perf: publish a narrow router runtime entry

Stacks #2590 measured 8.9 MiB of fresh-process RSS from importing the published @stacksjs/bun-router root barrel before registering a route. The root intentionally exports auth, containers, sessions, testing, typed clients, response helpers, middleware, and the entire router surface, so changing it would break the public API.

Add a stable @stacksjs/bun-router/runtime entry for framework and API-server consumers that need the registered Router and its serve/dispatch path without importing unrelated root-barrel features.

The entry should expose the runtime values Stacks uses directly: the fully registered Router, request enhancement and context helpers, response compression/factory helpers, and typed-router creation. It must preserve the root entry unchanged.

Acceptance:

• The package exports ./runtime with JavaScript and declarations.
• A built-package consumer can register and serve a native route through the runtime entry, with byte-identical response behavior.
• The runtime entry does not export unrelated root-only surfaces such as auth, the dependency container, session stores, or testing utilities.
• A build-graph test starts at the emitted runtime entry and records its statically reachable chunks, preventing a later root-barrel re-export from silently restoring the full graph.
• Fresh Bun 1.4.2 processes measure imports of the same required symbols from the root and runtime entries. Report every sample and the median wall time and RSS, including a null result if no saving appears.
• Link the resulting commit and measurements back to stacksjs/stacks#2590. No dependency adoption or package publication is part of this issue.

This is the upstream prerequisite for a later Stacks narrow entry. Importing a hash-named chunk or an undeclared source subpath is not acceptable.

Implemented and pushed to main in 0ca8f67.

The package now publishes @stacksjs/bun-router/runtime with the registered Router, request context and enhancement helpers, response compression and factory helpers, and typed-router creation. The root entry and its complete API are unchanged.

The built-package regression starts at emitted runtime.js, follows its static chunk graph, verifies that index.js is unreachable, and rejects auth, container, session, or testing source inputs. It then serves the same real route through root and runtime builds in separate Bun processes and compares the exact status, content type, and body.

Exact Bun 1.4.2 validation before push:

• 565 tests pass, 0 fail, 1,741 assertions
• lint passes
• both typecheck configurations pass
• full package build and compiled CLI pass

The deterministic emitted graph is 372,175 bytes across five files for the root entry and 157,974 bytes across three files for the runtime entry. That is 214,201 fewer bytes, or 57.6% less statically reachable JavaScript. This is graph evidence only and is not being presented as an RSS or startup claim.

A 15-pair alternating fresh-process Bun 1.4.2 measurement is guarded by sampled host CPU before and after every pair. The local host remains busy with unrelated compiler work, so the guard has correctly refused to produce timing or RSS numbers. I will add every sample and medians once the guarded run obtains two quiet observations and completes. Pushed CI for the exact SHA will also be linked here before closing.

Downstream adoption remains tracked in stacksjs/stacks#2590. No release or dependency adoption is claimed by this commit.

Exact pushed-SHA CI is green: run 35562325457 passed lint, typecheck, the full test suite, build, and the repository's publish-commit job for 0ca8f6718290f4f34ab5469ca811d7fbf768ad45.

The issue remains open only for the guarded fresh-process sample report.

The checked-in diagnostic from #897 completed on a clean GitHub-hosted Ubuntu x64 checkout at 19c592af252990adf4e4c9400c25c322e20bba7c, using latest stable Bun 1.4.2. Workflow run, raw JSON artifact.

This is hosted-runner diagnostic evidence, not a publishable hardware ranking. The checkout stayed clean at the same commit for the entire run. Each variant ran in a fresh process, imported and verified the same six serving symbols, forced GC, settled for 20 ms, and alternated order for 30 pairs.

Every sample:

The runtime entry therefore clears the behavior, graph, fresh-process, validation, and pushed-CI acceptance criteria. Downstream adoption remains in stacksjs/stacks#2590 and still requires an ordinary stable package release.