# System map — evanw/esbuild

> Canonical page: https://codevetter.com/unpack/esbuild/system-map

# System map — evanw/esbuild

Scanned commit f6058f8364fe7ab91ca57a83e02577ed74c9cae4 (2026-08-09). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

The module is github.com/evanw/esbuild. The process entry is cmd/esbuild, which either runs the CLI or a stdin/stdout service. Bundling lives under internal/ and is wrapped by pkg/api. There is no database: inputs are files or stdin, outputs are files, stdout, or in-memory bytes. The JS API in lib/ is compiled into the published npm packages and is not a separate server. Official builds pin Go 1.26.5, keep the language at Go 1.13, and disable cgo.
- go.mod declares module github.com/evanw/esbuild, sets go 1.13 on purpose so old OS toolchains can still build it, and requires only golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8, which the comment says must not be upgraded. — [go.mod#L1-L10](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/go.mod#L1-L10)
- The native entrypoint is main() in cmd/esbuild/main.go. It handles --help, --version (printed from esbuildVersion), hidden --trace/--heap/--cpuprofile/--timing, and --service=<hostVersion>, which must equal the binary version or the process exits 1. — [cmd/esbuild/main.go#L159-L253](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/cmd/esbuild/main.go#L159-L253) [cmd/esbuild/version.go#L1-L3](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/cmd/esbuild/version.go#L1-L3)
- version.txt and cmd/esbuild/version.go both say 0.28.2, matching npm/esbuild/package.json and npm/esbuild-wasm/package.json. — [version.txt](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/version.txt) [cmd/esbuild/version.go#L1-L3](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/cmd/esbuild/version.go#L1-L3) [npm/esbuild/package.json#L2-L4](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/npm/esbuild/package.json#L2-L4) [npm/esbuild-wasm/package.json#L2-L4](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/npm/esbuild-wasm/package.json#L2-L4)
- pkg/api exposes Build, Transform, and Context (Rebuild, Watch, Serve, Cancel, Dispose). pkg/cli.Run and RunWithPlugins invoke the same CLI parser without spawning a child process; ParseBuildOptions, ParseTransformOptions, and ParseServeOptions reuse that parser. — [pkg/api/api.go#L398-L563](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/pkg/api/api.go#L398-L563) [pkg/cli/cli.go#L30-L99](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/pkg/cli/cli.go#L30-L99)
- The bundler pipeline is implemented in internal/bundler.ScanBundle and (*Bundle).Compile. Compile calls a Linker, which production code passes as linker.Link. Docs place both phases in internal/bundler/bundler.go. — [docs/architecture.md#L54-L66](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/docs/architecture.md#L54-L66) [internal/bundler/bundler.go#L1371-L1379](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/internal/bundler/bundler.go#L1371-L1379) [internal/bundler/bundler.go#L3037-L3051](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/internal/bundler/bundler.go#L3037-L3051) [internal/linker/linker.go#L227-L238](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/internal/linker/linker.go#L227-L238)
- Parsing, printing, resolution, and helpers are split across internal/js_parser, internal/js_printer, internal/css_parser, internal/css_printer, internal/resolver, internal/runtime, internal/cache, internal/compat, and internal/config. JS parse entry is js_parser.Parse; CSS parse entry is css_parser.Parse; print entries are js_printer.Print and css_printer.Print. — [internal/js_parser/js_parser.go#L17815-L17837](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/internal/js_parser/js_parser.go#L17815-L17837) [internal/css_parser/css_parser.go#L122](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/internal/css_parser/css_parser.go#L122) [internal/js_printer/js_printer.go#L4969](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/internal/js_printer/js_printer.go#L4969) [internal/css_printer/css_printer.go#L68](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/internal/css_printer/css_printer.go#L68) [internal/resolver/resolver.go#L242](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/internal/resolver/resolver.go#L242)
- File IO goes through internal/fs.FS so tests can mock it and so Yarn PnP zip installs can be overlaid. fs.go documents the abstraction; fs_zip.go wraps an inner FS and treats zip files as directories, including Yarn __virtual__ and $$virtual path segments. — [internal/fs/fs.go#L1-L6](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/internal/fs/fs.go#L1-L6) [internal/fs/fs_zip.go#L1-L33](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/internal/fs/fs_zip.go#L1-L33)
- The Makefile default target builds with CGO_ENABLED=0, -ldflags=-s -w -buildid=, -buildvcs=false, and -trimpath. go.version is 1.26.5. The go-compiler target downloads that Go source and comments out ctxt.buildinfo() so go version ./esbuild does not embed the toolchain version. — [Makefile#L1-L17](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/Makefile#L1-L17) [Makefile#L59-L83](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/Makefile#L59-L83) [go.version](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/go.version)
- make no-filepath fails the build if any Go file under cmd, internal, or pkg imports path/filepath, citing golang.org/issue/43768. CI runs that check on Ubuntu. — [Makefile#L85-L87](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/Makefile#L85-L87) [.github/workflows/ci.yml#L126-L128](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/.github/workflows/ci.yml#L126-L128)
- WebAssembly builds use main_wasm.go under //go:build js && wasm. That file rejects --trace, --heap, and --cpuprofile and sets isServeUnsupported to true, so the dev server is not available in WASM. — [cmd/esbuild/main_wasm.go#L1-L29](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/cmd/esbuild/main_wasm.go#L1-L29) [cmd/esbuild/main.go#L325-L332](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/cmd/esbuild/main.go#L325-L332)
- npm/esbuild postinstall is node install.js. optionalDependencies lists per-OS @esbuild/* packages at 0.28.2, and esbuild.binaryHashes stores sha256 digests of those binaries. esbuild-wasm has no optionalDependencies and points browser at lib/browser.js. — [npm/esbuild/package.json#L9-L47](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/npm/esbuild/package.json#L9-L47) [npm/esbuild/package.json#L49-L73](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/npm/esbuild/package.json#L49-L73) [npm/esbuild-wasm/package.json#L1-L18](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/npm/esbuild-wasm/package.json#L1-L18)
- GitHub Actions workflows are ci.yml (push, PR, dispatch), publish.yml (push to main when version.txt changes), e2e.yml (cron every 6 hours plus dispatch), and validate.yml (tags v* and dispatch running make validate-builds). — [.github/workflows/ci.yml#L1-L8](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/.github/workflows/ci.yml#L1-L8) [.github/workflows/publish.yml#L1-L13](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/.github/workflows/publish.yml#L1-L13) [.github/workflows/e2e.yml#L1-L7](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/.github/workflows/e2e.yml#L1-L7) [.github/workflows/validate.yml#L1-L30](https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/.github/workflows/validate.yml#L1-L30)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)