/tsc": "^0.25.1",
-        "@gjsify/web-polyfills": "^0.25.1",
-        "@gjsify/workspace": "^0.25.1",
+        "@gjsify/buffer": "^0.26.1",
+        "@gjsify/create-app": "^0.26.1",
+        "@gjsify/node-globals": "^0.26.1",
+        "@gjsify/node-polyfills": "^0.26.1",
+        "@gjsify/npm-registry": "^0.26.1",
+        "@gjsify/resolve-npm": "^0.26.1",
+        "@gjsify/rolldown-plugin-gjsify": "^0.26.1",
+        "@gjsify/rolldown-plugin-pnp": "^0.26.1",
+        "@gjsify/semver": "^0.26.1",
+        "@gjsify/tar": "^0.26.1",
+        "@gjsify/tsc": "^0.26.1",
+        "@gjsify/web-polyfills": "^0.26.1",
+        "@gjsify/workspace": "^0.26.1",
         "cosmiconfig": "^9.0.2",
         "get-tsconfig": "^4.14.0",
         "pkg-types": "^2.3.1",
@@ -150,13 +150,13 @@
         "yargs": "^18.0.0"
     },
     "devDependencies": {
-        "@gjsify/unit": "^0.25.1",
+        "@gjsify/unit": "^0.26.1",
         "@types/yargs": "^17.0.35",
         "typescript": "^6.0.3"
     },
     "peerDependencies": {
-        "@gjsify/oxfmt-native": "^0.25.1",
-        "@gjsify/rolldown-native": "^0.25.1"
+        "@gjsify/oxfmt-native": "^0.26.1",
+        "@gjsify/rolldown-native": "^0.26.1"
     },
     "peerDependenciesMeta": {
         "@gjsify/oxfmt-native": {