1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
[]
= "bun_runtime"
# 0.1.1 (2026-08-19): explicit version — breaks workspace inheritance
# so this patch release ships alone. runtime fix batch: atob/btoa binary fidelity, async_hooks promise identity, spawn watch, SC bridge + WHATWG URL parity, premature loop exit fetch teardown.
# 0.1.2 (2026-08-19): stable-channel fix — http_client body handoff via
# bun_core::vec::chan_vec_to_std (Bytes::From needs the std Vec).
= "0.1.13"
= "Bao runtime integration — JS engine + Bun API + event loop"
= true
= true
= "https://github.com/putao520/bao"
[]
= { = "../bao_engine", = "0.1.0" }
= { = "../bao_workflow_host", = "0.1.0" }
= { = "../bao_stealth", = "0.1.0" }
= { = "../bao_boringssl_bridge", = "0.1.0" }
= { = "../boringssl_sys", = "0.1.0" }
= { = "../bao_crypto", = "0.1.0" }
= { = "../bao_cdp_client", = "0.1.0" }
= true
= true
= "0.4"
= "0.2"
= { = "0.38", = ["bundled"] }
= "3"
= "1"
= true
# Package manager (auto-install, lockfile, npm registry)
# @trace STUB-INVENTORY: default product must NOT hard-dep bao_native_stubs.
# Closed-set residual dispatch → product_dispatch_residual.rs; C libs →
# force_link_native_c_libs. RealImpl still only in stubs = residual owner task.
= { = "../install", = "0.1.0" }
# Bun 纯 Rust crate(L0-L3 层,零 JSC 依赖)
= { = "../http", = "0.1.0" }
= { = "../http_types", = "0.1.0" }
= { = "../threading", = "0.1.0" }
= { = "../bun_core", = "0.1.0" }
= { = "../url", = "0.1.0" }
= { = "../uws", = "0.1.0" }
= { = "../uws_sys", = "0.1.0" }
# @trace REQ-ENG-006 [api:Bun.semver.order] — Bun's own semver implementation
# (parse + orderWithoutBuild), the same engine install/resolver use.
= { = "../semver", = "0.1.0" }
# Real owner of liblsquic.a / liblshpack.a — product force_link (not via stubs).
# @trace STUB-INVENTORY: replaces bao_native_stubs::force_c_lib_stubs lsquic leg
= { = "../lsquic_sys", = "0.1.0" }
= { = "../spawn", = "0.1.0" }
= { = "../spawn_sys", = "0.1.0" }
# @trace REQ-BAO-API-018 [dep:bun_shell_parser] — Shell lexer/parser/AST (replaces hand-written shell parsing)
= { = "../shell_parser", = "0.1.0" }
# @trace REQ-BAO-API-018 [dep:bun_alloc] — Arena allocator for bun_shell_parser Lexer/Parser
= { = "../bun_alloc", = "0.1.0" }
= { = "../sys", = "0.1.0" }
= { = "../opaque", = "0.1.0" }
= { = "../picohttp", = "0.1.0" }
= { = "../resolver", = "0.1.0" }
= { = "../ast", = "0.1.0" }
= { = "../event_loop", = "0.1.0" }
= { = "../dns", = "0.1.0" }
= { = "../cares_sys", = "0.1.0" }
= { = "../io", = "0.1.0" }
= { = "../base64", = "0.1.0" }
= { = "../s3_signing", = "0.1.0" }
# @trace REQ-ENG-007 [code:bun_simdutf_sys] — SIMD-accelerated UTF-8/ASCII
# validation for Buffer.isUtf8 / Buffer.isAscii. Replaces the hand-written
# byte-by-byte RFC 3629 DFA in node_buffer.rs with bun_simdutf_sys::validate_*
# (FFI to bun-simdutf.cpp, ~3-10× faster on AVX2/NEON).
= { = "../simdutf_sys", = "0.1.0" }
# @trace REQ-ENG-007 [code:bun_paths] — POSIX path normalization primitives
# for node:path (resolve/normalize/join/relative). Replaces the std::path-
# based helpers in node_path.rs with bun_paths::resolve_path (Zig-parity
# normalize_string / join / join_abs_string).
= { = "../paths", = "0.1.0" }
# @trace REQ-ENG-007 [code:bun_glob] — fs.glob/globSync engine (GlobWalker,
# the Bun-faithful `**`/brace/dot walker). Replaces the hand-written
# glob_walk/glob_match in node_fs.rs which ignored options.cwd entirely.
= { = "../glob", = "0.1.0" }
= true
= true
= true
= { = "../bao_uloop", = "0.1.0" }
= { = "../sha_hmac", = "0.1.0" }
# @trace REQ-BAO-API-010 [dep:bun_hash] — non-cryptographic hash (adler32, xxhash, cityhash, etc.)
= { = "../hash", = "0.1.0" }
# @trace REQ-ENG-006 [dep:bun_wyhash] — Bun.hash default algorithm (std.hash.Wyhash
# final4, seed 0). Same crate the parser/router HashMaps use.
= { = "../wyhash", = "0.1.0" }
# @trace REQ-ENG-006 [dep:bun_parsers] — Bun.TOML.parse / Bun.YAML.parse /
# Bun.JSONC.parse bridge (upstream TOML/YAML/JSON5 Expr-tree parsers; already
# in the dep tree via bun_install).
= true
# @trace REQ-ENG-006 [dep:unicode-width] — Bun.stringWidth per-codepoint
# widths (UAX#11: wide/fullwidth = 2, combining/control = 0). Already in the
# tree via swc_common; bun_core's C++ visible-width FFI has no linked C++
# object in bao, so the Rust crate is the engine here.
= "0.2"
# @trace REQ-BAO-API-010 [dep:crc32fast] — CRC32 via crc32fast (same backend as bun_zlib)
= true
# @trace REQ-ENG-014 [dep:argon2] — password hashing (argon2id/argon2i/argon2d via rust-argon2)
# Workspace key is `rust-argon2` (matches package name); crate name is `argon2`.
= true
# @trace REQ-ENG-014 [dep:bcrypt] — password hashing (bcrypt)
= { = true }
# @trace REQ-ENG-014 [dep:getrandom] — salt generation for password hashing
= { = true }
= "0.4"
= true
= { = "../brotli", = "0.1.0" }
# @trace REQ-ENG-007 [dep:bun_zlib] — node:zlib sync decompress routes through
# the same streaming state machine as the HTTP pipeline (multi-member gzip,
# per-member CRC/ISIZE, node-classified failure reasons).
= { = "../zlib", = "0.1.0" }
# @trace STUB-INVENTORY: real __bun_regex_* for PnpmMatcher (was always-fail noop)
= "1"
[]
= { = "../bao_engine", = "0.1.0" }
= { = "../bao_uloop", = "0.1.0" }
= { = "../bao_cdp", = "0.1.0" }
= { = "../cdp-server", = "0.1.0" }
= "3"
# Bun.build e2e: registers the native bundle driver (full bun_bundler
# pipeline). Dev-only dep — a NORMAL dep would cycle
# (bao_bundler → bun_runtime → bao_bundler); dev-dep cycles are legal and the
# product installs the same driver from bao_cli::run().
= { = "../bao_bundler", = "0.1.0" }
# Do NOT dev-dep bao_native_stubs: product residual + product_native_symbols +
# product_buffered_reader own the closed-set / RealImpl symbols; co-linking
# stubs dual-defs (STUB-INVENTORY dual-def iron rule). Tests force-link via
# bao_uloop / product #[used] anchors only.
# Node.js conformance suite (ported from ~/code/rust/bun/test/js/node/, MIT).
# All integration tests — including the node_conformance/ modules and the
# former explicit targets (fetch_c13_minimal, fetch_e2e_tests,
# bun_build_e2e_tests, fs_watch_events_tests, cluster_pump_loop_tests) — now
# live in the single-harness target `suite` (tests/suite/main.rs). Test-level
# process isolation comes from cargo-nextest (one process per #[test]); use
# `cargo nextest run -p bun_runtime -E 'test(buffer_conformance)'` to scope a
# run. No per-file [[test]] targets are declared anymore.