feat: run on Bun and Deno, and prove it in CI

[unional]

assertron is a leaf dependency of nearly every testing package in this fleet, so its portability ceiling is everyone else's. This raises it and, more importantly, puts a job in CI that executes the claim instead of asserting it in a table.

What actually ships

Audited by packing the tarball and grepping the build output, not by grepping ts/:

Builtin	Where	Ships?
perf_hooks (bare)	ts/assert-order/StateMachine.ts	yes — esm/assert-order/StateMachine.js and the CJS require("perf_hooks")
node:assert	ts/testUtils.ts, ts/**/*.spec.ts	no — both excluded by files
node:fs/promises	tsdown.config.ts	no — build config, untouched

So the shipped coupling was one bare perf_hooks import, and one only.

node:assert is not breaking, because it never shipped

The brief asked whether removing it breaks consumers. It does not, because there is nothing to remove: node:assert appears only in the test helper and the spec files, and files excludes ts/testUtils.ts and every *.spec.*. npm pack --dry-run confirms neither is in the tarball. The library's own AssertionError already comes from iso-error (ts/errors.ts), never from node:assert — consumers catching an assertion failure have always been catching this package's error, with its own shape. No major changeset; this PR is a patch.

The clock

StateMachine reached for perf_hooks and preferred process.hrtime. It now uses performance.now(), a global on Node ≥20 (this package's engines floor), Bun, Deno and the browser. That is the same high-resolution millisecond clock process.hrtime was providing, so AssertOrder#end() and getTimeTaken() return what they always did. There is no Date.now() fallback arm: no supported host lacks performance, and a branch no test can enter is not a safety net — codecov caught it as an uncovered half of the diff, and deleting it was the honest fix. Coverage is now 100% across statements, branches, functions and lines. browser: { "perf_hooks": false } is dropped along with it: it stubbed an import that no longer exists.

The published output now references no Node builtin at all.

The measured result, including the part that undercuts the premise

Deno 2.9 already resolves bare perf_hooks through its Node compatibility layer. I rebuilt the pre-change output and ran the smoke test on Deno to check rather than assume, and it passed. So the old code was not in fact broken on Deno, and this PR should not be read as a bug fix for it.

It still earns its place. Removing the builtin outright is what makes the output loadable where there is no Node compat layer — browsers, workers, edge runtimes — and it clears the last suppression so the lint rule can guard the package with no carve-out.

Smoke results on the built output, ESM and CJS, all green:

Runtime	ESM	CJS
Node 26.7.0	pass	pass
Bun 1.4.0	pass	pass
Deno 2.9.6	pass	pass

Enforcement, verified rather than assumed

useNodejsImportProtocol is pinned to "error" in biome.json. Inheriting it from the preset would have enforced nothing: the rule ships in the style group at info, where biome prints the finding and still exits 0. Verified by reverting the import to its bare form — biome ci then exits 1 with a real lint/style/useNodejsImportProtocol error — and by a scratch probe on a bare path import. Restored afterwards.

CI

.github/workflows/runtimes.yml is a local reusable workflow running a three-way matrix. All three legs are handed the identical artifact, built once on Node with pnpm, so the matrix tests portability of the output and not of the build.

• pull-request.yml calls it as a separate runtimes job. The caller job id code is untouched, so the required code / all-checks context still exists.
• release.yml calls it and adds it to release's needs, so a runtime regression fails the release closed, the way publish-gate already does.

pnpm verify gains a smoke turbo task, so the Node leg also runs locally.

Not done here

ESM-only: the package still ships dual esm/ + cjs/, and both halves are exercised by the smoke test. It could go ESM-only — nothing in the source needs CJS — but that is a breaking change for a package with this many dependents, and it deserves its own PR and its own major. Left alone deliberately.

Checked and found already correct, so unchanged: .husky/commit-msg is 100755 and commitlint ran on this commit; minimumReleaseAge already lives in pnpm-workspace.yaml with minimumReleaseAgeStrict: true, not in .npmrc; every files entry resolves to a real directory. Workflow refs stay cyberuni/.github/... — this repo lives in cyberuni, not unional.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ETjy9oQGyETyFmDBdR9Egz

[changeset-bot]

🦋 Changeset detected

Latest commit: 419f686

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
assertron	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (4ead2bb) to head (e7a157f).

Additional details and impacted files

@@             Coverage Diff             @@
##             main      #352      +/-   ##
===========================================
+ Coverage   95.18%   100.00%   +4.81%     
===========================================
  Files          21        21              
  Lines         187       179       -8     
  Branches       47        45       -2     
===========================================
+ Hits          178       179       +1     
+ Misses          8         0       -8     
+ Partials        1         0       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.