sproutboat 0.10.2 → 0.11.0

package/CHANGELOG.md

@@ -10,6 +10,79 @@ maintained going forward by the `release` skill.
 
 ## [Unreleased]
 
+## [0.11.0] - 2026-09-13
+### Added
+- `sproutboat toolchain doctor [--json]`: reports the whole toolchain's state
+  at a glance — Zig, Porffor, SQLite, BearSSL, and uWebSockets
+  versions/paths/presence, plus C compiler/archiver/SDK prerequisites.
+- Self-contained platform packages (baronunread/sproutboat#134, #166):
+  `@sproutboat/cli-<os>-<arch>` now ships a vendored, sha256-verified Zig
+  archive and the patched Porffor source alongside the native binary. A fresh
+  install's first build needs no network for either.
+- `optionalDependencies` restored on the root package: `npm install
+  sproutboat` resolves the real native binary for your platform again.
+- `scripts/build-cli.ts --all`: cross-compiles all four platform binaries
+  from one machine, for a maintainer building a full release without
+  waiting on CI.
+
+### Fixed
+- Host builds (`build --target host`, `dev`, `build --standalone`) no longer
+  require a system C compiler. They prefer one when present; when none is
+  found, they fall back to the vendored Zig cross-compiler targeting the
+  host itself — covering uWebSockets/SQLite/BearSSL's own object compiles
+  and Porffor's final link alike.
+- Zig is validated right after download (confirmed to actually link the
+  linux-x86_64-musl target) instead of failing unexplained mid-build.
+- Native dependency caches (Zig, SQLite, BearSSL, uWebSockets) are locked
+  during publication and rebuild, and keyed by compiler identity — a
+  concurrent build or a stale/corrupted cache entry can no longer be
+  silently reused.
+- Non-ASCII Latin-1-range strings emitted as raw bytes under
+  `charset=utf-8` (baronunread/sproutboat#172), fixed upstream and pulled in
+  via the `@sproutboat/runtime`/`@sproutboat/toolchain` bump.
+- Binary static assets and proxied bodies corrupted by the #172 fix itself
+  (baronunread/sproutboat#176), fixed upstream and pulled in via the same
+  bump.
+- A capability check rejected any code declaring a local `process()` member,
+  blocking `zod` (baronunread/sproutboat#132), fixed upstream and pulled in
+  via the same bump.
+
+### Removed
+- The Bun-fallback launcher: `bin/sproutboat.cjs` no longer runs
+  `src/main.ts` under `bun` when no platform binary is installed — the
+  platform binaries are guaranteed present now that they're published and
+  self-contained.
+
+### Docs
+- `docs/standalone.md`: documents the `toISOString()`-after-async-resume
+  livelock (baronunread/sproutboat#168) and its `Date.now()` workaround;
+  corrects an earlier note that wrongly called it `Date`-specific.
+- Release provenance notices published alongside toolchain diagnostics.
+
+## [0.10.3] - 2026-09-11
+### Added
+- Rate-limiter result carries `resetAt`: `env.<NAME>.limit({ key })` now returns
+  `{ success, resetAt }`, where `resetAt` is epoch ms for when the fixed window
+  rolls, so a `429` can send an accurate `Retry-After`
+  (baronunread/sproutboat#69). Additive; callers reading only `success` are
+  unaffected.
+
+### Changed
+- `@sproutboat/runtime` and `@sproutboat/wire` bumped to `^0.5.0`; they carry
+  the `resetAt` value the rate-limiter type now declares.
+
+### Docs
+- `docs/standalone.md`: dropped the stale "outbound `fetch()` speaks `http://`
+  only" bullet. Standalone binaries link BearSSL and verify HTTPS against the
+  Mozilla root set (see "TLS, in both directions"). Added a
+  dev/standalone/deployed parity note: every binding op, rate limiters and
+  `request.cf.clientIp` with `SB_TRUSTED_PROXIES` included, behaves the same
+  under `sproutboat dev` as in a standalone binary and a deployed sprout.
+- `capability-http-sync-v0.md`: documented async handlers. `fetch` may return a
+  promise it creates (not a `.then()`-chained one, which hangs); async responses
+  omit `x-sb-cpu-ms`; `crypto.subtle` digest/sign/verify are async in signature
+  only over synchronous inline C, so per-request hashing costs no I/O.
+
 ## [0.10.2] - 2026-09-11
 ### Fixed
 - The one-time Zig download no longer depends on ziglang.org being reachable.
@@ -370,7 +443,9 @@ its own package.
 - Renamed the package to `sproutboat` (was `@sproutboat/cli`); dropped the
   `sprout` bin alias in favour of a user-defined shell alias.
 
-[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.10.2...HEAD
+[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.0...HEAD
+[0.11.0]: https://github.com/baronunread/sproutboat-cli/compare/v0.10.3...v0.11.0
+[0.10.3]: https://github.com/baronunread/sproutboat-cli/compare/v0.10.2...v0.10.3
 [0.10.2]: https://github.com/baronunread/sproutboat-cli/compare/v0.10.1...v0.10.2
 [0.10.1]: https://github.com/baronunread/sproutboat-cli/compare/v0.10.0...v0.10.1
 [0.10.0]: https://github.com/baronunread/sproutboat-cli/compare/v0.9.0...v0.10.0

package/README.md

@@ -81,6 +81,13 @@ Run `sproutboat` with no arguments for the grouped list.
 [`SURFACE.md`](SURFACE.md) is the generated inventory: every command, every
 argument, every env var, kept honest by a drift test.
 
+### Toolchain diagnostics
+
+`sproutboat toolchain doctor` reports the selected Porffor, Zig, SQLite, and
+BearSSL inputs, cache locations, active overrides, and host compiler
+prerequisites. It never downloads a toolchain or starts a compiler. Use
+`sproutboat toolchain doctor --json` for CI or support tooling.
+
 ### KV data and waitlist export
 
 Manage one namespace by its account-level name:

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.10.2 · runs on Bun (use `bunx`, not `npx`)
+**Package:** `sproutboat` 0.11.0 · runs on Bun (use `bunx`, not `npx`)
 
 ## Commands
 
@@ -14,6 +14,7 @@
 | `types` | `[project-dir]` | Write sproutboat-env.d.ts from the config, so an editor knows what `env` holds. `dev` and `deploy` refresh it when the config is newer. |
 | `dev` | `[project-dir] [--port <n>] [--no-watch]` | Run the project on this machine against a real broker, rebuilding on save. |
 | `build` | `[project-dir] [--target host] [--standalone]` | Cross-compile the native-fetch sprout (Porffor + Zig). `--target host` builds for this machine instead, to run locally — not deployable. `--standalone` emits one executable carrying its own bindings, with SQLite compiled in (~2 MB) and no broker process. |
+| `toolchain` | `doctor [--json]` | Report the selected compiler inputs, cache locations, overrides, and host prerequisites without downloading or compiling anything. |
 | `deploy` | `[project-dir] [--dry-run] [--artifact <dir>] [--no-wait] [--no-provision]` | Build (unless --artifact), auto-provision id-less storage bindings and pin their ids into sproutboat.jsonc, print the report, upload, wait until the URL serves. The control plane skips an upload that matches the live artifact byte-for-byte. --dry-run stops before upload; --no-wait skips the health check; --no-provision leaves id-less bindings as ephemeral deploy-scoped stores. |
 | `versions` | `<list | view <version-id>> [project-dir]` | List the project's deployed versions, or show one version's artifact and bindings. |
 | `rollback` | `<version-id> [project-dir]` | Re-activate a previous version. |
@@ -30,7 +31,7 @@
 | `whoami` | — | Show the active endpoint and the account the stored token belongs to. |
 
 ```
-usage: sproutboat <init [name] | check [project-dir] | types [project-dir] | dev [project-dir] [--port <n>] [--no-watch] | build [project-dir] [--target host] [--standalone] | deploy [project-dir] [--dry-run] [--artifact <dir>] [--no-wait] [--no-provision] | versions <list | view <version-id>> [project-dir] | rollback <version-id> [project-dir] | tail [project-dir] [--sprout] | kv <list | create <name> | info <name> | rename <name> <new> | delete <name>> | <key | bulk | export> ... | d1 <list | create <name> | info <name> | rename <name> <new> | delete <name>> | r2 <list | create <name> | info <name> | rename <name> <new> | delete <name>> | queues <list | create <name> | info <name> | rename <name> <new> | delete <name>> | domains <list | add <host> | verify <host> | delete <host>> [project-dir] | secrets <list | put <NAME> [--value <value>] | delete <NAME>> [project-dir] | delete [project-dir] [--name <project>] --yes | login [--api-url <url>] [--token <token>] | logout [--api-url <url>] | whoami>
+usage: sproutboat <init [name] | check [project-dir] | types [project-dir] | dev [project-dir] [--port <n>] [--no-watch] | build [project-dir] [--target host] [--standalone] | toolchain doctor [--json] | deploy [project-dir] [--dry-run] [--artifact <dir>] [--no-wait] [--no-provision] | versions <list | view <version-id>> [project-dir] | rollback <version-id> [project-dir] | tail [project-dir] [--sprout] | kv <list | create <name> | info <name> | rename <name> <new> | delete <name>> | <key | bulk | export> ... | d1 <list | create <name> | info <name> | rename <name> <new> | delete <name>> | r2 <list | create <name> | info <name> | rename <name> <new> | delete <name>> | queues <list | create <name> | info <name> | rename <name> <new> | delete <name>> | domains <list | add <host> | verify <host> | delete <host>> [project-dir] | secrets <list | put <NAME> [--value <value>] | delete <NAME>> [project-dir] | delete [project-dir] [--name <project>] --yes | login [--api-url <url>] [--token <token>] | logout [--api-url <url>] | whoami>
 ```
 
 ## Environment variables
@@ -42,8 +43,9 @@ usage: sproutboat <init [name] | check [project-dir] | types [project-dir] | dev
 | `SPROUTBOAT_ZIG` | Path to a Zig binary to use instead of downloading the pinned one. |
 | `SPROUTBOAT_ZIG_URL` | URL to download the pinned Zig tarball from, instead of a Zig community mirror. The sha256 is still enforced. |
 | `SPROUTBOAT_UWS_TARBALL` | Path to a uWebSockets source tarball to seed the Porffor cache with, instead of the one vendored in the package. Both targets are seeded from it. |
-| `CC` | C compiler used to build uSockets for a host build (default `cc`). A host build needs one regardless: it is what Porffor compiles its own generated C with. |
-| `AR` | Archiver used to assemble uSockets.a for a host build (default `ar`). |
+| `CC` | C compiler for a host build (default `cc` if present, else the vendored Zig cross-compiler targeting this host). |
+| `CXX` | C++ compiler for a host build's native-fetch link step (default `c++` if present, else the vendored Zig cross-compiler targeting this host). |
+| `AR` | Archiver used to assemble uSockets.a for a host build (default `ar` if present, else Zig's). |
 | `SPROUTBOAT_COMPILE_TIMEOUT_MS` | Porffor compile timeout in ms (default 600000). |
 | `SPROUTBOAT_TOOLCHAIN_CACHE` | Managed Porffor and compiler cache root (default ~/.cache/sproutboat). |
 | `SPROUTBOAT_PORFFOR_DIR` | Contributor override for an existing Porffor source checkout. Required files are validated before use. |

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,29 @@
+# Third-party notices and provenance
+
+This release contains or acquires the components below. Pins and checksums are
+recorded so a released executable and every first-build download can be traced
+to its upstream source.
+
+| Component | Version or revision | Distribution role | License | Source |
+| --- | --- | --- | --- | --- |
+| Porffor | `a415d194e74948f0ac32b9d608153ea8720c71fd` | Acquired on first application build | MIT | https://github.com/CanadaHonk/porffor |
+| Zig | `0.16.0` | Acquired cross-compiler | MIT | https://ziglang.org |
+| uWebSockets and uSockets | `360c276d609d59af56ae6932adb95154ace9f15f` | Embedded source and static archive | Apache-2.0 | https://github.com/uNetworking/uWebSockets |
+| esbuild | `0.28.2` | Embedded platform executable | MIT | https://esbuild.github.io |
+| SQLite | `3.50.4` | Acquired for standalone builds | Public domain | https://sqlite.org |
+| BearSSL | `0.6` | Acquired for standalone builds | MIT | https://bearssl.org |
+
+## Integrity pins
+
+| Component | SHA-256 |
+| --- | --- |
+| Porffor source archive | `677779c8be49efc28686378f665cd6fc4a8a2dd81e7b15a89298103ded960829` |
+| Embedded uWebSockets archive | `e83736f3f8cf9d56a1ebe6ea61625a7af12386763374d47c14cff472ada7484a` |
+| SQLite amalgamation archive | `1d3049dd0f830a025a53105fc79fd2ab9431aea99e137809d064d8ee8356b032` |
+| BearSSL source archive | `6705bba1714961b41a728dfc5debbe348d2966c117649392f8c8139efc83ff14` |
+| Mozilla CA bundle | `f66dff1bdf8f96060b8177976f8b7d9254bc89bc4db933d769f7384d28480bc9` |
+
+The complete Apache-2.0 notice for uWebSockets and uSockets is retained in the
+embedded source archive. Porffor and BearSSL retain their MIT notices in the
+source archives acquired at the revisions above. esbuild's MIT notice is
+available from its upstream distribution.

package/bin/sproutboat.cjs

@@ -1,36 +1,34 @@
 #!/usr/bin/env node
-// npm selects the packaged executable for this host when it is installed; that
-// is a native single-file binary that needs no Bun. When it is absent (it is
-// not published yet — see issue #134), fall back to running the TypeScript
-// entry point with Bun, which is how the CLI shipped through v0.9.0.
+// npm resolves exactly one @sproutboat/cli-<os>-<arch> optionalDependency for
+// this host at install time (#134); this launcher just execs that native
+// single-file binary. No Bun, no fallback: a platform with no published
+// binary means npm skipped that optional dependency, and require.resolve
+// below fails with a clear "package not found" rather than a silent one.
 const { spawn } = require("node:child_process");
-const { join } = require("node:path");
 
 const platform = process.platform === "darwin" ? "darwin" : process.platform === "linux" ? "linux" : null;
 const arch = process.arch === "arm64" ? "arm64" : process.arch === "x64" ? "x64" : null;
 
+if (!platform || !arch) {
+  console.error(`sproutboat: unsupported host ${process.platform}/${process.arch}`);
+  process.exit(1);
+}
+
 let command;
-let args;
-let viaBun = false;
 try {
-  if (!platform || !arch) throw new Error(`unsupported host ${process.platform}/${process.arch}`);
   command = require.resolve(`@sproutboat/cli-${platform}-${arch}/bin/sproutboat`);
-  args = process.argv.slice(2);
 } catch {
-  viaBun = true;
-  // SPROUTBOAT_BUN is an escape hatch for an unusual install; otherwise PATH.
-  command = process.env.SPROUTBOAT_BUN || "bun";
-  args = [join(__dirname, "..", "src", "main.ts"), ...process.argv.slice(2)];
+  console.error(
+    `sproutboat: no native build installed for ${platform}-${arch}. ` +
+      `Reinstall sproutboat, or install @sproutboat/cli-${platform}-${arch} directly.`,
+  );
+  process.exit(1);
 }
 
-const child = spawn(command, args, { stdio: "inherit", windowsHide: true });
+const child = spawn(command, process.argv.slice(2), { stdio: "inherit", windowsHide: true });
 
 child.once("error", (error) => {
-  if (viaBun && error.code === "ENOENT") {
-    console.error("sproutboat: this build needs Bun on PATH. Install it: https://bun.sh");
-  } else {
-    console.error(`sproutboat: could not start: ${error.message}`);
-  }
+  console.error(`sproutboat: could not start: ${error.message}`);
   process.exit(1);
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.10.2",
+  "version": "0.11.0",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -24,6 +24,7 @@
   "files": [
     "CHANGELOG.md",
     "SURFACE.md",
+    "THIRD_PARTY_NOTICES.md",
     "src",
     "bin/sproutboat.cjs",
     "scripts",
@@ -63,9 +64,9 @@
     "@sproutboat/artifact": "^0.2.0",
     "@sproutboat/assets": "^0.2.0",
     "@sproutboat/config": "^0.3.0",
-    "@sproutboat/runtime": "^0.4.0",
-    "@sproutboat/toolchain": "^0.3.0",
-    "@sproutboat/wire": "^0.4.0",
+    "@sproutboat/runtime": "^0.6.1",
+    "@sproutboat/toolchain": "^0.4.0",
+    "@sproutboat/wire": "^0.5.0",
     "esbuild": "^0.28.2"
   },
   "devDependencies": {
@@ -76,6 +77,12 @@
     "oxlint": "1.81.0",
     "typescript": "7.0.2"
   },
+  "optionalDependencies": {
+    "@sproutboat/cli-darwin-arm64": "0.11.0",
+    "@sproutboat/cli-darwin-x64": "0.11.0",
+    "@sproutboat/cli-linux-arm64": "0.11.0",
+    "@sproutboat/cli-linux-x64": "0.11.0"
+  },
   "engines": {
     "node": ">=18"
   }

package/scripts/build-cli.ts

@@ -1,44 +1,117 @@
-/** Build one platform package executable. npm's tiny root launcher resolves it. */
+/**
+ * Build platform package executable(s). npm's tiny root launcher resolves one
+ * of these at install time.
+ *
+ * Default (no args): build the host's own target only — what CI's per-platform
+ * matrix runners want, one native build each, no cross-compilation involved.
+ *
+ * `--all`: cross-compile all four targets from this one machine (`bun build
+ * --compile` can target any `bun-<os>-<arch>` regardless of host — verified
+ * against real Linux/macOS output, not just docs). For a maintainer building
+ * every platform package locally without waiting on CI.
+ */
 import { chmod, copyFile, mkdir } from "node:fs/promises";
 import { resolve } from "node:path";
+import { ensureZigArchive, type ZigPlatform } from "../src/toolchain";
 
-const platform = process.platform === "darwin" ? "darwin" : process.platform === "linux" ? "linux" : null;
-const arch = process.arch === "arm64" ? "arm64" : process.arch === "x64" ? "x64" : null;
-if (!platform || !arch) throw new Error(`unsupported release host ${process.platform}/${process.arch}`);
-const packageDir = resolve(import.meta.dir, "..", "platform-packages", `${platform}-${arch}`);
-const out = resolve(packageDir, "bin", "sproutboat");
-await mkdir(resolve(out, ".."), { recursive: true });
-// SAFETY: package.json is this release's manifest and npm requires its version.
-const version = ((await Bun.file(resolve(import.meta.dir, "..", "package.json")).json()) as { version: string })
-  .version;
-// SAFETY: every checked-in platform package manifest owns a required string version.
-const platformVersion = ((await Bun.file(resolve(packageDir, "package.json")).json()) as { version: string }).version;
-if (platformVersion !== version)
-  throw new Error(`platform package version ${platformVersion} does not match root ${version}`);
-const child = Bun.spawn(
-  [
-    process.execPath,
-    "build",
-    "--compile",
-    "--target=bun",
-    `--define:process.env.SPROUTBOAT_CLI_VERSION=${JSON.stringify(version)}`,
-    "--outfile",
-    out,
-    "src/main.ts",
-  ],
-  {
-    cwd: resolve(import.meta.dir, ".."),
-    stdout: "inherit",
-    stderr: "inherit",
-  },
-);
-if ((await child.exited) !== 0) process.exit(1);
-let esbuild: string;
-try {
-  esbuild = Bun.resolveSync(`@esbuild/${platform}-${arch}/bin/esbuild`, import.meta.dir);
-} catch {
-  throw new Error("matching esbuild binary is missing; run bun install before building a platform package");
+type Target = { platform: "darwin" | "linux"; arch: "arm64" | "x64"; bunTarget: string; zigPlatform: ZigPlatform };
+
+const TARGETS: Target[] = [
+  { platform: "darwin", arch: "arm64", bunTarget: "bun-darwin-arm64", zigPlatform: "aarch64-macos" },
+  { platform: "darwin", arch: "x64", bunTarget: "bun-darwin-x64", zigPlatform: "x86_64-macos" },
+  { platform: "linux", arch: "arm64", bunTarget: "bun-linux-arm64", zigPlatform: "aarch64-linux" },
+  { platform: "linux", arch: "x64", bunTarget: "bun-linux-x64", zigPlatform: "x86_64-linux" },
+];
+
+function hostTarget(): Target {
+  const platform = process.platform === "darwin" ? "darwin" : process.platform === "linux" ? "linux" : null;
+  const arch = process.arch === "arm64" ? "arm64" : process.arch === "x64" ? "x64" : null;
+  if (!platform || !arch) throw new Error(`unsupported release host ${process.platform}/${process.arch}`);
+  const match = TARGETS.find((t) => t.platform === platform && t.arch === arch);
+  if (!match) throw new Error(`no target entry for ${platform}/${arch}`);
+  return match;
+}
+
+const root = resolve(import.meta.dir, "..");
+
+/** esbuild ships one binary per platform (`@esbuild/<os>-<arch>`); a cross
+ * target's copy is never installed locally (npm/bun refuse it — the package
+ * declares `os`/`cpu` and gets skipped for any other host), so fetch that
+ * platform's tarball from the registry instead, same shape as ensureZig's
+ * prebuilt-archive fetches. */
+async function esbuildBinaryFor(target: Target): Promise<string> {
+  const host = hostTarget();
+  if (target.platform === host.platform && target.arch === host.arch) {
+    try {
+      return Bun.resolveSync(`@esbuild/${target.platform}-${target.arch}/bin/esbuild`, import.meta.dir);
+    } catch {
+      throw new Error("host esbuild binary is missing; run bun install first");
+    }
+  }
+  // SAFETY: package.json is this repo's own manifest, with a required esbuild dependency entry.
+  const pkg = (await Bun.file(resolve(root, "package.json")).json()) as { dependencies: { esbuild: string } };
+  const version = pkg.dependencies.esbuild.replace(/^[\^~]/, "");
+  const name = `${target.platform}-${target.arch}`;
+  const cacheDir = resolve(
+    process.env.SPROUTBOAT_TOOLCHAIN_CACHE ?? `${process.env.HOME}/.cache/sproutboat`,
+    `esbuild-${version}-${name}`,
+  );
+  const cached = resolve(cacheDir, "esbuild");
+  if (await Bun.file(cached).exists()) return cached;
+  const res = await fetch(`https://registry.npmjs.org/@esbuild/${name}/-/${name}-${version}.tgz`);
+  if (!res.ok) throw new Error(`could not fetch @esbuild/${name}@${version}: HTTP ${res.status}`);
+  const tarPath = resolve(cacheDir, "esbuild.tgz");
+  await mkdir(cacheDir, { recursive: true });
+  await Bun.write(tarPath, await res.arrayBuffer());
+  const untar = Bun.spawn(["tar", "-xzf", tarPath, "-C", cacheDir, "--strip-components=2", "package/bin/esbuild"], {
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [code, err] = await Promise.all([untar.exited, new Response(untar.stderr).text()]);
+  if (code !== 0) throw new Error(`could not extract @esbuild/${name}: ${err.trim()}`);
+  await chmod(cached, 0o755);
+  return cached;
+}
+
+async function buildOne(target: Target): Promise<void> {
+  const packageDir = resolve(root, "platform-packages", `${target.platform}-${target.arch}`);
+  const out = resolve(packageDir, "bin", "sproutboat");
+  await mkdir(resolve(out, ".."), { recursive: true });
+  // SAFETY: package.json is this release's manifest and npm requires its version.
+  const version = ((await Bun.file(resolve(root, "package.json")).json()) as { version: string }).version;
+  // SAFETY: every checked-in platform package manifest owns a required string version.
+  const platformVersion = ((await Bun.file(resolve(packageDir, "package.json")).json()) as { version: string }).version;
+  if (platformVersion !== version)
+    throw new Error(`platform package version ${platformVersion} does not match root ${version}`);
+  console.log(`building ${target.platform}-${target.arch}...`);
+  const child = Bun.spawn(
+    [
+      process.execPath,
+      "build",
+      "--compile",
+      `--target=${target.bunTarget}`,
+      `--define:process.env.SPROUTBOAT_CLI_VERSION=${JSON.stringify(version)}`,
+      "--outfile",
+      out,
+      "src/main.ts",
+    ],
+    { cwd: root, stdout: "inherit", stderr: "inherit" },
+  );
+  if ((await child.exited) !== 0) throw new Error(`compile failed for ${target.platform}-${target.arch}`);
+  const esbuild = await esbuildBinaryFor(target);
+  const packagedEsbuild = resolve(packageDir, "bin", "esbuild");
+  await copyFile(esbuild, packagedEsbuild);
+  // The compressed archive (~50 MB), not the ~400 MB extracted install: Zig's
+  // lib/ carries libc/libc++ sources for every target it can cross-compile to,
+  // which only matters once, on extract. `ensureZig` (src/toolchain.ts) looks
+  // for this file next to the running executable before ever hitting the
+  // network, and extracts it into the ordinary toolchain cache on first use --
+  // same shape as the vendored uWebSockets archive.
+  await copyFile(await ensureZigArchive(target.zigPlatform), resolve(packageDir, "bin", "zig.tar.xz"));
+  await copyFile(resolve(root, "THIRD_PARTY_NOTICES.md"), resolve(packageDir, "THIRD_PARTY_NOTICES.md"));
+  await chmod(packagedEsbuild, 0o755);
+  await chmod(out, 0o755);
 }
-const packagedEsbuild = resolve(packageDir, "bin", "esbuild");
-await copyFile(esbuild, packagedEsbuild);
-await chmod(packagedEsbuild, 0o755);
+
+const all = process.argv.includes("--all");
+for (const target of all ? TARGETS : [hostTarget()]) await buildOne(target);