AkurAI-Build

Latest change 1c2159692a31765cd66ed709791ba11468054873 - Initial commit: bunfork v0.1.0 source tree by Olafur Bui

Verdict: reject the broad compatibility claim. Bunfork has limited conceptual overlap with the named projects, but no source compatibility, no build compatibility, and currently no cross-framework deployment compatibility. Its own README is substantially more truthful than the proposed claim: it explicitly disclaims Bun, Next.js, and Svelte compatibility and any JS pipeline, package manager, hydration runtime, or plugin system ([README.md](/home/olafurbui/bunfork/README.md:3)).

The smallest credible product today is a single-user Linux SQLCipher vector appliance with a MiniJinja UI. The smallest credible compatibility target is narrower still: serving prebuilt static exports produced elsewhere, with external JS build tools and browser JS explicitly allowed.

One immediate conclusion outranks the compatibility discussion: static inspection shows `deploy --force` can erase arbitrary project directories, including `src`, `data`, or `.git`. That is a release blocker.

## Compatibility taxonomy

| Kind | Required contract | Bunfork today |
|---|---|---|
| Source compatibility | Existing `.svelte`, `.vue`, TSX, framework Rust, configs, imports, and APIs work unchanged | None |
| Build compatibility | Equivalent `dev/build/test/start`, transforms, module graph, diagnostics, HMR, manifests, chunks, source maps | None |
| Deployment compatibility | Existing adapter/preset artifacts run with equivalent process, asset, routing, environment, and cache semantics | Only Bunfork’s own local directory; static-export hosting is not complete |
| Conceptual parity | Similar ideas such as file routes, server-rendered HTML, static assets, one CLI/process | Real but small |

“No JS runtime” must itself be split three ways:

- No server-side JS engine: compatible with prebuilt static sites, but not JS SSR, loaders, actions, RSC, or npm packages.
- No JS build toolchain: rules out compiling Svelte, Vue, React/Next/Rari, SvelteKit, and Nuxt sources with their official semantics.
- No browser JS or WASM: rules out hydration, reactive event handlers, soft navigation, and the interactive web modes of Leptos and Dioxus.

If all three are prohibited, the honest common denominator is HTML, CSS, forms, and framework-inspired routing.

# 1. Strongest objections

1. **Deployment is presently unsafe.** `--out` accepts any single direct child of the project. With `--force`, an existing directory is renamed, replaced, and then recursively deleted. Only ancestry relationships with the selected pages/public directories are checked. Thus `bunfork deploy --out .git --force`, `--out src`, or `--out data` passes the relevant ownership test and can destroy the directory ([main.rs](/home/olafurbui/bunfork/src/main.rs:334), [main.rs](/home/olafurbui/bunfork/src/main.rs:382), [main.rs](/home/olafurbui/bunfork/src/main.rs:431)). Compatibility work should stop until replacement is limited to a Bunfork-owned output manifest.

2. **The comparison set is a category error.**

   - Svelte and Vue are component compiler/reactivity systems.
   - SvelteKit, Next.js, Nuxt, and Rari are full-stack meta-frameworks.
   - Bun and Deno are language runtimes and developer toolchains.
   - Leptos and Dioxus are Rust UI/component systems with separate server/browser build products.

   A Rust HTTP server, a bracket-route matcher, and a single CLI are not a common compatibility layer across those categories.

3. **Rust implementation does not eliminate JavaScript semantics.** Bun is explicitly a JS/TS runtime, Node replacement, package manager, bundler, and test runner, backed by JavaScriptCore ([Bun README](/home/olafurbui/bunfork/.refrepos/bun/README.md:25), [Bun license](/home/olafurbui/bunfork/.refrepos/bun/docs/project/license.mdx:8)). Deno is a V8-based JS/TS/WASM runtime ([Deno README](/home/olafurbui/bunfork/.refrepos/deno/README.md:9), [Deno Cargo](/home/olafurbui/bunfork/.refrepos/deno/Cargo.toml:108)). Even Andromeda—the Rust-first comparison—depends on Nova as its JS VM ([Andromeda runtime](/home/olafurbui/bunfork/.refrepos/andromeda/crates/runtime/Cargo.toml:20)).

   Rari is the decisive counterexample: its advertised architecture is Rust HTTP/routing plus embedded V8, React, Vite, and TypeScript ([Rari README](/home/olafurbui/bunfork/.refrepos/rari/README.md:16)); it constructs `deno_core::JsRuntime` ([runtime_builder.rs](/home/olafurbui/bunfork/.refrepos/rari/crates/rari/src/runtime/factory/runtime_builder.rs:33)) and hydrates through React and Vite virtual modules in the browser ([entry-client.ts](/home/olafurbui/bunfork/.refrepos/rari/packages/rari/src/runtime/entry-client.ts:1)). Removing that runtime removes the behavior being compared.

4. **Route syntax is a false equivalence.** Bun itself carefully calls its matcher merely “Next.js-style” and says it does not support the App Router ([file-system-router.mdx](/home/olafurbui/bunfork/.refrepos/bun/docs/runtime/file-system-router.mdx:6)). Bunfork implements useful static, parameter, catch-all, optional-catch-all, and group syntax, but not layouts, route handlers, loading/error boundaries, data lifecycles, metadata, caching, or client navigation.

   There are also local contract holes:

   - `/api` and `/assets` page routes can be discovered and counted but are shadowed by fixed services ([server.rs](/home/olafurbui/bunfork/src/server.rs:198)).
   - Repeated parameter names are accepted and silently overwrite earlier values ([server.rs](/home/olafurbui/bunfork/src/server.rs:627)).
   - Catch-all values are strings, whereas several comparator contracts expose segment arrays.
   - Query data is unavailable to templates.

5. **“Full-stack” is not user-visible today.** Application authors cannot define server loaders, actions, endpoints, middleware, or database logic. The complete page contract is one MiniJinja template compiled per request with only `params`, `pathname`, `tenant`, and `model` ([server.rs](/home/olafurbui/bunfork/src/server.rs:376)). The vector API is fixed framework code, not an application extension mechanism.

   Worse, the two halves do not compose safely: templates cannot call the database server-side, while exposing the global bearer token to browser code would defeat the security boundary.

6. **The page server is tightly coupled to the vector appliance.** Before serving health, assets, or a page, Bunfork requires a migrated SQLCipher database, database key, and separate API token ([main.rs](/home/olafurbui/bunfork/src/main.rs:213)). A static site cannot start independently. Every app therefore pays for SQLCipher, migrations, vectors, two secrets, filesystem hardening, and backup semantics even when none are wanted.

7. **There is no application build system.** Cargo builds Bunfork itself. It does not parse Svelte/Vue SFCs, TypeScript, JSX/TSX, React directives, framework configs, CSS modules, or import graphs. It emits no browser/server split, hashes, manifests, chunks, or source maps. Bun’s own bundler documentation explains that transforms and client/server code splitting are how framework features exist ([bundler index](/home/olafurbui/bunfork/.refrepos/bun/docs/bundler/index.mdx:43)).

   `dev` means rescan the page tree on each request, not HMR. `serve` freezes the route table but still reads and compiles page content on each request. `bunfork test` runs Bunfork’s Cargo tests and direct helper smoke checks, not an application/browser build ([main.rs](/home/olafurbui/bunfork/src/main.rs:296)).

8. **The named framework contracts are materially absent.**

   - Svelte source contains scripts, reactive event handlers, and scoped styles requiring compilation ([App.svelte](/home/olafurbui/bunfork/.refrepos/bun/test/integration/svelte/fixtures/app/App.svelte:1)).
   - SvelteKit specifies Vite development/HMR, `+page.svelte`, adapters, and a JS SSR bundle ([sveltekit.mdx](/home/olafurbui/bunfork/.refrepos/bun/docs/guides/ecosystem/sveltekit.mdx:49)).
   - Next invokes the actual Next CLI for dev/build/start and promises SSR, SSG, and API routes ([nextjs.mdx](/home/olafurbui/bunfork/.refrepos/bun/docs/guides/ecosystem/nextjs.mdx:7)).
   - Nuxt requires nuxi, generated types, Vite, Nitro, and an executable `.output/server/index.mjs` ([nuxt.mdx](/home/olafurbui/bunfork/.refrepos/bun/docs/guides/ecosystem/nuxt.mdx:7)).
   - Leptos defines full-stack as CSR, SSR, or SSR plus hydration, with isomorphic server functions ([Leptos README](/home/olafurbui/bunfork/.refrepos/leptos/README.md:71)).
   - Dioxus promises signals, server functions, hot reload, hydration, browser WASM, native targets, and bundling ([Dioxus README](/home/olafurbui/bunfork/.refrepos/dioxus/README.md:71)).

9. **“One binary” is misleading.** The homepage says “One binary for your app and data” ([index.html](/home/olafurbui/bunfork/app/pages/index.html:21)), but runtime requires external pages, assets, database, lock file, key, and token. Deployment explicitly excludes database and secrets. The current `dist/bunfork` is also a dynamically linked x86-64 ELF requiring glibc, libm, and libgcc, so it is not a hermetic or portable single-file application.

10. **Even narrow current claims have release gaps.**

   - Deploy copies arbitrary files but hard-codes `database_included: false` and `secrets_included: false`; those flags can be false statements ([main.rs](/home/olafurbui/bunfork/src/main.rs:404), [bunfork.json](/home/olafurbui/bunfork/dist/bunfork.json:1)).
   - `test`/`deploy` do not validate the public tree, so a hidden public file can produce a deployment that subsequently refuses to start ([server.rs](/home/olafurbui/bunfork/src/server.rs:164)).
   - Invalid template syntax is not detected during deploy.
   - “Exact schema” validation checks versions, ledger text, and existence of two tables—not exact columns, constraints, indexes, or extra objects ([db.rs](/home/olafurbui/bunfork/src/db.rs:634)).
   - Invalid vector IDs, limits, dimensions, and budgets become HTTP 500 instead of client errors ([server.rs](/home/olafurbui/bunfork/src/server.rs:299)).
   - The database key/API-token reuse check compares hex strings, while key decoding is case-insensitive. Uppercase and lowercase encodings of the same bytes bypass the intended separation ([main.rs](/home/olafurbui/bunfork/src/main.rs:216), [db.rs](/home/olafurbui/bunfork/src/db.rs:729)).
   - Existing migration database paths lack the hard-link check used by normal database opening ([db.rs](/home/olafurbui/bunfork/src/db.rs:757)).
   - The database is a single `Arc<Mutex<Connection>>`, serializing all database work; appropriate for an appliance, not a broad framework scalability claim ([db.rs](/home/olafurbui/bunfork/src/db.rs:30)).

11. **The evidence base is not yet reproducible.** The main branch has no commits and every authored file is untracked. `.refrepos`, `dist`, and `target` are ignored. The canonical Svelte, SvelteKit, Next, Vue, and Nuxt repositories are not present under `.refrepos`; local evidence for them comes through Bun/Deno compatibility docs and fixtures. The “ten adversarial passes” file currently contains only an index ([docs/adversarial/README.md](/home/olafurbui/bunfork/docs/adversarial/README.md:3)).

# 2. What is already defensible

These are implementation facts, not ecosystem compatibility:

- The public README’s explicit non-compatibility boundary is correct and should remain.
- The page router implements a coherent small grammar: static routes, parameters, required and optional terminal catch-alls, groups, ambiguity detection, and deterministic precedence ([server.rs](/home/olafurbui/bunfork/src/server.rs:554)).
- MiniJinja rendering is request-local and HTML autoescaping is enabled ([server.rs](/home/olafurbui/bunfork/src/server.rs:394)).
- Static assets, gzip compression, basic security headers, and graceful signal handling exist.
- SQLCipher/OpenSSL are vendored through the selected `rusqlite` feature ([Cargo.toml](/home/olafurbui/bunfork/Cargo.toml:16)).
- Migrations are embedded, ledger-checked, and transactional ([db.rs](/home/olafurbui/bunfork/src/db.rs:83)).
- Vector search is exhaustive rather than ANN, tenant/model/dimension scoped, normalized, bounded, and deterministically tie-broken ([db.rs](/home/olafurbui/bunfork/src/db.rs:151)). “Exact” should mean exhaustive selection, not exact arithmetic; scoring uses ordinary `f32`.
- Same-key encrypted backup and carefully staged restore paths are substantive, differentiated features ([db.rs](/home/olafurbui/bunfork/src/db.rs:265), [db.rs](/home/olafurbui/bunfork/src/db.rs:410)).
- The deployment directory is atomically staged in the normal case, and its current authored files byte-match their first-party sources. Its replacement ownership logic remains unsafe.

A defensible present-tense description would be:

> A small Linux-first Rust server for MiniJinja pages and a SQLCipher-backed exact-vector API, intended for loopback or operation behind a trusted TLS reverse proxy.

Do not call it a Bun/Deno runtime, a Svelte/Next/Vue adapter, or a Leptos/Dioxus alternative.

# 3. Ranked minimal feature set

The smallest cross-framework compatibility target should be:

> Deployment compatibility for explicitly supported prebuilt static exports. Framework source is built elsewhere; browser JS/WASM is allowed; Bunfork embeds no server-side JS engine.

Current Bunfork does not yet meet even that target because assets live only under `/assets`, there is no SPA/deep-link fallback mode, the CSP can block generated inline bootstrap code, and serving still requires the database and both secrets.

Ranked work:

1. **P0 — Make deployment non-destructive and truthful.**

   Require a valid Bunfork ownership manifest before `--force` replacement. Refuse `.git`, `src`, `data`, `backups`, `target`, and any unowned directory. Derive secret/database flags from inspected contents or remove those assertions.

2. **P0 — Establish one real black-box HTTP/deployment suite.**

   Start the shipped binary and test the listener. Helper-level route/database tests are insufficient.

3. **P1 — Decouple site serving from the data appliance.**

   A page/static-only mode must start without a database, database key, or API token. Make vectors an opt-in service.

4. **P1 — Define correct static-export serving semantics.**

   Serve output at URL root, with explicit modes for file-based MPA, pretty URLs, and SPA history fallback. Specify `GET`, `HEAD`, ranges, MIME, ETag/cache headers, compression, custom 404s, and CSP behavior.

5. **P1 — Produce an immutable owned artifact.**

   Validate routes, templates, public files, and manifest contents before publication. Run the bundle from a clean compatible container without Cargo or source checkout. Resolve content paths relative to the artifact, not accidental working directory.

6. **P2 — If “server-rendered full-stack” remains desired, add a Rust MPA contract.**

   The minimum is request method, query, headers, cookies, form/body parsing, response status/headers/redirect, application-defined Rust loaders/actions, nested layouts/includes, custom 404/500, and progressive-enhancement forms. Without application-defined server behavior, “full-stack framework” remains false.

7. **P2 — Add development diagnostics, not a framework compiler.**

   Validate templates on startup/deploy, watch route/content changes, report file/line errors, and optionally inject a development-only browser reload client. Do not call request-time rescanning HMR.

8. **Stop there.**

   Do not build a second Svelte/Vue compiler, React/RSC engine, Bun/Deno runtime, or Leptos/Dioxus reactive UI system. Use those projects or host their static output.

# 4. Black-box acceptance tests

No compatibility claim should graduate based on implementation resemblance. Use pinned official fixture projects and observable behavior.

| Claim earned | Black-box gate |
|---|---|
| Safe deploy | Put a sentinel file in an unowned direct-child directory. `deploy --force` must fail and preserve every byte. Replacing a valid prior Bunfork-owned bundle must succeed and run. |
| Bunfork route compatibility | Start the binary and request static, parameter, required/optional catch-all, grouped, shadowed, encoded, malformed, trailing-slash, 404, `HEAD`, and wrong-method cases. Assert exact status, headers, body, and parameter representation. |
| Bunfork SSR | Concurrently request distinct HTML-metacharacter params and assert correct escaping and no request-context leakage. Invalid templates must fail build/deploy, not return the first production 500. |
| Page-only server | Start with only binary/pages/assets and no database or secrets; health, page, and asset requests must succeed. |
| “Full-stack MPA” | With browser JS disabled, submit a form, validate input, mutate state, receive a 303 redirect, observe cookies/headers, and render updated state. Test nearest layout/error behavior and custom 404/500 pages. |
| Source compatibility | Run unmodified official source fixtures under the candidate command. Any port, rewrite, precompile, or framework-specific source conversion means the source-compatibility claim fails. |
| Build compatibility | Run reference and candidate builds on the same fixture. Compare exit code, normalized diagnostics, entrypoints, asset hashes, chunks, manifests, source maps, and runtime DOM/network behavior. Bun’s Next test demonstrates the appropriate rigor by comparing normalized output and hashed `.next` artifacts ([next-build.test.ts](/home/olafurbui/bunfork/.refrepos/bun/test/integration/next-pages/test/next-build.test.ts:113)). |
| Static deployment compatibility | Build each supported fixture with its official static adapter, copy only the documented output into a clean image, and serve through Bunfork. Crawl deep links and assets; test reloads, MIME, cache headers, CSP, browser console, and any browser-side interaction. |
| Own deployment contract | Copy only the produced Bunfork directory into a clean compatible Linux image with no Cargo/source. Generate secrets, migrate, start from an arbitrary working directory, serve pages/assets/API, send SIGTERM/SIGINT, and assert clean exit. |
| Data/security contract | Test wrong/equivalent-case keys, plaintext-marker absence, no-overwrite backup, restore preservation, concurrent maintenance locks, malformed vectors returning stable 4xx errors, and crash/fault cleanup. This is evidence, not cryptographic proof. |

The source fixture matrix must include:

- Svelte counter with `<script>`, scoped CSS, and click reactivity; SvelteKit page/layout/action/endpoint.
- Next and Rari nested layout, client counter, server action, API route, loading/error boundary, metadata, and streaming response.
- Vue SFC with reactivity/scoped CSS/router; Nuxt page/layout/server API/async data.
- Bun/Deno TypeScript module import, package script, test, fetch, permission denial, and compile/bundle cases.
- Leptos and Dioxus official counters with SSR, hydration, browser state, server function, and production bundle.

Current outcome is predictable: Bunfork fails all source/build gates, partially implements the routing gate, and does not yet pass the static-deployment gate.

Rari’s local browser tests are a useful contract model: dynamic routing and navigation ([dynamic-routes.spec.ts](/home/olafurbui/bunfork/.refrepos/rari/test/e2e/dynamic-routes.spec.ts:8)), nested layout behavior ([route-conventions.spec.ts](/home/olafurbui/bunfork/.refrepos/rari/test/e2e/route-conventions.spec.ts:3)), and no-browser-JS form actions ([server-actions-progressive-enhancement.spec.ts](/home/olafurbui/bunfork/.refrepos/rari/test/e2e/server-actions-progressive-enhancement.spec.ts:34)).

One caveat: “contains no embedded JS runtime” cannot be proven solely black-box. It needs dependency/SBOM, binary, license, and provenance inspection in addition to observing that the process never executes an external runtime.

# 5. Explicit no-go scope

Unless the product explicitly admits a JS build/runtime dependency, exclude:

- Unmodified `.svelte`, `.vue`, JS, JSX, TS, TSX, Next, Nuxt, SvelteKit, or Rari source compatibility.
- npm/JSR/package-manager semantics, lifecycle scripts, lockfile compatibility, Node/Web APIs, native addons, `eval`, workers, inspectors, REPLs, or runtime permissions.
- Official Next `.next`, Svelte server-adapter, Nuxt/Nitro `.output`, or Rari `dist` execution.
- React Server Components, Flight, Fizz, Suspense streaming, server actions, framework middleware, and JS API modules.
- Hydration, reactive components, client-side routers, state-preserving HMR, and soft navigation.
- Reimplementing Leptos or Dioxus components, signals, macros, browser WASM, server-function code generation, desktop, or mobile bundles.
- Claims of cloud, edge, serverless, Vercel, Deno Deploy, Lambda, container, DNS, TLS, or provisioning compatibility.
- Multi-user authorization, distributed locks, ANN search, full-text search, secret rotation, and remote backup transport unless separately designed and tested.
- “Drop-in,” “replacement,” “runs X apps,” “adapter-compatible,” or unqualified “close to” wording.

Safe language:

- “Next/Rari-inspired file-route syntax.”
- “Rust server-rendered MiniJinja MPA.”
- After the static-host gates pass: “Serves prebuilt static exports from these documented framework configurations.”
- Never turn conceptual influence into a compatibility claim.

# 6. Exact local evidence map

Bunfork’s product boundary and planned adapter pressure:

- [README.md](/home/olafurbui/bunfork/README.md:3)
- [docs/adversarial/README.md](/home/olafurbui/bunfork/docs/adversarial/README.md:3)
- [Cargo.toml](/home/olafurbui/bunfork/Cargo.toml:8)
- [app/pages/index.html](/home/olafurbui/bunfork/app/pages/index.html:21)

Current architecture and blockers:

- [src/main.rs — mandatory DB/token startup](/home/olafurbui/bunfork/src/main.rs:213)
- [src/main.rs — smoke tests](/home/olafurbui/bunfork/src/main.rs:296)
- [src/main.rs — deploy path validation](/home/olafurbui/bunfork/src/main.rs:334)
- [src/main.rs — deployment replacement](/home/olafurbui/bunfork/src/main.rs:431)
- [src/server.rs — fixed route/service namespaces](/home/olafurbui/bunfork/src/server.rs:198)
- [src/server.rs — template/request contract](/home/olafurbui/bunfork/src/server.rs:376)
- [src/server.rs — route grammar](/home/olafurbui/bunfork/src/server.rs:554)
- [src/server.rs — helper-only server tests](/home/olafurbui/bunfork/src/server.rs:759)
- [src/db.rs — serialized connection](/home/olafurbui/bunfork/src/db.rs:30)
- [src/db.rs — schema validation](/home/olafurbui/bunfork/src/db.rs:634)
- [dist/bunfork.json](/home/olafurbui/bunfork/dist/bunfork.json:1)
- [dist/bunfork](/home/olafurbui/bunfork/dist/bunfork)

Reference contracts:

- [Bun README](/home/olafurbui/bunfork/.refrepos/bun/README.md:25)
- [Bun bundler contract](/home/olafurbui/bunfork/.refrepos/bun/docs/bundler/index.mdx:43)
- [Deno README](/home/olafurbui/bunfork/.refrepos/deno/README.md:9)
- [Deno V8 dependency](/home/olafurbui/bunfork/.refrepos/deno/Cargo.toml:108)
- [Deno’s Next execution path](/home/olafurbui/bunfork/.refrepos/deno/cli/tools/framework.rs:232)
- [Deno’s SvelteKit artifact distinctions](/home/olafurbui/bunfork/.refrepos/deno/cli/tools/framework.rs:477)
- [Deno’s static Vite output contract](/home/olafurbui/bunfork/.refrepos/deno/cli/tools/framework.rs:638)
- [Rari architecture](/home/olafurbui/bunfork/.refrepos/rari/README.md:16)
- [Rari JS runtime construction](/home/olafurbui/bunfork/.refrepos/rari/crates/rari/src/runtime/factory/runtime_builder.rs:33)
- [Leptos full-stack definition](/home/olafurbui/bunfork/.refrepos/leptos/README.md:71)
- [Leptos dual build tooling](/home/olafurbui/bunfork/.refrepos/leptos/ARCHITECTURE.md:220)
- [Dioxus product contract](/home/olafurbui/bunfork/.refrepos/dioxus/README.md:71)
- [Dioxus workspace surface](/home/olafurbui/bunfork/.refrepos/dioxus/Cargo.toml:3)
- [Andromeda JS-engine dependency](/home/olafurbui/bunfork/.refrepos/andromeda/crates/runtime/Cargo.toml:20)

No files were edited.