Remove dead code from C++ bindings, bindgen glue, ast, and orphaned scripts

[robobun]

Net -2001 lines. Every deleted symbol was verified to have zero references across src/, scripts/, packages/, and freshly regenerated build/debug/codegen/ output (including .lut.h tables, GeneratedJS2Native, $cpp/$newCppFunction string lookups, and symbols.txt/.def/.dyn), then validated with a full bun bd build and cargo check on all 10 CI target triples. No file here is touched by any open dead-code PR (checked against #37089, #37062, #37012, #36237, #36115, #35880, #35775, #35437).

C++ bindings

• ncrypto.cpp/h (-524): 33 uncalled methods carried over from the ncrypto port: Cipher::bytesToKey/isCtrMode, the 9 unused AES_{128,192,256}_{CTR,GCM,KW} factories (the CBC trio is live via Cipher::FromName), setFipsEnabled/testFipsEnabled, the secure-heap helpers (SecureAlloc, GetSecureHeapUsed, TryInitSecureHeap, isSecure), X509View::enumUsages/getValidFromTime/getValidToTime, EVPKeyCtxPointer::privateCheck/publicCheck/setRsaImplicitRejection/initForDerive/initForEncrypt, BignumPointer::NewPrime/NewSub/NewLShift/encodePadded/encodePaddedInto, BIOPointer::NewFile/NewSecMem/Printf, hashDigest, X509Pointer::ErrorReason, Ec::getCurve, EVPKeyPointer::derPublicKey, CryptoErrorList::peek_back, plus the private helpers (PortableTimeGM, days_from_epoch) and the 5 named Digest factories (MD5()..SHA512()) those removals orphaned; only Digest::FromName has callers. Review follow-up: also dropped the secure_ field, the bool secure constructor parameters, and the now-unreachable OPENSSL_secure_clear_free branch in reset() that SecureAlloc was the sole producer for.
• DOMJIT IDL helper headers (-312, 5 files): DOMJITIDLTypeFilter.h, DOMJITIDLType.h, DOMJITIDLConvert.h define ~50 template specializations (IDLArgumentTypeFilter, IDLResultTypeFilter, IDLJSArgumentType, DirectConverter) with zero instantiations anywhere; DOMJITHelpers.h declares nothing and DOMJITHelpers.cpp was already an empty stub. Former includers (JSBuffer.cpp, JSPerformance.cpp, generated ZigGeneratedClasses.cpp) now include <JavaScriptCore/FrameTracers.h> directly for JITOperationPrologueCallFrameTracer, which they previously got transitively.
• 13 empty stub files (-56): MessagePortChannel*.{h,cpp}, MessagePortIdentifier.h, BroadcastChannelRegistry.h, JSDOMConvertSerializedScriptValue.h, JSDOMBuiltinConstructorBase.{h,cpp}. Each contains only #pragma once/#include "config.h" and a comment saying it was kept for an earlier cleanup PR's verification mechanics and can be removed later. Nothing includes them.
• ZigGlobalObject.h (-23): 20 accessors with zero callers, including all 8 *SinkPrototype() getters (generated JSSink.cpp calls only the *SinkStructure() variants), bunStdin()/bunStderr()/bunStdout() (callers use the m_bunStdin members directly), worldIsNormal()/offsetOfWorldIsNormal(), and clearDOMGuardedObjects(), a declaration with no definition anywhere. Review follow-up: the orphaned backing fields (m_cachedGlobalProxyStructure, m_JSCryptoKey, m_performMicrotaskVariadicFunction, m_worldIsNormal), their initLater closures and ctor initializers, and jsFunctionPerformMicrotaskVariadic (whose only reference was the removed initLater) are gone too; CryptoKey wrappers use the DOM structure cache, not the lazy property.
• Misc webcore/bindings (-60): BunString::isCrossThreadShareable, NodeValidator::validateArrayBufferView, JSDOMConvertBase::convertResult, both SequenceTraits::reserveEstimated overloads, EventNames::isGamepadEventType (declaration with no definition), the EnumTraits<ExceptionDetails::Type> specialization (isValidEnum has zero hits in the tree), ResourceTiming::overrideInitiatorType, WebSocket::hasNativeCallbacks, the never-invoked hasCallback virtual pair on PerformanceObserverCallback, ScriptExecutionContext::isDocument/isWorkerGlobalScope, and io_darwin_close_machport (both cfg arms; unlike io_darwin_create_machport/io_darwin_schedule_wakeup it has no Rust-side declaration and no caller).

Rust

• jsc/bindgen.rs (-101): the BindgenOptionalRepr trait, BindgenOptionalCustom, BindgenExternalShared, and their three impls form a closed cycle nothing outside the file references; the bindgen codegen emitters (src/codegen/bindgenv2/) never emit these names. Removing them orphaned strong::Optional::adopt, which the workspace dead_code = deny lint then flagged; removed as well.
• runtime/timer/WTFTimer.rs (-10): WTFTimer__runIfImminent (#[no_mangle]). Verified against vendor/: WebKit's RunLoopBun.cpp declares and WebKitCompilerFlags.cmake force-links only the six other WTFTimer__* hooks.
• ast/binding.rs (-39): BindingInit trait, its 4 impls, and Binding::init; all binding construction goes through Binding::alloc or literal struct init.
• ast/runtime.rs (-5): write-only ImportsIteratorEntry.value field (the only iterator consumer reads .key) and two commented-out Zig-era fields.
• runtime/webcore.rs (-2): two flat re-exports (DOMExceptionCode, web_worker) no consumer uses; everything spells the bun_jsc:: path directly.
• ini/lib.rs (-13): commented-out Zig code from the port (syntactically impossible to revive in a Rust file).

Orphaned scripts (-927, 9 files)

Their only invoker, .github/workflows/labeled.yml.disabled, was deleted in #36778 ("disabled Nov 2025, never ran here"): label-issue.ts, read-issue.ts, handle-crash-patterns.ts, is-outdated.ts, associate-issue-with-sentry.ts. Plus nav2readme.ts (imports docs/nav, deleted in #24201, so it cannot even load), buildkite-slow-tests.js (superseded by bun run ci:slowest and the wired update-test-durations pipeline), and check-node.sh/check-node-all.sh (superseded by bun run node:test).

Verification

• bun bd full debug build passes; bun run rust:check-all passes on all 10 triples (10 ok, 0 failed).
• Smoke tests on touched areas pass: test/js/node/crypto/crypto-oneshot.test.ts, crypto-sign-regression.test.ts, test/js/web/timers/performance-entries.test.ts, test/js/bun/sqlite/sqlite.test.js, test/cli/install/npmrc.test.ts (179 tests, 0 fail), plus the full test/internal/source-lints/ suite.
• test/internal/source-lints/dead-symbols-cpp-scripts-bindgen.test.ts pins the removed symbols and deleted files so they do not drift back, following the pattern of earlier sweeps.

Verified-dead but deliberately left for follow-up

• scripts/clippy-loop/ (984 LOC, zero refs) and scripts/find-dead-exports.ts (superseded by hawk): recent manual tooling, may still be invoked by hand.
• src/sql/mysql/protocol/ColumnDefinition41.rs: 12 reference-dead ColumnFlags consts that double as wire-protocol documentation.
• ci-rust-only/ci-link-only build profiles and their ci.ts branches: unreachable from CI since the rust+link lane merge, but still valid manual entry points.

---

[review] gate passed · iteration 0 · 61 files touched

fails on main (without fix)

ASAN without fix: 1 FAILED
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" test/internal/source-lints/dead-symbols-cpp-scripts-bindgen.test.ts
bun test v1.4.0 (15fddf058)

test/internal/source-lints/dead-symbols-cpp-scripts-bindgen.test.ts:
(pass) orphaned scripts and dead C++ headers stay deleted [510.62ms]
(pass) dead ncrypto methods do not reappear [28.72ms]
(pass) dead C++ binding helpers do not reappear [78.52ms]
174 |     // unused flat re-exports; consumers spell bun_jsc:: paths directly
175 |     ["src/runtime/webcore.rs", /pub use bun_jsc::js_error_code::DOMExceptionCode;/],
176 |     ["src/runtime/webcore.rs", /pub use bun_jsc::web_worker;/],
177 |   ];
178 |   const resurrected = checks.filter(([file, re]) => re.test(src(file))).map(([file, re]) => `${file}: ${re.source}`);
179 |   expect(resurrected).toEqual([]);
                            ^
error: expect(received).toEqual(expected)

- []
+ [
+   "src/jsc/bindgen.rs: \bBindgenOptionalRepr\b",
+   "src/jsc/bindgen.rs: \bBindgenOptionalCustom\b",
+   "src/jsc/bindgen.rs: \bBindgenExternalShared\b",
+   "src/jsc/Strong.rs: fn adopt\(handle: Option<N
... (truncated)

release without fix: 1 FAILED
bun test v1.4.0-canary.1 (69a9823c1)

test/internal/source-lints/dead-symbols-cpp-scripts-bindgen.test.ts:
(pass) orphaned scripts and dead C++ headers stay deleted [21.64ms]
(pass) dead ncrypto methods do not reappear [3.64ms]
(pass) dead C++ binding helpers do not reappear [32.82ms]
174 |     // unused flat re-exports; consumers spell bun_jsc:: paths directly
175 |     ["src/runtime/webcore.rs", /pub use bun_jsc::js_error_code::DOMExceptionCode;/],
176 |     ["src/runtime/webcore.rs", /pub use bun_jsc::web_worker;/],
177 |   ];
178 |   const resurrected = checks.filter(([file, re]) => re.test(src(file))).map(([file, re]) => `${file}: ${re.source}`);
179 |   expect(resurrected).toEqual([]);
                            ^
error: expect(received).toEqual(expected)

- []
+ [
+   "src/jsc/bindgen.rs: \bBindgenOptionalRepr\b",
+   "src/jsc/bindgen.rs: \bBindgenOptionalCustom\b",
+   "src/jsc/bindgen.rs: \bBindgenExternalShared\b",
+   "src/jsc/Strong.rs: fn adopt\(handle: Option<NonNull<Impl>>\)",
+   "src/runtime/timer/WTFTimer.rs: \bWTFTimer__runIfImminent\b",
+   "src/ast/binding.rs: \btrait BindingInit\b",
+   "src/runtime/webcore.rs: pub use bun_jsc::js_error_code::
... (truncated)

passes on PR (with fix)

ASAN with fix: all passed
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" test/internal/source-lints/dead-symbols-cpp-scripts-bindgen.test.ts
bun test v1.4.0 (15fddf058)

test/internal/source-lints/dead-symbols-cpp-scripts-bindgen.test.ts:
(pass) orphaned scripts and dead C++ headers stay deleted [502.21ms]
(pass) dead ncrypto methods do not reappear [28.79ms]
(pass) dead C++ binding helpers do not reappear [80.00ms]
(pass) dead Rust symbols do not reappear [15.48ms]

 4 pass
 0 fail
 4 expect() calls
Ran 4 tests across 1 file. [2.63s]
__F:0:S:0

release with fix: all passed
$ bun scripts/build.ts --profile=release
[configured] bun-profile → bun (stripped) in 668ms (unchanged)
ninja: Entering directory `/workspace/bun/build/release'
[1/147] gen JSBuffer.lut.h
Generating /workspace/bun/build/release/codegen/JSBuffer.lut.h from /workspace/bun/src/jsc/bindings/JSBuffer.cpp
[2/147] gen generated_host_exports.rs
generated_host_exports.rs: 92 exports (host=3, lazy=10, generic=79, rust=0); 239 extern-C blocks audited
[3/147] gen ZigGeneratedClasses.{cpp,h,rs}
Found 2 classes from /workspace/bun/src/jsc/resolve_message.classes.ts
  - ResolveMessage (13 fields)
  - BuildMessage (10 fields)
Found 1 classes from /workspace/bun/src/runtime/api/Archive.classes.ts
  - Archive (4 fields, 1 class fields)
Found 2 classes from /workspace/bun/src/runtime/api/BunObject.classes.ts
  - ResourceUsage (8 fields)
  - Subprocess (20 fields)
Found 1 classes from /workspace/bun/src/runtime/api/cron.classes.ts
  - CronJob (5 fields)
Found 3 classes from /workspace/bun/src/runtime/api/filesystem_router.classes.ts
  - FileSystemRouter (5 fields)
  - FrameworkFileSystemRouter (2 fields)
  - MatchedRoute (8 fields)
Found 1 classes from /workspace/bun/src/runtime/api/
... (truncated)

diff hotspot

scripts/associate-issue-with-sentry.ts             |  51 ---
 scripts/buildkite-slow-tests.js                    | 107 -----
 scripts/check-node-all.sh                          |  34 --
 scripts/check-node.sh                              |  41 --
 scripts/handle-crash-patterns.ts                   | 111 ------
 scripts/is-outdated.ts                             |  61 ---
 scripts/label-issue.ts                             | 353 -----------------
 scripts/nav2readme.ts                              | 113 ------
 scripts/read-issue.ts                              |  56 ---
 src/ast/binding.rs                                 |  40 +-
 src/ast/runtime.rs                                 |   6 +-
 src/codegen/generate-classes.ts                    |   5 +-
 src/ini/lib.rs                                     |  17 +-
 src/io/io_darwin.cpp                               |   7 -
 src/js_parser/p.rs                                 |   3 +-
 src/js_printer/lib.rs                              |   2 -
 src/jsc/Strong.rs                                  |  10 -
 src/jsc/bindgen.rs                                 |  96 +----
 src/jsc/bindings/BunObject.cpp                     |   3 -
 src/jsc/bindings/BunString.cpp                     |  18 -
 src/jsc/bindings/BunString.h                       |   1 -
 src/jsc/bindings/JSBuffer.cpp                      |   5 +-
 src/jsc/bindings/JSFFIFunction.cpp                 |   4 -
 src/jsc/bindings/NodeValidator.cpp                 |  13 -
 src/jsc/bindings/NodeValidator.h                   |   1 -
 src/jsc/bindings/ScriptExecutionContext.h          |   2 -
 src/jsc/bindings/ZigGlobalObject.cpp               |  73 ----
 src/jsc/bindings/ZigGlobalObject.h                 |  30 --
 src/jsc/bindings/ncrypto.cpp                       | 437 +--------------------
 src/jsc/bindings/ncrypto.h                         |  90 +----
 src/jsc/bindings/sqlite/JSSQLStatement.cpp         |   4 -
 .../bindings/webcore/BroadcastChannelRegistry.h 
... (truncated)

gate history · 2 passed · 0 rejected · iteration 0

evidence per changed file

file                                    reads  edits  tests
scripts/associate-issue-with-sentry.ts      0      0      0
scripts/buildkite-slow-tests.js             0      0      0
scripts/check-node-all.sh                   0      0      0
scripts/check-node.sh                       0      0      0
scripts/handle-crash-patterns.ts            0      0      0
scripts/is-outdated.ts                      0      0      0
scripts/label-issue.ts                      0      0      0
scripts/nav2readme.ts                       0      0      0
scripts/read-issue.ts                       0      0      0
src/ast/binding.rs                          1      1      0
src/ast/runtime.rs                          1      1      0
src/codegen/generate-classes.ts             1      2      0
src/ini/lib.rs                              1      2      0
src/io/io_darwin.cpp                        1      2      0
src/js_parser/p.rs                          1      1      0
src/js_printer/lib.rs                       1      1      0
(+ 45 more files)

[coderabbitai]

Walkthrough

This pull request removes obsolete scripts, Rust and C++ APIs, WebCore stubs, DOMJIT headers, crypto helpers, runtime hooks, and global-object members. It adds source-lint checks that prevent selected deleted paths and symbols from returning.

Changes

Repository cleanup

Layer / File(s)	Summary
Rust runtime and binding cleanup src/ast/*, src/ini/lib.rs, src/io/io_darwin.cpp, src/js_parser/p.rs, src/js_printer/lib.rs, src/runtime/*	Removes obsolete binding initialization, import iterator values, Darwin Mach-port cleanup, timer callbacks, and runtime re-exports.
Bindgen and string sharing cleanup src/jsc/bindgen.rs, src/jsc/bindings/BunString.*	Removes bespoke optional representations, external-shared adapters, and isCrossThreadShareable.
JavaScriptCore and WebCore binding cleanup src/codegen/generate-classes.ts, src/jsc/bindings/*, src/jsc/bindings/webcore/*	Removes unused validators, global-object members, callback accessors, WebCore APIs, DOMJIT headers, and empty compatibility stubs. Generated includes use FrameTracers.h where required.
ncrypto API reduction src/jsc/bindings/ncrypto.*	Removes legacy secure-memory, FIPS, digest, cipher, BIO, bignum, certificate, and key-context APIs.
Deletion enforcement test/internal/source-lints/dead-symbols-cpp-scripts-bindgen.test.ts	Adds checks for deleted scripts, files, and selected C++, Rust, bindgen, runtime, and ncrypto symbols.

Possibly related PRs

• oven-sh/bun#36390: Removes dead code from overlapping src/jsc/bindings areas.
• oven-sh/bun#36500: Removes dead symbols and adds source-lint protection.
• oven-sh/bun#36756: Removes obsolete WebCore DOMJIT helpers and related symbols.

Suggested reviewers: jarred-sumner

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: removing dead code across bindings, bindgen, AST code, and orphaned scripts.
Description check	✅ Passed	The description explains the changes and provides detailed verification results, including builds, checks, tests, and the new source-lint test.

---

_{Comment @coderabbitai help to get the list of available commands.}

[robobun]

Addressed the review in 15fddf0: completed the DataPointer secure_ cascade in ncrypto, removed the orphaned ZigGlobalObject backing fields plus their initLater closures and jsFunctionPerformMicrotaskVariadic, and fixed the two doc comments that still referenced the deleted Binding::init. Full build, all-triple cargo check, and crypto/webcrypto smoke tests pass after the change. PR is now net -2001 lines.