build(nix): migrate to bun2nix v2 and fix other checks

* Updated `bun2nix` to v2.0.1, regenerated `bun.nix`
* Use `bun2nix` npm package for `postinstall` script so that it works
  both inside and outside a nix devshell
* Migrated `www` builds to new bun2nix APIs to fix build-time errors
* Fixed `cargo-deny` checks failing by reordering the
  `--hide-inclusion-graph` flag to be after the `check` command
* Excluded generated `bun.nix` fixed-output derivation file from
  `treefmt `formatting

Author: CompeyDev

flake.lock

@@ -6,7 +6,7 @@
     flake-utils.url = "github:numtide/flake-utils";
     crane.url = "github:ipetkov/crane";
     rust-overlay.url = "github:oxalica/rust-overlay";
-    bun2nix.url = "github:baileyluTCD/bun2nix";
+    bun2nix.url = "github:nix-community/bun2nix";
 
     rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
     bun2nix.inputs.nixpkgs.follows = "nixpkgs";
@@ -27,12 +27,14 @@
       let
         pkgs = import nixpkgs {
           inherit system;
-          overlays = [ (import rust-overlay) ];
+          overlays = [
+            (import rust-overlay)
+            bun2nix.overlays.default
+          ];
         };
 
         # --- Libraries ---
         lib = pkgs.lib;
-        bunLib = bun2nix.lib.${system};
         craneLib = (crane.mkLib pkgs).overrideToolchain (
           toolchain:
           toolchain.rust-bin.nightly."2025-06-20".default.override {
@@ -46,10 +48,14 @@
         );
 
         # Build www project
-        www = bunLib.mkBunDerivation {
-          bunNix = ./www/bun.nix;
+        www = pkgs.stdenv.mkDerivation {
+          name = "ssh-portfolio-www";
           packageJson = ./www/package.json;
           src = ./www;
+
+          nativeBuildInputs = [ pkgs.bun2nix.hook ];
+          bunDeps = pkgs.bun2nix.fetchBunDeps { bunNix = ./www/bun.nix; };
+
           buildPhase = ''
             bun run build
           '';
@@ -132,9 +138,12 @@
           );
 
         ssh-portfolio = pkgs.callPackage crate { };
-        ssh-portfolio-deny = craneLib.cargoDeny commonCraneArgs // {
-          cargoDenyExtraArgs = "--hide-inclusion-graph";
-        };
+        ssh-portfolio-deny = craneLib.cargoDeny (
+          commonCraneArgs
+          // {
+            cargoDenyChecks = "--hide-inclusion-graph bans licenses sources";
+          }
+        );
 
       in
       {
@@ -150,7 +159,7 @@
             set -euo pipefail
             cp -r ${./.} workdir
             chmod -R +w workdir/
-            treefmt --ci --tree-root workdir/
+            treefmt --ci --tree-root workdir/ --excludes '**/bun.nix'
             touch $out
           '';
         };

flake.nix

@@ -11,6 +11,7 @@
         "@sveltejs/vite-plugin-svelte": "^6.2.0",
         "@tailwindcss/vite": "^4.1.13",
         "@types/node": "^24.5.2",
+        "bun2nix": "^2.0.1",
         "esbuild": "^0.25.10",
         "eslint": "^9.36.0",
         "eslint-config-prettier": "^10.1.8",
@@ -261,6 +262,8 @@
 
     "braces": ["braces@3.0.3", "", { "dependencies": { "fill-range": "^7.1.1" } }, "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA=="],
 
+    "bun2nix": ["bun2nix@2.0.1", "", { "dependencies": { "sade": "^1.8.1" }, "bin": { "bun2nix": "index.ts" } }, "sha512-DYRxOPa+HP2cpJWYFigytOiG6u0Jq/wyD2fbdlmGvJ1vxzigLGLzMmnv/pbt5t8W3CUxxypdaEVS7bUitGTJyQ=="],
+
     "callsites": ["callsites@3.1.0", "", {}, "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ=="],
 
     "chalk": ["chalk@4.1.2", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],