@gjsify/cli 0.64.12-next.281 → 0.64.12

package/lib/commands/ship.js

@@ -39,7 +39,7 @@ import { resolveNodeModulesClosure, stageNodeModules } from '../utils/ship/node-
 import { acquireGtkRuntime } from '../utils/ship/gtk-runtime-acquire.js';
 import { discoverPayload } from '../utils/ship/discover.js';
 import { appDirFor, appDirPayload, appImageHostRequirements, appImageRuntimeNotice, buildAppImage, findPinnedRuntime, stampAppDirTimes, } from '../utils/ship/appimage.js';
-import { buildDmgImage, dmgVolumeDir, dmgVolumeName } from '../utils/ship/dmg.js';
+import { addApplicationsLink, buildDmgImage, dmgVolumeDir, dmgVolumeName, signDmgImage } from '../utils/ship/dmg.js';
 import { assertNoDroppedFlatpakModules } from '../utils/ship/flatpak-config.js';
 import { buildFlatpakBundle } from '../utils/ship/flatpak.js';
 import { iconSizes, resolveAppIcon } from '../utils/ship/icons.js';
@@ -55,7 +55,8 @@ import { assertEntryRunsUnder } from '../utils/ship/entry-interpreter.js';
 import { scanGiRequirements } from '../utils/ship/gi-namespaces.js';
 import { assertLauncherMatchesInterpreter, assertPayloadMatchesArch, buildTimestamp, isArchIndependent, linuxInstallDependent, readPayloadFacts, } from '../utils/ship/payload.js';
 import { assertOverlayIsLicensed, planOverlay, planStage } from '../utils/ship/plan.js';
-import { assertHostCanSign, notarizeArtifact, stapleArtifact, resolveNotaryPlan, resolveSignPlan, signPayload, } from '../utils/ship/signing.js';
+import { recordedSignature, writeReleaseRecord } from '../utils/ship/release-record.js';
+import { ADHOC_IDENTITY, assertHostCanSign, notarizeArtifact, stapleArtifact, resolveNotaryPlan, resolveSignPlan, signPayload, } from '../utils/ship/signing.js';
 import { renderLauncher } from '../utils/ship/launcher.js';
 import { buildRpm } from '../utils/ship/rpm.js';
 import { resolveShipApp, resolveShipBundle, resolveShipKind, resolveShipSettings, } from '../utils/ship/settings.js';
@@ -1261,6 +1262,7 @@ async function packOne(input) {
             // mounts showing `Contents/` — a window with no application in it.
             const volumeDir = dmgVolumeDir(outRoot);
             writePayload(volumeDir, payload, '');
+            addApplicationsLink(volumeDir);
             await buildDmgImage({
                 volumeName: dmgVolumeName(settings),
                 sourceDir: volumeDir,
@@ -1268,6 +1270,17 @@ async function packOne(input) {
                 workDir: dirname(volumeDir),
                 verbose: input.verbose,
             });
+            // The IMAGE's own signature, before the notarisation below submits
+            // it and the staple writes into it — see `utils/ship/dmg.ts`.
+            if (input.sign.kind === 'sign') {
+                await signDmgImage({
+                    identity: input.sign.identity,
+                    file: target,
+                    adhoc: input.sign.identity === ADHOC_IDENTITY,
+                    workDir: dirname(volumeDir),
+                    verbose: input.verbose,
+                });
+            }
             break;
         }
         case 'macos-app-zip':
@@ -1339,6 +1352,8 @@ async function packOne(input) {
     // installer, so a `<App>.app` has no submittable form of its own; on darwin
     // the zip beside it is the one that goes. Refusing here would make
     // `--notarize` unusable with the default format set, which is both rows.
+    let notarized = false;
+    let stapled = false;
     if (input.notarize.kind === 'notarize') {
         if (format.artifactKind === 'directory') {
             console.warn(`${LOG} ${format.id} is a directory, and notarytool submits an archive or an installer — ` +
@@ -1351,6 +1366,7 @@ async function packOne(input) {
                 verbose: input.verbose,
                 log: (line) => console.log(`${LOG} ${line}`),
             });
+            notarized = true;
             // AND THEN THE TICKET, on the artifacts that can hold one. Submitting
             // and stapling are two questions with two answers, and the `.zip` is
             // where they come apart: the notary service accepts it and `stapler`
@@ -1365,6 +1381,7 @@ async function packOne(input) {
                     verbose: input.verbose,
                     log: (line) => console.log(`${LOG} ${line}`),
                 });
+                stapled = true;
             }
             else {
                 console.warn(`${LOG} ${format.id} is notarised and NOT stapled: \`stapler\` takes a UDIF image, a ` +
@@ -1374,6 +1391,22 @@ async function packOne(input) {
             }
         }
     }
+    // THE RELEASE RECORD, after every step that writes into the file (ADR 0124).
+    // A directory is never a release asset; the container beside it is.
+    if (format.artifactKind === 'file') {
+        const record = writeReleaseRecord({
+            file: target,
+            format: format.id,
+            os: format.layoutOs,
+            arch: isArchIndependent(payload) ? 'noarch' : input.arch,
+            signature: recordedSignature(input.sign.kind === 'sign' ? input.sign.identity : undefined, ADHOC_IDENTITY),
+            notarized,
+            stapled,
+            generator: `@gjsify/cli ${cliVersion()}`,
+        });
+        if (input.verbose)
+            console.log(`${LOG} release record: ${record}`);
+    }
     return { format: format.id, path: target, size };
 }
 function printArtifacts(base, artifacts) {

package/lib/utils/ship/dmg.d.ts

@@ -22,7 +22,7 @@ export declare function dmgVolumeName(settings: PackSettings): string;
 export interface DmgCreateInput {
     /** The volume label — see {@link dmgVolumeName}. */
     volumeName: string;
-    /** The directory whose CONTENTS become the volume root; it holds `<App>.app` and nothing else. */
+    /** The directory whose CONTENTS become the volume root: `<App>.app` and the `Applications` link. */
     sourceDir: string;
     /** Absolute path the finished `.dmg` is written to. */
     target: string;
@@ -63,9 +63,57 @@ export declare function buildDmgImage(input: DmgPackInput): Promise<void>;
  * Where the volume is assembled before `hdiutil` turns it into an image.
  *
  * A directory of its own under the run's output root, never `out/` itself: the
- * volume root holds the `.app` and NOTHING ELSE, because `-srcfolder` copies
+ * volume root holds the `.app` and its drop target and NOTHING ELSE, because `-srcfolder` copies
  * whatever it finds — a stray sibling would ride into the image, and the reader
  * that would catch it is the same listing comparison that would then have to be
  * relaxed to allow it.
  */
 export declare function dmgVolumeDir(outRoot: string): string;
+/** The drop target's name in the volume root, and where it points. */
+export declare const DMG_APPLICATIONS_LINK: {
+    readonly name: "Applications";
+    readonly target: "/Applications";
+};
+/**
+ * Put the drag-here link into a volume `writePayload` has just filled.
+ *
+ * AFTER `writePayload`, never before: that call wipes the directory it writes,
+ * so it is also what keeps a previous run's link from making this one fail
+ * with `EEXIST`. An ABSOLUTE target, because the link is resolved on the
+ * user's machine where `/Applications` is the only path that means anything —
+ * the Finder shows it as "Applications" with the folder's own icon.
+ */
+export declare function addApplicationsLink(volumeDir: string): void;
+/** The tool that signs the image. The bundle's signer uses the same one. */
+export declare const DMG_SIGN_TOOL = "codesign";
+export interface DmgSignInput {
+    /** A `codesign` identity, or `-` for ad-hoc. */
+    identity: string;
+    /** The finished `.dmg`. */
+    file: string;
+    /** `identity` is the ad-hoc `-`. */
+    adhoc: boolean;
+}
+/**
+ * The `codesign` invocation for the IMAGE, as data.
+ *
+ * NOT the darwin signer's argv (`SIGNERS.darwin.args`), and the two differences
+ * are the point. No `--options runtime`: the hardened runtime is a property of
+ * code that executes, and a disk image does not. No entitlements, for the same
+ * reason. What stays is `--force` — `-ov` rewrites the file, but a caller may
+ * hand in one that is already signed — and `--timestamp` on a real identity
+ * only, for the reason that row gives: an ad-hoc signature has no certificate
+ * to countersign, and `codesign(1)` documents a timestamp failure as fatal.
+ */
+export declare function codesignDmgArgs(input: DmgSignInput): string[];
+/**
+ * Sign the image at `input.file`.
+ *
+ * Ad-hoc is signed too. It earns the image nothing with Gatekeeper, but it is
+ * what CI runs, and a branch only a release with a real certificate reaches is
+ * a branch that breaks on release day.
+ */
+export declare function signDmgImage(input: DmgSignInput & {
+    verbose: boolean;
+    workDir: string;
+}): Promise<void>;

package/lib/utils/ship/dmg.js

@@ -39,13 +39,25 @@
 //     ubuntu-24.04 ships 7-Zip 23.01, not this workstation's 26.02. zlib is the
 //     method its `Dmg` handler has read since long before either.
 //
-// WHAT THIS PACKER DOES NOT PUT IN THE VOLUME: an `/Applications` symlink, the
-// drag-here convention. `writePayload` writes regular files and nothing else —
-// which is a property `tests/e2e/ship` and the `ship-stage` job both assert, and
-// a symlink is also what `actions/upload-artifact` silently dereferences. The
-// artifact is still draggable out of the mounted volume; what it lacks is the
-// arrow. Unblocker: a staged-symlink concept with a reader that can see one, at
-// which point the link and its oracle land together.
+// THE VOLUME CARRIES ONE SYMLINK, `Applications → /Applications`, the drag-here
+// convention: without it the mounted window shows the bundle and nothing to drop
+// it on. It is NOT staged. `writePayload` writes regular files and nothing else —
+// a property `tests/e2e/ship` and the `ship-stage` job both assert — and a staged
+// symlink would be dereferenced by `actions/upload-artifact` on its way to the
+// packing host. The volume directory is assembled ON that host, after the stage
+// has arrived, so neither objection reaches it: the link is written here, next to
+// the `hdiutil` call that consumes it. Its reader is `verify-dmg.py`, which admits
+// exactly this one link with exactly this target and refuses any other.
+//
+// THE IMAGE ITSELF IS SIGNED, and that is a separate signature from the bundle's.
+// Measured on macOS 27 with a Developer ID identity (2026-10-29): a notarised and
+// stapled `.dmg` whose container was never passed to `codesign` reads "code object
+// is not signed at all" under `codesign -dv`, and `spctl -a -t open
+// --context context:primary-signature` rejects it with "no usable signature" —
+// while the `.app` mounted from it is "accepted, source=Notarized Developer ID".
+// The order is fixed by `stapler(1)`: a later `codesign` invalidates a stapled
+// ticket, so the image is signed here, before `ship` notarises and staples it.
+import { symlinkSync } from 'node:fs';
 import { join } from 'node:path';
 import { describeExit, spawnToCompletion } from '../spawn.js';
 /** The tool this packer execs. One spelling, read by this module AND by the format row. */
@@ -171,7 +183,7 @@ export async function buildDmgImage(input) {
  * Where the volume is assembled before `hdiutil` turns it into an image.
  *
  * A directory of its own under the run's output root, never `out/` itself: the
- * volume root holds the `.app` and NOTHING ELSE, because `-srcfolder` copies
+ * volume root holds the `.app` and its drop target and NOTHING ELSE, because `-srcfolder` copies
  * whatever it finds — a stray sibling would ride into the image, and the reader
  * that would catch it is the same listing comparison that would then have to be
  * relaxed to allow it.
@@ -179,3 +191,55 @@ export async function buildDmgImage(input) {
 export function dmgVolumeDir(outRoot) {
     return join(outRoot, 'dmg', 'volume');
 }
+/** The drop target's name in the volume root, and where it points. */
+export const DMG_APPLICATIONS_LINK = { name: 'Applications', target: '/Applications' };
+/**
+ * Put the drag-here link into a volume `writePayload` has just filled.
+ *
+ * AFTER `writePayload`, never before: that call wipes the directory it writes,
+ * so it is also what keeps a previous run's link from making this one fail
+ * with `EEXIST`. An ABSOLUTE target, because the link is resolved on the
+ * user's machine where `/Applications` is the only path that means anything —
+ * the Finder shows it as "Applications" with the folder's own icon.
+ */
+export function addApplicationsLink(volumeDir) {
+    symlinkSync(DMG_APPLICATIONS_LINK.target, join(volumeDir, DMG_APPLICATIONS_LINK.name));
+}
+/** The tool that signs the image. The bundle's signer uses the same one. */
+export const DMG_SIGN_TOOL = 'codesign';
+/**
+ * The `codesign` invocation for the IMAGE, as data.
+ *
+ * NOT the darwin signer's argv (`SIGNERS.darwin.args`), and the two differences
+ * are the point. No `--options runtime`: the hardened runtime is a property of
+ * code that executes, and a disk image does not. No entitlements, for the same
+ * reason. What stays is `--force` — `-ov` rewrites the file, but a caller may
+ * hand in one that is already signed — and `--timestamp` on a real identity
+ * only, for the reason that row gives: an ad-hoc signature has no certificate
+ * to countersign, and `codesign(1)` documents a timestamp failure as fatal.
+ */
+export function codesignDmgArgs(input) {
+    return ['--force', '--sign', input.identity, ...(input.adhoc ? [] : ['--timestamp']), input.file];
+}
+/**
+ * Sign the image at `input.file`.
+ *
+ * Ad-hoc is signed too. It earns the image nothing with Gatekeeper, but it is
+ * what CI runs, and a branch only a release with a real certificate reaches is
+ * a branch that breaks on release day.
+ */
+export async function signDmgImage(input) {
+    const args = codesignDmgArgs(input);
+    if (input.verbose)
+        console.log(`[gjsify ship] ${DMG_SIGN_TOOL} ${args.join(' ')}`);
+    const result = await spawnToCompletion(DMG_SIGN_TOOL, args, {
+        completion: 'return',
+        cwd: input.workDir,
+        stdio: 'inherit',
+        notFound: () => new Error(`gjsify ship: ${DMG_SIGN_TOOL} is not on PATH, so the image cannot be signed. Install the ` +
+            'Xcode Command Line Tools (`xcode-select --install`).'),
+    });
+    if (result.code !== 0) {
+        throw new Error(`gjsify ship: ${DMG_SIGN_TOOL} failed on the image with ${describeExit(result)}.`);
+    }
+}

package/lib/utils/ship/release-record.d.ts

@@ -0,0 +1,47 @@
+import type { FormatId, HostOs } from './types.js';
+/** The suffix a record's name adds to its artifact's. The site matches on it. */
+export declare const RELEASE_RECORD_SUFFIX = ".gjsify-release.json";
+export declare const RELEASE_RECORD_SCHEMA = 1;
+export type RecordedSignature = {
+    kind: 'none';
+} | {
+    kind: 'adhoc';
+} | {
+    kind: 'identity';
+    identity: string;
+};
+export interface ReleaseRecord {
+    schema: typeof RELEASE_RECORD_SCHEMA;
+    /** The artifact's file name, which is also its release asset name. */
+    artifact: string;
+    /** Lower-case hex SHA-256 of the artifact as written. */
+    sha256: string;
+    size: number;
+    format: FormatId;
+    os: HostOs;
+    /** `process.arch` spelling, or `noarch` for a payload with no native code. */
+    arch: string;
+    signature: RecordedSignature;
+    notarized: boolean;
+    stapled: boolean;
+    /** `@gjsify/cli <version>` — who wrote this record. */
+    generator: string;
+}
+export interface ReleaseRecordInput {
+    /** Absolute path of the finished artifact file. */
+    file: string;
+    format: FormatId;
+    os: HostOs;
+    arch: string;
+    signature: RecordedSignature;
+    notarized: boolean;
+    stapled: boolean;
+    generator: string;
+}
+export declare function releaseRecordPath(artifact: string): string;
+/** Map a run's signing identity to what the record says; `-` is ad-hoc. */
+export declare function recordedSignature(identity: string | undefined, adhocIdentity: string): RecordedSignature;
+/** Build the record from the bytes at `input.file`. Pure apart from reading that file. */
+export declare function buildReleaseRecord(input: ReleaseRecordInput): ReleaseRecord;
+/** Write the record beside its artifact and return the record's path. */
+export declare function writeReleaseRecord(input: ReleaseRecordInput): string;

package/lib/utils/ship/release-record.js

@@ -0,0 +1,55 @@
+// The release record — ADR 0124.
+//
+// ONE FILE BESIDE EVERY FILE ARTIFACT, `<artifact>.gjsify-release.json`, saying
+// what this run did to it: which signature it carries, whether Apple accepted
+// it, whether a ticket was stapled. `@gjsify/site` reads it to decide whether a
+// download needs the "how to open an unsigned app" hint.
+//
+// WRITTEN LAST, from outcomes and not from flags. The hash is taken from the
+// bytes on disk after `stapler` wrote into them, because a hash from before
+// the staple describes a file nobody downloads. A step that fails throws
+// before this runs, so a record never claims a step that did not finish.
+//
+// Per artifact rather than per run or per release: a release is assembled by
+// several jobs on several hosts, and a file named by its artifact cannot
+// collide with another job's.
+import { createHash } from 'node:crypto';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { basename } from 'node:path';
+/** The suffix a record's name adds to its artifact's. The site matches on it. */
+export const RELEASE_RECORD_SUFFIX = '.gjsify-release.json';
+export const RELEASE_RECORD_SCHEMA = 1;
+export function releaseRecordPath(artifact) {
+    return `${artifact}${RELEASE_RECORD_SUFFIX}`;
+}
+/** Map a run's signing identity to what the record says; `-` is ad-hoc. */
+export function recordedSignature(identity, adhocIdentity) {
+    if (identity === undefined)
+        return { kind: 'none' };
+    if (identity === adhocIdentity)
+        return { kind: 'adhoc' };
+    return { kind: 'identity', identity };
+}
+/** Build the record from the bytes at `input.file`. Pure apart from reading that file. */
+export function buildReleaseRecord(input) {
+    const bytes = readFileSync(input.file);
+    return {
+        schema: RELEASE_RECORD_SCHEMA,
+        artifact: basename(input.file),
+        sha256: createHash('sha256').update(bytes).digest('hex'),
+        size: bytes.length,
+        format: input.format,
+        os: input.os,
+        arch: input.arch,
+        signature: input.signature,
+        notarized: input.notarized,
+        stapled: input.stapled,
+        generator: input.generator,
+    };
+}
+/** Write the record beside its artifact and return the record's path. */
+export function writeReleaseRecord(input) {
+    const path = releaseRecordPath(input.file);
+    writeFileSync(path, `${JSON.stringify(buildReleaseRecord(input), null, 4)}\n`);
+    return path;
+}

package/lib/utils/ship/signing.d.ts

@@ -266,12 +266,12 @@ export declare function resolveNotaryPlan(input: {
 /**
  * Submit one written artifact for notarisation.
  *
- * ⚠️ UNVERIFIED END TO END. Everything up to the `spawnToCompletion` is covered
- * — the argv by `signing.spec.ts`, the guard and both refusals by
- * `tests/e2e/ship-signing` — and the invocation itself has never run: it needs
- * an Apple Developer account, and § A17's whole point is that M6's proof does
- * not. Whoever first runs this on a real credential should record what it did
- * beside § A15, which is where the question was left open.
+ * VERIFIED BY HAND, NOT IN CI. The argv is covered by `signing.spec.ts`, the
+ * guard and both refusals by `tests/e2e/ship-signing`; the invocation needs an
+ * Apple Developer account, which § A17 keeps out of CI. It has been run with a
+ * real Developer ID and keychain profile on 2026-10-29 (ADR 0024, amendment of
+ * that date): the `.dmg` and the `.zip` of a GTK application both came back
+ * `Accepted`.
  */
 export declare function notarizeArtifact(input: {
     plan: Extract<NotaryPlan, {
@@ -298,9 +298,10 @@ export declare function notarizeArtifact(input: {
  * instead — which is a fact about the CONTAINER and therefore lives on the format
  * (`canCarryTicket`), not in a branch here.
  *
- * ⚠️ UNVERIFIED END TO END, for the same reason `notarizeArtifact` is: stapling
- * needs a real notarisation, which needs an Apple account (ADR 0024 § A15, § A17).
- * The argv is unit-tested and the invocation has never run in this repository.
+ * VERIFIED BY HAND, for the same reason as `notarizeArtifact`: stapling needs a
+ * real notarisation (ADR 0024 § A15, § A17). Run on 2026-10-29 against a signed
+ * `.dmg` — "The staple and validate action worked!", and `spctl` accepts the
+ * image afterwards. The argv is unit-tested.
  *
  * `stapler(1)` also states the constraint that decides the ORDER: *"Stapling does
  * not invalidate the code signature and must be run after an executable or archive

package/lib/utils/ship/signing.js

@@ -461,12 +461,12 @@ export function resolveNotaryPlan(input) {
 /**
  * Submit one written artifact for notarisation.
  *
- * ⚠️ UNVERIFIED END TO END. Everything up to the `spawnToCompletion` is covered
- * — the argv by `signing.spec.ts`, the guard and both refusals by
- * `tests/e2e/ship-signing` — and the invocation itself has never run: it needs
- * an Apple Developer account, and § A17's whole point is that M6's proof does
- * not. Whoever first runs this on a real credential should record what it did
- * beside § A15, which is where the question was left open.
+ * VERIFIED BY HAND, NOT IN CI. The argv is covered by `signing.spec.ts`, the
+ * guard and both refusals by `tests/e2e/ship-signing`; the invocation needs an
+ * Apple Developer account, which § A17 keeps out of CI. It has been run with a
+ * real Developer ID and keychain profile on 2026-10-29 (ADR 0024, amendment of
+ * that date): the `.dmg` and the `.zip` of a GTK application both came back
+ * `Accepted`.
  */
 export async function notarizeArtifact(input) {
     const { notary, credential } = input.plan;
@@ -504,9 +504,10 @@ export async function notarizeArtifact(input) {
  * instead — which is a fact about the CONTAINER and therefore lives on the format
  * (`canCarryTicket`), not in a branch here.
  *
- * ⚠️ UNVERIFIED END TO END, for the same reason `notarizeArtifact` is: stapling
- * needs a real notarisation, which needs an Apple account (ADR 0024 § A15, § A17).
- * The argv is unit-tested and the invocation has never run in this repository.
+ * VERIFIED BY HAND, for the same reason as `notarizeArtifact`: stapling needs a
+ * real notarisation (ADR 0024 § A15, § A17). Run on 2026-10-29 against a signed
+ * `.dmg` — "The staple and validate action worked!", and `spctl` accepts the
+ * image afterwards. The argv is unit-tested.
  *
  * `stapler(1)` also states the constraint that decides the ORDER: *"Stapling does
  * not invalidate the code signature and must be run after an executable or archive

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/cli",
-    "version": "0.64.12-next.281",
+    "version": "0.64.12",
     "description": "CLI for Gjsify",
     "type": "module",
     "main": "lib/index.js",
@@ -142,22 +142,22 @@
         "cli"
     ],
     "dependencies": {
-        "@gjsify/blueprint": "0.64.12-next.281",
-        "@gjsify/buffer": "0.64.12-next.281",
-        "@gjsify/create-app": "0.64.12-next.281",
-        "@gjsify/node-globals": "0.64.12-next.281",
-        "@gjsify/node-polyfills": "0.64.12-next.281",
-        "@gjsify/npm-registry": "0.64.12-next.281",
-        "@gjsify/resolve-npm": "0.64.12-next.281",
-        "@gjsify/rolldown-plugin-gjsify": "0.64.12-next.281",
-        "@gjsify/vite-plugin-blueprint": "0.64.12-next.281",
-        "@gjsify/rolldown-plugin-pnp": "0.64.12-next.281",
-        "@gjsify/semver": "0.64.12-next.281",
-        "@gjsify/tar": "0.64.12-next.281",
-        "@gjsify/tsc": "0.64.12-next.281",
-        "@gjsify/utils": "0.64.12-next.281",
-        "@gjsify/web-polyfills": "0.64.12-next.281",
-        "@gjsify/workspace": "0.64.12-next.281",
+        "@gjsify/blueprint": "^0.64.12",
+        "@gjsify/buffer": "^0.64.12",
+        "@gjsify/create-app": "^0.64.12",
+        "@gjsify/node-globals": "^0.64.12",
+        "@gjsify/node-polyfills": "^0.64.12",
+        "@gjsify/npm-registry": "^0.64.12",
+        "@gjsify/resolve-npm": "^0.64.12",
+        "@gjsify/rolldown-plugin-gjsify": "^0.64.12",
+        "@gjsify/vite-plugin-blueprint": "^0.64.12",
+        "@gjsify/rolldown-plugin-pnp": "^0.64.12",
+        "@gjsify/semver": "^0.64.12",
+        "@gjsify/tar": "^0.64.12",
+        "@gjsify/tsc": "^0.64.12",
+        "@gjsify/utils": "^0.64.12",
+        "@gjsify/web-polyfills": "^0.64.12",
+        "@gjsify/workspace": "^0.64.12",
         "acorn": "^8.17.0",
         "cosmiconfig": "^9.0.2",
         "get-tsconfig": "^4.14.0",
@@ -166,13 +166,13 @@
         "yargs": "^18.0.0"
     },
     "devDependencies": {
-        "@gjsify/unit": "0.64.12-next.281",
+        "@gjsify/unit": "^0.64.12",
         "@types/yargs": "^17.0.35",
         "typescript": "^6.0.3"
     },
     "peerDependencies": {
-        "@gjsify/oxfmt-native": "0.64.12-next.281",
-        "@gjsify/rolldown-native": "0.64.12-next.281"
+        "@gjsify/oxfmt-native": "^0.64.12",
+        "@gjsify/rolldown-native": "^0.64.12"
     },
     "peerDependenciesMeta": {
         "@gjsify/oxfmt-native": {
@@ -191,6 +191,5 @@
     "bugs": {
         "url": "https://github.com/gjsify/gjsify/issues"
     },
-    "homepage": "https://github.com/gjsify/gjsify/tree/main/packages/infra/cli#readme",
-    "gitHead": "c4d2e266c0d9849860b9828c14ebfe37b6d493b8"
+    "homepage": "https://github.com/gjsify/gjsify/tree/main/packages/infra/cli#readme"
 }