sproutboat 0.11.11 → 0.11.12

package/CHANGELOG.md

@@ -8,6 +8,21 @@ a breaking change.
 Reconstructed from git history on 2026-09-03 for everything through v0.4.11;
 maintained going forward by the `release` skill.
 
+## [0.11.12] - 2026-09-24
+
+### Changed
+- Porffor alpha 9 handles ESM modules without the external esbuild executable.
+  The CLI now requires `@sproutboat/toolchain@^0.4.12`, runtime `^0.12.1`,
+  and wire `^0.9.1`.
+  Removed the CLI's esbuild dependency, platform binary copies, and compile-time
+  PATH lookup. Handler validation and shimming still use Bun's built-in bundler.
+  The required `esbuildVersion` manifest field remains for older artifact
+  readers and now records `unused`.
+- Local `dev` rebuilds keep a stable generated entry path for each process, so
+  Porffor alpha 9 can reuse unchanged compiled C units. In a local `hello`
+  handler-edit comparison, compilation took 549 ms with the stable path versus
+  1,505 ms with changing paths. Candidate binaries remain isolated.
+
 ## [0.11.11] - 2026-09-24
 ### Fixed
 - Updated the native runtime to `0.12.0` so repeated HMAC signing uses the raw
@@ -15,7 +30,6 @@ maintained going forward by the `release` skill.
 - Updated the toolchain to `0.4.11` so `Uint8Array.from({ length: 16 }, mapFn)`
   produces the intended key bytes in standalone native builds.
 - Added the two-round HMAC vector to broker and standalone conformance checks.
-
 ## [0.11.10] - 2026-09-18
 ### Changed
 - Bumped `@sproutboat/toolchain` to `0.4.10`, pinning Porffor to the
@@ -596,7 +610,8 @@ its own package.
 - Renamed the package to `sproutboat` (was `@sproutboat/cli`); dropped the
   `sprout` bin alias in favour of a user-defined shell alias.
 
-[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.11...HEAD
+[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.12...HEAD
+[0.11.12]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.11...v0.11.12
 [0.11.11]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.10...v0.11.11
 [0.11.10]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.9...v0.11.10
 [0.11.9]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.8...v0.11.9

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.11.11 · runs on Bun (use `bunx`, not `npx`)
+**Package:** `sproutboat` 0.11.12 · runs on Bun (use `bunx`, not `npx`)
 
 ## Commands
 
@@ -76,7 +76,7 @@ usage: sproutboat <init [name] | check [project-dir] | types [project-dir] | dev
 | | |
 | --- | --- |
 | Zig | `0.16.0` (`zig cc -target x86_64-linux-musl`, static) |
-| Provenance stamp | `zig-musl/0.16.0+porffor/8f01541+uws/360c276d` |
+| Provenance stamp | `zig-musl/0.16.0+porffor/de4eb58+uws/360c276d` |
 | Artifact schema | `2` |
 | Runtime | `native-fetch` |
 | Capability profile | `http-sync-v0` |

package/THIRD_PARTY_NOTICES.md

@@ -6,10 +6,9 @@ to its upstream source.
 
 | Component | Version or revision | Distribution role | License | Source |
 | --- | --- | --- | --- | --- |
-| Porffor | `a415d194e74948f0ac32b9d608153ea8720c71fd` | Acquired on first application build | MIT | https://github.com/CanadaHonk/porffor |
+| Porffor | `de4eb588264885b3a1596f75010e371a2052033f` | Acquired on first application build | MIT | https://github.com/CanadaHonk/porffor |
 | Zig | `0.16.0` | Acquired cross-compiler | MIT | https://ziglang.org |
 | uWebSockets and uSockets | `360c276d609d59af56ae6932adb95154ace9f15f` | Embedded source and static archive | Apache-2.0 | https://github.com/uNetworking/uWebSockets |
-| esbuild | `0.28.2` | Embedded platform executable | MIT | https://esbuild.github.io |
 | SQLite | `3.50.4` | Acquired for standalone builds | Public domain | https://sqlite.org |
 | BearSSL | `0.6` | Acquired for standalone builds | MIT | https://bearssl.org |
 
@@ -17,7 +16,7 @@ to its upstream source.
 
 | Component | SHA-256 |
 | --- | --- |
-| Porffor source archive | `677779c8be49efc28686378f665cd6fc4a8a2dd81e7b15a89298103ded960829` |
+| Porffor source archive | `1a62187a93356b36cb6ac703ce9770c8917e4fa65545fd7c33ee8a180ae5a4c9` |
 | Embedded uWebSockets archive | `e83736f3f8cf9d56a1ebe6ea61625a7af12386763374d47c14cff472ada7484a` |
 | SQLite amalgamation archive | `1d3049dd0f830a025a53105fc79fd2ab9431aea99e137809d064d8ee8356b032` |
 | BearSSL source archive | `6705bba1714961b41a728dfc5debbe348d2966c117649392f8c8139efc83ff14` |
@@ -25,5 +24,4 @@ to its upstream source.
 
 The complete Apache-2.0 notice for uWebSockets and uSockets is retained in the
 embedded source archive. Porffor and BearSSL retain their MIT notices in the
-source archives acquired at the revisions above. esbuild's MIT notice is
-available from its upstream distribution.
+source archives acquired at the revisions above.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.11.11",
+  "version": "0.11.12",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -64,10 +64,9 @@
     "@sproutboat/artifact": "^0.2.0",
     "@sproutboat/assets": "^0.3.0",
     "@sproutboat/config": "^0.4.0",
-    "@sproutboat/runtime": "^0.12.0",
-    "@sproutboat/toolchain": "^0.4.11",
-    "@sproutboat/wire": "^0.9.0",
-    "esbuild": "^0.28.2"
+    "@sproutboat/runtime": "^0.12.1",
+    "@sproutboat/toolchain": "^0.4.12",
+    "@sproutboat/wire": "^0.9.1"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.81.0",
@@ -78,10 +77,10 @@
     "typescript": "7.0.2"
   },
   "optionalDependencies": {
-    "@sproutboat/cli-darwin-arm64": "0.11.11",
-    "@sproutboat/cli-darwin-x64": "0.11.11",
-    "@sproutboat/cli-linux-arm64": "0.11.11",
-    "@sproutboat/cli-linux-x64": "0.11.11"
+    "@sproutboat/cli-darwin-arm64": "0.11.12",
+    "@sproutboat/cli-darwin-x64": "0.11.12",
+    "@sproutboat/cli-linux-arm64": "0.11.12",
+    "@sproutboat/cli-linux-x64": "0.11.12"
   },
   "engines": {
     "node": ">=18"

package/scripts/build-cli.ts

@@ -15,7 +15,7 @@
  * GitHub's only x64 macOS image (`macos-13`) routinely sits queued for half an
  * hour while every other leg finishes in one minute.
  */
-import { chmod, copyFile, mkdir } from "node:fs/promises";
+import { chmod, copyFile, mkdir, rm } from "node:fs/promises";
 import { resolve } from "node:path";
 import { ensureZigArchive, type ZigPlatform } from "../src/toolchain";
 
@@ -39,49 +39,11 @@ function hostTarget(): Target {
 
 const root = resolve(import.meta.dir, "..");
 
-/** esbuild ships one binary per platform (`@esbuild/<os>-<arch>`); a cross
- * target's copy is never installed locally (npm/bun refuse it — the package
- * declares `os`/`cpu` and gets skipped for any other host), so fetch that
- * platform's tarball from the registry instead, same shape as ensureZig's
- * prebuilt-archive fetches. */
-async function esbuildBinaryFor(target: Target): Promise<string> {
-  const host = hostTarget();
-  if (target.platform === host.platform && target.arch === host.arch) {
-    try {
-      return Bun.resolveSync(`@esbuild/${target.platform}-${target.arch}/bin/esbuild`, import.meta.dir);
-    } catch {
-      throw new Error("host esbuild binary is missing; run bun install first");
-    }
-  }
-  // SAFETY: package.json is this repo's own manifest, with a required esbuild dependency entry.
-  const pkg = (await Bun.file(resolve(root, "package.json")).json()) as { dependencies: { esbuild: string } };
-  const version = pkg.dependencies.esbuild.replace(/^[\^~]/, "");
-  const name = `${target.platform}-${target.arch}`;
-  const cacheDir = resolve(
-    process.env.SPROUTBOAT_TOOLCHAIN_CACHE ?? `${process.env.HOME}/.cache/sproutboat`,
-    `esbuild-${version}-${name}`,
-  );
-  const cached = resolve(cacheDir, "esbuild");
-  if (await Bun.file(cached).exists()) return cached;
-  const res = await fetch(`https://registry.npmjs.org/@esbuild/${name}/-/${name}-${version}.tgz`);
-  if (!res.ok) throw new Error(`could not fetch @esbuild/${name}@${version}: HTTP ${res.status}`);
-  const tarPath = resolve(cacheDir, "esbuild.tgz");
-  await mkdir(cacheDir, { recursive: true });
-  await Bun.write(tarPath, await res.arrayBuffer());
-  const untar = Bun.spawn(["tar", "-xzf", tarPath, "-C", cacheDir, "--strip-components=2", "package/bin/esbuild"], {
-    stdout: "pipe",
-    stderr: "pipe",
-  });
-  const [code, err] = await Promise.all([untar.exited, new Response(untar.stderr).text()]);
-  if (code !== 0) throw new Error(`could not extract @esbuild/${name}: ${err.trim()}`);
-  await chmod(cached, 0o755);
-  return cached;
-}
-
 async function buildOne(target: Target): Promise<void> {
   const packageDir = resolve(root, "platform-packages", `${target.platform}-${target.arch}`);
   const out = resolve(packageDir, "bin", "sproutboat");
   await mkdir(resolve(out, ".."), { recursive: true });
+  await rm(resolve(packageDir, "bin", "esbuild"), { force: true });
   // SAFETY: package.json is this release's manifest and npm requires its version.
   const version = ((await Bun.file(resolve(root, "package.json")).json()) as { version: string }).version;
   // SAFETY: every checked-in platform package manifest owns a required string version.
@@ -103,9 +65,6 @@ async function buildOne(target: Target): Promise<void> {
     { cwd: root, stdout: "inherit", stderr: "inherit" },
   );
   if ((await child.exited) !== 0) throw new Error(`compile failed for ${target.platform}-${target.arch}`);
-  const esbuild = await esbuildBinaryFor(target);
-  const packagedEsbuild = resolve(packageDir, "bin", "esbuild");
-  await copyFile(esbuild, packagedEsbuild);
   // The compressed archive (~50 MB), not the ~400 MB extracted install: Zig's
   // lib/ carries libc/libc++ sources for every target it can cross-compile to,
   // which only matters once, on extract. `ensureZig` (src/toolchain.ts) looks
@@ -114,7 +73,6 @@ async function buildOne(target: Target): Promise<void> {
   // same shape as the vendored uWebSockets archive.
   await copyFile(await ensureZigArchive(target.zigPlatform), resolve(packageDir, "bin", "zig.tar.xz"));
   await copyFile(resolve(root, "THIRD_PARTY_NOTICES.md"), resolve(packageDir, "THIRD_PARTY_NOTICES.md"));
-  await chmod(packagedEsbuild, 0o755);
   await chmod(out, 0o755);
 }
 

package/src/build.ts

@@ -47,6 +47,8 @@ export type BuildInput = {
   reuseSproutPath?: string;
   /** An isolated artifact directory, used by dev candidates to avoid mixing snapshots. */
   outputDirectory?: string;
+  /** Stable compiler input used only by the local dev loop. */
+  generatedPath?: string;
 };
 
 export type BuildOutput = {
@@ -182,6 +184,7 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
   else
     await compileSprout({
       sourcePath: input.sourcePath,
+      generatedPath: input.generatedPath,
       source: input.source,
       outPath: sproutPath,
       vars: input.config.vars ?? {},

package/src/bundle.ts

@@ -1,9 +1,9 @@
 /**
  * #89 — bundle the handler before Porffor sees it.
  *
- * Porffor compiles one self-contained module, so until now a project was one
- * file with no imports: no router, no validation library, no SDK, no splitting
- * a codebase in two. Bundling first lifts that without touching the compiler.
+ * Porffor alpha 9 supports ESM imports. We still bundle first so capability
+ * validation sees every dependency and the runtime wrapper receives one
+ * controlled default export.
  *
  * Bun's bundler resolves relative imports across the project and bare
  * specifiers out of the project's own `node_modules`, then emits a single ESM

package/src/compile.ts

@@ -10,7 +10,6 @@
  * unusable it stops with its specific integrity or archive error. Contributors
  * may explicitly opt into Porffor's source fallback.
  */
-import { existsSync } from "node:fs";
 import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import { ensurePorfforPatched } from "./patch-porffor";
@@ -50,6 +49,8 @@ const COMPILE_TIMEOUT_MS = Number(process.env.SPROUTBOAT_COMPILE_TIMEOUT_MS || 6
 
 export type CompileInput = {
   sourcePath: string;
+  /** Stable compiler input for dev rebuilds, independent of the candidate binary path. */
+  generatedPath?: string;
   /** The bundled module (#89). Falls back to reading `sourcePath` verbatim. */
   source?: string;
   outPath: string;
@@ -195,7 +196,8 @@ export async function compileSprout(input: CompileInput): Promise<void> {
   // OS may still be executing. The linker cannot overwrite either, so clear it
   // first rather than failing with "can't write output file".
   await rm(input.outPath, { force: true });
-  const generatedPath = resolve(outDir, "sprout.generated.js");
+  const generatedPath = input.generatedPath ?? resolve(outDir, "sprout.generated.js");
+  await mkdir(dirname(generatedPath), { recursive: true });
   const [source, prelude] = await Promise.all([
     input.source === undefined ? readFile(input.sourcePath, "utf8") : Promise.resolve(input.source),
     loadPrelude(input.transport ?? "broker"),
@@ -222,22 +224,7 @@ export async function compileSprout(input: CompileInput): Promise<void> {
   // below instead and has no zigBin to contribute here.
   const zigDir = input.zigBin ? `${dirname(input.zigBin)}:` : "";
   const hostCompiler = input.target === "host" ? await resolveHostCompiler() : undefined;
-  // The per-platform binary ships esbuild next to it; a compiled build finds it
-  // there. Running from the npm package under Bun, `process.execPath` is Bun
-  // itself and `npm i -g` puts no dependency `.bin` on PATH, so resolve the
-  // esbuild dependency directly. `Bun.which` is the last resort.
-  const packagedEsbuild = resolve(dirname(process.execPath), "esbuild");
-  let esbuild: string | null = existsSync(packagedEsbuild) ? packagedEsbuild : null;
-  if (!esbuild) {
-    try {
-      esbuild = Bun.resolveSync("esbuild/bin/esbuild", import.meta.dir);
-    } catch {
-      esbuild = null;
-    }
-  }
-  esbuild ??= Bun.which("esbuild");
-  if (!esbuild) throw new Error("esbuild could not be located; install it or reinstall sproutboat");
-  const path = `${zigDir}${dirname(esbuild)}:${process.env.PATH ?? ""}`;
+  const path = `${zigDir}${process.env.PATH ?? ""}`;
   const command = PACKAGED
     ? [process.execPath, "__porffor", launcher]
     : [process.execPath, resolve(import.meta.dir, "main.ts"), "__porffor", launcher];

package/src/dev.ts

@@ -11,6 +11,7 @@
  * project, one port.
  */
 import { existsSync, watch, type FSWatcher } from "node:fs";
+import { randomUUID } from "node:crypto";
 import { mkdir, readFile, rm } from "node:fs/promises";
 import { connect } from "node:net";
 import { dirname, resolve } from "node:path";
@@ -21,6 +22,7 @@ import { amber, dim, leaf, ok } from "./style";
 import type { SproutboatConfig } from "./config";
 
 const RESTART_DEBOUNCE_MS = 120;
+const DEV_COMPILE_SESSION = randomUUID();
 
 export type DevInput = {
   projectDir: string;
@@ -121,6 +123,14 @@ async function start(input: DevInput, port: number): Promise<Running> {
       optimize: "dev",
       reuseSproutPath: input.reuseSproutPath,
       outputDirectory: candidateDir,
+      // Alpha 9 keys its C-unit cache by the entry's absolute path. Keep that
+      // path fixed across saves while each candidate keeps its own binary.
+      generatedPath: resolve(
+        input.projectDir,
+        ".sproutboat/dev-compile",
+        `${process.pid}-${DEV_COMPILE_SESSION}`,
+        "sprout.generated.js",
+      ),
     });
   } catch (error) {
     await rm(candidateDir, { recursive: true, force: true });

package/src/toolchain.ts

@@ -677,14 +677,9 @@ export function porfforVersion(): string {
 }
 
 export function esbuildVersion(): string {
-  try {
-    const pkg = Bun.resolveSync("esbuild/package.json", import.meta.dir);
-    // SAFETY: esbuild's package.json always has a string `version`; defaulted below.
-    const parsed = JSON.parse(readFileSync(pkg, "utf8")) as { version?: string };
-    return parsed.version || "unknown";
-  } catch {
-    return "unknown";
-  }
+  // Legacy artifact field, retained so older control planes can read manifests.
+  // Handler bundling uses Bun.build and Porffor alpha 9 needs no esbuild binary.
+  return "unused";
 }
 
 function uwsCommit(): string {