sproutboat 0.11.11 → 0.11.13

package/CHANGELOG.md

@@ -8,6 +8,38 @@ a breaking change.
 Reconstructed from git history on 2026-09-03 for everything through v0.4.11;
 maintained going forward by the `release` skill.
 
+## Unreleased
+
+## [0.11.13] - 2026-09-26
+
+### Added
+- Record compile duration in the artifact manifest so the platform can show it per deployment.
+- Support selected `node:path`, `node:url`, and `node:querystring` APIs in handlers.
+
+### Changed
+- Reuse checksum-verified native binaries for identical release builds and
+  refresh broker asset sidecars without recompiling the handler.
+- Report native compilation time and binary cache status after `build`.
+- Reject unsupported service bindings before starting a standalone build.
+- Fetch the pinned Mozilla CA bundle from curl's dated archive so new upstream
+  revisions do not break fresh standalone builds.
+- Update the pinned toolchain to `0.4.13` and the artifact contract to `0.3.0`.
+
+## [0.11.12] - 2026-09-24
+
+### Changed
+- Porffor alpha 9 handles ESM modules without the external esbuild executable.
+  The CLI now requires `@sproutboat/toolchain@^0.4.12`, runtime `^0.12.1`,
+  and wire `^0.9.1`.
+  Removed the CLI's esbuild dependency, platform binary copies, and compile-time
+  PATH lookup. Handler validation and shimming still use Bun's built-in bundler.
+  The required `esbuildVersion` manifest field remains for older artifact
+  readers and now records `unused`.
+- Local `dev` rebuilds keep a stable generated entry path for each process, so
+  Porffor alpha 9 can reuse unchanged compiled C units. In a local `hello`
+  handler-edit comparison, compilation took 549 ms with the stable path versus
+  1,505 ms with changing paths. Candidate binaries remain isolated.
+
 ## [0.11.11] - 2026-09-24
 ### Fixed
 - Updated the native runtime to `0.12.0` so repeated HMAC signing uses the raw
@@ -15,7 +47,6 @@ maintained going forward by the `release` skill.
 - Updated the toolchain to `0.4.11` so `Uint8Array.from({ length: 16 }, mapFn)`
   produces the intended key bytes in standalone native builds.
 - Added the two-round HMAC vector to broker and standalone conformance checks.
-
 ## [0.11.10] - 2026-09-18
 ### Changed
 - Bumped `@sproutboat/toolchain` to `0.4.10`, pinning Porffor to the
@@ -596,7 +627,9 @@ its own package.
 - Renamed the package to `sproutboat` (was `@sproutboat/cli`); dropped the
   `sprout` bin alias in favour of a user-defined shell alias.
 
-[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.11...HEAD
+[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.13...HEAD
+[0.11.13]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.12...v0.11.13
+[0.11.12]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.11...v0.11.12
 [0.11.11]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.10...v0.11.11
 [0.11.10]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.9...v0.11.10
 [0.11.9]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.8...v0.11.9

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.11.11 · runs on Bun (use `bunx`, not `npx`)
+**Package:** `sproutboat` 0.11.13 · runs on Bun (use `bunx`, not `npx`)
 
 ## Commands
 
@@ -76,7 +76,7 @@ usage: sproutboat <init [name] | check [project-dir] | types [project-dir] | dev
 | | |
 | --- | --- |
 | Zig | `0.16.0` (`zig cc -target x86_64-linux-musl`, static) |
-| Provenance stamp | `zig-musl/0.16.0+porffor/8f01541+uws/360c276d` |
+| Provenance stamp | `zig-musl/0.16.0+porffor/de4eb58+uws/360c276d` |
 | Artifact schema | `2` |
 | Runtime | `native-fetch` |
 | Capability profile | `http-sync-v0` |

package/THIRD_PARTY_NOTICES.md

@@ -6,10 +6,9 @@ to its upstream source.
 
 | Component | Version or revision | Distribution role | License | Source |
 | --- | --- | --- | --- | --- |
-| Porffor | `a415d194e74948f0ac32b9d608153ea8720c71fd` | Acquired on first application build | MIT | https://github.com/CanadaHonk/porffor |
+| Porffor | `de4eb588264885b3a1596f75010e371a2052033f` | Acquired on first application build | MIT | https://github.com/CanadaHonk/porffor |
 | Zig | `0.16.0` | Acquired cross-compiler | MIT | https://ziglang.org |
 | uWebSockets and uSockets | `360c276d609d59af56ae6932adb95154ace9f15f` | Embedded source and static archive | Apache-2.0 | https://github.com/uNetworking/uWebSockets |
-| esbuild | `0.28.2` | Embedded platform executable | MIT | https://esbuild.github.io |
 | SQLite | `3.50.4` | Acquired for standalone builds | Public domain | https://sqlite.org |
 | BearSSL | `0.6` | Acquired for standalone builds | MIT | https://bearssl.org |
 
@@ -17,7 +16,7 @@ to its upstream source.
 
 | Component | SHA-256 |
 | --- | --- |
-| Porffor source archive | `677779c8be49efc28686378f665cd6fc4a8a2dd81e7b15a89298103ded960829` |
+| Porffor source archive | `1a62187a93356b36cb6ac703ce9770c8917e4fa65545fd7c33ee8a180ae5a4c9` |
 | Embedded uWebSockets archive | `e83736f3f8cf9d56a1ebe6ea61625a7af12386763374d47c14cff472ada7484a` |
 | SQLite amalgamation archive | `1d3049dd0f830a025a53105fc79fd2ab9431aea99e137809d064d8ee8356b032` |
 | BearSSL source archive | `6705bba1714961b41a728dfc5debbe348d2966c117649392f8c8139efc83ff14` |
@@ -25,5 +24,4 @@ to its upstream source.
 
 The complete Apache-2.0 notice for uWebSockets and uSockets is retained in the
 embedded source archive. Porffor and BearSSL retain their MIT notices in the
-source archives acquired at the revisions above. esbuild's MIT notice is
-available from its upstream distribution.
+source archives acquired at the revisions above.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.11.11",
+  "version": "0.11.13",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -61,13 +61,12 @@
     "kitchen-sink:standalone": "bun examples/kitchen-sink/harness-standalone.ts"
   },
   "dependencies": {
-    "@sproutboat/artifact": "^0.2.0",
+    "@sproutboat/artifact": "^0.3.0",
     "@sproutboat/assets": "^0.3.0",
     "@sproutboat/config": "^0.4.0",
-    "@sproutboat/runtime": "^0.12.0",
-    "@sproutboat/toolchain": "^0.4.11",
-    "@sproutboat/wire": "^0.9.0",
-    "esbuild": "^0.28.2"
+    "@sproutboat/runtime": "^0.12.1",
+    "@sproutboat/toolchain": "^0.4.13",
+    "@sproutboat/wire": "^0.9.1"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.81.0",
@@ -78,10 +77,10 @@
     "typescript": "7.0.2"
   },
   "optionalDependencies": {
-    "@sproutboat/cli-darwin-arm64": "0.11.11",
-    "@sproutboat/cli-darwin-x64": "0.11.11",
-    "@sproutboat/cli-linux-arm64": "0.11.11",
-    "@sproutboat/cli-linux-x64": "0.11.11"
+    "@sproutboat/cli-darwin-arm64": "0.11.13",
+    "@sproutboat/cli-darwin-x64": "0.11.13",
+    "@sproutboat/cli-linux-arm64": "0.11.13",
+    "@sproutboat/cli-linux-x64": "0.11.13"
   },
   "engines": {
     "node": ">=18"

package/scripts/build-cli.ts

@@ -15,7 +15,7 @@
  * GitHub's only x64 macOS image (`macos-13`) routinely sits queued for half an
  * hour while every other leg finishes in one minute.
  */
-import { chmod, copyFile, mkdir } from "node:fs/promises";
+import { chmod, copyFile, mkdir, rm } from "node:fs/promises";
 import { resolve } from "node:path";
 import { ensureZigArchive, type ZigPlatform } from "../src/toolchain";
 
@@ -39,49 +39,11 @@ function hostTarget(): Target {
 
 const root = resolve(import.meta.dir, "..");
 
-/** esbuild ships one binary per platform (`@esbuild/<os>-<arch>`); a cross
- * target's copy is never installed locally (npm/bun refuse it — the package
- * declares `os`/`cpu` and gets skipped for any other host), so fetch that
- * platform's tarball from the registry instead, same shape as ensureZig's
- * prebuilt-archive fetches. */
-async function esbuildBinaryFor(target: Target): Promise<string> {
-  const host = hostTarget();
-  if (target.platform === host.platform && target.arch === host.arch) {
-    try {
-      return Bun.resolveSync(`@esbuild/${target.platform}-${target.arch}/bin/esbuild`, import.meta.dir);
-    } catch {
-      throw new Error("host esbuild binary is missing; run bun install first");
-    }
-  }
-  // SAFETY: package.json is this repo's own manifest, with a required esbuild dependency entry.
-  const pkg = (await Bun.file(resolve(root, "package.json")).json()) as { dependencies: { esbuild: string } };
-  const version = pkg.dependencies.esbuild.replace(/^[\^~]/, "");
-  const name = `${target.platform}-${target.arch}`;
-  const cacheDir = resolve(
-    process.env.SPROUTBOAT_TOOLCHAIN_CACHE ?? `${process.env.HOME}/.cache/sproutboat`,
-    `esbuild-${version}-${name}`,
-  );
-  const cached = resolve(cacheDir, "esbuild");
-  if (await Bun.file(cached).exists()) return cached;
-  const res = await fetch(`https://registry.npmjs.org/@esbuild/${name}/-/${name}-${version}.tgz`);
-  if (!res.ok) throw new Error(`could not fetch @esbuild/${name}@${version}: HTTP ${res.status}`);
-  const tarPath = resolve(cacheDir, "esbuild.tgz");
-  await mkdir(cacheDir, { recursive: true });
-  await Bun.write(tarPath, await res.arrayBuffer());
-  const untar = Bun.spawn(["tar", "-xzf", tarPath, "-C", cacheDir, "--strip-components=2", "package/bin/esbuild"], {
-    stdout: "pipe",
-    stderr: "pipe",
-  });
-  const [code, err] = await Promise.all([untar.exited, new Response(untar.stderr).text()]);
-  if (code !== 0) throw new Error(`could not extract @esbuild/${name}: ${err.trim()}`);
-  await chmod(cached, 0o755);
-  return cached;
-}
-
 async function buildOne(target: Target): Promise<void> {
   const packageDir = resolve(root, "platform-packages", `${target.platform}-${target.arch}`);
   const out = resolve(packageDir, "bin", "sproutboat");
   await mkdir(resolve(out, ".."), { recursive: true });
+  await rm(resolve(packageDir, "bin", "esbuild"), { force: true });
   // SAFETY: package.json is this release's manifest and npm requires its version.
   const version = ((await Bun.file(resolve(root, "package.json")).json()) as { version: string }).version;
   // SAFETY: every checked-in platform package manifest owns a required string version.
@@ -103,9 +65,6 @@ async function buildOne(target: Target): Promise<void> {
     { cwd: root, stdout: "inherit", stderr: "inherit" },
   );
   if ((await child.exited) !== 0) throw new Error(`compile failed for ${target.platform}-${target.arch}`);
-  const esbuild = await esbuildBinaryFor(target);
-  const packagedEsbuild = resolve(packageDir, "bin", "esbuild");
-  await copyFile(esbuild, packagedEsbuild);
   // The compressed archive (~50 MB), not the ~400 MB extracted install: Zig's
   // lib/ carries libc/libc++ sources for every target it can cross-compile to,
   // which only matters once, on extract. `ensureZig` (src/toolchain.ts) looks
@@ -114,7 +73,6 @@ async function buildOne(target: Target): Promise<void> {
   // same shape as the vendored uWebSockets archive.
   await copyFile(await ensureZigArchive(target.zigPlatform), resolve(packageDir, "bin", "zig.tar.xz"));
   await copyFile(resolve(root, "THIRD_PARTY_NOTICES.md"), resolve(packageDir, "THIRD_PARTY_NOTICES.md"));
-  await chmod(packagedEsbuild, 0o755);
   await chmod(out, 0o755);
 }
 

package/src/bearssl.ts

@@ -34,7 +34,8 @@ const BEARSSL_SHA256 = "6705bba1714961b41a728dfc5debbe348d2966c117649392f8c8139e
  * release is unknown until the next one. Fine while releases are frequent;
  * revisit if a user is ever stuck on an old CLI for months.
  */
-const CACERT_URL = "https://curl.se/ca/cacert.pem";
+// Use the dated archive so its bytes stay equal to the pinned digest.
+const CACERT_URL = "https://curl.se/ca/cacert-2026-08-13.pem";
 const CACERT_SHA256 = "f66dff1bdf8f96060b8177976f8b7d9254bc89bc4db933d769f7384d28480bc9";
 
 const cacheDir = (): string =>

package/src/build.ts

@@ -1,12 +1,13 @@
-import { createHash } from "node:crypto";
-import { cp, mkdir, readFile, stat, writeFile } from "node:fs/promises";
-import { resolve } from "node:path";
+import { createHash, randomUUID } from "node:crypto";
+import { cp, mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
 import { walkAssets, type AssetManifest } from "./assets";
 import { resourceRefs, type SproutboatConfig } from "./config";
 import { ensureSqliteObject } from "./sqlite";
 import { sqliteStamp } from "./sqlite";
 import { bearsslStamp, ensureBearssl } from "./bearssl";
-import { compileSprout, type Transport } from "./compile";
+import { compileSprout, loadPrelude, type Transport } from "./compile";
+import { compileCached } from "./compile-cache";
 import {
   ARTIFACT_SCHEMA_VERSION,
   CAPABILITY_PROFILE,
@@ -16,6 +17,10 @@ import {
   type ArtifactManifest,
 } from "./manifest";
 import { ensureZig, esbuildVersion, porfforVersion, toolchainStamp } from "./toolchain";
+import { PORFFOR_ARCHIVE_SHA256, PORFFOR_COMMIT_FULL } from "./porffor-toolchain";
+import { version as toolchainPackageVersion } from "@sproutboat/toolchain/package.json" with { type: "json" };
+import { version as cliVersion } from "../package.json" with { type: "json" };
+import { wrapNativeFetchHandler } from "./wrap";
 
 export type BuildInput = {
   projectDir: string;
@@ -47,11 +52,15 @@ export type BuildInput = {
   reuseSproutPath?: string;
   /** An isolated artifact directory, used by dev candidates to avoid mixing snapshots. */
   outputDirectory?: string;
+  /** Stable compiler input used only by the local dev loop. */
+  generatedPath?: string;
 };
 
 export type BuildOutput = {
   artifactDir: string;
   manifest: ArtifactManifest;
+  compileCache: "hit" | "miss" | "bypass";
+  compileMs: number;
 };
 
 /** Baking megabytes of assets into the module makes the Porffor compile crawl;
@@ -62,6 +71,39 @@ function digest(value: Uint8Array | string): `sha256:${string}` {
   return `sha256:${createHash("sha256").update(value).digest("hex")}`;
 }
 
+async function integrationIdentity(): Promise<string> {
+  // A published CLI has immutable bundled integration code and a release
+  // version. Source checkouts also hash their live files, so local edits never
+  // accidentally reuse a binary compiled by an earlier checkout state.
+  if (import.meta.url.includes("/$bunfs/")) {
+    const executable = await stat(process.execPath);
+    return `release:${cliVersion}:${executable.size}:${executable.mtimeMs}`;
+  }
+  const files = ["build.ts", "compile.ts", "sqlite.ts", "bearssl.ts", "toolchain.ts"].map((file) =>
+    resolve(import.meta.dir, file),
+  );
+  files.push(Bun.resolveSync("@sproutboat/toolchain/patch", import.meta.dir));
+  return digest(Buffer.concat(await Promise.all(files.map((file) => readFile(file)))));
+}
+
+async function acquireArtifactLock(artifactDir: string): Promise<string> {
+  const lock = `${artifactDir}.lock`;
+  await mkdir(dirname(lock), { recursive: true });
+  const deadline = Date.now() + 12 * 60_000;
+  while (true) {
+    try {
+      await mkdir(lock);
+      return lock;
+    } catch (error) {
+      if (!(error instanceof Error && "code" in error && error.code === "EEXIST")) throw error;
+      if (Date.now() > deadline) throw new Error(`timed out waiting for artifact lock ${lock}`);
+      const info = await stat(lock).catch(() => null);
+      if (info && Date.now() - info.mtimeMs > 15 * 60_000) await rm(lock, { recursive: true, force: true });
+      else await Bun.sleep(100);
+    }
+  }
+}
+
 /**
  * Cross-compile a handler into a linux-x86_64 native-fetch server binary with
  * Porffor + Zig — no Docker. The binary is not run here (the build host may not
@@ -73,30 +115,6 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
   const sourceHash = digest(source);
   const target = input.target ?? "linux-x86_64";
   const embedded = input.transport === "embedded";
-  // The directory identity must change whenever an input that changes the
-  // generated C or link line changes. A source digest alone reused an artifact
-  // path across compiler pins, targets, and standalone ABI settings.
-  const artifactId = digest(
-    JSON.stringify({
-      sourceHash,
-      target,
-      transport: input.transport ?? "broker",
-      optimize: input.optimize ?? "release",
-      compatibilityDate: input.config.compatibility_date,
-      config: input.config,
-      toolchain: toolchainStamp(),
-      compiler:
-        target === "host"
-          ? `host:${process.env.CC ?? "cc"}`
-          : process.env.SPROUTBOAT_ZIG
-            ? `override:${process.env.SPROUTBOAT_ZIG}`
-            : "managed-zig",
-      native: embedded ? [sqliteStamp(), bearsslStamp()] : [],
-    }),
-  ).slice("sha256:".length, 24);
-  const artifactDir = input.outputDirectory ?? resolve(input.projectDir, ".sproutboat/dist", artifactId);
-  const sproutPath = resolve(artifactDir, "sprout");
-  await mkdir(artifactDir, { recursive: true });
 
   // #74 — split each storage-binding array into its binding-name list (the
   // legacy shape the prelude/broker read) plus a `resources` map { binding ->
@@ -132,33 +150,34 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
     resources,
   };
 
-  // A host build never shells out to `zig`, so do not fetch a 50 MB toolchain
-  // for it — that download is the slowest part of a first local build.
-  const host = input.target === "host";
-  const zigBin = host ? undefined : await ensureZig();
-  // #15 — an embedded sprout carries its own storage and TLS instead of talking
-  // to a broker: SQLite and BearSSL are compiled once per target and added to
-  // the link line, and BearSSL's header to the compile line.
-  const sqliteObject = embedded ? await ensureSqliteObject({ target, zigBin }) : null;
-  const tls = embedded ? await ensureBearssl({ target, zigBin }) : null;
-  const extraLink = [...(sqliteObject ? [sqliteObject] : []), ...(tls ? tls.objects : [])];
-  const extraCflags = tls ? ["-I", tls.includeDir] : [];
+  const host = target === "host";
+  const assetDir = input.config.assets ? resolve(input.projectDir, input.config.assets.directory) : undefined;
+  if (
+    assetDir &&
+    !(await stat(assetDir)
+      .then((s) => s.isDirectory())
+      .catch(() => false))
+  ) {
+    throw new Error(`assets.directory "${input.config.assets?.directory}" not found — run your site build first`);
+  }
+  const assetManifest: AssetManifest | undefined =
+    assetDir && input.config.assets
+      ? {
+          notFound: input.config.assets.not_found_handling ?? "none",
+          runSproutFirst: input.config.assets.run_sprout_first ?? false,
+          files: walkAssets(assetDir),
+        }
+      : undefined;
   // #15 — an embedded binary has no files beside it, so assets are baked into
   // the module. Read them from the source directory: the artifact copy happens
   // after the compile, and the compile is what needs them. Bytes travel as a
   // latin1 string, one char per byte, which is what the asset shim hands back.
   let bakedAssets: { manifest: AssetManifest; files: Record<string, string> } | undefined;
-  if (input.transport === "embedded" && input.config.assets) {
-    const dir = resolve(input.projectDir, input.config.assets.directory);
-    const manifest: AssetManifest = {
-      notFound: input.config.assets.not_found_handling ?? "none",
-      runSproutFirst: input.config.assets.run_sprout_first ?? false,
-      files: walkAssets(dir),
-    };
+  if (embedded && assetDir && assetManifest) {
     const files: Record<string, string> = {};
     let total = 0;
-    for (const key of Object.keys(manifest.files)) {
-      const bytes = await readFile(resolve(dir, `.${key}`));
+    for (const key of Object.keys(assetManifest.files)) {
+      const bytes = await readFile(resolve(assetDir, `.${key}`));
       total += bytes.byteLength;
       if (total > MAX_BAKED_ASSET_BYTES) {
         throw new Error(
@@ -168,85 +187,156 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
       }
       files[key] = bytes.toString("latin1");
     }
-    bakedAssets = { manifest, files };
+    bakedAssets = { manifest: assetManifest, files };
   }
 
-  // Hoisted above the compile: #126 bakes it into the binary, and the manifest
-  // records the same instant rather than a slightly later one.
+  // Version metadata is compiled into the executable. Its timestamp makes a
+  // new binary necessary on every build when this binding is configured.
   const builtAt = new Date().toISOString();
+  const versionId = digest(
+    JSON.stringify({ sourceHash, target, config: input.config, assets: assetManifest, toolchain: toolchainStamp() }),
+  ).slice("sha256:".length, 24);
   const versionMetadata = input.config.version_metadata
-    ? { binding: input.config.version_metadata, id: artifactId, tag: input.config.name, timestamp: builtAt }
+    ? { binding: input.config.version_metadata, id: versionId, tag: input.config.name, timestamp: builtAt }
     : undefined;
+  const generatedSource = wrapNativeFetchHandler(
+    source.toString(),
+    await loadPrelude(input.transport ?? "broker"),
+    input.config.vars ?? {},
+    bindings,
+    undefined,
+    input.config.compatibility_date,
+    input.config.name,
+    bakedAssets,
+    input.transport,
+    versionMetadata,
+  );
+  const compileKey = digest(
+    JSON.stringify({
+      generatedSource,
+      target,
+      optimize: input.optimize ?? "release",
+      toolchain: toolchainStamp(),
+      toolchainPackageVersion,
+      porffor: [PORFFOR_COMMIT_FULL, PORFFOR_ARCHIVE_SHA256],
+      native: embedded ? [sqliteStamp(), bearsslStamp()] : [],
+      integration: await integrationIdentity(),
+    }),
+  ).slice("sha256:".length);
+  const artifactId = versionMetadata
+    ? versionId
+    : digest(JSON.stringify({ compileKey, config: input.config, assets: assetManifest })).slice("sha256:".length, 24);
+  const artifactDir = input.outputDirectory ?? resolve(input.projectDir, ".sproutboat/dist", artifactId);
+  const sproutPath = resolve(artifactDir, "sprout");
+  const artifactLock = await acquireArtifactLock(artifactDir);
+  try {
+    await mkdir(artifactDir, { recursive: true });
 
-  if (input.reuseSproutPath) await cp(input.reuseSproutPath, sproutPath);
-  else
-    await compileSprout({
-      sourcePath: input.sourcePath,
-      source: input.source,
-      outPath: sproutPath,
-      vars: input.config.vars ?? {},
-      bindings,
-      zigBin,
-      target: input.target,
-      compatibilityDate: input.config.compatibility_date,
-      transport: input.transport,
-      appName: input.config.name,
-      assets: bakedAssets,
-      extraLink,
-      extraCflags,
-      optimize: input.optimize,
-      versionMetadata,
-    });
-
-  const sprout = await readFile(sproutPath);
-  const manifest: ArtifactManifest = {
-    schemaVersion: ARTIFACT_SCHEMA_VERSION,
-    project: input.config.name,
-    target: host ? hostTarget() : DEPLOY_TARGET,
-    runtime: RUNTIME,
-    capabilityProfile: CAPABILITY_PROFILE,
-    porfforVersion: porfforVersion(),
-    esbuildVersion: esbuildVersion(),
-    buildImage: toolchainStamp(),
-    compatibilityDate: input.config.compatibility_date,
-    sourceHash,
-    binaryHash: digest(sprout),
-    binarySize: (await stat(sproutPath)).size,
-    builtAt,
-  };
-  await writeFile(resolve(artifactDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
-  // Bindings live beside the manifest, not in it: the artifact manifest schema is
-  // frozen at v2. The control plane reads this to configure the per-deployment
-  // broker (KV / D1 / R2 / queue names, secret names, outbound allowlist, cron
-  // schedules, Durable Object classes).
-  const hasBindings =
-    Object.values(bindings).some((value) => Array.isArray(value) && value.length > 0) ||
-    Object.keys(bindings.resources).length > 0 ||
-    Object.keys(bindings.vars).length > 0;
-  if (hasBindings) {
-    await writeFile(resolve(artifactDir, "bindings.json"), `${JSON.stringify(bindings, null, 2)}\n`);
-  }
-
-  // Static assets: copy the directory next to the artifact and record a manifest
-  // the edge serves from directly (assets-first) and the broker reads for
-  // `env.<ASSETS>.fetch()`.
-  if (input.config.assets) {
-    const srcDir = resolve(input.projectDir, input.config.assets.directory);
-    const outDir = resolve(artifactDir, "assets");
+    const compile = async (outPath: string) => {
+      // Acquire native inputs only after a cache miss. A host build never needs
+      // the cross-compiler; embedded builds link SQLite and BearSSL as well.
+      const zigBin = host ? undefined : await ensureZig();
+      const [sqliteObject, tls] = embedded
+        ? await Promise.all([ensureSqliteObject({ target, zigBin }), ensureBearssl({ target, zigBin })])
+        : [null, null];
+      await compileSprout({
+        sourcePath: input.sourcePath,
+        generatedPath: input.generatedPath,
+        generatedSource,
+        outPath,
+        vars: input.config.vars ?? {},
+        bindings,
+        zigBin,
+        target: input.target,
+        compatibilityDate: input.config.compatibility_date,
+        transport: input.transport,
+        appName: input.config.name,
+        assets: bakedAssets,
+        extraLink: [...(sqliteObject ? [sqliteObject] : []), ...(tls ? tls.objects : [])],
+        extraCflags: tls ? ["-I", tls.includeDir] : [],
+        optimize: input.optimize,
+        versionMetadata,
+      });
+    };
+    let compileCache: BuildOutput["compileCache"] = "bypass";
+    const compileStartedAt = performance.now();
     if (
-      !(await stat(srcDir)
-        .then((s) => s.isDirectory())
-        .catch(() => false))
+      !input.reuseSproutPath &&
+      !host &&
+      input.optimize !== "dev" &&
+      !input.outputDirectory &&
+      !versionMetadata &&
+      !process.env.SPROUTBOAT_PORFFOR_DIR &&
+      !process.env.SPROUTBOAT_ZIG &&
+      !process.env.SPROUTBOAT_UWS_TARBALL &&
+      !process.env.SPROUTBOAT_BUILD_UWS_FROM_SOURCE &&
+      !process.env.PORFFOR_VERSION
     ) {
-      throw new Error(`assets.directory "${input.config.assets.directory}" not found — run your site build first`);
+      compileCache = await compileCached(
+        resolve(input.projectDir, ".sproutboat/compile-cache"),
+        compileKey,
+        sproutPath,
+        compile,
+      );
+    } else {
+      const candidate = resolve(artifactDir, `.sprout-${randomUUID()}`);
+      try {
+        if (input.reuseSproutPath) await cp(input.reuseSproutPath, candidate);
+        else await compile(candidate);
+        await rename(candidate, sproutPath);
+      } finally {
+        await rm(candidate, { force: true });
+      }
     }
-    await cp(srcDir, outDir, { recursive: true });
-    const assetManifest: AssetManifest = {
-      notFound: input.config.assets.not_found_handling ?? "none",
-      runSproutFirst: input.config.assets.run_sprout_first ?? false,
-      files: walkAssets(outDir),
+    const compileMs = Math.round(performance.now() - compileStartedAt);
+
+    const sprout = await readFile(sproutPath);
+    const manifest: ArtifactManifest & { compileMs: number } = {
+      schemaVersion: ARTIFACT_SCHEMA_VERSION,
+      project: input.config.name,
+      target: host ? hostTarget() : DEPLOY_TARGET,
+      runtime: RUNTIME,
+      capabilityProfile: CAPABILITY_PROFILE,
+      porfforVersion: porfforVersion(),
+      esbuildVersion: esbuildVersion(),
+      buildImage: toolchainStamp(),
+      compatibilityDate: input.config.compatibility_date,
+      sourceHash,
+      binaryHash: digest(sprout),
+      binarySize: (await stat(sproutPath)).size,
+      compileMs,
+      builtAt,
     };
-    await writeFile(resolve(artifactDir, "assets.json"), `${JSON.stringify(assetManifest, null, 2)}\n`);
+    await writeFile(resolve(artifactDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
+    // Bindings live beside the manifest, not in it: the artifact manifest schema is
+    // frozen at v2. The control plane reads this to configure the per-deployment
+    // broker (KV / D1 / R2 / queue names, secret names, outbound allowlist, cron
+    // schedules, Durable Object classes).
+    const hasBindings =
+      Object.values(bindings).some((value) => Array.isArray(value) && value.length > 0) ||
+      Object.keys(bindings.resources).length > 0 ||
+      Object.keys(bindings.vars).length > 0;
+    if (hasBindings) {
+      await writeFile(resolve(artifactDir, "bindings.json"), `${JSON.stringify(bindings, null, 2)}\n`);
+    } else await rm(resolve(artifactDir, "bindings.json"), { force: true });
+
+    // Static assets: copy the directory next to the artifact and record a manifest
+    // the edge serves from directly (assets-first) and the broker reads for
+    // `env.<ASSETS>.fetch()`.
+    if (assetDir && assetManifest) {
+      const outDir = resolve(artifactDir, "assets");
+      await rm(outDir, { recursive: true, force: true });
+      await cp(assetDir, outDir, { recursive: true });
+      if (JSON.stringify(walkAssets(outDir)) !== JSON.stringify(assetManifest.files)) {
+        throw new Error("assets changed during the build; retry after the asset build finishes");
+      }
+      await writeFile(resolve(artifactDir, "assets.json"), `${JSON.stringify(assetManifest, null, 2)}\n`);
+    } else {
+      await rm(resolve(artifactDir, "assets.json"), { force: true });
+      await rm(resolve(artifactDir, "assets"), { recursive: true, force: true });
+    }
+    return { artifactDir, manifest, compileCache, compileMs };
+  } finally {
+    await rm(artifactLock, { recursive: true, force: true });
   }
-  return { artifactDir, manifest };
 }