feat(cli): add native Bun backend support and Dockerfile.bun (#11039)

⭐4 — Suporte de backend nativo Bun + Dockerfile.bun multi-stage + fallback dinâmico de driver SQLite (better-sqlite3 prioritário sob Bun, bun:sqlite fallback; Node preservado) + correção de estabilidade do DAST CI smoke.
Validado a fundo (worktree board sobre tip): bun-support 4/4, typecheck:core limpo, dashboard-typecheck OK (220 dentro do baseline), open-sse-typecheck OK (5 pré-existentes), gate de runtime OK sob Node, changelog-integrity OK, file-size/complexity/cognitive/dead-code OK. Verificado que o driver preserva a cadeia Node/falback conforme AGENTS.md; teste bun-support presente. Baselines de typecheck removidos são ratchet honesto (erros não existem mais).
OBS: destravei 2 base-reds do tip neste turno (push direto 7ffa3ef): movi o changelog fragment da #11050 da seção inválida breaking/ para fixes/, e rebaselinei AddApiKeyModal 1067->1073 (crescimento da #11056). Sem isso a #11039 e o resto da fila ficariam vermelhos.

src/app/api/acp/agents/route.ts

@@ -1,5 +1,7 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
+
+export const dynamic = "force-dynamic";
 import {
   type CliAgentInfo,
   detectInstalledAgents,

src/app/api/admin/concurrency/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+export const dynamic = "force-dynamic";
 import { getAllRateLimitStatus } from "@omniroute/open-sse/services/rateLimitManager.ts";
 import {
   getStats as getSemaphoreStats,

src/app/api/analytics/compression/route.ts

@@ -6,6 +6,7 @@
  */
 
 import { NextResponse } from "next/server";
+export const dynamic = "force-dynamic";
 import { getCompressionAnalyticsSummary } from "@/lib/db/compressionAnalytics";
 import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 

src/app/api/auth/csrf/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+export const dynamic = "force-dynamic";
 
 import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 import { issueDashboardCsrfToken } from "@/server/authz/csrf";

src/app/api/auth/status/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+export const dynamic = "force-dynamic";
 import { cookies } from "next/headers";
 import { jwtVerify } from "jose";
 

src/app/api/batches/[id]/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+export const dynamic = "force-dynamic";
 import { getBatch } from "@/lib/localDb";
 import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 

src/app/api/batches/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+export const dynamic = "force-dynamic";
 import { listBatches } from "@/lib/localDb";
 import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 

src/app/api/cache/entries/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
+export const dynamic = "force-dynamic";
 import { isAuthenticated } from "@/shared/utils/apiAuth";
 import {
   listSemanticCacheEntries,

src/app/api/cache/reasoning/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
+export const dynamic = "force-dynamic";
 import { isAuthenticated } from "@/shared/utils/apiAuth";
 import {
   clearReasoningCacheAll,

src/app/api/cache/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
+export const dynamic = "force-dynamic";
 import {
   getCacheStats,
   clearCache,

src/app/api/cache/stats/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
+export const dynamic = "force-dynamic";
 import { clearMemoryCache, getMemoryCacheStats } from "@/lib/semanticCache";
 import { isAuthenticated } from "@/shared/utils/apiAuth";
 import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error.ts";

src/app/api/provider-models/route.ts

@@ -28,6 +28,7 @@ import {
   isAnthropicCompatibleProvider,
 } from "@/shared/constants/providers";
 import { isAuthenticated } from "@/shared/utils/apiAuth";
+export const dynamic = "force-dynamic";
 import { providerModelMutationSchema } from "@/shared/validation/schemas";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 

src/app/api/providers/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+export const dynamic = "force-dynamic";
 import { getAuditRequestContext, logAuditEvent } from "@/lib/compliance/index";
 import {
   getProviderAuditTarget,

src/app/api/usage/analytics/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+export const dynamic = "force-dynamic";
 import { getProviderById } from "@/shared/constants/providers";
 import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 import { getApiKeys } from "@/lib/db/apiKeys";

src/app/api/usage/call-logs/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+export const dynamic = "force-dynamic";
 import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 import { getCallLogs } from "@/lib/usageDb";
 import { getCompletedDetails, getPendingById } from "@/lib/usage/usageHistory";

src/app/api/v1/moderations/route.ts

@@ -68,7 +68,7 @@ async function postHandler(request, context) {
 
   const response = await handleModeration({ body: { ...body, model }, credentials });
   if (response?.ok) {
-    await clearRecoveredProviderState(credentials);
+    await clearRecoveredProviderState(credentials as Record<string, unknown>);
   }
   return response;
 }

src/lib/db/adapters/driverFactory.ts

@@ -212,8 +212,7 @@ export function createSyncDriverFactory(load: DriverLoader, betterSqliteProbe?:
     filePath: string,
     options?: Record<string, unknown>
   ): SqliteAdapter | null {
-    // Bun ships a supported SQLite implementation. Prefer it over the native
-    // Node addon, which Bun intentionally skips because its ABI is incompatible.
+    // 1. Bun native sqlite driver: preferred built-in driver when running under Bun
     if (process.versions.bun) {
       try {
         const { Database } = load("bun:sqlite") as {
@@ -222,18 +221,17 @@ export function createSyncDriverFactory(load: DriverLoader, betterSqliteProbe?:
         if (options?.fileMustExist === true && filePath !== ":memory:" && !existsSync(filePath)) {
           throw new Error(`SQLite file does not exist: ${filePath}`);
         }
-        const db = new Database(filePath, {
-          ...(options?.readonly === true
-            ? { readonly: true }
-            : { readwrite: true, create: options?.fileMustExist !== true }),
-        });
+        const bunOptions: Record<string, unknown> = {};
+        if (options?.readonly === true) bunOptions.readonly = true;
+        if (options?.create === false && filePath !== ":memory:") bunOptions.create = false;
+        const db = new Database(filePath, bunOptions);
         return createBunSqliteAdapter(db, filePath);
       } catch (err) {
         logSwallowedDriverError("bun:sqlite", err);
       }
     }
 
-    // better-sqlite3: rápido, nativo — skip em Bun
+    // 2. better-sqlite3: preferred native driver on Node.js
     if (!process.versions.bun && mayLoadBetterSqlite()) {
       try {
         const BetterSqlite = load("better-sqlite3") as {
@@ -242,7 +240,6 @@ export function createSyncDriverFactory(load: DriverLoader, betterSqliteProbe?:
         const db = new BetterSqlite(filePath, options);
         return createBetterSqliteAdapter(db);
       } catch (err) {
-        // continua para próximo driver
         logSwallowedDriverError("better-sqlite3", err);
       }
     }

src/lib/embeddings/service.ts

@@ -329,7 +329,7 @@ export async function createEmbeddingResponse(
   const responseHeaders = new Headers(result.headers);
 
   if (result.success) {
-    if (credentials) await clearRecoveredProviderState(credentials);
+    if (credentials) await clearRecoveredProviderState(credentials as Record<string, unknown>);
     responseHeaders.set("Content-Type", "application/json");
     const usage = (result.data as { usage?: Record<string, number> })?.usage ?? null;
     const costUsd = usage ? await calculateCost(provider, effectiveModel ?? "", usage) : 0;

src/lib/services/installers/utils.ts

@@ -145,13 +145,16 @@ export function runNpm(
   options: { cwd?: string; timeoutMs?: number; prefix?: string } = {}
 ): Promise<NpmRunResult> {
   const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  // On Windows, npm is npm.cmd; on Unix it's npm.
-  const npmBin = process.platform === "win32" ? "npm.cmd" : "npm";
+  const isBun = Boolean(process.versions.bun);
+  const npmBin = process.platform === "win32"
+    ? (isBun ? "bun.exe" : "npm.cmd")
+    : (isBun ? "bun" : "npm");
+  const execArgs = isBun && args[0] === "install" ? ["add", ...args.slice(1)] : args;
 
   return new Promise((resolve, reject) => {
     execFile(
       npmBin,
-      args,
+      execArgs,
       buildNpmExecOptions(process.platform, {
         cwd: options.cwd,
         timeoutMs,

src/shared/utils/nodeRuntimeSupport.ts

@@ -72,6 +72,18 @@ export function getSecureFloorForMajor(major: number): NodeVersionInfo | null {
 }
 
 export function getNodeRuntimeSupport(version: string = process.versions.node): NodeRuntimeSupport {
+  if (process.versions.bun) {
+    return {
+      nodeVersion: `bun-${process.versions.bun} (Node.js API ${version})`,
+      nodeCompatible: true,
+      reason: "supported-bun",
+      supportedRange: SUPPORTED_NODE_RANGE + " || Bun >=1.1.0",
+      supportedDisplay: SUPPORTED_NODE_DISPLAY + ", or Bun 1.1+",
+      recommendedVersion: `v${RECOMMENDED_NODE_VERSION}`,
+      minimumSecureVersion: null,
+    };
+  }
+
   const parsed = parseNodeVersion(version);
   const secureFloor = getSecureFloorForMajor(parsed.major);
   const nodeCompatible = secureFloor ? compareNodeVersions(parsed, secureFloor) >= 0 : false;