CodeVetter · Repo Unpack · Feature catalog
oven-sh/bun
User-facing surface splits four ways: the CLI subcommand table, the `Bun` global namespace, the Node.js compatibility layer, and Web APIs. The CLI covers running scripts, package management (install/add/update/remove/link/patch/publish/audit/why/dedupe/prune/outdated), bundling (`bun build`, including `--compile` standalone executables), testing (`bun test`), a REPL, `bunx`, `bun init`/`bun create`, and self-upgrade. The `Bun` global is defined by a JSC hash table in `BunObject.cpp` exposing ~100 properties — `Bun.serve`, `Bun.file`, `Bun.write`, `Bun.spawn`, `Bun.build`, `Bun.sql`, `Bun.redis`, `Bun.s3`, `Bun.secrets`, `Bun.CSRF`, `Bun.$` shell, FFI, and hashing/compression helpers. Node compatibility is implemented per-module across `src/js/node/*.ts` and `src/runtime/node/*.rs`. Bake (`src/runtime/bake/`) adds a hot-reloading dev server and server-components framework toolkit on top of the bundler and `Bun.serve`.
- The CLI exposes 34 dispatchable commands including `run`, `test`, `build`, `install`, `add`, `update`, `remove`, `link`/`unlink`, `patch`/`patch-commit`, `outdated`, `update --interactive`, `publish`, `audit`, `why`, `dedupe`, `prune`, `pm`, `x` (bunx), `repl`, `exec`, `init`, `create`, `upgrade`, and a `fuzzilli` fuzzing entry point.
- `bun pm` is itself a subcommand hub with its own verbs — `pm ls`, `pm why`, `pm view`, `pm pkg`, `pm licenses`, `pm trust`/`untrusted`/`default-trusted`, `pm version`, and a `pm diff` implementation split across five files (`pm_diff_command.rs`, `pm_diff_semantic.rs`, `pm_diff_normalize.rs`, `pm_diff_relayout.rs`, `pm_diff_profile.rs`).
- The `Bun` global's full property list is a JSC static hash table in `BunObject.cpp`, including `serve`, `file`, `write`, `spawn`/`spawnSync`, `build`, `listen`/`connect`/`udpSocket`, `password`, `hash`, `which`, `mmap`, `inspect`, `peek`, `plugin`, `Transpiler`, `embeddedFiles`, `randomUUIDv5`/`v7`, `stringWidth`/`stripANSI`/`wrapAnsi`, and `generateHeapSnapshot`.
- Data-format parsers are exposed as lazily constructed `Bun` properties: `Bun.TOML`, `Bun.YAML`, `Bun.XML`, `Bun.JSON5`, `Bun.JSONC`, `Bun.JSONL`, and `Bun.markdown`, backed by dedicated Rust objects.
- `Bun.serve()` is implemented as a const-generic `NewServer<SSL, DEBUG>` monomorphized four ways (HTTP/HTTPS × normal/debug) over uWebSockets, with per-request state in a 4,794-line `RequestContext.rs` that also handles WebSocket upgrades, range requests, and cookie maps.
- Bake is a dev-server + SSR framework toolkit that attaches to `Bun.serve`, holds all build state in memory with an incremental graph, and is explicitly designed as infrastructure for frameworks rather than being a framework itself; it ships a React framework (`src/runtime/bake/bun-framework-react`) and an HMR client runtime.
- `bun build --compile` produces standalone executables by appending a `bun_standalone_graph::Graph` to the binary; boot takes a dedicated `#[cold]` path that splices `compile_exec_argv` and `BUN_OPTIONS` into argv before handing off to `RunCommand::boot_standalone`.
- The test runner is a Jest-compatible implementation in `src/runtime/test_runner/` with `expect` matchers, snapshot support, structured diffing, and a `CommandLineReporter` driven from `test_command.rs::run_all_tests`.
- Node.js compatibility is implemented module-by-module in TypeScript (`src/js/node/` — `fs`, `http`, `http2`, `net`, `tls`, `dgram`, `cluster`, `worker_threads`, `vm`, `quic`, `wasi`, `inspector`, `domain`, `trace_events`) with native bindings alongside in `src/runtime/node/` (`node_fs.rs` is the second-largest Rust file in the repo).
- Web/platform APIs live in `src/runtime/webcore/`: `fetch`, `Request`/`Response`, `Blob`, `FormData`, `ReadableStream` and sinks, `TextEncoder`/`TextDecoder`, `CompressionStream`, `CookieMap`, `FileReader`, `Crypto`, and an `ObjectURLRegistry`.
- `bun:ffi` compiles C at runtime via a vendored TinyCC (`bun_tcc_sys::State`), exposing `cc`, `linkSymbols`, `dlopen`, and JS callbacks, with bundled stdlib headers shipped as source files next to the implementation.
- `Bun.secrets` is an OS-keychain integration with three platform backends — macOS Keychain, Linux libsecret, and Windows Credential Manager — behind one JS object.
- `Bun.$` shell is a full cross-platform shell implementation with its own parser (`src/shell_parser/`), brace expansion, an interpreter state machine, and built-in commands so scripts don't depend on a system shell.
- There is an experimental `Bun.WebView` API with native backends — a WebKit backend, a Chrome backend driven over an IPC protocol, and a separate host process.
- `bun install` supports two linker strategies selected by `NodeLinker` — classic hoisted installs (`hoisted_install.rs`) and pnpm-style isolated store installs (`isolated_install/`) — plus patching, catalogs, workspaces, and transitive update planning.