Ship Bun 1.4.3 tooling and reproducible Cookie Loom preview releases

.bun-version

@@ -0,0 +1 @@
+1.4.3

.github/dependabot.yml

@@ -1,6 +1,6 @@
 version: 2
 updates:
-  - package-ecosystem: npm
+  - package-ecosystem: bun
     directory: /
     schedule:
       interval: monthly

.github/workflows/ci.yml

@@ -2,8 +2,10 @@ name: CI
 
 on:
   push:
+    branches: ['**']
   pull_request:
   workflow_dispatch:
+  workflow_call:
 
 permissions:
   contents: read
@@ -21,26 +23,20 @@ jobs:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          node-version: '24'
-          cache: npm
-      - run: npm ci
-      - run: npm run format:check
-      - run: npm audit --omit=dev
-      - run: npm run check
-      - run: npm test
-      - run: npm run build
-      - run: npm run lint:firefox
-      - run: npm run zip
-      - run: npm run verify:builds
-      - name: Check archive integrity and generate checksums
-        working-directory: apps/extension/.output
-        run: |
-          for archive in cookie-loom-*.zip; do
-            unzip -tq "$archive"
-          done
-          sha256sum cookie-loom-*.zip > SHA256SUMS
+          bun-version: '1.4.3'
+      - run: bun install --frozen-lockfile --ignore-scripts
+      - run: bun run format:check
+      - run: bun audit --prod
+      - run: bun run typecheck
+      - run: bun run test
+      - run: bun run build
+      - run: bun run lint:firefox
+      - run: bun run zip
+      - run: bun run verify:builds
+      - run: bun run verify:sources
+      - run: bun run release:prepare
       - name: Upload unsigned packages and corresponding source
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
@@ -50,6 +46,7 @@ jobs:
           path: |
             apps/extension/.output/cookie-loom-*.zip
             apps/extension/.output/SHA256SUMS
+            apps/extension/.output/RELEASE.json
           if-no-files-found: error
           retention-days: 14
 
@@ -61,15 +58,14 @@ jobs:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          node-version: '24'
-          cache: npm
-      - run: npm ci
-      - run: npm run build
-      - run: npx playwright install --with-deps chromium firefox
-      - run: xvfb-run --auto-servernum npm run test:e2e
-      - run: npm run test:firefox
+          bun-version: '1.4.3'
+      - run: bun install --frozen-lockfile --ignore-scripts
+      - run: bun run build
+      - run: bunx --bun playwright install --with-deps chromium firefox
+      - run: xvfb-run --auto-servernum bun run test:e2e
+      - run: bun run test:firefox
       - name: Upload failed-test diagnostics
         if: failure()
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
@@ -80,3 +76,38 @@ jobs:
             test-results/
           if-no-files-found: ignore
           retention-days: 7
+
+  minimum-browsers:
+    name: Minimum browser versions
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: '1.4.3'
+      - run: bun install --frozen-lockfile --ignore-scripts
+      - run: bun run build
+      - run: bunx --bun playwright install-deps chromium firefox
+      - run: mkdir -p "$RUNNER_TEMP/cookie-loom-baselines"
+      - name: Download pinned official baseline browsers
+        working-directory: ${{ runner.temp }}/cookie-loom-baselines
+        run: |
+          curl --fail --location --retry 3 https://storage.googleapis.com/chrome-for-testing-public/132.0.6834.159/linux64/chrome-linux64.zip --output chrome.zip
+          curl --fail --location --retry 3 https://archive.mozilla.org/pub/firefox/releases/140.0/linux-x86_64/en-US/firefox-140.0.tar.xz --output firefox.tar.xz
+          sha256sum --check --strict <<'CHECKSUMS'
+          955bbbe5bfc2c210eced0c8faf5bc4aca4640af63b33f7480a4c2fc0b449e6e6  chrome.zip
+          ca3469774734743b878bca2cfb7efb7b8a8eb4a3c15c2f1f427fbc0472ad3f6e  firefox.tar.xz
+          CHECKSUMS
+          unzip -q chrome.zip
+          tar -xf firefox.tar.xz
+      - name: Test compiled extension on Chrome 132
+        run: bun run test:e2e -- --project=chromium-extension
+        env:
+          CHROMIUM_BINARY: ${{ runner.temp }}/cookie-loom-baselines/chrome-linux64/chrome
+      - name: Test native APIs on Firefox 140
+        run: bun run test:firefox
+        env:
+          FIREFOX_BINARY: ${{ runner.temp }}/cookie-loom-baselines/firefox/firefox

.github/workflows/release.yml

@@ -0,0 +1,72 @@
+name: Preview release
+
+on:
+  push:
+    tags: ['v*-preview.*']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: preview-release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  validate:
+    name: Validate preview tag
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: '1.4.3'
+      - run: bun scripts/validate-release-tag.mjs
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+
+  verify:
+    needs: validate
+    uses: ./.github/workflows/ci.yml
+
+  publish:
+    name: Publish verified preview
+    needs: verify
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: '1.4.3'
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: cookie-loom-unsigned-packages
+          path: release-assets
+      - name: Verify checksums and source revision
+        working-directory: release-assets
+        env:
+          EXPECTED_COMMIT: ${{ github.sha }}
+        run: |
+          sha256sum --check --strict SHA256SUMS
+          bun -e 'import fs from "node:fs"; const m = JSON.parse(fs.readFileSync("RELEASE.json")); if (m.sourceCommit !== process.env.EXPECTED_COMMIT || m.unsigned !== true) process.exit(1);'
+      - name: Create and publish preview
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.ref_name }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
+            echo 'This release already exists. Refusing to replace published assets.' >&2
+            exit 1
+          fi
+          gh release create "$RELEASE_TAG" release-assets/* --verify-tag --draft --prerelease --title "Cookie Loom $RELEASE_TAG" --notes-file "docs/releases/$RELEASE_TAG.md"
+          gh release edit "$RELEASE_TAG" --draft=false

.prettierignore

@@ -2,6 +2,6 @@ legacy/
 node_modules/
 **/.output/
 **/.wxt/
-package-lock.json
+bun.lock
 playwright-report/
 test-results/

CHANGELOG.md

@@ -3,7 +3,10 @@
 Notable user-facing changes are recorded here. Cookie Loom versions are
 independent of the historical Cookie Quick Manager version numbers.
 
-## Unreleased — Cookie Loom 0.1.0
+## 0.1.0-preview.1 — 2026-10-12
+
+The first public GitHub preview. Browser manifests use `0.1.0`; packages are
+unsigned and browser-store publication is pending.
 
 ### Added
 
@@ -22,9 +25,19 @@ independent of the historical Cookie Quick Manager version numbers.
   those capabilities.
 - A synthetic-data demonstration workspace and automated checks.
 - Contributor, privacy, security, architecture, migration, and release guides.
+- Tagged preview releases with SHA-256 checksums, source revision metadata, and
+  automated byte-for-byte source/archive verification.
+- Chrome 132 and Firefox 140 baseline API checks in CI, plus browser-store
+  listing copy, permission justifications, reviewer instructions, and images.
+- A pinned Bun 1.4.3 toolchain for development, builds, tests, CI, and source
+  reproduction, with a single text lockfile and scripts-disabled frozen installs.
 
 ### Changed
 
+- Native Bun typechecking runs workspace checks in parallel, and the native Bun
+  unit runner replaces Vitest. WXT/Vite continue to compile the browser builds.
+- Development processes follow their supervisor's lifetime through Bun's
+  no-orphan process handling.
 - Cookie protection is a cleanup safeguard within Cookie Loom. It does not
   recreate cookies removed by websites or browser settings.
 - Startup cleanup is opt-in and bound to the browser's profile-startup event.
@@ -42,4 +55,4 @@ independent of the historical Cookie Quick Manager version numbers.
 
 The old extension and its documentation are preserved in `legacy/`. Upstream
 history is credited in [NOTICE](NOTICE); the GPL license is unchanged. This
-unreleased entry is not a claim of browser-store publication or certification.
+preview entry is not a claim of browser-store publication or certification.

CONTRIBUTING.md

@@ -11,6 +11,10 @@ without weakening the user's control over their browser data.
 3. Open a focused issue or pull request. Discuss substantial permission,
    storage, dependency, or product changes before implementing them.
 
+Use Bun 1.4.3 and install with `bun install --frozen-lockfile --ignore-scripts`.
+Dependency changes must include the updated `bun.lock`; keep the single workspace
+lockfile rather than introducing another package manager's lockfile.
+
 Bug reports should include the browser and version, operating system, steps
 to reproduce, expected behavior, and what happened. Use a disposable profile
 and synthetic cookies whenever possible. Never attach real session tokens,
@@ -40,16 +44,17 @@ Please also read the [code of conduct](CODE_OF_CONDUCT.md).
 Before opening a pull request, run:
 
 ```sh
-npm run format:check
-npm audit --omit=dev
-npm run check
-npm test
-npm run build
-npm run lint:firefox
-npm run test:e2e
-npm run test:firefox
-npm run zip
-npm run verify:builds
+bun run format:check
+bun audit --prod
+bun run typecheck
+bun run test
+bun run build
+bun run lint:firefox
+bun run test:e2e
+bun run test:firefox
+bun run zip
+bun run verify:builds
+bun run verify:sources
 ```
 
 The browser tests require Playwright's Chromium and Firefox installations; see the

README.md

@@ -9,8 +9,10 @@ new TypeScript / React codebase and shared Chromium and Firefox builds. It
 continues under GPL-3.0-or-later and retains the original project's history and
 attribution. See [NOTICE](NOTICE) and [the migration guide](docs/migration.md).
 
-**Status: 0.1.0 development preview.** Build and load it locally using the
-instructions below. No Cookie Loom browser-store release is claimed here.
+**Status: 0.1.0 public preview.** Download the unsigned browser ZIPs, reproducible
+source, and checksums from [the preview release](https://github.com/q1/cookie-quick-manager/releases/tag/v0.1.0-preview.1).
+Chromium can load the extracted build unpacked; Firefox supports a temporary
+development installation. No Cookie Loom browser-store release is claimed here.
 Targets are desktop Chromium 132+ and Firefox 140+; browser-specific behavior
 must be verified on the versions you use. Safari and mobile are not current
 release targets.
@@ -64,11 +66,11 @@ search syntax, cleanup scope, and import behavior.
 
 ## Try the demo
 
-Use Node.js 24 and npm:
+Use [Bun 1.4.3](https://bun.sh/blog/bun-v1.4.3), pinned in `.bun-version`:
 
 ```sh
-npm ci
-npm run dev
+bun install --frozen-lockfile --ignore-scripts
+bun run dev
 ```
 
 Open the local URL printed by Vite, normally `http://localhost:5173`.
@@ -78,7 +80,7 @@ store. It is useful for exploring the interface, not verifying extension APIs.
 ## Build the extension
 
 ```sh
-npm run build
+bun run build
 ```
 
 **Chromium:** open `chrome://extensions`, enable **Developer mode**, select
@@ -90,23 +92,23 @@ This is a temporary development installation; normal distribution requires
 [Mozilla signing](https://extensionworkshop.com/documentation/publish/signing-and-distribution-overview/).
 
 Use a disposable browser profile for development. To run WXT's development
-workflow directly, use `npm run dev:chrome` or `npm run dev:firefox`.
+workflow directly, use `bun run dev:chrome` or `bun run dev:firefox`.
 
 ## Develop and contribute
 
 ```sh
-npm run format:check
-npm audit --omit=dev
-npm run check
-npm test
-npm run build
-npm run lint:firefox
-npx playwright install chromium firefox
-npm run test:e2e
-npm run test:firefox
+bun run format:check
+bun audit --prod
+bun run typecheck
+bun run test
+bun run build
+bun run lint:firefox
+bunx --bun playwright install chromium firefox
+bun run test:e2e
+bun run test:firefox
 ```
 
-The npm workspace contains:
+The Bun workspace contains:
 
 ```text
 apps/extension/   WXT extension, React interface, browser adapter, local demo
@@ -120,7 +122,12 @@ Start with [CONTRIBUTING.md](CONTRIBUTING.md),
 [architecture decisions](docs/architecture.md). See
 [browser verification](docs/verification.md) for real-extension checks and
 [the release guide](docs/releasing.md) for packaging and store preparation.
-`npm run zip` creates unsigned browser-specific archives for review.
+Native Bun typechecking and parallel unit tests keep feedback quick; measured
+toolchain results are recorded in [the performance notes](docs/toolchain-performance.md).
+`bun run zip` creates unsigned browser-specific archives for review.
+`bun run verify:sources` rebuilds from the source archive and compares every
+browser ZIP file with the production build. Store copy, permission explanations,
+images, and reviewer instructions are in [the submission kit](docs/store-listing.md).
 
 See the [dependency review](docs/dependency-review.md) for the remaining
 development-tool advisories; the production dependency audit is clean.

THIRD_PARTY_NOTICES.md

@@ -2,7 +2,7 @@
 
 These notices cover code bundled in the Cookie Loom extension. Development tools
 retain their licenses in their installed packages. Update this file with
-`npm run prepare:assets` after dependency changes.
+`bun run prepare:assets` after dependency changes.
 
 ## react 19.3.0
 

apps/extension/package.json

@@ -9,9 +9,9 @@
     "dev:chrome": "wxt -b chrome --mv3",
     "dev:firefox": "wxt -b firefox --mv3",
     "build": "wxt build -b chrome --mv3 && wxt build -b firefox --mv3",
-    "zip": "npm --prefix ../.. run zip",
-    "typecheck": "wxt prepare && tsc --noEmit",
-    "lint:firefox": "node ../../scripts/lint-firefox.mjs"
+    "zip": "bun run --cwd ../.. zip",
+    "typecheck": "wxt prepare && bun check -p tsconfig.json",
+    "lint:firefox": "bun ../../scripts/lint-firefox.mjs"
   },
   "dependencies": {
     "@cookie-loom/core": "*",