sproutboat 0.46.0 → 0.47.0

package/CHANGELOG.md

@@ -10,6 +10,23 @@ maintained going forward by the `release` skill.
 
 ## Unreleased
 
+## [0.47.0] - 2026-10-30
+
+Built on `@sproutboat/runtime` 0.38.0, `@sproutboat/toolchain` 0.21.1 and `@sproutboat/wire` 0.21.1.
+
+### Added
+
+- **`crypto.subtle` like workerd from `2026-11-06`**: RSASSA-PKCS1-v1_5, RSA-PSS, RSA-OAEP, ECDSA (P-256, P-384, P-521), ECDH,
+  Ed25519 (and `NODE-ED25519`), X25519, AES-GCM, AES-CBC, AES-CTR and AES-KW, PBKDF2 and HKDF for every hash, `generateKey`,
+  `importKey` and `exportKey` in raw, spki, pkcs8 and jwk, `deriveBits`, `deriveKey`, `wrapKey`, `unwrapKey` and
+  `crypto.DigestStream`, with workerd's DOMException error names. Earlier dates answer as before. The primitives are
+  BearSSL's and Monocypher's, and standalone and broker builds both carry them.
+
+### Changed
+
+- **A build whose handler never names `subtle`, `DigestStream` or `CryptoKey` carries none of the crypto code** (its generated
+  program is unchanged); a broker build whose handler does use `crypto.subtle` links the cached BearSSL library for it.
+
 ## [0.46.0] - 2026-10-30
 
 Built on `@sproutboat/runtime` 0.37.1, `@sproutboat/toolchain` 0.21.1 and

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.46.0
+**Package:** `sproutboat` 0.47.0
 
 ## Commands
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.46.0",
+  "version": "0.47.0",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -64,9 +64,9 @@
     "@sproutboat/artifact": "^0.3.0",
     "@sproutboat/assets": "^0.3.0",
     "@sproutboat/config": "^0.6.0",
-    "@sproutboat/runtime": "^0.37.1",
+    "@sproutboat/runtime": "^0.38.0",
     "@sproutboat/toolchain": "^0.21.1",
-    "@sproutboat/wire": "^0.21.0"
+    "@sproutboat/wire": "^0.21.1"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.85.0",
@@ -78,10 +78,10 @@
     "typescript": "7.0.2"
   },
   "optionalDependencies": {
-    "@sproutboat/cli-darwin-arm64": "0.46.0",
-    "@sproutboat/cli-darwin-x64": "0.46.0",
-    "@sproutboat/cli-linux-arm64": "0.46.0",
-    "@sproutboat/cli-linux-x64": "0.46.0"
+    "@sproutboat/cli-darwin-arm64": "0.47.0",
+    "@sproutboat/cli-darwin-x64": "0.47.0",
+    "@sproutboat/cli-linux-arm64": "0.47.0",
+    "@sproutboat/cli-linux-x64": "0.47.0"
   },
   "engines": {
     "node": ">=18"

package/src/build.ts

@@ -21,7 +21,7 @@ import { ensureZig, esbuildVersion, porfforVersion, toolchainStamp } from "./too
 import { PORFFOR_ARCHIVE_SHA256, PORFFOR_COMMIT_FULL } from "./porffor-toolchain";
 import { version as toolchainPackageVersion } from "@sproutboat/toolchain/package.json" with { type: "json" };
 import { version as cliVersion } from "../package.json" with { type: "json" };
-import { wrapNativeFetchHandler } from "./wrap";
+import { reachesSubtle, wrapNativeFetchHandler } from "./wrap";
 
 export type BuildInput = {
   projectDir: string;
@@ -230,8 +230,13 @@ async function prepareBuild(input: BuildInput) {
     bakedAssets,
     input.transport,
     versionMetadata,
+    // Drop crypto.subtle (about 330 KB, and BearSSL on the link line) from a handler that never names it.
+    "auto",
   );
+  // The broker transport links no BearSSL of its own; a handler that uses crypto.subtle needs it.
+  const subtle = !embedded && reachesSubtle(source.toString());
   return {
+    subtle,
     sourceHash,
     target,
     embedded,
@@ -309,6 +314,7 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
     sourceHash,
     target,
     embedded,
+    subtle,
     host,
     bindings,
     assetDir,
@@ -327,7 +333,7 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
       toolchain: toolchainStamp(),
       toolchainPackageVersion,
       porffor: [PORFFOR_COMMIT_FULL, PORFFOR_ARCHIVE_SHA256],
-      native: embedded ? [sqliteStamp(), bearsslStamp()] : [],
+      native: embedded ? [sqliteStamp(), bearsslStamp()] : subtle ? [bearsslStamp()] : [],
       integration: await integrationIdentity(),
       nativeRestore: input.withRestore ? NATIVE_RESTORE_IDENTITY : null,
     }),
@@ -347,7 +353,7 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
       const zigBin = host ? undefined : await ensureZig();
       const [sqliteObject, tls] = embedded
         ? await Promise.all([ensureSqliteObject({ target, zigBin }), ensureBearssl({ target, zigBin })])
-        : [null, null];
+        : [null, subtle ? await ensureBearssl({ target, zigBin }) : null];
       const unitDir = unitDirFor(input);
       const unitLock = input.generatedPath ? null : await acquireArtifactLock(unitDir);
       try {
@@ -364,7 +370,11 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
           transport: input.transport,
           appName: input.config.name,
           assets: bakedAssets,
-          extraLink: [...(sqliteObject ? [sqliteObject] : []), ...(tls ? tls.objects : [])],
+          // Without TLS (broker), the trust anchors are not wanted: only crypto.subtle uses the library.
+          extraLink: [
+            ...(sqliteObject ? [sqliteObject] : []),
+            ...(tls ? (embedded ? tls.objects : tls.objects.slice(0, -1)) : []),
+          ],
           extraCflags: tls ? ["-I", tls.includeDir] : [],
           optimize: input.optimize,
           versionMetadata,