# Feature catalog — oven-sh/bun

> Canonical page: https://codevetter.com/unpack/bun/feature-catalog

# Feature catalog — oven-sh/bun

Scanned commit bf80d21c69c355f6e5bae2749485674663ed13a1 (2026-09-22). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

User-facing surface splits four ways: the CLI subcommand table, the `Bun` global namespace, the Node.js compatibility layer, and Web APIs. The CLI covers running scripts, package management (install/add/update/remove/link/patch/publish/audit/why/dedupe/prune/outdated), bundling (`bun build`, including `--compile` standalone executables), testing (`bun test`), a REPL, `bunx`, `bun init`/`bun create`, and self-upgrade. The `Bun` global is defined by a JSC hash table in `BunObject.cpp` exposing ~100 properties — `Bun.serve`, `Bun.file`, `Bun.write`, `Bun.spawn`, `Bun.build`, `Bun.sql`, `Bun.redis`, `Bun.s3`, `Bun.secrets`, `Bun.CSRF`, `Bun.$` shell, FFI, and hashing/compression helpers. Node compatibility is implemented per-module across `src/js/node/*.ts` and `src/runtime/node/*.rs`. Bake (`src/runtime/bake/`) adds a hot-reloading dev server and server-components framework toolkit on top of the bundler and `Bun.serve`.
- The CLI exposes 34 dispatchable commands including `run`, `test`, `build`, `install`, `add`, `update`, `remove`, `link`/`unlink`, `patch`/`patch-commit`, `outdated`, `update --interactive`, `publish`, `audit`, `why`, `dedupe`, `prune`, `pm`, `x` (bunx), `repl`, `exec`, `init`, `create`, `upgrade`, and a `fuzzilli` fuzzing entry point. — [src/options_types/command_tag.rs#L12-48](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/options_types/command_tag.rs#L12-L48) [src/runtime/cli/mod.rs#L1286-1320](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/cli/mod.rs#L1286-L1320)
- `bun pm` is itself a subcommand hub with its own verbs — `pm ls`, `pm why`, `pm view`, `pm pkg`, `pm licenses`, `pm trust`/`untrusted`/`default-trusted`, `pm version`, and a `pm diff` implementation split across five files (`pm_diff_command.rs`, `pm_diff_semantic.rs`, `pm_diff_normalize.rs`, `pm_diff_relayout.rs`, `pm_diff_profile.rs`). — [src/install/PackageManager.rs#L130-170](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/install/PackageManager.rs#L130-L170) [src/runtime/cli/pm_diff_semantic.rs](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/cli/pm_diff_semantic.rs) [src/runtime/cli/pm_licenses_command.rs](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/cli/pm_licenses_command.rs)
- The `Bun` global's full property list is a JSC static hash table in `BunObject.cpp`, including `serve`, `file`, `write`, `spawn`/`spawnSync`, `build`, `listen`/`connect`/`udpSocket`, `password`, `hash`, `which`, `mmap`, `inspect`, `peek`, `plugin`, `Transpiler`, `embeddedFiles`, `randomUUIDv5`/`v7`, `stringWidth`/`stripANSI`/`wrapAnsi`, and `generateHeapSnapshot`. — [src/jsc/bindings/BunObject.cpp#L930-1030](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/jsc/bindings/BunObject.cpp#L930-L1030)
- Data-format parsers are exposed as lazily constructed `Bun` properties: `Bun.TOML`, `Bun.YAML`, `Bun.XML`, `Bun.JSON5`, `Bun.JSONC`, `Bun.JSONL`, and `Bun.markdown`, backed by dedicated Rust objects. — [src/jsc/bindings/BunObject.cpp#L938-945](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/jsc/bindings/BunObject.cpp#L938-L945) [src/runtime/api/TOMLObject.rs](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/api/TOMLObject.rs) [src/runtime/api/YAMLObject.rs](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/api/YAMLObject.rs) [src/parsers/yaml.rs](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/parsers/yaml.rs)
- `Bun.serve()` is implemented as a const-generic `NewServer<SSL, DEBUG>` monomorphized four ways (HTTP/HTTPS × normal/debug) over uWebSockets, with per-request state in a 4,794-line `RequestContext.rs` that also handles WebSocket upgrades, range requests, and cookie maps. — [src/runtime/server/mod.rs#L1-60](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/server/mod.rs#L1-L60) [src/runtime/server/RequestContext.rs#L1-45](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/server/RequestContext.rs#L1-L45)
- Bake is a dev-server + SSR framework toolkit that attaches to `Bun.serve`, holds all build state in memory with an incremental graph, and is explicitly designed as infrastructure for frameworks rather than being a framework itself; it ships a React framework (`src/runtime/bake/bun-framework-react`) and an HMR client runtime. — [src/runtime/bake/mod.rs#L1-10](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/bake/mod.rs#L1-L10) [src/runtime/bake/DevServer.rs#L1-12](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/bake/DevServer.rs#L1-L12) [src/runtime/bake/hmr-runtime-client.ts](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/bake/hmr-runtime-client.ts)
- `bun build --compile` produces standalone executables by appending a `bun_standalone_graph::Graph` to the binary; boot takes a dedicated `#[cold]` path that splices `compile_exec_argv` and `BUN_OPTIONS` into argv before handing off to `RunCommand::boot_standalone`. — [src/runtime/cli/mod.rs#L1330-1410](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/cli/mod.rs#L1330-L1410) [src/standalone_graph](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/standalone_graph)
- The test runner is a Jest-compatible implementation in `src/runtime/test_runner/` with `expect` matchers, snapshot support, structured diffing, and a `CommandLineReporter` driven from `test_command.rs::run_all_tests`. — [src/runtime/test_runner/expect.rs](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/test_runner/expect.rs) [src/runtime/test_runner/snapshot.rs](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/test_runner/snapshot.rs) [src/runtime/cli/test_command.rs#L2724-2760](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/cli/test_command.rs#L2724-L2760)
- Node.js compatibility is implemented module-by-module in TypeScript (`src/js/node/` — `fs`, `http`, `http2`, `net`, `tls`, `dgram`, `cluster`, `worker_threads`, `vm`, `quic`, `wasi`, `inspector`, `domain`, `trace_events`) with native bindings alongside in `src/runtime/node/` (`node_fs.rs` is the second-largest Rust file in the repo). — [src/js/node/http2.ts](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/js/node/http2.ts) [src/js/node/quic.ts](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/js/node/quic.ts) [src/runtime/node/node_fs.rs](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/node/node_fs.rs) [src/runtime/node/node_crypto_binding.rs](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/node/node_crypto_binding.rs)
- Web/platform APIs live in `src/runtime/webcore/`: `fetch`, `Request`/`Response`, `Blob`, `FormData`, `ReadableStream` and sinks, `TextEncoder`/`TextDecoder`, `CompressionStream`, `CookieMap`, `FileReader`, `Crypto`, and an `ObjectURLRegistry`. — [src/runtime/webcore/fetch.rs](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/webcore/fetch.rs) [src/runtime/webcore/streams.rs](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/webcore/streams.rs) [src/runtime/webcore/CookieMap.rs](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/webcore/CookieMap.rs) [src/runtime/webcore/ObjectURLRegistry.rs](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/webcore/ObjectURLRegistry.rs)
- `bun:ffi` compiles C at runtime via a vendored TinyCC (`bun_tcc_sys::State`), exposing `cc`, `linkSymbols`, `dlopen`, and JS callbacks, with bundled stdlib headers shipped as source files next to the implementation. — [src/runtime/ffi/mod.rs#L1-25](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/ffi/mod.rs#L1-L25) [src/runtime/ffi/ffi_body.rs](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/ffi/ffi_body.rs) [src/runtime/ffi/FFI.h](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/ffi/FFI.h)
- `Bun.secrets` is an OS-keychain integration with three platform backends — macOS Keychain, Linux libsecret, and Windows Credential Manager — behind one JS object. — [src/jsc/JSSecrets.rs](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/jsc/JSSecrets.rs) [src/jsc/bindings/SecretsDarwin.cpp](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/jsc/bindings/SecretsDarwin.cpp) [src/jsc/bindings/SecretsLinux.cpp](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/jsc/bindings/SecretsLinux.cpp) [src/jsc/bindings/SecretsWindows.cpp](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/jsc/bindings/SecretsWindows.cpp)
- `Bun.$` shell is a full cross-platform shell implementation with its own parser (`src/shell_parser/`), brace expansion, an interpreter state machine, and built-in commands so scripts don't depend on a system shell. — [src/shell_parser/parse.rs](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/shell_parser/parse.rs) [src/shell_parser/braces.rs](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/shell_parser/braces.rs) [src/runtime/shell/interpreter.rs](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/shell/interpreter.rs) [src/runtime/shell/builtin](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/shell/builtin)
- There is an experimental `Bun.WebView` API with native backends — a WebKit backend, a Chrome backend driven over an IPC protocol, and a separate host process. — [src/runtime/webview/WebKitBackend.cpp](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/webview/WebKitBackend.cpp) [src/runtime/webview/ChromeBackend.cpp](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/webview/ChromeBackend.cpp) [src/runtime/webview/ipc_protocol.h](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/runtime/webview/ipc_protocol.h) [src/jsc/bindings/BunObject.cpp#L1026](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/jsc/bindings/BunObject.cpp#L1026)
- `bun install` supports two linker strategies selected by `NodeLinker` — classic hoisted installs (`hoisted_install.rs`) and pnpm-style isolated store installs (`isolated_install/`) — plus patching, catalogs, workspaces, and transitive update planning. — [src/install/hoisted_install.rs](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/install/hoisted_install.rs) [src/install/isolated_install.rs](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/install/isolated_install.rs) [src/install/PackageManager/install_with_manager.rs#L29-48](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/install/PackageManager/install_with_manager.rs#L29-L48) [src/install/patch_install.rs](https://github.com/oven-sh/bun/blob/bf80d21c69c355f6e5bae2749485674663ed13a1/src/install/patch_install.rs)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)