@bun-native/runtime 0.0.0-stage → 0.33.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Bunly contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,5 @@
-# Temporary Holding Version
+# @bun-native/runtime
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Bun Native host process lifecycle and bridge runtime.
+
+Part of [Bun Native](https://github.com/0xPlayerOne/bun-native), an experimental developer preview. Version 0.33.0 was built from [fa8bef754122](https://github.com/0xPlayerOne/bun-native/tree/fa8bef754122621d4235eb06e30bb1085b4f7b1e) and published from GitHub Actions with npm provenance. Use the Bun revision pinned in that commit's toolchain.json. Start with the [getting-started guide](https://github.com/0xPlayerOne/bun-native/blob/fa8bef754122621d4235eb06e30bb1085b4f7b1e/docs/getting-started.md); `bun-native host install` fetches the matching release host. The license notice is in LICENSE.

package/bun-native-source.json

@@ -0,0 +1,43 @@
+{
+  "schemaVersion": 1,
+  "commit": "fa8bef754122621d4235eb06e30bb1085b4f7b1e",
+  "tree": "f805e2eb19a4e10fc29d1dc827cf5bc617b5773b",
+  "files": {
+    "package.json": {
+      "bytes": 2164,
+      "sha256": "db50b6f81f25c113a46f8c9b038bc548a92effaeb4ad9562e5e95044baa7b66f"
+    },
+    "packages/runtime/package.json": {
+      "bytes": 195,
+      "sha256": "30d8e6684ee94e266b3bc63d151f718a5d0a8804b2155c11f74de3e7189af63a"
+    },
+    "packages/runtime/src/exit-diagnostic.ts": {
+      "bytes": 4876,
+      "sha256": "f73b2259d80a6584427ad3b27ad239b5950b816468cca8d64bdfc35a5f3cfce8"
+    },
+    "packages/runtime/src/index.ts": {
+      "bytes": 38743,
+      "sha256": "aba3c6c58e2b9089b4faaf32e512736e660314bc2c0f74f62fe6dba45df5b053"
+    },
+    "packages/runtime/src/installation.ts": {
+      "bytes": 1871,
+      "sha256": "a89c677fad56ace6839bda86891fafa088f3a37e0248c313a72d7918a0538a10"
+    },
+    "packages/runtime/src/startup-trace.ts": {
+      "bytes": 3021,
+      "sha256": "b34971a20cb541fa8cd97eb611d59923297844186b6653ecb607b4b29bf80b2d"
+    },
+    "LICENSE": {
+      "bytes": 1075,
+      "sha256": "86673fb485f12fa9aaa3941dfccc9f69a7f8322f8141d0d5c73db4323de10ac5"
+    }
+  },
+  "toolchain": {
+    "bytes": 3012,
+    "sha256": "00c3f707aae8abe9ca75cd2e162f5e1c7c34362a03675da39afead60d856066a"
+  },
+  "dependencyLock": {
+    "bytes": 28357,
+    "sha256": "65e3dbd01be4a1889367690faf1a9c3f08fb31d22dbd273d9bb9f39dd6baa6fb"
+  }
+}

package/package.json

@@ -1,6 +1,31 @@
 {
   "name": "@bun-native/runtime",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.33.0",
+  "type": "module",
+  "license": "MIT",
+  "files": [
+    "src",
+    "LICENSE",
+    "README.md",
+    "bun-native-source.json"
+  ],
+  "engines": {
+    "bun": "1.4.4-canary.1"
+  },
+  "exports": "./src/index.ts",
+  "description": "Bun Native host process lifecycle and bridge runtime.",
+  "dependencies": {
+    "@bun-native/protocol": "0.33.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/0xPlayerOne/bun-native.git",
+    "directory": "packages/runtime"
+  },
+  "homepage": "https://github.com/0xPlayerOne/bun-native#readme",
+  "bugs": "https://github.com/0xPlayerOne/bun-native/issues",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
+}

package/src/exit-diagnostic.ts

@@ -0,0 +1,128 @@
+/** Upper bound for the redacted native stderr tail carried by an exit diagnostic. */
+export const MAX_DIAGNOSTIC_TAIL = 2_048
+const MAX_DIAGNOSTIC_LINES = 32
+const MIN_REDACTED_ENV_VALUE = 6
+const REDACTED = '[redacted]'
+const CLIPPED = '…'
+const PANIC_LOCATION = /panicked at ([^\s:]+(?::\d+){2})/
+
+export type NativeHostExitReason = 'panic' | 'signal' | 'exit'
+
+/**
+ * Bounded record of an unexpected native host exit. It never carries the
+ * environment, command line or unredacted native output, so it is safe to log.
+ */
+export interface NativeHostExitDiagnostic {
+  readonly reason: NativeHostExitReason
+  /** Process exit code, or null when the host was terminated by a signal. */
+  readonly exitCode: number | null
+  readonly signal: string | null
+  /** Transport phase when the host exited. */
+  readonly phase: 'starting' | 'running' | 'stopping'
+  /** Requests that were awaiting acknowledgement and were rejected with this error. */
+  readonly pendingRequests: number
+  /** `file:line:column` of a Rust panic reported on stderr, if any. */
+  readonly panicLocation: string | null
+  /** Redacted last native stderr lines, at most MAX_DIAGNOSTIC_TAIL characters. */
+  readonly stderrTail: string
+  readonly stderrTruncated: boolean
+}
+
+export class NativeHostExitError extends Error {
+  override readonly name = 'NativeHostExitError'
+  constructor(
+    readonly diagnostic: Readonly<NativeHostExitDiagnostic>,
+    status: number
+  ) {
+    super(`Native host exited unexpectedly (${status}). ${diagnostic.stderrTail}`)
+  }
+}
+
+function escapeRegExp(text: string): string {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+/**
+ * Removes inherited environment values, assignments and credential-shaped
+ * tokens from native output. Over-redaction is acceptable; leaks are not.
+ */
+function redactDiagnostic(
+  text: string,
+  environment: Readonly<Record<string, string | undefined>>
+): string {
+  let redacted = text.replace(/\p{Cc}/gu, (control) =>
+    control === '\n' || control === '\t' ? control : ''
+  )
+  const values = [
+    ...new Set(
+      Object.values(environment).filter(
+        (value): value is string =>
+          typeof value === 'string' && value.trim().length >= MIN_REDACTED_ENV_VALUE
+      )
+    ),
+  ].sort((left, right) => right.length - left.length)
+  for (const value of values)
+    redacted = redacted.replace(new RegExp(escapeRegExp(value), 'g'), REDACTED)
+  return redacted
+    .replace(/\b([A-Za-z_][A-Za-z0-9_]*)=("[^"]*"|'[^']*'|\S+)/g, `$1=${REDACTED}`)
+    .replace(
+      /\b(authorization|bearer|token|secret|password|passwd|api[_-]?key|cookie)(\s*[:=]\s*|\s+)("[^"]*"|'[^']*'|\S+)/gi,
+      `$1$2${REDACTED}`
+    )
+    .replace(/\b[A-Za-z0-9+_-]{32,}={0,2}/g, REDACTED)
+}
+
+export function exitDiagnostic(input: {
+  exitCode: number | null
+  signal: string | null
+  phase: NativeHostExitDiagnostic['phase']
+  pendingRequests: number
+  stderr: string
+  /** The captured stderr lost its beginning; its first line may be a fragment. */
+  stderrClipped: boolean
+  /**
+   * Complete `panicked at` header and message lines kept while stderr was
+   * captured, so a long backtrace that clips the bounded capture cannot hide
+   * the panic itself.
+   */
+  panicReport?: string | null
+  environment: Readonly<Record<string, string | undefined>>
+}): Readonly<NativeHostExitDiagnostic> {
+  // A clipped first line can hold the end of a secret that no longer matches
+  // its full environment value, so it is dropped before redaction.
+  const stderr = input.stderrClipped
+    ? input.stderr.slice(input.stderr.indexOf('\n') + 1 || input.stderr.length)
+    : input.stderr
+  const redacted = redactDiagnostic(stderr, input.environment)
+  let panic = PANIC_LOCATION.exec(redacted)
+  // The kept report leads the tail only when the captured stderr lost it.
+  const report =
+    !panic && input.panicReport
+      ? redactDiagnostic(input.panicReport, input.environment)
+          .trimEnd()
+          .slice(0, MAX_DIAGNOSTIC_TAIL / 2)
+      : null
+  if (report) panic = PANIC_LOCATION.exec(report)
+  const reportLines = report ? [...report.split('\n'), CLIPPED] : []
+  let lines = redacted.trimEnd().split('\n')
+  const room = MAX_DIAGNOSTIC_LINES - reportLines.length
+  let truncated = input.stderrClipped || lines.length > room
+  lines = lines.slice(-room)
+  let tail = lines.join('\n')
+  const tailRoom = MAX_DIAGNOSTIC_TAIL - (report ? report.length + CLIPPED.length + 2 : 0)
+  if (tail.length > tailRoom) {
+    tail = tail.slice(-tailRoom)
+    truncated = true
+  }
+  if (report) tail = [...reportLines, tail].join('\n')
+  return Object.freeze({
+    reason: panic ? 'panic' : input.signal ? 'signal' : 'exit',
+    exitCode: input.exitCode,
+    signal: input.signal,
+    phase: input.phase,
+    pendingRequests: input.pendingRequests,
+    panicLocation: panic?.[1] ?? null,
+    stderrTail: tail,
+    stderrTruncated: truncated,
+  })
+}