Remove dead code from webcrypto, the node:http binding, the class codegen, build scripts, and misc crates - #39249
Conversation
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 35 minutes Limit details: You’ve used all 1 included review currently available under your plan. You completed 69 included PR reviews in the past 7 days; at that activity level, included reviews refill at 1 review per hour. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (65)
Comment |
|
Updated 6:10 PM PT - Aug 15th, 2026
@Jarred-Sumner, your commit c6e13ee is building: |
|
Merged as a42889a (the pinning lint test was dropped before merge; the deletions landed as described above). |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
I reviewed this PR and didn't find any bugs. Because it's a ~2800-line removal across 66 files that touches the live RequestContext::on_abort/set_timeout paths, drops a field from Request, and rewires the class code generator, a human look would still be worthwhile.
What was reviewed:
- Verified none of the removed
internal/http.tsexports are imported by any of the 12 consuming modules; theheadersTuplehit in http2.ts is an unrelated local parameter name. - Traced
assignEventCallback→Request__setInternalEventCallback→internal_event_callback: no remaining setter anywhere insrc/, so the removediec_trigger/iec_deinitcalls inon_abort/finalize_requestwere provably no-ops;set_timeout(0)still callsclear_timeout(). - Confirmed
CssModuleReference::{Local,Global}have no constructors or match arms, the removedConfigfields (androidNdk/androidApiLevel/freebsdVersion) are only read as locals during resolution (thePartialConfiginputs stay), and the droppedversionMacrodeps have noBUN_DEP_*consumer insrc/. - Checked
dgramInternals.isFdAdopted,fsStreamInternals,ObjectSetPrototypeOf(interface.js),$sloppy/$nakedConstructor/OutOfMemoryError, and theLoadertype decl — no live references.
Extended reasoning...
Overview
This PR removes ~2772 lines of dead code across five subsystems: WebCrypto bindings (RSAES-PKCS1-v1_5 gated behind an always-true deprecation flag; ECDSA DER encoding and RSA padding overrides whose only setter was deleted in April 2025), the node:http internal binding (NodeHTTP.cpp host functions and the Rust Request::internal_event_callback cascade whose only JS entry point was never destructured), the class code generator (own/callbacks/accessor/supportsObjectCreate/custom/zigOnly features no .classes.ts file uses, plus the empty .lut.txt→.lut.h build step), build-script helpers in scripts/utils.mjs/runner.node.mjs, and cross-crate-dead Rust items in libuv_sys/cares_sys/bun_sys/css. A 214-line source lint pins every removed symbol.
Security risks
None identified. The WebCrypto changes fold constant conditions (isRSAESPKCSWebCryptoDeprecated() was already unconditionally true) — the resulting NotSupportedError rejections are byte-identical, and the ECDSA/RSA-OAEP/RSA-PSS refactors preserve the behavior their previous constant-default branches produced. No auth, permission, or input-validation code is weakened.
Level of scrutiny
High. While each individual removal is mechanical, the PR modifies live control flow in RequestContext::on_abort and set_timeout (removing calls that were provably no-ops because the callback field was never set), drops a struct field from Request (touching every constructor site), and edits the class code generator whose output feeds every generated JSC binding. The PR description states generated output was diffed byte-for-byte and rust:check-all passes on all 12 targets, and my spot-checks of the reachability claims held, but the breadth (66 files spanning C++/Rust/TS/build scripts) and the fact that several removals are cascades from a single reachability root (assignEventCallback was registered but never destructured → 880 lines across three languages) make this worth a maintainer's eye.
Other factors
The verification section is unusually thorough (build, all-target cargo check, generated-output diff, ~15 test suites, cross-check against 19 open dead-code PRs). The new source-lint test guards against reintroduction. No prior human or bot review has landed on this PR yet. I spot-checked ~15 of the removed symbols against the current tree and found no remaining references; the one apparent hit (isFdAdopted in dgram.ts) is a separate $newRustFunction binding, not an import of the removed internal-for-testing export.
…egen, build scripts, and misc crates WebCrypto: RSAES-PKCS1-v1_5 has been rejected by an unconditional "deprecated" check since 2023, so its encrypt/decrypt/generateKey/importKey/ exportKey overrides, the OpenSSL implementation file and the JSRsaKeyGenParams converter were unreachable; the algorithm stays registered so the error is unchanged. Also drops the ECDSA DER output mode and the RSA PSS/OAEP padding overrides (nothing set them since the old KeyObject.cpp was deleted), an unused MlDsaParams::isolatedCopy, and a few include blocks copied from that file. node:http: internal/http.ts still destructured eight members of the NodeHTTP.cpp binding that no module imports. Removing them makes the host functions behind them (assignHeaders, assignEventCallback, setRequestTimeout, getHeader, setHeader), their header-copying helpers, and the Rust exports they called (Request__getUWSRequest, Request__setInternalEventCallback, Request__setTimeout, NodeHTTPResponse__setTimeout, the two body-value host functions) unreachable. Request__setInternalEventCallback was the only writer of the per-request internal event callback, so that machinery and the RequestContext timeout handler it armed go too. Codegen and build scripts: generate-classes.ts carried template branches for .classes.ts keys no class file uses (own, callbacks, accessor, supportsObjectCreate, custom, zigOnly, defaultValue) plus the ONLY_ZIG and BUN_SILENT env switches nothing sets; generated output is byte-identical apart from the now-empty ZigGeneratedClasses.lut.h include, whose build step is removed as well. bundle-functions.ts loses directives no builtin uses, bake.bind.ts was entirely commented out, and scripts/utils.mjs, runner.node.mjs, glob-sources.ts, flags.ts, config.ts and the dependency version header lose helpers and entries with no readers. Rust: CssModuleReference::Local/Global were never constructed, and a handful of libuv_sys / bun_sys / cares_sys items had no callers on any target. A source lint pins the removed symbols.
d92318c to
7bd9912
Compare
There was a problem hiding this comment.
I reviewed this PR and didn't find any bugs. Given the scope — ~2,800 lines removed across 66 files spanning WebCrypto, the node:http server request lifecycle (RequestContext/Request), the class code generator, and build infrastructure — a human look is still warranted before merging.
What was reviewed:
- Spot-checked the JS→C++→Rust reachability chain for the removed
internal/http.tsbinding members,InternalJSEventCallback, and theRequestContexttimeout-handler cascade — no remaining references insrc/. - Verified
ObjectSetPrototypeOfhas no other importer ofrepl/node-primordialsusing it, and that theheadersTuplehits inhttp2.tsare unrelated local parameter names. - Checked the RSA-OAEP/PSS/ECDSA constant-folding against the removed
padding/encodingfields — the surviving branches match the pre-change defaults.
Extended reasoning...
Overview
This PR removes ~2,772 lines of dead code across 66 files: WebCrypto C++ bindings (the always-rejected RSAES-PKCS1-v1_5 implementation, never-set encoding/padding fields on ECDSA/RSA-PSS/RSA-OAEP params, unused includes), the node:http internal binding (unreferenced createNodeHTTPInternalBinding members and the C++/Rust host functions, Request::internal_event_callback, and the RequestContext timeout-handler machinery only it fed), unused .classes.ts features in generate-classes.ts, unused exports in scripts/utils.mjs/build scripts, and cross-crate-dead Rust items in libuv_sys/css/sys/cares_sys. A 214-line source-lint test pins the removed symbols.
Security risks
The PR touches WebCrypto (RSA-OAEP, RSA-PSS, ECDSA, RSAES-PKCS1-v1_5) and the HTTP server request lifecycle. The crypto edits fold branches whose selector fields were never written (padding defaulted to 0, encoding defaulted to IeeeP1363), so the surviving code paths are the ones that always ran; the RSAES removal is behind an unconditional NotSupportedError that the PR keeps. No security check is weakened that I can see, but crypto changes deserve maintainer eyes.
Level of scrutiny
High. The change is large, crosses three languages plus code generators, and its correctness depends on cross-FFI reachability arguments (JS import graph → C++ host-fn registration → Rust export_name) that the compiler cannot verify. The RequestContext::on_abort change removing the internal_event_callback trigger is a real behavior deletion — the PR argues it has been unreachable since 2024 because nothing sets the callback, and I found no writer, but this is exactly the kind of claim a maintainer familiar with the node:http server rewrite should confirm.
Other factors
The PR description is unusually thorough (byte-for-byte diff of regenerated codegen output, 12-triple rust:check-all, per-subsystem test runs, cross-check against 19 open dead-code PRs). The bug-hunting system found nothing. My spot checks of the reachability claims (internal/http.ts exports, ObjectSetPrototypeOf importers, CssModuleReference variants, fsStreamInternals in tests) all held. CI is still building. No prior human review on the thread.
There was a problem hiding this comment.
I reviewed this PR and the automated bug-hunt found no issues. Given its breadth — ~2,800 lines removed across 65 files spanning WebCrypto (RSA-OAEP/PSS/ECDSA constant-folding), the node:http binding and its Rust request-context cascade, the class code generator, and Windows-only libuv_sys — a human pass is still worthwhile before merging.
What was reviewed:
- Confirmed no remaining references to the removed
internal/http.tsexports,InternalJSEventCallback/HAS_TIMEOUT_HANDLERcascade, or theRequest__*/NodeHTTPResponse__setTimeoutRust exports. - Verified the removed
CryptoAlgorithmRsaOaepParams::padding/RsaPssParams::padding/EcdsaParams::encodingfields have no writers; the.paddinghits inncrypto.cpp/JSCipher.cppare a different struct. - Checked
fsStreamInternals/isFdAdoptedhave no test consumers,CssModuleReference::{Local,Global}are never constructed, andlibuv_sys::Loop::wakeup/uv_async_sendextern have no Rust callers (the.wakeup()hits elsewhere are onuws_sys::Loop/EventLoop; napi'suv_async_sendre-export goes through the C stub, not this extern).
Extended reasoning...
Overview
This PR removes ~2,772 unreferenced lines across four clusters: WebCrypto bindings (RSAES-PKCS1-v1_5 dead overrides, constant-true feature gates, unused padding/encoding param fields and the branches they guarded), the node:http internal binding (unused $cpp exports, their C++ host functions, and the Rust Request::internal_event_callback / RequestContext::on_timeout cascade they alone reached), the class/builtin code generators (unused .classes.ts keys own/callbacks/accessor/supportsObjectCreate/custom/zigOnly and the .lut.txt build step), build scripts (utils.mjs helpers, versionMacro fields with no header consumer, unmatched glob patterns, LIBUS_USE_BORINGSSL), and misc Rust crates (libuv_sys, css_modules, cares_sys, bun_sys Windows constants). The only non-deletion edits fold now-constant conditions.
Security risks
WebCrypto is directly touched: RSA-OAEP and RSA-PSS padding branches are folded to their sole reachable value, ECDSA's DER branch is dropped, and RSAES-PKCS1-v1_5's method bodies are removed behind an unconditional NotSupportedError. The transformations are behavior-preserving if the removed fields truly had no writer — I grepped and found none outside the deleted code (the .padding hits in ncrypto.cpp are on ncrypto's own params struct, unrelated). Still, constant-folding in crypto padding paths deserves a second pair of eyes.
Level of scrutiny
High. This is not a mechanical change: it spans security-sensitive crypto, the production node:http request path (RequestContext::on_abort loses its iec_trigger call and request_weakref.deref() moves up), a code generator whose output was verified only by the author's byte-diff, and Windows-only libuv_sys items I cannot cross-check on this platform. The PR description is unusually thorough and every spot-check I ran (removed http exports, Rust FFI symbols, param-field writers, CssModuleReference constructors, libuv_sys::Loop::wakeup callers) confirmed its claims, but the sheer surface area and the "delete odd-looking code only after understanding why it was written" review rule make this a case for human review rather than auto-approval.
Other factors
The description states generator output was byte-diffed, rust:check-all passes on all 12 triples, and the relevant test suites pass; a source-lint test pins the removed symbols. The second commit deletes that source-lint test (per the PR title), so the "fails on main / passes here" claim in the description refers to the first commit. Buildkite is still running per the timeline. No prior human or claude[bot] review exists on this PR.
2 participants
Removes 2772 lines that nothing references (136 lines of signature, import and formatting adjustments added, plus a 214-line source lint pinning the removed symbols) across the WebCrypto bindings, the node:http internal binding and the C++/Rust behind it, the class code generator, the build scripts, and four Rust crates. No behavior change.
Problem
WebCrypto (
src/jsc/bindings/webcrypto/, about 560 lines)SubtleCrypto.cpphas hadisRSAESPKCSWebCryptoDeprecated()returningtrueunconditionally since 2023, so every RSAES-PKCS1-v1_5 operation is rejected withNotSupportedErrorbefore the algorithm class is reached. Itsencrypt/decrypt/generateKey/importKey/exportKeyoverrides, the whole ofCryptoAlgorithmRSAES_PKCS1_v1_5OpenSSL.cpp, andJSRsaKeyGenParams.{cpp,h}(whose only caller was the unreachable generateKey branch) were dead.isSafeCurvesEnabled()is the same shape: alwaystrue, one never-taken branch.CryptoAlgorithmEcdsaParams::encoding(DER signatures) and thepaddingfields ofRsaPssParams/RsaOaepParamswere only ever set by the oldsrc/bun.js/bindings/KeyObject.cpp, deleted in April 2025. Since then the DER branches inCryptoAlgorithmECDSAOpenSSL.cpp, the padding branches in the PSS/OAEP OpenSSL files, andplatformEncryptWithHash/platformDecryptWithHashran on constant inputs. The same file left behind theignoreExtAndKeyOpsparameter ofconvertDictionaryToJS(JsonWebKey)(no caller passestrue) and include blocks copied verbatim intonode_crypto_binding.cppandAsymmetricKeyValue.cpp(neither file uses any of them).CryptoAlgorithmMlDsaParams::isolatedCopy()has nocrossThreadCopyinstantiation,CryptoAlgorithm::VoidCallbackhas no user,SubtleCrypto::addAuthenticatedEncryptionWarningIfNecessaryis an empty body with two calls, andCryptoKey.cpp/CryptoAlgorithmX25519.cppcarried includes nothing in the file uses.node:http binding (
src/js/internal/http.ts,NodeHTTP.cpp, and the Rust it reached, about 880 lines)internal/http.tsdestructures the object returned bycreateNodeHTTPInternalBindingand re-exports the members, but no module importsgetHeader,setHeader,Headers,assignHeaders,setRequestTimeout,headersTuple,webRequestOrResponseHasBodyValueorgetCompleteWebRequestOrResponseBodyValueAsArrayBuffer(the last users left with the http client rewrite);assignEventCallback,Request,ResponseandBlobwere registered but not even destructured. A few symbols (kDeprecatedReplySymbol,controllerSymbol,runSymbol,deferredSymbol,firstWriteSymbol,kEmptyObject) andisAbortError/get|setIsNextIncomingMessageHTTPSlost their last reader in earlier sweeps.NodeHTTP.cpp'sjsHTTPAssignHeaders,jsHTTPAssignEventCallback,jsHTTPSetTimeout,jsHTTPGetHeaderandjsHTTPSetHeader, which in turn were the only callers ofassignHeadersFromFetchHeaders,assignHeadersFromUWebSockets(the...ForCallvariant used by the request path stays) and theRequestHeaderKindhelpers: about 600 lines of C++.jsFunctionRequestOrResponseHasBodyValue,jsFunctionGetCompleteRequestOrResponseBodyValueAsArrayBuffer(Response.rs),Request__getUWSRequest,Request__setInternalEventCallback,Request__setTimeout(Request.rs) andNodeHTTPResponse__setTimeout(NodeHTTPResponse.rs).Request__setInternalEventCallbackwas the only writer ofRequest::internal_event_callback, and the JS side stopped calling it in 2024, soInternalJSEventCallback, theRequestContext::on_timeouthandler,set_timeout_handler, theHAS_TIMEOUT_HANDLERflag and its three clear sites, andAnyRequestContext::enable_timeout_eventshave not been reachable since then;Body::Value::is_definitely_emptywas only used by the removed host function.Code generators and build scripts (about 1000 lines)
generate-classes.ts/class-definitions.tsstill emitted code for.classes.tskeys no class file sets:own(and theZigGeneratedClasses.lut.txt->.lut.hbuild step inscripts/build/codegen.ts, whose output was an empty header),callbacks, theaccessorfield variant,supportsObjectCreate,custom,zigOnly,defaultValue, plus theONLY_ZIGandBUN_SILENTenvironment switches nothing sets (git grepover all 30*.classes.tsfiles, andgit log -Gfor the keys that ever existed).bundle-functions.tshandled$nakedConstructor,$sloppyand$intrinsicdirectives no file insrc/js/builtinsuses, and tracked write-only fields;generate-jssink.ts,replacements.ts(OutOfMemoryErrorrewrite, no builtin throws it) andcppbind.tshad smaller leftovers.src/runtime/bake/bake.bind.tswas 100% comments and produced an emptyGeneratedBake.hnothing includes.scripts/utils.mjs(379 lines:downloadTargetand its helpers,getBuildArtifactsand its helpers,getChangedFiles,isDocumentation,getPullRequestRepository,getRepositoryOwner,escapeYaml,escapeGitHubAction,parseNumber,getUser,isArm64) andscripts/runner.node.mjs(listArtifactsFromBuildKite, a localescapeGitHubAction) exported functions none of the 11 importers import.glob-sources.tsglobbed two patterns that have never matched a file;flags.tsdefinedLIBUS_USE_BORINGSSL, which nothing insrc/,packages/orvendor/reads;config.tscarried three resolved fields nothing reads (thePartialConfiginputs stay);depVersionsHeader.tsand fivedeps/*.tsemitted seven version macros with no consumer inBunProcess.cpp, the header's only includer.Rust crates (about 140 lines)
CssModuleReference::Local/Globalare never constructed (onlyDependencyis) andeqlhas no caller;bun_sysduplicatedNT_UNC_OBJECT_PREFIX/_U8(the live copies are inbun_paths) and two Windows send-flag constants the wrappers do not use;cares_sys::AddrInfo::namehas no caller;libuv_syskeptLoop::{ref_, unref, unref_count, run, tick_with_timeout, wakeup},uv_write_t::write_raw,uv_async_t::send,Process::get_pid,uv_stat_t::{atime, ctime},ReturnCode::from_raw,ReturnCodeI64::init, five type aliases and the two externs only those methods used. These come from the workspace reachability analysis intools/hawk/, run for linux-gnu, darwin and windows-msvc and then re-checked by hand; the items it reported that are used only fromdebug_assertionscode (which the release-profile analysis does not see) or only on FreeBSD were kept.Fix
SubtleCrypto.cppbecome unconditional (same error strings, pinned bytest/js/web/crypto/web-crypto.test.ts),isSupportedExportKeyloses an unused parameter,platformEncrypt/platformDecryptin RSA-OAEP absorb their one-lineWithHashwrappers,RequestContext::set_timeoutkeeps itsclear_timeout()for0, oneconstdestructure ininternal/http.tsis reflowed, andgenerate-classes.tsconditions that became constant are folded.generate-classes.ts,generate-jssink.tsandbundle-modules.tsinto a scratch directory and comparing with the output generated before the change: byte-identical except for the dropped#include "ZigGeneratedClasses.lut.h"line and the two deleted webcrypto files disappearing from theNativeFilenameCPPunion.bun scripts/build.ts --configure-onlyconfirmsbuild.ninjano longer referencesGeneratedBake.h, the.lutpair, orLIBUS_USE_BORINGSSL, and that the C++ source list changed only by the three deleted files.bun bdbuilds;bun run rust:check-allpasses on all 12 target triples;cargo fmt --check, prettier and clang-format are clean.bun bd testpasses ontest/js/web/crypto/web-crypto.test.ts(94),test/js/node/crypto/{crypto.key-objects,crypto-rsa,sign-jwk-ieee-p1363,crypto-pqc,x509}(162),test/js/node/http/{node-http,node-http-server-timeouts,node-http-server-abort-events,node-http-res-settimeout-unref}(151; the one failure, the http proxy test, fails identically with the released binary in this container),test/js/bun/http/serve.test.ts(283; the 4 failures, requestIP v6, root-range port, Bun will not close socket if receive not understandable request in Bun.serve #6583 and /bun:info, fail identically with the released binary here),test/js/node/http2/node-http2.test.js,test/js/node/fs/fs-leak.test.js,test/js/bun/udp/dgram.test.ts,test/js/node/readline/readline.node.test.ts,test/bundler/css/css-modules.test.ts,test/js/node/process/process.test.js(dependency version assertions pass; theUSERenv assertion fails on both binaries here), the ninetest/internal/build-*/bindgen/macos-cross-config/rust-*tests,test/js/bun/perf/linker-order.test.ts, and all oftest/internal/source-lints/(166). The newdead-symbols-webcrypto-nodehttp-codegen.test.tsfails on main and passes here.auto& vm = ...) that Remove dead code from C++ bindings, src/js builtins, CSS, and Rust util crates #35437 also deletes from a different function inNodeHTTP.cpp. Hunks adjacent to open PRs, which will need a trivial rebase on whichever side lands second: theinternal/http.tsdestructure andNodeHTTP.cppregistration block (Remove dead code from C++ bindings, src/js builtins, CSS, and Rust util crates #35437 removessetServerIdleTimeoutthere), theCryptoKey.cppinclude block (Remove dead code from the WebCore bindings, IDL converters, and Rust FFI wrappers #38005 removes the neighbouring line),CryptoAlgorithmRSA_PSSOpenSSL.cpp(Remove dead code from the WebCore bindings, IDL converters, and Rust FFI wrappers #38005's hunk still applies),class-definitions.ts(Remove dead code from bindgen codegen, orphaned scripts, and misc crates #37208 removesisEventEmitter),generate-classes.ts(Remove dead code from C++ bindings, bindgen glue, ast, and orphaned scripts #37149 removes four DOMJIT includes), andc_ares.rs(Remove dead code from bun_core, bun_css, bun_jsc, and the FFI crates #38703 removes a method 30 lines below).Background
createNodeHTTPInternalBindingis the C++ function behind$cpp("NodeHTTP.cpp", ...)ininternal/http.ts; it builds a plain object whose properties are JS functions wrapping C++ host functions. A host function registered there is reachable only if some builtin reads the property, which is why the JS import graph decides what is dead in the C++ file.export_name/uws_callback(export = ...)exist for C++ callers;cppbind/js2native codegen emits the glue from the sources, so once the last C++ caller is gone they are unreachable, and the workspace lints (dead_code/unused_importsaredeny) then flag whatever only they called, which is how theRequest.rs/RequestContext.rscascade was found and bounded.Request::internal_event_callbackwas the hook node:http used to be told about per-request timeouts and aborts;RequestContext::set_timeout_handlerregistered the uWS timeout callback only when that hook was set. With no setter, the flag was never set and the handler never registered, so removing them changes nothing at runtime;server.timeout()still arms the socket timeout and the abort path is untouched.generate-classes.tsreads everysrc/**/*.classes.tsand emitsZigGeneratedClasses.{h,cpp}plusgenerated_classes.rs; a feature of the class definition format that no class uses is dead code in the generator, and its removal is checkable by diffing the generated files.tools/hawk/README.mddescribes the workspace-wide reachability analysis used for the Rust items: rustc's per-cratedead_codelint treats everypubitem of a library crate as live, so cross-crate deadpubitems need this separate pass.Found dead but deliberately left alone
bun_shim_impl::read_without_launchandFromBunShellContext(src/install/windows-shim/bun_shim_impl.rs) have no caller, but theLauncherMode::ReadWithoutLaunchmode is threaded through the launcher, so removing it cleanly means de-generifyinglauncher(); better as its own change.CssModule::referencesmap itself (this PR removes only the never-constructed variants); the#[cfg(target_arch = "wasm32")]branches scattered through the parser/output code (no wasm32 target is built, but earlier commits describe it as "not built yet", so that is a product call);windows_errno::posix::{mode_t, E}andbun_sys::File::write(unused, but intentional API parity with the POSIX side);WindowsLoop::{wait, unref}and the Windowsus_socket_t::write_fdstub (8 and 7 lines in files three open PRs are editing).AnyResponse::on_timeout/uws_res_on_timeoutinbun_uws_syslose their last caller with this PR (set_timeout_handlerwas it); left for the next pass since those files are in open PRs.generate-classes.tsis disabled on purpose (define()strips it), not dead; the split CI build modes inscripts/build/profiles.tswere explicitly kept by ci: build C++, Rust and link in one build-bun step instead of build-cpp + build-bun #37733 four days ago; the*.idlfiles in webcrypto are kept as documentation as in the previous sweeps; the AES-GCM> UINT64_MAXchecks are upstream-identical.#[allow(dead_code)]in the tree was re-verified and is live on some platform or underdebug_assertions(the inventory indead-code-escape-limits.jsonis accurate), so nothing was taken from there.CryptoAlgorithmAKPShared.hdoes not includeCryptoAlgorithmParameters.h, soCryptoAlgorithmMLDSA.cpponly compiles inside its unified bundle; pre-existing and unrelated to this change.