@gjsify/cli 0.59.0 → 0.60.0

package/lib/utils/publish-hold.js

@@ -0,0 +1,213 @@
+// Do not publish a package whose dependency closure contains a version nobody can install.
+//
+// THE INCIDENT (v0.59.0 / v0.59.1). `@gjsify/adwaita-fonts@0.59.x` was accepted
+// by npm (202) and never served — it sits in "Validating". The sweep published
+// its dependents anyway: `publish-pins.ts` asks whether the NAME exists, and
+// `adwaita-fonts` has existed since 0.5x, so the guard passed. `adwaita-web` and
+// `adwaita-nativescript` 0.59.x went live pinning a version the registry does not
+// serve, and are uninstallable. A name guard cannot see that; a VERSION guard can,
+// at the price the name guard was designed to avoid — a version is eventually
+// consistent for minutes after its own 2xx (see `publish-readback.ts`), so this
+// one WAITS for the pin before it holds, and consults the status endpoint
+// (`publish-status.ts`) so a version that is terminally unavailable does not cost
+// the wait.
+//
+// The sweep is one `gjsify publish` PROCESS per package (`foreach --exec`), so a
+// verdict reached by one process cannot reach the next in memory. The ledger is
+// how it does: a JSONL file named by `GJSIFY_PUBLISH_LEDGER`, appended by every
+// process that finds a version unserved or holds a package. A dependent of a held
+// package then holds at once from the ledger instead of waiting out the budget
+// again — but only for a TERMINAL class; a `validating` entry is re-probed, and a
+// confirmed re-probe appends `served`. The end-of-job summary is rendered from
+// the same file.
+import { appendFileSync, existsSync, readFileSync } from 'node:fs';
+import { REQUIRED_BLOCK } from './publish-pins.js';
+import { verifyPublishedVersion } from './publish-readback.js';
+import { classifyUnserved, describeClass, fetchVersionStatus, isTerminalClass, } from './publish-status.js';
+/** Wait for a pin this long before holding. Covers the measured 252 s write lag (publish-readback.ts). */
+export const DEFAULT_HOLD_WAIT_MS = 300_000;
+/** `verifyPublishedVersion` needs a budget > 0; this makes it exactly one probe. */
+const SINGLE_PROBE_BUDGET_MS = 1;
+export function appendLedger(path, entry) {
+    if (!path)
+        return;
+    appendFileSync(path, `${JSON.stringify(entry)}\n`);
+}
+/** Tolerates a missing file (no entries yet) and skips unparseable lines rather than losing the rest. */
+export function readLedger(path) {
+    if (!path || !existsSync(path))
+        return [];
+    const entries = [];
+    for (const line of readFileSync(path, 'utf-8').split('\n')) {
+        if (!line.trim())
+            continue;
+        try {
+            const parsed = JSON.parse(line);
+            if (parsed.ev === 'unserved' || parsed.ev === 'held' || parsed.ev === 'served')
+                entries.push(parsed);
+        }
+        catch {
+            /* a torn line from a killed process must not hide the entries around it */
+        }
+    }
+    return entries;
+}
+/**
+ * The version a rewritten pin asks for, when the spec names exactly one:
+ * `0.59.1`, `^0.59.1`, `~0.59.1`. `undefined` for a range, tag or URL — those are
+ * not decidable against one version and the name-level guard covers them.
+ */
+export function pinVersion(spec) {
+    const match = /^[\^~]?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)$/.exec(spec.trim());
+    return match?.[1];
+}
+/**
+ * Every pin whose exact version the registry does not serve (after waiting for
+ * one that may be late), with the reason. Empty = safe to publish.
+ *
+ * Three cheap exits come first, in order: the ledger already knows this version
+ * is unserved or held; one packument probe finds it served (nine in ten); the
+ * status endpoint says it can never be served. Only a pin that is none of those —
+ * possibly just late — pays the wait.
+ */
+export async function findUnavailablePins(input) {
+    const reasons = [];
+    const seen = new Map();
+    for (const pin of input.pins) {
+        const version = pinVersion(pin.spec);
+        if (!version) {
+            input.log?.(`gjsify publish: ${pin.name}@${pin.spec} names no single version — not checked for hold`);
+            continue;
+        }
+        const key = `${pin.name}@${version}`;
+        // An optional/peer edge is reported but never holds (see `holdsPublish`),
+        // so it does not earn the wait either: one probe.
+        const cacheKey = pin.block === REQUIRED_BLOCK ? key : `${key}#nowait`;
+        if (!seen.has(cacheKey)) {
+            const probe = pin.block === REQUIRED_BLOCK ? input : { ...input, waitBudgetMs: 0 };
+            seen.set(cacheKey, await judgePin(probe, pin.name, version));
+        }
+        const verdict = seen.get(cacheKey);
+        // One reason per EDGE: the same target in two blocks costs different things
+        // at install time, and the operator should see both.
+        if (verdict)
+            reasons.push({ ...verdict, block: pin.block });
+    }
+    return reasons;
+}
+async function judgePin(input, name, version) {
+    const base = { name, version, block: 'dependencies' };
+    // The LAST entry wins: a `served` entry supersedes the `unserved` one before it.
+    const known = [...input.ledger].reverse().find((e) => e.name === name && e.version === version);
+    if (known?.ev === 'served')
+        return null;
+    // Only a terminal class short-circuits. npm holds EVERY new version in
+    // `validating` for 30–90 s, and the publisher's own read-back runs inside
+    // that window, so a non-terminal entry is stale by the time a dependent
+    // looks (v0.60.0: 92 of 215 packages held on it). Fall through and re-probe.
+    if (known?.ev === 'unserved' && isTerminalClass(known.cls)) {
+        return { ...base, cls: known.cls, detail: known.detail };
+    }
+    if (known?.ev === 'held') {
+        return {
+            ...base,
+            cls: 'held',
+            detail: `was itself held — ${summariseReasons(known.reasons)}`,
+        };
+    }
+    const probeInput = {
+        registry: input.registry,
+        name,
+        version,
+        authorization: input.authorization,
+        fetchImpl: input.fetchImpl,
+        sleep: input.sleep,
+        now: input.now,
+        log: input.log,
+    };
+    let readback = await verifyPublishedVersion({
+        ...probeInput,
+        budgetMs: SINGLE_PROBE_BUDGET_MS,
+    });
+    if (readback.confirmed)
+        return confirmedServed(input, known, name, version);
+    const ask = () => fetchVersionStatus({
+        registry: input.registry,
+        name,
+        version,
+        token: input.statusToken,
+        fetchImpl: input.fetchImpl,
+    });
+    let classification = classifyUnserved(readback.verdict, await ask());
+    if (!classification.terminal && input.waitBudgetMs > 0) {
+        readback = await verifyPublishedVersion({
+            ...probeInput,
+            budgetMs: input.waitBudgetMs,
+        });
+        if (readback.confirmed)
+            return confirmedServed(input, known, name, version);
+        classification = classifyUnserved(readback.verdict, await ask());
+    }
+    return { ...base, cls: classification.cls, detail: classification.detail };
+}
+function confirmedServed(input, known, name, version) {
+    if (known?.ev === 'unserved')
+        appendLedger(input.ledgerPath, { ev: 'served', name, version });
+    return null;
+}
+/** Only a `dependencies` edge holds a publish, as in the name-level guard; the rest are reported. */
+export const holdsPublish = (reason) => reason.block === REQUIRED_BLOCK;
+export function summariseReasons(reasons) {
+    return reasons
+        .map((r) => `${r.name}@${r.version} is ${r.cls === 'held' ? 'held' : describeClass(r.cls)}`)
+        .join('; ');
+}
+/** Classify a version THIS process PUT and could not read back, and write it to the ledger. */
+export async function recordUnserved(input) {
+    const status = await fetchVersionStatus({
+        registry: input.registry,
+        name: input.name,
+        version: input.version,
+        token: input.statusToken,
+        fetchImpl: input.fetchImpl,
+    });
+    const classification = classifyUnserved(input.verdict, status);
+    appendLedger(input.ledgerPath, {
+        ev: 'unserved',
+        name: input.name,
+        version: input.version,
+        cls: classification.cls,
+        detail: classification.detail,
+    });
+    return classification;
+}
+/**
+ * The job-summary markdown for a ledger: what is unserved and why, what was held
+ * and why, and the exact command that publishes the held set once their
+ * dependencies are installable. `undefined` when nothing needs saying.
+ */
+export function renderLedgerSummary(entries, ref) {
+    const served = new Set(entries.filter((e) => e.ev === 'served').map((e) => `${e.name}@${e.version}`));
+    const unserved = entries.filter((e) => e.ev === 'unserved' && !served.has(`${e.name}@${e.version}`));
+    const held = entries.filter((e) => e.ev === 'held');
+    if (unserved.length === 0 && held.length === 0)
+        return undefined;
+    const lines = ['### npm versions that were accepted but are not installable', ''];
+    if (unserved.length > 0) {
+        lines.push('| Package | Version | State | Detail |', '| --- | --- | --- | --- |');
+        for (const e of unserved) {
+            lines.push(`| \`${e.name}\` | ${e.version} | ${describeClass(e.cls)} | ${e.detail} |`);
+        }
+        lines.push('');
+    }
+    if (held.length > 0) {
+        lines.push('### Held — NOT published in this run', '', 'Each package below depends on a version npm does not serve, so publishing it would have shipped a package that cannot be installed.', '', '| Package | Version | Because |', '| --- | --- | --- |');
+        for (const e of held)
+            lines.push(`| \`${e.name}\` | ${e.version} | ${summariseReasons(e.reasons)} |`);
+        lines.push('', 'Once the dependencies above are served by npm (a `validating` version appears on its own, or is approved/released by a maintainer), publish the held set with:', '', '```sh', `gh workflow run release.yml --ref ${ref} -f skip_publish=false -f only='${[...new Set(held.map((e) => e.name))].join(' ')}'`, '```');
+        if (entries.some((e) => e.ev === 'unserved' && (e.cls === 'blocked' || e.cls === 'deleted'))) {
+            lines.push('', 'A `blocked` or `deleted` version is a spent number: re-running the release cannot serve it, the package needs a version bump.');
+        }
+    }
+    return lines.join('\n');
+}

package/lib/utils/publish-status.d.ts

@@ -0,0 +1,83 @@
+import type { ReadbackVerdict } from './publish-readback.js';
+/** The lifecycle states the status endpoint documents. */
+export type VersionStatus = 'published' | 'validating' | 'staged' | 'blocked' | 'deleted';
+export type StatusUnavailableReason = 
+/** No token to ask with — the OIDC-only CI case. */
+'no-credential'
+/** 401: the token is wrong or lacks the scope. */
+ | 'rejected'
+/** 403: the endpoint's per-package rollout gate is closed for this package. */
+ | 'not-enabled'
+/** 404: the version does not exist, OR this token cannot see the package. Indistinguishable by design. */
+ | 'not-found'
+/** 429 / 5xx / timeout / unparseable body. */
+ | 'error';
+export type StatusProbe = {
+    state: 'known';
+    status: VersionStatus;
+} | {
+    state: 'unavailable';
+    reason: StatusUnavailableReason;
+    detail: string;
+};
+export interface FetchVersionStatusInput {
+    registry: string;
+    name: string;
+    version: string;
+    /** A bare npm access token / granular access token. Absent → `no-credential`, no request is sent. */
+    token?: string;
+    probeTimeoutMs?: number;
+    fetchImpl?: typeof fetch;
+}
+/**
+ * The token to ask the status endpoint with: the dedicated `NPM_STATUS_TOKEN`
+ * first, then a `NODE_AUTH_TOKEN` that is a real token and not the
+ * `XXXXX-XXXXX-XXXXX-XXXXX` literal `actions/setup-node` injects when given a
+ * `registry-url`. Empty string and the placeholder both mean "none".
+ */
+export declare function statusTokenFromEnv(env: Record<string, string | undefined>): string | undefined;
+/** `GET {registry}/-/package/{name}/version/{version}/status`, classified. Never throws. */
+export declare function fetchVersionStatus(input: FetchVersionStatusInput): Promise<StatusProbe>;
+/**
+ * What a version the packument does not serve IS. The first five come from the
+ * registry's own status; the last two are what we can say without it.
+ */
+export type UnservedClass = 
+/** Automated review has not finished; the version will appear — or turn `blocked`. */
+'validating'
+/** Waits for a maintainer to approve it; nothing automatic will change this. */
+ | 'staged'
+/** Failed automated validation. Will never be served. */
+ | 'blocked'
+/** Deleted. Will never be served, and the number cannot be re-used. */
+ | 'deleted'
+/** The registry says `published` but the install document does not carry it yet (write lag). */
+ | 'published-lagging'
+/** The registry has no record of the version: the PUT did not land. */
+ | 'missing'
+/** Not served and the status endpoint could not be asked; the read-back verdict is all there is. */
+ | 'unchecked';
+export interface Classification {
+    cls: UnservedClass;
+    /** One line for the log and the summary. */
+    detail: string;
+    /**
+     * Waiting can no longer change the answer. `validating`, `published-lagging`
+     * and `unchecked` can still resolve on their own; the rest cannot.
+     */
+    terminal: boolean;
+}
+/** `classifyUnserved(...).terminal` for a class read back from the ledger. */
+export declare function isTerminalClass(cls: UnservedClass): boolean;
+/**
+ * Fold the registry's lifecycle status and the read-back verdict into ONE class.
+ *
+ * The status wins when it answered. When it did not, the read-back verdict is
+ * kept in the detail but never promoted to `missing`: `not-published` from the
+ * packument alone is exactly the observation a `validating` version produces, so
+ * "missing — re-publish" would send the operator into a 409. Only a status 404
+ * (the registry itself has no such version) earns `missing`.
+ */
+export declare function classifyUnserved(verdict: ReadbackVerdict, probe: StatusProbe): Classification;
+/** The class as a human label for tables. */
+export declare function describeClass(cls: UnservedClass): string;

package/lib/utils/publish-status.js

@@ -0,0 +1,193 @@
+// What happened to a version npm ACCEPTED and the packument does not serve?
+//
+// THE INCIDENT (v0.59.0 / v0.59.1). A handful of packages — `@gjsify/adwaita-fonts`
+// and five `@gjsify/example-*` — got HTTP 202 on the PUT and never appeared in the
+// public packument; a re-PUT is answered 409. The npm website shows them as
+// "Validating" ("Automated review hasn't finished. The version will remain
+// unavailable until review completes."). Both read-back verdicts that existed
+// for them — `not-published` and `recorded-not-served` — were wrong in spirit: the
+// first told the operator to re-publish (answered 409), the second to wait (it
+// would not come). The packument has no field that says which.
+//
+// The registry does: `GET /-/package/{name}/version/{version}/status` answers
+// `published | validating | staged | blocked | deleted`. It accepts an npm access
+// token or a granular access token with publish access to the package — NOT the
+// short-lived OIDC exchange token the release sweep publishes with, and not
+// anonymous requests (401). So in CI the answer is only available when a
+// read-only token is provided as `NPM_STATUS_TOKEN`; without one this module says
+// so (`no-credential`) instead of guessing, and the callers keep the old behaviour
+// plus a hold, which needs no status to be safe.
+import { escapePackageName } from './publish-headers.js';
+const KNOWN_STATUSES = ['published', 'validating', 'staged', 'blocked', 'deleted'];
+/**
+ * The token to ask the status endpoint with: the dedicated `NPM_STATUS_TOKEN`
+ * first, then a `NODE_AUTH_TOKEN` that is a real token and not the
+ * `XXXXX-XXXXX-XXXXX-XXXXX` literal `actions/setup-node` injects when given a
+ * `registry-url`. Empty string and the placeholder both mean "none".
+ */
+export function statusTokenFromEnv(env) {
+    for (const candidate of [env['NPM_STATUS_TOKEN'], env['NODE_AUTH_TOKEN']]) {
+        const token = candidate?.trim();
+        if (token && !/^X+(-X+)+$/.test(token))
+            return token;
+    }
+    return undefined;
+}
+/** `GET {registry}/-/package/{name}/version/{version}/status`, classified. Never throws. */
+export async function fetchVersionStatus(input) {
+    if (!input.token) {
+        return {
+            state: 'unavailable',
+            reason: 'no-credential',
+            detail: 'the status endpoint needs an npm access token (set NPM_STATUS_TOKEN); OIDC publish tokens are not accepted',
+        };
+    }
+    const doFetch = input.fetchImpl ?? ((...args) => globalThis.fetch(...args));
+    const registryClean = input.registry.endsWith('/') ? input.registry.slice(0, -1) : input.registry;
+    const url = `${registryClean}/-/package/${escapePackageName(input.name)}/version/${encodeURIComponent(input.version)}/status`;
+    let res;
+    try {
+        res = await doFetch(url, {
+            headers: {
+                accept: 'application/json',
+                authorization: `Bearer ${input.token}`,
+            },
+            signal: AbortSignal.timeout(input.probeTimeoutMs ?? 30_000),
+        });
+    }
+    catch (err) {
+        return {
+            state: 'unavailable',
+            reason: 'error',
+            detail: err instanceof Error ? err.message : String(err),
+        };
+    }
+    if (res.status === 401) {
+        return {
+            state: 'unavailable',
+            reason: 'rejected',
+            detail: '401 — the token is missing, invalid or expired',
+        };
+    }
+    if (res.status === 403) {
+        return {
+            state: 'unavailable',
+            reason: 'not-enabled',
+            detail: '403 — package version status is not enabled for this package',
+        };
+    }
+    if (res.status === 404) {
+        return {
+            state: 'unavailable',
+            reason: 'not-found',
+            detail: '404 — no such version, or the token cannot see this package',
+        };
+    }
+    if (!res.ok) {
+        return {
+            state: 'unavailable',
+            reason: 'error',
+            detail: `${res.status} ${res.statusText}`,
+        };
+    }
+    let body;
+    try {
+        body = await res.json();
+    }
+    catch (err) {
+        return {
+            state: 'unavailable',
+            reason: 'error',
+            detail: `status body is not JSON (${err instanceof Error ? err.message : String(err)})`,
+        };
+    }
+    const status = body?.status;
+    if (typeof status !== 'string' || !KNOWN_STATUSES.includes(status)) {
+        return {
+            state: 'unavailable',
+            reason: 'error',
+            detail: `unrecognised status ${JSON.stringify(status)}`,
+        };
+    }
+    return { state: 'known', status: status };
+}
+/** `classifyUnserved(...).terminal` for a class read back from the ledger. */
+export function isTerminalClass(cls) {
+    return cls !== 'validating' && cls !== 'published-lagging' && cls !== 'unchecked';
+}
+/** Why the status could not be asked, in the words the `unchecked` line uses. */
+function whyUnchecked(probe) {
+    return probe.reason === 'no-credential' ? 'status endpoint not asked: no NPM_STATUS_TOKEN' : probe.detail;
+}
+/**
+ * Fold the registry's lifecycle status and the read-back verdict into ONE class.
+ *
+ * The status wins when it answered. When it did not, the read-back verdict is
+ * kept in the detail but never promoted to `missing`: `not-published` from the
+ * packument alone is exactly the observation a `validating` version produces, so
+ * "missing — re-publish" would send the operator into a 409. Only a status 404
+ * (the registry itself has no such version) earns `missing`.
+ */
+export function classifyUnserved(verdict, probe) {
+    if (probe.state === 'known') {
+        switch (probe.status) {
+            case 'validating':
+                return {
+                    cls: 'validating',
+                    detail: 'npm accepted the upload and its automated review has not finished',
+                    terminal: false,
+                };
+            case 'staged':
+                return {
+                    cls: 'staged',
+                    detail: 'awaiting maintainer approval on npm',
+                    terminal: true,
+                };
+            case 'blocked':
+                return {
+                    cls: 'blocked',
+                    detail: 'failed npm automated validation',
+                    terminal: true,
+                };
+            case 'deleted':
+                return { cls: 'deleted', detail: 'deleted on npm', terminal: true };
+            case 'published':
+                return {
+                    cls: 'published-lagging',
+                    detail: 'npm reports it published; the install document does not serve it yet',
+                    terminal: false,
+                };
+        }
+    }
+    if (probe.reason === 'not-found') {
+        return {
+            cls: 'missing',
+            detail: `the registry has no such version (${probe.detail}); the PUT did not land`,
+            terminal: true,
+        };
+    }
+    return {
+        cls: 'unchecked',
+        detail: `not served (read-back: ${verdict}); ${whyUnchecked(probe)}`,
+        terminal: false,
+    };
+}
+/** The class as a human label for tables. */
+export function describeClass(cls) {
+    switch (cls) {
+        case 'validating':
+            return 'validating (npm automated review pending)';
+        case 'staged':
+            return 'staged (needs maintainer approval)';
+        case 'blocked':
+            return 'blocked (failed automated validation)';
+        case 'deleted':
+            return 'deleted';
+        case 'published-lagging':
+            return 'published, not yet served';
+        case 'missing':
+            return 'missing (never recorded)';
+        case 'unchecked':
+            return 'not served (status not checked)';
+    }
+}

package/lib/utils/ship/app-runtime.d.ts

@@ -106,8 +106,9 @@ export interface ResolvedNodeGiPackage {
  * `Layout.dirs().native`, the directory a `.app` keeps loadable code in.
  *
  * So the rule is what `require('@gjsify/node-gi/<subpath>')` can REACH:
- * `package.json` (the `exports` map is what resolves every subpath), every `.js`
- * at the package root (every `exports` target is one), and `overrides/`, which
+ * `package.json` (the `exports` map is what resolves every subpath, and itself an
+ * `exports` target for bundler hook discovery), every `.js` at the package root
+ * (every other `exports` target is one), and `overrides/`, which
  * `gi.js` loads at runtime. `tests/e2e/ship-macos` holds that rule against the
  * REAL package's `exports` map, so a node-gi release that adds an entry outside
  * this set fails there rather than in a `.app` a stranger downloaded.

package/lib/utils/ship/app-runtime.js

@@ -217,8 +217,9 @@ function resolveStagedPackage(specifier, options) {
  * `Layout.dirs().native`, the directory a `.app` keeps loadable code in.
  *
  * So the rule is what `require('@gjsify/node-gi/<subpath>')` can REACH:
- * `package.json` (the `exports` map is what resolves every subpath), every `.js`
- * at the package root (every `exports` target is one), and `overrides/`, which
+ * `package.json` (the `exports` map is what resolves every subpath, and itself an
+ * `exports` target for bundler hook discovery), every `.js` at the package root
+ * (every other `exports` target is one), and `overrides/`, which
  * `gi.js` loads at runtime. `tests/e2e/ship-macos` holds that rule against the
  * REAL package's `exports` map, so a node-gi release that adds an entry outside
  * this set fails there rather than in a `.app` a stranger downloaded.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/cli",
-    "version": "0.59.0",
+    "version": "0.60.0",
     "description": "CLI for Gjsify",
     "type": "module",
     "main": "lib/index.js",
@@ -142,22 +142,22 @@
         "cli"
     ],
     "dependencies": {
-        "@gjsify/blueprint": "^0.59.0",
-        "@gjsify/buffer": "^0.59.0",
-        "@gjsify/create-app": "^0.59.0",
-        "@gjsify/node-globals": "^0.59.0",
-        "@gjsify/node-polyfills": "^0.59.0",
-        "@gjsify/npm-registry": "^0.59.0",
-        "@gjsify/resolve-npm": "^0.59.0",
-        "@gjsify/rolldown-plugin-gjsify": "^0.59.0",
-        "@gjsify/vite-plugin-blueprint": "^0.59.0",
-        "@gjsify/rolldown-plugin-pnp": "^0.59.0",
-        "@gjsify/semver": "^0.59.0",
-        "@gjsify/tar": "^0.59.0",
-        "@gjsify/tsc": "^0.59.0",
-        "@gjsify/utils": "^0.59.0",
-        "@gjsify/web-polyfills": "^0.59.0",
-        "@gjsify/workspace": "^0.59.0",
+        "@gjsify/blueprint": "^0.60.0",
+        "@gjsify/buffer": "^0.60.0",
+        "@gjsify/create-app": "^0.60.0",
+        "@gjsify/node-globals": "^0.60.0",
+        "@gjsify/node-polyfills": "^0.60.0",
+        "@gjsify/npm-registry": "^0.60.0",
+        "@gjsify/resolve-npm": "^0.60.0",
+        "@gjsify/rolldown-plugin-gjsify": "^0.60.0",
+        "@gjsify/vite-plugin-blueprint": "^0.60.0",
+        "@gjsify/rolldown-plugin-pnp": "^0.60.0",
+        "@gjsify/semver": "^0.60.0",
+        "@gjsify/tar": "^0.60.0",
+        "@gjsify/tsc": "^0.60.0",
+        "@gjsify/utils": "^0.60.0",
+        "@gjsify/web-polyfills": "^0.60.0",
+        "@gjsify/workspace": "^0.60.0",
         "acorn": "^8.17.0",
         "cosmiconfig": "^9.0.2",
         "get-tsconfig": "^4.14.0",
@@ -166,13 +166,13 @@
         "yargs": "^18.0.0"
     },
     "devDependencies": {
-        "@gjsify/unit": "^0.59.0",
+        "@gjsify/unit": "^0.60.0",
         "@types/yargs": "^17.0.35",
         "typescript": "^6.0.3"
     },
     "peerDependencies": {
-        "@gjsify/oxfmt-native": "^0.59.0",
-        "@gjsify/rolldown-native": "^0.59.0"
+        "@gjsify/oxfmt-native": "^0.60.0",
+        "@gjsify/rolldown-native": "^0.60.0"
     },
     "peerDependenciesMeta": {
         "@gjsify/oxfmt-native": {

package/showcases.json

@@ -1,48 +1,6 @@
 {
     "$schema": "https://json-schema.org/draft/2020-12/schema",
     "showcases": [
-        {
-            "name": "canvas2d-fireworks",
-            "category": "dom",
-            "package": "@gjsify/example-dom-canvas2d-fireworks",
-            "description": "Colorful fireworks Canvas 2D example with Adwaita controls"
-        },
-        {
-            "name": "excalibur-jelly-jumper",
-            "category": "dom",
-            "package": "@gjsify/example-dom-excalibur-jelly-jumper",
-            "description": "Excalibur.js jelly-jumper game"
-        },
-        {
-            "name": "three-geometry-teapot",
-            "category": "dom",
-            "package": "@gjsify/example-dom-three-geometry-teapot",
-            "description": "Three.js Utah teapot"
-        },
-        {
-            "name": "three-loader-ldraw",
-            "category": "dom",
-            "package": "@gjsify/example-dom-three-loader-ldraw",
-            "description": "Three.js LDraw viewer — loads packed .mpd models over fetch and steps through their building instructions"
-        },
-        {
-            "name": "three-postprocessing-pixel",
-            "category": "dom",
-            "package": "@gjsify/example-dom-three-postprocessing-pixel",
-            "description": "Three.js postprocessing pixel demo"
-        },
-        {
-            "name": "webrtc-loopback",
-            "category": "dom",
-            "package": "@gjsify/example-dom-webrtc-loopback",
-            "description": "WebRTC data-channel loopback: two local peers exchange offer/answer + ICE, then echo messages over an RTCDataChannel"
-        },
-        {
-            "name": "minimalist-browser",
-            "category": "dom",
-            "package": "@gjsify/example-dom-minimalist-browser",
-            "description": "Minimalist browser with URL bar + back/forward + iframe content area; same code runs in browser (real iframe) and GJS (IFrameBridge over WebKit.WebView)"
-        },
         {
             "name": "express-webserver",
             "category": "node",