[robobun]

Net -4,402 lines (172 files, +509 / -4,911). Everything removed has zero references across src/, scripts/, test/, packages/ and the regenerated build/debug/codegen/ output, and the removal builds: removing a Rust or C++ definition that still had a caller fails to compile or link, so a green build is the reference check for those; JS, codegen and manifest removals were additionally grepped by name (including bun:internal-for-testing consumers under test/).

Most of these were first identified by the sweeps that were closed yesterday for merge conflicts (#37272, #37062, #38439, #37089, #38703). This PR re-applies the subset that still applies on current main, minus anything an open PR already deletes and minus small hunks in files that change daily (see "Left out" below), plus a few new finds.

react_compiler (-1,166)

• validate_no_derived_computations_in_effects_exp and its ~22 exclusive helpers/types (~1.1k lines in validation/validate_no_derived_computations_in_effects.rs). The pipeline only ever calls the non-_exp validation; the _exp env-config flag was parsed from fixture pragmas and read by nothing. react-compiler-fixtures.test.ts now lists the two pragmas as ignored instead of handled; the fixture suite still passes.
• SymbolHost (back-compat alias of Host; DESIGN.md updated), HirBox, is_use_state_type, default_true.

C++ bindings (-1,350 across 64 files)

• JSDOMConvertBufferSource.h: the IDL typed-array specializations and toPossiblyShared*Array helpers for every element type no binding converts (only the Uint8Array/ArrayBuffer views are used).
• JSDOMPromiseDeferred.h/.cpp: resolveWithJSValue, resolveWithNewlyCreated, resolveCallbackValueWithNewlyCreated and friends.
• IDLTypes.h: the IDLUnsupportedType family, the IDB / WebGL / ScheduledAction wrappers and stale forward declarations; JSDOMConvertDate.h/.cpp (the only IDLDate converter) deleted along with its two includes. The 8-line IDLDate struct itself stays for now (see "Left out"). JSDOMConvertScheduledAction.h, orphaned in the same way, is already deleted by Remove dead code from C++ webcore headers, src/js, and pretty_format #35775, so it is not touched here.
• NetworkLoadMetrics.h: WebKit networking-stack fields/accessors bun never reads.
• Deleted files: JSWorkerOptions.h/.cpp (JSWorker.cpp builds WorkerOptions by hand), JSMIMEBindings.h/.cpp (createMIMEBinding had no callers; include dropped from ZigGlobalObject.cpp), JSDOMIterator.cpp (addValueIterableMethods).
• ncrypto.h/.cpp: peekError, BignumPointer::isZero, EVPKeyCtxPointer::sign, unused copy/move operator= overloads and an AsymmetricKeyEncodingConfig constructor.
• Smaller: JSDOMOperationReturningPromise.h (call*ReturningOwnPromise), JSDOMAttribute.h (setPassingPropertyName, setStatic), JSDOMGuardedObject (DoNotRegisterWithGlobalObjectTag), Event/EventTarget (resetBeforeDispatch, default-handled flags, isNode()), EventEmitter::{eventTypes,eventListeners}, HTTPHeaderIdentifiers::identifierFor, JSURLPatternResult convertDictionary stubs, PerformanceTiming::monotonicTimeToIntegerMilliseconds, ContextDestructionObserver::protectedScriptExecutionContext, expectedEnumerationValues<CryptoKeyUsage>, BufferSource::mutableData/toBufferSource, BunString__toInt32, BunString::utf8ByteLength, the Ref<StringImpl> overload of toCrossThreadShareable, normalWorld(), TextEncoding(const String&), JSBuffer createBuffer/constructFromEncoding overloads, the JSX509Certificate m_infoAccess lazy property and the non-legacy branch of computeInfoAccess (the prototype getter reads the view directly; x509 tests pass), BakeAdditionsToGlobalObject::wrapComponent, jsFunction_lsanDoLeakCheck, and the dead BunObject+exports.h macro entries (together with the Rust BunObject_callback_nanoseconds export the nanoseconds entry declared; Bun.nanoseconds is functionBunNanoseconds in BunObject.cpp).

install_jsc / install_types / bun:internal-for-testing (-344)

• install_jsc/dependency_jsc.rs and update_request_jsc.rs deleted: their only consumers were the npa / npmTag exports of bun:internal-for-testing, which no test imports. The dispatch_js2native.rs re-exports, the generate-js2native.ts file-map entry and the lsanDoLeakCheck export (tests use isASANEnabled) go with them.
• install_types/lib.rs: the ExternalString / SlicedString / SemverString re-export modules; nothing names those paths (everything imports the types from bun_semver). New in this PR.

node-fallbacks (-400) and codegen (-392)

• util.js: a ~270 line commented-out util.types block.
• package.json / bun.lock / tsconfig.json: dependencies and path mappings nothing imports (esbuild, buffer, events, util, url, process, path-browserify, os-browserify, timers-browserify, tty-browserify, vm-browserify, ...). build-fallbacks.ts marks every builtin name external, and the remaining sources only import the packages still listed; bun install --frozen-lockfile in the directory is a no-op and bundler_browser.test.ts passes.
• src/codegen/generate-unified-source-bundles.rb: WebKit's Ruby generator, superseded by scripts/build/unified.ts; nothing invokes it.

Rust crates (-1,200 across bun_jsc, bun_runtime, css, uws_sys and leaf crates)

• bun_jsc: BuiltinName::get + BUILTIN_NAME_MAP, MarkedArrayBuffer::to_js (the ArrayBuffer::alloc Uint8Array arm and its Bun__allocUint8ArrayForCopy binding are kept, so alloc keeps mirroring create), the __dangerouslySetPtr wrapper js_class_module! emitted into every class, ErrorBuilder::new, TopExceptionScope::new, Task::new, JSCell::to_js, JSGlobalObject::{to_js,ref_,ctx}, job::{on_js_thread,off_thread}, AbortReason impl, JSPromise settle helpers, UUID::ZERO, TagPayload::get.
• bun_runtime: the target_os = "wasi" directory-iterator backend in dir_iterator.rs (no shipped target is wasi and the bun_sys::wasi module it imports does not exist), the Display impls in assert/myers_diff.rs, the non-unix stub and not-macos escapes in fs_events.rs (the file is only compiled on macOS), ArrayBufferSink::to_js, unused re-exports in node.rs / api/bun/spawn.rs / ffi/mod.rs (with abi_type formatters narrowed to pub(crate)), Error::UnableToDecode, MyersDiff::Error::OutOfMemory. The first three are new in this PR.
• css: the inherent eql / to_css / parse forwarders whose callers all go through the CssEql / ToCss / Parse trait impls (values/calc.rs and friends), generics::{implement_eql,parse}, TokenList::parse_with_options, CssString::parse.
• uws_sys: the uws_loop_defer, uws_res_clear_corked_socket, uws_ws_iterate_topics and uws_h3_req_get_parameter C shims plus their Rust declarations and wrappers (Loop::{uncork,wake,next_tick,run}), AnyResponse::init, SocketGroup::is_empty, socket.rs group() accessors and the SocketTcp/SocketTls aliases, Opcode::Close, WindowsLoop.
• leaf crates: windows_sys constants and their bun_sys::windows re-exports, zlib/zlib_sys declarations (deflateInit_, inflateInit_, the gz* file API, legacy type aliases), sha_hmac deprecated-API hashers (SHA512 raw, RIPEMD160, MD5_SHA1, Blake2 evp), wyhash HashInt impls for u16/u64, libarchive commented-out Zig-era callbacks, bun_alloc (AllocError::name, usable_size, BSSList::init), clap::Error::WriteFailed, csrf error variants, pe::Error::{InputIsSigned,InsufficientSpace}, md Setextheader, opaque_mut_nn, cares_sys AddrInfo_hints::is_empty, boringssl_sys constants, errno Mode re-exports, bounded_array::get, string::write::Result, SplitIterator::rest, OutOfRangeValue impls, symbol::Map::init, sql_jsc re-exports.

src/js (-32)

• Unused REPL primordials entries in internal/repl/node-primordials.js; with that gone SafeWeakSet had no importer, so internal/primordials.js stops exporting it (new in this PR). Unused export-object entries in internal/fs/watch.ts and internal/readline/interface.js.

scripts (-9)

• glob-sources.ts src/*.c pattern (matched nothing since asan-config.c was deleted), the write-only BUN_DEP_* defines in depVersionsHeader.ts, the unread kqueue config field.

Verification

• bun bd (full debug build) passes.
• bun run rust:check-all: all 11 target triples ok (covers the windows/darwin-only removals in windows_sys, sys/windows, zlib_sys/win32.rs, fs_events.rs, windows-shim).
• cargo fmt --check, cargo clippy --workspace, clang-format on every touched C++ file, prettier, and bun run lint are clean.
• All of test/internal/source-lints/ (including the new dead-symbols-react-compiler-webcore-idl-misc.test.ts that guards these symbols, and dead-code-escapes against the updated dead-code-escape-limits.json), react-compiler-fixtures.test.ts, bundler_browser.test.ts, css, cryptohasher/hash, node:assert, zlib, url, events, websocket, inspect and x509 tests pass. serve.test.ts has the same 4 failures as the unmodified release build in this container (IPv6 / root port range), nothing else.

Left out on purpose (follow-up candidates)

• The pre-engine inbound path in h2_frame_parser.rs (~2.2k lines, still dead, Remove dead code from react_compiler and the node:http2 frame parser #37272's diff still applies cleanly): the file has had 15 commits in the last two weeks, so it is better landed on its own.
• Deletions already owned by open PRs: simdutf wrappers (simdutf: make the convert wrappers unsafe fn, delete the unused ones; replace unpaired surrogates in convert_utf16_to_utf8_in_buffer #38958), getStackTraceForThrownValue (Error.prepareStackTrace: index source URLs by visible frame, not by JSC frame #37450), validateOneOf (node: render native validateOneOf errors like Node and type-check vm microtaskMode #38401), the redis error variants (redis: harden connection lifecycle (Handshake enum, promise-settlement fixes, -1251 LOC) #34829), URL::from_js (Fold CppWebSocketRef onto ForeignRef with a release marker #33889 / jsc: free owned FFI allocations when the post-call trap check returns Err #34577), schema::api re-exports (Delete the schema::api mirror types and bun_api; one loader numbering across Rust/C++/JS #37095), FsPath (Remove the undispatched LoaderHooks::resolve hook #39327), NodeJSFS Null impl (node:fs: accessSync() returns undefined, promises.access() resolves to undefined, symlink callback gets null #38065), the deprecated selector to_css (css: eliminate all unreachable!() via type-level hardening #33332).
• Small hunks in high-churn files (bindings.cpp, ZigGlobalObject.cpp, Blob.rs, streams.rs, BunProcess.cpp, the ManifestLoad::LoadFromMemory parameter across src/install, the watcher loader parameter), and the #[no_mangle] statics (Zig_ErrorCode*, Bun__versions_*) nothing on the C++ side reads.
• VM::has_termination_request and its JSC__VM__hasTerminationRequest shim in bindings.cpp: a dead pair, kept intact here because bindings.cpp is the most actively edited file in the tree; both halves go together in a follow-up.
• IDLDate in IDLTypes.h: its only converter is deleted here, but the struct itself is left in place so this PR's file deletions stay independent of the header edits; removing the struct is a one-hunk follow-up once the converter files are gone.
• Found but not removed here: the windows shim's ReadWithoutLaunch mode (~110 lines, overlaps install(windows): store bin-link metadata in :bunx NTFS stream instead of .bunx sidecar #36200), node_quic_binding.rs constants JS never destructures (~35 lines), the native NodeJSFS.unwatchFile / FSWatcher.hasRef / QuicSession.silentClose / QuicEndpoint.ref bindings JS never calls, never-constructed bun_install::Error variants, and ~160 lines of $-declarations in src/js/builtins.d.ts with no users.

---

[review] gate passed · iteration 1 · 172 files touched

fails on main (without fix)

ASAN without fix: 10 failed, 320 skipped
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" test/bundler/transpiler/react-compiler-fixtures.test.ts test/internal/source-lints/dead-symbols-react-compiler-webcore-idl-misc.test.ts
bun test v1.4.0 (8326d1bd3)

test/internal/source-lints/dead-symbols-react-compiler-webcore-idl-misc.test.ts:
88 |     // Arena box alias with zero uses (HirVec is the one HIR actually uses).
89 |     ["src/react_compiler/hir/mod.rs", /\bHirBox\b/],
90 |     // Type predicate whose only callers were in the removed _exp validation.
91 |     ["src/react_compiler/hir/mod.rs", /\bis_use_state_type\b/],
92 |   ];
93 |   expect(resurrected(checks)).toEqual([]);
                                   ^
error: expect(received).toEqual(expected)

- []
+ [
+   "src/react_compiler/validation/validate_no_derived_computations_in_effects.rs: validate_no_derived_computations_in_effects_exp",
+   "src/react_compiler/hir/environment_config.rs: validate_no_derived_computations_in_effects_exp",
+   "src/react_compiler/program.rs: validate_no_derived_computations_in_effects_exp",
+   "src/react_compiler/program.rs: \bSymbolHo
... (truncated)

release without fix: 10 failed, 1146 skipped
bun test v1.4.0-canary.1 (21a4206cb)

test/internal/source-lints/dead-symbols-react-compiler-webcore-idl-misc.test.ts:
88 |     // Arena box alias with zero uses (HirVec is the one HIR actually uses).
89 |     ["src/react_compiler/hir/mod.rs", /\bHirBox\b/],
90 |     // Type predicate whose only callers were in the removed _exp validation.
91 |     ["src/react_compiler/hir/mod.rs", /\bis_use_state_type\b/],
92 |   ];
93 |   expect(resurrected(checks)).toEqual([]);
                                   ^
error: expect(received).toEqual(expected)

- []
+ [
+   "src/react_compiler/validation/validate_no_derived_computations_in_effects.rs: validate_no_derived_computations_in_effects_exp",
+   "src/react_compiler/hir/environment_config.rs: validate_no_derived_computations_in_effects_exp",
+   "src/react_compiler/program.rs: validate_no_derived_computations_in_effects_exp",
+   "src/react_compiler/program.rs: \bSymbolHost\b",
+   "src/react_compiler/lib.rs: \bSymbolHost\b",
+   "src/react_compiler/hir/mod.rs: \bHirBox\b",
+   "src/react_compiler/hir/mod.rs: \bis_use_state_type\b",
+ ]

- Expected  - 1
+ Received  + 9

      at <anonymous> (/workspace/bun/test/internal/source
... (truncated)

passes on PR (with fix)

ASAN with fix: 320 skipped
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" test/bundler/transpiler/react-compiler-fixtures.test.ts test/internal/source-lints/dead-symbols-react-compiler-webcore-idl-misc.test.ts
bun test v1.4.0 (8326d1bd3)

test/internal/source-lints/dead-symbols-react-compiler-webcore-idl-misc.test.ts:
(pass) dead react_compiler symbols do not reappear [21.23ms]
(pass) dead exe_format symbols do not reappear [2.63ms]
(pass) dead bun_core / bun_alloc / bun_ast / bun_ptr items do not reappear [18.66ms]
(pass) dead bun_css items do not reappear [21.91ms]
(pass) dead bun_jsc items do not reappear [20.67ms]
(pass) dead FFI-crate items do not reappear [30.81ms]
(pass) dead Rust symbols (install, webcore, jsc, leaf crates) do not reappear [18.03ms]
(pass) unused re-export names do not reappear [12.35ms]
(pass) stale build-script entries do not reappear [6.80ms]
(pass) dead Rust FFI wrappers and trait methods do not reappear [22.18ms]
(pass) dead C++ binding helpers do not reappear [99.82ms]
(pass) dead WebCore / IDL binding code does not reappear [114.33ms]
(pass) dead code in install_jsc, install_t
... (truncated)

release with fix: 1146 skipped
$ bun scripts/build.ts --profile=release
[configured] bun-profile → bun (stripped) in 641ms (unchanged)
ninja: Entering directory `/workspace/bun/build/release'
[1/130] install /workspace/bun/src/node-fallbacks
bun install v1.4.0-canary.1 (21a4206cb)

Checked 111 installs across 104 packages (no changes) [3.00ms]
[2/130] gen node-fallbacks/react-refresh.js
Bundled 1 module in 5ms

  react-refresh.js  4.81 KB  (entry point)

[3/130] gen JSBuffer.lut.h
Generating /workspace/bun/build/release/codegen/JSBuffer.lut.h from /workspace/bun/src/jsc/bindings/JSBuffer.cpp
[4/130] gen generated_host_exports.rs
generated_host_exports.rs: 92 exports (host=3, lazy=10, generic=79, rust=0); 241 extern-C blocks audited
[5/130] gen node-fallbacks/*.js
[6/130] gen cpp.rs (cppbind)
[7/130] gen JS modules (bundle-modules)
Preprocess modules (7887ms)
Bundle modules (42ms)
Postprocesss modules (259ms)
Bundle Functions (695ms)
Generate Code (32ms)

[8.94s] Bundled "src/js" for production
  2630 kb
  197 internal modules
  13 native modules
  91 internal functions across 17 files
[7/129] cargo bun_bin → libbun_rust.a (--target x86_64-unknown-linux-gnu)

  nightly-2026-07-20-x86_64-unknow
... (truncated)

diff hotspot

scripts/build/config.ts                            |    4 -
 scripts/build/depVersionsHeader.ts                 |    3 -
 scripts/build/source.ts                            |    2 +-
 scripts/glob-sources.ts                            |    1 -
 src/ast/symbol.rs                                  |    8 -
 src/boringssl_sys/boringssl.rs                     |    8 -
 src/bun_alloc/lib.rs                               |   29 +-
 src/bun_core/bounded_array.rs                      |    8 -
 src/bun_core/fmt.rs                                |   17 -
 src/bun_core/string/immutable.rs                   |    7 -
 src/bun_core/string/mod.rs                         |   11 -
 src/bun_core/string/write.rs                       |    3 -
 src/bun_core/windows_sys.rs                        |    2 +-
 src/cares_sys/c_ares.rs                            |    6 -
 src/clap/error.rs                                  |    9 -
 src/clap/lib.rs                                    |    5 -
 src/codegen/generate-js2native.ts                  |    1 -
 src/codegen/generate-unified-source-bundles.rb     |  392 -------
 src/csrf/lib.rs                                    |    3 -
 src/css/css_parser.rs                              |   19 +-
 src/css/generics.rs                                |   10 -
 src/css/lib.rs                                     |    2 +-
 src/css/properties/custom.rs                       |    8 +-
 src/css/rules/mod.rs                               |    7 +-
 src/css/values/angle.rs                            |    4 -
 src/css/values/calc.rs                             |  132 +--
 src/css/values/css_string.rs                       |    6 -
 src/css/values/time.rs                             |    7 -
 src/css_derive/lib.rs                              |    4 +-
 src/css_jsc/css_internals.rs                       |   11 -
 src/errno/darwin_errno.rs                          |    1 -
 src/errno/freebsd_errno.rs                         |    1 -
 src/errno/linux_
... (truncated)

gate history · 4 passed · 1 rejected · iteration 1

evidence per changed file

file                                reads  edits  tests
scripts/build/config.ts                 0      0      0
scripts/build/depVersionsHeader.ts      0      0      0
scripts/build/source.ts                 0      0      0
scripts/glob-sources.ts                 0      0      0
src/ast/symbol.rs                       0      0      0
src/boringssl_sys/boringssl.rs          0      0      0
src/bun_alloc/lib.rs                    0      0      0
src/bun_core/bounded_array.rs           0      0      0
src/bun_core/fmt.rs                     0      0      0
src/bun_core/string/immutable.rs        0      0      0
src/bun_core/string/mod.rs              0      0      0
src/bun_core/string/write.rs            0      0      0
src/bun_core/windows_sys.rs             0      0      0
src/cares_sys/c_ares.rs                 0      0      0
src/clap/error.rs                       0      0      0
src/clap/lib.rs                         0      0      0
(+ 156 more files)

[robobun]

^{Updated 1:47 PM PT - Aug 17th, 2026}

@Jarred-Sumner, your commit b55ec04 is building: #100151

[claude]

Beyond the two inline nits, I spot-checked the non-pure-deletion hunks: the JSX509Certificate m_infoAccess/computeInfoAccess(legacy) removal is safe — jsX509CertificateGetter_infoAccess in JSX509CertificatePrototype.cpp reads view().getInfoAccess() directly and never touched the lazy property; kRestorePreviousState and FSWatcher remain defined and used internally after their export-object entries were dropped; and SafeMap (unlike SafeWeakSet) still has importers and stays in internal/primordials.js.

Extended reasoning...

This is a 171-file, -4.4k-line dead-code sweep spanning react_compiler, the WebCore/IDL C++ bindings, ncrypto, install_jsc, node-fallbacks, uws_sys, and dozens of leaf Rust crates. The bug-hunting pass surfaced two nits (an orphaned JSDOMConvertScheduledAction.h and a stale test comment), neither with runtime impact. I additionally verified the one hunk that isn't a pure deletion — the JSX509Certificate::computeInfoAccess legacy-parameter collapse — against its remaining caller in JSX509CertificatePrototype.cpp, and confirmed the src/js export-object removals (FSWatcher, kRestorePreviousState, SafeWeakSet) leave the underlying definitions intact for their internal users. Given the breadth (Event bitfield layout, ncrypto move-assignment operators, node-fallbacks lockfile) a human pass is still appropriate; this note just records what was already checked so it isn't re-derived.

[robobun]

Addressed the review in 4870a79:

• react-compiler-fixtures.test.ts: reworded the IGNORED_PRAGMAS comment; the keys are no longer recognized by parse_fixture_pragmas at all, as pointed out.
• JSDOMConvertScheduledAction.h: intentionally not touched here because the open Remove dead code from C++ webcore headers, src/js, and pretty_format #35775 already deletes that file. Removing IDLScheduledAction from IDLTypes.h and deleting the header compose in either order (nothing includes it). Noted in the description.
• zlib_sys: the comment flagged on shared.rs was defending aliases with no users, so the aliases went instead: z_alloc_func, z_free_func, struct_z_stream_s, z_stream_s and internal_state, plus the posix.rs / win32.rs re-export entries that were their only mentions. cargo check --target x86_64-pc-windows-msvc passes.
• ArrayBufferSink.rs: trimmed the ownership comment; the reason the call site uses to_js_unchecked (previously documented on the removed to_js) now lives as a two-line note at that call site.
• The remaining flagged comment hunks only shorten existing comments so they stop describing items this PR deletes; replied on each thread.

Also kept the 8-line IDLDate struct itself (only its converter files are deleted) so the header edits and the file deletions are independent of each other; it is listed as a follow-up in the description.

[robobun]

Rebased onto current main (2bb6919, no conflicts, same diff). The binary-size annotation on the previous build compared this branch against canary #99935, which is #39326 (rust std built without the backtrace symbolizer); the branch predated that commit, so the ~0.5-0.8 MB per-target delta was the missing baseline change rather than anything in this diff. The one test failure (bun-lock.test.ts) passed on retry.

IDLDate staying in IDLTypes.h for now is intentional, see the "Left out on purpose" list in the description and the reply on the thread.

[claude]

I reviewed this PR and didn't find any bugs; the two earlier nits (pragma comment wording, JSDOMConvertScheduledAction.h) and the comment-cop flags have all been addressed, and the IDLDate deferral is called out in the description. Because it's a ~5k-line deletion across 171 files spanning the C++ JSC bindings, ncrypto, uws_sys shims, node-fallbacks lockfile, and a large react_compiler validation removal, a human look would still be worthwhile.

What was reviewed:

• JSX509Certificate m_infoAccess/computeInfoAccess(legacy) removal — the prototype getter reads view().getInfoAccess() directly and both remaining callers passed legacy=true, so the non-legacy branch was dead.
• internal/fs/watch and readline/interface export-object trims — importers only destructure watch/createIgnoreMatcher; kRestorePreviousState is still used internally.
• ncrypto.h move-operator= removals and Event.h bitfield removals — build-verified; no implicit users.
• ArrayBuffer::alloc_typed_array_uninit Uint8Array arm — no callers instantiate that const-generic value.

Extended reasoning...

Overview

This PR removes ~4,900 lines of dead code across 171 files: the ~1.1k-line experimental validate_no_derived_computations_in_effects_exp pass in react_compiler, unused WebCore/IDL binding helpers (typed-array converter specializations, JSDOMPromiseDeferred resolve variants, NetworkLoadMetrics fields, JSWorkerOptions/JSMIMEBindings/JSDOMConvertDate files), install_jsc host functions whose only consumers were unused bun:internal-for-testing exports, ~400 lines of node-fallbacks package.json/lockfile entries and commented-out code, WebKit's Ruby unified-source generator, and a long tail of unused Rust items across bun_jsc, bun_css, uws_sys, zlib_sys, sha_hmac, windows_sys, and leaf crates. A new source-lint test guards against reintroduction.

Security risks

None identified. The removals in ncrypto, boringssl_sys, sha_hmac, and csrf are unused helpers (BignumPointer::isZero, EVPKeyCtxPointer::sign, deprecated raw hasher instantiations, never-constructed error variants) — not changes to any live security path. The JSX509Certificate::computeInfoAccess change collapses a two-branch function to its only-called branch; the prototype getter's behavior is unchanged.

Level of scrutiny

High, due to breadth. Each individual removal is mechanical and compiler-verified (Rust/C++ removals with remaining callers would fail to build; rust:check-all passed all 11 target triples for the platform-gated windows_sys/fs_events/zlib_sys hunks). JS/codegen removals were grepped and I spot-checked the internal/fs/watch, readline/interface, and repl/node-primordials export trims against their importers. The node-fallbacks lockfile prune is the least compiler-verifiable piece, but the description states build-fallbacks.ts externalizes builtin names and bundler_browser.test.ts passes.

Other factors

All prior review feedback on this PR has been addressed or explicitly deferred with rationale (IDLDate and JSDOMConvertScheduledAction.h are noted in "Left out on purpose"). The description is unusually thorough and the verification story (bun bd, rust:check-all, targeted test suites) is strong. However, at 171 files including C++ JSC bindings, ncrypto, uWS C++ shims, and a package lockfile, this exceeds the "simple, mechanical, or obvious" threshold for auto-approval — a maintainer should sign off on a sweep of this scale.

[robobun]

CI is green on the rebased head (2bb6919, build 99949: 179/179 jobs, the only red-then-green entries are retry-passed flakes in install/hot/napi tests this diff does not touch). Against the same canary baseline the binary is now 0 to 32 KB smaller on every target, which confirms the earlier +0.5 MB annotation was the missing #39326 baseline and not this diff.

Ready for a maintainer. For a focused look, the only hunks that are not plain deletions are: the computeInfoAccess legacy-branch collapse in JSX509Certificate.cpp, the abi_type formatters narrowed to pub(crate), and the node-fallbacks package.json / bun.lock / tsconfig trim (verified with bun install --frozen-lockfile in that directory plus bundler_browser.test.ts). Everything else is removal of definitions that the build, rust:check-all on all 11 targets, and the new source lint confirm have no remaining references.

[robobun]

Rebased onto main again (4ddb4e2). One conflict, in src/jsc/VM.rs: #38660 added is_entered() and termination_exception() next to the has_termination_request() wrapper this PR removes; resolved by keeping the new methods and dropping the wrapper, which still has no callers on main. Diff is otherwise unchanged (171 files, -4,911 / +505); full debug build plus the source lints, react-compiler fixtures and the x509 / events / zlib / css / browser-bundler suites pass on the rebased head.

[robobun]

Pushed 21a4206 for the array_buffer.rs review note: the ArrayBuffer::alloc Uint8Array arm and its Bun__allocUint8ArrayForCopy declaration are kept (so alloc keeps mirroring create and the C++ definition keeps its caller); only MarkedArrayBuffer::to_js is removed from that file now. The intermediate push b8719a2 briefly re-added the ten deleted files by mistake and was replaced within a few minutes; 21a4206 is the previous head plus exactly that 8-line restore and one dropped guard entry (171 files, -4,903 / +504).