@plasius/gpu-demo-viewer 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -18,6 +18,20 @@ The format is based on Keep a Changelog and this project adheres to SemVer.
 - **Security**
   - (placeholder)
 
+## [0.4.0] - 2026-10-21
+
+- **Added**
+  - Source-owned curated showcase diagnostics with integrity-pinned public assets, remote access checks, explicit consent, accessible preview/copy, and fail-closed provenance; no client-pixel capture or diagnostic transport.
+
+- **Changed**
+  - (placeholder)
+
+- **Fixed**
+  - (placeholder)
+
+- **Security**
+  - (placeholder)
+
 ## [0.3.0] - 2026-10-21
 
 - **Added**
@@ -353,3 +367,4 @@ The format is based on Keep a Changelog and this project adheres to SemVer.
 [0.2.2]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.2.2
 [0.2.3]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.2.3
 [0.3.0]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.3.0
+[0.4.0]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.4.0

package/NFR.md

@@ -34,3 +34,17 @@ entry surfaces.
 ## Model library review
 
 Inherits `gpu-demo.scene-fidelity.enabled` with a localhost-only fixture override. Model changes abort prior work and release its GPU resources. Downloads use trusted reviewed hosts, no redirects, strict byte/hash limits and bounded concurrency. Preserve source licences. Keep missing downloads and renderer defects visible. Keyboard, touch, reduced-motion and 320px layouts must remain usable.
+
+## Consented diagnostics
+
+Task #42 inherits `feedback.game-diagnostics.enabled` and the host-evaluated
+`feedback.game-diagnostics.attach` capability. The separate diagnostics mount
+has no local/query override. Source-owned native mounts use four SRI-pinned
+public baseline assets from published shared 1.3.0; fallback or unqualified
+surfaces are ineligible. No scene/canvas/DOM/debug snapshot crosses the
+diagnostics boundary. Timing is unknown rather than synthetic precision.
+No automatic collection, diagnostic request, cache, storage or analytics is
+permitted. Explicit preview/copy must remain keyboard accessible at 320px;
+consent/access changes and disposal cancel pending work. Preserve the ordinary
+structured-only reporting path on denial or rollback. Requirements and evidence
+are recorded in [the design](docs/consented-diagnostics.md) and ADR 0007.

package/README.md

@@ -11,6 +11,48 @@ A browser workshop for inspecting source models with the Plasius GPU renderer,
 plus a workspace launcher for the `gpu-*` package demos. The workshop provides
 camera gestures, progressive rendering, quality controls and model credits.
 
+## Optional consented renderer diagnostics
+
+Hosts can mount the fixed public baseline harbour and an accessible optional
+diagnostics panel through the focused subpath:
+
+```js
+import { mountDiagnosticShowcase } from '@plasius/gpu-demo-viewer/feedback-diagnostics';
+
+const viewer = await mountDiagnosticShowcase({
+  root: document.getElementById('scene'),
+  feedbackRoot: document.getElementById('feedback'),
+  resolveAccess: async () => {
+    const decisions = await readCurrentRemoteAccess(); // host source-of-truth evaluator
+    return {
+      featureEnabled: decisions.flags['feedback.game-diagnostics.enabled'] === true,
+      capabilityGranted: decisions.capabilities['feedback.game-diagnostics.attach'] === true,
+      sceneEnabled: decisions.flags['gpu-demo.scene-fidelity.enabled'] === true,
+    };
+  },
+});
+// On a pushed access/flag change: viewer.refreshAccess();
+// On route exit: viewer.destroy(); remount after changing the scene rollout.
+```
+
+Approved routes are exactly `/gpu-demo`, `/gpu-demo/`, and the workspace
+`/gpu-demo-viewer/showcase/` (including its `index.html`). The API accepts no
+surface ID, existing runtime, model, renderer loader or provenance override.
+Only the fixed four integrity-pinned procedural public assets and a live native
+WebGPU frame are eligible. Open model-library studies, generator and
+`/player-system` are excluded. This does not add controls to the existing demo
+launcher or grant a product capability; downstream site integration is tracked
+in site#1677.
+
+Consent starts unchecked. Preview and copy both verify current remote access;
+copy also verifies that the surface still matches the reviewed packet. Only
+coarse renderer/backend/viewport fields and closed codes leave this module;
+synthetic timing stays unknown. Nothing is automatically captured, sent,
+logged or stored. Clipboard denial leaves a selectable read-only preview.
+Disabling `feedback.game-diagnostics.enabled` restores structured-only reporting.
+See [the design and validation contract](docs/consented-diagnostics.md) and
+[ADR 0007](docs/adrs/adr-0007-consented-curated-showcase-diagnostics.md).
+
 The npm package includes the viewer source, manifest and build-time acquisition
 helper and typed composite layout definitions. Model binaries are downloaded separately; they are not bundled in npm.
 

package/diagnostics/assets.js

@@ -0,0 +1,7 @@
+// Reviewed procedural public baseline from @plasius/gpu-shared@1.3.0.
+export const showcaseAssetIntegrity = Object.freeze({
+  "brigantine": "sha384-iK6Q3rfU7L0mtjE/pgOJWrAaS0X56xrnmomRuGQkHaA24TvKra4BffwwDjhOxaNG",
+  "lighthouse": "sha384-rm8vGSiRziQ4V3IAFGJNiZqEzyvEpJDg/FvZNa2MxOrThSQ9HYIEVGzz9dN0S8Qb",
+  "harbor-dock": "sha384-4FJzP1Rk0Ll0IokVbzBWpY06m6zfWAUeALPC7Lh7refibUKF3Am+JWStJSlcC7cV",
+  "shoreline": "sha384-/hcbf3/xM+bdGaDnQliQ2r45WoCmZ769s1fpKneZ6QhIZGTDPGH2YNDQjKKP3MMO"
+});

package/diagnostics/index.js

@@ -0,0 +1,20 @@
+import { createCuratedShowcaseSource } from './source.js';
+import { createFeedbackPanel } from './panel.js';
+
+export async function mountDiagnosticShowcase(options) {
+  const keys=['root','feedbackRoot','resolveAccess'];
+  if(!options || Object.getPrototypeOf(options)!==Object.prototype ||
+    Reflect.ownKeys(options).length!==keys.length || keys.some(key=>!Object.hasOwn(options,key)) ||
+    typeof options.resolveAccess!=='function')throw new TypeError('Invalid diagnostics mount options.');
+  const pathname=globalThis.location?.pathname;
+  if(!['/gpu-demo','/gpu-demo/','/gpu-demo-viewer/showcase/','/gpu-demo-viewer/showcase/index.html'].includes(pathname)) {
+    throw new TypeError('This route is not registered for diagnostics.');
+  }
+  let access;
+  try {access=await options.resolveAccess();}catch {access=undefined;}
+  const source=await createCuratedShowcaseSource({root:options.root,sceneEnabled:access?.sceneEnabled===true});
+  try {
+    const panel=createFeedbackPanel({root:options.feedbackRoot,source,resolveAccess:options.resolveAccess,initialAccess:access});
+    return Object.freeze({refreshAccess:panel.refreshAccess,destroy(){panel.destroy();source.destroy();}});
+  } catch {source.destroy();throw new Error('Diagnostics controls could not be mounted.');}
+}

package/diagnostics/panel.js

@@ -0,0 +1,88 @@
+import { parseFeedbackGameDiagnostics } from '@plasius/gpu-shared/feedback-diagnostics';
+
+const available = value => value?.featureEnabled===true && value?.capabilityGranted===true && value?.sceneEnabled===true;
+
+// Source is private to the public mount; this internal seam permits hostile-data
+// and race tests without making arbitrary registrations a supported public API.
+export function createFeedbackPanel({root,source,resolveAccess,initialAccess,document=globalThis.document,
+  copy=text=>globalThis.navigator.clipboard.writeText(text)}) {
+  const make=(tag,text)=>{const e=document.createElement(tag);if(text)e.textContent=text;return e;};
+  const section=make('section'),heading=make('h2','Optional renderer diagnostics');
+  const help=make('p','Share coarse renderer health only. No image, page content, names, locations or device identity is collected. Nothing is sent automatically.');
+  const label=make('label'),consent=make('input');consent.type='checkbox';consent.checked=false;
+  label.append(consent,make('span','I consent to preview and copy renderer diagnostics.'));
+  const prepare=make('button','Preview diagnostics'),copyButton=make('button','Copy diagnostics');
+  prepare.type=copyButton.type='button';copyButton.disabled=true;
+  const previewLabel=make('label','Diagnostics preview'),preview=make('textarea');
+  preview.readOnly=true;preview.value='';preview.rows=12;previewLabel.append(preview);
+  const status=make('p','Diagnostics are optional. Select consent to prepare a preview.');
+  status.setAttribute('role','status');status.setAttribute('aria-live','polite');
+  const style=make('style',`[data-feedback-diagnostics] {box-sizing:border-box;max-width:42rem;padding:1rem;color:#f4f7fb;background:#152234;font:1rem/1.5 system-ui;overflow-wrap:anywhere}
+    [data-feedback-diagnostics] label {display:block;min-height:44px;margin:.75rem 0}
+    [data-feedback-diagnostics] textarea {box-sizing:border-box;display:block;width:100%;max-width:100%;color:#f4f7fb;background:#101925;font:0.85rem/1.5 monospace}
+    [data-feedback-diagnostics] input {margin-right:.5rem}
+    [data-feedback-diagnostics] button {min-height:44px;margin:.25rem;padding:.5rem;color:#101925;background:#d7e7fa;border:2px solid #a3c6ed;border-radius:.25rem}
+    [data-feedback-diagnostics] :focus-visible {outline:3px solid #ffce64;outline-offset:3px}
+    [data-feedback-diagnostics] button:disabled {color:#526071;background:#d7e7fa}`);
+  section.setAttribute('data-feedback-diagnostics','');
+  section.hidden=!available(initialAccess);
+  section.append(style,heading,help,label,prepare,copyButton,previewLabel,status);root.append(section);
+  let revision=0,destroyed=false,text='';
+  function clear(message) {
+    revision++;text='';preview.value='';copyButton.disabled=true;
+    if(message)status.textContent=message;
+  }
+  function revoke(message) {consent.checked=false;section.hidden=true;clear(message);}
+  const consentChanged=()=>clear('Consent changed. Prepare a new preview before copying.');
+  async function permitted(token) {
+    try {
+      const decision=await resolveAccess();
+      if(destroyed || token!==revision || !consent.checked)return false;
+      if(!available(decision)){revoke('Diagnostics are unavailable. Ordinary bug reporting remains available.');return false;}
+      return true;
+    } catch {
+      if(!destroyed && token===revision)revoke('Diagnostics access could not be verified. Try again later.');
+      return false;
+    }
+  }
+  async function preparePreview() {
+    clear();const token=revision;
+    if(destroyed || !consent.checked){status.textContent='Select consent before preparing diagnostics.';return;}
+    if(!await permitted(token))return;
+    try {
+      const packet=await source.observe(true,()=>!destroyed && token===revision && consent.checked);
+      if(destroyed || token!==revision || !consent.checked)return;
+      if(!packet){revoke('This surface is not eligible for diagnostics.');return;}
+      text=JSON.stringify(parseFeedbackGameDiagnostics(packet),null,2);preview.value=text;
+      copyButton.disabled=false;status.textContent='Preview ready. Review these exact fields before copying.';
+    } catch {if(!destroyed && token===revision)revoke('Diagnostics could not be prepared safely.');}
+  }
+  async function copyPreview() {
+    if(destroyed || !text || !consent.checked)return;
+    const token=++revision;
+    if(!await permitted(token))return;
+    try {
+      const packet=await source.observe(true,()=>!destroyed && token===revision && consent.checked);
+      if(destroyed || token!==revision || !consent.checked)return;
+      if(!packet || JSON.stringify(parseFeedbackGameDiagnostics(packet),null,2)!==text){
+        clear('The surface changed. Prepare and review a new preview.');return;
+      }
+      // No await between the last consent check and invoking the explicit copy.
+      await copy(text);
+      if(!destroyed && token===revision)status.textContent='Diagnostics copied. Paste them only where you choose.';
+    } catch {if(!destroyed && token===revision)status.textContent='Copy unavailable. Select the preview text and copy it manually.';}
+  }
+  consent.addEventListener('change',consentChanged);
+  prepare.addEventListener('click',preparePreview);copyButton.addEventListener('click',copyPreview);
+  return Object.freeze({
+    async refreshAccess() {
+      revoke('Access changed. Select consent and prepare a new preview.');const token=revision;
+      try {
+        const decision=await resolveAccess();
+        if(!destroyed && token===revision)section.hidden=!available(decision);
+      } catch { /* Missing remote decisions leave the controls hidden. */ }
+    },
+    destroy() {if(destroyed)return;destroyed=true;revoke();consent.removeEventListener('change',consentChanged);
+      prepare.removeEventListener('click',preparePreview);copyButton.removeEventListener('click',copyPreview);section.remove();},
+  });
+}

package/diagnostics/source.js

@@ -0,0 +1,39 @@
+import { showcaseAssetIntegrity } from './assets.js';
+
+// Internal mount seam for tests. The public entrypoint never accepts loaders or
+// an existing runtime. Registration is a consequence of this fixed source mount.
+export async function createCuratedShowcaseSource({root,sceneEnabled,
+  loadShared=()=>import('@plasius/gpu-shared'),
+  loadRenderer=()=>import('@plasius/gpu-renderer')}) {
+  let destroyed=false, runtime;
+  if(sceneEnabled===true) {
+    const shared=await loadShared();
+    const integrity=Object.fromEntries(Object.entries(showcaseAssetIntegrity).map(
+      ([key,digest])=>[String(shared.resolveShowcaseAssetUrl(key)),digest]));
+    runtime=await shared.mountGpuShowcase({root,focus:'integrated',
+      packageName:'@plasius/gpu-demo-viewer',
+      __featureFlags:{'gpu-demo.scene-fidelity.enabled':true,gpu_showcase_realistic_models_v1:false,
+        'gpu.model.conversion.enabled':false},gltfLoadOptions:{integrity}});
+  }
+  function eligible() {
+    const state=runtime?.state;
+    return !destroyed && state?.assetCatalog?.mode==='modeled-baseline' &&
+      state.assetCatalog.fallbackReason===null && state.rendererUnavailable!==true &&
+      state.nativeRenderer?.backend==='webgpu-raster' && state.nativeRenderer.submittedFrames>0;
+  }
+  return Object.freeze({
+    async observe(consent,isCurrent=()=>true) {
+      if(consent!==true || !isCurrent() || !eligible())return null;
+      const {createFeedbackGameDiagnosticSnapshot}=await loadRenderer();
+      if(!isCurrent() || !eligible())return null;
+      const frame=runtime.state.nativeRenderer;
+      // Never pass the frame, canvas, telemetry, raw errors or other scene state
+      // across the renderer diagnostics boundary. Synthetic timing stays unknown.
+      return createFeedbackGameDiagnosticSnapshot({featureEnabled:true,capabilityGranted:true,
+        consentConfirmed:true,surfaceId:'site.gpu-demo',renderer:'webgpu',backend:'browser',
+        viewportWidth:frame.width,viewportHeight:frame.height,frameRate:undefined,frameTimeMs:undefined,
+        featureIds:['renderer.frame-loop'],counters:[],errorCodes:[]});
+    },
+    destroy() { if(destroyed)return;destroyed=true;runtime?.destroy();runtime=undefined; },
+  });
+}

package/docs/adrs/adr-0007-consented-curated-showcase-diagnostics.md

@@ -0,0 +1,42 @@
+# ADR 0007: Consented diagnostics from a source-owned curated showcase
+
+Status: accepted for Task gpu-demo-viewer#42, Story site#1671, Feature site#1665.
+
+The shared registration contract and renderer bucketing API do not establish
+that a caller's arbitrary canvas or scene is curated. The open model library
+can contain private or unqualified assets. Existing debug snapshots contain
+coordinates, names and broad runtime state.
+
+The new `feedback-diagnostics` package subpath owns a fixed baseline showcase
+mount. Its public API accepts only render/control roots and a remote access
+resolver. Source registration is fixed to `site.gpu-demo` on exact approved
+routes; generator, `/player-system`, model-library and arbitrary runtime
+injection are excluded. Four procedural public shared-package assets are
+integrity-pinned to the published 1.3.0 release. Missing assets, fallback,
+unsubmitted frames, unavailable renderers and destroyed mounts fail closed.
+The raw runtime stays in a closure. Only explicit native backend and viewport
+numbers reach the released renderer bucketing helper. Synthetic timing is
+reported as unknown. The resulting packet is validated by the shared parser.
+
+The host resolves `feedback.game-diagnostics.enabled`, capability
+`feedback.game-diagnostics.attach`, and `gpu-demo.scene-fidelity.enabled`.
+Publishing does not grant access. No environment or query override exists.
+Explicit consent and preview precede observation. Copy rechecks access and
+surface eligibility, and requires a packet identical to the reviewed preview.
+Revocation, access refresh and disposal invalidate pending asynchronous work.
+Disable the diagnostics flag to roll back; ordinary structured reports remain.
+Hosts must call `refreshAccess()` on pushed control changes and destroy on route
+exit. Remount after changing the scene rollout decision.
+
+Accepting caller-supplied IDs/provenance or filtering generic debug snapshots
+was rejected because neither proves a curated source. Adding capture or
+transport was rejected because the Feature prohibits client pixels. The new
+boundary exposes an accessible optional preview/copy UI and performs no upload,
+storage, diagnostic logging or automatic collection.
+
+Tests cover denial/allow/rollback, exact routes, source provenance, immutable
+schema output, forbidden fields, race cancellation and lifetime. Browser checks
+cover explicit user flow, mobile/keyboard access and network/cache isolation.
+Release uses PR CI followed by exact-main `cd.yml` in `production`; verify the
+npm artifact before downstream site#1677 adopts it. No backend or secret mapping
+changes occur in this static package release.

package/docs/adrs/index.md

@@ -9,3 +9,4 @@
 
 - [ADR 0005: Build-time model acquisition subpath](adr-0005-build-time-model-acquisition-subpath.md)
 - [ADR 0006: Composite study consumer](adr-0006-composite-study-consumer.md)
+- [ADR 0007: Consented curated showcase diagnostics](adr-0007-consented-curated-showcase-diagnostics.md)

package/docs/consented-diagnostics.md

@@ -0,0 +1,82 @@
+# Consented showcase diagnostics
+
+Design for gpu-demo-viewer#42, Story site#1671, Feature site#1665.
+
+Only a mount owned by this package can register `site.gpu-demo`. A new focused
+entrypoint will mount the fixed baseline harbour using the published shared
+runtime, four integrity-pinned procedural public assets, and the native renderer.
+It will retain the runtime privately. It will accept no caller-provided surface
+ID, provenance, scene, model, renderer loader, snapshot, warning or URL. Open
+model-library studies, generator, arbitrary canvases and `/player-system` remain
+ineligible. Asset failure, fallback rendering, no submitted frame, disposal or
+unknown provenance disables diagnostics.
+
+The host supplies a fresh remote decision for `feedback.game-diagnostics.enabled`,
+`feedback.game-diagnostics.attach`, and `gpu-demo.scene-fidelity.enabled`.
+Missing decisions deny access. This package adds no service endpoint or local
+production override. The panel requires explicit unchecked consent and a preview
+action before reading observations. Copy rechecks remote access; consent changes,
+refresh, disposal and races clear or invalidate pending work. Normal structured
+reporting is independent. Rollback disables the diagnostics flag.
+
+Only native renderer/backend and coarse viewport buckets are observed. Timing is
+unknown because existing showcase telemetry includes synthetic stress values.
+No raw scene/debug snapshot is passed to the renderer helper. That released helper
+constructs the closed packet, then the shared parser validates it. Preview is
+read-only text; copying is an explicit clipboard operation. No automatic capture,
+upload, download, browser storage, cache entry, analytics or log is introduced.
+
+Alternatives: accepting any source-tagged object would permit forged provenance;
+using `render_game_to_text` would disclose scene details; collecting images would
+violate the Feature. This narrow mount adds a supported validation surface rather
+than assuming every existing demo is eligible. Site integration/reconstruction is
+the separate downstream site#1677.
+
+Validation: tests derive from deny/allow/rollback/provenance/consent/lifetime
+requirements, with changed-source LCOV, static package checks and real browser
+keyboard/320px/no-pixel network/storage/cache checks. Release only via PR CI and
+exact-main `cd.yml` in `production`, then verify npm artifact and provenance.
+
+## Dependency and compatibility decision
+
+The direct shared dependency changes from `^1.2.0` (locked 1.2.0) to exact 1.3.0.
+This adopts the published diagnostics contract verified under shared#101 and
+fixes the bytes used by the four SRI entries. The renderer remains locked to
+0.2.54, with its existing compatible manifest range. Shared 1.3.0 brings its
+declared model-conversion dependency graph; this mount explicitly disables
+conversion and lazily loads the shared runtime only for a positive scene
+decision. No unrelated direct dependency is updated. Package audits and
+signature/attestation verification cover the new locked graph. A future shared
+version requires an explicit asset/hash compatibility review rather than
+silently accepting changed assets.
+
+## Browser qualification — 21 October 2026
+
+An isolated in-app Chromium tab mounted the actual published shared/native
+WebGPU renderer, with the four SRI-pinned assets. The local harness supplied
+test access decisions only; no production controls changed. Keyboard activation
+prepared the closed packet; explicit Copy reported success. No-consent preview
+was denied. Revoking access immediately before Copy cleared preview and consent;
+unchecking consent and disposal also removed retained diagnostics. A 320px-wide
+panel had no horizontal overflow. This is actual narrow-container validation,
+not an emulated 320px device viewport or a full multi-browser qualification.
+
+The harness trapped canvas export/readback and display capture. It recorded
+four public-asset fetches at mount, zero later fetches, zero non-GET requests,
+zero request bodies and zero pixel reads. Resource entries stayed at 36 across
+preview/copy/revocation; localStorage, sessionStorage, Cache Storage and IndexedDB
+stayed empty. This combines browser observations with source/invariant tests;
+it does not claim arbitrary third-party host code cannot perform network I/O.
+No Chrome/Firefox/Safari cross-browser pass is inferred. Clipboard denial has a
+tested selectable-preview fallback.
+
+NFR disposition: security/privacy checked by integrity, closed packet, no-pixel,
+rollback and race tests plus browser isolation evidence; accessibility checked
+for labels, keyboard activation, live status, visible focus, contrast and 44px
+action targets; performance checked through lazy loading and absence of new
+sampling loops; reliability/reproducibility checked by clean install, build,
+asset hashes and lifetime tests; maintainability/testability checked by ADR,
+focused public entrypoint and changed-source LCOV; observability uses fixed
+user-visible status messages without raw diagnostics logging. SEO is N/A for a
+package subpath that creates no public route. Backend sensitive-environment
+mapping is N/A because no backend or Azure resource changes are made.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plasius/gpu-demo-viewer",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "type": "module",
   "description": "Root validation viewer for Plasius gpu-* demos.",
   "license": "Apache-2.0",
@@ -23,7 +23,8 @@
     "./model-library/studies": {
       "types": "./model-library/studies.d.ts",
       "default": "./model-library/studies.js"
-    }
+    },
+    "./feedback-diagnostics": "./diagnostics/index.js"
   },
   "files": [
     "assets/",
@@ -39,7 +40,8 @@
     "main.js",
     "styles.css",
     "viewer-manifest.js",
-    "model-library/"
+    "model-library/",
+    "diagnostics/"
   ],
   "engines": {
     "node": ">=24"
@@ -51,7 +53,7 @@
     "lint": "npm run typecheck",
     "pack:check": "node scripts/verify-public-package.cjs",
     "prepublishOnly": "npm run build && npm run pack:check",
-    "typecheck": "node --check index.js && node --check main.js && node --check viewer-manifest.js && node --check showcase/index.js && node --check showcase/main.js && node --check wavefront/main.js && node --check model-library/main.js && node --check model-library/controller.js && node --check model-library/scenes.js && node --check model-library/acquire.js && node --check model-library/rollout.js && node --check model-library/studies.js",
+    "typecheck": "node --check index.js && node --check main.js && node --check viewer-manifest.js && node --check showcase/index.js && node --check showcase/main.js && node --check wavefront/main.js && node --check model-library/main.js && node --check model-library/controller.js && node --check model-library/scenes.js && node --check model-library/acquire.js && node --check model-library/rollout.js && node --check model-library/studies.js && node --check diagnostics/index.js && node --check diagnostics/source.js && node --check diagnostics/panel.js && node --check diagnostics/assets.js",
     "test": "node --test",
     "models:download": "node scripts/acquire-model-library.mjs",
     "models:dev": "vite --config model-library/vite.config.js",
@@ -59,7 +61,7 @@
   },
   "dependencies": {
     "@plasius/gpu-renderer": "^0.2.54",
-    "@plasius/gpu-shared": "^1.2.0"
+    "@plasius/gpu-shared": "1.3.0"
   },
   "devDependencies": {
     "c8": "^11.0.0",