sproutboat 0.11.11 → 0.11.13

package/src/bundle.ts

@@ -1,9 +1,9 @@
 /**
  * #89 — bundle the handler before Porffor sees it.
  *
- * Porffor compiles one self-contained module, so until now a project was one
- * file with no imports: no router, no validation library, no SDK, no splitting
- * a codebase in two. Bundling first lifts that without touching the compiler.
+ * Porffor alpha 9 supports ESM imports. We still bundle first so capability
+ * validation sees every dependency and the runtime wrapper receives one
+ * controlled default export.
  *
  * Bun's bundler resolves relative imports across the project and bare
  * specifiers out of the project's own `node_modules`, then emits a single ESM
@@ -12,6 +12,7 @@
  * reaching for a Node API fails exactly as user code would.
  */
 import { relative } from "node:path";
+import { NODE_SHIMS } from "./node-shims";
 
 export type BundleResult = {
   /** One self-contained ESM module: what gets validated, hashed, and compiled. */
@@ -27,6 +28,32 @@ export class BundleError extends Error {
 
 const entryLabel = (entryPath: string, projectDir: string): string => relative(projectDir, entryPath) || entryPath;
 
+const shimSpecifiers = new RegExp(
+  `^(${Object.keys(NODE_SHIMS)
+    .map((s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
+    .join("|")})$`,
+);
+
+/**
+ * Bun already bundles working polyfills for most node:* built-ins under
+ * `target: "browser"` (verified for node:url, node:querystring). This
+ * plugin only overrides the ones in NODE_SHIMS — currently just node:path,
+ * whose bundled resolve() otherwise falls back to `process.cwd()`.
+ */
+const nodeShimsPlugin: import("bun").BunPlugin = {
+  name: "sproutboat-node-shims",
+  setup(build) {
+    build.onResolve({ filter: shimSpecifiers }, (args) => ({ path: args.path, namespace: "sb-node-shim" }));
+    build.onLoad({ filter: /.*/, namespace: "sb-node-shim" }, (args) => ({
+      // SAFETY: onResolve above only ever routes a specifier matched by
+      // shimSpecifiers (built from NODE_SHIMS's own keys) into this
+      // namespace, so args.path is always one of NODE_SHIMS's keys here.
+      contents: (NODE_SHIMS as Record<string, string>)[args.path],
+      loader: "js",
+    }));
+  },
+};
+
 /** Bun reports resolution failures on `AggregateError.errors`; its own message is just "Bundle failed". */
 function bundleDetail(cause: unknown): string {
   const errors = cause instanceof AggregateError ? cause.errors : [];
@@ -51,6 +78,7 @@ export async function bundleHandler(entryPath: string, projectDir: string): Prom
       minify: false,
       splitting: false,
       sourcemap: "none",
+      plugins: [nodeShimsPlugin],
     });
   } catch (cause) {
     // An unresolvable specifier arrives as an AggregateError whose `errors`

package/src/compile-cache.ts

@@ -0,0 +1,98 @@
+import { createHash, randomUUID } from "node:crypto";
+import { chmod, mkdir, mkdtemp, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+
+type CacheRecord = { key: string; hash: string; size: number };
+
+function digest(bytes: Uint8Array): string {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+
+async function verified(entry: string, key: string): Promise<Buffer | null> {
+  try {
+    // SAFETY: cache.json is private cache data; the key, metadata and binary
+    // digest are all checked before this entry can be used.
+    const record = JSON.parse(await readFile(resolve(entry, "cache.json"), "utf8")) as CacheRecord;
+    if (record.key !== key) return null;
+    const path = resolve(entry, "sprout");
+    const info = await stat(path);
+    if (!info.isFile() || (info.mode & 0o111) === 0 || info.size !== record.size) return null;
+    const bytes = await readFile(path);
+    return digest(bytes) === record.hash ? bytes : null;
+  } catch {
+    return null;
+  }
+}
+
+async function publish(bytes: Uint8Array, outPath: string): Promise<void> {
+  await mkdir(dirname(outPath), { recursive: true });
+  const candidate = `${outPath}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(candidate, bytes);
+    await chmod(candidate, 0o555);
+    await rename(candidate, outPath);
+  } finally {
+    await rm(candidate, { force: true });
+  }
+}
+
+/** A per-project binary cache. The lock covers compilation and publication, so
+ * another process can only read a complete, checksum-verified entry. */
+export async function compileCached(
+  cacheRoot: string,
+  key: string,
+  outPath: string,
+  compile: (candidatePath: string) => Promise<void>,
+): Promise<"hit" | "miss"> {
+  const entry = resolve(cacheRoot, key);
+  const cached = await verified(entry, key);
+  if (cached) {
+    await publish(cached, outPath);
+    return "hit";
+  }
+  await mkdir(cacheRoot, { recursive: true });
+  const lock = `${entry}.lock`;
+  const deadline = Date.now() + 12 * 60_000;
+  while (true) {
+    try {
+      await mkdir(lock);
+      break;
+    } catch (error) {
+      // SAFETY: Node filesystem errors expose code; unrelated failures are
+      // rethrown instead of being treated as a held lock.
+      if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+      const ready = await verified(entry, key);
+      if (ready) {
+        await publish(ready, outPath);
+        return "hit";
+      }
+      if (Date.now() > deadline) throw new Error(`timed out waiting for compile cache lock ${lock}`);
+      const lockInfo = await stat(lock).catch(() => null);
+      if (lockInfo && Date.now() - lockInfo.mtimeMs > 15 * 60_000) await rm(lock, { recursive: true, force: true });
+      else await Bun.sleep(100);
+    }
+  }
+  let stage: string | undefined;
+  try {
+    const ready = await verified(entry, key);
+    if (ready) {
+      await publish(ready, outPath);
+      return "hit";
+    }
+    await rm(entry, { recursive: true, force: true });
+    stage = await mkdtemp(resolve(cacheRoot, `.candidate-${key}-`));
+    const candidate = resolve(stage, "sprout");
+    await compile(candidate);
+    const bytes = await readFile(candidate);
+    const record: CacheRecord = { key, hash: digest(bytes), size: bytes.byteLength };
+    await chmod(candidate, 0o555);
+    await writeFile(resolve(stage, "cache.json"), JSON.stringify(record));
+    await rename(stage, entry);
+    stage = undefined;
+    await publish(bytes, outPath);
+    return "miss";
+  } finally {
+    if (stage) await rm(stage, { recursive: true, force: true });
+    await rm(lock, { recursive: true, force: true });
+  }
+}

package/src/compile.ts

@@ -10,7 +10,6 @@
  * unusable it stops with its specific integrity or archive error. Contributors
  * may explicitly opt into Porffor's source fallback.
  */
-import { existsSync } from "node:fs";
 import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import { ensurePorfforPatched } from "./patch-porffor";
@@ -50,8 +49,12 @@ const COMPILE_TIMEOUT_MS = Number(process.env.SPROUTBOAT_COMPILE_TIMEOUT_MS || 6
 
 export type CompileInput = {
   sourcePath: string;
+  /** Stable compiler input for dev rebuilds, independent of the candidate binary path. */
+  generatedPath?: string;
   /** The bundled module (#89). Falls back to reading `sourcePath` verbatim. */
   source?: string;
+  /** The exact wrapped module used to compute a verified compile-cache key. */
+  generatedSource?: string;
   outPath: string;
   vars: Record<string, string>;
   bindings?: Bindings;
@@ -195,26 +198,29 @@ export async function compileSprout(input: CompileInput): Promise<void> {
   // OS may still be executing. The linker cannot overwrite either, so clear it
   // first rather than failing with "can't write output file".
   await rm(input.outPath, { force: true });
-  const generatedPath = resolve(outDir, "sprout.generated.js");
-  const [source, prelude] = await Promise.all([
-    input.source === undefined ? readFile(input.sourcePath, "utf8") : Promise.resolve(input.source),
-    loadPrelude(input.transport ?? "broker"),
-  ]);
-  await writeFile(
-    generatedPath,
-    wrapNativeFetchHandler(
-      source,
-      prelude,
-      input.vars,
-      input.bindings ?? EMPTY_BINDINGS,
-      undefined,
-      input.compatibilityDate,
-      input.appName,
-      input.assets,
-      input.transport,
-      input.versionMetadata,
-    ),
-  );
+  const generatedPath = input.generatedPath ?? resolve(outDir, "sprout.generated.js");
+  await mkdir(dirname(generatedPath), { recursive: true });
+  const generatedSource =
+    input.generatedSource ??
+    (await (async () => {
+      const [source, prelude] = await Promise.all([
+        input.source === undefined ? readFile(input.sourcePath, "utf8") : Promise.resolve(input.source),
+        loadPrelude(input.transport ?? "broker"),
+      ]);
+      return wrapNativeFetchHandler(
+        source,
+        prelude,
+        input.vars,
+        input.bindings ?? EMPTY_BINDINGS,
+        undefined,
+        input.compatibilityDate,
+        input.appName,
+        input.assets,
+        input.transport,
+        input.versionMetadata,
+      );
+    })());
+  await writeFile(generatedPath, generatedSource);
 
   const launcher = resolve(porffor, "runtime/index.js");
   // A musl build shells `zig` bare (Porffor hardcodes the literal command), so
@@ -222,22 +228,7 @@ export async function compileSprout(input: CompileInput): Promise<void> {
   // below instead and has no zigBin to contribute here.
   const zigDir = input.zigBin ? `${dirname(input.zigBin)}:` : "";
   const hostCompiler = input.target === "host" ? await resolveHostCompiler() : undefined;
-  // The per-platform binary ships esbuild next to it; a compiled build finds it
-  // there. Running from the npm package under Bun, `process.execPath` is Bun
-  // itself and `npm i -g` puts no dependency `.bin` on PATH, so resolve the
-  // esbuild dependency directly. `Bun.which` is the last resort.
-  const packagedEsbuild = resolve(dirname(process.execPath), "esbuild");
-  let esbuild: string | null = existsSync(packagedEsbuild) ? packagedEsbuild : null;
-  if (!esbuild) {
-    try {
-      esbuild = Bun.resolveSync("esbuild/bin/esbuild", import.meta.dir);
-    } catch {
-      esbuild = null;
-    }
-  }
-  esbuild ??= Bun.which("esbuild");
-  if (!esbuild) throw new Error("esbuild could not be located; install it or reinstall sproutboat");
-  const path = `${zigDir}${dirname(esbuild)}:${process.env.PATH ?? ""}`;
+  const path = `${zigDir}${process.env.PATH ?? ""}`;
   const command = PACKAGED
     ? [process.execPath, "__porffor", launcher]
     : [process.execPath, resolve(import.meta.dir, "main.ts"), "__porffor", launcher];

package/src/dev.ts

@@ -11,6 +11,7 @@
  * project, one port.
  */
 import { existsSync, watch, type FSWatcher } from "node:fs";
+import { randomUUID } from "node:crypto";
 import { mkdir, readFile, rm } from "node:fs/promises";
 import { connect } from "node:net";
 import { dirname, resolve } from "node:path";
@@ -21,6 +22,7 @@ import { amber, dim, leaf, ok } from "./style";
 import type { SproutboatConfig } from "./config";
 
 const RESTART_DEBOUNCE_MS = 120;
+const DEV_COMPILE_SESSION = randomUUID();
 
 export type DevInput = {
   projectDir: string;
@@ -121,6 +123,14 @@ async function start(input: DevInput, port: number): Promise<Running> {
       optimize: "dev",
       reuseSproutPath: input.reuseSproutPath,
       outputDirectory: candidateDir,
+      // Alpha 9 keys its C-unit cache by the entry's absolute path. Keep that
+      // path fixed across saves while each candidate keeps its own binary.
+      generatedPath: resolve(
+        input.projectDir,
+        ".sproutboat/dev-compile",
+        `${process.pid}-${DEV_COMPILE_SESSION}`,
+        "sprout.generated.js",
+      ),
     });
   } catch (error) {
     await rm(candidateDir, { recursive: true, force: true });

package/src/main.ts

@@ -319,6 +319,7 @@ async function build(directory?: string, target: "linux-x86_64" | "host" = "linu
     target,
   });
   console.log(ok(`built ${project.config.name}`));
+  console.log(dim(`  compile  ${artifact.compileMs} ms · binary cache ${artifact.compileCache}`));
   if (target === "host")
     console.log(dim("  host build — runs here, not deployable; drop --target host to build for a box"));
   console.log(artifact.artifactDir);

package/src/node-shims.ts

@@ -0,0 +1,378 @@
+/**
+ * Bun's bundler ships full Node-compatible polyfills for node:path,
+ * node:url, and node:querystring under `target: "browser"`, but each has
+ * exactly one thing wrong with it for a Porffor-compiled handler — found
+ * by auditing bundled output against the capability check (source.ts) and,
+ * for node:url, by an actual failure through the real Porffor compiler.
+ * Auditing the bundle alone was not enough:
+ *
+ * - node:path's bundled `resolve()` falls back to `process.cwd()`, which
+ *   trips the `process.` ban in `../packages/runtime/src/source.ts`.
+ * - node:querystring's bundled polyfill pulls in Bun's full Buffer
+ *   implementation internally (for percent-decoding), tripping the
+ *   `Buffer.` ban.
+ * - node:url's bundled `URL`/`URLSearchParams` exports are
+ *   `var { URL, URLSearchParams } = globalThis;` — passes every capability
+ *   check (no banned pattern in it) but Porffor's compiler rejects it at
+ *   parse time as `Identifier 'URL' has already been declared`: Porffor
+ *   pre-binds `URL` as a global, and a second top-level declaration of
+ *   that exact name is a compile error, confirmed by actually building a
+ *   handler through `sproutboat build` rather than just checking the
+ *   bundle. `URL`/`URLSearchParams` are already global in a compiled
+ *   handler (see `docs/concepts/handler.mdx`), so nothing needs importing
+ *   — the fix is a shim that re-exports the globals under aliased local
+ *   names instead of declaring anything literally named `URL`.
+ *
+ * None of these are the capability check being wrong — every case is a
+ * real thing (`process.cwd()`, `Buffer`, a name Porffor itself reserves)
+ * that doesn't exist the way a compiled handler needs it to, so the shims
+ * replace it rather than the check being loosened.
+ */
+const NODE_PATH_SHIM = `
+function assertPath(path) {
+  if (typeof path !== "string")
+    throw TypeError("Path must be a string. Received " + JSON.stringify(path));
+}
+function normalizeStringPosix(path, allowAboveRoot) {
+  var res = "", lastSegmentLength = 0, lastSlash = -1, dots = 0, code;
+  for (var i = 0; i <= path.length; ++i) {
+    if (i < path.length) code = path.charCodeAt(i);
+    else if (code === 47) break;
+    else code = 47;
+    if (code === 47) {
+      if (lastSlash === i - 1 || dots === 1) {
+      } else if (lastSlash !== i - 1 && dots === 2) {
+        if (res.length < 2 || lastSegmentLength !== 2 || res.charCodeAt(res.length - 1) !== 46 || res.charCodeAt(res.length - 2) !== 46) {
+          if (res.length > 2) {
+            var lastSlashIndex = res.lastIndexOf("/");
+            if (lastSlashIndex !== res.length - 1) {
+              if (lastSlashIndex === -1) res = "", lastSegmentLength = 0;
+              else res = res.slice(0, lastSlashIndex), lastSegmentLength = res.length - 1 - res.lastIndexOf("/");
+              lastSlash = i, dots = 0;
+              continue;
+            }
+          } else if (res.length === 2 || res.length === 1) {
+            res = "", lastSegmentLength = 0, lastSlash = i, dots = 0;
+            continue;
+          }
+        }
+        if (allowAboveRoot) {
+          if (res.length > 0) res += "/..";
+          else res = "..";
+          lastSegmentLength = 2;
+        }
+      } else {
+        if (res.length > 0) res += "/" + path.slice(lastSlash + 1, i);
+        else res = path.slice(lastSlash + 1, i);
+        lastSegmentLength = i - lastSlash - 1;
+      }
+      lastSlash = i, dots = 0;
+    } else if (code === 46 && dots !== -1) ++dots;
+    else dots = -1;
+  }
+  return res;
+}
+function _format(sep, pathObject) {
+  var dir = pathObject.dir || pathObject.root, base = pathObject.base || (pathObject.name || "") + (pathObject.ext || "");
+  if (!dir) return base;
+  if (dir === pathObject.root) return dir + base;
+  return dir + sep + base;
+}
+function resolve() {
+  // Node falls back to process.cwd() here; a compiled handler has no real
+  // filesystem or cwd, so an all-relative resolve() resolves against a
+  // fixed virtual root instead.
+  var resolvedPath = "", resolvedAbsolute = false, cwd;
+  for (var i = arguments.length - 1; i >= -1 && !resolvedAbsolute; i--) {
+    var path;
+    if (i >= 0) path = arguments[i];
+    else {
+      if (cwd === undefined) cwd = "/";
+      path = cwd;
+    }
+    if (assertPath(path), path.length === 0) continue;
+    resolvedPath = path + "/" + resolvedPath, resolvedAbsolute = path.charCodeAt(0) === 47;
+  }
+  if (resolvedPath = normalizeStringPosix(resolvedPath, !resolvedAbsolute), resolvedAbsolute)
+    if (resolvedPath.length > 0) return "/" + resolvedPath;
+    else return "/";
+  else if (resolvedPath.length > 0) return resolvedPath;
+  else return ".";
+}
+function normalize(path) {
+  if (assertPath(path), path.length === 0) return ".";
+  var isAbsolute = path.charCodeAt(0) === 47, trailingSeparator = path.charCodeAt(path.length - 1) === 47;
+  if (path = normalizeStringPosix(path, !isAbsolute), path.length === 0 && !isAbsolute) path = ".";
+  if (path.length > 0 && trailingSeparator) path += "/";
+  if (isAbsolute) return "/" + path;
+  return path;
+}
+function isAbsolute(path) {
+  return assertPath(path), path.length > 0 && path.charCodeAt(0) === 47;
+}
+function join() {
+  if (arguments.length === 0) return ".";
+  var joined;
+  for (var i = 0; i < arguments.length; ++i) {
+    var arg = arguments[i];
+    if (assertPath(arg), arg.length > 0)
+      if (joined === undefined) joined = arg;
+      else joined += "/" + arg;
+  }
+  if (joined === undefined) return ".";
+  return normalize(joined);
+}
+function relative(from, to) {
+  if (assertPath(from), assertPath(to), from === to) return "";
+  if (from = resolve(from), to = resolve(to), from === to) return "";
+  var fromStart = 1;
+  for (; fromStart < from.length; ++fromStart) if (from.charCodeAt(fromStart) !== 47) break;
+  var fromEnd = from.length, fromLen = fromEnd - fromStart, toStart = 1;
+  for (; toStart < to.length; ++toStart) if (to.charCodeAt(toStart) !== 47) break;
+  var toEnd = to.length, toLen = toEnd - toStart, length = fromLen < toLen ? fromLen : toLen, lastCommonSep = -1, i = 0;
+  for (; i <= length; ++i) {
+    if (i === length) {
+      if (toLen > length) {
+        if (to.charCodeAt(toStart + i) === 47) return to.slice(toStart + i + 1);
+        else if (i === 0) return to.slice(toStart + i);
+      } else if (fromLen > length) {
+        if (from.charCodeAt(fromStart + i) === 47) lastCommonSep = i;
+        else if (i === 0) lastCommonSep = 0;
+      }
+      break;
+    }
+    var fromCode = from.charCodeAt(fromStart + i), toCode = to.charCodeAt(toStart + i);
+    if (fromCode !== toCode) break;
+    else if (fromCode === 47) lastCommonSep = i;
+  }
+  var out = "";
+  for (i = fromStart + lastCommonSep + 1; i <= fromEnd; ++i)
+    if (i === fromEnd || from.charCodeAt(i) === 47)
+      if (out.length === 0) out += "..";
+      else out += "/..";
+  if (out.length > 0) return out + to.slice(toStart + lastCommonSep);
+  else {
+    if (toStart += lastCommonSep, to.charCodeAt(toStart) === 47) ++toStart;
+    return to.slice(toStart);
+  }
+}
+function dirname(path) {
+  if (assertPath(path), path.length === 0) return ".";
+  var code = path.charCodeAt(0), hasRoot = code === 47, end = -1, matchedSlash = true;
+  for (var i = path.length - 1; i >= 1; --i)
+    if (code = path.charCodeAt(i), code === 47) {
+      if (!matchedSlash) { end = i; break; }
+    } else matchedSlash = false;
+  if (end === -1) return hasRoot ? "/" : ".";
+  if (hasRoot && end === 1) return "//";
+  return path.slice(0, end);
+}
+function basename(path, ext) {
+  if (ext !== undefined && typeof ext !== "string") throw TypeError('"ext" argument must be a string');
+  assertPath(path);
+  var start = 0, end = -1, matchedSlash = true, i;
+  if (ext !== undefined && ext.length > 0 && ext.length <= path.length) {
+    if (ext.length === path.length && ext === path) return "";
+    var extIdx = ext.length - 1, firstNonSlashEnd = -1;
+    for (i = path.length - 1; i >= 0; --i) {
+      var code = path.charCodeAt(i);
+      if (code === 47) {
+        if (!matchedSlash) { start = i + 1; break; }
+      } else {
+        if (firstNonSlashEnd === -1) matchedSlash = false, firstNonSlashEnd = i + 1;
+        if (extIdx >= 0)
+          if (code === ext.charCodeAt(extIdx)) { if (--extIdx === -1) end = i; }
+          else extIdx = -1, end = firstNonSlashEnd;
+      }
+    }
+    if (start === end) end = firstNonSlashEnd;
+    else if (end === -1) end = path.length;
+    return path.slice(start, end);
+  } else {
+    for (i = path.length - 1; i >= 0; --i)
+      if (path.charCodeAt(i) === 47) {
+        if (!matchedSlash) { start = i + 1; break; }
+      } else if (end === -1) matchedSlash = false, end = i + 1;
+    if (end === -1) return "";
+    return path.slice(start, end);
+  }
+}
+function extname(path) {
+  assertPath(path);
+  var startDot = -1, startPart = 0, end = -1, matchedSlash = true, preDotState = 0;
+  for (var i = path.length - 1; i >= 0; --i) {
+    var code = path.charCodeAt(i);
+    if (code === 47) {
+      if (!matchedSlash) { startPart = i + 1; break; }
+      continue;
+    }
+    if (end === -1) matchedSlash = false, end = i + 1;
+    if (code === 46) { if (startDot === -1) startDot = i; else if (preDotState !== 1) preDotState = 1; }
+    else if (startDot !== -1) preDotState = -1;
+  }
+  if (startDot === -1 || end === -1 || preDotState === 0 || preDotState === 1 && startDot === end - 1 && startDot === startPart + 1) return "";
+  return path.slice(startDot, end);
+}
+function format(pathObject) {
+  if (pathObject === null || typeof pathObject !== "object")
+    throw TypeError('The "pathObject" argument must be of type Object. Received type ' + typeof pathObject);
+  return _format("/", pathObject);
+}
+function parse(path) {
+  assertPath(path);
+  var ret = { root: "", dir: "", base: "", ext: "", name: "" };
+  if (path.length === 0) return ret;
+  var code = path.charCodeAt(0), isAbsolute2 = code === 47, start;
+  if (isAbsolute2) ret.root = "/", start = 1;
+  else start = 0;
+  var startDot = -1, startPart = 0, end = -1, matchedSlash = true, i = path.length - 1, preDotState = 0;
+  for (; i >= start; --i) {
+    if (code = path.charCodeAt(i), code === 47) {
+      if (!matchedSlash) { startPart = i + 1; break; }
+      continue;
+    }
+    if (end === -1) matchedSlash = false, end = i + 1;
+    if (code === 46) { if (startDot === -1) startDot = i; else if (preDotState !== 1) preDotState = 1; }
+    else if (startDot !== -1) preDotState = -1;
+  }
+  if (startDot === -1 || end === -1 || preDotState === 0 || preDotState === 1 && startDot === end - 1 && startDot === startPart + 1) {
+    if (end !== -1)
+      if (startPart === 0 && isAbsolute2) ret.base = ret.name = path.slice(1, end);
+      else ret.base = ret.name = path.slice(startPart, end);
+  } else {
+    if (startPart === 0 && isAbsolute2) ret.name = path.slice(1, startDot), ret.base = path.slice(1, end);
+    else ret.name = path.slice(startPart, startDot), ret.base = path.slice(startPart, end);
+    ret.ext = path.slice(startDot, end);
+  }
+  if (startPart > 0) ret.dir = path.slice(0, startPart - 1);
+  else if (isAbsolute2) ret.dir = "/";
+  return ret;
+}
+var sep = "/";
+var delimiter = ":";
+var path = { resolve, normalize, isAbsolute, join, relative, dirname, basename, extname, format, parse, sep, delimiter };
+path.posix = path;
+path.win32 = path;
+export default path;
+export { resolve, normalize, isAbsolute, join, relative, dirname, basename, extname, format, parse, sep, delimiter };
+`;
+
+/**
+ * node:querystring's bundled polyfill pulls in Bun's full Buffer
+ * implementation (used internally for percent-decoding), which the
+ * capability check correctly rejects — Buffer isn't something Porffor's
+ * compiled output can rely on. This shim implements parse/stringify/
+ * escape/unescape (plus the encode/decode aliases Node exports) over
+ * plain string ops and encodeURIComponent/decodeURIComponent instead.
+ */
+const NODE_QUERYSTRING_SHIM = `
+function qsUnescape(str) {
+  try { return decodeURIComponent(String(str).replace(/\\+/g, " ")); }
+  catch { return String(str); }
+}
+function qsEscape(str) {
+  return encodeURIComponent(String(str));
+}
+function parse(qs, sep, eq, options) {
+  sep = sep || "&";
+  eq = eq || "=";
+  var obj = Object.create(null);
+  if (typeof qs !== "string" || qs.length === 0) return obj;
+  var decode = (options && options.decodeURIComponent) || qsUnescape;
+  var maxKeys = options && typeof options.maxKeys === "number" ? options.maxKeys : 1000;
+  var pairs = qs.split(sep);
+  var limit = maxKeys > 0 ? Math.min(pairs.length, maxKeys) : pairs.length;
+  for (var i = 0; i < limit; i++) {
+    var pair = pairs[i];
+    var eqIdx = pair.indexOf(eq);
+    var key, value;
+    if (eqIdx >= 0) { key = pair.slice(0, eqIdx); value = pair.slice(eqIdx + eq.length); }
+    else { key = pair; value = ""; }
+    key = decode(key);
+    value = decode(value);
+    if (Object.prototype.hasOwnProperty.call(obj, key)) {
+      if (Array.isArray(obj[key])) obj[key].push(value);
+      else obj[key] = [obj[key], value];
+    } else obj[key] = value;
+  }
+  return obj;
+}
+function stringify(obj, sep, eq, options) {
+  sep = sep || "&";
+  eq = eq || "=";
+  obj = obj || {};
+  var encode = (options && options.encodeURIComponent) || qsEscape;
+  var parts = [];
+  for (var key in obj) {
+    if (!Object.prototype.hasOwnProperty.call(obj, key)) continue;
+    var value = obj[key];
+    var encodedKey = encode(key);
+    if (Array.isArray(value)) {
+      for (var i = 0; i < value.length; i++) parts.push(encodedKey + eq + encode(value[i]));
+    } else {
+      parts.push(encodedKey + eq + encode(value));
+    }
+  }
+  return parts.join(sep);
+}
+export { parse, stringify, qsEscape as escape, qsUnescape as unescape, stringify as encode, parse as decode };
+export default { parse, stringify, escape: qsEscape, unescape: qsUnescape, encode: stringify, decode: parse };
+`;
+
+/**
+ * `URL`/`URLSearchParams` are re-exported under aliased local names
+ * (`NodeURL`/`NodeURLSearchParams`) rather than declared as top-level
+ * `URL`/`URLSearchParams` — Porffor pre-binds `URL` as a global and
+ * rejects a second top-level declaration of that name. legacy
+ * parse/format/resolve are hand-written over the WHATWG URL rather than
+ * Bun's internal legacy-Url implementation, which isn't something this
+ * shim can import from; good enough for the common absolute-URL case,
+ * not a byte-for-byte port of Node's edge cases (relative/protocol-less
+ * input, unusual schemes).
+ */
+const NODE_URL_SHIM = `
+var NodeURL = globalThis.URL;
+var NodeURLSearchParams = globalThis.URLSearchParams;
+function urlFormat(urlObject) {
+  if (typeof urlObject === "string") return urlObject;
+  if (urlObject instanceof NodeURL) return urlObject.href;
+  var protocol = urlObject.protocol || "";
+  var slashes = urlObject.slashes !== false && !!(urlObject.host || urlObject.hostname);
+  var auth = urlObject.auth ? urlObject.auth + "@" : "";
+  var host = urlObject.host || ((urlObject.hostname || "") + (urlObject.port ? ":" + urlObject.port : ""));
+  var pathname = urlObject.pathname || "";
+  var search = urlObject.search || (urlObject.query ? "?" + (typeof urlObject.query === "string" ? urlObject.query : "") : "");
+  var hash = urlObject.hash || "";
+  return protocol + (slashes ? "//" : "") + auth + host + pathname + search + hash;
+}
+function legacyFromURL(u) {
+  return {
+    protocol: u.protocol,
+    slashes: true,
+    auth: u.username ? u.username + (u.password ? ":" + u.password : "") : null,
+    host: u.host,
+    port: u.port || null,
+    hostname: u.hostname,
+    hash: u.hash || null,
+    search: u.search || null,
+    query: u.search ? u.search.slice(1) : null,
+    pathname: u.pathname,
+    path: u.pathname + (u.search || ""),
+    href: u.href,
+  };
+}
+function urlParse(input) {
+  return legacyFromURL(new NodeURL(input));
+}
+function urlResolve(from, to) {
+  return new NodeURL(to, new NodeURL(from)).href;
+}
+export { NodeURL as URL, NodeURLSearchParams as URLSearchParams, urlFormat as format, urlParse as parse, urlResolve as resolve };
+export default { URL: NodeURL, URLSearchParams: NodeURLSearchParams, format: urlFormat, parse: urlParse, resolve: urlResolve };
+`;
+
+export const NODE_SHIMS = {
+  "node:path": NODE_PATH_SHIM,
+  "node:querystring": NODE_QUERYSTRING_SHIM,
+  "node:url": NODE_URL_SHIM,
+} satisfies Record<string, string>;