BunProfile: add missing Bun API coverage

[robobun]

Adds missing Bun APIs to the fuzzing profile, verified against the bunObjectTable lookup table in the bun runtime (not just the .d.ts types). Builds on the existing coverage (SHA3, subtle crypto, rapidhash).

Independent of the upstream-sync PR (#8); this only touches BunProfile.swift. If the sync PR lands first, rebase and the additionalOptionsBags field it adds carries over automatically.

New APIs

Functions: Bun.connect, Bun.listen, Bun.sliceAnsi, Bun.readableStreamToFormData, Bun.cron / Bun.cron.remove / Bun.cron.parse, Bun.plugin, Bun.gc

Properties: Bun.argv, Bun.env, Bun.main, Bun.cwd, Bun.stdin, Bun.stdout, Bun.stderr

Object groups: Listener (from Bun.listen()), UDPSocket (from Bun.udpSocket()), BuildArtifact (from Bun.build())

Fixes

• Bun.JSONL: methods are parse + parseChunk (was incorrectly stringify)
• Bun.markdown: exposes html / render / ansi / react (added react; the engine defines all four)
• Bun.dns: expanded from just lookup to include resolve, prefetch, getCacheStats, reverse
• Bun.udpSocket: returns typed BunUDPSocket instead of jsAnything

Verification

swift build passes. The Bun profile and JavaScriptEnvironment construct with all new builtins and ObjectGroups and no consistency errors (verified by running FuzzilliCli --profile=bun).

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: fce64ba0-c399-4e07-8945-f4e9e3ff823c

📥 Commits

Reviewing files that changed from the base of the PR and between 78cf67d and bdc34f1.

📒 Files selected for processing (1)

• Sources/Fuzzilli/Profiles/BunProfile.swift

---

Walkthrough

This PR extends the Bun fuzzing profile with new IL types and object groups, updates JSONL method modeling, expands builtin typings for multiple Bun APIs, and registers the new groups in the profile.

Changes

Bun Profile Type and Builtin Updates

Layer / File(s)	Summary
JSONL method modeling update Sources/Fuzzilli/Profiles/BunProfile.swift	ILType.bunJSONL and bunJSONLGroup now model parseChunk instead of stringify, while keeping parse.
New Bun IL types and object groups Sources/Fuzzilli/Profiles/BunProfile.swift	Adds bunListener, bunUDPSocket, bunBuildArtifact, and bunCronJob, plus matching object groups and their methods/properties.
Builtin typings and profile wiring Sources/Fuzzilli/Profiles/BunProfile.swift	Updates Bun builtin return types, adds new builtins, adjusts Bun.gc, and wires the new object groups into bunProfile.additionalObjectGroups.

Sequence Diagram(s)

Not applicable.

Possibly related PRs

• oven-sh/fuzzilli#4: Earlier Bun profile support that also extends Sources/Fuzzilli/Profiles/BunProfile.swift with Bun-specific IL and builtin modeling.
• oven-sh/fuzzilli#5: Also overlaps on bunJSONL modeling in BunProfile.swift.
• oven-sh/fuzzilli#9: Also changes Bun.markdown builtin registration in BunProfile.swift.

Suggested labels: enhancement, fuzzilli-profile, bun

Suggested reviewers: Maintainers familiar with the Bun profile and Fuzzilli IL type system

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	It clearly summarizes the main change: expanding BunProfile with missing Bun API coverage.
Description check	✅ Passed	It directly describes the BunProfile API additions and corrections in this pull request.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Sources/Fuzzilli/Profiles/BunProfile.swift`:
- Line 771: The `parseChunk` builtin in `BunProfile` is modeled too narrowly and
only covers the string overload. Update the `Bun.JSONL.parseChunk` entry to also
accept binary input shapes such as `ArrayBufferLike`, `TypedArray`, and
`DataView`, and account for the optional `start`/`end` byte-offset arguments
used for slicing. Keep the change localized to the `parseChunk` signature in
`BunProfile` so the fuzzing model reflects all supported overloads.
- Around line 2061-2064: The Bun.cron modeling in BunProfile is missing the
callback overload, so only the 3-string Promise signature is covered. Update the
Bun.cron entry to include the cronExpression + callback form and model it as
returning a CronJob object with stop/ref/unref methods, while keeping the
existing Promise overload intact. Use the Bun.cron symbol in the profile to
locate the API definition and extend the type description accordingly.
- Line 2039: `Bun.udpSocket` is currently modeled as returning a socket
directly, but it is async and resolves through a promise, which causes invalid
follow-up calls in the fuzzer. Update the `BunProfile` entry for `Bun.udpSocket`
to return `.jsPromise` instead of `.bunUDPSocket`, keeping the existing argument
shape intact so the fuzzer treats the result as a promise.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 09d5c5c0-1668-4cea-99a6-36c231e6d7d0

📥 Commits

Reviewing files that changed from the base of the PR and between c24c01b and 78cf67d.

📒 Files selected for processing (1)

• Sources/Fuzzilli/Profiles/BunProfile.swift