Restrict crate-internal items to pub(crate) and remove dead code it exposes

[Jarred-Sumner]

What

Three commits, one sweep:

1. pub → pub(crate) for 1,298 items across 105 files. Applied mechanically via cargo fix driven by the unreachable_pub lint, which only fires on items that are provably unreachable from outside their defining crate — so the demotion cannot change what compiles. Two items (addrinfo/freeaddrinfo re-exports in bun_dns) were reverted by hand because a chained pub use re-exports them.

2. Remove the dead AST JSON-serialization facility. The js_ast jsonStringify port — JsonWriter/BindingJsonWriter traits, Serializable carrier structs, 26 json_stringify methods, Ast::to_json — has zero trait implementors and zero callers. The only .json_stringify() call sites in the tree are JSValue's native JSON.stringify, which is unrelated.

3. Remove six crates nothing depends on, plus the data files vendored under them:

   • bun_unicode — empty lib.rs, no consumers, but carried the entire vendored Unicode Character Database (~70k lines of .txt)
   • bun_libarchive_sys / bun_picohttp_sys — superseded duplicates; bun_libarchive / bun_picohttp carry their own bindings and are what everything actually uses
   • bun_meta, bun_url_jsc — zero callers
   • the bun_node-fallbacks crate wrapper (the .js fallback modules stay; codegen bundles those directly)
   • crossbeam from [workspace.dependencies] (no member declares it)

After this, every workspace crate except the two standalone build roots (bun_codegen, bun_shim_impl) has at least one in-workspace dependent.

Why

dead_code = "deny" is already enforced workspace-wide, but it treats every pub item as an external API root and never analyzes it. In a workspace where every crate is an internal implementation detail of one binary, that exemption swallows real dead code. Demoting crate-internal items to pub(crate) puts them back under the lint — that is what surfaced the dead serialization facility.

Verification

• cargo check --workspace --lib --bins clean under the workspace's normal lint set
• Full debug build links and runs
• bundler_edgecase 103 pass / 0 fail, bundler_browser 12 pass / 0 fail (node-fallbacks path), bun-add failures are pre-existing on main (registry config leak in the test environment, identical signature with an unmodified build)

179 files changed, 1,522 insertions(+), 84,970 deletions(-)

[robobun]

^{Updated 12:03 AM PT - May 24th, 2026}

✅ @Jarred-Sumner, your commit a9b037440657c8fd95fb117045f4ce1273d1cea1 passed in Build #57468! 🎉

---

🧪   To try this PR locally:

bunx bun-pr 31254

That installs a local version of the PR into your bun-31254 executable, so you can run:

bun-31254 --bun

[coderabbitai]

Warning

Review limit reached

@Jarred-Sumner, we couldn't start this review because you've used your available PR reviews for now.

Your plan currently allows 2 reviews/hour. Refill in 11 minutes and 24 seconds.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more review capacity refills, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 980ee955-54f5-47f6-94f5-6bcd3844bdd6

📥 Commits

Reviewing files that changed from the base of the PR and between 01fc54b and 672ec73.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (267)

• Cargo.toml
• scripts/find-dead-exports.ts
• scripts/update-uucode.sh
• src/analytics/lib.rs
• src/analytics/schema.rs
• src/ast/binding.rs
• src/ast/char_freq.rs
• src/ast/e.rs
• src/ast/expr.rs
• src/ast/known_global.rs
• src/ast/lexer_tables.rs
• src/ast/lib.rs
• src/ast/new_store.rs
• src/ast/scope.rs
• src/ast/server_component_boundary.rs
• src/ast/symbol.rs
• src/ast_jsc/lib.rs
• src/base64/lib.rs
• src/boringssl_sys/boringssl.rs
• src/brotli_sys/brotli_c.rs
• src/bun_alloc/MimallocArena.rs
• src/bun_alloc/heap_breakdown.rs
• src/bun_alloc/lib.rs
• src/bun_alloc/maybe_owned.rs
• src/bun_alloc/memory.rs
• src/bun_bin/phase_c_exports.rs
• src/bun_core/Global.rs
• src/bun_core/debug.rs
• src/bun_core/env.rs
• src/bun_core/env_var.rs
• src/bun_core/feature_flags.rs
• src/bun_core/heap.rs
• src/bun_core/lib.rs
• src/bun_core/output.rs
• src/bun_core/string/PathString.rs
• src/bun_core/string/SmolStr.rs
• src/bun_core/string/identifier.rs
• src/bun_core/string/immutable/exact_size_matcher.rs
• src/bun_core/string/immutable/grapheme.rs
• src/bun_core/string/immutable/visible.rs
• src/bun_core/string/mod.rs
• src/bun_core/thread_id.rs
• src/bun_core/windows_sys.rs
• src/bun_output_tags/lib.rs
• src/bundler/AstBuilder.rs
• src/bundler/BundleThread.rs
• src/bundler/Chunk.rs
• src/bundler/HTMLScanner.rs
• src/bundler/LinkerContext.rs
• src/bundler/LinkerGraph.rs
• src/bundler/ParseTask.rs
• src/bundler/PathToSourceIndexMap.rs
• src/bundler/ServerComponentParseTask.rs
• src/bundler/ThreadPool.rs
• src/bundler/analyze_transpiled_module.rs
• src/bundler/barrel_imports.rs
• src/bundler/bundle_v2.rs
• src/bundler/bundled_ast.rs
• src/bundler/lib.rs
• src/bundler/linker.rs
• src/bundler/linker_context/computeCrossChunkDependencies.rs
• src/bundler/linker_context/findImportedFilesInCSSOrder.rs
• src/bundler/transpiler.rs
• src/bundler/ungate_support.rs
• src/bundler_jsc/PluginRunner.rs
• src/bundler_jsc/analyze_jsc.rs
• src/bundler_jsc/options_jsc.rs
• src/bunfig/bunfig.rs
• src/cares_sys/lib.rs
• src/clap/comptime.rs
• src/clap/streaming.rs
• src/codegen/Cargo.toml
• src/codegen/generate-string-map.ts
• src/codegen/lib.rs
• src/codegen/process_windows_translate_c.rs
• src/collections/array_list.rs
• src/collections/bit_set.rs
• src/collections/hive_array.rs
• src/collections/lib.rs
• src/collections/multi_array_list.rs
• src/collections/pool.rs
• src/collections/zig_hash_map.rs
• src/crash_handler/CPUFeatures.rs
• src/crash_handler/lib.rs
• src/csrf/lib.rs
• src/css/declaration.rs
• src/css/generics.rs
• src/css/lib.rs
• src/css/media_query.rs
• src/css/prefixes.rs
• src/css/printer.rs
• src/css/properties/align.rs
• src/css/properties/background.rs
• src/css/properties/border.rs
• src/css/properties/border_image.rs
• src/css/properties/box_shadow.rs
• src/css/properties/contain.rs
• src/css/properties/custom.rs
• src/css/properties/display.rs
• src/css/properties/effects.rs
• src/css/properties/flex.rs
• src/css/properties/font.rs
• src/css/properties/list.rs
• src/css/properties/mod.rs
• src/css/properties/outline.rs
• src/css/properties/overflow.rs
• src/css/properties/position.rs
• src/css/properties/prefix_handler.rs
• src/css/properties/size.rs
• src/css/properties/svg.rs
• src/css/properties/text.rs
• src/css/properties/transform.rs
• src/css/properties/transition.rs
• src/css/properties/ui.rs
• src/css/rules/container.rs
• src/css/rules/counter_style.rs
• src/css/rules/document.rs
• src/css/rules/font_face.rs
• src/css/rules/font_palette_values.rs
• src/css/rules/keyframes.rs
• src/css/rules/layer.rs
• src/css/rules/mod.rs
• src/css/rules/nesting.rs
• src/css/rules/page.rs
• src/css/rules/property.rs
• src/css/rules/starting_style.rs
• src/css/rules/supports.rs
• src/css/rules/viewport.rs
• src/css/selectors/builder.rs
• src/css/selectors/mod.rs
• src/css/selectors/selector.rs
• src/css/small_list.rs
• src/css/values/alpha.rs
• src/css/values/angle.rs
• src/css/values/calc.rs
• src/css/values/color.rs
• src/css/values/gradient.rs
• src/css/values/ident.rs
• src/css/values/image.rs
• src/css/values/length.rs
• src/css/values/percentage.rs
• src/css/values/position.rs
• src/css/values/ratio.rs
• src/css/values/rect.rs
• src/css/values/resolution.rs
• src/css/values/size.rs
• src/css/values/syntax.rs
• src/css_jsc/color_js.rs
• src/css_jsc/css_internals.rs
• src/css_jsc/error_jsc.rs
• src/dispatch/tests/shape.rs
• src/dns/lib.rs
• src/errno/lib.rs
• src/errno/windows_errno.rs
• src/event_loop/AutoFlusher.rs
• src/exe_format/elf.rs
• src/exe_format/macho.rs
• src/exe_format/macho_types.rs
• src/exe_format/pe.rs
• src/http/H2Client.rs
• src/http/HTTPContext.rs
• src/http/HTTPThread.rs
• src/http/InternalState.rs
• src/http/SendFile.rs
• src/http/h2_client/dispatch.rs
• src/http/h2_client/encode.rs
• src/http/h3_client/AltSvc.rs
• src/http/h3_client/callbacks.rs
• src/http/h3_client/encode.rs
• src/http/lib.rs
• src/http/zlib.rs
• src/http_jsc/headers_jsc.rs
• src/http_jsc/websocket_client.rs
• src/http_jsc/websocket_client/CppWebSocket.rs
• src/http_jsc/websocket_client/WebSocketDeflate.rs
• src/http_jsc/websocket_client/WebSocketProxy.rs
• src/http_jsc/websocket_client/WebSocketProxyTunnel.rs
• src/http_jsc/websocket_client/WebSocketUpgradeClient.rs
• src/http_types/Method.rs
• src/http_types/MimeType.rs
• src/http_types/h2.rs
• src/ini/lib.rs
• src/install/NetworkTask.rs
• src/install/PackageInstall.rs
• src/install/PackageInstaller.rs
• src/install/PackageManager.rs
• src/install/PackageManager/PackageJSONEditor.rs
• src/install/PackageManager/PackageManagerEnqueue.rs
• src/install/PackageManager/PackageManagerOptions.rs
• src/install/PackageManager/PopulateManifestCache.rs
• src/install/PackageManager/install_with_manager.rs
• src/install/PackageManager/security_scanner.rs
• src/install/PackageManagerTask.rs
• src/install/TarballStream.rs
• src/install/auto_installer.rs
• src/install/bin.rs
• src/install/dependency.rs
• src/install/extract_tarball.rs
• src/install/hoisted_install.rs
• src/install/hosted_git_info.rs
• src/install/integrity.rs
• src/install/isolated_install.rs
• src/install/isolated_install/FileCloner.rs
• src/install/isolated_install/Installer.rs
• src/install/isolated_install/Store.rs
• src/install/lib.rs
• src/install/lifecycle_script_runner.rs
• src/install/lockfile.rs
• src/install/lockfile/Buffers.rs
• src/install/lockfile/OverrideMap.rs
• src/install/lockfile/Package.rs
• src/install/lockfile/Package/WorkspaceMap.rs
• src/install/lockfile/Tree.rs
• src/install/lockfile/bun.lock.rs
• src/install/lockfile/bun.lockb.rs
• src/install/lockfile/printer/Yarn.rs
• src/install/migration.rs
• src/install/npm.rs
• src/install/patch_install.rs
• src/install/pnpm.rs
• src/install/repository.rs
• src/install/resolution.rs
• src/install/resolvers/folder_resolver.rs
• src/install/windows-shim/BinLinkingShim.rs
• src/install/windows-shim/bun_shim_impl.rs
• src/install/windows-shim/main.rs
• src/install/yarn.rs
• src/install_jsc/dependency_jsc.rs
• src/install_jsc/install_binding.rs
• src/install_jsc/npm_jsc.rs
• src/install_types/NodeLinker.rs
• src/io/ParentDeathWatchdog.rs
• src/io/PipeReader.rs
• src/io/PipeWriter.rs
• src/io/lib.rs
• src/io/posix_event_loop.rs
• src/io/source.rs
• src/io/windows_event_loop.rs
• src/js_parser/benches/string_map_vs_phf.rs
• src/js_parser/defines_table.generated.rs
• src/js_parser/defines_table.rs
• src/js_parser/lib.rs
• src/js_parser/lower/lower_esm_exports_hmr.rs
• src/js_parser/p.rs
• src/js_parser/parse/parse_skip_typescript.rs
• src/js_parser/parser.rs
• src/js_parser/scan/scan_imports.rs
• src/js_parser/typescript.rs
• src/js_parser/visit/mod.rs
• src/js_parser_jsc/Macro.rs
• src/js_parser_jsc/expr_jsc.rs
• src/js_printer/lib.rs
• src/js_printer/renamer.rs
• src/jsc/AbortSignal.rs
• src/jsc/AsyncModule.rs
• src/jsc/BunCPUProfiler.rs
• src/jsc/CachedBytecode.rs
• src/jsc/CallFrame.rs
• src/jsc/CppTask.rs
• src/jsc/Debugger.rs
• src/jsc/ErrorCode.rs
• src/jsc/FFI.rs
• src/jsc/GarbageCollectionController.rs
• src/jsc/JSCScheduler.rs
• src/jsc/JSFunction.rs
• src/jsc/JSGlobalObject.rs
• src/jsc/JSObject.rs

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

src/js_parser/parse/parse_entry.rs (1)

357-363: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Fix wasm32 mutability in Parser::parse

src/js_parser/parse/parse_entry.rs defines pub fn parse(self) ... (immutable self binding), but the #[cfg(target_arch = "wasm32")] block assigns to self.options.ts and self.options.jsx.parse. Both are plain bool fields (Options.ts: bool, options::JSX::Pragma.parse: bool), so wasm32 builds will fail to compile.

💡 Proposed fix

-    pub fn parse(self) -> Result<crate::Result<'a>, Error> {
+    pub fn parse(mut self) -> Result<crate::Result<'a>, Error> {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/js_parser/parse/parse_entry.rs` around lines 357 - 363, The parse method
takes an immutable self but the wasm32 branch assigns to self.options.ts and
self.options.jsx.parse; change the signature of pub fn parse(self) -> ... to pub
fn parse(mut self) -> ... so self is mutable, allowing assignments to the bool
fields (referencing Parser::parse, self.options.ts and self.options.jsx.parse),
then keep the rest of the logic and return self._parse::<true>() as before.

src/runtime/shell/subproc.rs (1)

655-668: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Keep stdin_opt/stdout_opt bindings mutable on Windows (needed for deinit(&mut self))

spawn::process::WindowsStdio::deinit is declared as pub fn deinit(&mut self) in src/spawn/process.rs, so the Windows error-path calls stdin_opt.deinit() / stdout_opt.deinit() in src/runtime/shell/subproc.rs require stdin_opt/stdout_opt to be mut. Restoring mut fixes the Windows build.

Suggested fix

-        let stdin_opt = match stdio_guard[0].as_spawn_option(0) {
+        let mut stdin_opt = match stdio_guard[0].as_spawn_option(0) {
             stdio::ResultT::Result(opt) => opt,
             stdio::ResultT::Err(e) => {
                 return Err(ShellErr::Custom(Box::<[u8]>::from(e.to_str())));
             }
         };
@@
-        let stdout_opt = match stdio_guard[1].as_spawn_option(1) {
+        let mut stdout_opt = match stdio_guard[1].as_spawn_option(1) {
             stdio::ResultT::Result(opt) => opt,
             stdio::ResultT::Err(e) => {
                 #[cfg(windows)]
                 stdin_opt.deinit();
                 return Err(ShellErr::Custom(Box::<[u8]>::from(e.to_str())));
             }
         };

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/runtime/shell/subproc.rs` around lines 655 - 668, The Windows build fails
because the error paths call WindowsStdio::deinit(&mut self) on
stdin_opt/stdout_opt but the bindings are not declared mutable; update the
bindings created from stdio_guard[*].as_spawn_option(...) so that stdin_opt and
stdout_opt are declared mut (e.g., change let stdin_opt / let stdout_opt to let
mut stdin_opt / let mut stdout_opt) so they can be passed as &mut to
WindowsStdio::deinit in the error branches (references: as_spawn_option,
stdin_opt, stdout_opt, WindowsStdio::deinit, ShellErr::Custom).

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/runtime/webcore/s3/client.rs`:
- Line 1133: The S3DownloadStreamWrapper is declared as a local item inside the
readable_stream function but incorrectly uses the visibility qualifier
`pub(crate)`; remove `pub(crate)` from the `S3DownloadStreamWrapper` struct
declaration and any method impls or inherent methods declared inside
`readable_stream` so they are plain (non-`pub`) local items, e.g., update the
struct and its impl blocks in the readable_stream function to drop `pub(crate)`
from the identifiers.

---

Outside diff comments:
In `@src/js_parser/parse/parse_entry.rs`:
- Around line 357-363: The parse method takes an immutable self but the wasm32
branch assigns to self.options.ts and self.options.jsx.parse; change the
signature of pub fn parse(self) -> ... to pub fn parse(mut self) -> ... so self
is mutable, allowing assignments to the bool fields (referencing Parser::parse,
self.options.ts and self.options.jsx.parse), then keep the rest of the logic and
return self._parse::<true>() as before.

In `@src/runtime/shell/subproc.rs`:
- Around line 655-668: The Windows build fails because the error paths call
WindowsStdio::deinit(&mut self) on stdin_opt/stdout_opt but the bindings are not
declared mutable; update the bindings created from
stdio_guard[*].as_spawn_option(...) so that stdin_opt and stdout_opt are
declared mut (e.g., change let stdin_opt / let stdout_opt to let mut stdin_opt /
let mut stdout_opt) so they can be passed as &mut to WindowsStdio::deinit in the
error branches (references: as_spawn_option, stdin_opt, stdout_opt,
WindowsStdio::deinit, ShellErr::Custom).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 80803f7c-2819-4331-9a79-39df8bdf80bf

📥 Commits

Reviewing files that changed from the base of the PR and between 4df6154 and e1d285c.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (178)

• Cargo.toml
• src/ast/ast_result.rs
• src/ast/base.rs
• src/ast/binding.rs
• src/ast/e.rs
• src/ast/expr.rs
• src/ast/g.rs
• src/ast/lib.rs
• src/ast/nodes.rs
• src/ast/op.rs
• src/ast/s.rs
• src/ast/scope.rs
• src/ast/stmt.rs
• src/ast/symbol.rs
• src/bun_alloc/basic.rs
• src/bun_bin/phase_c_exports.rs
• src/bundler/LinkerGraph.rs
• src/bundler/ParseTask.rs
• src/bundler/ThreadPool.rs
• src/bundler/linker.rs
• src/bundler/linker_context/findImportedFilesInCSSOrder.rs
• src/bundler/options.rs
• src/collections/lib.rs
• src/css/properties/border.rs
• src/css/properties/properties_impl.rs
• src/css/rules/mod.rs
• src/http_jsc/websocket_client.rs
• src/install/PackageManager.rs
• src/install/PackageManager/PopulateManifestCache.rs
• src/install/PackageManager/patchPackage.rs
• src/install/PackageManager/security_scanner.rs
• src/install/hoisted_install.rs
• src/install/isolated_install.rs
• src/install/lib.rs
• src/install/lockfile/Buffers.rs
• src/install/lockfile/bun.lock.rs
• src/install/npm.rs
• src/install/repository.rs
• src/js_parser/defines_table.rs
• src/js_parser/parse/parse_entry.rs
• src/js_printer/lib.rs
• src/jsc/ConsoleObject.rs
• src/jsc/Debugger.rs
• src/jsc/btjs.rs
• src/jsc/cpp.rs
• src/jsc/event_loop.rs
• src/jsc/host_fn.rs
• src/jsc/ipc.rs
• src/libarchive_sys/Cargo.toml
• src/libarchive_sys/bindings.rs
• src/libarchive_sys/bindings.zig
• src/libarchive_sys/lib.rs
• src/md/lib.rs
• src/meta/Cargo.toml
• src/meta/bits.zig
• src/meta/lib.rs
• src/meta/meta.zig
• src/meta/tagged_union.rs
• src/meta/tagged_union.zig
• src/meta/traits.zig
• src/node-fallbacks/Cargo.toml
• src/node-fallbacks/lib.rs
• src/parsers/lib.rs
• src/picohttp_sys/Cargo.toml
• src/picohttp_sys/lib.rs
• src/picohttp_sys/picohttpparser.rs
• src/picohttp_sys/picohttpparser.zig
• src/runtime/api/BunObject.rs
• src/runtime/api/JSON5Object.rs
• src/runtime/api/bun/SecureContext.rs
• src/runtime/api/bun/Terminal.rs
• src/runtime/api/bun/h2_frame_parser.rs
• src/runtime/bake/DevServer.rs
• src/runtime/bake/DevServer/ErrorReportRequest.rs
• src/runtime/bake/DevServer/HmrSocket.rs
• src/runtime/bake/DevServer/memory_cost.rs
• src/runtime/bake/FrameworkRouter.rs
• src/runtime/bake/bake_body.rs
• src/runtime/bake/mod.rs
• src/runtime/bake/production.rs
• src/runtime/cli/audit_command.rs
• src/runtime/cli/create_command.rs
• src/runtime/cli/filter_run.rs
• src/runtime/cli/mod.rs
• src/runtime/cli/multi_run.rs
• src/runtime/cli/open.rs
• src/runtime/cli/package_manager_command.rs
• src/runtime/cli/pm_version_command.rs
• src/runtime/cli/repl.rs
• src/runtime/cli/repl_command.rs
• src/runtime/cli/test/parallel/runner.rs
• src/runtime/cli/test_command.rs
• src/runtime/crypto/CryptoHasher.rs
• src/runtime/dns_jsc/dns.rs
• src/runtime/ffi/FFIObject.rs
• src/runtime/ffi/ffi_body.rs
• src/runtime/ffi/mod.rs
• src/runtime/hw_exports.rs
• src/runtime/lib.rs
• src/runtime/napi/napi_body.rs
• src/runtime/node/node_crypto_binding.rs
• src/runtime/node/node_fs.rs
• src/runtime/node/node_fs_stat_watcher.rs
• src/runtime/node/node_process.rs
• src/runtime/node/util/parse_args.rs
• src/runtime/server/RequestContext.rs
• src/runtime/server/ServerWebSocket.rs
• src/runtime/server/mod.rs
• src/runtime/server/server_body.rs
• src/runtime/shell/subproc.rs
• src/runtime/socket/socket_body.rs
• src/runtime/socket/tls_socket_functions.rs
• src/runtime/test_runner/Order.rs
• src/runtime/test_runner/ScopeFunctions.rs
• src/runtime/test_runner/diff/printDiff.rs
• src/runtime/test_runner/pretty_format.rs
• src/runtime/timer/DateHeaderTimer.rs
• src/runtime/timer/EventLoopDelayMonitor.rs
• src/runtime/valkey_jsc/js_valkey.rs
• src/runtime/valkey_jsc/js_valkey_functions.rs
• src/runtime/webcore/Blob.rs
• src/runtime/webcore/Response.rs
• src/runtime/webcore/TextEncoder.rs
• src/runtime/webcore/encoding.rs
• src/runtime/webcore/fetch.rs
• src/runtime/webcore/s3/client.rs
• src/runtime/webcore/s3/error_jsc.rs
• src/sourcemap/lib.rs
• src/sourcemap_jsc/lib.rs
• src/spawn_sys/posix_spawn.rs
• src/sql_jsc/postgres/DataCell.rs
• src/standalone_graph/lib.rs
• src/unicode/Cargo.toml
• src/unicode/lib.rs
• src/unicode/uucode/CLAUDE.md
• src/unicode/uucode/grapheme_gen.zig
• src/unicode/uucode/lut.zig
• src/unicode/uucode/uucode_config.zig
• src/unicode/uucode_lib/LICENSE.md
• src/unicode/uucode_lib/README.md
• src/unicode/uucode_lib/build.zig
• src/unicode/uucode_lib/build.zig.zon
• src/unicode/uucode_lib/src/ascii.zig
• src/unicode/uucode_lib/src/config.zig
• src/unicode/uucode_lib/src/get.zig
• src/unicode/uucode_lib/src/grapheme.zig
• src/unicode/uucode_lib/src/root.zig
• src/unicode/uucode_lib/src/types.zig
• src/unicode/uucode_lib/src/utf8.zig
• src/unicode/uucode_lib/src/x/config.x.zig
• src/unicode/uucode_lib/src/x/config_x/grapheme_break.zig
• src/unicode/uucode_lib/src/x/config_x/wcwidth.zig
• src/unicode/uucode_lib/src/x/grapheme.zig
• src/unicode/uucode_lib/src/x/root.zig
• src/unicode/uucode_lib/src/x/types.x.zig
• src/unicode/uucode_lib/src/x/types_x/grapheme.zig
• src/unicode/uucode_lib/ucd/.gitignore
• src/unicode/uucode_lib/ucd/BidiBrackets.txt
• src/unicode/uucode_lib/ucd/Blocks.txt
• src/unicode/uucode_lib/ucd/CaseFolding.txt
• src/unicode/uucode_lib/ucd/DerivedCoreProperties.txt
• src/unicode/uucode_lib/ucd/SpecialCasing.txt
• src/unicode/uucode_lib/ucd/UnicodeData.txt
• src/unicode/uucode_lib/ucd/auxiliary/GraphemeBreakProperty.txt
• src/unicode/uucode_lib/ucd/auxiliary/GraphemeBreakTest.txt
• src/unicode/uucode_lib/ucd/emoji/emoji-data.txt
• src/unicode/uucode_lib/ucd/emoji/emoji-variation-sequences.txt
• src/unicode/uucode_lib/ucd/emoji/emoji-zwj-sequences.txt
• src/unicode/uucode_lib/ucd/extracted/DerivedBidiClass.txt
• src/unicode/uucode_lib/ucd/extracted/DerivedEastAsianWidth.txt
• src/unicode/uucode_lib/ucd/extracted/DerivedGeneralCategory.txt
• src/url_jsc/Cargo.toml
• src/url_jsc/lib.rs
• src/url_jsc/url_jsc.zig
• src/uws_sys/Loop.rs
• src/uws_sys/Request.rs
• src/uws_sys/h3.rs
• src/uws_sys/us_socket_t.rs

💤 Files with no reviewable changes (66)

• src/unicode/uucode_lib/LICENSE.md
• src/meta/Cargo.toml
• src/libarchive_sys/bindings.rs
• src/unicode/uucode_lib/README.md
• src/unicode/uucode_lib/ucd/.gitignore
• src/unicode/uucode_lib/src/x/config.x.zig
• src/sourcemap/lib.rs
• src/meta/traits.zig
• src/unicode/uucode_lib/ucd/Blocks.txt
• src/unicode/uucode_lib/src/x/types.x.zig
• src/unicode/uucode/CLAUDE.md
• src/collections/lib.rs
• src/unicode/uucode/grapheme_gen.zig
• src/unicode/uucode_lib/src/config.zig
• src/node-fallbacks/lib.rs
• src/ast/base.rs
• src/libarchive_sys/lib.rs
• src/jsc/cpp.rs
• src/unicode/uucode_lib/ucd/BidiBrackets.txt
• src/meta/tagged_union.zig
• src/unicode/uucode_lib/src/root.zig
• src/unicode/uucode_lib/src/x/config_x/grapheme_break.zig
• src/unicode/uucode/uucode_config.zig
• src/unicode/uucode_lib/src/x/root.zig
• src/meta/tagged_union.rs
• src/unicode/uucode_lib/src/x/types_x/grapheme.zig
• src/ast/symbol.rs
• src/picohttp_sys/Cargo.toml
• src/unicode/uucode_lib/src/get.zig
• src/meta/bits.zig
• src/picohttp_sys/picohttpparser.zig
• src/node-fallbacks/Cargo.toml
• src/parsers/lib.rs
• src/ast/op.rs
• src/unicode/uucode_lib/src/utf8.zig
• src/runtime/lib.rs
• src/unicode/uucode/lut.zig
• src/ast/binding.rs
• src/libarchive_sys/Cargo.toml
• src/standalone_graph/lib.rs
• src/ast/s.rs
• src/unicode/uucode_lib/src/ascii.zig
• src/picohttp_sys/picohttpparser.rs
• src/unicode/uucode_lib/src/grapheme.zig
• src/unicode/Cargo.toml
• src/picohttp_sys/lib.rs
• src/libarchive_sys/bindings.zig
• src/md/lib.rs
• src/unicode/uucode_lib/build.zig.zon
• src/ast/e.rs
• src/unicode/lib.rs
• src/meta/lib.rs
• src/unicode/uucode_lib/src/x/grapheme.zig
• src/ast/ast_result.rs
• src/ast/stmt.rs
• src/ast/lib.rs
• src/meta/meta.zig
• src/ast/scope.rs
• src/unicode/uucode_lib/build.zig
• src/sourcemap_jsc/lib.rs
• src/ast/expr.rs
• src/unicode/uucode_lib/src/x/config_x/wcwidth.zig
• src/ast/g.rs
• src/unicode/uucode_lib/src/types.zig
• Cargo.toml
• src/ast/nodes.rs

[claude]

I didn't find any bugs, but this is a very large refactor (862 files, ~97k lines deleted) that removes several crates and enables a workspace-wide lint, so it warrants human sign-off.

Extended reasoning...

Overview

This PR demotes pub items to pub(crate) across the workspace, enables #![deny(unreachable_pub)] workspace-wide, deletes several unconsumed crates (bun_meta, bun_url_jsc, bun_libarchive_sys, bun_picohttp_sys, bun_unicode), removes the dead AST JSON-serialization facility, and prunes empty module shells. The net result is 862 files changed with ~8k insertions and ~97k deletions.

Security risks

None apparent — the changes are visibility reductions and dead-code removal, which strictly shrink the surface area rather than expand it. No auth, crypto, or permission logic is touched in a behavior-changing way.

Level of scrutiny

High, purely due to scale. While the bulk of edits are mechanical pub → pub(crate) rewrites that the compiler enforces, the PR also removes entire crates and a serialization facility. A human should confirm those crates are genuinely unconsumed (e.g., not used by out-of-tree tooling, build scripts, or downstream consumers) and that the workspace-wide deny(unreachable_pub) won't break alternate build configurations.

Other factors

The bug-hunting system found no issues, and the changes that are purely visibility-narrowing are self-validating (Rust won't compile if something needed wider visibility). However, 862 files and wholesale crate deletion is well outside the "simple, mechanical, self-contained" bar for auto-approval. No PR timeline was available, so I have no prior reviewer context to lean on.

[claude]

🔴 warnings = { level = "deny", priority = -1 } (f8b2ca0) is still breaking CI on 6 cross targets after 7b7737e's linker_messages = "allow" fix — robobun's Build #57446 (commit 72556c0, which is after 7b7737e) shows ❌ linker stderr: clang++: argument unused during compilation: '-no-pie' on aarch64-musl, x64-asan, freebsd-{x64,aarch64}, and {x64,aarch64}-android. Separately, the comment at 184-186 ("Individual lints below can override this back to 'warn' (their priority 0 beats the group's -1)") is incorrect: rustc's special warnings group recaptures any lint at warn level regardless of CLI flag order — rustc -D warnings -W unexpected_cfgs still errors with rustc's own note "-D unexpected-cfgs implied by -D warnings"; only allow or force-warn escape it — so unexpected_cfgs = { level = "warn", … } at line 191 is now silently at deny. Suggest gating -no-pie (or passing -Wno-unused-command-line-argument) in the build script for the cross targets, and rewording the comment to say only allow/force-warn override -D warnings.

Extended reasoning...

What's failing

robobun's most recent update (9:42 PM PT May 23rd) reports Build #57446 against commit 72556c0 as ❌ on six build-rust jobs — aarch64-musl, x64-asan, freebsd-x64, freebsd-aarch64, x64-android, aarch64-android — all with the identical annotation:

linker stderr: clang++: argument unused during compilation: '-no-pie' [-Wunused-command-line-argument]

git log confirms 72556c0 sits after 7b7737e ("Fix Windows release build: cfg the core_intrinsics feature, allow linker_messages"), the commit that added linker_messages = "allow" at line 196. So the follow-up that was meant to address the -D warnings fallout did not resolve these six targets, and the only commits since (02380d3 from main, 2d94380 merge) touch neither Cargo.toml nor the build scripts.

Why this is introduced by this PR

scripts/build/rust.ts and scripts/build/flags.ts are unchanged in this PR (git diff origin/main...HEAD -- scripts/build/ is empty), so clang's -no-pie stderr line was being emitted before this PR too — what changed is that f8b2ca0 added warnings = { level = "deny", priority = -1 } to [workspace.lints.rust], promoting that previously-benign rustc warning to a hard error. Circumstantial evidence in the timeline supports this: resolved comment 3292474257 enumerated Build #57240's failures (commit 81291dd, before f8b2ca0) as 42 private_bounds/private_interfaces diagnostics — no -no-pie anywhere — and the author's own reply at 03:49 UTC May 24 confirms "the workspace now also carries warnings = deny (f8b2ca0)". The -no-pie failures appear only in builds after that commit. CI's annotation harness (scripts/build/ci.ts:143) only posts on a non-zero exit code, so these are hard errors, not surfaced warnings.

The Cargo.toml comment at lines 194-195 says linker_messages "already exempts itself from -D warnings, so this only silences the noise" — but the six-target failure on a build that has linker_messages = "allow" directly contradicts that claim. The exact mechanism is not fully pinned down (candidates: the diagnostic may be emitted for a host-triple proc-macro/build-script link where [workspace.lints] flags don't apply; or the allow is being overridden by something in the cross-build RUSTFLAGS path; or the lint isn't actually self-exempting and the host build only passes because its linker driver doesn't print this), but the observable fact stands: CI is red at HEAD on 6 targets due to a change in this PR, and the author's targeted fix didn't cover them.

The comment at 184-186 is also factually wrong

Independent of the CI break, the new comment

Individual lints below can override this back to "warn" (their priority 0 beats the group's -1) where a warning level is intentional.

is incorrect for rustc's special warnings pseudo-group. Cargo's priority controls CLI flag order (-D warnings is emitted before -W unexpected_cfgs), but flag order doesn't matter for warnings: it recaptures any lint whose resolved level is "warn" regardless of where on the command line it was set. Empirically verified on both rustc 1.95.0 stable and the pinned nightly-2026-05-06:

$ echo '#[cfg(unknown)] fn f() {}' | rustc --crate-type lib --check-cfg='cfg()' -D warnings -W unexpected_cfgs -
error: unexpected `cfg` condition name: `unknown`
  = note: `-D unexpected-cfgs` implied by `-D warnings`
  = help: to override `-D warnings` add `#[allow(unexpected_cfgs)]`

rustc's own diagnostic note confirms the mechanism. Swapping -W → -A exits 0; --force-warn exits 0 with a warning. Only allow and force-warn escape -D warnings; level = "warn" does not.

Concrete consequence: unexpected_cfgs = { level = "warn", check-cfg = ['cfg(bun_asan)'] } at line 191 is now effectively at deny level — a silent behavior change vs. before this PR. The check-cfg half still does its job (registers bun_asan), but level = "warn" is dead config that misleadingly suggests the lint is intentionally kept at warn. There's no current build break only because every #[cfg(bun_codegen_embed)] site already carries a per-site #[allow(unexpected_cfgs)], but the comment will mislead the next person who adds a level = "warn" entry expecting it to take effect.

Step-by-step proof (CI break)

1. Commit f8b2ca0 adds warnings = { level = "deny", priority = -1 } to [workspace.lints.rust]. Cargo translates this to --deny=warnings on every workspace crate's rustc invocation.
2. On the six listed cross targets, the rustc-driven link step produces clang++: argument unused during compilation: '-no-pie' on stderr (rustc itself injects -no-pie into the linker driver invocation when -Crelocation-model=static is set in scripts/build/rust.ts, and on musl/android/freebsd clang treats it as unused). rustc surfaces that as a linker_messages warning prefixed warning: linker stderr: ….
3. Under -D warnings, that warning is now a hard error → build-rust exits non-zero → scripts/build/ci.ts:143 posts the ❌ annotation → robobun reports the failure.
4. Commit 7b7737e adds linker_messages = "allow" to [workspace.lints.rust]. This fixes the Windows host build (per the commit message), but Build #57446 against the next commit 72556c0 shows the same six non-Windows targets still failing with the identical message — i.e., on those targets the allow is not reaching whatever rustc invocation emits the diagnostic.
5. No commit between 72556c0 and HEAD (2d94380) touches the lint table or build scripts.

Fix

Two independent edits:

• CI break: since the lint-table allow demonstrably isn't reaching these targets, fix it at the source — either gate -Crelocation-model=static (and thus rustc's -no-pie injection) to glibc-only targets in scripts/build/rust.ts, or append -Wno-unused-command-line-argument to the linker-driver flags so clang stops emitting the message. Setting -A linker_messages via RUSTFLAGS in the build script would also work (RUSTFLAGS reaches every rustc invocation, including host proc-macro links, unlike [workspace.lints]).
• Incorrect comment: reword 184-186 to say that only allow (or force-warn) overrides -D warnings; level = "warn" is recaptured. Optionally drop the no-op level = "warn" from the unexpected_cfgs entry (the check-cfg key is the only part doing work), and revisit the line-195 "exempts itself from -D warnings" claim in light of the CI evidence.

[claude]

🟡 One more orphaned-reference instance not in the open #22/#25/#26/#27 lists or resolved #16: the doc on pub fn to_source (line 3186) reads "/// to_source_at rooted at the process CWD." — but this PR deletes the local pub fn to_source_at wrapper it described (the hunk immediately above). The remaining to_source_at hits (lines 2663/3167, transpiler.rs:1828) are the unrelated bun_sys::File::to_source_at. Same fix as the prior sweeps — reword to reference source_from_file_at (or source_from_file). Doc-only, no build/runtime effect.

Extended reasoning...

What was left behind

Same orphaned-reference-to-deleted-item category as resolved comment #16 (3292377782: live_arena_heaps/DumpOptions/allocator_has_pointer/heap::leak/allocator<T>), which the author accepted and swept in f8b2ca0. This is one more instance not enumerated in #16 or in any of the open lists (#22 covers Package.rs/layer.rs/selectors/effects/list; #25 c_thunks; #26 heap_breakdown HeapLabel/named_allocator; #27 ParentDeathWatchdog/keyframes/ident/dependency).

The doc comment on pub fn to_source at src/ast/lib.rs:3186 reads:

/// `to_source_at` rooted at the process CWD.
pub fn to_source(path: &bun_core::ZStr, opts: ToSourceOptions) -> bun_sys::Result<Source> {
    source_from_file(path, opts)
}

It describes to_source as "to_source_at rooted at CWD" — but this PR's hunk @@ -3222,15 +3183,6 @@ (immediately above this line in the diff) deletes the local pub fn to_source_at wrapper it referred to:

-/// Read `path` (relative to `dir_fd`) into memory and wrap it in a `Source`.
-pub fn to_source_at(
-    dir_fd: bun_sys::Fd,
-    path: &bun_core::ZStr,
-    opts: ToSourceOptions,
-) -> bun_sys::Result<Source> {
-    source_from_file_at(dir_fd, path, opts)
-}
-
 /// `to_source_at` rooted at the process CWD.
 pub fn to_source(...)

The doc now describes to_source in terms of a sibling function that no longer exists.

Step-by-step proof

1. Before this PR, src/ast/lib.rs defined two thin wrappers in this module: pub fn to_source_at(dir_fd, path, opts) (forwarding to source_from_file_at) and pub fn to_source(path, opts) (forwarding to source_from_file). The doc on to_source — "/// to_source_at rooted at the process CWD." — accurately described it as the CWD-rooted variant of its sibling to_source_at.
2. This PR deletes pub fn to_source_at (visible as a 9-line removal in the diff hunk @@ -3222,15 +3183,6 @@) but leaves the doc on to_source as an unchanged context line.
3. At HEAD, line 3186 still reads /// to_source_at rooted at the process CWD. and line 3187 is pub fn to_source(...). rg to_source_at src/ returns five hits:
   • src/ast/lib.rs:3186 — this stale doc (the only reference to the deleted local fn).
   • src/ast/lib.rs:2663 and :3167 — references to bun_sys::File::to_source_at (a different method in a different namespace; the MOVE_DOWN provenance comment on source_from_file_at).
   • src/bundler/transpiler.rs:1828 — also File::to_source_at (provenance comment).
   • src/runtime/cli/pack_command.rs:71 — an unrelated local fn file_to_source_at (different identifier).
4. No local to_source_at exists anymore in this module; the doc's referent is gone.

Why nothing prevents it

Same as every prior instance in this PR: the compiler doesn't lint doc-comment prose, and the dead-code deletion only touched the item, not the adjacent prose that referenced it. cargo check --workspace (the PR's stated verification) doesn't run rustdoc, and rustdoc wouldn't flag a backtick-quoted identifier that isn't an intra-doc link anyway.

Impact

Documentation-only — zero build, lint, or runtime effect. Same lowest-tier-of-nit category as the ~16+ orphaned-reference instances the author has already accepted and swept across d8ee30d / 01fc54b / 3f63077 / 7915136 / 9abf984 / f8b2ca0. Filed only because (a) it's exactly the category resolved #16 covered, (b) src/ast/lib.rs:3186 isn't enumerated in any open or resolved list, and (c) the diff context proves the deletion and the surviving doc are in the same hunk.

Fix

Reword line 3186 to reference the surviving sibling, e.g.:

/// `source_from_file_at` rooted at the process CWD.

or simply /// source_from_file convenience wrapper. — either restores a valid referent.

[Jarred-Sumner]

Reworded in a9b0374 — the doc now references source_from_file_at.

[claude]

🟡 The "Optionally" sub-item of resolved comment 3292362121 was missed: src/exe_format/elf.rs:527 still says "Do not route macho::utils::is_elf through this; that function is intentionally a 4-byte-magic-only sniff…" — but f8b2ca0 deleted pub mod utils from macho.rs entirely (the author's reply enumerated only the four primary items, not elf.rs). Same orphaned-reference-to-deleted-item category as resolved #16 and open #29; doc-only, no build/runtime effect — delete or reword the sentence at elf.rs:526-529.

Extended reasoning...

What was left behind

Resolved inline comment 3292362121 (#15, on src/install/lib.rs) listed five sub-items — four empty-container shells plus a final "Optionally also drop the stale macho::utils::is_elf reference in the comment at src/exe_format/elf.rs:527". The author's f8b2ca0 reply (3293857203) enumerated exactly four fixes: "deleted impl DependencyInstallContext {}, both pub mod utils {} shells in macho.rs/pe.rs (and the orphaned PE doc comment), and css/properties/contain.rs plus its pub mod contain; declaration" — the elf.rs sub-item is not mentioned, and the thread was marked resolved.

At HEAD, src/exe_format/elf.rs:525-529 reads:

/// Full ELF64-LE header validation (magic + class + endian). This is the strict
/// check used before parsing program/section headers — NOT a format sniff. Do
/// not route `macho::utils::is_elf` through this; that function is intentionally
/// a 4-byte-magic-only sniff used for elf-vs-macho dispatch and must accept
/// 32-bit/BE ELF.

But this PR's macho.rs diff at @@ -797,25 +797,6 @@ deletes the entire pub mod utils { pub fn is_elf(data: &[u8]) -> bool {…} pub fn is_macho(data: &[u8]) -> bool {…} } block (and f8b2ca0 then deleted the empty pub mod utils {} shell that remained). The doc comment now warns readers not to route a function through this code path that no longer exists anywhere in the tree.

Step-by-step proof

1. Resolved comment 3292362121 explicitly listed as its final sub-item: "Optionally also drop the stale macho::utils::is_elf reference in the comment at src/exe_format/elf.rs:527".
2. Commit f8b2ca0 (the author's response) deleted impl DependencyInstallContext {}, the two pub mod utils {} shells in macho.rs/pe.rs, the orphaned PE doc comment, and contain.rs + its mod declaration. The author's reply (3293857203) enumerated exactly those four items and did not mention elf.rs.
3. At HEAD, grep -rn 'macho::utils\|utils::is_elf\|utils::is_macho' src/ returns exactly one hit: src/exe_format/elf.rs:527.
4. grep -rn 'pub mod utils' src/exe_format/ returns zero hits — the module the comment references is gone.
5. git log --oneline -- src/exe_format/elf.rs shows no commit since the PR base touched lines 525-529.

Why nothing prevents it

Same as every prior orphaned-reference instance in this PR: rustc doesn't lint doc-comment prose, and rustdoc doesn't validate backtick-quoted identifiers that aren't intra-doc […] links. cargo check --workspace (the PR's stated verification) doesn't run rustdoc.

Same pattern as accepted follow-ups

This is the incomplete-fix-of-resolved-comment shape the author has already accepted three times in this PR's review cycle:

• #3292016403 (opaque_callback): d8ee30d fixed 3 of 4 items in a resolved thread; follow-up flagged the 4th → fixed in 3f63077.
• #3292365164 (heap_breakdown parenthetical): 9abf984 restored the lead line but skipped the parenthetical sub-item; follow-up flagged it → fixed in f8b2ca0.
• #3293929698 (fileToCrate): 00d7859 fixed the primary impl-skip bug but skipped the secondary dead-Map sub-item; follow-up flagged it → fixed in 672ec73.

It is also the same orphaned-reference-to-deleted-item category as resolved #16 (live_arena_heaps/DumpOptions/allocator_has_pointer/heap::leak/allocator<T> — all swept in f8b2ca0) and open #29 (3293966588, to_source_at in ast/lib.rs:3186). Not a duplicate of any open comment: checked #22/#23/#25/#26/#27/#28/#29/#30 — none mention elf.rs.

Impact

Documentation-only — zero build, lint, or runtime effect. Lowest tier of nit. The comment is now actively misleading (it tells readers not to route a function that doesn't exist through this validator), but validate_elf64_le is a private fn so the rustdoc isn't externally rendered. Filed only because (a) it directly contradicts a resolved-comment claim, (b) it's exactly the dead-prose category this PR explicitly targets, and (c) the author has accepted this exact follow-up shape three times already.

Fix

Delete or reword the second sentence at elf.rs:526-529. Simplest is to truncate after "NOT a format sniff.":

/// Full ELF64-LE header validation (magic + class + endian). This is the strict
/// check used before parsing program/section headers — NOT a format sniff.

[claude]

🟡 Two more comment-only file modules not in #22's enumeration: src/css/properties/svg.rs (was 30 lines of placeholder enums, now 1 comment line; mod.rs:189 still declares pub mod svg;) and src/sql_jsc/postgres/types/bool.rs (was 12 lines, now 1 comment line; postgres.rs:80-81 still declares #[path = "bool.rs"] pub mod r#bool;). Same shape and same fix as #15's contain.rs (deleted in f8b2ca0) and #22's effects.rs/list.rs — delete the files and their pub mod declarations.

Extended reasoning...

What was left behind

This is the same comment-only-file-module residue as resolved #15 (3292362121, which enumerated css/properties/contain.rs — deleted in f8b2ca0) and open #22 (3293839135, which enumerates css/properties/effects.rs + list.rs). Two more instances were gutted by commit 3f63077 (this PR's audit commit) but appear in neither enumeration:

File	Before	After	Orphaned declaration
src/css/properties/svg.rs	30 lines (7 placeholder pub enum types: StrokeLinecap/StrokeLinejoin/ColorInterpolation/ColorRendering/ShapeRendering/TextRendering/ImageRendering)	1 line: // ported from: src/css/properties/svg.zig	src/css/properties/mod.rs:189 — pub mod svg;
src/sql_jsc/postgres/types/bool.rs	12 lines	1 line: // ported from: src/sql_jsc/postgres/types/bool.zig	src/sql_jsc/postgres.rs:80-81 — #[path = "bool.rs"] pub mod r#bool; inside the inline pub mod types { ... } block

Why this would be missed when #22 is addressed

Open #22 enumerates exactly six locations: Package.rs:3152, layer.rs:22, selector.rs:42/selectors/mod.rs:60 (local_identifier), and css/properties/effects.rs + list.rs. The author's demonstrated pattern across this PR's ~12 review rounds is to fix exactly the enumerated locations — e.g., resolved #15 listed four locations (DependencyInstallContext, macho/pe utils, contain.rs), the author swept exactly those four in f8b2ca0, and then #22 found effects.rs/list.rs which #15 had missed. svg.rs and bool.rs are not in #22's list, so when #22 is addressed they would be missed again unless enumerated separately.

Why nothing catches it

Same as every prior comment-only-file-module instance: an empty file module compiles to nothing. dead_code analyzes items, not item containers — a module with zero items has nothing to flag. The new unreachable_pub = "deny" likewise only fires on pub items inside an unreachable path, not on a reachable pub mod with zero items. cargo check --workspace (the PR's stated verification) passes cleanly.

Step-by-step proof (svg.rs)

1. Before this PR (verified via git show 4df6154f:src/css/properties/svg.rs | wc -l → 30), the file contained 7 placeholder enum types with no parse/to_css impls — e.g., pub enum StrokeLinecap { Butt, Round, Square }.
2. Commit 3f63077 (this PR's "Audit cross-crate exports" commit) deleted all 7 types as dead — none were referenced anywhere — leaving only the // ported from: footer line. The cumulative PR diff for this file shows 29 lines deleted.
3. At HEAD, wc -l src/css/properties/svg.rs returns 1; the file's entire content is // ported from: src/css/properties/svg.zig. src/css/properties/mod.rs:189 still reads pub mod svg;.
4. The same verification applies to bool.rs: 1 line at HEAD, #[path = "bool.rs"] pub mod r#bool; still at src/sql_jsc/postgres.rs:80-81.

Impact

Zero build, lint, or runtime effect — purely cosmetic, the lowest tier of nit. Filed only because (a) this PR's stated purpose is removing exactly this category of dead-code residue, (b) the author has already accepted and swept the identical pattern (contain.rs in f8b2ca0, with #22 open for effects.rs/list.rs), and (c) without explicit enumeration these two would survive the #22 sweep.

Fix

Same treatment as contain.rs in f8b2ca0:

• Delete src/css/properties/svg.rs and the pub mod svg; line at src/css/properties/mod.rs:189.
• Delete src/sql_jsc/postgres/types/bool.rs and the #[path = "bool.rs"] pub mod r#bool; lines at src/sql_jsc/postgres.rs:80-81.