@smthrs/platform-bun 0.0.0-stage → 1.0.0-rc.12

package/CHANGELOG.md

@@ -0,0 +1,73 @@
+# @smthrs/platform-bun
+
+## [Unreleased]
+
+### Added
+
+- `BunHost.BunHostError`, the refusal `BunHost.layerAt` and
+  `BunHost.layerContainedAt` throw for a root that is not absolute, the empty
+  string included. It carries the stable code `invalid_repository_root`
+  (`BunHost.BunHostErrorCode`), names the Bun factory that refused, and repeats
+  at most 64 characters of the root. Both factories used to hand the root
+  straight to the `Jj` adapter, which threw a bare `TypeError` naming
+  `NodeJj.layerAt` or `NodeJj.layerSpawnerAt`, carried no code, and echoed the
+  whole string.
+- `BunHost.layerHttpClient`, the network slot on its own: the fetch client with
+  `redirect: "manual"` that every `BunHost` factory installs.
+
+### Removed
+
+- The `BunHost.BunHttpClient` re-export. Its `layer` follows redirects, so a
+  program that composed it instead of `BunHost.layer` reached origins the
+  capability kernel never authorized. Use `BunHost.layerHttpClient`.
+
+## [1.0.0-rc.0] - 2026-09-01
+
+### Added
+
+- Initial extraction from the dissolved `@smthrs/host`. `BunHost` and
+  `BunFileSystem` moved here unchanged in behaviour; `BunJj` had already moved
+  to `@smthrs/jj` and is composed from there.
+- `BunHost.layerAt` and `BunHost.layerContainedAt` bind `Jj` to one absolute
+  repository root, so a host does not inherit the process working directory.
+- `BunFileSystem.layer` is `@smthrs/platform-node`'s `AtomicFileSystem.layer`,
+  the same implementation behind `NodeHost`'s filesystem slot. Guarded path
+  operations under `@smthrs/kernel`'s `FileSystem.layer` are therefore
+  descriptor-relative and no-follow on Bun, not failing closed. The host needs a
+  CPython 3 interpreter at `/usr/bin/python3`; `BunFileSystem.layerWith` names a
+  different one, and `BunHost` re-exports `AtomicFileSystem` for parity with
+  `NodeHost`.
+- `engines.bun` declares the supported Bun floor, `>=1.3.0`.
+
+### Changed
+
+- `BunHost.layerContained` and `BunHost.layerContainedAt` take
+  `BunHost.ContainedOptions`, which is `ContainedSpawner.Options` without
+  `platform`, plus `ProcessReaper.Options`. The spawner always gets the real
+  `process.platform`: a caller-supplied `"win32"` on a POSIX host used to win
+  the spread and record `pgid: null` for a child that genuinely leads a process
+  group, and `ProcessReaper.reap` retires such a record as `no-group` without
+  signalling anything, so the orphan outlived every incarnation. Both halves are
+  now read when the factory is called rather than when the layer is built, so
+  mutating the object afterwards cannot change what either layer was built with.
+- `BunHost.implementationIds` names `@smthrs/platform-node/AtomicFileSystem` for
+  the filesystem slot, which is the module actually behind it, and writes every
+  key as a literal so reordering `HostServiceIds` cannot mis-pair a slot with
+  another slot's implementation. No planner reads the record yet, so the change
+  invalidates no cached step.
+
+### Removed
+
+- `BunHttpTransport` is gone, and with it the dependency on
+  `@smthrs/platform-browser` that existed only to borrow a `fetch`-backed
+  transport. An outgoing request is Effect's `HttpClient`, and `BunHost.layer`
+  now provides `@effect/platform-bun`'s own `BunHttpClient.layer` with
+  `RequestInit { redirect: "manual" }`, so nothing follows a redirect behind
+  the capability kernel's back. `BunHost.implementationIds` names
+  `@effect/platform-bun/BunHttpClient` for the network slot.
+
+- `BunShell` is gone, and with it the hand-rolled runtime detection that chose
+  between `Bun.spawn` and `node:child_process`. `BunHost.layer` provides
+  `@effect/platform-bun`'s `ChildProcessSpawner`, which is
+  `@effect/platform-node-shared`'s implementation re-exported, the same code on
+  both runtimes, so there is nothing left to detect.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 William Cory and the Smithers Flows contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,111 @@
-# Temporary Holding Version
+# @smthrs/platform-bun
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Release candidate scope, host requirements and compatibility review are defined in the [library support policy](https://github.com/smithersai/smithers/blob/main/RELEASE_SUPPORT.md).
+
+This package declares `effect` as a `^4.0.4` peer dependency. Install one
+`effect` release in that range so all Smithers packages share one Effect
+runtime.
+
+**Documentation:** https://github.com/smithersai/smithers/tree/main/packages/smithers/flows/platform-bun/docs
+
+The Bun host bundle for Smithers, which runs long jobs as durable flows: each
+step is recorded, so a restart resumes what did not finish instead of starting
+over. `BunHost.layer` is a single Effect layer that fills the five services a
+program reaches the outside world through: the filesystem, path handling, child
+processes, version control, and HTTP.
+
+A program that calls `node:fs`, `Bun.spawn`, or a global `fetch` directly cannot
+be permission checked, denied, audited, or replayed, because nothing sits
+between it and the runtime. Smithers closes the outside world behind five Effect
+service tags instead, and a host bundle is the object that fills them. This
+package is that object for a process running on Bun.
+
+## Install
+
+```bash
+bun add @smthrs/platform-bun@1.0.0-rc.12 effect
+```
+
+`@smthrs/platform-node` and `effect` are required peers, as `package.json`
+declares them, with `effect` in the range `^4.0.4`. Package managers that
+resolve required peers install both automatically. `@effect/platform-bun`,
+`@effect/platform-node` and `@effect/platform-node-shared` are bundled
+privately, built from `effect@4.0.4`.
+
+The filesystem slot spawns the `smithers-jj-export` native helper, which
+`@smthrs/platform-node` ships for macOS, Linux, and Windows. To use another
+helper, set `SMITHERS_WORKSPACE_JJ_EXPORT_BINARY` to its absolute path, or
+build the layer with `BunFileSystem.layerWith({ executable })`. `PATH` is never
+searched. Windows is unsupported.
+
+## Example
+
+```ts
+import { BunHost } from "@smthrs/platform-bun"
+import { Effect } from "effect"
+import * as ChildProcess from "effect/process/ChildProcess"
+import { ChildProcessSpawner } from "effect/process/ChildProcessSpawner"
+
+const program = Effect.gen(function*() {
+  const spawner = yield* ChildProcessSpawner
+  return yield* spawner.string(ChildProcess.make("git", ["status", "--short"]))
+})
+
+Effect.runPromise(Effect.provide(program, BunHost.layer))
+```
+
+The program names Bun nowhere. It asks for a service tag, and the layer decides
+what fills it, so swapping `BunHost.layer` for `NodeHost.layer` from
+`@smthrs/platform-node` does not change a character of it.
+
+Every host bundle builds without jj. The `Jj` slot needs jj 0.39.0 or newer: its
+first operation runs one version probe and fails with `JjError` `not_installed`
+or `unsupported_version` when jj is missing or older. The version probe and
+repository commands use the selected process runner. Contained bundles record
+and retire the probe in the host process ledger. Probe results are cached per
+resolved absolute executable path and runner, with a separate cache for each
+spawner instance.
+
+## Modules
+
+| Module          | What it provides                                                                                                                                                                                                                                                                        |
+| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `BunHost`       | The closed Host bundle: `layer`, `layerAt`, `layerContained`, `layerContainedAt`, and the `BunHostError` those two root-bound factories throw; `layerHttpClient`, the network slot with redirects stopped; re-exports `AtomicFileSystem`, `BunChildProcessSpawner`, and `BunFileSystem` |
+| `BunFileSystem` | `@smthrs/platform-node`'s atomic `FileSystem`, plus `layerWith` for a host whose helper lives elsewhere                                                                                                                                                                                 |
+
+Three variants change one slot each. `BunHost.layerAt(root)` binds version
+control to one absolute repository root instead of the process working
+directory. `BunHost.layerContained(options)` prepares and records a supervisor
+before each target starts, then keeps its cleanup deadline after target exit.
+The private host connection also initiates group cleanup on host loss;
+unverified cleanup retains its `ProcessLedger` record for restart
+reconciliation. `BunHost.layerContainedAt` combines both variants. On POSIX,
+handle `pid` names the supervisor while status describes the target; use
+`handle.kill` to stop it. See the [containment guide](./docs/guides/contain-child-processes.md)
+for detached commands, escaped sessions, and unsupported-platform limits.
+
+Two properties are worth knowing before you compose the five slots by hand. The
+filesystem slot carries `@smthrs/platform-node`'s `AtomicFileSystem`, so under
+`@smthrs/kernel`'s guard an authorized path operation runs against file
+descriptors and refuses to follow a link: a symlink swapped in after
+authorization cannot redirect the write. And the HTTP slot is Effect's
+shared egress client without automatic redirects, so a
+`302` comes back to you as a `302` and the second origin is never contacted.
+
+## Runtimes
+
+Bun >=1.4.0 and Node.js >=26.4.0. The raw bundle's child-process spawner is
+Effect's Node spawner re-exported. Contained POSIX bundles use the prepared
+native adapter from `@smthrs/platform-node/ProcessReaper`. The bundle falls back to the
+`@effect/platform-node` adapters off Bun and so resolves `node:` built-ins,
+which is what stops it bundling for a browser. A page composes
+`@smthrs/platform-browser` instead.
+
+The host exports `implementationIds` for its five raw bundle service slots;
+contained factories replace the process runner. Its rooted
+factories reject invalid roots before constructing a layer, using the host's
+own error with code `invalid_repository_root`.
+
+BunHost includes BunCrypto in every bundle, so ArtifactStore.put composes
+with BunHost alone. Crypto remains separate from the five capability slots.
+BunHost also re-exports ProcessReaper and HostLiveness from platform-node.

package/dist/cjs/BunFileSystem.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Bun layer for Effect's `FileSystem` service.
+ *
+ * This is `@smthrs/platform-node`'s `AtomicFileSystem.layer`, the same
+ * implementation the Node bundle puts in its filesystem slot. It carries the
+ * kernel's atomic host extension, so `@smthrs/kernel`'s `FileSystem.layer`
+ * performs every guarded path operation descriptor-relative and no-follow
+ * instead of failing closed.
+ *
+ * The extension uses the packaged `smithers-jj-export --atomic-fs` helper.
+ * `layerWith` accepts another absolute executable path. Windows is unsupported.
+ *
+ * @since 1.0.0-rc.0
+ */
+import * as AtomicFileSystem from "@smthrs/platform-node/AtomicFileSystem";
+import type { FileSystem } from "effect/FileSystem";
+import type * as Layer from "effect/Layer";
+/**
+ * Provides Bun's filesystem implementation, carrying the kernel's atomic host
+ * extension.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ * @slop
+ */
+export declare const layer: Layer.Layer<FileSystem>;
+/**
+ * Provides the same filesystem against an explicitly configured helper and
+ * set of byte limits.
+ *
+ * This is the escape hatch for a host with a different packaged helper path.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export declare const layerWith: (options: AtomicFileSystem.Options) => Layer.Layer<FileSystem>;
+/**
+ * The helper path and byte limits {@link layerWith} accepts.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type Options = AtomicFileSystem.Options;
+//# sourceMappingURL=BunFileSystem.d.ts.map

package/dist/cjs/BunFileSystem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BunFileSystem.d.ts","sourceRoot":"","sources":["../../src/BunFileSystem.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,gBAAgB,MAAM,wCAAwC,CAAA;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAA;AAE1C;;;;;;;GAOG;AACH,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAA0B,CAAA;AAEpE;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,EAAE,CAAC,OAAO,EAAE,gBAAgB,CAAC,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAA8B,CAAA;AAEnH;;;;;GAKG;AACH,MAAM,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAA"}

package/dist/cjs/BunFileSystem.js

@@ -0,0 +1,38 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var BunFileSystem_exports = {};
+__export(BunFileSystem_exports, {
+  layer: () => layer,
+  layerWith: () => layerWith
+});
+module.exports = __toCommonJS(BunFileSystem_exports);
+var AtomicFileSystem = __toESM(require("@smthrs/platform-node/AtomicFileSystem"), 1);
+const layer = AtomicFileSystem.layer;
+const layerWith = AtomicFileSystem.layerWith;
+//# sourceMappingURL=BunFileSystem.js.map

package/dist/cjs/BunFileSystem.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/BunFileSystem.ts"],
+  "sourcesContent": ["/**\n * Bun layer for Effect's `FileSystem` service.\n *\n * This is `@smthrs/platform-node`'s `AtomicFileSystem.layer`, the same\n * implementation the Node bundle puts in its filesystem slot. It carries the\n * kernel's atomic host extension, so `@smthrs/kernel`'s `FileSystem.layer`\n * performs every guarded path operation descriptor-relative and no-follow\n * instead of failing closed.\n *\n * The extension uses the packaged `smithers-jj-export --atomic-fs` helper.\n * `layerWith` accepts another absolute executable path. Windows is unsupported.\n *\n * @since 1.0.0-rc.0\n */\n\nimport * as AtomicFileSystem from \"@smthrs/platform-node/AtomicFileSystem\"\nimport type { FileSystem } from \"effect/FileSystem\"\nimport type * as Layer from \"effect/Layer\"\n\n/**\n * Provides Bun's filesystem implementation, carrying the kernel's atomic host\n * extension.\n *\n * @category layers\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const layer: Layer.Layer<FileSystem> = AtomicFileSystem.layer\n\n/**\n * Provides the same filesystem against an explicitly configured helper and\n * set of byte limits.\n *\n * This is the escape hatch for a host with a different packaged helper path.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerWith: (options: AtomicFileSystem.Options) => Layer.Layer<FileSystem> = AtomicFileSystem.layerWith\n\n/**\n * The helper path and byte limits {@link layerWith} accepts.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type Options = AtomicFileSystem.Options\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeA,uBAAkC;AAY3B,MAAM,QAAiC,iBAAiB;AAWxD,MAAM,YAA4E,iBAAiB;",
+  "names": []
+}

package/dist/cjs/BunHost.d.ts

@@ -0,0 +1,205 @@
+/**
+ * Aggregate Bun Host bundle.
+ *
+ * Runtime-specific dependencies stay inside this package; callers get the same
+ * closed five-service Host surface every other bundle provides, plus native
+ * `ProcessConfinement` for guarded commands.
+ *
+ * There is no Bun shell module: running a command is Effect's
+ * `ChildProcessSpawner`, and `@effect/platform-bun`'s implementation is
+ * `@effect/platform-node-shared`'s re-exported: the same code on both
+ * runtimes, so no runtime detection is needed here.
+ *
+ * Outgoing HTTP uses the shared EgressHttpClient on both runtimes. Web
+ * requests pin approved addresses; ordinary requests retain the shared pool.
+ * Redirects remain visible to the capability kernel, and proxy routing follows
+ * the host environment.
+ *
+ * The filesystem slot is `@smthrs/platform-node`'s `AtomicFileSystem`, byte for
+ * byte the layer `NodeHost` uses, so a guarded path operation is
+ * descriptor-relative and no-follow on both runtimes.
+ *
+ * @since 1.0.0-rc.0
+ */
+import * as BunChildProcessSpawner from "../vendor/cjs/bun/BunChildProcessSpawner.js";
+import * as BunCrypto from "../vendor/cjs/bun/BunCrypto.js";
+import type { Jj } from "@smthrs/jj";
+import type { HostServiceIds } from "@smthrs/kernel/HostServices";
+import type * as KernelProcessConfinement from "@smthrs/kernel/ProcessConfinement";
+import type * as ProcessLedger from "@smthrs/kernel/ProcessLedger";
+import * as AtomicFileSystem from "@smthrs/platform-node/AtomicFileSystem";
+import * as HostLiveness from "@smthrs/platform-node/HostLiveness";
+import * as ProcessReaper from "@smthrs/platform-node/ProcessReaper";
+import type * as Crypto from "effect/Crypto";
+import type { FileSystem } from "effect/FileSystem";
+import type { HttpClient } from "effect/http/HttpClient";
+import * as Layer from "effect/Layer";
+import type * as Path from "effect/Path";
+import type { ChildProcessSpawner } from "effect/process/ChildProcessSpawner";
+import * as Schema from "effect/Schema";
+import * as BunFileSystem from "./BunFileSystem.ts";
+/**
+ * Bun platform modules for selectively providing individual services.
+ *
+ * `AtomicFileSystem` is here for the same reason `NodeHost` re-exports it: it
+ * owns the only configuration escape hatch the filesystem slot has, and a Bun
+ * program with a different packaged helper path needs to reach
+ * `AtomicFileSystem.layerWith` without hand-composing the other four tags.
+ *
+ * `BunJj` is deliberately absent: it belongs to `@smthrs/jj` and is imported
+ * from there, never re-exported here. So is `@effect/platform-bun/BunHttpClient`:
+ * its `layer` follows redirects to origins the capability kernel never
+ * authorized. The network slot on its own is {@link layerHttpClient}.
+ *
+ * @category re-exports
+ * @since 1.0.0-rc.0
+ * @slop
+ */
+export { AtomicFileSystem, BunChildProcessSpawner, BunCrypto, BunFileSystem, HostLiveness, ProcessReaper };
+/**
+ * The complete closed Host service union provided by Bun.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ * @slop
+ */
+export type BunHost = FileSystem | Path.Path | ChildProcessSpawner | Jj | HttpClient | KernelProcessConfinement.ProcessConfinement;
+/**
+ * The stable codes a `BunHost` factory refuses with.
+ *
+ * A code is the contract a caller branches on; the message beside it is for a
+ * person. `invalid_repository_root` is the root handed to {@link layerAt} or
+ * {@link layerContainedAt} not being absolute or containing NUL, the empty
+ * string included.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type BunHostErrorCode = "invalid_repository_root";
+declare const BunHostError_base: Schema.Class<BunHostError, Schema.TaggedStruct<"@smthrs/platform-bun/BunHostError", {
+    readonly code: Schema.Literal<"invalid_repository_root">;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The refusal a `BunHost` factory throws before it builds a layer.
+ *
+ * It is thrown rather than failed because a factory is called while a program
+ * composes its layers, where there is no fiber to fail yet and a wrong root is
+ * a composition mistake, not a runtime outcome. It is this package's class,
+ * not the `Jj` adapter's, because a Bun caller composes `BunHost` and should
+ * learn nothing about the adapter behind the `Jj` slot from an error message.
+ *
+ * @category errors
+ * @since 1.0.0-rc.0
+ */
+export declare class BunHostError extends BunHostError_base {
+    readonly name = "BunHostError";
+}
+/**
+ * Stable implementation identities keyed by the closed Host service slots.
+ *
+ * Each value names the module behind that slot in the raw host bundle.
+ * Contained POSIX factories replace the spawner with {@link ProcessReaper.layerSpawner}.
+ * These are identity
+ * tokens rather than import specifiers: the filesystem entry is
+ * `@smthrs/platform-node/AtomicFileSystem` because that is the implementation,
+ * even though a consumer reaches it through `@smthrs/platform-bun`.
+ *
+ * Nothing digests them yet. `@smthrs/plan`'s step key carries a `layers`
+ * component these values are meant to feed, but no planner derives it from a
+ * host bundle today, so changing one invalidates no cached step.
+ *
+ * The keys are written as literals rather than `HostServiceIds` positions so
+ * that reordering the closed list cannot silently pair a slot with another
+ * slot's implementation.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ * @slop
+ */
+export declare const implementationIds: Readonly<Record<(typeof HostServiceIds)[number], string>>;
+/**
+ * What a caller may configure about containment.
+ *
+ * `ContainedSpawner.Options.platform` is deliberately not part of it. It
+ * decides one thing, whether a command that names no `detached` option gets a
+ * process group of its own, and this native host detaches by `process.platform`
+ * whatever a record claims. A
+ * caller-supplied `"win32"` on a POSIX host would therefore record
+ * `pgid: null` for a child that really does lead a group, and
+ * {@link ProcessReaper.reap} would retire that record as `no-group` and leave
+ * the orphan running forever: a durable lie rather than a compile error.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type ContainedOptions = ProcessReaper.SpawnerOptions & ProcessReaper.Options;
+/**
+ * The network slot on its own: the shared egress client, which never follows a
+ * redirect. A `3xx` comes back to the caller with its `location` intact and the
+ * second origin uncontacted; following a redirect is `@smthrs/kernel`'s guarded
+ * `HttpClient.layer`, which rechecks every hop.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export declare const layerHttpClient: Layer.Layer<HttpClient>;
+/**
+ * Provides all five Bun Host services, including the runtime-independent Path
+ * service.
+ *
+ * Builds on a host without jj. The `Jj` slot probes `jj --version` on its
+ * first operation and fails that operation with `JjError` carrying
+ * `not_installed` or `unsupported_version`; a program that never calls `Jj`
+ * runs without jj. `Jj` requires jj 0.39.0 or later.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ * @slop
+ */
+export declare const layer: Layer.Layer<BunHost | Crypto.Crypto>;
+/**
+ * Provides all five Bun Host services bound to one absolute repository root.
+ *
+ * Throws {@link BunHostError} with code `invalid_repository_root` when `root`
+ * is not absolute or contains NUL; the empty string counts. The check runs
+ * when the factory is called, before any layer exists.
+ *
+ * Builds without jj exactly as {@link layer} does: the `Jj` slot probes
+ * `jj --version` on its first operation.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export declare const layerAt: (root: string) => Layer.Layer<BunHost | Crypto.Crypto>;
+/**
+ * Provides the Bun host with process containment turned on.
+ *
+ * Bun uses the same prepared native process lifecycle as Node on POSIX, while
+ * preserving its underlying runtime spawner on Windows. `ContainedSpawner` gives
+ * every child an escalation deadline and a ledger entry, and
+ * `ProcessReaper` sweeps the entries a crashed incarnation of this host left
+ * behind. The reaper module lives in `@smthrs/platform-node` because the calls
+ * it makes, `process.kill` and `taskkill`, are Node's, and Bun implements
+ * them unchanged.
+ *
+ * Builds without jj exactly as {@link layer} does; here the first
+ * operation's `jj --version` probe runs through the contained spawner, so its
+ * record enters and leaves the ledger like any other child.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export declare const layerContained: (options?: ContainedOptions) => Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger>;
+/**
+ * Provides the contained Bun host bound to one absolute repository root.
+ *
+ * Refuses a root exactly as {@link layerAt} does: {@link BunHostError} with
+ * code `invalid_repository_root`, thrown when the factory is called.
+ * Builds without jj exactly as {@link layerContained} does.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export declare const layerContainedAt: (root: string, options?: ContainedOptions) => Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger>;
+//# sourceMappingURL=BunHost.d.ts.map

package/dist/cjs/BunHost.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BunHost.d.ts","sourceRoot":"","sources":["../../src/BunHost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,sBAAsB,MAAM,6CAA6C,CAAA;AACrF,OAAO,KAAK,SAAS,MAAM,gCAAgC,CAAA;AAE3D,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,YAAY,CAAA;AAEpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,KAAK,KAAK,wBAAwB,MAAM,mCAAmC,CAAA;AAClF,OAAO,KAAK,KAAK,aAAa,MAAM,8BAA8B,CAAA;AAClE,OAAO,KAAK,gBAAgB,MAAM,wCAAwC,CAAA;AAE1E,OAAO,KAAK,YAAY,MAAM,oCAAoC,CAAA;AAElE,OAAO,KAAK,aAAa,MAAM,qCAAqC,CAAA;AACpE,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,KAAK,IAAI,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAC7E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,CAAA;AAE1G;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,GACf,UAAU,GACV,IAAI,CAAC,IAAI,GACT,mBAAmB,GACnB,EAAE,GACF,UAAU,GACV,wBAAwB,CAAC,kBAAkB,CAAA;AAE/C;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GAAG,yBAAyB,CAAA;;;;;AAExD;;;;;;;;;;;GAWG;AACH,qBAAa,YAAa,SAAQ,iBAGhC;IACA,SAAkB,IAAI,kBAAiB;CACxC;AA4DD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAMvF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC,cAAc,GAAG,aAAa,CAAC,OAAO,CAAA;AAWnF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAuC,CAAA;AAE3F;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAMtD,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,MAAM,KAAG,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CASzE,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,GACzB,UAAU,gBAAgB,KACzB,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,aAAa,CAczE,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAC3B,MAAM,MAAM,EACZ,UAAU,gBAAgB,KACzB,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,aAAa,CAYzE,CAAA"}

package/dist/cjs/BunHost.js

@@ -0,0 +1,148 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var BunHost_exports = {};
+__export(BunHost_exports, {
+  AtomicFileSystem: () => AtomicFileSystem,
+  BunChildProcessSpawner: () => BunChildProcessSpawner,
+  BunCrypto: () => BunCrypto,
+  BunFileSystem: () => BunFileSystem,
+  BunHostError: () => BunHostError,
+  HostLiveness: () => HostLiveness,
+  ProcessReaper: () => ProcessReaper,
+  implementationIds: () => implementationIds,
+  layer: () => layer,
+  layerAt: () => layerAt,
+  layerContained: () => layerContained,
+  layerContainedAt: () => layerContainedAt,
+  layerHttpClient: () => layerHttpClient
+});
+module.exports = __toCommonJS(BunHost_exports);
+var BunChildProcessSpawner = __toESM(require("../vendor/cjs/bun/BunChildProcessSpawner.js"), 1);
+var BunCrypto = __toESM(require("../vendor/cjs/bun/BunCrypto.js"), 1);
+var BunPath = __toESM(require("../vendor/cjs/bun/BunPath.js"), 1);
+var BunJj = __toESM(require("@smthrs/jj/bun/BunJj"), 1);
+var AtomicFileSystem = __toESM(require("@smthrs/platform-node/AtomicFileSystem"), 1);
+var EgressHttpClient = __toESM(require("@smthrs/platform-node/EgressHttpClient"), 1);
+var HostLiveness = __toESM(require("@smthrs/platform-node/HostLiveness"), 1);
+var ProcessConfinement = __toESM(require("@smthrs/platform-node/ProcessConfinement"), 1);
+var ProcessReaper = __toESM(require("@smthrs/platform-node/ProcessReaper"), 1);
+var Layer = __toESM(require("effect/Layer"), 1);
+var Schema = __toESM(require("effect/Schema"), 1);
+var import_node_path = require("node:path");
+var BunFileSystem = __toESM(require("./BunFileSystem.js"), 1);
+class BunHostError extends Schema.TaggedError()("@smthrs/platform-bun/BunHostError", {
+  code: Schema.Literal("invalid_repository_root"),
+  message: Schema.String
+}) {
+  name = "BunHostError";
+}
+const messageLimit = 255;
+const previewLimit = 64;
+const preview = (root, budget) => {
+  const points = Array.from(root);
+  const whole = JSON.stringify(root);
+  if (points.length <= previewLimit && whole.length <= budget) return whole;
+  const suffix = `... (${points.length} characters)`;
+  const room = budget - suffix.length - 2;
+  let excerpt = "";
+  for (const point of points.slice(0, previewLimit)) {
+    const encoded = JSON.stringify(point).slice(1, -1);
+    if (excerpt.length + encoded.length > room) break;
+    excerpt += encoded;
+  }
+  return `"${excerpt}"${suffix}`;
+};
+const absoluteRoot = (factory, root) => {
+  const requirement = !(0, import_node_path.isAbsolute)(root) ? "an absolute repository root" : root.includes("\0") ? "a repository root without NUL" : void 0;
+  if (requirement === void 0) return root;
+  const prefix = `BunHost.${factory} requires ${requirement}, got `;
+  throw new BunHostError({
+    code: "invalid_repository_root",
+    message: `${prefix}${preview(root, messageLimit - prefix.length)}`
+  });
+};
+const implementationIds = {
+  "effect/FileSystem": "@smthrs/platform-node/AtomicFileSystem",
+  "effect/Path": "@effect/platform-bun/BunPath",
+  "effect/process/ChildProcessSpawner": "@effect/platform-bun/BunChildProcessSpawner",
+  "@smthrs/jj/Jj": "@smthrs/jj/bun/BunJj",
+  "effect/HttpClient": "@smthrs/platform-node/EgressHttpClient"
+};
+const reaping = (options) => ({
+  ownerPid: options?.ownerPid,
+  system: options?.system
+});
+const platform = Layer.mergeAll(BunFileSystem.layer, BunPath.layer, BunCrypto.layer);
+const layerHttpClient = EgressHttpClient.layer(process.env);
+const layer = Layer.mergeAll(
+  ProcessConfinement.layer(),
+  platform,
+  Layer.provide(BunChildProcessSpawner.layer, platform),
+  BunJj.layer,
+  layerHttpClient
+);
+const layerAt = (root) => {
+  const repositoryRoot = absoluteRoot("layerAt", root);
+  return Layer.mergeAll(
+    ProcessConfinement.layer(),
+    platform,
+    Layer.provide(BunChildProcessSpawner.layer, platform),
+    BunJj.layerAt(repositoryRoot),
+    layerHttpClient
+  );
+};
+const layerContained = (options) => {
+  const spawner = Layer.provide(
+    ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),
+    Layer.provide(BunChildProcessSpawner.layer, platform)
+  );
+  return Layer.mergeAll(
+    ProcessConfinement.layer(),
+    platform,
+    layerHttpClient,
+    // jj goes through the CONTAINED spawner here, not around it, exactly as in
+    // `NodeHost.layerContained`: a jj child that starts its own process leads
+    // no recorded group, is in no ledger, and outlives the host that ran it.
+    Layer.provideMerge(BunJj.layerSpawner, spawner)
+  ).pipe(Layer.provideMerge(ProcessReaper.layer(reaping(options))));
+};
+const layerContainedAt = (root, options) => {
+  const repositoryRoot = absoluteRoot("layerContainedAt", root);
+  const spawner = Layer.provide(
+    ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),
+    Layer.provide(BunChildProcessSpawner.layer, platform)
+  );
+  return Layer.mergeAll(
+    ProcessConfinement.layer(),
+    platform,
+    layerHttpClient,
+    Layer.provideMerge(BunJj.layerSpawnerAt(repositoryRoot), spawner)
+  ).pipe(Layer.provideMerge(ProcessReaper.layer(reaping(options))));
+};
+//# sourceMappingURL=BunHost.js.map