fix(rivetkit): fix crypto dep in drizzle

[NathanFlurry]

Description

Please include a summary of the changes and the related issue. Please also include relevant motivation and context.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes.

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[NathanFlurry]

• fix(sqlite): stop actors on head fence mismatch #4977
• fix(rivetkit): fix crypto dep in drizzle #4972 👈 (View in Graphite)
• refactor(depot-client): split embedded depot transport #4970 : 1 other dependent PR (#4971 )
• fix(rivetkit): decode legacy v4 actor schedule args #4976
• fix(engine): install rustls provider with pools #4975
• fix(rivetkit): defer initialized persist until state exists #4974
• test(rivetkit): cover failed preflight disconnect handling #4973
• fix(rivetkit): hide pending connections during preflight #4969
• WIP: more fuzz tests #4962
• fix(rivetkit): wrap onMigrate in savepoints #4960 : 1 other dependent PR (#4963 )
• fix(pegboard): align drain grace defaults with stop threshold #4958 : 1 other dependent PR (#4966 )
• fix(rivetkit): preserve bridge error messages #4959
• fix(rivetkit): fire abort signal on shutdown finalize #4957
• fix(rivetkit): use startup kv preload #4956
• fix(client): flatten skipReadyWait option #4955
• ci(publish): add manual preview publish flow #4954
• fix(depot): add ltx decode diagnostics #4953
• fix(universaldb): preserve plain set values #4952
• fix(universaldb): align versionstamp operand encoding #4951
• fix(rivetkit): export database provider types #4950
• wip: kitchen sink agentic loop finish #4949
• chore(rivetkit): note duplicate admission logic #4948
• test(rivetkit): cover bypass fetch header forwarding #4947
• feat(kitchen-sink): add actor probe controls #4946
• fix(gateway): split actor response wait errors #4945
• fix(guard): handle bypass preflight before query parse #4944
• feat(kitchen-sink): add mock agent event log copy #4943
• fix(kitchen-sink): default mock agent to local endpoint #4942
• test(rivetkit): enable driver lifecycle regressions #4941
• test(rivetkit): verify cached websocket db refs exceed grace #4940
• fix(rivetkit-core): keep sleeping actors reachable during grace #4939
• test(rivetkit): cover async websocket close db access #4938
• fix(rivetkit): keep actors awake until keepAwake work finishes #4937
• fix(rivetkit): persist native onSleep state on errors #4936
• fix(rivetkit-core): allow dispatch during sleep grace #4935
• fix(rivetkit): make duplicate sleep requests idempotent #4934
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[claude]

PR Review: fix(rivetkit): fix crypto dep in drizzle

Overview

This PR replaces Node.js-specific crypto.createHash used in Drizzle migration hashing with the cross-platform Web Crypto API (globalThis.crypto.subtle), and adds the missing importNodeDependencies() call before getNodeFsSync() in the runtime static-dir path.

Correctness

1. Hash compatibility: The old implementation used crypto.createHash with SHA-256 and UTF-8 encoding; the new implementation uses TextEncoder which is also UTF-8. This produces identical hex output, so existing __drizzle_migrations rows will not break on upgrade.

2. importNodeDependencies placement: This fixes a pre-existing bug where getNodeFsSync() would throw because importNodeDependencies() was never called. The function guards on nodeFsSync !== undefined, so without the prior call it would fail at runtime.

3. Async change: sha256Hex is now async while createHash was sync. The await is correctly propagated. ExecuteFunction accepts variadic ...args: unknown[] so the two-argument form (hash, entry.when) is correctly typed.

Issues and Suggestions

1. Missing tests for sha256Hex: No unit test verifies known-vector output or that it matches the old createHash path. A test with a fixed input and expected SHA-256 hex string would provide a regression guard.

2. Error message in sha256Hex guard could be more actionable: Consider adding context such as "available in Node >= 15, Bun, Deno, and modern browsers" so developers know what runtime upgrade is needed.

3. Single importNodeDependencies call site: There is now only one call site in the codebase. Future Node-dependent paths added without it will fail at runtime rather than at startup, making the failure harder to diagnose.

Minor

sha256Hex has no comment explaining why Web Crypto was chosen over Node crypto. A brief inline note such as // Use Web Crypto for cross-runtime compatibility would help future contributors understand the intent.

Summary

The fix is correct. The main follow-up is a unit test for sha256Hex. The importNodeDependencies addition fixes a genuine pre-existing bug and is a welcome improvement.