sproutboat 0.10.2 → 0.11.0

package/src/bearssl.ts

@@ -16,9 +16,10 @@
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { existsSync } from "node:fs";
-import { mkdir, readdir, writeFile } from "node:fs/promises";
+import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { resolve } from "node:path";
+import { resolveHostCompiler } from "./toolchain";
 
 export const BEARSSL_VERSION = "0.6";
 const BEARSSL_URL = `https://bearssl.org/bearssl-${BEARSSL_VERSION}.tar.gz`;
@@ -36,7 +37,41 @@ const BEARSSL_SHA256 = "6705bba1714961b41a728dfc5debbe348d2966c117649392f8c8139e
 const CACERT_URL = "https://curl.se/ca/cacert.pem";
 const CACERT_SHA256 = "f66dff1bdf8f96060b8177976f8b7d9254bc89bc4db933d769f7384d28480bc9";
 
-const cacheDir = (): string => resolve(homedir(), ".cache/sproutboat", `bearssl-${BEARSSL_VERSION}`);
+const cacheDir = (): string =>
+  resolve(
+    process.env.SPROUTBOAT_TOOLCHAIN_CACHE ?? resolve(homedir(), ".cache/sproutboat"),
+    `bearssl-${BEARSSL_VERSION}`,
+  );
+
+const digest = async (path: string): Promise<string> =>
+  createHash("sha256")
+    .update(await readFile(path))
+    .digest("hex");
+
+async function withBearsslLock<T>(dir: string, name: string, action: () => Promise<T>): Promise<T> {
+  await mkdir(dir, { recursive: true });
+  const lock = resolve(dir, `.${name}.lock`);
+  const deadline = Date.now() + 30_000;
+  for (;;) {
+    try {
+      await mkdir(lock);
+      break;
+    } catch {
+      if (Date.now() > deadline) throw new Error(`timed out waiting for BearSSL cache lock ${lock}`);
+      try {
+        if (Date.now() - (await stat(lock)).mtimeMs > 5 * 60_000) await rm(lock, { recursive: true, force: true });
+      } catch {
+        /* publisher released the lock while it was being inspected */
+      }
+      await Bun.sleep(25);
+    }
+  }
+  try {
+    return await action();
+  } finally {
+    await rm(lock, { recursive: true, force: true });
+  }
+}
 
 export type BearsslInput = {
   target: "linux-x86_64" | "host";
@@ -51,9 +86,18 @@ export type BearsslBuild = {
   objects: string[];
 };
 
-const run = (cmd: string, args: string[], cwd?: string): Promise<{ code: number; stderr: string }> =>
+const run = (
+  cmd: string,
+  args: string[],
+  cwd?: string,
+  env?: Record<string, string | undefined>,
+): Promise<{ code: number; stderr: string }> =>
   new Promise((done) => {
-    const child = spawn(cmd, args, { cwd, stdio: ["ignore", "ignore", "pipe"] });
+    const child = spawn(cmd, args, {
+      cwd,
+      stdio: ["ignore", "ignore", "pipe"],
+      env: env ? { ...process.env, ...env } : undefined,
+    });
     let stderr = "";
     child.stderr.on("data", (chunk) => (stderr += String(chunk)));
     child.on("close", (code) => done({ code: code ?? 1, stderr }));
@@ -73,13 +117,43 @@ async function download(url: string, expected: string, to: string): Promise<Buff
 async function sourceTree(): Promise<string> {
   const dir = cacheDir();
   const tree = resolve(dir, `bearssl-${BEARSSL_VERSION}`);
-  if (existsSync(resolve(tree, "inc/bearssl.h"))) return tree;
-  await mkdir(dir, { recursive: true });
-  const tarball = resolve(dir, "bearssl.tar.gz");
-  if (!existsSync(tarball)) await download(BEARSSL_URL, BEARSSL_SHA256, tarball);
-  const untar = await run("tar", ["xzf", tarball], dir);
-  if (untar.code !== 0) throw new Error(`could not unpack BearSSL: ${untar.stderr}`);
-  return tree;
+  return withBearsslLock(dir, "source", async () => {
+    const tarball = resolve(dir, "bearssl.tar.gz");
+    const sourceManifest = resolve(tree, ".sproutboat-source");
+    try {
+      // SAFETY: this untrusted JSON is checked against pinned and computed hashes below.
+      const manifest = JSON.parse(await readFile(sourceManifest, "utf8")) as {
+        archive?: string;
+        header?: string;
+      };
+      if (manifest.archive === BEARSSL_SHA256 && manifest.header === (await digest(resolve(tree, "inc/bearssl.h"))))
+        return tree;
+    } catch {
+      /* rebuild an incomplete or corrupt source cache below */
+    }
+    await rm(tree, { recursive: true, force: true });
+    if (!existsSync(tarball) || (await digest(tarball)) !== BEARSSL_SHA256) {
+      await rm(tarball, { force: true });
+      await download(BEARSSL_URL, BEARSSL_SHA256, tarball);
+    }
+    const stage = resolve(dir, `.bearssl-stage-${process.pid}-${crypto.randomUUID()}`);
+    await mkdir(stage, { recursive: true });
+    const untar = await run("tar", ["xzf", tarball, "-C", stage]);
+    if (untar.code !== 0) throw new Error(`could not unpack BearSSL: ${untar.stderr}`);
+    const stagedTree = resolve(stage, `bearssl-${BEARSSL_VERSION}`);
+    if (!existsSync(resolve(stagedTree, "inc/bearssl.h"))) {
+      await rm(stage, { recursive: true, force: true });
+      throw new Error("BearSSL archive did not contain bearssl.h");
+    }
+    await writeFile(
+      resolve(stagedTree, ".sproutboat-source"),
+      JSON.stringify({ archive: BEARSSL_SHA256, header: await digest(resolve(stagedTree, "inc/bearssl.h")) }),
+      { mode: 0o444 },
+    );
+    await rename(stagedTree, tree);
+    await rm(stage, { recursive: true, force: true });
+    return tree;
+  });
 }
 
 /** Every .c under src/, which is what the library is. */
@@ -103,7 +177,8 @@ async function sources(tree: string): Promise<string[]> {
 async function trustAnchorTool(tree: string): Promise<string> {
   const tool = resolve(tree, "build/brssl");
   if (existsSync(tool)) return tool;
-  const make = await run("make", ["-j8", "build/brssl"], tree);
+  const { cc } = await resolveHostCompiler();
+  const make = await run("make", ["-j8", "build/brssl"], tree, { CC: cc.join(" ") });
   if (!existsSync(tool)) throw new Error(`could not build brssl: ${make.stderr}`);
   return tool;
 }
@@ -117,27 +192,44 @@ async function trustAnchorTool(tree: string): Promise<string> {
  */
 async function trustAnchorSource(tree: string): Promise<string> {
   const out = resolve(cacheDir(), "trust-anchors.c");
-  if (existsSync(out)) return out;
-  const pem = resolve(cacheDir(), "cacert.pem");
-  if (!existsSync(pem)) await download(CACERT_URL, CACERT_SHA256, pem);
-  const tool = await trustAnchorTool(tree);
-
-  const generated = await new Promise<string>((done, fail) => {
-    const child = spawn(tool, ["ta", pem], { stdio: ["ignore", "pipe", "pipe"] });
-    let text = "";
-    let err = "";
-    child.stdout.on("data", (chunk) => (text += String(chunk)));
-    child.stderr.on("data", (chunk) => (err += String(chunk)));
-    child.on("close", (code) => (code === 0 ? done(text) : fail(new Error(`brssl ta failed: ${err}`))));
-  });
+  return withBearsslLock(cacheDir(), "anchors", async () => {
+    const manifestPath = resolve(cacheDir(), ".sproutboat-anchors");
+    const pem = resolve(cacheDir(), "cacert.pem");
+    try {
+      // SAFETY: this untrusted JSON is checked against pinned and computed hashes below.
+      const manifest = JSON.parse(await readFile(manifestPath, "utf8")) as { pem?: string; source?: string };
+      if (manifest.pem === CACERT_SHA256 && manifest.source === (await digest(out))) return out;
+    } catch {
+      /* regenerate an incomplete or corrupt trust-anchor cache below */
+    }
+    if (!existsSync(pem) || (await digest(pem)) !== CACERT_SHA256) {
+      await rm(pem, { force: true });
+      await download(CACERT_URL, CACERT_SHA256, pem);
+    }
+    const tool = await trustAnchorTool(tree);
+
+    const generated = await new Promise<string>((done, fail) => {
+      const child = spawn(tool, ["ta", pem], { stdio: ["ignore", "pipe", "pipe"] });
+      let text = "";
+      let err = "";
+      child.stdout.on("data", (chunk) => (text += String(chunk)));
+      child.stderr.on("data", (chunk) => (err += String(chunk)));
+      child.on("close", (code) => (code === 0 ? done(text) : fail(new Error(`brssl ta failed: ${err}`))));
+    });
 
-  const count = /#define TAs_NUM\s+(\d+)/.exec(generated)?.[1];
-  if (!count) throw new Error("brssl ta produced no TAs_NUM — its output format changed");
-  const linkable = generated
-    .replace(/static const br_x509_trust_anchor TAs\[/, "const br_x509_trust_anchor sb_trust_anchors[")
-    .replace(/#define TAs_NUM\s+\d+/, `const size_t sb_trust_anchor_count = ${count};`);
-  await writeFile(out, `#include <stddef.h>\n#include "bearssl.h"\n${linkable}\n`);
-  return out;
+    const count = /#define TAs_NUM\s+(\d+)/.exec(generated)?.[1];
+    if (!count) throw new Error("brssl ta produced no TAs_NUM — its output format changed");
+    const linkable = generated
+      .replace(/static const br_x509_trust_anchor TAs\[/, "const br_x509_trust_anchor sb_trust_anchors[")
+      .replace(/#define TAs_NUM\s+\d+/, `const size_t sb_trust_anchor_count = ${count};`);
+    const stage = `${out}.${process.pid}.${crypto.randomUUID()}`;
+    await writeFile(stage, `#include <stddef.h>\n#include "bearssl.h"\n${linkable}\n`);
+    await rename(stage, out);
+    const manifestStage = `${manifestPath}.${process.pid}.${crypto.randomUUID()}`;
+    await writeFile(manifestStage, JSON.stringify({ pem: CACERT_SHA256, source: await digest(out) }), { mode: 0o444 });
+    await rename(manifestStage, manifestPath);
+    return out;
+  });
 }
 
 /** Compile one C file, caching on the output path. */
@@ -152,29 +244,90 @@ export async function ensureBearssl(input: BearsslInput): Promise<BearsslBuild>
   const tree = await sourceTree();
   const includeDir = resolve(tree, "inc");
   const objDir = resolve(cacheDir(), `obj-${input.target}`);
-  await mkdir(objDir, { recursive: true });
-
-  const [cc, prefix] =
+  const [cc, ...prefix] =
     input.target === "host"
-      ? (["cc", []] as const)
-      : ([input.zigBin ?? "zig", ["cc", "-target", "x86_64-linux-musl"]] as const);
+      ? (await resolveHostCompiler()).cc
+      : [input.zigBin ?? "zig", "cc", "-target", "x86_64-linux-musl"];
   const includes = [includeDir, resolve(tree, "src")];
+  const sourceFiles = await sources(tree);
+  const anchors = await trustAnchorSource(tree);
+  const sourceHashes = Object.fromEntries(
+    await Promise.all(sourceFiles.map(async (source) => [source, await digest(source)] as const)),
+  );
+  const anchorSha256 = await digest(anchors);
+  const manifestPath = resolve(objDir, ".sproutboat-complete");
+  const objectNames = [
+    ...sourceFiles.map((source) => `${source.split("/").pop()!.replace(/\.c$/, "")}.o`),
+    "trust-anchors.o",
+  ];
+  const flags = ["-Os", ...includes.flatMap((include) => ["-I", include])];
+  const validCache = async (): Promise<boolean> => {
+    try {
+      // SAFETY: the manifest is private data written below. Every source, target,
+      // compiler invocation, and object digest must match before reuse.
+      const manifest = JSON.parse(await readFile(manifestPath, "utf8")) as {
+        target?: string;
+        command?: string[];
+        flags?: string[];
+        sources?: Record<string, string>;
+        anchors?: string;
+        objects?: Record<string, string>;
+      };
+      const validObjects = await Promise.all(
+        objectNames.map(async (name) => manifest.objects?.[name] === (await digest(resolve(objDir, name)))),
+      );
+      return (
+        manifest.target === input.target &&
+        JSON.stringify(manifest.command) === JSON.stringify([cc, ...prefix]) &&
+        JSON.stringify(manifest.flags) === JSON.stringify(flags) &&
+        JSON.stringify(manifest.sources) === JSON.stringify(sourceHashes) &&
+        manifest.anchors === anchorSha256 &&
+        validObjects.every(Boolean)
+      );
+    } catch {
+      return false;
+    }
+  };
+  if (await validCache()) return { includeDir, objects: objectNames.map((name) => resolve(objDir, name)) };
 
-  const objects: string[] = [];
-  // Sequential rather than parallel: this runs once per target and a burst of
-  // ~180 compiler processes is a worse neighbour than a slow first build.
-  for (const source of await sources(tree)) {
-    const out = resolve(objDir, `${source.split("/").pop()!.replace(/\.c$/, "")}.o`);
-    await compile(cc, [...prefix], source, out, includes);
-    objects.push(out);
-  }
+  return withBearsslLock(cacheDir(), `objects-${input.target}`, async () => {
+    if (await validCache()) return { includeDir, objects: objectNames.map((name) => resolve(objDir, name)) };
+    await rm(objDir, { recursive: true, force: true });
+    await mkdir(objDir, { recursive: true });
 
-  const anchors = await trustAnchorSource(tree);
-  const anchorObject = resolve(objDir, "trust-anchors.o");
-  await compile(cc, [...prefix], anchors, anchorObject, includes);
-  objects.push(anchorObject);
+    const objects: string[] = [];
+    // Sequential rather than parallel: this runs once per target and a burst of
+    // ~180 compiler processes is a worse neighbour than a slow first build.
+    for (const source of sourceFiles) {
+      const out = resolve(objDir, `${source.split("/").pop()!.replace(/\.c$/, "")}.o`);
+      await compile(cc, [...prefix], source, out, includes);
+      objects.push(out);
+    }
 
-  return { includeDir, objects };
+    const anchorObject = resolve(objDir, "trust-anchors.o");
+    await compile(cc, [...prefix], anchors, anchorObject, includes);
+    objects.push(anchorObject);
+
+    const objectHashes = Object.fromEntries(
+      await Promise.all(objects.map(async (object) => [object.split("/").pop()!, await digest(object)] as const)),
+    );
+    const stagedManifest = `${manifestPath}.${process.pid}.${crypto.randomUUID()}`;
+    await writeFile(
+      stagedManifest,
+      JSON.stringify({
+        target: input.target,
+        command: [cc, ...prefix],
+        flags,
+        sources: sourceHashes,
+        anchors: anchorSha256,
+        objects: objectHashes,
+      }),
+      { mode: 0o444 },
+    );
+    await rename(stagedManifest, manifestPath);
+
+    return { includeDir, objects };
+  });
 }
 
 export const bearsslStamp = (): string => `bearssl/${BEARSSL_VERSION}`;

package/src/build.ts

@@ -4,7 +4,8 @@ import { resolve } from "node:path";
 import { walkAssets, type AssetManifest } from "./assets";
 import { resourceRefs, type SproutboatConfig } from "./config";
 import { ensureSqliteObject } from "./sqlite";
-import { ensureBearssl } from "./bearssl";
+import { sqliteStamp } from "./sqlite";
+import { bearsslStamp, ensureBearssl } from "./bearssl";
 import { compileSprout, type Transport } from "./compile";
 import {
   ARTIFACT_SCHEMA_VERSION,
@@ -70,7 +71,29 @@ function digest(value: Uint8Array | string): `sha256:${string}` {
 export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
   const source = input.source ?? (await readFile(input.sourcePath));
   const sourceHash = digest(source);
-  const artifactId = sourceHash.slice("sha256:".length, 24);
+  const target = input.target ?? "linux-x86_64";
+  const embedded = input.transport === "embedded";
+  // The directory identity must change whenever an input that changes the
+  // generated C or link line changes. A source digest alone reused an artifact
+  // path across compiler pins, targets, and standalone ABI settings.
+  const artifactId = digest(
+    JSON.stringify({
+      sourceHash,
+      target,
+      transport: input.transport ?? "broker",
+      optimize: input.optimize ?? "release",
+      compatibilityDate: input.config.compatibility_date,
+      config: input.config,
+      toolchain: toolchainStamp(),
+      compiler:
+        target === "host"
+          ? `host:${process.env.CC ?? "cc"}`
+          : process.env.SPROUTBOAT_ZIG
+            ? `override:${process.env.SPROUTBOAT_ZIG}`
+            : "managed-zig",
+      native: embedded ? [sqliteStamp(), bearsslStamp()] : [],
+    }),
+  ).slice("sha256:".length, 24);
   const artifactDir = input.outputDirectory ?? resolve(input.projectDir, ".sproutboat/dist", artifactId);
   const sproutPath = resolve(artifactDir, "sprout");
   await mkdir(artifactDir, { recursive: true });
@@ -116,8 +139,6 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
   // #15 — an embedded sprout carries its own storage and TLS instead of talking
   // to a broker: SQLite and BearSSL are compiled once per target and added to
   // the link line, and BearSSL's header to the compile line.
-  const embedded = input.transport === "embedded";
-  const target = input.target ?? "linux-x86_64";
   const sqliteObject = embedded ? await ensureSqliteObject({ target, zigBin }) : null;
   const tls = embedded ? await ensureBearssl({ target, zigBin }) : null;
   const extraLink = [...(sqliteObject ? [sqliteObject] : []), ...(tls ? tls.objects : [])];

package/src/compile.ts

@@ -14,7 +14,7 @@ import { existsSync } from "node:fs";
 import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import { ensurePorfforPatched } from "./patch-porffor";
-import { ensureUWebSockets, ensureUWebSocketsHost, UwsUnavailableError } from "./toolchain";
+import { ensureUWebSockets, ensureUWebSocketsHost, resolveHostCompiler, UwsUnavailableError } from "./toolchain";
 import { ensurePorffor } from "./porffor-toolchain";
 // The prelude + transports live in @sproutboat/runtime (next to wrap.ts, which
 // locates them by file URL). `preludePath`/`transportPath` read them from there
@@ -109,11 +109,20 @@ export async function loadPrelude(transport: Transport = "broker"): Promise<stri
 }
 
 /** Child env for the Porffor run. `SB_EXTRA_LINK` is read by the patched link
- *  step (#15) and is absent entirely for a normal build. */
-function compileEnv(path: string, extraLink?: string[], extraCflags?: string[]) {
+ *  step (#15) and is absent entirely for a normal build. `cc`/`cxx` override
+ *  Porffor's own `CC`/`CXX` read for a **host** build (musl builds hardcode
+ *  `zig cc` themselves and ignore both). */
+function compileEnv(
+  path: string,
+  extraLink?: string[],
+  extraCflags?: string[],
+  compiler?: { cc: string[]; cxx: string[] },
+) {
   const link = extraLink && extraLink.length > 0 ? extraLink.join(" ") : undefined;
   const cflags = extraCflags && extraCflags.length > 0 ? extraCflags.join(" ") : undefined;
-  return { ...process.env, PATH: path, SB_EXTRA_LINK: link, SB_EXTRA_CFLAGS: cflags };
+  const env = { ...process.env, PATH: path, SB_EXTRA_LINK: link, SB_EXTRA_CFLAGS: cflags };
+  if (compiler) return { ...env, CC: compiler.cc.join(" "), CXX: compiler.cxx.join(" ") };
+  return env;
 }
 
 /**
@@ -130,6 +139,7 @@ export function porfforArgs(
   outPath: string,
   target: CompileInput["target"],
   optimize: CompileInput["optimize"],
+  usingZig = false,
 ): string[] {
   const args = ["native", generatedPath, "-o", outPath];
   if (target !== "host") args.push("--musl");
@@ -138,6 +148,10 @@ export function porfforArgs(
   // three times faster to compile, so dev takes it and everything else does
   // not: a deployable artifact is never built with it.
   if (optimize === "dev" && target === "host") args.push("-O0");
+  // Porffor defaults LTO on for a non-musl link. Zig's cc needs `-fuse-ld=lld`
+  // wired up for that, which nothing here does, so turn it off rather than
+  // fail every host build that falls back to Zig for its C toolchain.
+  if (usingZig) args.push("--no-flto");
   return args;
 }
 
@@ -199,8 +213,11 @@ export async function compileSprout(input: CompileInput): Promise<void> {
   );
 
   const launcher = resolve(porffor, "runtime/index.js");
-  // A host build never shells `zig`, so it has no zigBin to contribute.
+  // A musl build shells `zig` bare (Porffor hardcodes the literal command), so
+  // it needs its dir on PATH; a host build passes its compiler via CC/CXX
+  // below instead and has no zigBin to contribute here.
   const zigDir = input.zigBin ? `${dirname(input.zigBin)}:` : "";
+  const hostCompiler = input.target === "host" ? await resolveHostCompiler() : undefined;
   // The per-platform binary ships esbuild next to it; a compiled build finds it
   // there. Running from the npm package under Bun, `process.execPath` is Bun
   // itself and `npm i -g` puts no dependency `.bin` on PATH, so resolve the
@@ -221,12 +238,15 @@ export async function compileSprout(input: CompileInput): Promise<void> {
     ? [process.execPath, "__porffor", launcher]
     : [process.execPath, resolve(import.meta.dir, "main.ts"), "__porffor", launcher];
 
-  const child = Bun.spawn([...command, ...porfforArgs(generatedPath, input.outPath, input.target, input.optimize)], {
-    cwd: outDir,
-    stdout: "pipe",
-    stderr: "pipe",
-    env: compileEnv(path, input.extraLink, input.extraCflags),
-  });
+  const child = Bun.spawn(
+    [...command, ...porfforArgs(generatedPath, input.outPath, input.target, input.optimize, hostCompiler?.usingZig)],
+    {
+      cwd: outDir,
+      stdout: "pipe",
+      stderr: "pipe",
+      env: compileEnv(path, input.extraLink, input.extraCflags, hostCompiler),
+    },
+  );
   let timedOut = false;
   const timer = setTimeout(() => {
     timedOut = true;

package/src/main.ts

@@ -19,6 +19,7 @@ import { notifyIfOutdated } from "./update-check";
 import { controlVersionWarning } from "./api-version";
 import { amber, bold, dim, leaf, ok, rose } from "./style";
 import { pathToFileURL } from "node:url";
+import { inspectToolchain } from "./toolchain";
 
 // A compiled Bun executable is not a general-purpose `bun` command. Porffor
 // is acquired after installation, so run its external ESM launcher through an
@@ -1194,6 +1195,42 @@ function usage(): never {
   process.exit(2);
 }
 
+async function toolchain(args: string[]): Promise<void> {
+  if (args[0] !== "doctor" || args.slice(1).some((arg) => arg !== "--json"))
+    usageError("expected toolchain doctor", "toolchain doctor [--json]");
+  const report = inspectToolchain();
+  if (args.includes("--json")) {
+    console.log(JSON.stringify(report, null, 2));
+    return;
+  }
+  console.log(`host: ${report.host}`);
+  console.log(`cache: ${report.cacheRoot}`);
+  console.log(`Porffor: ${report.porffor.version} (${report.porffor.present ? "ready" : "acquired on first build"})`);
+  console.log(`  ${report.porffor.path}${report.porffor.override ? " (override)" : ""}`);
+  console.log(`Zig: ${report.zig.version} (${report.zig.platform ?? "unsupported host"})`);
+  console.log(`  ${report.zig.path ?? "set SPROUTBOAT_ZIG to a supported Zig binary"}`);
+  console.log(
+    `  ${report.zig.present ? "ready" : "acquired on first deployment build"}${report.zig.override ? " (override)" : ""}`,
+  );
+  console.log(
+    `SQLite: ${report.sqlite.version} (${report.sqlite.present ? "cached" : "acquired for standalone builds"})`,
+  );
+  console.log(`  ${report.sqlite.path}`);
+  console.log(
+    `BearSSL: ${report.bearssl.version} (${report.bearssl.present ? "cached" : "acquired for standalone builds"})`,
+  );
+  console.log(`  ${report.bearssl.path}`);
+  console.log(
+    `host compiler: ${report.prerequisites.cc ?? "missing: install Xcode Command Line Tools or a C compiler"}`,
+  );
+  console.log(`archiver: ${report.prerequisites.ar ?? "missing: install an archiver"}`);
+  console.log(`archive extractor: ${report.prerequisites.tar ?? "missing: install tar with xz support"}`);
+  if (process.platform === "darwin")
+    console.log(`macOS SDK tools: ${report.prerequisites.xcrun ?? "missing: run xcode-select --install"}`);
+  if (process.platform === "darwin")
+    console.log(`macOS SDK: ${report.prerequisites.sdk ?? "missing: run xcode-select --install"}`);
+}
+
 const [command, ...args] = process.argv.slice(2);
 if (command === undefined || command === "help" || command === "-h" || command === "--help") help();
 if (command === "--version" || command === "-v") {
@@ -1223,6 +1260,9 @@ switch (command) {
     else await build(directory, hostBuild ? "host" : "linux-x86_64");
     break;
   }
+  case "toolchain":
+    await toolchain(args);
+    break;
   case "login":
     await login(args);
     break;