sproutboat 0.46.0 → 0.48.1

package/CHANGELOG.md

@@ -10,6 +10,54 @@ maintained going forward by the `release` skill.
 
 ## Unreleased
 
+## [0.48.1] - 2026-10-31
+
+Same packages as 0.48.0 (`@sproutboat/runtime` 0.39.0, `@sproutboat/toolchain` 0.21.3, `@sproutboat/wire` 0.21.2). The v0.48.0 tag
+published the four platform packages but not `sproutboat` itself, because the release job's test run timed out; 0.48.1 publishes all
+five at one version.
+
+### Fixed
+
+- **The release test run no longer times out**: the native restore test builds two standalone binaries cold, which took 476 s on CI at
+  0.47.0 and over 600 s at 0.48.0 as the prelude grew; its limit is now 1,200 s.
+
+## [0.48.0] - 2026-10-30
+
+Built on `@sproutboat/runtime` 0.39.0, `@sproutboat/toolchain` 0.21.3 and `@sproutboat/wire` 0.21.2. Each change below that an
+existing app could observe starts at a new compatibility date; earlier dates answer as before.
+
+### Added
+
+- **Database clients that need only `fetch` or WebSocket build and run unmodified from `2026-11-15`** (`@libsql/client`,
+  `@neondatabase/serverless`, `@supabase/supabase-js`, `@upstash/redis`, `@planetscale/database`; 113 of 117 comparisons with workerd
+  match, the rest being the wording of a network error). The build check for Node, Bun and Deno globals skips a use behind a
+  `typeof` test, a global the bundle declares itself, and mentions in strings and comments; `Error.captureStackTrace` exists.
+
+### Fixed
+
+- **`fetch()` on a standalone binary returns a promise from `2026-10-22`**, so `fetch(url).then(...)` works and a refused request
+  rejects.
+- **A fetched 204, 205 or 304 response** no longer throws "Response with null body status cannot have body".
+- **A `Uint8Array` subclass that redefines a builtin method** (a `Buffer` polyfill's `toString("hex")`) reaches its own method.
+- **A collector crash (SIGBUS)** when an object grew (toolchain 0.21.3).
+
+## [0.47.0] - 2026-10-30
+
+Built on `@sproutboat/runtime` 0.38.0, `@sproutboat/toolchain` 0.21.1 and `@sproutboat/wire` 0.21.1.
+
+### Added
+
+- **`crypto.subtle` like workerd from `2026-11-06`**: RSASSA-PKCS1-v1_5, RSA-PSS, RSA-OAEP, ECDSA (P-256, P-384, P-521), ECDH,
+  Ed25519 (and `NODE-ED25519`), X25519, AES-GCM, AES-CBC, AES-CTR and AES-KW, PBKDF2 and HKDF for every hash, `generateKey`,
+  `importKey` and `exportKey` in raw, spki, pkcs8 and jwk, `deriveBits`, `deriveKey`, `wrapKey`, `unwrapKey` and
+  `crypto.DigestStream`, with workerd's DOMException error names. Earlier dates answer as before. The primitives are
+  BearSSL's and Monocypher's, and standalone and broker builds both carry them.
+
+### Changed
+
+- **A build whose handler never names `subtle`, `DigestStream` or `CryptoKey` carries none of the crypto code** (its generated
+  program is unchanged); a broker build whose handler does use `crypto.subtle` links the cached BearSSL library for it.
+
 ## [0.46.0] - 2026-10-30
 
 Built on `@sproutboat/runtime` 0.37.1, `@sproutboat/toolchain` 0.21.1 and

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.46.0
+**Package:** `sproutboat` 0.48.1
 
 ## Commands
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.46.0",
+  "version": "0.48.1",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -64,9 +64,9 @@
     "@sproutboat/artifact": "^0.3.0",
     "@sproutboat/assets": "^0.3.0",
     "@sproutboat/config": "^0.6.0",
-    "@sproutboat/runtime": "^0.37.1",
-    "@sproutboat/toolchain": "^0.21.1",
-    "@sproutboat/wire": "^0.21.0"
+    "@sproutboat/runtime": "^0.39.0",
+    "@sproutboat/toolchain": "^0.21.3",
+    "@sproutboat/wire": "^0.21.2"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.85.0",
@@ -78,10 +78,10 @@
     "typescript": "7.0.2"
   },
   "optionalDependencies": {
-    "@sproutboat/cli-darwin-arm64": "0.46.0",
-    "@sproutboat/cli-darwin-x64": "0.46.0",
-    "@sproutboat/cli-linux-arm64": "0.46.0",
-    "@sproutboat/cli-linux-x64": "0.46.0"
+    "@sproutboat/cli-darwin-arm64": "0.48.1",
+    "@sproutboat/cli-darwin-x64": "0.48.1",
+    "@sproutboat/cli-linux-arm64": "0.48.1",
+    "@sproutboat/cli-linux-x64": "0.48.1"
   },
   "engines": {
     "node": ">=18"

package/src/build.ts

@@ -21,7 +21,7 @@ import { ensureZig, esbuildVersion, porfforVersion, toolchainStamp } from "./too
 import { PORFFOR_ARCHIVE_SHA256, PORFFOR_COMMIT_FULL } from "./porffor-toolchain";
 import { version as toolchainPackageVersion } from "@sproutboat/toolchain/package.json" with { type: "json" };
 import { version as cliVersion } from "../package.json" with { type: "json" };
-import { wrapNativeFetchHandler } from "./wrap";
+import { reachesSubtle, wrapNativeFetchHandler } from "./wrap";
 
 export type BuildInput = {
   projectDir: string;
@@ -230,8 +230,13 @@ async function prepareBuild(input: BuildInput) {
     bakedAssets,
     input.transport,
     versionMetadata,
+    // Drop crypto.subtle (about 330 KB, and BearSSL on the link line) from a handler that never names it.
+    "auto",
   );
+  // The broker transport links no BearSSL of its own; a handler that uses crypto.subtle needs it.
+  const subtle = !embedded && reachesSubtle(source.toString());
   return {
+    subtle,
     sourceHash,
     target,
     embedded,
@@ -309,6 +314,7 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
     sourceHash,
     target,
     embedded,
+    subtle,
     host,
     bindings,
     assetDir,
@@ -327,7 +333,7 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
       toolchain: toolchainStamp(),
       toolchainPackageVersion,
       porffor: [PORFFOR_COMMIT_FULL, PORFFOR_ARCHIVE_SHA256],
-      native: embedded ? [sqliteStamp(), bearsslStamp()] : [],
+      native: embedded ? [sqliteStamp(), bearsslStamp()] : subtle ? [bearsslStamp()] : [],
       integration: await integrationIdentity(),
       nativeRestore: input.withRestore ? NATIVE_RESTORE_IDENTITY : null,
     }),
@@ -347,7 +353,7 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
       const zigBin = host ? undefined : await ensureZig();
       const [sqliteObject, tls] = embedded
         ? await Promise.all([ensureSqliteObject({ target, zigBin }), ensureBearssl({ target, zigBin })])
-        : [null, null];
+        : [null, subtle ? await ensureBearssl({ target, zigBin }) : null];
       const unitDir = unitDirFor(input);
       const unitLock = input.generatedPath ? null : await acquireArtifactLock(unitDir);
       try {
@@ -364,7 +370,11 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
           transport: input.transport,
           appName: input.config.name,
           assets: bakedAssets,
-          extraLink: [...(sqliteObject ? [sqliteObject] : []), ...(tls ? tls.objects : [])],
+          // Without TLS (broker), the trust anchors are not wanted: only crypto.subtle uses the library.
+          extraLink: [
+            ...(sqliteObject ? [sqliteObject] : []),
+            ...(tls ? (embedded ? tls.objects : tls.objects.slice(0, -1)) : []),
+          ],
           extraCflags: tls ? ["-I", tls.includeDir] : [],
           optimize: input.optimize,
           versionMetadata,