@gjsify/cli 0.40.0 → 0.41.0

package/lib/utils/install-provenance.js

@@ -0,0 +1,106 @@
+// How was THIS gjsify installed?
+//
+// `self-update` re-runs the `gjsify install -g` pipeline, which writes into the
+// user-global XDG prefix. That is correct for an install that came from
+// `install.mjs` or `gjsify install -g`, and WRONG for one a package manager owns:
+// it would lay a second copy into `~/.local` that shadows — or is shadowed by —
+// the one apt/dnf/flatpak is tracking, and the package manager would then be
+// managing a file the user no longer runs. The next `apt upgrade` reverts or
+// diverges, silently, and "I updated it and nothing changed" is the report.
+//
+// Before `gjsify ship` there was only one non-XDG case worth naming (`npm -g`),
+// and the command warned and continued. Now that gjsify ships as `.deb`, `.rpm`
+// and Flatpak, continuing is the defect. So the question gets a real answer, and
+// the answer carries the command the user should run instead.
+//
+// Everything here is derived from where the RUNNING code sits, never from a
+// build-time constant: one tarball is unpacked by all of these routes, so a flag
+// baked at build time would describe the builder rather than the installation.
+import { posix, win32 } from 'node:path';
+/** System prefixes a distro package stages into. POSIX only — win32 handled separately. */
+const SYSTEM_PREFIXES = ['/usr/', '/opt/', '/snap/'];
+/** Inside a Flatpak the whole app tree lives under this prefix. */
+const FLATPAK_PREFIX = '/app/';
+/**
+ * The TARGET platform's path module, never the host's.
+ *
+ * Same rule as `pathFor` in `install-global.ts`, and for the same reason: this
+ * function ACCEPTS a `platform` and must therefore answer for it. Reading the
+ * host's `node:path` instead makes every POSIX-shaped case unanswerable from a
+ * Windows runner — which is exactly what happened. Four of these tests went red on
+ * the win32 leg, on `main`, because `resolve('/app/lib')` there is `C:\app\lib`
+ * and `sep` is a backslash.
+ */
+function pathFor(platform) {
+    return platform === 'win32' ? win32 : posix;
+}
+/** Does `child` sit inside `parent`? Both must be absolute and already resolved. */
+function isInside(child, parent, platform) {
+    const p = pathFor(platform);
+    if (!p.isAbsolute(child) || !p.isAbsolute(parent))
+        return false;
+    const withSep = parent.endsWith(p.sep) ? parent : parent + p.sep;
+    return child === parent || child.startsWith(withSep);
+}
+/**
+ * Classify an installation from its path and environment.
+ *
+ * ORDER MATTERS and is not alphabetical:
+ *
+ *  1. **Flatpak first.** Its `/app` prefix would also satisfy no other test, but
+ *     `FLATPAK_ID` is the unambiguous signal and is present even when the tree is
+ *     mounted somewhere unusual.
+ *  2. **XDG before system.** The XDG prefix is under `$HOME`, so it can never be
+ *     `/usr` — but a user whose `$HOME` is `/opt/someuser` exists, and asking the
+ *     narrow question first means that user is not told to run `dnf`.
+ *  3. **System before npm.** A `.deb` stages a `node_modules`-shaped tree under
+ *     `/usr/lib`, so the npm test alone would claim it.
+ */
+export function classifyInstall(input) {
+    const env = input.env ?? process.env;
+    const platform = input.platform ?? process.platform;
+    const p = pathFor(platform);
+    const selfDir = p.resolve(input.selfDir);
+    if (env.FLATPAK_ID || isInside(selfDir, FLATPAK_PREFIX, platform)) {
+        const id = env.FLATPAK_ID ?? 'io.github.gjsify.Cli';
+        return {
+            kind: 'flatpak',
+            evidence: env.FLATPAK_ID ? `FLATPAK_ID=${env.FLATPAK_ID}` : `running from ${FLATPAK_PREFIX}`,
+            updateWith: `flatpak update ${id}`,
+            managedElsewhere: true,
+        };
+    }
+    if (isInside(selfDir, p.resolve(input.xdgPrefix), platform)) {
+        return {
+            kind: 'xdg-global',
+            evidence: `running from the user-global prefix ${input.xdgPrefix}`,
+            managedElsewhere: false,
+        };
+    }
+    if (platform !== 'win32' && SYSTEM_PREFIXES.some((pfx) => isInside(selfDir, pfx, platform))) {
+        return {
+            kind: 'system-package',
+            evidence: `running from the system prefix ${selfDir}`,
+            // Not `apt` or `dnf` specifically: the same path serves both, and
+            // guessing wrong sends the user to a package manager that does not
+            // know this file. The release assets are named because they are the
+            // one answer that is true on every distribution.
+            updateWith: 'your distribution package manager (`apt upgrade` / `dnf upgrade` / …), or install the newer package from ' +
+                'https://github.com/gjsify/gjsify/releases/latest',
+            managedElsewhere: true,
+        };
+    }
+    if (selfDir.split(p.sep).includes('node_modules')) {
+        return {
+            kind: 'npm-global',
+            evidence: `running from a node_modules tree at ${selfDir}`,
+            updateWith: 'npm install -g @gjsify/cli@latest (or switch to the Node-free bootstrap)',
+            managedElsewhere: true,
+        };
+    }
+    return {
+        kind: 'unknown',
+        evidence: `running from ${selfDir}, which matches no known install layout`,
+        managedElsewhere: false,
+    };
+}

package/lib/utils/prune-prefix.d.ts

@@ -0,0 +1,83 @@
+import { type PlatformDeclaration, type PlatformTarget, type PlatformVerdict } from './platform-check.js';
+/** One package directory found under a prefix's `node_modules` tree. */
+export interface InstalledPackage {
+    /** `name` from its manifest, or the directory path when the manifest is unreadable. */
+    name: string;
+    version: string;
+    /** Absolute path to the package directory. */
+    dir: string;
+    /**
+     * A symlink, i.e. a workspace source tree linked into `node_modules` rather than
+     * a copy the installer extracted. Never pruned and never descended: the installer
+     * refuses to remove one for the same reason, and following it would walk the
+     * user's own sources.
+     */
+    linked: boolean;
+    /** The `os`/`cpu`/`libc` slice, absent when the manifest declares none. */
+    platform?: PlatformDeclaration;
+}
+export interface PruneEntry {
+    pkg: InstalledPackage;
+    /** Apparent size of the package directory, summed from `statSync().size`. */
+    bytes: number;
+    verdict: PlatformVerdict;
+}
+export interface PrunePlan {
+    prefix: string;
+    target: PlatformTarget;
+    /** How many package directories were examined, so an empty plan is distinguishable from an empty scan. */
+    scanned: number;
+    entries: PruneEntry[];
+    bytes: number;
+}
+export interface PruneResult {
+    plan: PrunePlan;
+    removed: PruneEntry[];
+    failed: Array<{
+        entry: PruneEntry;
+        error: string;
+    }>;
+    bytes: number;
+    /** `.bin` entries removed because they were symlinks with no target left. */
+    binLinks: string[];
+}
+/** Every package directory under `<prefix>/node_modules`, at any depth. */
+export declare function scanPrefix(prefix: string): InstalledPackage[];
+/**
+ * The packages `target` cannot use. Pure — no filesystem, no `process.*` — so every
+ * OS/arch/libc branch is decidable from any host.
+ */
+export declare function planPlatformPrune(pkgs: readonly InstalledPackage[], target: PlatformTarget): PruneEntry[];
+/** Apparent size of a directory tree — what the files claim, not what the block device spent. */
+export declare function dirBytes(dir: string): number;
+export declare function planPrune(opts: {
+    prefix: string;
+    target: PlatformTarget;
+}): PrunePlan;
+/**
+ * Remove a plan's entries.
+ *
+ * `remove` is injected so the failure path is testable without a filesystem that
+ * can fail on demand. Nothing here throws: this runs as housekeeping at the end of
+ * an install, and an install that already succeeded must not be reported as failed
+ * because a directory could not be unlinked.
+ */
+export declare function executePrune(plan: PrunePlan, opts?: {
+    dryRun?: boolean;
+    remove?: (dir: string) => void;
+}): PruneResult;
+export declare function formatPruneReport(result: PruneResult, opts: {
+    dryRun: boolean;
+    verbose: boolean;
+}): string;
+/** Why an automatic pass declined to run, or null when it may proceed. */
+export declare function automaticPruneRefusal(env: Record<string, string | undefined>, immutable: boolean): string | null;
+/**
+ * The automatic pass: prune what this install would not have placed, report one
+ * line, and never fail the install that called it.
+ */
+export declare function pruneAfterInstall(prefix: string, target: PlatformTarget, opts?: {
+    env?: Record<string, string | undefined>;
+    immutable?: boolean;
+    hint?: string;
+}): void;

package/lib/utils/prune-prefix.js

@@ -0,0 +1,333 @@
+// Remove what an install prefix holds that THIS host cannot use.
+//
+// An install prefix is a write-only union today: `applyPlatformFilter` keeps a
+// foreign-platform package from being installed, and nothing ever removes one that
+// an EARLIER install placed. Measured on a workstation whose user-global prefix was
+// created in May and whose CLI was current: 638 MB, of which `@rolldown` alone was
+// 258 MB across sixteen platform bindings on a host that can load exactly one.
+//
+// The residue is ACCRETION, not a live filter defect, and the on-disk versions are
+// what prove it: the foreign `@rolldown/binding-*` dirs were a minor version behind
+// the `rolldown` that pins all of them, and every foreign `@gjsify/*-<os>-<arch>`
+// was at the release that first SHIPPED the filter. They were written by the
+// previous CLI, during the self-update that installed the fix. A filter cannot
+// remove what predates it, which is why this exists as its own pass.
+//
+// ## What this is allowed to decide
+//
+// One rule, and it is a pure manifest read: npm's own `os`/`cpu`/`libc` fields,
+// through the SAME `checkPlatform` the installer filters with — so a pruned prefix
+// converges on what a fresh install would have placed, rather than on this module's
+// opinion. A package that declares nothing is never touched: `@rolldown/binding-
+// wasm32-wasi` is unusable here and says so nowhere, and guessing from its name is
+// how a prune starts deleting things it cannot justify.
+//
+// Reachability ("nothing installed points at this any more") would catch that one
+// and more, but it needs a record of what the prefix was ASSEMBLED FROM, which no
+// prefix carries yet. Uncertain means keep — see ADR 0025 and
+// `status/open-todos.md`.
+import { existsSync, lstatSync, readFileSync, readdirSync, rmSync, statSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+import { checkPlatform, declaresPlatform, describePlatformTarget, readPlatformOverrides, } from './platform-check.js';
+/** Directory entries under `node_modules` that are never packages. */
+function isReservedEntry(name) {
+    // `.bin` holds launchers, `.gjsify-install-lock` is the LIVE cross-process lock
+    // directory — removing it mid-install would hand the prefix to a second writer.
+    return name.startsWith('.');
+}
+function readManifest(dir) {
+    try {
+        const raw = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
+        const platform = {
+            os: raw.os,
+            cpu: raw.cpu,
+            libc: raw.libc,
+        };
+        return {
+            name: typeof raw.name === 'string' ? raw.name : undefined,
+            version: typeof raw.version === 'string' ? raw.version : undefined,
+            platform: declaresPlatform(platform) ? platform : undefined,
+        };
+    }
+    catch {
+        // An unreadable or half-written manifest declares nothing, which makes the
+        // package un-prunable by the only rule this module has. That is the safe
+        // direction: the one thing worse than 638 MB of residue is deleting a
+        // package because its manifest could not be parsed.
+        return null;
+    }
+}
+function collect(nodeModules, out) {
+    let entries;
+    try {
+        entries = readdirSync(nodeModules, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (isReservedEntry(entry.name))
+            continue;
+        const full = join(nodeModules, entry.name);
+        if (entry.name.startsWith('@')) {
+            let scoped;
+            try {
+                scoped = readdirSync(full, { withFileTypes: true });
+            }
+            catch {
+                continue;
+            }
+            for (const inner of scoped) {
+                if (isReservedEntry(inner.name))
+                    continue;
+                addPackage(join(full, inner.name), out);
+            }
+            continue;
+        }
+        addPackage(full, out);
+    }
+}
+function addPackage(dir, out) {
+    let linked = false;
+    try {
+        linked = lstatSync(dir).isSymbolicLink();
+    }
+    catch {
+        return;
+    }
+    const manifest = readManifest(dir);
+    out.push({
+        name: manifest?.name ?? dir,
+        version: manifest?.version ?? '0.0.0',
+        dir,
+        linked,
+        platform: manifest?.platform,
+    });
+    // A linked package is the user's own source tree — its `node_modules` is not
+    // this prefix's to prune.
+    if (!linked)
+        collect(join(dir, 'node_modules'), out);
+}
+/** Every package directory under `<prefix>/node_modules`, at any depth. */
+export function scanPrefix(prefix) {
+    const out = [];
+    collect(join(prefix, 'node_modules'), out);
+    return out;
+}
+/**
+ * The packages `target` cannot use. Pure — no filesystem, no `process.*` — so every
+ * OS/arch/libc branch is decidable from any host.
+ */
+export function planPlatformPrune(pkgs, target) {
+    const entries = [];
+    for (const pkg of pkgs) {
+        if (pkg.linked || !pkg.platform)
+            continue;
+        const verdict = checkPlatform(pkg.platform, target);
+        if (!verdict.ok)
+            entries.push({ pkg, bytes: 0, verdict });
+    }
+    return entries;
+}
+/** Apparent size of a directory tree — what the files claim, not what the block device spent. */
+export function dirBytes(dir) {
+    let total = 0;
+    const stack = [dir];
+    while (stack.length > 0) {
+        const current = stack.pop();
+        let entries;
+        try {
+            entries = readdirSync(current, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            const full = join(current, entry.name);
+            if (entry.isDirectory()) {
+                stack.push(full);
+            }
+            else if (entry.isFile()) {
+                try {
+                    total += statSync(full).size;
+                }
+                catch {
+                    // A file that vanished mid-walk contributes nothing; a size is a
+                    // report, and refusing to produce one over a race would be worse.
+                }
+            }
+        }
+    }
+    return total;
+}
+export function planPrune(opts) {
+    const pkgs = scanPrefix(opts.prefix);
+    const entries = planPlatformPrune(pkgs, opts.target);
+    for (const entry of entries)
+        entry.bytes = dirBytes(entry.pkg.dir);
+    return {
+        prefix: opts.prefix,
+        target: opts.target,
+        scanned: pkgs.length,
+        entries,
+        bytes: entries.reduce((sum, e) => sum + e.bytes, 0),
+    };
+}
+/**
+ * Remove a plan's entries.
+ *
+ * `remove` is injected so the failure path is testable without a filesystem that
+ * can fail on demand. Nothing here throws: this runs as housekeeping at the end of
+ * an install, and an install that already succeeded must not be reported as failed
+ * because a directory could not be unlinked.
+ */
+export function executePrune(plan, opts = {}) {
+    const removed = [];
+    const failed = [];
+    const binLinks = [];
+    // `maxRetries` mirrors the installer's own removal: on Windows a handle held by
+    // a virus scanner or an indexer makes the first unlink fail and the third work.
+    const remove = opts.remove ?? ((dir) => rmSync(dir, { recursive: true, force: true, maxRetries: 10 }));
+    if (!opts.dryRun) {
+        for (const entry of plan.entries) {
+            try {
+                remove(entry.pkg.dir);
+                removed.push(entry);
+            }
+            catch (err) {
+                failed.push({ entry, error: err.message });
+            }
+        }
+        binLinks.push(...pruneDeadBinLinks(plan.prefix));
+    }
+    return {
+        plan,
+        removed,
+        failed,
+        bytes: removed.reduce((sum, e) => sum + e.bytes, 0),
+        binLinks,
+    };
+}
+/**
+ * Drop `.bin` entries that are SYMLINKS whose target is gone.
+ *
+ * Only symlinks, and only dangling ones: that is the case where deadness is
+ * provable from the filesystem alone. A `.bin` entry that is a real file may be a
+ * launcher script this prefix still needs, and deciding that would mean reading it —
+ * a second, weaker rule for a few hundred bytes.
+ */
+function pruneDeadBinLinks(prefix) {
+    const binDir = join(prefix, 'node_modules', '.bin');
+    const dropped = [];
+    let entries;
+    try {
+        entries = readdirSync(binDir, { withFileTypes: true });
+    }
+    catch {
+        return dropped;
+    }
+    for (const entry of entries) {
+        const full = join(binDir, entry.name);
+        try {
+            if (!lstatSync(full).isSymbolicLink())
+                continue;
+            if (existsSync(full))
+                continue;
+            unlinkSync(full);
+            dropped.push(entry.name);
+        }
+        catch {
+            // Same reasoning as `executePrune`: housekeeping never fails the caller.
+        }
+    }
+    return dropped;
+}
+function humanBytes(bytes) {
+    if (bytes < 1024)
+        return `${bytes} B`;
+    const units = ['KB', 'MB', 'GB'];
+    let value = bytes / 1024;
+    let unit = 0;
+    while (value >= 1024 && unit < units.length - 1) {
+        value /= 1024;
+        unit += 1;
+    }
+    return `${value.toFixed(1)} ${units[unit]}`;
+}
+/** How many entries a non-verbose report lists before summarising the rest. */
+const REPORT_HEAD = 10;
+export function formatPruneReport(result, opts) {
+    const { plan } = result;
+    const lines = [
+        `${plan.prefix} · target ${describePlatformTarget(plan.target)} · scanned ${plan.scanned} package(s)`,
+    ];
+    if (plan.entries.length === 0) {
+        // Not "every package declares a platform this host can use": most declare
+        // none at all, and saying otherwise reports a check that did not happen.
+        lines.push('nothing to prune — no installed package declares a platform this target cannot use.');
+        return lines.join('\n');
+    }
+    const shown = opts.verbose ? plan.entries : plan.entries.slice(0, REPORT_HEAD);
+    for (const entry of shown) {
+        const required = JSON.stringify(entry.verdict.required);
+        lines.push(`  ${entry.pkg.name}@${entry.pkg.version}  ${humanBytes(entry.bytes)}  requires ${required}`);
+    }
+    if (shown.length < plan.entries.length) {
+        lines.push(`  … and ${plan.entries.length - shown.length} more (--verbose to list them)`);
+    }
+    // The byte figure is APPARENT size, summed from the files themselves. `du`
+    // reports allocated blocks and will disagree; saying so here is cheaper than
+    // the bug report that difference otherwise produces.
+    lines.push(opts.dryRun
+        ? `would free ${humanBytes(plan.bytes)} across ${plan.entries.length} package(s) (apparent size)`
+        : `freed ${humanBytes(result.bytes)} across ${result.removed.length} package(s) (apparent size)`);
+    if (result.binLinks.length > 0) {
+        lines.push(`removed ${result.binLinks.length} dangling .bin link(s): ${result.binLinks.join(', ')}`);
+    }
+    for (const f of result.failed) {
+        lines.push(`FAILED ${f.entry.pkg.name}: ${f.error}`);
+    }
+    return lines.join('\n');
+}
+/** Why an automatic pass declined to run, or null when it may proceed. */
+export function automaticPruneRefusal(env, immutable) {
+    // THE data-loss guard. `--os/--cpu/--libc` are legal on `gjsify install -g`, and
+    // they reach here as npm config keys. Pruning against a target the USER TYPED
+    // would make `gjsify install -g foo --os=darwin` delete every linux package in
+    // the real shared prefix — the engine set, the bundler bindings, the CLI's own.
+    // An explicit `gjsify prune --os=darwin` stays legal; it is a request, not a
+    // side effect.
+    if (Object.keys(readPlatformOverrides(env)).length > 0) {
+        return 'the platform target was overridden on the command line';
+    }
+    // `--immutable` promises the tree is not modified. Resolution-only would be a
+    // defensible reading, but it is not the one the flag's users have, and
+    // `ensureProjectGjsEngine` already declines under it for the same reason.
+    if (immutable)
+        return '--immutable';
+    return null;
+}
+/**
+ * The automatic pass: prune what this install would not have placed, report one
+ * line, and never fail the install that called it.
+ */
+export function pruneAfterInstall(prefix, target, opts = {}) {
+    try {
+        const refusal = automaticPruneRefusal(opts.env ?? process.env, opts.immutable ?? false);
+        if (refusal)
+            return;
+        const plan = planPrune({ prefix, target });
+        if (plan.entries.length === 0)
+            return;
+        const result = executePrune(plan);
+        if (result.removed.length === 0)
+            return;
+        const hint = opts.hint ? ` (${opts.hint} to review)` : '';
+        console.log(`gjsify: pruned ${result.removed.length} package(s) this host cannot use, ` +
+            `freeing ${humanBytes(result.bytes)}${hint}`);
+    }
+    catch (err) {
+        if (process.env.GJSIFY_DEBUG)
+            console.error(`gjsify: prune skipped — ${err.message}`);
+    }
+}

package/lib/utils/ship/depends.js

@@ -106,6 +106,23 @@ const TYPELIB_PACKAGES = {
     'Vte-3.91': { deb: 'gir1.2-vte-3.91', rpm: 'vte291-gtk4' },
     'Manette-0.2': { deb: 'gir1.2-manette-0.2', rpm: 'libmanette' },
 };
+/**
+ * A typelib the payload CARRIES, rather than one the system provides.
+ *
+ * `@gjsify/*`'s native bridges ship their own `.typelib` inside the package —
+ * `GjsifyHttpSoupBridge`, which `@gjsify/http`'s server pulls in unconditionally,
+ * plus `GjsifyHttp2`, `GjsifySabNative` and the rest of the `*-native` set. No
+ * distribution has ever packaged a `gir1.2-gjsifyhttpsoupbridge` and none can:
+ * the file is in the tarball being built. So these are not a gap in the table.
+ * Mapping one would emit a dependency apt and dnf must fail to resolve, and the
+ * module header's rule — an unmapped namespace FAILS the build — is about a
+ * SYSTEM library nobody declared, which is the opposite situation.
+ *
+ * Excluding them is a precondition for widening the namespace scanner rather
+ * than a refinement of it: without this, `gjsify ship` throws on every project
+ * whose bundle reaches one, which includes every `@gjsify/http` server.
+ */
+const BUNDLED_TYPELIB = /^Gjsify[A-Z]/;
 /**
  * The `Depends:` / `Requires:` list for one format.
  *
@@ -115,6 +132,8 @@ export function deriveDepends(format, inputs) {
     const out = [`gjs >= ${inputs.minGjsVersion ?? DEFAULT_GJS_FLOOR}`];
     const unmapped = [];
     for (const namespace of [...new Set(inputs.namespaces)].sort()) {
+        if (BUNDLED_TYPELIB.test(namespace))
+            continue;
         const entry = lookupTypelib(namespace, inputs.typelibPackages);
         if (entry === undefined) {
             unmapped.push(namespace);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/cli",
-    "version": "0.40.0",
+    "version": "0.41.0",
     "description": "CLI for Gjsify",
     "type": "module",
     "main": "lib/index.js",
@@ -96,6 +96,14 @@
                 }
             ]
         },
+        "ship": {
+            "binaryName": "gjsify",
+            "bundle": "dist/cli.gjs.mjs",
+            "targets": [
+                "deb",
+                "rpm"
+            ]
+        },
         "tier": 1,
         "defineFromPackageJson": {
             "__PACKAGE_VERSION__": {
@@ -134,20 +142,20 @@
         "cli"
     ],
     "dependencies": {
-        "@gjsify/buffer": "^0.40.0",
-        "@gjsify/create-app": "^0.40.0",
-        "@gjsify/node-globals": "^0.40.0",
-        "@gjsify/node-polyfills": "^0.40.0",
-        "@gjsify/npm-registry": "^0.40.0",
-        "@gjsify/resolve-npm": "^0.40.0",
-        "@gjsify/rolldown-plugin-gjsify": "^0.40.0",
-        "@gjsify/vite-plugin-blueprint": "^0.40.0",
-        "@gjsify/rolldown-plugin-pnp": "^0.40.0",
-        "@gjsify/semver": "^0.40.0",
-        "@gjsify/tar": "^0.40.0",
-        "@gjsify/tsc": "^0.40.0",
-        "@gjsify/web-polyfills": "^0.40.0",
-        "@gjsify/workspace": "^0.40.0",
+        "@gjsify/buffer": "^0.41.0",
+        "@gjsify/create-app": "^0.41.0",
+        "@gjsify/node-globals": "^0.41.0",
+        "@gjsify/node-polyfills": "^0.41.0",
+        "@gjsify/npm-registry": "^0.41.0",
+        "@gjsify/resolve-npm": "^0.41.0",
+        "@gjsify/rolldown-plugin-gjsify": "^0.41.0",
+        "@gjsify/vite-plugin-blueprint": "^0.41.0",
+        "@gjsify/rolldown-plugin-pnp": "^0.41.0",
+        "@gjsify/semver": "^0.41.0",
+        "@gjsify/tar": "^0.41.0",
+        "@gjsify/tsc": "^0.41.0",
+        "@gjsify/web-polyfills": "^0.41.0",
+        "@gjsify/workspace": "^0.41.0",
         "acorn": "^8.17.0",
         "cosmiconfig": "^9.0.2",
         "get-tsconfig": "^4.14.0",
@@ -156,13 +164,13 @@
         "yargs": "^18.0.0"
     },
     "devDependencies": {
-        "@gjsify/unit": "^0.40.0",
+        "@gjsify/unit": "^0.41.0",
         "@types/yargs": "^17.0.35",
         "typescript": "^6.0.3"
     },
     "peerDependencies": {
-        "@gjsify/oxfmt-native": "^0.40.0",
-        "@gjsify/rolldown-native": "^0.40.0"
+        "@gjsify/oxfmt-native": "^0.41.0",
+        "@gjsify/rolldown-native": "^0.41.0"
     },
     "peerDependenciesMeta": {
         "@gjsify/oxfmt-native": {