diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a42c16781..07ac28ec1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -81,6 +81,26 @@ jobs:
           npx prisma db seed
       - run: npm test
 
+  bun:
+    name: Bun runtime smoke (#508)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          cache: npm
+      # npm ci installs the workspace + the `amaro` optionalDependency that the
+      # Bun stripper backend needs.
+      - run: npm ci
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+      # Boot a webjs app under Bun: SSR + TypeScript strip (via amaro, since Bun
+      # has no built-in stripper) + a server-action RPC round-trip.
+      - name: webjs runtime smoke on Bun
+        run: bun test/bun/smoke.mjs
+
   browser:
     name: Browser (web-test-runner / Playwright)
     runs-on: ubuntu-latest
diff --git a/AGENTS.md b/AGENTS.md
index dff746d8a..a48717cb0 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -78,7 +78,7 @@ See `agent-docs/framework-dev.md` for monorepo commands, workspace layout, per-f
 
 An **AI-first, web-components-first** framework inspired by NextJs, Lit, and Rails. The component runtime API matches lit (reactive `static properties`, the lit lifecycle hooks, ReactiveControllers, the `lit-html` directive set, `html` / `css` templates) so lit training data transfers directly, but webjs ships its own no-build implementation under `packages/core/src/`. Decorators are the one lit exception (invariant 10); use `declare` + `static properties`.
 
-- **No build step.** Source files are served as native ES modules. JSDoc `.js` is default; `.ts` / `.mts` is stripped via Node 24+'s `module.stripTypeScriptTypes` (invariant 10 + `agent-docs/typescript.md`). Node 24+ is required, enforced by an early `assertNodeVersion()` preflight.
+- **No build step.** Source files are served as native ES modules. JSDoc `.js` is default; `.ts` / `.mts` is stripped through a pluggable stripper (#508): Node 24+'s built-in `module.stripTypeScriptTypes`, or `amaro` on Bun (byte-identical, position-preserving) (invariant 10 + `agent-docs/typescript.md`). **Runs on Node 24+ or Bun** (run a Bun app with `bun --bun run dev` / `start`); the early `assertNodeVersion()` preflight enforces the Node floor and admits Bun. Edge runtimes (no filesystem) are a separate, later target.
 - **SSR + CSR by default.** Pages are server-rendered HTML; components render light DOM by default, shadow DOM opt-in via `static shadow = true` with DSD SSR.
 - **Progressive enhancement is the default architecture.** Pages and components are SSR'd; with JS off, content reads, `<a>` navigates, `<form>` server actions submit, display-only elements render. JS is opt-in *per interactive behaviour* (`@click`, a reactive property assignment, a signal mutation). Never write a first paint that depends on hydration; never use `fetch` + JS where a `<form>` + server action would do.
 - **Display-only components are elided from the browser.** A component with no interactivity signal renders identical HTML with or without its JS, so the framework strips its import (and any vendor reachable only through it, importmap entry included) from the served source. Automatic, conservative, verified differentially. Disable with `"webjs": { "elide": false }` or `WEBJS_ELIDE=0`. See `agent-docs/components.md`.
diff --git a/agent-docs/typescript.md b/agent-docs/typescript.md
index 19ee2b8bd..1b196008d 100644
--- a/agent-docs/typescript.md
+++ b/agent-docs/typescript.md
@@ -6,12 +6,13 @@ run is part of the user-visible workflow, no separate build step:
 
 - **Editor** (VS Code) runs the TypeScript language server continuously. Red-squiggle on wrong types, including non-erasable syntax (see below).
 - **CI** (optional) runs `tsc --noEmit` against `tsconfig.json`. Type-check only. Also catches non-erasable syntax via `erasableSyntaxOnly`.
-- **Dev + prod server** (runtime, both directions): Node 24+'s built-in TypeScript type-stripping handles server-side `.ts` imports automatically (`process.features.typescript === 'strip'`). Browser-bound `.ts` requests go through `module.stripTypeScriptTypes` on the dev server, which performs whitespace replacement: every (line, column) in the source maps to the same position in the stripped output, so no sourcemap needs to be shipped and stack traces are byte-exact. The transform is cached by mtime (~microseconds per cache hit). Implementation backing: Node ships the [`amaro`](https://github.com/nodejs/amaro) package internally, which wraps SWC's WASM TypeScript transform in a position-preserving strip-only mode. If the framework ever needs to run on a non-Node runtime (Bun, Deno) we will install `amaro` directly or an equivalent position-preserving stripper (Sucrase preserves lines but not columns; SWC's strip mode also works).
+- **Dev + prod server** (runtime, both directions): the runtime's TypeScript type-stripping handles server-side `.ts` imports automatically (on Node, `process.features.typescript === 'strip'`; Bun runs `.ts` natively). Browser-bound `.ts` requests go through the pluggable stripper in `packages/server/src/ts-strip.js` (#508) on the dev server, which performs whitespace replacement: every (line, column) in the source maps to the same position in the stripped output, so no sourcemap needs to be shipped and stack traces are byte-exact. The transform is cached by mtime (~microseconds per cache hit). Implementation backing: on **Node 24+** it is the built-in `module.stripTypeScriptTypes` (which itself wraps the [`amaro`](https://github.com/nodejs/amaro) package, SWC's WASM TypeScript transform in position-preserving strip-only mode); on **Bun** (no such built-in) it is `amaro` loaded directly, an `optionalDependency` of `@webjsdev/server`, producing byte-identical output. `WEBJS_TS_STRIPPER=builtin|amaro` forces a backend. Edge runtimes without a filesystem are a separate, later target.
 
 ## TypeScript feature support: erasable only
 
-The framework uses Node 24+'s built-in `module.stripTypeScriptTypes`,
-which only supports **erasable TypeScript**: type annotations,
+The framework strips with Node 24+'s built-in `module.stripTypeScriptTypes`
+(or `amaro` on Bun, the same engine), which only supports **erasable
+TypeScript**: type annotations,
 `interface`, `type`, `declare`, generics, `import type`, `as` casts,
 and `satisfies`. Non-erasable syntax is rejected.
 
@@ -62,8 +63,8 @@ off so you catch the configuration drift before runtime.
 
 ## Import convention
 
-Use explicit `.ts` extensions in imports. Node 24+'s built-in
-type-stripping and the dev server's HTTP handler both key on the
+Use explicit `.ts` extensions in imports. The runtime's type-stripping
+and the dev server's HTTP handler both key on the
 file URL ending in `.ts` / `.mts`. For mixed codebases, `.js` imports
 that point at a `.ts` sibling also resolve in the dev server. Still
 prefer explicit `.ts`.
diff --git a/docs/app/docs/ai-first/page.ts b/docs/app/docs/ai-first/page.ts
index 3817adc9a..a9533bfdf 100644
--- a/docs/app/docs/ai-first/page.ts
+++ b/docs/app/docs/ai-first/page.ts
@@ -58,7 +58,7 @@ modules/posts/queries/get-post.server.ts      → exports getPost()</pre>
 
     <h3>4. No Build Step = What You See Is What Runs</h3>
     <p>Frameworks with build pipelines transform source code before it executes. The JSX you write becomes <code>React.createElement</code> calls. Your imports become webpack chunks. Your CSS modules get hashed classnames. An AI agent reading the source sees one thing, while the runtime does another.</p>
-    <p>webjs has <strong>no build step you run</strong>. The <code>.ts</code> file you see is the file that runs. <code>.ts</code> imports are stripped of types by Node 24+'s built-in <code>module.stripTypeScriptTypes</code>, which is whitespace replacement: every <code>(line, column)</code> in the source maps to the same position in the output, so stack traces stay byte-exact. The same transform runs server-side and on browser-bound requests. No intermediate representation, no generated code, no output directory. An AI agent can reason about what the code does by reading the file, because the file IS what runs. See <a href="/docs/no-build">No-Build Model</a> for the full pipeline.</p>
+    <p>webjs has <strong>no build step you run</strong>. The <code>.ts</code> file you see is the file that runs. <code>.ts</code> imports are stripped of types by the runtime's stripper (Node 24+'s built-in <code>module.stripTypeScriptTypes</code>, or <code>amaro</code> on Bun), which is whitespace replacement: every <code>(line, column)</code> in the source maps to the same position in the output, so stack traces stay byte-exact. The same transform runs server-side and on browser-bound requests. No intermediate representation, no generated code, no output directory. An AI agent can reason about what the code does by reading the file, because the file IS what runs. See <a href="/docs/no-build">No-Build Model</a> for the full pipeline.</p>
 
     <h3>5. Explicit Server Boundary</h3>
     <p>The <code>.server.ts</code> extension is a visible, greppable marker that says "this code runs only on the server." An AI agent never accidentally puts a database call in a component, because the naming convention prevents it. And the framework enforces it: <code>.server.ts</code> files are rewritten to RPC stubs for the browser.</p>
diff --git a/docs/app/docs/deployment/page.ts b/docs/app/docs/deployment/page.ts
index fd3197195..10380c537 100644
--- a/docs/app/docs/deployment/page.ts
+++ b/docs/app/docs/deployment/page.ts
@@ -5,7 +5,7 @@ export const metadata = { title: 'Deployment | webjs' };
 export default function Deployment() {
   return html`
     <h1>Deployment</h1>
-    <p>webjs runs as a standard Node.js server. There is no static export, no serverless adapter, no edge runtime. Deploy it anywhere you can run Node 24+ (the minimum is set by Node's built-in TypeScript type-stripping): a VPS, a container, a PaaS like Fly.io or Railway, or behind a reverse proxy on bare metal.</p>
+    <p>webjs runs as a standard server on <strong>Node 24+ or Bun</strong>. There is no static export, no serverless adapter, and no edge runtime yet. Deploy it anywhere you can run Node or Bun: a VPS, a container, a PaaS like Fly.io or Railway, or behind a reverse proxy on bare metal. On Node the minimum is set by the built-in TypeScript type-stripping; on Bun the stripping comes from <code>amaro</code> automatically, so the same source runs on either.</p>
 
     <h2>Dev vs Prod</h2>
     <p>webjs has two modes, controlled by the npm script (which wraps the underlying <code>webjs dev</code> / <code>webjs start</code> CLI):</p>
@@ -334,7 +334,7 @@ HEALTHCHECK CMD curl -f http://localhost:8080/__webjs/health || exit 1
 CMD ["npx", "webjs", "start"]</pre>
     <p>Tips:</p>
     <ul>
-      <li><code>node:slim</code> works fine. webjs strips TypeScript via Node 24+'s built-in <code>module.stripTypeScriptTypes</code>, so no extra system packages are needed.</li>
+      <li><code>node:slim</code> works fine. webjs strips TypeScript via the runtime's stripper (Node's built-in <code>module.stripTypeScriptTypes</code>, or <code>amaro</code> on a Bun image), so no extra system packages are needed.</li>
       <li><code>npm ci --omit=dev</code> skips dev dependencies. <code>@webjsdev/server</code> is a runtime dependency. webjs is buildless end-to-end: there is no bundler or transpiler at deploy time.</li>
       <li>Set <code>HEALTHCHECK</code> to the built-in health endpoint for container orchestrators.</li>
       <li>For apps with Prisma, add <code>RUN npx prisma generate</code> before the CMD.</li>
@@ -400,7 +400,7 @@ pm2 start "webjs start" --name my-app</pre>
 
     <h2>Deployment Checklist</h2>
     <ul>
-      <li>Node 24+ installed (required for the built-in TypeScript type-stripping that the framework uses for both server-side imports and browser-bound <code>.ts</code> files).</li>
+      <li>Node 24+ or Bun installed (the TypeScript type-stripping for both server-side imports and browser-bound <code>.ts</code> files comes from Node's built-in on Node, or <code>amaro</code> on Bun).</li>
       <li><code>npm ci --omit=dev</code> to install only runtime dependencies.</li>
       <li>Run <code>npx prisma generate</code> if you use Prisma.</li>
       <li>No build step. Source <code>.js</code> / <code>.ts</code> files are deployed as-is. TypeScript types are stripped on first request via Node's built-in stripper (whitespace replacement, byte-exact positions, no sourcemap overhead) and cached by mtime.</li>
diff --git a/docs/app/docs/getting-started/page.ts b/docs/app/docs/getting-started/page.ts
index e96fb2e1b..58d4cc24a 100644
--- a/docs/app/docs/getting-started/page.ts
+++ b/docs/app/docs/getting-started/page.ts
@@ -9,7 +9,7 @@ export default function GettingStarted() {
 
     <h2>Prerequisites</h2>
     <ul>
-      <li><strong>Node.js 24+</strong>: webjs uses Node's built-in TypeScript type-stripping (<code>process.features.typescript === 'strip'</code>), which is default-on and stable from Node 24.</li>
+      <li><strong>Node.js 24+ or Bun</strong>: on Node, webjs uses the built-in TypeScript type-stripping (<code>process.features.typescript === 'strip'</code>), default-on and stable from Node 24. On Bun (which has no such built-in), it strips via <code>amaro</code> automatically. Run a Bun app with <code>bun --bun run dev</code> / <code>bun --bun run start</code>.</li>
       <li><strong>npm</strong> (or any package manager).</li>
     </ul>
 
@@ -132,7 +132,7 @@ Counter.register('my-counter');</pre>
 
     <h2>How It Works</h2>
     <ul>
-      <li><strong>TypeScript:</strong> Node 24+ strips types natively via <code>module.stripTypeScriptTypes</code> (whitespace replacement, byte-exact line + column preservation, no sourcemap shipped). Every <code>.ts</code> file, whether server-side or browser-fetched, goes through the same stripper, so SSR and hydration produce identical JS. The transform is cached by mtime. Only erasable TypeScript is supported; <code>enum</code>, <code>namespace</code> with values, parameter properties, and legacy decorators fail at strip time with a pointer at the <code>no-non-erasable-typescript</code> lint rule.</li>
+      <li><strong>TypeScript:</strong> types are stripped by the runtime's stripper, Node 24+'s built-in <code>module.stripTypeScriptTypes</code> or <code>amaro</code> on Bun (byte-identical, whitespace replacement, byte-exact line + column preservation, no sourcemap shipped). Every <code>.ts</code> file, whether server-side or browser-fetched, goes through the same stripper, so SSR and hydration produce identical JS. The transform is cached by mtime. Only erasable TypeScript is supported; <code>enum</code>, <code>namespace</code> with values, parameter properties, and legacy decorators fail at strip time with a pointer at the <code>no-non-erasable-typescript</code> lint rule.</li>
       <li><strong>SSR:</strong> Pages are rendered to HTML strings on the server. Light-DOM components serialize as plain children with a <code>&lt;!--webjs-hydrate--&gt;</code> marker. Shadow-DOM components (opt-in) emit Declarative Shadow DOM so scoped styles paint before JS loads.</li>
       <li><strong>Hydration:</strong> When JS loads, custom elements upgrade and become interactive. The fine-grained renderer preserves focus, cursor position, and form state across state updates.</li>
       <li><strong>Progressive enhancement:</strong> Pages and every custom element are SSR'd. Each component's <code>render()</code> runs on the server, so its initial HTML is in the response before any script loads. With JS disabled: content reads, <code>&lt;a&gt;</code> links navigate, <code>&lt;form&gt;</code> + server actions submit, and even an interactive component (counter, dropdown, tabs) paints its initial state correctly. JS is opt-in <em>per interactive behavior</em>, not per component: a counter renders as "0" without JS, and only the +/- click handling needs scripts. See <a href="/docs/progressive-enhancement">Progressive Enhancement</a>.</li>
diff --git a/docs/app/docs/no-build/page.ts b/docs/app/docs/no-build/page.ts
index df7ecbb26..e1c2470e8 100644
--- a/docs/app/docs/no-build/page.ts
+++ b/docs/app/docs/no-build/page.ts
@@ -35,7 +35,7 @@ export default function NoBuild() {
     <ol>
       <li>Browser parses HTML, finds <code>&lt;script type="module" src="/app/page.ts"&gt;</code> (or follows an <code>import</code> from one that was already loaded).</li>
       <li>Server receives the request. Reads the file from disk.</li>
-      <li>If the file is <code>.ts</code> / <code>.mts</code>, runs Node 24+'s built-in <code>module.stripTypeScriptTypes</code>. This is whitespace replacement: every <code>(line, column)</code> in the source maps to the same position in the output, so no sourcemap is needed and stack traces are byte-exact. Only erasable TypeScript is supported. <code>enum</code>, <code>namespace</code> with values, parameter properties, legacy decorators, and <code>import = require</code> fail at strip time and the dev server returns a 500 naming the file. The scaffolded <code>tsconfig.json</code> turns on <code>erasableSyntaxOnly: true</code> by default so the compiler rejects these in your own code at edit time. Almost no npm package ships <code>.ts</code> source anyway: published packages compile to <code>.js</code> with sidecar <code>.d.ts</code> type files, which the runtime serves as plain JavaScript with no transform.</li>
+      <li>If the file is <code>.ts</code> / <code>.mts</code>, runs the runtime's stripper: Node 24+'s built-in <code>module.stripTypeScriptTypes</code>, or <code>amaro</code> on Bun (byte-identical). This is whitespace replacement: every <code>(line, column)</code> in the source maps to the same position in the output, so no sourcemap is needed and stack traces are byte-exact. Only erasable TypeScript is supported. <code>enum</code>, <code>namespace</code> with values, parameter properties, legacy decorators, and <code>import = require</code> fail at strip time and the dev server returns a 500 naming the file. The scaffolded <code>tsconfig.json</code> turns on <code>erasableSyntaxOnly: true</code> by default so the compiler rejects these in your own code at edit time. Almost no npm package ships <code>.ts</code> source anyway: published packages compile to <code>.js</code> with sidecar <code>.d.ts</code> type files, which the runtime serves as plain JavaScript with no transform.</li>
       <li>Result is cached in memory keyed by <code>(absolute path, mtime)</code>. A file edit invalidates naturally.</li>
       <li>Response is served as <code>application/javascript</code> with appropriate cache headers. In dev: <code>no-cache</code> (always revalidate, so an edit shows up immediately). In prod: a request that carries the content-hash <code>?v=&lt;digest&gt;</code> query the framework emits (see below) is served <code>public, max-age=31536000, immutable</code>; a bare un-fingerprinted request falls back to <code>public, max-age=3600</code>. Either way a weak ETag rides along for conditional GET.</li>
       <li>Browser executes the module, encounters its imports, repeat from step 1 for each.</li>
diff --git a/docs/app/docs/ssr/page.ts b/docs/app/docs/ssr/page.ts
index da6080fd4..627373586 100644
--- a/docs/app/docs/ssr/page.ts
+++ b/docs/app/docs/ssr/page.ts
@@ -25,7 +25,7 @@ export default async function Home() {
   \`;
 }</pre>
 
-    <p>Node 24+ strips TypeScript types natively when it imports a <code>.ts</code> file, so the file above runs directly on the server with no manual compilation step.</p>
+    <p>The runtime (Node 24+ or Bun) strips TypeScript types natively when it imports a <code>.ts</code> file, so the file above runs directly on the server with no manual compilation step.</p>
 
     <h2>The SSR Pipeline</h2>
     <p>When the server receives a GET request for a page URL, the pipeline runs in this order:</p>
diff --git a/docs/app/docs/typescript/page.ts b/docs/app/docs/typescript/page.ts
index 0ab154513..9356ecdcc 100644
--- a/docs/app/docs/typescript/page.ts
+++ b/docs/app/docs/typescript/page.ts
@@ -5,10 +5,10 @@ export const metadata = { title: 'TypeScript | webjs' };
 export default function TypeScript() {
   return html`
     <h1>TypeScript</h1>
-    <p>webjs is built for TypeScript from the ground up, but never forces a build step you run. The framework requires Node 24+, which strips TypeScript types natively (<code>process.features.typescript === 'strip'</code>). Server-side <code>.ts</code> imports work without any loader registration; browser-bound <code>.ts</code> requests go through <code>module.stripTypeScriptTypes</code> on the dev server. Both paths perform whitespace replacement: every (line, column) in the source maps to the same position in the stripped output, so no sourcemap is shipped and stack traces are byte-exact.</p>
+    <p>webjs is built for TypeScript from the ground up, but never forces a build step you run. It runs on <strong>Node 24+ or Bun</strong>; on Node the type-stripping is the built-in (<code>process.features.typescript === 'strip'</code>), on Bun it is <code>amaro</code> (byte-identical). Server-side <code>.ts</code> imports work without any loader registration; browser-bound <code>.ts</code> requests go through the runtime stripper on the dev server. Both paths perform whitespace replacement: every (line, column) in the source maps to the same position in the stripped output, so no sourcemap is shipped and stack traces are byte-exact.</p>
 
     <h2>No-Build TypeScript</h2>
-    <p>Node 24+'s built-in type stripping does the heavy lifting. The dev server reads each <code>.ts</code> request from disk, runs <code>module.stripTypeScriptTypes</code>, and serves the result. Transform time is around 1ms per file; the result is cached by mtime, so subsequent loads are instant. SSR and hydration produce identical JS because both halves use the same stripper.</p>
+    <p>The runtime's type stripping does the heavy lifting: Node 24+'s built-in <code>module.stripTypeScriptTypes</code>, or <code>amaro</code> on Bun (the same engine Node wraps internally, so the output is byte-identical). The dev server reads each <code>.ts</code> request from disk, strips it, and serves the result. Transform time is around 1ms per file; the result is cached by mtime, so subsequent loads are instant. SSR and hydration produce identical JS because both halves use the same stripper.</p>
     <p>On the server side, your pages, layouts, server actions, and middleware run as-is. On the client side, browsers fetch <code>.ts</code> URLs and receive whitespace-stripped JS with no sourcemap appended. The URL keeps its <code>.ts</code> extension; only the response body changes. In production, <code>webjs start</code> uses the same code path, with the same mtime cache.</p>
     <p>The "no build" promise is literal: every position in source maps to itself in runtime. DevTools shows accurate stack traces without consulting a sourcemap, and wire bytes drop by roughly 70% vs a bundler-with-sourcemap pipeline.</p>
 
@@ -67,8 +67,8 @@ import { slugify } from '../utils/slugify.js';
 import { prisma } from '../lib/prisma';       // ERROR</pre>
     <p>This convention works because:</p>
     <ul>
-      <li>Node 24+ strips types from <code>.ts</code> imports server-side natively. No loader hook required.</li>
-      <li>The dev server reads <code>.ts</code> files from disk, runs <code>module.stripTypeScriptTypes</code>, and serves the result with position-preserving whitespace replacement.</li>
+      <li>The runtime strips types from <code>.ts</code> imports server-side natively (Node 24+, or Bun). No loader hook required.</li>
+      <li>The dev server reads <code>.ts</code> files from disk, strips them (Node's <code>module.stripTypeScriptTypes</code> or <code>amaro</code> on Bun), and serves the result with position-preserving whitespace replacement.</li>
       <li>When the browser requests a <code>.js</code> file that doesn't exist but a sibling <code>.ts</code> does, webjs falls back to the <code>.ts</code> version automatically. This means libraries that import without extensions can still work.</li>
     </ul>
 
diff --git a/examples/blog/.agents/rules/workflow.md b/examples/blog/.agents/rules/workflow.md
index b98ba9cc0..1eaf3cea3 100644
--- a/examples/blog/.agents/rules/workflow.md
+++ b/examples/blog/.agents/rules/workflow.md
@@ -96,7 +96,7 @@ self-review loop.
 ## Framework rules
 
 - No build step: ES modules served directly.
-- **Erasable TypeScript only.** Node 24+ strips types via
+- **Erasable TypeScript only.** The runtime (Node 24+ or Bun) strips types via
   `module.stripTypeScriptTypes` (whitespace replacement, byte-exact position
   preservation, no sourcemap). The scaffold's `tsconfig.json` sets
   `erasableSyntaxOnly: true`, so the TS compiler rejects `enum`, `namespace`
diff --git a/examples/blog/.cursorrules b/examples/blog/.cursorrules
index f70961409..a713846dd 100644
--- a/examples/blog/.cursorrules
+++ b/examples/blog/.cursorrules
@@ -102,7 +102,7 @@ self-review loop.
 ## Framework rules
 
 - No build step: source files are served as ES modules
-- **Erasable TypeScript only.** Node 24+ strips types via `module.stripTypeScriptTypes` (whitespace replacement, byte-exact position preservation, no sourcemap). The scaffold's tsconfig.json sets `erasableSyntaxOnly: true`, so the TS compiler rejects `enum`, `namespace` with values, constructor parameter properties, legacy decorators with `emitDecoratorMetadata`, and `import = require`. Use erasable equivalents: `const X = { ... } as const` plus a derived union type instead of `enum`; explicit fields plus constructor body assignments instead of parameter properties. If `erasableSyntaxOnly` is disabled and non-erasable syntax is used, the dev server fails at strip time and returns a 500 pointing at the `no-non-erasable-typescript` lint rule. webjs is buildless end-to-end and has no bundler fallback.
+- **Erasable TypeScript only.** The runtime strips types via `module.stripTypeScriptTypes` (Node's built-in, or `amaro` on Bun) (whitespace replacement, byte-exact position preservation, no sourcemap). The scaffold's tsconfig.json sets `erasableSyntaxOnly: true`, so the TS compiler rejects `enum`, `namespace` with values, constructor parameter properties, legacy decorators with `emitDecoratorMetadata`, and `import = require`. Use erasable equivalents: `const X = { ... } as const` plus a derived union type instead of `enum`; explicit fields plus constructor body assignments instead of parameter properties. If `erasableSyntaxOnly` is disabled and non-erasable syntax is used, the dev server fails at strip time and returns a 500 pointing at the `no-non-erasable-typescript` lint rule. webjs is buildless end-to-end and has no bundler fallback.
 - Web components with shadow DOM: use `static styles = css` not inline styles
 - One function per server action file (*.server.ts)
 - Components must call customElements.define('tag', Class)
diff --git a/examples/blog/.github/copilot-instructions.md b/examples/blog/.github/copilot-instructions.md
index 56b665df3..0eefd0d65 100644
--- a/examples/blog/.github/copilot-instructions.md
+++ b/examples/blog/.github/copilot-instructions.md
@@ -98,7 +98,7 @@ each change must include.
 
 - No build step: source files are served as ES modules. Don't introduce
   build tools or bundlers in the critical path.
-- **Erasable TypeScript only.** Node 24+ strips types via `module.stripTypeScriptTypes` (whitespace replacement, byte-exact position preservation, no sourcemap). The scaffold's tsconfig.json sets `erasableSyntaxOnly: true`, so the TS compiler rejects `enum`, `namespace` with values, constructor parameter properties, legacy decorators with `emitDecoratorMetadata`, and `import = require`. Use erasable equivalents: `const X = { ... } as const` plus a derived union type instead of `enum`; explicit fields plus constructor body assignments instead of parameter properties. If `erasableSyntaxOnly` is disabled and non-erasable syntax is used, the dev server fails at strip time and returns a 500 pointing at the `no-non-erasable-typescript` lint rule. webjs is buildless end-to-end and has no bundler fallback.
+- **Erasable TypeScript only.** The runtime strips types via `module.stripTypeScriptTypes` (Node's built-in, or `amaro` on Bun) (whitespace replacement, byte-exact position preservation, no sourcemap). The scaffold's tsconfig.json sets `erasableSyntaxOnly: true`, so the TS compiler rejects `enum`, `namespace` with values, constructor parameter properties, legacy decorators with `emitDecoratorMetadata`, and `import = require`. Use erasable equivalents: `const X = { ... } as const` plus a derived union type instead of `enum`; explicit fields plus constructor body assignments instead of parameter properties. If `erasableSyntaxOnly` is disabled and non-erasable syntax is used, the dev server fails at strip time and returns a 500 pointing at the `no-non-erasable-typescript` lint rule. webjs is buildless end-to-end and has no bundler fallback.
 - Tagged template: html`<div>${value}</div>` with css`...` for styles.
   Don't use inline `style="..."` on components (use `static styles = css\`...\``).
 - Components: extend WebComponent, declare `static properties` (and `static styles` for shadow-DOM components), call `Class.register('tag-name')` at the bottom of the file. The tag name is the argument to `.register()`, not a static field.
diff --git a/package-lock.json b/package-lock.json
index 71f800ebd..177ff45b2 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2521,6 +2521,16 @@
         "node": ">= 14"
       }
     },
+    "node_modules/amaro": {
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/amaro/-/amaro-1.1.10.tgz",
+      "integrity": "sha512-ceFv+QA3SlhFsn0hu8Q8oyj36YZdIgoJFpyS2sGJGK2dyncwcMWuBlNzhXfc1oLWtbDWM2Ol2rrzOYa+HNyEjg==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=22"
+      }
+    },
     "node_modules/ansi-escapes": {
       "version": "4.3.2",
       "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-4.3.2.tgz",
@@ -6914,6 +6924,9 @@
       },
       "engines": {
         "node": ">=24.0.0"
+      },
+      "optionalDependencies": {
+        "amaro": "^1.1.10"
       }
     },
     "packages/server/node_modules/ws": {
diff --git a/packages/cli/templates/.agents/rules/workflow.md b/packages/cli/templates/.agents/rules/workflow.md
index 3bb635efe..bb3295e29 100644
--- a/packages/cli/templates/.agents/rules/workflow.md
+++ b/packages/cli/templates/.agents/rules/workflow.md
@@ -96,7 +96,7 @@ self-review loop.
 ## Framework rules
 
 - No build step: ES modules served directly.
-- **Erasable TypeScript only.** Node 24+ strips types via
+- **Erasable TypeScript only.** The runtime (Node 24+ or Bun) strips types via
   `module.stripTypeScriptTypes` (whitespace replacement, byte-exact position
   preservation, no sourcemap). The scaffold's `tsconfig.json` sets
   `erasableSyntaxOnly: true`, so the TS compiler rejects `enum`, `namespace`
diff --git a/packages/cli/templates/.cursorrules b/packages/cli/templates/.cursorrules
index f863c9bdb..6e5c224b8 100644
--- a/packages/cli/templates/.cursorrules
+++ b/packages/cli/templates/.cursorrules
@@ -102,7 +102,7 @@ self-review loop.
 ## Framework rules
 
 - No build step: source files are served as ES modules
-- **Erasable TypeScript only.** Node 24+ strips types via `module.stripTypeScriptTypes` (whitespace replacement, byte-exact position preservation, no sourcemap). The scaffold's tsconfig.json sets `erasableSyntaxOnly: true`, so the TS compiler rejects `enum`, `namespace` with values, constructor parameter properties, legacy decorators with `emitDecoratorMetadata`, and `import = require`. Use erasable equivalents: `const X = { ... } as const` plus a derived union type instead of `enum`; explicit fields plus constructor body assignments instead of parameter properties. If `erasableSyntaxOnly` is disabled and non-erasable syntax is used, the dev server fails at strip time and returns a 500 pointing at the `no-non-erasable-typescript` lint rule. webjs is buildless end-to-end and has no bundler fallback.
+- **Erasable TypeScript only.** The runtime strips types via `module.stripTypeScriptTypes` (Node's built-in, or `amaro` on Bun) (whitespace replacement, byte-exact position preservation, no sourcemap). The scaffold's tsconfig.json sets `erasableSyntaxOnly: true`, so the TS compiler rejects `enum`, `namespace` with values, constructor parameter properties, legacy decorators with `emitDecoratorMetadata`, and `import = require`. Use erasable equivalents: `const X = { ... } as const` plus a derived union type instead of `enum`; explicit fields plus constructor body assignments instead of parameter properties. If `erasableSyntaxOnly` is disabled and non-erasable syntax is used, the dev server fails at strip time and returns a 500 pointing at the `no-non-erasable-typescript` lint rule. webjs is buildless end-to-end and has no bundler fallback.
 - **Tailwind-first styling.** Tailwind utilities are the strong default for pages AND light-DOM components (the default DOM mode): layout, spacing, color (via `@theme` tokens), typography, borders, radius, shadows, interaction states. Light DOM does not scope, so utilities apply directly. The lit reflex to scope CSS (`static styles = css`) or write an inline `<style>` with semantic class names (`.hero`, `.card`) in a light-DOM component is wrong: the scoped block needs `static shadow = true`, and inline class names leak globally. When a utility bundle repeats, extract a `lib/utils/ui.ts` helper returning an `html` fragment, not a CSS class. Reserve raw CSS for the allowlist (design tokens / `@theme`, `@property` + `@keyframes`, `::-webkit-scrollbar`, `prefers-reduced-motion`, complex `color-mix()` / gradients); when unavoidable in a light-DOM component, prefix every class selector with the component tag.
 - Shadow-DOM components opt in with `static shadow = true` and use `static styles = css` for scoped CSS, not inline styles. That is the right home for scoped CSS.
 - One function per server action file (*.server.ts)
diff --git a/packages/cli/templates/.github/copilot-instructions.md b/packages/cli/templates/.github/copilot-instructions.md
index e26967fd9..0e4959309 100644
--- a/packages/cli/templates/.github/copilot-instructions.md
+++ b/packages/cli/templates/.github/copilot-instructions.md
@@ -98,7 +98,7 @@ each change must include.
 
 - No build step: source files are served as ES modules. Don't introduce
   build tools or bundlers in the critical path.
-- **Erasable TypeScript only.** Node 24+ strips types via `module.stripTypeScriptTypes` (whitespace replacement, byte-exact position preservation, no sourcemap). The scaffold's tsconfig.json sets `erasableSyntaxOnly: true`, so the TS compiler rejects `enum`, `namespace` with values, constructor parameter properties, legacy decorators with `emitDecoratorMetadata`, and `import = require`. Use erasable equivalents: `const X = { ... } as const` plus a derived union type instead of `enum`; explicit fields plus constructor body assignments instead of parameter properties. If `erasableSyntaxOnly` is disabled and non-erasable syntax is used, the dev server fails at strip time and returns a 500 pointing at the `no-non-erasable-typescript` lint rule. webjs is buildless end-to-end and has no bundler fallback.
+- **Erasable TypeScript only.** The runtime strips types via `module.stripTypeScriptTypes` (Node's built-in, or `amaro` on Bun) (whitespace replacement, byte-exact position preservation, no sourcemap). The scaffold's tsconfig.json sets `erasableSyntaxOnly: true`, so the TS compiler rejects `enum`, `namespace` with values, constructor parameter properties, legacy decorators with `emitDecoratorMetadata`, and `import = require`. Use erasable equivalents: `const X = { ... } as const` plus a derived union type instead of `enum`; explicit fields plus constructor body assignments instead of parameter properties. If `erasableSyntaxOnly` is disabled and non-erasable syntax is used, the dev server fails at strip time and returns a 500 pointing at the `no-non-erasable-typescript` lint rule. webjs is buildless end-to-end and has no bundler fallback.
 - Tagged template: html`<div>${value}</div>` with css`...` for styles.
 - **Tailwind-first styling.** Tailwind utilities are the strong default for pages AND light-DOM components (the default DOM mode): layout, spacing, color (via `@theme` tokens), typography, borders, radius, shadows, interaction states. Light DOM does not scope, so utilities apply directly. The lit reflex to scope CSS (`static styles = css\`...\``) or write an inline `<style>` with semantic class names (`.hero`, `.card`) in a light-DOM component is wrong: the scoped block needs `static shadow = true`, and inline class names leak globally. When a utility bundle repeats, extract a `lib/utils/ui.ts` helper returning an `html` fragment, not a CSS class. Reserve raw CSS for the allowlist (design tokens / `@theme`, `@property` + `@keyframes`, `::-webkit-scrollbar`, `prefers-reduced-motion`, complex `color-mix()` / gradients); when unavoidable in a light-DOM component, prefix every class selector with the component tag. Shadow-DOM components (`static shadow = true`) legitimately author `static styles = css\`...\`` for scoped CSS; don't use inline `style="..."` there.
 - Components: extend WebComponent, declare `static properties` (and `static styles` for shadow-DOM components), call `Class.register('tag-name')` at the bottom of the file. The tag name is the argument to `.register()`, not a static field.
diff --git a/packages/cli/templates/AGENTS.md b/packages/cli/templates/AGENTS.md
index cf9a4be1a..235c1f7e3 100644
--- a/packages/cli/templates/AGENTS.md
+++ b/packages/cli/templates/AGENTS.md
@@ -393,6 +393,23 @@ In Docker / Railway, prefer `npm start` (or `node node_modules/.bin/npm
 start`) as the CMD over `node ... webjs.js start ...`. The npm form
 fires `prestart`; the direct binary form skips it.
 
+### Running on Bun instead of Node
+
+webjs runs on **Node 24+ or Bun**. The same `package.json` scripts work on
+either; to run under Bun, force it with `--bun` so the server executes on Bun
+rather than the `webjs` bin's Node shebang:
+
+```sh
+bun install
+bun --bun run dev      # or: bun --bun run start
+```
+
+On Node the `.ts` type-stripping is the built-in `module.stripTypeScriptTypes`;
+on Bun (which has no built-in) it comes from `amaro` automatically, so the same
+source serves identically. SSR action-result seeding (an internal hydration
+optimization) is off on Bun (it needs `module.registerHooks`), which only means
+an async-render component re-fetches once on hydration, no behavior change.
+
 **Containerized deploy ships with the scaffold.** `Dockerfile`,
 `compose.yaml`, and `.dockerignore` are scaffolded at the app root. The
 Dockerfile pins `node:24-alpine` (the same Node major CI uses), installs
@@ -1126,7 +1143,7 @@ composition, so a nested shell ends up dropped by the HTML parser.
    browser-only). Never fetch initial data in `connectedCallback` /
    `firstUpdated`. Fetch in the page function (server) and pass it as
    a prop. See *Component pattern* above.
-8. **Erasable TypeScript only.** Node 24+ strips types via
+8. **Erasable TypeScript only.** The runtime (Node 24+ or Bun) strips types via
    `module.stripTypeScriptTypes` (whitespace replacement, byte-exact
    line and column position preservation, no sourcemap shipped to the
    browser). Your `tsconfig.json` sets `erasableSyntaxOnly: true`, so
diff --git a/packages/server/AGENTS.md b/packages/server/AGENTS.md
index 62c1852a5..8a6cd83f7 100644
--- a/packages/server/AGENTS.md
+++ b/packages/server/AGENTS.md
@@ -61,7 +61,8 @@ with metadata, Suspense, streaming) for HTML, or `api.js` /
 | `asset-hash.js` | Content-hash asset URLs for immutable caching (#243, feature 1). `setAssetRoots({ appDir, coreDir, enabled })` binds the app + core roots and enables fingerprinting in PROD only (`dev.js` passes `enabled: !dev`, so dev is a pure no-op). `assetHashFor(absPath)` computes (and memoizes in a `Map<absPath, hash>`) a short 12-hex prefix of a sha-256 over the file BYTES (`node:crypto`, synchronous so the emit hot path stays sync), returning `''` on a read failure (NOT memoized, so a transient failure re-attempts). For a file under `_appDir` it ALSO folds in `_elisionFp` (set by `setElisionFingerprint`, called from `ensureReady`): an app module's served body is elision-transformed (a display-only import stripped), so a verdict flip must bust the importer's `?v` even when its source is byte-identical. The fingerprint is a relativized digest of the elidable + inert set (empty when nothing is elidable, leaving an app module's hash at exactly `sha256(bytes)`); core / `public/` files are never elision-transformed, so they hash over bytes alone. `routeFor` (the 103 Early Hints) applies `withAssetHash` too, so the hint and the body request the same URL. `withAssetHash(url, basePath?)` appends `?v=<hash>` to a framework-emitted SAME-ORIGIN absolute url (the importmap targets, the modulepreload hrefs, the boot specifiers): a NO-OP when disabled (dev), for a CROSS-ORIGIN / protocol-relative / relative url (so a `https://` jspm vendor target keeps its exact url, its #235 SRI key intact, and is never re-fingerprinted; an already-version-named `/__webjs/vendor/*` bundle is left alone too), and when the url does not resolve to a readable same-origin file (1h fallback). Composes with `withBasePath` (basePath then `?v`; it strips the base path before file resolution). `clearAssetHashCache()` is wired into `dev.js`'s rebuild path next to `clearVendorCache` so a changed file re-hashes (the deploy-busts mechanism). The emit is in `importmap.js`'s `buildImportMap` (`fingerprint` flag, true for the SERVED map, false for the internal hash so the build id stays a stable per-deploy fingerprint) and `ssr.js`'s `wrapHead` (boot specifiers + modulepreload hrefs + lazy entries). The SERVE seam is `dev.js`: a request carrying a `?v=` query is served `Cache-Control: public, max-age=31536000, immutable` (vs the 1h fallback) by `fileResponse` (`immutable` flag), `jsModuleResponse` / `tsResponse` (an `immutable` arg), and the core serve in `tryServeFrameworkStatic` (a `versioned` ctx flag); the pathname (query stripped) resolves the file as today, only the cache header changes. Dev stays `no-cache` regardless. **`versionModuleImports(source, importerAbs)` (#369)** is the matching SERVED-SOURCE rewrite: a layout/page/component imports its dependencies with a BARE relative specifier (`import '../components/x.ts'`), and the browser resolves that against the importer's `?v=`-versioned URL WITHOUT inheriting the `?v` query, so it would fetch the un-versioned URL (a different cache key from the `?v=`-versioned modulepreload hint -> wasted preload, double download, 1h cache). The pass appends the target's `?v=<hash>` (the same `assetHashFor` the preload href uses, so the URLs are byte-identical) to every same-origin relative / root-absolute static-import specifier in a served module, matching over a redaction mask (so a templated example import is skipped). Bare specifiers (importmap-resolved, versioned at their target) and `.server.*` stubs (bare-URL, not in the preload set) are left untouched. Run AFTER `elideImportsFromSource` in `jsModuleResponse` / `tsResponse`; a pure no-op when disabled (dev), so dev source stays byte-faithful. |
 | `csp.js` | CSP nonce minting + `Content-Security-Policy` header building (#233). `readCspConfig` normalizes the `webjs.csp` package.json key (off by default; `true` = strict default policy, object = custom directives + `reportOnly`); `mintNonce` is the per-request CSPRNG nonce; `buildCspHeader` substitutes the nonce into the policy. Plugs into the #232 `applySecurityHeaders` seam in `dev.js`'s `handle()` |
 | `env-schema.js` | Boot-time env-var validation (#236). `validateEnv(schema, env)` is the PURE validator: it checks an env object against a schema (an object of `name -> type-name | options`, supporting `string`/`number`/`boolean`/`url`/`enum`, `required`/`optional`/`default`, `minLength`/`pattern`), collecting ALL errors at once and returning the coerced + defaulted values to write back. A schema may instead be a FUNCTION `(env) => void` (the escape hatch for zod etc.), whose throw becomes the single error. `loadEnvSchema(appDir)` reads the optional app-root `env.{js,ts}` (null when absent, so opt-in); `applyEnvValidation(appDir)` is the side-effecting boot wrapper called from `createRequestHandler` right after the `.env` auto-load: it validates `process.env`, applies coerced values back, and THROWS a clear aggregated Error on failure (CLI exits non-zero, embedded host rejects), consistent with the Node-version preflight. `formatEnvErrors` composes the aggregated message. |
-| `node-version.js` | Node-version preflight guard (#238). `checkNodeVersion(current, requiredMajor)` is the PURE comparison; `assertNodeVersion({ onFail })` is the side-effecting wrapper that throws a clear Error (embedded server, called at the top of `createRequestHandler`) or exits non-zero (CLI). The minimum is sourced from this package's own `engines.node` via `requiredNodeMajor()` so it never drifts. Fails fast on an older Node with a message naming the found + required version (the built-in TS strip + recursive `fs.watch` need 24+), instead of a cryptic late failure. For the embedded-host throw to actually fire, `dev.js` namespace-imports `node:module` (`import * as nodeModule`) rather than name-importing `stripTypeScriptTypes`, so importing `@webjsdev/server` LINKS on old Node instead of link-failing before the guard runs (PR #282 fix; the CLI carries its own dependency-free inline guard in `cli/lib/node-preflight.js` for the same reason). |
+| `ts-strip.js` | Pluggable TypeScript stripper (#508), the seam that lets webjs run on both Node and Bun. `stripTypeScript(source)` erases types in place (position-preserving, no sourcemap) via the backend `ensureStripper()` resolves once at boot: Node 24+'s built-in `module.stripTypeScriptTypes` (zero deps, the default), or `amaro` on a runtime lacking it (Bun), lazily imported. Node's built-in is itself a wrapper over amaro's `strip-only` mode, so the output is BYTE-IDENTICAL (a unit test asserts it). `amaro` is an `optionalDependency` of this package: a Node-only install that prunes optionals still runs (it never loads amaro); a Bun install gets it. `WEBJS_TS_STRIPPER=builtin|amaro` forces a backend. Namespace-imports `node:module` (not a named `stripTypeScriptTypes` import) so the module LINKS on a runtime lacking the builtin (Bun, old Node) instead of link-failing before the runtime check (the PR #282 link-safety pattern, now living here). Also hosts the one-shot `stripTypeScriptTypes` ExperimentalWarning suppression, co-located with the call. `dev.js`'s `stripTs` delegates here and `createRequestHandler` calls `ensureStripper()` at boot. |
+| `node-version.js` | Node-version preflight guard (#238). `checkNodeVersion(current, requiredMajor)` is the PURE comparison; `assertNodeVersion({ onFail })` is the side-effecting wrapper that throws a clear Error (embedded server, called at the top of `createRequestHandler`) or exits non-zero (CLI). The minimum is sourced from this package's own `engines.node` via `requiredNodeMajor()` so it never drifts. Fails fast on an older Node with a message naming the found + required version (the built-in TS strip + recursive `fs.watch` need 24+), instead of a cryptic late failure. **Admits Bun (#508):** when `process.versions.bun` is set and no explicit `current` is passed, the gate is a no-op (Bun gets its TS strip from `amaro` via `ts-strip.js` and `node:*` from its compat layer, even though it reports a Node version string). The link-safety pattern (namespace-import `node:module`, not a named `stripTypeScriptTypes` import) now lives in `ts-strip.js` since that is where the built-in is reached (PR #282 reasoning; the CLI carries its own dependency-free inline guard in `cli/lib/node-preflight.js`). |
 | `conditional-get.js` | RFC 7232 conditional GET (ETag + If-None-Match -> 304) (#240). `applyConditionalGet(req, res)` is the shared funnel: for a cacheable GET/HEAD response (status 200, `Cache-Control` present and NOT `no-store` / `private`) it attaches a WEAK content-hash `ETag` (`W/"..."`) over the response's OWN body bytes when one is absent, then returns a `304 Not Modified` (no body, validators + caching headers preserved) when the request's `If-None-Match` matches (weak comparison, `*` wildcard, comma lists). `ifNoneMatchSatisfied` is the pure matcher. The ETag is WEAK because it hashes the uncompressed body and `sendWebResponse` reuses it across identity / gzip / br codings, which a strong validator may not do (RFC 7232 2.3.3). **The funnel only reads a body that a serve branch positively marked buffered** via the internal `BUFFERED_MARKER` (`x-webjs-buffered`) header it stamps on a string / bytes body (`htmlResponse` + the non-streaming `streamingHtmlResponse`, `fileResponse`, `jsModuleResponse`, `tsResponse`, `serveDownloadedBundle`). Both internal markers are stripped at the funnel and never reach a client. EXCLUDED: `no-store` / `private` responses (no cross-session 304 on per-user content); non-GET/HEAD; non-200; a genuinely-streamed Suspense body (flagged with `STREAM_MARKER` / `x-webjs-stream` by `ssr.js`); and **any unmarked body, which is how a user `route.{js,ts}` handler returning a `ReadableStream` (incl. an SSE `text/event-stream` that never ends) is never buffered into memory or awaited forever**. A web `Response` exposes a `ReadableStream` body for a string and a live stream alike, so the explicit marker is the only safe discriminator. Wired once at the response funnel in `dev.js`'s `handle()` (AFTER `applySecurityHeaders` + the X-Request-Id / CSP header steps), so it covers SSR HTML pages, static assets, app source modules, and the core / vendor runtime uniformly. The serve branches no longer compute their own ETag; the funnel is the single ETag authority (dev + prod). |
 | `body-limit.js` | Request body-size limits (413) + node:http server timeouts (#237). `readBodyLimits` resolves the JSON/RPC (`webjs.maxBodyBytes`, default 1 MiB) and form/multipart (`webjs.maxMultipartBytes`, default 10 MiB) caps from package.json + the `WEBJS_MAX_BODY_BYTES` / `WEBJS_MAX_MULTIPART_BYTES` env overrides (env wins, `0` disables). `computeServerTimeouts` resolves `requestTimeout` (30s) / `headersTimeout` (20s) / `keepAliveTimeout` (5s), clamping `headersTimeout` strictly under `requestTimeout` per node semantics. `readBytesBounded` / `readTextBounded` / `readFormDataBounded` are the single bounded-read funnel every body-read site (RPC in `actions.js`, `readBody` in `json.js`, the page-action form in `page-action.js`) routes through: a `Content-Length` over the limit is a fast reject, a chunked body is counted while streaming and abandoned past the cap, so an over-limit body is never buffered whole. `BodyLimitError` (caught and mapped to 413 by `api.js`) is how `readBody` inside a route handler signals over-limit; the RPC / page-action paths return `payloadTooLarge()` inline |
 | `testing.js` | handle() test-harness helpers (#267), exported from `index.js` AND the `./testing` subpath. THIN builders over `createRequestHandler(...).handle()`: `testRequest(handle, path, init?)` fires a native Request through the real pipeline; `getCsrf(handle)` mints a `{ token, cookie, header }` pair off the first SSR response (reusing `csrf.js`'s `CSRF_COOKIE` / `CSRF_HEADER`); `loginAndGetCookies(handle, creds)` drives the REAL credentials login (`/api/auth/signin/credentials`) and captures the genuine signed session `Set-Cookie`; `actionEndpoint(appDir, file, fn)` computes the `/__webjs/action/<hash>/<fn>` path via `hashFile` (the same scheme the stub uses); `invokeActionForTest(app, file, fn, args)` round-trips an action through that REAL endpoint (serializer + CSRF + prod error sanitization), and `rawActionRequest(...)` returns the raw Response (no throw, `omitCsrf` for the 403 case). No test-framework machinery; reuses the real serializer (`serializer.js` -> `@webjsdev/core`) and cookie/header names, never a fake |
diff --git a/packages/server/package.json b/packages/server/package.json
index a7b0335ff..bdc1e3e86 100644
--- a/packages/server/package.json
+++ b/packages/server/package.json
@@ -51,5 +51,8 @@
   ],
   "engines": {
     "node": ">=24.0.0"
+  },
+  "optionalDependencies": {
+    "amaro": "^1.1.10"
   }
 }
diff --git a/packages/server/src/action-seed.js b/packages/server/src/action-seed.js
index fbd5e6cbd..49e9f734d 100644
--- a/packages/server/src/action-seed.js
+++ b/packages/server/src/action-seed.js
@@ -258,6 +258,18 @@ function seedLoadHook(url, context, nextLoad) {
  * second call.
  */
 export function registerSeedHooks() {
+  // The seed facade rides Node's synchronous `module.registerHooks` (#472).
+  // Bun (and any runtime without that API, #508) cannot install the hook, so
+  // seeding simply stays OFF there: `seedingEnabled()` returns false, ssr.js
+  // emits no seed block, and the client RPC stub falls back to a normal fetch.
+  // This is the same fail-open posture as a key miss, never wrong data.
+  if (typeof nodeModule.registerHooks !== 'function') {
+    if (!_registered) {
+      _registered = true;
+      console.warn('[webjs] SSR action-result seeding (#472) is disabled: module.registerHooks is unavailable on this runtime (e.g. Bun). Async-render components will re-fetch on hydration; no correctness impact.');
+    }
+    return;
+  }
   _enabled = true;
   if (_registered) return;
   _registered = true;
diff --git a/packages/server/src/dev.js b/packages/server/src/dev.js
index c17e03542..9a5f592de 100644
--- a/packages/server/src/dev.js
+++ b/packages/server/src/dev.js
@@ -4,47 +4,13 @@ import { existsSync, readFileSync } from 'node:fs';
 import { createGzip, createBrotliCompress, constants as zlibConstants } from 'node:zlib';
 import { join, extname, resolve, dirname, relative, sep } from 'node:path';
 import { createRequire } from 'node:module';
-// Namespace import, NOT `import { stripTypeScriptTypes }`. On Node < 22.13 the
-// `stripTypeScriptTypes` named export does not exist, and a NAMED import of a
-// missing builtin export is a LINK-TIME SyntaxError that fires before any
-// module body runs, which would defeat the Node-version preflight (issue #238)
-// by crashing the import of @webjsdev/server itself. A namespace import links
-// on every Node (the property is just `undefined` at runtime on old Node), so
-// importing @webjsdev/server succeeds and `assertNodeVersion()` at the top of
-// createRequestHandler throws the clean "you need Node 24+" message instead.
-import * as nodeModule from 'node:module';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 // Server-side `.ts` imports are handled natively by Node 24+'s default
-// type-stripping (`process.features.typescript === 'strip'`). No loader
-// hook required. The browser-bound TypeScript request handler uses
-// `module.stripTypeScriptTypes` for the same transform, so SSR and
-// hydration produce identical JS.
-//
-// Runtime backing: Node ships `stripTypeScriptTypes` via the `amaro`
-// package internally (wraps SWC's WASM TypeScript transform in a
-// position-preserving strip-only mode). If the framework ever needs
-// to run on Bun, Deno, or another runtime that does NOT expose the
-// equivalent built-in, we will need to install `amaro` directly (or
-// an equivalent: Sucrase preserves lines but not columns; SWC's
-// strip-only also works). The fast-path `stripTs` helper would
-// change one import line.
-//
-// Suppress the one-shot ExperimentalWarning that Node prints the
-// first time `stripTypeScriptTypes` is called. The API is committed
-// per Node 24's release notes; the warning is a holdover. We keep
-// every other warning intact.
-const _origEmitWarning = process.emitWarning.bind(process);
-process.emitWarning = function (warning, type, code, ctor) {
-  const msg = warning && warning.message ? warning.message : String(warning);
-  if (
-    (type === 'ExperimentalWarning' || (warning && warning.name === 'ExperimentalWarning')) &&
-    msg.includes('stripTypeScriptTypes')
-  ) {
-    return;
-  }
-  return _origEmitWarning(warning, type, code, ctor);
-};
+// type-stripping (`process.features.typescript === 'strip'`) or by Bun. The
+// BROWSER-bound `.ts` request handler erases types via the pluggable stripper in
+// `./ts-strip.js` (Node's built-in `module.stripTypeScriptTypes`, or `amaro` on
+// Bun), so SSR and hydration produce identical JS on either runtime (#508).
 
 import { buildRouteTable, matchPage, matchApi } from './router.js';
 import { generateRouteTypes } from './route-types.js';
@@ -61,6 +27,7 @@ import {
   hashFile,
 } from './actions.js';
 import { registerSeedHooks } from './action-seed.js';
+import { stripTypeScript, ensureStripper } from './ts-strip.js';
 import { defaultLogger } from './logger.js';
 import { assertNodeVersion } from './node-version.js';
 import { applyEnvValidation } from './env-schema.js';
@@ -441,6 +408,10 @@ export async function createRequestHandler(opts) {
   // Throw a clear Error here so an embedded host (Express/Fastify/Bun/Deno)
   // gets the actionable message at boot, not a cryptic API failure mid-request.
   assertNodeVersion({ onFail: 'throw' });
+  // Resolve the TS stripper backend at boot (#508): the Node built-in, or amaro
+  // on Bun. Doing it here pays the (one-time) amaro import up front and surfaces
+  // a missing-amaro error at boot rather than on the first `.ts` request.
+  await ensureStripper();
   const appDir = resolve(opts.appDir);
   // Load <appDir>/.env into process.env BEFORE anything else.
   // buildActionIndex below imports server-only files (lib/*.server.ts,
@@ -2201,12 +2172,16 @@ async function exists(p) {
  * rules catch these at edit time. There is no bundler fallback;
  * webjs is buildless end-to-end.
  *
+ * The backend is the runtime-appropriate stripper (#508): Node 24+'s built-in
+ * `module.stripTypeScriptTypes`, or `amaro` on Bun (byte-identical, equally
+ * position-preserving), resolved once via `./ts-strip.js`.
+ *
  * @param {string} source
  * @param {string} _abs  (unused; preserved for symmetry with prior signature)
  * @returns {Promise<string>}
  */
 async function stripTs(source, _abs) {
-  return nodeModule.stripTypeScriptTypes(source);
+  return stripTypeScript(source);
 }
 
 /**
diff --git a/packages/server/src/node-version.js b/packages/server/src/node-version.js
index cedfa5f55..0c38ef8e5 100644
--- a/packages/server/src/node-version.js
+++ b/packages/server/src/node-version.js
@@ -89,6 +89,15 @@ export function requiredNodeMajor() {
  * @returns {void}
  */
 export function assertNodeVersion(opts = {}) {
+  // Bun (#508) satisfies webjs's requirements through a different mechanism: the
+  // TS strip comes from `amaro` (resolved by ts-strip.js), and `fs.watch` /
+  // `node:crypto` are provided by its node-compat layer, even though Bun reports
+  // a Node version string. The Node-major gate is a proxy for "the Node built-ins
+  // exist", which does not hold on Bun, so skip it there. Only when no explicit
+  // `current` is passed (real runtime detection, not a unit test override).
+  if (opts.current === undefined && typeof process !== 'undefined' && process.versions && process.versions.bun) {
+    return;
+  }
   const current = opts.current ?? process.versions.node;
   const requiredMajor = opts.requiredMajor ?? requiredNodeMajor();
   const onFail = opts.onFail ?? 'throw';
diff --git a/packages/server/src/ts-strip.js b/packages/server/src/ts-strip.js
new file mode 100644
index 000000000..82d1b4983
--- /dev/null
+++ b/packages/server/src/ts-strip.js
@@ -0,0 +1,139 @@
+/**
+ * Pluggable TypeScript stripper (#508), the one seam that lets webjs run on both
+ * Node and Bun.
+ *
+ * webjs serves `.ts` / `.mts` source to the browser as JavaScript by ERASING the
+ * type syntax in place (position-preserving whitespace replacement, so no
+ * sourcemap is shipped and stack traces stay byte-exact). On Node 24+ that is the
+ * built-in `module.stripTypeScriptTypes`. Bun has no such built-in, so this
+ * module picks the backend at boot:
+ *
+ *   - **Node 24+**: the built-in `module.stripTypeScriptTypes` (zero deps, the
+ *     default; nothing about the Node path changes).
+ *   - **Bun (or any runtime lacking the built-in)**: `amaro`, lazily imported.
+ *     Node's built-in is itself a thin wrapper over `amaro`'s `strip-only` mode,
+ *     so the output is BYTE-IDENTICAL and equally position-preserving. `amaro` is
+ *     an `optionalDependency` of `@webjsdev/server`: a Node-only install that
+ *     prunes optionals still runs (it never loads amaro), while a Bun install
+ *     gets it.
+ *
+ * `WEBJS_TS_STRIPPER=builtin|amaro` forces a backend (used by the tests to
+ * exercise the amaro path under Node, and an escape hatch).
+ *
+ * Erasable TypeScript only, either way: non-erasable syntax (`enum`, value
+ * `namespace`, parameter properties, legacy decorators, `import = require`)
+ * throws at strip time, which the `erasable-typescript-only` /
+ * `no-non-erasable-typescript` lint rules catch at edit time.
+ */
+// Namespace import, NOT `import { stripTypeScriptTypes }`. On Node < 22.13 the
+// named export does not exist, and a NAMED import of a missing builtin export is
+// a LINK-TIME SyntaxError that fires before any module body runs, which would
+// defeat the Node-version preflight by crashing the import of @webjsdev/server
+// itself. A namespace import links on every runtime (the property is just
+// `undefined` where absent, e.g. Bun) and we branch on it at runtime instead.
+import * as nodeModule from 'node:module';
+
+// Suppress the one-shot ExperimentalWarning Node prints the first time
+// `stripTypeScriptTypes` is called (the API is committed per Node 24's release
+// notes; the warning is a holdover). Installed here, co-located with the strip
+// call, so it covers every consumer of this module (dev.js, the CLI, tests),
+// not just the dev server. Every other warning passes through untouched.
+const _origEmitWarning = process.emitWarning.bind(process);
+process.emitWarning = function (warning, type, code, ctor) {
+  const msg = warning && warning.message ? warning.message : String(warning);
+  if (
+    (type === 'ExperimentalWarning' || (warning && warning.name === 'ExperimentalWarning')) &&
+    msg.includes('stripTypeScriptTypes')
+  ) {
+    return;
+  }
+  return _origEmitWarning(warning, type, code, ctor);
+};
+
+/** @typedef {{ fn: (source: string) => string, name: 'builtin' | 'amaro' }} Stripper */
+
+/** @type {Stripper | null} */
+let _strip = null;
+/** @type {Promise<Stripper> | null} */
+let _resolving = null;
+
+/** Forced backend from the env, or '' for auto-detect. */
+function forcedBackend() {
+  const v = String(process.env.WEBJS_TS_STRIPPER || '').toLowerCase().trim();
+  return v === 'builtin' || v === 'amaro' ? v : '';
+}
+
+/**
+ * Resolve the active stripper backend once. Auto-detects (built-in when present,
+ * else amaro); honors a `WEBJS_TS_STRIPPER` override.
+ * @returns {Promise<Stripper>}
+ */
+async function resolve() {
+  const forced = forcedBackend();
+  const hasBuiltin = typeof nodeModule.stripTypeScriptTypes === 'function';
+  if (forced !== 'amaro' && (forced === 'builtin' || hasBuiltin)) {
+    if (forced === 'builtin' && !hasBuiltin) {
+      throw new Error('WEBJS_TS_STRIPPER=builtin but module.stripTypeScriptTypes is unavailable on this runtime.');
+    }
+    return { fn: (source) => nodeModule.stripTypeScriptTypes(source), name: 'builtin' };
+  }
+  // amaro backend (Bun, a Node without the built-in, or forced).
+  let amaro;
+  try {
+    amaro = await import('amaro');
+  } catch (e) {
+    const why = e && e.message ? e.message : String(e);
+    throw new Error(
+      "webjs needs a TypeScript stripper: this runtime has no built-in " +
+      "`module.stripTypeScriptTypes` (e.g. Bun) and the `amaro` fallback failed " +
+      "to load. Install `amaro` (it is an optionalDependency of @webjsdev/server) " +
+      "to run webjs here. Underlying: " + why,
+    );
+  }
+  const tx = amaro.transformSync || (amaro.default && amaro.default.transformSync);
+  if (typeof tx !== 'function') {
+    throw new Error('webjs: the resolved `amaro` module has no `transformSync` export.');
+  }
+  return { fn: (source) => tx(source, { mode: 'strip-only' }).code, name: 'amaro' };
+}
+
+/**
+ * Resolve (once, memoized) and return the active stripper. Call at boot so the
+ * backend is ready and a missing-amaro error surfaces early rather than on the
+ * first `.ts` request.
+ * @returns {Promise<Stripper>}
+ */
+export async function ensureStripper() {
+  if (_strip) return _strip;
+  // Clear `_resolving` on BOTH settle paths so a failed resolve (e.g. a missing
+  // amaro on a runtime lacking the built-in) re-detects on the next call instead
+  // of caching the rejection forever (self-healing, matching `__resetStripper`).
+  if (!_resolving) {
+    _resolving = resolve().then(
+      (s) => { _strip = s; _resolving = null; return s; },
+      (e) => { _resolving = null; throw e; },
+    );
+  }
+  return _resolving;
+}
+
+/**
+ * Strip TypeScript types from `source`, resolving the backend on first use.
+ * @param {string} source
+ * @returns {Promise<string>}
+ */
+export async function stripTypeScript(source) {
+  const s = _strip || await ensureStripper();
+  return s.fn(source);
+}
+
+/** The active backend name, or null before resolution (diagnostics / tests). */
+export function stripperName() {
+  return _strip ? _strip.name : null;
+}
+
+/** Test seam: forget the resolved backend so the next call re-detects. */
+export function __resetStripper() {
+  _strip = null;
+  _resolving = null;
+}
diff --git a/packages/server/test/node-version/node-version.test.js b/packages/server/test/node-version/node-version.test.js
index 92eddefb2..898ac54b4 100644
--- a/packages/server/test/node-version/node-version.test.js
+++ b/packages/server/test/node-version/node-version.test.js
@@ -143,35 +143,59 @@ test('assertNodeVersion exits non-zero on an old Node (exit mode)', () => {
   assert.ok(logged.includes('24'));
 });
 
-/* ---------------- link-safety regression (dev.js) ---------------- */
+/* ---------------- Bun admission (#508) ---------------- */
 
-test('dev.js does NOT NAMED-import stripTypeScriptTypes from node:module', async () => {
+test('assertNodeVersion is a no-op on Bun even when it reports a low Node version', () => {
+  // Bun (#508) gets its TS strip from amaro and node:* from its compat layer, so
+  // the Node-major gate (a proxy for "the Node built-ins exist") must not block
+  // it, even if a future Bun reports a Node version below the floor.
+  const orig = process.versions.bun;
+  try {
+    process.versions.bun = '1.3.14';
+    assert.doesNotThrow(() => assertNodeVersion({ requiredMajor: 24 }));
+  } finally {
+    if (orig === undefined) delete process.versions.bun; else process.versions.bun = orig;
+  }
+});
+
+test('an explicit `current` still enforces the gate even under Bun (unit-test override)', () => {
+  // The Bun bypass only applies to real runtime detection (no `current` passed),
+  // so a test that injects an old `current` still exercises the failure path.
+  const orig = process.versions.bun;
+  try {
+    process.versions.bun = '1.3.14';
+    assert.throws(() => assertNodeVersion({ current: '20.0.0', requiredMajor: 24, onFail: 'throw' }), /20\.0\.0/);
+  } finally {
+    if (orig === undefined) delete process.versions.bun; else process.versions.bun = orig;
+  }
+});
+
+/* ---------------- link-safety regression (ts-strip.js) ---------------- */
+
+test('ts-strip.js does NOT NAMED-import stripTypeScriptTypes from node:module', async () => {
   // Regression for the PR #282 defeat: a NAMED import of a missing builtin
-  // export (`import { stripTypeScriptTypes }`) is a LINK-TIME SyntaxError on
-  // Node < 22.13, which crashes the import of @webjsdev/server BEFORE
-  // assertNodeVersion can fire, so an embedded host (and the CLI's server-side
-  // belt) gets the cryptic error the guard exists to replace. dev.js must use a
-  // namespace import (`import * as nodeModule from 'node:module'`) so the module
-  // LINKS on every Node and the clean preflight message wins instead.
+  // export (`import { stripTypeScriptTypes }`) is a LINK-TIME SyntaxError on a
+  // runtime lacking it (Node < 22.13, Bun), which crashes the import of
+  // @webjsdev/server BEFORE the runtime check can fire. The strip seam (now in
+  // ts-strip.js) must use a namespace import so the module LINKS everywhere and
+  // the built-in-vs-amaro branch is taken at runtime instead.
   const { readFileSync } = await import('node:fs');
   const { fileURLToPath } = await import('node:url');
   const src = readFileSync(
-    fileURLToPath(new URL('../../src/dev.js', import.meta.url)),
+    fileURLToPath(new URL('../../src/ts-strip.js', import.meta.url)),
     'utf8',
   );
-  // No named import of stripTypeScriptTypes from node:module.
   assert.equal(
     /import\s*\{[^}]*\bstripTypeScriptTypes\b[^}]*\}\s*from\s*['"]node:module['"]/.test(src),
     false,
-    'dev.js must not name-import stripTypeScriptTypes from node:module',
+    'ts-strip.js must not name-import stripTypeScriptTypes from node:module',
   );
-  // And it must reach the API through a namespace binding instead.
   assert.ok(
     /import\s*\*\s*as\s+\w+\s+from\s*['"]node:module['"]/.test(src),
-    'dev.js must namespace-import node:module',
+    'ts-strip.js must namespace-import node:module',
   );
   assert.ok(
-    /\bnodeModule\.stripTypeScriptTypes\(/.test(src),
-    'the strip call site must use the namespace binding',
+    /\bnodeModule\.stripTypeScriptTypes\b/.test(src),
+    'the strip seam must reach the built-in through the namespace binding',
   );
 });
diff --git a/packages/server/test/ts-strip/ts-strip.test.js b/packages/server/test/ts-strip/ts-strip.test.js
new file mode 100644
index 000000000..9e397ff32
--- /dev/null
+++ b/packages/server/test/ts-strip/ts-strip.test.js
@@ -0,0 +1,84 @@
+/**
+ * The pluggable TypeScript stripper seam (#508). Node uses the built-in
+ * `module.stripTypeScriptTypes`; Bun (and any runtime without it) uses `amaro`.
+ * These tests run under Node, so they exercise the built-in by default AND the
+ * amaro backend via the `WEBJS_TS_STRIPPER=amaro` override, asserting the two are
+ * byte-identical (which is why the Bun path is safe: amaro is exactly what Node's
+ * built-in wraps).
+ */
+import { test, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import * as nodeModule from 'node:module';
+import { stripTypeScript, ensureStripper, stripperName, __resetStripper } from '../../src/ts-strip.js';
+
+const SAMPLES = [
+  'const x: number = 5;\nexport const y = (z: { a: number }): number => z.a;\n',
+  'import type { Foo } from "./foo.ts";\nexport function f<T>(a: T): T { return a; }\n',
+  'class C { declare x: number; constructor() { this.x = 1; } m(s: string): void {} }\n',
+  'export type T = { a: number };\nexport const v: T = { a: 1 };\n',
+];
+
+afterEach(() => {
+  delete process.env.WEBJS_TS_STRIPPER;
+  __resetStripper();
+});
+
+test('default backend on Node is the built-in stripper', async () => {
+  __resetStripper();
+  const s = await ensureStripper();
+  assert.equal(s.name, 'builtin');
+  assert.equal(stripperName(), 'builtin');
+});
+
+test('the built-in backend strips erasable TypeScript', async () => {
+  __resetStripper();
+  const out = await stripTypeScript('const n: number = 1;\n');
+  assert.equal(out, nodeModule.stripTypeScriptTypes('const n: number = 1;\n'));
+  assert.ok(!out.includes(': number'));
+});
+
+test('WEBJS_TS_STRIPPER=amaro forces the amaro backend', async () => {
+  process.env.WEBJS_TS_STRIPPER = 'amaro';
+  __resetStripper();
+  const s = await ensureStripper();
+  assert.equal(s.name, 'amaro');
+  assert.equal(stripperName(), 'amaro');
+});
+
+test('the amaro backend output is byte-identical to the Node built-in (so Bun is safe)', async () => {
+  for (const src of SAMPLES) {
+    const builtin = nodeModule.stripTypeScriptTypes(src);
+    process.env.WEBJS_TS_STRIPPER = 'amaro';
+    __resetStripper();
+    const amaroOut = await stripTypeScript(src);
+    assert.equal(amaroOut, builtin, `amaro and built-in must agree for:\n${src}`);
+    delete process.env.WEBJS_TS_STRIPPER;
+  }
+});
+
+test('the amaro backend is position-preserving (same line count)', async () => {
+  process.env.WEBJS_TS_STRIPPER = 'amaro';
+  __resetStripper();
+  const src = 'const a: number = 1;\nfunction f(x: string): void {}\nexport const g = 2;\n';
+  const out = await stripTypeScript(src);
+  assert.equal(out.split('\n').length, src.split('\n').length);
+});
+
+test('WEBJS_TS_STRIPPER=builtin forces the built-in when present', async () => {
+  process.env.WEBJS_TS_STRIPPER = 'builtin';
+  __resetStripper();
+  const s = await ensureStripper();
+  assert.equal(s.name, 'builtin');
+});
+
+test('the resolved backend is memoized (resolves once)', async () => {
+  __resetStripper();
+  const a = await ensureStripper();
+  const b = await ensureStripper();
+  assert.equal(a, b, 'ensureStripper returns the same memoized backend');
+});
+
+test('stripperName is null before resolution', () => {
+  __resetStripper();
+  assert.equal(stripperName(), null);
+});
diff --git a/test/bun/runtime-smoke.test.mjs b/test/bun/runtime-smoke.test.mjs
new file mode 100644
index 000000000..caf2cb478
--- /dev/null
+++ b/test/bun/runtime-smoke.test.mjs
@@ -0,0 +1,12 @@
+/**
+ * Run the cross-runtime smoke (#508) under WHICHEVER runtime executes the test
+ * suite. Picked up by the root `node --test` runner, so `npm test` exercises the
+ * Node path; CI runs `bun test/bun/smoke.mjs` separately for the Bun path. The
+ * smoke is a plain assert script (`smoke.mjs`, not `*.test.mjs`, so the runner
+ * does not double-run it); importing it executes it and throws on any failure.
+ */
+import { test } from 'node:test';
+
+test('webjs boots, strips TypeScript, and round-trips a server action on this runtime (#508)', async () => {
+  await import('./smoke.mjs');
+});
diff --git a/test/bun/smoke.mjs b/test/bun/smoke.mjs
new file mode 100644
index 000000000..df4393c63
--- /dev/null
+++ b/test/bun/smoke.mjs
@@ -0,0 +1,81 @@
+/**
+ * Cross-runtime smoke test (#508): boot a minimal webjs app through
+ * `createRequestHandler` and assert SSR HTML plus TypeScript-stripped `.ts`
+ * serving, under WHICHEVER runtime executes this file. Run it under both:
+ *
+ *   node test/bun/smoke.mjs
+ *   bun  test/bun/smoke.mjs
+ *
+ * On Node the stripper is the built-in `module.stripTypeScriptTypes`; on Bun
+ * (which lacks it) the `amaro` fallback resolves transparently. A plain assert
+ * script (not node:test) so the SAME file runs identically on both runtimes; it
+ * exits non-zero on failure. Run it from the repo root so the bare
+ * `@webjsdev/server` specifier resolves to the workspace package.
+ */
+import assert from 'node:assert/strict';
+import { mkdtempSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { createRequestHandler, hashFile } from '@webjsdev/server';
+import { stringify, parse } from '@webjsdev/core';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+// Absolute file URL to @webjsdev/core, injected into the fixture so its SSR
+// imports resolve regardless of the temp-dir location (the same trick the Node
+// integration tests use).
+const CORE = pathToFileURL(resolve(__dirname, '../../packages/core/index.js')).toString();
+const runtime = process.versions.bun ? `bun ${process.versions.bun}` : `node ${process.versions.node}`;
+
+const dir = mkdtempSync(join(tmpdir(), 'webjs-runtime-smoke-'));
+const w = (rel, body) => { const abs = join(dir, rel); mkdirSync(dirname(abs), { recursive: true }); writeFileSync(abs, body); };
+try {
+  writeFileSync(join(dir, 'package.json'), JSON.stringify({ name: 'smoke', type: 'module', webjs: {} }));
+  w('app/layout.ts', `import { html } from ${JSON.stringify(CORE)};\nexport default ({ children }: { children: unknown }) => html\`<!doctype html><html><head></head><body>\${children}</body></html>\`;\n`);
+  w('app/page.ts', `import { html } from ${JSON.stringify(CORE)};\nimport '../components/hi-there.ts';\nexport default function Page() { return html\`<main><hi-there></hi-there></main>\`; }\n`);
+  w('components/hi-there.ts', `import { WebComponent, html } from ${JSON.stringify(CORE)};\nexport class HiThere extends WebComponent {\n  greet(name: string): string { return 'hi ' + name; }\n  render() { const n: number = 42; return html\`<p class="hi">\${this.greet('there')} \${n}</p>\`; }\n}\nHiThere.register('hi-there');\n`);
+  // A server action, to round-trip the RPC wire (serializer + dispatch) on the runtime.
+  const actionFile = join(dir, 'actions/echo.server.ts');
+  w('actions/echo.server.ts', `'use server';\nexport async function echo(input: { n: number; at: Date }) { return { doubled: input.n * 2, at: input.at }; }\n`);
+
+  const app = await createRequestHandler({ appDir: dir, dev: true });
+  if (app.warmup) await app.warmup();
+
+  // 1. SSR renders the component's resolved output (no JS needed).
+  const page = await app.handle(new Request('http://localhost/'));
+  assert.equal(page.status, 200, 'GET / should be 200');
+  const pageHtml = await page.text();
+  assert.ok(pageHtml.includes('hi there 42'), `SSR HTML should contain the rendered text; got:\n${pageHtml.slice(0, 400)}`);
+
+  // 2. The `.ts` component is served as JavaScript with its types stripped.
+  const comp = await app.handle(new Request('http://localhost/components/hi-there.ts'));
+  assert.equal(comp.status, 200, 'GET the .ts component should be 200');
+  const js = await comp.text();
+  assert.ok(!/:\s*string/.test(js) && !/:\s*number/.test(js), `served component should have its type annotations stripped; got:\n${js}`);
+  assert.ok(js.includes('class HiThere') && js.includes("register('hi-there')"), 'stripped output should still be valid JS (class + register intact)');
+  // Position-preserving strip: the method/render lines keep their line numbers
+  // (the source has 6 code lines; assert the class body line structure survives
+  // rather than an exact count, which dev-time transforms may pad).
+  assert.ok(js.includes('\nexport class HiThere'), 'the class declaration stays on its own line (strip preserved newlines)');
+
+  // 3. A server action round-trips over RPC (the serializer + dispatch), with a
+  // rich Date value, proving the action path works on this runtime.
+  const cookieRes = await app.handle(new Request('http://localhost/'));
+  const m = (cookieRes.headers.get('set-cookie') || '').match(/webjs_csrf=([^;]+)/);
+  const token = m ? decodeURIComponent(m[1]) : '';
+  const hash = await hashFile(actionFile);
+  const when = new Date('2021-02-03T04:05:06.000Z');
+  const rpc = await app.handle(new Request(`http://localhost/__webjs/action/${hash}/echo`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/vnd.webjs+json', 'x-webjs-csrf': token, cookie: `webjs_csrf=${token}` },
+    body: await stringify([{ n: 21, at: when }]),
+  }));
+  assert.equal(rpc.status, 200, 'the action RPC should be 200');
+  const result = parse(await rpc.text());
+  assert.equal(result.doubled, 42, 'the action ran server-side and returned the computed value');
+  assert.ok(result.at instanceof Date && result.at.getTime() === when.getTime(), 'a rich Date round-trips through the RPC serializer on this runtime');
+
+  console.log(`OK  webjs runtime smoke passed on ${runtime} (SSR + TS strip + server-action RPC)`);
+} finally {
+  rmSync(dir, { recursive: true, force: true });
+}
diff --git a/website/app/page.ts b/website/app/page.ts
index 9dd5257c9..a458a228c 100644
--- a/website/app/page.ts
+++ b/website/app/page.ts
@@ -31,7 +31,7 @@ const ICON = {
 };
 
 const PILLARS = [
-  { icon: ICON.bolt, title: 'No build step', desc: 'Source files are served as native ES modules. Edit, refresh, see it. TypeScript is stripped by Node 24, no bundler, no compile.' },
+  { icon: ICON.bolt, title: 'No build step', desc: 'Source files are served as native ES modules. Edit, refresh, see it. TypeScript is stripped by the runtime (Node or Bun), no bundler, no compile.' },
   { icon: ICON.cube, title: 'Web components, light DOM', desc: 'A thin reactive base class with html and css tagged templates, signals, and the full lit lifecycle. Light DOM by default so Tailwind just works.' },
   { icon: ICON.layers, title: 'Progressive enhancement', desc: 'Everything renders to real HTML on the server. JavaScript is opt-in per interactive behavior. Dead JS is statically elided and never shipped.' },
   { icon: ICON.plug, title: 'Server actions, rich types', desc: 'Mark a file with use server and import it from the client. Date, Map, Set, BigInt, Blob, and cycles all round-trip through the wire.' },