v0.2.0

Source commit: d34c2ba616e08a6bb9a33d1851af7d1e417f50e0

Install the verified source archive using Bzlmod:

bazel_dep(name = "curlewlabs_rules_bun", version = "0.2.0")
archive_override(
    module_name = "curlewlabs_rules_bun",
    urls = ["https://github.com/curlewlabs-com/rules_bun/releases/download/v0.2.0/rules_bun-0.2.0.tar.gz"],
    integrity = "sha256-2sAQsWO5JdHz1YxaLY90kkHX8hnzPEh8krm5aaAIXqY=",
    strip_prefix = "rules_bun-0.2.0",
)

The archive includes generated API documentation at docs/api.md, the runnable
independent consumer, and license notices. Runtimes and npm packages are
separate downloads with their own licenses. Acquisition is unsandboxed;
consumers supply their own execution isolation. This release is not a BCR entry.

What's Changed

• Exercise the published release through the independent consumer by @jeffwall-curlewlabs in #9
• Install from Bazel-downloaded, integrity-verified tarballs by @jeffwall-curlewlabs in #10
• Prepare the 0.2.0 release by @jeffwall-curlewlabs in #11

Full Changelog: v0.1.0...v0.2.0

Tightening and migration from 0.1.x

• Only default-registry packages are acquired. Lock entries from tarball URLs, Git, other registries, or without an integrity value now fail planning with Unsupported lock entry. Depend on those packages through the default npm registry, or stay on 0.1.x.
• Registry settings in declared inputs no longer redirect downloads. Bazel fetches every locked tarball from https://registry.npmjs.org/ against its lock integrity, and Bun installs from a loopback registry. Do not put tokens or passwords in declared inputs.
• Tarballs are cached by Bazel's repository cache: fetched once per host and checked against their lock integrity on every reuse. closure.json gains an additive planner digest; the format identifier is unchanged.