@smthrs/platform-bun 1.0.0-rc.7 → 1.0.0-rc.9

package/README.md

@@ -22,7 +22,9 @@ package is that object for a process running on Bun.
 
 ## Install
 
-Not on npm yet; see [Installation](https://github.com/smithersai/smithers/blob/main/packages/smithers/flows/flow/docs/installation.md#use-the-libraries).
+```bash
+bun add @smthrs/platform-bun@1.0.0-rc.9 effect
+```
 
 `@smthrs/platform-node` and `effect` are required peers, as `package.json`
 declares them, with `effect` in the range `^4.0.4`. Package managers that
@@ -30,14 +32,9 @@ resolve required peers install both automatically. `@effect/platform-bun`,
 `@effect/platform-node` and `@effect/platform-node-shared` are bundled
 privately, built from `effect@4.0.4`.
 
-The filesystem slot spawns the `smithers-jj-export` native helper. From a
-source checkout, build it with:
-
-```sh
-cargo build --locked --release -p smithers-ffi --bin smithers-jj-export
-```
-
-Elsewhere, set `SMITHERS_WORKSPACE_JJ_EXPORT_BINARY` to its absolute path, or
+The filesystem slot spawns the `smithers-jj-export` native helper, which
+`@smthrs/platform-node` ships for macOS, Linux, and Windows. To use another
+helper, set `SMITHERS_WORKSPACE_JJ_EXPORT_BINARY` to its absolute path, or
 build the layer with `BunFileSystem.layerWith({ executable })`. `PATH` is never
 searched. Windows is unsupported.
 
@@ -61,12 +58,13 @@ The program names Bun nowhere. It asks for a service tag, and the layer decides
 what fills it, so swapping `BunHost.layer` for `NodeHost.layer` from
 `@smthrs/platform-node` does not change a character of it.
 
-The complete host bundles require jj 0.39.0 or newer. Each bundle builds its jj
-layer with one version probe; construction can fail with `JjError`, including
-`not_installed` or `unsupported_version`. The version probe and repository commands use the
-selected process runner. Contained bundles record and retire the probe in the
-host process ledger. Probe results are cached per resolved absolute executable
-path and runner, with a separate cache for each spawner instance.
+Every host bundle builds without jj. The `Jj` slot needs jj 0.39.0 or newer: its
+first operation runs one version probe and fails with `JjError` `not_installed`
+or `unsupported_version` when jj is missing or older. The version probe and
+repository commands use the selected process runner. Contained bundles record
+and retire the probe in the host process ledger. Probe results are cached per
+resolved absolute executable path and runner, with a separate cache for each
+spawner instance.
 
 ## Modules
 

package/dist/cjs/BunHost.d.ts

@@ -23,7 +23,7 @@
  */
 import * as BunChildProcessSpawner from "../vendor/cjs/bun/BunChildProcessSpawner.js";
 import * as BunCrypto from "../vendor/cjs/bun/BunCrypto.js";
-import type { Jj, JjError } from "@smthrs/jj";
+import type { Jj } from "@smthrs/jj";
 import type { HostServiceIds } from "@smthrs/kernel/HostServices";
 import type * as KernelProcessConfinement from "@smthrs/kernel/ProcessConfinement";
 import type * as ProcessLedger from "@smthrs/kernel/ProcessLedger";
@@ -69,7 +69,8 @@ export type BunHost = FileSystem | Path.Path | ChildProcessSpawner | Jj | HttpCl
  *
  * A code is the contract a caller branches on; the message beside it is for a
  * person. `invalid_repository_root` is the root handed to {@link layerAt} or
- * {@link layerContainedAt} not being absolute, the empty string included.
+ * {@link layerContainedAt} not being absolute or containing NUL, the empty
+ * string included.
  *
  * @category models
  * @since 1.0.0-rc.0
@@ -147,30 +148,30 @@ export declare const layerHttpClient: Layer.Layer<HttpClient>;
  * Provides all five Bun Host services, including the runtime-independent Path
  * service.
  *
- * Fails at construction with {@link JjError} carrying `not_installed` or
- * `unsupported_version`: the `Jj` slot is merged eagerly and probes
- * `jj --version` while the layer is built, before the program body runs and
- * whether or not the program asks for `Jj`. Requires jj 0.39.0 or later.
+ * Builds on a host without jj. The `Jj` slot probes `jj --version` on its
+ * first operation and fails that operation with `JjError` carrying
+ * `not_installed` or `unsupported_version`; a program that never calls `Jj`
+ * runs without jj. `Jj` requires jj 0.39.0 or later.
  *
  * @category layers
  * @since 1.0.0-rc.0
  * @slop
  */
-export declare const layer: Layer.Layer<BunHost | Crypto.Crypto, JjError>;
+export declare const layer: Layer.Layer<BunHost | Crypto.Crypto>;
 /**
  * Provides all five Bun Host services bound to one absolute repository root.
  *
  * Throws {@link BunHostError} with code `invalid_repository_root` when `root`
- * is not absolute; the empty string counts. The check runs when the factory is
- * called, before any layer exists.
+ * is not absolute or contains NUL; the empty string counts. The check runs
+ * when the factory is called, before any layer exists.
  *
- * Fails at construction with {@link JjError} exactly as {@link layer} does:
- * the `Jj` slot probes `jj --version` while the layer is built.
+ * Builds without jj exactly as {@link layer} does: the `Jj` slot probes
+ * `jj --version` on its first operation.
  *
  * @category layers
  * @since 1.0.0-rc.0
  */
-export declare const layerAt: (root: string) => Layer.Layer<BunHost | Crypto.Crypto, JjError>;
+export declare const layerAt: (root: string) => Layer.Layer<BunHost | Crypto.Crypto>;
 /**
  * Provides the Bun host with process containment turned on.
  *
@@ -182,24 +183,23 @@ export declare const layerAt: (root: string) => Layer.Layer<BunHost | Crypto.Cry
  * it makes, `process.kill` and `taskkill`, are Node's, and Bun implements
  * them unchanged.
  *
- * Fails at construction with {@link JjError} exactly as {@link layer} does;
- * here the `jj --version` probe runs through the contained spawner, so its
+ * Builds without jj exactly as {@link layer} does; here the first
+ * operation's `jj --version` probe runs through the contained spawner, so its
  * record enters and leaves the ledger like any other child.
  *
  * @category layers
  * @since 1.0.0-rc.0
  */
-export declare const layerContained: (options?: ContainedOptions) => Layer.Layer<BunHost | Crypto.Crypto, JjError, ProcessLedger.ProcessLedger>;
+export declare const layerContained: (options?: ContainedOptions) => Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger>;
 /**
  * Provides the contained Bun host bound to one absolute repository root.
  *
  * Refuses a root exactly as {@link layerAt} does: {@link BunHostError} with
  * code `invalid_repository_root`, thrown when the factory is called.
- * Fails at construction with {@link JjError} exactly as {@link layerContained}
- * does.
+ * Builds without jj exactly as {@link layerContained} does.
  *
  * @category layers
  * @since 1.0.0-rc.0
  */
-export declare const layerContainedAt: (root: string, options?: ContainedOptions) => Layer.Layer<BunHost | Crypto.Crypto, JjError, ProcessLedger.ProcessLedger>;
+export declare const layerContainedAt: (root: string, options?: ContainedOptions) => Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger>;
 //# sourceMappingURL=BunHost.d.ts.map

package/dist/cjs/BunHost.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BunHost.d.ts","sourceRoot":"","sources":["../../src/BunHost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,sBAAsB,MAAM,6CAA6C,CAAA;AACrF,OAAO,KAAK,SAAS,MAAM,gCAAgC,CAAA;AAE3D,OAAO,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAE7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,KAAK,KAAK,wBAAwB,MAAM,mCAAmC,CAAA;AAClF,OAAO,KAAK,KAAK,aAAa,MAAM,8BAA8B,CAAA;AAClE,OAAO,KAAK,gBAAgB,MAAM,wCAAwC,CAAA;AAE1E,OAAO,KAAK,YAAY,MAAM,oCAAoC,CAAA;AAElE,OAAO,KAAK,aAAa,MAAM,qCAAqC,CAAA;AACpE,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,KAAK,IAAI,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAC7E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,CAAA;AAE1G;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,GACf,UAAU,GACV,IAAI,CAAC,IAAI,GACT,mBAAmB,GACnB,EAAE,GACF,UAAU,GACV,wBAAwB,CAAC,kBAAkB,CAAA;AAE/C;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG,yBAAyB,CAAA;;;;;AAExD;;;;;;;;;;;GAWG;AACH,qBAAa,YAAa,SAAQ,iBAGhC;IACA,SAAkB,IAAI,kBAAiB;CACxC;AAqDD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAMvF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC,cAAc,GAAG,aAAa,CAAC,OAAO,CAAA;AAWnF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAuC,CAAA;AAE3F;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAM/D,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,MAAM,KAAG,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CASlF,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,GACzB,UAAU,gBAAgB,KACzB,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,aAAa,CAc3E,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,GAC3B,MAAM,MAAM,EACZ,UAAU,gBAAgB,KACzB,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,aAAa,CAY3E,CAAA"}
+{"version":3,"file":"BunHost.d.ts","sourceRoot":"","sources":["../../src/BunHost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,sBAAsB,MAAM,6CAA6C,CAAA;AACrF,OAAO,KAAK,SAAS,MAAM,gCAAgC,CAAA;AAE3D,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,YAAY,CAAA;AAEpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,KAAK,KAAK,wBAAwB,MAAM,mCAAmC,CAAA;AAClF,OAAO,KAAK,KAAK,aAAa,MAAM,8BAA8B,CAAA;AAClE,OAAO,KAAK,gBAAgB,MAAM,wCAAwC,CAAA;AAE1E,OAAO,KAAK,YAAY,MAAM,oCAAoC,CAAA;AAElE,OAAO,KAAK,aAAa,MAAM,qCAAqC,CAAA;AACpE,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,KAAK,IAAI,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAC7E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,CAAA;AAE1G;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,GACf,UAAU,GACV,IAAI,CAAC,IAAI,GACT,mBAAmB,GACnB,EAAE,GACF,UAAU,GACV,wBAAwB,CAAC,kBAAkB,CAAA;AAE/C;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GAAG,yBAAyB,CAAA;;;;;AAExD;;;;;;;;;;;GAWG;AACH,qBAAa,YAAa,SAAQ,iBAGhC;IACA,SAAkB,IAAI,kBAAiB;CACxC;AA4DD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAMvF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC,cAAc,GAAG,aAAa,CAAC,OAAO,CAAA;AAWnF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAuC,CAAA;AAE3F;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAMtD,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,MAAM,KAAG,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CASzE,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,GACzB,UAAU,gBAAgB,KACzB,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,aAAa,CAczE,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAC3B,MAAM,MAAM,EACZ,UAAU,gBAAgB,KACzB,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,aAAa,CAYzE,CAAA"}

package/dist/cjs/BunHost.js

@@ -79,8 +79,9 @@ const preview = (root, budget) => {
   return `"${excerpt}"${suffix}`;
 };
 const absoluteRoot = (factory, root) => {
-  if ((0, import_node_path.isAbsolute)(root)) return root;
-  const prefix = `BunHost.${factory} requires an absolute repository root, got `;
+  const requirement = !(0, import_node_path.isAbsolute)(root) ? "an absolute repository root" : root.includes("\0") ? "a repository root without NUL" : void 0;
+  if (requirement === void 0) return root;
+  const prefix = `BunHost.${factory} requires ${requirement}, got `;
   throw new BunHostError({
     code: "invalid_repository_root",
     message: `${prefix}${preview(root, messageLimit - prefix.length)}`

package/dist/cjs/BunHost.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/BunHost.ts"],
-  "sourcesContent": ["/**\n * Aggregate Bun Host bundle.\n *\n * Runtime-specific dependencies stay inside this package; callers get the same\n * closed five-service Host surface every other bundle provides, plus native\n * `ProcessConfinement` for guarded commands.\n *\n * There is no Bun shell module: running a command is Effect's\n * `ChildProcessSpawner`, and `@effect/platform-bun`'s implementation is\n * `@effect/platform-node-shared`'s re-exported: the same code on both\n * runtimes, so no runtime detection is needed here.\n *\n * Outgoing HTTP uses the shared EgressHttpClient on both runtimes. Web\n * requests pin approved addresses; ordinary requests retain the shared pool.\n * Redirects remain visible to the capability kernel, and proxy routing follows\n * the host environment.\n *\n * The filesystem slot is `@smthrs/platform-node`'s `AtomicFileSystem`, byte for\n * byte the layer `NodeHost` uses, so a guarded path operation is\n * descriptor-relative and no-follow on both runtimes.\n *\n * @since 1.0.0-rc.0\n */\n\nimport * as BunChildProcessSpawner from \"@effect/platform-bun/BunChildProcessSpawner\"\nimport * as BunCrypto from \"@effect/platform-bun/BunCrypto\"\nimport * as BunPath from \"@effect/platform-bun/BunPath\"\nimport type { Jj, JjError } from \"@smthrs/jj\"\nimport * as BunJj from \"@smthrs/jj/bun/BunJj\"\nimport type { HostServiceIds } from \"@smthrs/kernel/HostServices\"\nimport type * as KernelProcessConfinement from \"@smthrs/kernel/ProcessConfinement\"\nimport type * as ProcessLedger from \"@smthrs/kernel/ProcessLedger\"\nimport * as AtomicFileSystem from \"@smthrs/platform-node/AtomicFileSystem\"\nimport * as EgressHttpClient from \"@smthrs/platform-node/EgressHttpClient\"\nimport * as HostLiveness from \"@smthrs/platform-node/HostLiveness\"\nimport * as ProcessConfinement from \"@smthrs/platform-node/ProcessConfinement\"\nimport * as ProcessReaper from \"@smthrs/platform-node/ProcessReaper\"\nimport type * as Crypto from \"effect/Crypto\"\nimport type { FileSystem } from \"effect/FileSystem\"\nimport type { HttpClient } from \"effect/http/HttpClient\"\nimport * as Layer from \"effect/Layer\"\nimport type * as Path from \"effect/Path\"\nimport type { ChildProcessSpawner } from \"effect/process/ChildProcessSpawner\"\nimport * as Schema from \"effect/Schema\"\nimport { isAbsolute } from \"node:path\"\nimport * as BunFileSystem from \"./BunFileSystem.ts\"\n\n/**\n * Bun platform modules for selectively providing individual services.\n *\n * `AtomicFileSystem` is here for the same reason `NodeHost` re-exports it: it\n * owns the only configuration escape hatch the filesystem slot has, and a Bun\n * program with a different packaged helper path needs to reach\n * `AtomicFileSystem.layerWith` without hand-composing the other four tags.\n *\n * `BunJj` is deliberately absent: it belongs to `@smthrs/jj` and is imported\n * from there, never re-exported here. So is `@effect/platform-bun/BunHttpClient`:\n * its `layer` follows redirects to origins the capability kernel never\n * authorized. The network slot on its own is {@link layerHttpClient}.\n *\n * @category re-exports\n * @since 1.0.0-rc.0\n * @slop\n */\nexport { AtomicFileSystem, BunChildProcessSpawner, BunCrypto, BunFileSystem, HostLiveness, ProcessReaper }\n\n/**\n * The complete closed Host service union provided by Bun.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport type BunHost =\n  | FileSystem\n  | Path.Path\n  | ChildProcessSpawner\n  | Jj\n  | HttpClient\n  | KernelProcessConfinement.ProcessConfinement\n\n/**\n * The stable codes a `BunHost` factory refuses with.\n *\n * A code is the contract a caller branches on; the message beside it is for a\n * person. `invalid_repository_root` is the root handed to {@link layerAt} or\n * {@link layerContainedAt} not being absolute, the empty string included.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type BunHostErrorCode = \"invalid_repository_root\"\n\n/**\n * The refusal a `BunHost` factory throws before it builds a layer.\n *\n * It is thrown rather than failed because a factory is called while a program\n * composes its layers, where there is no fiber to fail yet and a wrong root is\n * a composition mistake, not a runtime outcome. It is this package's class,\n * not the `Jj` adapter's, because a Bun caller composes `BunHost` and should\n * learn nothing about the adapter behind the `Jj` slot from an error message.\n *\n * @category errors\n * @since 1.0.0-rc.0\n */\nexport class BunHostError extends Schema.TaggedError<BunHostError>()(\"@smthrs/platform-bun/BunHostError\", {\n  code: Schema.Literal(\"invalid_repository_root\"),\n  message: Schema.String\n}) {\n  override readonly name = \"BunHostError\"\n}\n\n/** The longest message a factory refuses with, in UTF-16 code units. */\nconst messageLimit = 255\n\n/** How many code points of a refused root the message repeats at most. */\nconst previewLimit = 64\n\n/**\n * A bounded, quoted excerpt of a refused root that fits in `budget` code\n * units of the message.\n *\n * Counted in code points rather than UTF-16 units so a cut never splits a\n * surrogate pair, and passed through `JSON.stringify` so a newline in the root\n * cannot break the log line the message lands on. Each code point is encoded\n * on its own and admitted only while the quoted excerpt plus the length\n * suffix still fit, so a control character that widens to a `\\u0001` escape\n * shortens the excerpt instead of lengthening the message, and a cut never\n * lands inside an escape.\n */\nconst preview = (root: string, budget: number): string => {\n  const points = Array.from(root)\n  const whole = JSON.stringify(root)\n  if (points.length <= previewLimit && whole.length <= budget) return whole\n  const suffix = `... (${points.length} characters)`\n  const room = budget - suffix.length - 2\n  let excerpt = \"\"\n  for (const point of points.slice(0, previewLimit)) {\n    const encoded = JSON.stringify(point).slice(1, -1)\n    if (excerpt.length + encoded.length > room) break\n    excerpt += encoded\n  }\n  return `\"${excerpt}\"${suffix}`\n}\n\n/**\n * Refuses a root the `Jj` adapter underneath would refuse, here and in this\n * package's name.\n *\n * `BunJj.layerAt` and `BunJj.layerSpawnerAt` are `NodeJj`'s, and those throw a\n * bare `TypeError` that names `NodeJj`, carries no code, and echoes the whole\n * string. The predicate here is the same `isAbsolute` the adapter applies, so\n * a root that passes this check cannot reach that throw.\n */\nconst absoluteRoot = (factory: \"layerAt\" | \"layerContainedAt\", root: string): string => {\n  if (isAbsolute(root)) return root\n  const prefix = `BunHost.${factory} requires an absolute repository root, got `\n  throw new BunHostError({\n    code: \"invalid_repository_root\",\n    message: `${prefix}${preview(root, messageLimit - prefix.length)}`\n  })\n}\n\n/**\n * Stable implementation identities keyed by the closed Host service slots.\n *\n * Each value names the module behind that slot in the raw host bundle.\n * Contained POSIX factories replace the spawner with {@link ProcessReaper.layerSpawner}.\n * These are identity\n * tokens rather than import specifiers: the filesystem entry is\n * `@smthrs/platform-node/AtomicFileSystem` because that is the implementation,\n * even though a consumer reaches it through `@smthrs/platform-bun`.\n *\n * Nothing digests them yet. `@smthrs/plan`'s step key carries a `layers`\n * component these values are meant to feed, but no planner derives it from a\n * host bundle today, so changing one invalidates no cached step.\n *\n * The keys are written as literals rather than `HostServiceIds` positions so\n * that reordering the closed list cannot silently pair a slot with another\n * slot's implementation.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const implementationIds: Readonly<Record<(typeof HostServiceIds)[number], string>> = {\n  \"effect/FileSystem\": \"@smthrs/platform-node/AtomicFileSystem\",\n  \"effect/Path\": \"@effect/platform-bun/BunPath\",\n  \"effect/process/ChildProcessSpawner\": \"@effect/platform-bun/BunChildProcessSpawner\",\n  \"@smthrs/jj/Jj\": \"@smthrs/jj/bun/BunJj\",\n  \"effect/HttpClient\": \"@smthrs/platform-node/EgressHttpClient\"\n}\n\n/**\n * What a caller may configure about containment.\n *\n * `ContainedSpawner.Options.platform` is deliberately not part of it. It\n * decides one thing, whether a command that names no `detached` option gets a\n * process group of its own, and this native host detaches by `process.platform`\n * whatever a record claims. A\n * caller-supplied `\"win32\"` on a POSIX host would therefore record\n * `pgid: null` for a child that really does lead a group, and\n * {@link ProcessReaper.reap} would retire that record as `no-group` and leave\n * the orphan running forever: a durable lie rather than a compile error.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type ContainedOptions = ProcessReaper.SpawnerOptions & ProcessReaper.Options\n\n/** The reaper half of {@link ContainedOptions}. */\nconst reaping = (options?: ContainedOptions): ProcessReaper.Options => ({\n  ownerPid: options?.ownerPid,\n  system: options?.system\n})\n\n/** The two services `BunChildProcessSpawner` resolves paths and files with. */\nconst platform = Layer.mergeAll(BunFileSystem.layer, BunPath.layer, BunCrypto.layer)\n\n/**\n * The network slot on its own: the shared egress client, which never follows a\n * redirect. A `3xx` comes back to the caller with its `location` intact and the\n * second origin uncontacted; following a redirect is `@smthrs/kernel`'s guarded\n * `HttpClient.layer`, which rechecks every hop.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerHttpClient: Layer.Layer<HttpClient> = EgressHttpClient.layer(process.env)\n\n/**\n * Provides all five Bun Host services, including the runtime-independent Path\n * service.\n *\n * Fails at construction with {@link JjError} carrying `not_installed` or\n * `unsupported_version`: the `Jj` slot is merged eagerly and probes\n * `jj --version` while the layer is built, before the program body runs and\n * whether or not the program asks for `Jj`. Requires jj 0.39.0 or later.\n *\n * @category layers\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const layer: Layer.Layer<BunHost | Crypto.Crypto, JjError> = Layer.mergeAll(\n  ProcessConfinement.layer(),\n  platform,\n  Layer.provide(BunChildProcessSpawner.layer, platform),\n  BunJj.layer,\n  layerHttpClient\n)\n\n/**\n * Provides all five Bun Host services bound to one absolute repository root.\n *\n * Throws {@link BunHostError} with code `invalid_repository_root` when `root`\n * is not absolute; the empty string counts. The check runs when the factory is\n * called, before any layer exists.\n *\n * Fails at construction with {@link JjError} exactly as {@link layer} does:\n * the `Jj` slot probes `jj --version` while the layer is built.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerAt = (root: string): Layer.Layer<BunHost | Crypto.Crypto, JjError> => {\n  const repositoryRoot = absoluteRoot(\"layerAt\", root)\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    Layer.provide(BunChildProcessSpawner.layer, platform),\n    BunJj.layerAt(repositoryRoot),\n    layerHttpClient\n  )\n}\n\n/**\n * Provides the Bun host with process containment turned on.\n *\n * Bun uses the same prepared native process lifecycle as Node on POSIX, while\n * preserving its underlying runtime spawner on Windows. `ContainedSpawner` gives\n * every child an escalation deadline and a ledger entry, and\n * `ProcessReaper` sweeps the entries a crashed incarnation of this host left\n * behind. The reaper module lives in `@smthrs/platform-node` because the calls\n * it makes, `process.kill` and `taskkill`, are Node's, and Bun implements\n * them unchanged.\n *\n * Fails at construction with {@link JjError} exactly as {@link layer} does;\n * here the `jj --version` probe runs through the contained spawner, so its\n * record enters and leaves the ledger like any other child.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerContained = (\n  options?: ContainedOptions\n): Layer.Layer<BunHost | Crypto.Crypto, JjError, ProcessLedger.ProcessLedger> => {\n  const spawner = Layer.provide(\n    ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),\n    Layer.provide(BunChildProcessSpawner.layer, platform)\n  )\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    layerHttpClient,\n    // jj goes through the CONTAINED spawner here, not around it, exactly as in\n    // `NodeHost.layerContained`: a jj child that starts its own process leads\n    // no recorded group, is in no ledger, and outlives the host that ran it.\n    Layer.provideMerge(BunJj.layerSpawner, spawner)\n  ).pipe(Layer.provideMerge(ProcessReaper.layer(reaping(options))))\n}\n\n/**\n * Provides the contained Bun host bound to one absolute repository root.\n *\n * Refuses a root exactly as {@link layerAt} does: {@link BunHostError} with\n * code `invalid_repository_root`, thrown when the factory is called.\n * Fails at construction with {@link JjError} exactly as {@link layerContained}\n * does.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerContainedAt = (\n  root: string,\n  options?: ContainedOptions\n): Layer.Layer<BunHost | Crypto.Crypto, JjError, ProcessLedger.ProcessLedger> => {\n  const repositoryRoot = absoluteRoot(\"layerContainedAt\", root)\n  const spawner = Layer.provide(\n    ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),\n    Layer.provide(BunChildProcessSpawner.layer, platform)\n  )\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    layerHttpClient,\n    Layer.provideMerge(BunJj.layerSpawnerAt(repositoryRoot), spawner)\n  ).pipe(Layer.provideMerge(ProcessReaper.layer(reaping(options))))\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAwBA,6BAAwC;AACxC,gBAA2B;AAC3B,cAAyB;AAEzB,YAAuB;AAIvB,uBAAkC;AAClC,uBAAkC;AAClC,mBAA8B;AAC9B,yBAAoC;AACpC,oBAA+B;AAI/B,YAAuB;AAGvB,aAAwB;AACxB,uBAA2B;AAC3B,oBAA+B;AA4DxB,MAAM,qBAAqB,OAAO,YAA0B,EAAE,qCAAqC;AAAA,EACxG,MAAM,OAAO,QAAQ,yBAAyB;AAAA,EAC9C,SAAS,OAAO;AAClB,CAAC,EAAE;AAAA,EACiB,OAAO;AAC3B;AAGA,MAAM,eAAe;AAGrB,MAAM,eAAe;AAcrB,MAAM,UAAU,CAAC,MAAc,WAA2B;AACxD,QAAM,SAAS,MAAM,KAAK,IAAI;AAC9B,QAAM,QAAQ,KAAK,UAAU,IAAI;AACjC,MAAI,OAAO,UAAU,gBAAgB,MAAM,UAAU,OAAQ,QAAO;AACpE,QAAM,SAAS,QAAQ,OAAO,MAAM;AACpC,QAAM,OAAO,SAAS,OAAO,SAAS;AACtC,MAAI,UAAU;AACd,aAAW,SAAS,OAAO,MAAM,GAAG,YAAY,GAAG;AACjD,UAAM,UAAU,KAAK,UAAU,KAAK,EAAE,MAAM,GAAG,EAAE;AACjD,QAAI,QAAQ,SAAS,QAAQ,SAAS,KAAM;AAC5C,eAAW;AAAA,EACb;AACA,SAAO,IAAI,OAAO,IAAI,MAAM;AAC9B;AAWA,MAAM,eAAe,CAAC,SAAyC,SAAyB;AACtF,UAAI,6BAAW,IAAI,EAAG,QAAO;AAC7B,QAAM,SAAS,WAAW,OAAO;AACjC,QAAM,IAAI,aAAa;AAAA,IACrB,MAAM;AAAA,IACN,SAAS,GAAG,MAAM,GAAG,QAAQ,MAAM,eAAe,OAAO,MAAM,CAAC;AAAA,EAClE,CAAC;AACH;AAwBO,MAAM,oBAA+E;AAAA,EAC1F,qBAAqB;AAAA,EACrB,eAAe;AAAA,EACf,sCAAsC;AAAA,EACtC,iBAAiB;AAAA,EACjB,qBAAqB;AACvB;AAoBA,MAAM,UAAU,CAAC,aAAuD;AAAA,EACtE,UAAU,SAAS;AAAA,EACnB,QAAQ,SAAS;AACnB;AAGA,MAAM,WAAW,MAAM,SAAS,cAAc,OAAO,QAAQ,OAAO,UAAU,KAAK;AAW5E,MAAM,kBAA2C,iBAAiB,MAAM,QAAQ,GAAG;AAenF,MAAM,QAAuD,MAAM;AAAA,EACxE,mBAAmB,MAAM;AAAA,EACzB;AAAA,EACA,MAAM,QAAQ,uBAAuB,OAAO,QAAQ;AAAA,EACpD,MAAM;AAAA,EACN;AACF;AAeO,MAAM,UAAU,CAAC,SAAgE;AACtF,QAAM,iBAAiB,aAAa,WAAW,IAAI;AACnD,SAAO,MAAM;AAAA,IACX,mBAAmB,MAAM;AAAA,IACzB;AAAA,IACA,MAAM,QAAQ,uBAAuB,OAAO,QAAQ;AAAA,IACpD,MAAM,QAAQ,cAAc;AAAA,IAC5B;AAAA,EACF;AACF;AAoBO,MAAM,iBAAiB,CAC5B,YAC+E;AAC/E,QAAM,UAAU,MAAM;AAAA,IACpB,cAAc,aAAa,EAAE,SAAS,SAAS,QAAQ,CAAC;AAAA,IACxD,MAAM,QAAQ,uBAAuB,OAAO,QAAQ;AAAA,EACtD;AACA,SAAO,MAAM;AAAA,IACX,mBAAmB,MAAM;AAAA,IACzB;AAAA,IACA;AAAA;AAAA;AAAA;AAAA,IAIA,MAAM,aAAa,MAAM,cAAc,OAAO;AAAA,EAChD,EAAE,KAAK,MAAM,aAAa,cAAc,MAAM,QAAQ,OAAO,CAAC,CAAC,CAAC;AAClE;AAaO,MAAM,mBAAmB,CAC9B,MACA,YAC+E;AAC/E,QAAM,iBAAiB,aAAa,oBAAoB,IAAI;AAC5D,QAAM,UAAU,MAAM;AAAA,IACpB,cAAc,aAAa,EAAE,SAAS,SAAS,QAAQ,CAAC;AAAA,IACxD,MAAM,QAAQ,uBAAuB,OAAO,QAAQ;AAAA,EACtD;AACA,SAAO,MAAM;AAAA,IACX,mBAAmB,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA,MAAM,aAAa,MAAM,eAAe,cAAc,GAAG,OAAO;AAAA,EAClE,EAAE,KAAK,MAAM,aAAa,cAAc,MAAM,QAAQ,OAAO,CAAC,CAAC,CAAC;AAClE;",
+  "sourcesContent": ["/**\n * Aggregate Bun Host bundle.\n *\n * Runtime-specific dependencies stay inside this package; callers get the same\n * closed five-service Host surface every other bundle provides, plus native\n * `ProcessConfinement` for guarded commands.\n *\n * There is no Bun shell module: running a command is Effect's\n * `ChildProcessSpawner`, and `@effect/platform-bun`'s implementation is\n * `@effect/platform-node-shared`'s re-exported: the same code on both\n * runtimes, so no runtime detection is needed here.\n *\n * Outgoing HTTP uses the shared EgressHttpClient on both runtimes. Web\n * requests pin approved addresses; ordinary requests retain the shared pool.\n * Redirects remain visible to the capability kernel, and proxy routing follows\n * the host environment.\n *\n * The filesystem slot is `@smthrs/platform-node`'s `AtomicFileSystem`, byte for\n * byte the layer `NodeHost` uses, so a guarded path operation is\n * descriptor-relative and no-follow on both runtimes.\n *\n * @since 1.0.0-rc.0\n */\n\nimport * as BunChildProcessSpawner from \"@effect/platform-bun/BunChildProcessSpawner\"\nimport * as BunCrypto from \"@effect/platform-bun/BunCrypto\"\nimport * as BunPath from \"@effect/platform-bun/BunPath\"\nimport type { Jj } from \"@smthrs/jj\"\nimport * as BunJj from \"@smthrs/jj/bun/BunJj\"\nimport type { HostServiceIds } from \"@smthrs/kernel/HostServices\"\nimport type * as KernelProcessConfinement from \"@smthrs/kernel/ProcessConfinement\"\nimport type * as ProcessLedger from \"@smthrs/kernel/ProcessLedger\"\nimport * as AtomicFileSystem from \"@smthrs/platform-node/AtomicFileSystem\"\nimport * as EgressHttpClient from \"@smthrs/platform-node/EgressHttpClient\"\nimport * as HostLiveness from \"@smthrs/platform-node/HostLiveness\"\nimport * as ProcessConfinement from \"@smthrs/platform-node/ProcessConfinement\"\nimport * as ProcessReaper from \"@smthrs/platform-node/ProcessReaper\"\nimport type * as Crypto from \"effect/Crypto\"\nimport type { FileSystem } from \"effect/FileSystem\"\nimport type { HttpClient } from \"effect/http/HttpClient\"\nimport * as Layer from \"effect/Layer\"\nimport type * as Path from \"effect/Path\"\nimport type { ChildProcessSpawner } from \"effect/process/ChildProcessSpawner\"\nimport * as Schema from \"effect/Schema\"\nimport { isAbsolute } from \"node:path\"\nimport * as BunFileSystem from \"./BunFileSystem.ts\"\n\n/**\n * Bun platform modules for selectively providing individual services.\n *\n * `AtomicFileSystem` is here for the same reason `NodeHost` re-exports it: it\n * owns the only configuration escape hatch the filesystem slot has, and a Bun\n * program with a different packaged helper path needs to reach\n * `AtomicFileSystem.layerWith` without hand-composing the other four tags.\n *\n * `BunJj` is deliberately absent: it belongs to `@smthrs/jj` and is imported\n * from there, never re-exported here. So is `@effect/platform-bun/BunHttpClient`:\n * its `layer` follows redirects to origins the capability kernel never\n * authorized. The network slot on its own is {@link layerHttpClient}.\n *\n * @category re-exports\n * @since 1.0.0-rc.0\n * @slop\n */\nexport { AtomicFileSystem, BunChildProcessSpawner, BunCrypto, BunFileSystem, HostLiveness, ProcessReaper }\n\n/**\n * The complete closed Host service union provided by Bun.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport type BunHost =\n  | FileSystem\n  | Path.Path\n  | ChildProcessSpawner\n  | Jj\n  | HttpClient\n  | KernelProcessConfinement.ProcessConfinement\n\n/**\n * The stable codes a `BunHost` factory refuses with.\n *\n * A code is the contract a caller branches on; the message beside it is for a\n * person. `invalid_repository_root` is the root handed to {@link layerAt} or\n * {@link layerContainedAt} not being absolute or containing NUL, the empty\n * string included.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type BunHostErrorCode = \"invalid_repository_root\"\n\n/**\n * The refusal a `BunHost` factory throws before it builds a layer.\n *\n * It is thrown rather than failed because a factory is called while a program\n * composes its layers, where there is no fiber to fail yet and a wrong root is\n * a composition mistake, not a runtime outcome. It is this package's class,\n * not the `Jj` adapter's, because a Bun caller composes `BunHost` and should\n * learn nothing about the adapter behind the `Jj` slot from an error message.\n *\n * @category errors\n * @since 1.0.0-rc.0\n */\nexport class BunHostError extends Schema.TaggedError<BunHostError>()(\"@smthrs/platform-bun/BunHostError\", {\n  code: Schema.Literal(\"invalid_repository_root\"),\n  message: Schema.String\n}) {\n  override readonly name = \"BunHostError\"\n}\n\n/** The longest message a factory refuses with, in UTF-16 code units. */\nconst messageLimit = 255\n\n/** How many code points of a refused root the message repeats at most. */\nconst previewLimit = 64\n\n/**\n * A bounded, quoted excerpt of a refused root that fits in `budget` code\n * units of the message.\n *\n * Counted in code points rather than UTF-16 units so a cut never splits a\n * surrogate pair, and passed through `JSON.stringify` so a newline in the root\n * cannot break the log line the message lands on. Each code point is encoded\n * on its own and admitted only while the quoted excerpt plus the length\n * suffix still fit, so a control character that widens to a `\\u0001` escape\n * shortens the excerpt instead of lengthening the message, and a cut never\n * lands inside an escape.\n */\nconst preview = (root: string, budget: number): string => {\n  const points = Array.from(root)\n  const whole = JSON.stringify(root)\n  if (points.length <= previewLimit && whole.length <= budget) return whole\n  const suffix = `... (${points.length} characters)`\n  const room = budget - suffix.length - 2\n  let excerpt = \"\"\n  for (const point of points.slice(0, previewLimit)) {\n    const encoded = JSON.stringify(point).slice(1, -1)\n    if (excerpt.length + encoded.length > room) break\n    excerpt += encoded\n  }\n  return `\"${excerpt}\"${suffix}`\n}\n\n/**\n * Refuses a root the `Jj` adapter underneath would refuse, here and in this\n * package's name.\n *\n * `BunJj.layerAt` and `BunJj.layerSpawnerAt` are `NodeJj`'s, and those throw a\n * bare `TypeError` that names `NodeJj`, carries no code, and echoes the whole\n * string. The predicate includes the same `isAbsolute` the adapter applies, so\n * a root that passes this check cannot reach that throw. An absolute root\n * containing NUL is refused too: no filesystem or process API can represent it.\n */\nconst absoluteRoot = (factory: \"layerAt\" | \"layerContainedAt\", root: string): string => {\n  // An absolute root with NUL names that defect, not absoluteness it already has.\n  const requirement = !isAbsolute(root)\n    ? \"an absolute repository root\"\n    : root.includes(\"\\0\")\n    ? \"a repository root without NUL\"\n    : undefined\n  if (requirement === undefined) return root\n  const prefix = `BunHost.${factory} requires ${requirement}, got `\n  throw new BunHostError({\n    code: \"invalid_repository_root\",\n    message: `${prefix}${preview(root, messageLimit - prefix.length)}`\n  })\n}\n\n/**\n * Stable implementation identities keyed by the closed Host service slots.\n *\n * Each value names the module behind that slot in the raw host bundle.\n * Contained POSIX factories replace the spawner with {@link ProcessReaper.layerSpawner}.\n * These are identity\n * tokens rather than import specifiers: the filesystem entry is\n * `@smthrs/platform-node/AtomicFileSystem` because that is the implementation,\n * even though a consumer reaches it through `@smthrs/platform-bun`.\n *\n * Nothing digests them yet. `@smthrs/plan`'s step key carries a `layers`\n * component these values are meant to feed, but no planner derives it from a\n * host bundle today, so changing one invalidates no cached step.\n *\n * The keys are written as literals rather than `HostServiceIds` positions so\n * that reordering the closed list cannot silently pair a slot with another\n * slot's implementation.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const implementationIds: Readonly<Record<(typeof HostServiceIds)[number], string>> = {\n  \"effect/FileSystem\": \"@smthrs/platform-node/AtomicFileSystem\",\n  \"effect/Path\": \"@effect/platform-bun/BunPath\",\n  \"effect/process/ChildProcessSpawner\": \"@effect/platform-bun/BunChildProcessSpawner\",\n  \"@smthrs/jj/Jj\": \"@smthrs/jj/bun/BunJj\",\n  \"effect/HttpClient\": \"@smthrs/platform-node/EgressHttpClient\"\n}\n\n/**\n * What a caller may configure about containment.\n *\n * `ContainedSpawner.Options.platform` is deliberately not part of it. It\n * decides one thing, whether a command that names no `detached` option gets a\n * process group of its own, and this native host detaches by `process.platform`\n * whatever a record claims. A\n * caller-supplied `\"win32\"` on a POSIX host would therefore record\n * `pgid: null` for a child that really does lead a group, and\n * {@link ProcessReaper.reap} would retire that record as `no-group` and leave\n * the orphan running forever: a durable lie rather than a compile error.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type ContainedOptions = ProcessReaper.SpawnerOptions & ProcessReaper.Options\n\n/** The reaper half of {@link ContainedOptions}. */\nconst reaping = (options?: ContainedOptions): ProcessReaper.Options => ({\n  ownerPid: options?.ownerPid,\n  system: options?.system\n})\n\n/** The two services `BunChildProcessSpawner` resolves paths and files with. */\nconst platform = Layer.mergeAll(BunFileSystem.layer, BunPath.layer, BunCrypto.layer)\n\n/**\n * The network slot on its own: the shared egress client, which never follows a\n * redirect. A `3xx` comes back to the caller with its `location` intact and the\n * second origin uncontacted; following a redirect is `@smthrs/kernel`'s guarded\n * `HttpClient.layer`, which rechecks every hop.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerHttpClient: Layer.Layer<HttpClient> = EgressHttpClient.layer(process.env)\n\n/**\n * Provides all five Bun Host services, including the runtime-independent Path\n * service.\n *\n * Builds on a host without jj. The `Jj` slot probes `jj --version` on its\n * first operation and fails that operation with `JjError` carrying\n * `not_installed` or `unsupported_version`; a program that never calls `Jj`\n * runs without jj. `Jj` requires jj 0.39.0 or later.\n *\n * @category layers\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const layer: Layer.Layer<BunHost | Crypto.Crypto> = Layer.mergeAll(\n  ProcessConfinement.layer(),\n  platform,\n  Layer.provide(BunChildProcessSpawner.layer, platform),\n  BunJj.layer,\n  layerHttpClient\n)\n\n/**\n * Provides all five Bun Host services bound to one absolute repository root.\n *\n * Throws {@link BunHostError} with code `invalid_repository_root` when `root`\n * is not absolute or contains NUL; the empty string counts. The check runs\n * when the factory is called, before any layer exists.\n *\n * Builds without jj exactly as {@link layer} does: the `Jj` slot probes\n * `jj --version` on its first operation.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerAt = (root: string): Layer.Layer<BunHost | Crypto.Crypto> => {\n  const repositoryRoot = absoluteRoot(\"layerAt\", root)\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    Layer.provide(BunChildProcessSpawner.layer, platform),\n    BunJj.layerAt(repositoryRoot),\n    layerHttpClient\n  )\n}\n\n/**\n * Provides the Bun host with process containment turned on.\n *\n * Bun uses the same prepared native process lifecycle as Node on POSIX, while\n * preserving its underlying runtime spawner on Windows. `ContainedSpawner` gives\n * every child an escalation deadline and a ledger entry, and\n * `ProcessReaper` sweeps the entries a crashed incarnation of this host left\n * behind. The reaper module lives in `@smthrs/platform-node` because the calls\n * it makes, `process.kill` and `taskkill`, are Node's, and Bun implements\n * them unchanged.\n *\n * Builds without jj exactly as {@link layer} does; here the first\n * operation's `jj --version` probe runs through the contained spawner, so its\n * record enters and leaves the ledger like any other child.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerContained = (\n  options?: ContainedOptions\n): Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger> => {\n  const spawner = Layer.provide(\n    ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),\n    Layer.provide(BunChildProcessSpawner.layer, platform)\n  )\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    layerHttpClient,\n    // jj goes through the CONTAINED spawner here, not around it, exactly as in\n    // `NodeHost.layerContained`: a jj child that starts its own process leads\n    // no recorded group, is in no ledger, and outlives the host that ran it.\n    Layer.provideMerge(BunJj.layerSpawner, spawner)\n  ).pipe(Layer.provideMerge(ProcessReaper.layer(reaping(options))))\n}\n\n/**\n * Provides the contained Bun host bound to one absolute repository root.\n *\n * Refuses a root exactly as {@link layerAt} does: {@link BunHostError} with\n * code `invalid_repository_root`, thrown when the factory is called.\n * Builds without jj exactly as {@link layerContained} does.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerContainedAt = (\n  root: string,\n  options?: ContainedOptions\n): Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger> => {\n  const repositoryRoot = absoluteRoot(\"layerContainedAt\", root)\n  const spawner = Layer.provide(\n    ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),\n    Layer.provide(BunChildProcessSpawner.layer, platform)\n  )\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    layerHttpClient,\n    Layer.provideMerge(BunJj.layerSpawnerAt(repositoryRoot), spawner)\n  ).pipe(Layer.provideMerge(ProcessReaper.layer(reaping(options))))\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAwBA,6BAAwC;AACxC,gBAA2B;AAC3B,cAAyB;AAEzB,YAAuB;AAIvB,uBAAkC;AAClC,uBAAkC;AAClC,mBAA8B;AAC9B,yBAAoC;AACpC,oBAA+B;AAI/B,YAAuB;AAGvB,aAAwB;AACxB,uBAA2B;AAC3B,oBAA+B;AA6DxB,MAAM,qBAAqB,OAAO,YAA0B,EAAE,qCAAqC;AAAA,EACxG,MAAM,OAAO,QAAQ,yBAAyB;AAAA,EAC9C,SAAS,OAAO;AAClB,CAAC,EAAE;AAAA,EACiB,OAAO;AAC3B;AAGA,MAAM,eAAe;AAGrB,MAAM,eAAe;AAcrB,MAAM,UAAU,CAAC,MAAc,WAA2B;AACxD,QAAM,SAAS,MAAM,KAAK,IAAI;AAC9B,QAAM,QAAQ,KAAK,UAAU,IAAI;AACjC,MAAI,OAAO,UAAU,gBAAgB,MAAM,UAAU,OAAQ,QAAO;AACpE,QAAM,SAAS,QAAQ,OAAO,MAAM;AACpC,QAAM,OAAO,SAAS,OAAO,SAAS;AACtC,MAAI,UAAU;AACd,aAAW,SAAS,OAAO,MAAM,GAAG,YAAY,GAAG;AACjD,UAAM,UAAU,KAAK,UAAU,KAAK,EAAE,MAAM,GAAG,EAAE;AACjD,QAAI,QAAQ,SAAS,QAAQ,SAAS,KAAM;AAC5C,eAAW;AAAA,EACb;AACA,SAAO,IAAI,OAAO,IAAI,MAAM;AAC9B;AAYA,MAAM,eAAe,CAAC,SAAyC,SAAyB;AAEtF,QAAM,cAAc,KAAC,6BAAW,IAAI,IAChC,gCACA,KAAK,SAAS,IAAI,IAClB,kCACA;AACJ,MAAI,gBAAgB,OAAW,QAAO;AACtC,QAAM,SAAS,WAAW,OAAO,aAAa,WAAW;AACzD,QAAM,IAAI,aAAa;AAAA,IACrB,MAAM;AAAA,IACN,SAAS,GAAG,MAAM,GAAG,QAAQ,MAAM,eAAe,OAAO,MAAM,CAAC;AAAA,EAClE,CAAC;AACH;AAwBO,MAAM,oBAA+E;AAAA,EAC1F,qBAAqB;AAAA,EACrB,eAAe;AAAA,EACf,sCAAsC;AAAA,EACtC,iBAAiB;AAAA,EACjB,qBAAqB;AACvB;AAoBA,MAAM,UAAU,CAAC,aAAuD;AAAA,EACtE,UAAU,SAAS;AAAA,EACnB,QAAQ,SAAS;AACnB;AAGA,MAAM,WAAW,MAAM,SAAS,cAAc,OAAO,QAAQ,OAAO,UAAU,KAAK;AAW5E,MAAM,kBAA2C,iBAAiB,MAAM,QAAQ,GAAG;AAenF,MAAM,QAA8C,MAAM;AAAA,EAC/D,mBAAmB,MAAM;AAAA,EACzB;AAAA,EACA,MAAM,QAAQ,uBAAuB,OAAO,QAAQ;AAAA,EACpD,MAAM;AAAA,EACN;AACF;AAeO,MAAM,UAAU,CAAC,SAAuD;AAC7E,QAAM,iBAAiB,aAAa,WAAW,IAAI;AACnD,SAAO,MAAM;AAAA,IACX,mBAAmB,MAAM;AAAA,IACzB;AAAA,IACA,MAAM,QAAQ,uBAAuB,OAAO,QAAQ;AAAA,IACpD,MAAM,QAAQ,cAAc;AAAA,IAC5B;AAAA,EACF;AACF;AAoBO,MAAM,iBAAiB,CAC5B,YAC6E;AAC7E,QAAM,UAAU,MAAM;AAAA,IACpB,cAAc,aAAa,EAAE,SAAS,SAAS,QAAQ,CAAC;AAAA,IACxD,MAAM,QAAQ,uBAAuB,OAAO,QAAQ;AAAA,EACtD;AACA,SAAO,MAAM;AAAA,IACX,mBAAmB,MAAM;AAAA,IACzB;AAAA,IACA;AAAA;AAAA;AAAA;AAAA,IAIA,MAAM,aAAa,MAAM,cAAc,OAAO;AAAA,EAChD,EAAE,KAAK,MAAM,aAAa,cAAc,MAAM,QAAQ,OAAO,CAAC,CAAC,CAAC;AAClE;AAYO,MAAM,mBAAmB,CAC9B,MACA,YAC6E;AAC7E,QAAM,iBAAiB,aAAa,oBAAoB,IAAI;AAC5D,QAAM,UAAU,MAAM;AAAA,IACpB,cAAc,aAAa,EAAE,SAAS,SAAS,QAAQ,CAAC;AAAA,IACxD,MAAM,QAAQ,uBAAuB,OAAO,QAAQ;AAAA,EACtD;AACA,SAAO,MAAM;AAAA,IACX,mBAAmB,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA,MAAM,aAAa,MAAM,eAAe,cAAc,GAAG,OAAO;AAAA,EAClE,EAAE,KAAK,MAAM,aAAa,cAAc,MAAM,QAAQ,OAAO,CAAC,CAAC,CAAC;AAClE;",
   "names": []
 }

package/dist/esm/BunHost.d.ts

@@ -23,7 +23,7 @@
  */
 import * as BunChildProcessSpawner from "../vendor/bun/BunChildProcessSpawner.js";
 import * as BunCrypto from "../vendor/bun/BunCrypto.js";
-import type { Jj, JjError } from "@smthrs/jj";
+import type { Jj } from "@smthrs/jj";
 import type { HostServiceIds } from "@smthrs/kernel/HostServices";
 import type * as KernelProcessConfinement from "@smthrs/kernel/ProcessConfinement";
 import type * as ProcessLedger from "@smthrs/kernel/ProcessLedger";
@@ -69,7 +69,8 @@ export type BunHost = FileSystem | Path.Path | ChildProcessSpawner | Jj | HttpCl
  *
  * A code is the contract a caller branches on; the message beside it is for a
  * person. `invalid_repository_root` is the root handed to {@link layerAt} or
- * {@link layerContainedAt} not being absolute, the empty string included.
+ * {@link layerContainedAt} not being absolute or containing NUL, the empty
+ * string included.
  *
  * @category models
  * @since 1.0.0-rc.0
@@ -147,30 +148,30 @@ export declare const layerHttpClient: Layer.Layer<HttpClient>;
  * Provides all five Bun Host services, including the runtime-independent Path
  * service.
  *
- * Fails at construction with {@link JjError} carrying `not_installed` or
- * `unsupported_version`: the `Jj` slot is merged eagerly and probes
- * `jj --version` while the layer is built, before the program body runs and
- * whether or not the program asks for `Jj`. Requires jj 0.39.0 or later.
+ * Builds on a host without jj. The `Jj` slot probes `jj --version` on its
+ * first operation and fails that operation with `JjError` carrying
+ * `not_installed` or `unsupported_version`; a program that never calls `Jj`
+ * runs without jj. `Jj` requires jj 0.39.0 or later.
  *
  * @category layers
  * @since 1.0.0-rc.0
  * @slop
  */
-export declare const layer: Layer.Layer<BunHost | Crypto.Crypto, JjError>;
+export declare const layer: Layer.Layer<BunHost | Crypto.Crypto>;
 /**
  * Provides all five Bun Host services bound to one absolute repository root.
  *
  * Throws {@link BunHostError} with code `invalid_repository_root` when `root`
- * is not absolute; the empty string counts. The check runs when the factory is
- * called, before any layer exists.
+ * is not absolute or contains NUL; the empty string counts. The check runs
+ * when the factory is called, before any layer exists.
  *
- * Fails at construction with {@link JjError} exactly as {@link layer} does:
- * the `Jj` slot probes `jj --version` while the layer is built.
+ * Builds without jj exactly as {@link layer} does: the `Jj` slot probes
+ * `jj --version` on its first operation.
  *
  * @category layers
  * @since 1.0.0-rc.0
  */
-export declare const layerAt: (root: string) => Layer.Layer<BunHost | Crypto.Crypto, JjError>;
+export declare const layerAt: (root: string) => Layer.Layer<BunHost | Crypto.Crypto>;
 /**
  * Provides the Bun host with process containment turned on.
  *
@@ -182,24 +183,23 @@ export declare const layerAt: (root: string) => Layer.Layer<BunHost | Crypto.Cry
  * it makes, `process.kill` and `taskkill`, are Node's, and Bun implements
  * them unchanged.
  *
- * Fails at construction with {@link JjError} exactly as {@link layer} does;
- * here the `jj --version` probe runs through the contained spawner, so its
+ * Builds without jj exactly as {@link layer} does; here the first
+ * operation's `jj --version` probe runs through the contained spawner, so its
  * record enters and leaves the ledger like any other child.
  *
  * @category layers
  * @since 1.0.0-rc.0
  */
-export declare const layerContained: (options?: ContainedOptions) => Layer.Layer<BunHost | Crypto.Crypto, JjError, ProcessLedger.ProcessLedger>;
+export declare const layerContained: (options?: ContainedOptions) => Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger>;
 /**
  * Provides the contained Bun host bound to one absolute repository root.
  *
  * Refuses a root exactly as {@link layerAt} does: {@link BunHostError} with
  * code `invalid_repository_root`, thrown when the factory is called.
- * Fails at construction with {@link JjError} exactly as {@link layerContained}
- * does.
+ * Builds without jj exactly as {@link layerContained} does.
  *
  * @category layers
  * @since 1.0.0-rc.0
  */
-export declare const layerContainedAt: (root: string, options?: ContainedOptions) => Layer.Layer<BunHost | Crypto.Crypto, JjError, ProcessLedger.ProcessLedger>;
+export declare const layerContainedAt: (root: string, options?: ContainedOptions) => Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger>;
 //# sourceMappingURL=BunHost.d.ts.map

package/dist/esm/BunHost.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BunHost.d.ts","sourceRoot":"","sources":["../../src/BunHost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,sBAAsB,MAAM,6CAA6C,CAAA;AACrF,OAAO,KAAK,SAAS,MAAM,gCAAgC,CAAA;AAE3D,OAAO,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAE7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,KAAK,KAAK,wBAAwB,MAAM,mCAAmC,CAAA;AAClF,OAAO,KAAK,KAAK,aAAa,MAAM,8BAA8B,CAAA;AAClE,OAAO,KAAK,gBAAgB,MAAM,wCAAwC,CAAA;AAE1E,OAAO,KAAK,YAAY,MAAM,oCAAoC,CAAA;AAElE,OAAO,KAAK,aAAa,MAAM,qCAAqC,CAAA;AACpE,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,KAAK,IAAI,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAC7E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,CAAA;AAE1G;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,GACf,UAAU,GACV,IAAI,CAAC,IAAI,GACT,mBAAmB,GACnB,EAAE,GACF,UAAU,GACV,wBAAwB,CAAC,kBAAkB,CAAA;AAE/C;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG,yBAAyB,CAAA;;;;;AAExD;;;;;;;;;;;GAWG;AACH,qBAAa,YAAa,SAAQ,iBAGhC;IACA,SAAkB,IAAI,kBAAiB;CACxC;AAqDD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAMvF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC,cAAc,GAAG,aAAa,CAAC,OAAO,CAAA;AAWnF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAuC,CAAA;AAE3F;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAM/D,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,MAAM,KAAG,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CASlF,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,GACzB,UAAU,gBAAgB,KACzB,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,aAAa,CAc3E,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,GAC3B,MAAM,MAAM,EACZ,UAAU,gBAAgB,KACzB,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,aAAa,CAY3E,CAAA"}
+{"version":3,"file":"BunHost.d.ts","sourceRoot":"","sources":["../../src/BunHost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,sBAAsB,MAAM,6CAA6C,CAAA;AACrF,OAAO,KAAK,SAAS,MAAM,gCAAgC,CAAA;AAE3D,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,YAAY,CAAA;AAEpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,KAAK,KAAK,wBAAwB,MAAM,mCAAmC,CAAA;AAClF,OAAO,KAAK,KAAK,aAAa,MAAM,8BAA8B,CAAA;AAClE,OAAO,KAAK,gBAAgB,MAAM,wCAAwC,CAAA;AAE1E,OAAO,KAAK,YAAY,MAAM,oCAAoC,CAAA;AAElE,OAAO,KAAK,aAAa,MAAM,qCAAqC,CAAA;AACpE,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,KAAK,IAAI,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAC7E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,CAAA;AAE1G;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,GACf,UAAU,GACV,IAAI,CAAC,IAAI,GACT,mBAAmB,GACnB,EAAE,GACF,UAAU,GACV,wBAAwB,CAAC,kBAAkB,CAAA;AAE/C;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GAAG,yBAAyB,CAAA;;;;;AAExD;;;;;;;;;;;GAWG;AACH,qBAAa,YAAa,SAAQ,iBAGhC;IACA,SAAkB,IAAI,kBAAiB;CACxC;AA4DD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAMvF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC,cAAc,GAAG,aAAa,CAAC,OAAO,CAAA;AAWnF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAuC,CAAA;AAE3F;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAMtD,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,MAAM,KAAG,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CASzE,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,GACzB,UAAU,gBAAgB,KACzB,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,aAAa,CAczE,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAC3B,MAAM,MAAM,EACZ,UAAU,gBAAgB,KACzB,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,aAAa,CAYzE,CAAA"}

package/dist/esm/BunHost.js

@@ -108,13 +108,20 @@ const preview = (root, budget) => {
  *
  * `BunJj.layerAt` and `BunJj.layerSpawnerAt` are `NodeJj`'s, and those throw a
  * bare `TypeError` that names `NodeJj`, carries no code, and echoes the whole
- * string. The predicate here is the same `isAbsolute` the adapter applies, so
- * a root that passes this check cannot reach that throw.
+ * string. The predicate includes the same `isAbsolute` the adapter applies, so
+ * a root that passes this check cannot reach that throw. An absolute root
+ * containing NUL is refused too: no filesystem or process API can represent it.
  */
 const absoluteRoot = (factory, root) => {
-    if (isAbsolute(root))
+    // An absolute root with NUL names that defect, not absoluteness it already has.
+    const requirement = !isAbsolute(root)
+        ? "an absolute repository root"
+        : root.includes("\0")
+            ? "a repository root without NUL"
+            : undefined;
+    if (requirement === undefined)
         return root;
-    const prefix = `BunHost.${factory} requires an absolute repository root, got `;
+    const prefix = `BunHost.${factory} requires ${requirement}, got `;
     throw new BunHostError({
         code: "invalid_repository_root",
         message: `${prefix}${preview(root, messageLimit - prefix.length)}`
@@ -170,10 +177,10 @@ export const layerHttpClient = EgressHttpClient.layer(process.env);
  * Provides all five Bun Host services, including the runtime-independent Path
  * service.
  *
- * Fails at construction with {@link JjError} carrying `not_installed` or
- * `unsupported_version`: the `Jj` slot is merged eagerly and probes
- * `jj --version` while the layer is built, before the program body runs and
- * whether or not the program asks for `Jj`. Requires jj 0.39.0 or later.
+ * Builds on a host without jj. The `Jj` slot probes `jj --version` on its
+ * first operation and fails that operation with `JjError` carrying
+ * `not_installed` or `unsupported_version`; a program that never calls `Jj`
+ * runs without jj. `Jj` requires jj 0.39.0 or later.
  *
  * @category layers
  * @since 1.0.0-rc.0
@@ -184,11 +191,11 @@ export const layer = Layer.mergeAll(ProcessConfinement.layer(), platform, Layer.
  * Provides all five Bun Host services bound to one absolute repository root.
  *
  * Throws {@link BunHostError} with code `invalid_repository_root` when `root`
- * is not absolute; the empty string counts. The check runs when the factory is
- * called, before any layer exists.
+ * is not absolute or contains NUL; the empty string counts. The check runs
+ * when the factory is called, before any layer exists.
  *
- * Fails at construction with {@link JjError} exactly as {@link layer} does:
- * the `Jj` slot probes `jj --version` while the layer is built.
+ * Builds without jj exactly as {@link layer} does: the `Jj` slot probes
+ * `jj --version` on its first operation.
  *
  * @category layers
  * @since 1.0.0-rc.0
@@ -208,8 +215,8 @@ export const layerAt = (root) => {
  * it makes, `process.kill` and `taskkill`, are Node's, and Bun implements
  * them unchanged.
  *
- * Fails at construction with {@link JjError} exactly as {@link layer} does;
- * here the `jj --version` probe runs through the contained spawner, so its
+ * Builds without jj exactly as {@link layer} does; here the first
+ * operation's `jj --version` probe runs through the contained spawner, so its
  * record enters and leaves the ledger like any other child.
  *
  * @category layers
@@ -228,8 +235,7 @@ export const layerContained = (options) => {
  *
  * Refuses a root exactly as {@link layerAt} does: {@link BunHostError} with
  * code `invalid_repository_root`, thrown when the factory is called.
- * Fails at construction with {@link JjError} exactly as {@link layerContained}
- * does.
+ * Builds without jj exactly as {@link layerContained} does.
  *
  * @category layers
  * @since 1.0.0-rc.0

package/dist/esm/BunHost.js.map

@@ -1 +1 @@
-{"version":3,"file":"BunHost.js","sourceRoot":"","sources":["../../src/BunHost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,sBAAsB,MAAM,6CAA6C,CAAA;AACrF,OAAO,KAAK,SAAS,MAAM,gCAAgC,CAAA;AAC3D,OAAO,KAAK,OAAO,MAAM,8BAA8B,CAAA;AAEvD,OAAO,KAAK,KAAK,MAAM,sBAAsB,CAAA;AAI7C,OAAO,KAAK,gBAAgB,MAAM,wCAAwC,CAAA;AAC1E,OAAO,KAAK,gBAAgB,MAAM,wCAAwC,CAAA;AAC1E,OAAO,KAAK,YAAY,MAAM,oCAAoC,CAAA;AAClE,OAAO,KAAK,kBAAkB,MAAM,0CAA0C,CAAA;AAC9E,OAAO,KAAK,aAAa,MAAM,qCAAqC,CAAA;AAIpE,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAGrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,CAAA;AA6B1G;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,WAAW,EAAgB,CAAC,mCAAmC,EAAE;IACxG,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;IACkB,IAAI,GAAG,cAAc,CAAA;CACxC;AAED,wEAAwE;AACxE,MAAM,YAAY,GAAG,GAAG,CAAA;AAExB,0EAA0E;AAC1E,MAAM,YAAY,GAAG,EAAE,CAAA;AAEvB;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,MAAc,EAAU,EAAE;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,MAAM,CAAC,MAAM,IAAI,YAAY,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM;QAAE,OAAO,KAAK,CAAA;IACzE,MAAM,MAAM,GAAG,QAAQ,MAAM,CAAC,MAAM,cAAc,CAAA;IAClD,MAAM,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;IACvC,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAClD,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI;YAAE,MAAK;QACjD,OAAO,IAAI,OAAO,CAAA;IACpB,CAAC;IACD,OAAO,IAAI,OAAO,IAAI,MAAM,EAAE,CAAA;AAChC,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,CAAC,OAAuC,EAAE,IAAY,EAAU,EAAE;IACrF,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACjC,MAAM,MAAM,GAAG,WAAW,OAAO,6CAA6C,CAAA;IAC9E,MAAM,IAAI,YAAY,CAAC;QACrB,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE;KACnE,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA8D;IAC1F,mBAAmB,EAAE,wCAAwC;IAC7D,aAAa,EAAE,8BAA8B;IAC7C,oCAAoC,EAAE,6CAA6C;IACnF,eAAe,EAAE,sBAAsB;IACvC,mBAAmB,EAAE,wCAAwC;CAC9D,CAAA;AAmBD,mDAAmD;AACnD,MAAM,OAAO,GAAG,CAAC,OAA0B,EAAyB,EAAE,CAAC,CAAC;IACtE,QAAQ,EAAE,OAAO,EAAE,QAAQ;IAC3B,MAAM,EAAE,OAAO,EAAE,MAAM;CACxB,CAAC,CAAA;AAEF,+EAA+E;AAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAA;AAEpF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAA4B,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;AAE3F;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,KAAK,GAAkD,KAAK,CAAC,QAAQ,CAChF,kBAAkB,CAAC,KAAK,EAAE,EAC1B,QAAQ,EACR,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,EACrD,KAAK,CAAC,KAAK,EACX,eAAe,CAChB,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAiD,EAAE;IACrF,MAAM,cAAc,GAAG,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IACpD,OAAO,KAAK,CAAC,QAAQ,CACnB,kBAAkB,CAAC,KAAK,EAAE,EAC1B,QAAQ,EACR,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,EACrD,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,eAAe,CAChB,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,OAA0B,EACkD,EAAE;IAC9E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAC3B,aAAa,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EACzD,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CACtD,CAAA;IACD,OAAO,KAAK,CAAC,QAAQ,CACnB,kBAAkB,CAAC,KAAK,EAAE,EAC1B,QAAQ,EACR,eAAe;IACf,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAChD,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;AACnE,CAAC,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,IAAY,EACZ,OAA0B,EACkD,EAAE;IAC9E,MAAM,cAAc,GAAG,YAAY,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAA;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAC3B,aAAa,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EACzD,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CACtD,CAAA;IACD,OAAO,KAAK,CAAC,QAAQ,CACnB,kBAAkB,CAAC,KAAK,EAAE,EAC1B,QAAQ,EACR,eAAe,EACf,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,CAClE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;AACnE,CAAC,CAAA","sourcesContent":["/**\n * Aggregate Bun Host bundle.\n *\n * Runtime-specific dependencies stay inside this package; callers get the same\n * closed five-service Host surface every other bundle provides, plus native\n * `ProcessConfinement` for guarded commands.\n *\n * There is no Bun shell module: running a command is Effect's\n * `ChildProcessSpawner`, and `@effect/platform-bun`'s implementation is\n * `@effect/platform-node-shared`'s re-exported: the same code on both\n * runtimes, so no runtime detection is needed here.\n *\n * Outgoing HTTP uses the shared EgressHttpClient on both runtimes. Web\n * requests pin approved addresses; ordinary requests retain the shared pool.\n * Redirects remain visible to the capability kernel, and proxy routing follows\n * the host environment.\n *\n * The filesystem slot is `@smthrs/platform-node`'s `AtomicFileSystem`, byte for\n * byte the layer `NodeHost` uses, so a guarded path operation is\n * descriptor-relative and no-follow on both runtimes.\n *\n * @since 1.0.0-rc.0\n */\n\nimport * as BunChildProcessSpawner from \"@effect/platform-bun/BunChildProcessSpawner\"\nimport * as BunCrypto from \"@effect/platform-bun/BunCrypto\"\nimport * as BunPath from \"@effect/platform-bun/BunPath\"\nimport type { Jj, JjError } from \"@smthrs/jj\"\nimport * as BunJj from \"@smthrs/jj/bun/BunJj\"\nimport type { HostServiceIds } from \"@smthrs/kernel/HostServices\"\nimport type * as KernelProcessConfinement from \"@smthrs/kernel/ProcessConfinement\"\nimport type * as ProcessLedger from \"@smthrs/kernel/ProcessLedger\"\nimport * as AtomicFileSystem from \"@smthrs/platform-node/AtomicFileSystem\"\nimport * as EgressHttpClient from \"@smthrs/platform-node/EgressHttpClient\"\nimport * as HostLiveness from \"@smthrs/platform-node/HostLiveness\"\nimport * as ProcessConfinement from \"@smthrs/platform-node/ProcessConfinement\"\nimport * as ProcessReaper from \"@smthrs/platform-node/ProcessReaper\"\nimport type * as Crypto from \"effect/Crypto\"\nimport type { FileSystem } from \"effect/FileSystem\"\nimport type { HttpClient } from \"effect/http/HttpClient\"\nimport * as Layer from \"effect/Layer\"\nimport type * as Path from \"effect/Path\"\nimport type { ChildProcessSpawner } from \"effect/process/ChildProcessSpawner\"\nimport * as Schema from \"effect/Schema\"\nimport { isAbsolute } from \"node:path\"\nimport * as BunFileSystem from \"./BunFileSystem.ts\"\n\n/**\n * Bun platform modules for selectively providing individual services.\n *\n * `AtomicFileSystem` is here for the same reason `NodeHost` re-exports it: it\n * owns the only configuration escape hatch the filesystem slot has, and a Bun\n * program with a different packaged helper path needs to reach\n * `AtomicFileSystem.layerWith` without hand-composing the other four tags.\n *\n * `BunJj` is deliberately absent: it belongs to `@smthrs/jj` and is imported\n * from there, never re-exported here. So is `@effect/platform-bun/BunHttpClient`:\n * its `layer` follows redirects to origins the capability kernel never\n * authorized. The network slot on its own is {@link layerHttpClient}.\n *\n * @category re-exports\n * @since 1.0.0-rc.0\n * @slop\n */\nexport { AtomicFileSystem, BunChildProcessSpawner, BunCrypto, BunFileSystem, HostLiveness, ProcessReaper }\n\n/**\n * The complete closed Host service union provided by Bun.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport type BunHost =\n  | FileSystem\n  | Path.Path\n  | ChildProcessSpawner\n  | Jj\n  | HttpClient\n  | KernelProcessConfinement.ProcessConfinement\n\n/**\n * The stable codes a `BunHost` factory refuses with.\n *\n * A code is the contract a caller branches on; the message beside it is for a\n * person. `invalid_repository_root` is the root handed to {@link layerAt} or\n * {@link layerContainedAt} not being absolute, the empty string included.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type BunHostErrorCode = \"invalid_repository_root\"\n\n/**\n * The refusal a `BunHost` factory throws before it builds a layer.\n *\n * It is thrown rather than failed because a factory is called while a program\n * composes its layers, where there is no fiber to fail yet and a wrong root is\n * a composition mistake, not a runtime outcome. It is this package's class,\n * not the `Jj` adapter's, because a Bun caller composes `BunHost` and should\n * learn nothing about the adapter behind the `Jj` slot from an error message.\n *\n * @category errors\n * @since 1.0.0-rc.0\n */\nexport class BunHostError extends Schema.TaggedError<BunHostError>()(\"@smthrs/platform-bun/BunHostError\", {\n  code: Schema.Literal(\"invalid_repository_root\"),\n  message: Schema.String\n}) {\n  override readonly name = \"BunHostError\"\n}\n\n/** The longest message a factory refuses with, in UTF-16 code units. */\nconst messageLimit = 255\n\n/** How many code points of a refused root the message repeats at most. */\nconst previewLimit = 64\n\n/**\n * A bounded, quoted excerpt of a refused root that fits in `budget` code\n * units of the message.\n *\n * Counted in code points rather than UTF-16 units so a cut never splits a\n * surrogate pair, and passed through `JSON.stringify` so a newline in the root\n * cannot break the log line the message lands on. Each code point is encoded\n * on its own and admitted only while the quoted excerpt plus the length\n * suffix still fit, so a control character that widens to a `\\u0001` escape\n * shortens the excerpt instead of lengthening the message, and a cut never\n * lands inside an escape.\n */\nconst preview = (root: string, budget: number): string => {\n  const points = Array.from(root)\n  const whole = JSON.stringify(root)\n  if (points.length <= previewLimit && whole.length <= budget) return whole\n  const suffix = `... (${points.length} characters)`\n  const room = budget - suffix.length - 2\n  let excerpt = \"\"\n  for (const point of points.slice(0, previewLimit)) {\n    const encoded = JSON.stringify(point).slice(1, -1)\n    if (excerpt.length + encoded.length > room) break\n    excerpt += encoded\n  }\n  return `\"${excerpt}\"${suffix}`\n}\n\n/**\n * Refuses a root the `Jj` adapter underneath would refuse, here and in this\n * package's name.\n *\n * `BunJj.layerAt` and `BunJj.layerSpawnerAt` are `NodeJj`'s, and those throw a\n * bare `TypeError` that names `NodeJj`, carries no code, and echoes the whole\n * string. The predicate here is the same `isAbsolute` the adapter applies, so\n * a root that passes this check cannot reach that throw.\n */\nconst absoluteRoot = (factory: \"layerAt\" | \"layerContainedAt\", root: string): string => {\n  if (isAbsolute(root)) return root\n  const prefix = `BunHost.${factory} requires an absolute repository root, got `\n  throw new BunHostError({\n    code: \"invalid_repository_root\",\n    message: `${prefix}${preview(root, messageLimit - prefix.length)}`\n  })\n}\n\n/**\n * Stable implementation identities keyed by the closed Host service slots.\n *\n * Each value names the module behind that slot in the raw host bundle.\n * Contained POSIX factories replace the spawner with {@link ProcessReaper.layerSpawner}.\n * These are identity\n * tokens rather than import specifiers: the filesystem entry is\n * `@smthrs/platform-node/AtomicFileSystem` because that is the implementation,\n * even though a consumer reaches it through `@smthrs/platform-bun`.\n *\n * Nothing digests them yet. `@smthrs/plan`'s step key carries a `layers`\n * component these values are meant to feed, but no planner derives it from a\n * host bundle today, so changing one invalidates no cached step.\n *\n * The keys are written as literals rather than `HostServiceIds` positions so\n * that reordering the closed list cannot silently pair a slot with another\n * slot's implementation.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const implementationIds: Readonly<Record<(typeof HostServiceIds)[number], string>> = {\n  \"effect/FileSystem\": \"@smthrs/platform-node/AtomicFileSystem\",\n  \"effect/Path\": \"@effect/platform-bun/BunPath\",\n  \"effect/process/ChildProcessSpawner\": \"@effect/platform-bun/BunChildProcessSpawner\",\n  \"@smthrs/jj/Jj\": \"@smthrs/jj/bun/BunJj\",\n  \"effect/HttpClient\": \"@smthrs/platform-node/EgressHttpClient\"\n}\n\n/**\n * What a caller may configure about containment.\n *\n * `ContainedSpawner.Options.platform` is deliberately not part of it. It\n * decides one thing, whether a command that names no `detached` option gets a\n * process group of its own, and this native host detaches by `process.platform`\n * whatever a record claims. A\n * caller-supplied `\"win32\"` on a POSIX host would therefore record\n * `pgid: null` for a child that really does lead a group, and\n * {@link ProcessReaper.reap} would retire that record as `no-group` and leave\n * the orphan running forever: a durable lie rather than a compile error.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type ContainedOptions = ProcessReaper.SpawnerOptions & ProcessReaper.Options\n\n/** The reaper half of {@link ContainedOptions}. */\nconst reaping = (options?: ContainedOptions): ProcessReaper.Options => ({\n  ownerPid: options?.ownerPid,\n  system: options?.system\n})\n\n/** The two services `BunChildProcessSpawner` resolves paths and files with. */\nconst platform = Layer.mergeAll(BunFileSystem.layer, BunPath.layer, BunCrypto.layer)\n\n/**\n * The network slot on its own: the shared egress client, which never follows a\n * redirect. A `3xx` comes back to the caller with its `location` intact and the\n * second origin uncontacted; following a redirect is `@smthrs/kernel`'s guarded\n * `HttpClient.layer`, which rechecks every hop.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerHttpClient: Layer.Layer<HttpClient> = EgressHttpClient.layer(process.env)\n\n/**\n * Provides all five Bun Host services, including the runtime-independent Path\n * service.\n *\n * Fails at construction with {@link JjError} carrying `not_installed` or\n * `unsupported_version`: the `Jj` slot is merged eagerly and probes\n * `jj --version` while the layer is built, before the program body runs and\n * whether or not the program asks for `Jj`. Requires jj 0.39.0 or later.\n *\n * @category layers\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const layer: Layer.Layer<BunHost | Crypto.Crypto, JjError> = Layer.mergeAll(\n  ProcessConfinement.layer(),\n  platform,\n  Layer.provide(BunChildProcessSpawner.layer, platform),\n  BunJj.layer,\n  layerHttpClient\n)\n\n/**\n * Provides all five Bun Host services bound to one absolute repository root.\n *\n * Throws {@link BunHostError} with code `invalid_repository_root` when `root`\n * is not absolute; the empty string counts. The check runs when the factory is\n * called, before any layer exists.\n *\n * Fails at construction with {@link JjError} exactly as {@link layer} does:\n * the `Jj` slot probes `jj --version` while the layer is built.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerAt = (root: string): Layer.Layer<BunHost | Crypto.Crypto, JjError> => {\n  const repositoryRoot = absoluteRoot(\"layerAt\", root)\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    Layer.provide(BunChildProcessSpawner.layer, platform),\n    BunJj.layerAt(repositoryRoot),\n    layerHttpClient\n  )\n}\n\n/**\n * Provides the Bun host with process containment turned on.\n *\n * Bun uses the same prepared native process lifecycle as Node on POSIX, while\n * preserving its underlying runtime spawner on Windows. `ContainedSpawner` gives\n * every child an escalation deadline and a ledger entry, and\n * `ProcessReaper` sweeps the entries a crashed incarnation of this host left\n * behind. The reaper module lives in `@smthrs/platform-node` because the calls\n * it makes, `process.kill` and `taskkill`, are Node's, and Bun implements\n * them unchanged.\n *\n * Fails at construction with {@link JjError} exactly as {@link layer} does;\n * here the `jj --version` probe runs through the contained spawner, so its\n * record enters and leaves the ledger like any other child.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerContained = (\n  options?: ContainedOptions\n): Layer.Layer<BunHost | Crypto.Crypto, JjError, ProcessLedger.ProcessLedger> => {\n  const spawner = Layer.provide(\n    ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),\n    Layer.provide(BunChildProcessSpawner.layer, platform)\n  )\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    layerHttpClient,\n    // jj goes through the CONTAINED spawner here, not around it, exactly as in\n    // `NodeHost.layerContained`: a jj child that starts its own process leads\n    // no recorded group, is in no ledger, and outlives the host that ran it.\n    Layer.provideMerge(BunJj.layerSpawner, spawner)\n  ).pipe(Layer.provideMerge(ProcessReaper.layer(reaping(options))))\n}\n\n/**\n * Provides the contained Bun host bound to one absolute repository root.\n *\n * Refuses a root exactly as {@link layerAt} does: {@link BunHostError} with\n * code `invalid_repository_root`, thrown when the factory is called.\n * Fails at construction with {@link JjError} exactly as {@link layerContained}\n * does.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerContainedAt = (\n  root: string,\n  options?: ContainedOptions\n): Layer.Layer<BunHost | Crypto.Crypto, JjError, ProcessLedger.ProcessLedger> => {\n  const repositoryRoot = absoluteRoot(\"layerContainedAt\", root)\n  const spawner = Layer.provide(\n    ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),\n    Layer.provide(BunChildProcessSpawner.layer, platform)\n  )\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    layerHttpClient,\n    Layer.provideMerge(BunJj.layerSpawnerAt(repositoryRoot), spawner)\n  ).pipe(Layer.provideMerge(ProcessReaper.layer(reaping(options))))\n}\n"]}
+{"version":3,"file":"BunHost.js","sourceRoot":"","sources":["../../src/BunHost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,sBAAsB,MAAM,6CAA6C,CAAA;AACrF,OAAO,KAAK,SAAS,MAAM,gCAAgC,CAAA;AAC3D,OAAO,KAAK,OAAO,MAAM,8BAA8B,CAAA;AAEvD,OAAO,KAAK,KAAK,MAAM,sBAAsB,CAAA;AAI7C,OAAO,KAAK,gBAAgB,MAAM,wCAAwC,CAAA;AAC1E,OAAO,KAAK,gBAAgB,MAAM,wCAAwC,CAAA;AAC1E,OAAO,KAAK,YAAY,MAAM,oCAAoC,CAAA;AAClE,OAAO,KAAK,kBAAkB,MAAM,0CAA0C,CAAA;AAC9E,OAAO,KAAK,aAAa,MAAM,qCAAqC,CAAA;AAIpE,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAGrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,CAAA;AA8B1G;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,WAAW,EAAgB,CAAC,mCAAmC,EAAE;IACxG,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;IACkB,IAAI,GAAG,cAAc,CAAA;CACxC;AAED,wEAAwE;AACxE,MAAM,YAAY,GAAG,GAAG,CAAA;AAExB,0EAA0E;AAC1E,MAAM,YAAY,GAAG,EAAE,CAAA;AAEvB;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,MAAc,EAAU,EAAE;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,MAAM,CAAC,MAAM,IAAI,YAAY,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM;QAAE,OAAO,KAAK,CAAA;IACzE,MAAM,MAAM,GAAG,QAAQ,MAAM,CAAC,MAAM,cAAc,CAAA;IAClD,MAAM,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;IACvC,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAClD,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI;YAAE,MAAK;QACjD,OAAO,IAAI,OAAO,CAAA;IACpB,CAAC;IACD,OAAO,IAAI,OAAO,IAAI,MAAM,EAAE,CAAA;AAChC,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,YAAY,GAAG,CAAC,OAAuC,EAAE,IAAY,EAAU,EAAE;IACrF,gFAAgF;IAChF,MAAM,WAAW,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QACnC,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACrB,CAAC,CAAC,+BAA+B;YACjC,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAC1C,MAAM,MAAM,GAAG,WAAW,OAAO,aAAa,WAAW,QAAQ,CAAA;IACjE,MAAM,IAAI,YAAY,CAAC;QACrB,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE;KACnE,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA8D;IAC1F,mBAAmB,EAAE,wCAAwC;IAC7D,aAAa,EAAE,8BAA8B;IAC7C,oCAAoC,EAAE,6CAA6C;IACnF,eAAe,EAAE,sBAAsB;IACvC,mBAAmB,EAAE,wCAAwC;CAC9D,CAAA;AAmBD,mDAAmD;AACnD,MAAM,OAAO,GAAG,CAAC,OAA0B,EAAyB,EAAE,CAAC,CAAC;IACtE,QAAQ,EAAE,OAAO,EAAE,QAAQ;IAC3B,MAAM,EAAE,OAAO,EAAE,MAAM;CACxB,CAAC,CAAA;AAEF,+EAA+E;AAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAA;AAEpF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAA4B,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;AAE3F;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,KAAK,GAAyC,KAAK,CAAC,QAAQ,CACvE,kBAAkB,CAAC,KAAK,EAAE,EAC1B,QAAQ,EACR,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,EACrD,KAAK,CAAC,KAAK,EACX,eAAe,CAChB,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAwC,EAAE;IAC5E,MAAM,cAAc,GAAG,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IACpD,OAAO,KAAK,CAAC,QAAQ,CACnB,kBAAkB,CAAC,KAAK,EAAE,EAC1B,QAAQ,EACR,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,EACrD,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,eAAe,CAChB,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,OAA0B,EACgD,EAAE;IAC5E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAC3B,aAAa,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EACzD,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CACtD,CAAA;IACD,OAAO,KAAK,CAAC,QAAQ,CACnB,kBAAkB,CAAC,KAAK,EAAE,EAC1B,QAAQ,EACR,eAAe;IACf,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAChD,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;AACnE,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,IAAY,EACZ,OAA0B,EACgD,EAAE;IAC5E,MAAM,cAAc,GAAG,YAAY,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAA;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAC3B,aAAa,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EACzD,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CACtD,CAAA;IACD,OAAO,KAAK,CAAC,QAAQ,CACnB,kBAAkB,CAAC,KAAK,EAAE,EAC1B,QAAQ,EACR,eAAe,EACf,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,CAClE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;AACnE,CAAC,CAAA","sourcesContent":["/**\n * Aggregate Bun Host bundle.\n *\n * Runtime-specific dependencies stay inside this package; callers get the same\n * closed five-service Host surface every other bundle provides, plus native\n * `ProcessConfinement` for guarded commands.\n *\n * There is no Bun shell module: running a command is Effect's\n * `ChildProcessSpawner`, and `@effect/platform-bun`'s implementation is\n * `@effect/platform-node-shared`'s re-exported: the same code on both\n * runtimes, so no runtime detection is needed here.\n *\n * Outgoing HTTP uses the shared EgressHttpClient on both runtimes. Web\n * requests pin approved addresses; ordinary requests retain the shared pool.\n * Redirects remain visible to the capability kernel, and proxy routing follows\n * the host environment.\n *\n * The filesystem slot is `@smthrs/platform-node`'s `AtomicFileSystem`, byte for\n * byte the layer `NodeHost` uses, so a guarded path operation is\n * descriptor-relative and no-follow on both runtimes.\n *\n * @since 1.0.0-rc.0\n */\n\nimport * as BunChildProcessSpawner from \"@effect/platform-bun/BunChildProcessSpawner\"\nimport * as BunCrypto from \"@effect/platform-bun/BunCrypto\"\nimport * as BunPath from \"@effect/platform-bun/BunPath\"\nimport type { Jj } from \"@smthrs/jj\"\nimport * as BunJj from \"@smthrs/jj/bun/BunJj\"\nimport type { HostServiceIds } from \"@smthrs/kernel/HostServices\"\nimport type * as KernelProcessConfinement from \"@smthrs/kernel/ProcessConfinement\"\nimport type * as ProcessLedger from \"@smthrs/kernel/ProcessLedger\"\nimport * as AtomicFileSystem from \"@smthrs/platform-node/AtomicFileSystem\"\nimport * as EgressHttpClient from \"@smthrs/platform-node/EgressHttpClient\"\nimport * as HostLiveness from \"@smthrs/platform-node/HostLiveness\"\nimport * as ProcessConfinement from \"@smthrs/platform-node/ProcessConfinement\"\nimport * as ProcessReaper from \"@smthrs/platform-node/ProcessReaper\"\nimport type * as Crypto from \"effect/Crypto\"\nimport type { FileSystem } from \"effect/FileSystem\"\nimport type { HttpClient } from \"effect/http/HttpClient\"\nimport * as Layer from \"effect/Layer\"\nimport type * as Path from \"effect/Path\"\nimport type { ChildProcessSpawner } from \"effect/process/ChildProcessSpawner\"\nimport * as Schema from \"effect/Schema\"\nimport { isAbsolute } from \"node:path\"\nimport * as BunFileSystem from \"./BunFileSystem.ts\"\n\n/**\n * Bun platform modules for selectively providing individual services.\n *\n * `AtomicFileSystem` is here for the same reason `NodeHost` re-exports it: it\n * owns the only configuration escape hatch the filesystem slot has, and a Bun\n * program with a different packaged helper path needs to reach\n * `AtomicFileSystem.layerWith` without hand-composing the other four tags.\n *\n * `BunJj` is deliberately absent: it belongs to `@smthrs/jj` and is imported\n * from there, never re-exported here. So is `@effect/platform-bun/BunHttpClient`:\n * its `layer` follows redirects to origins the capability kernel never\n * authorized. The network slot on its own is {@link layerHttpClient}.\n *\n * @category re-exports\n * @since 1.0.0-rc.0\n * @slop\n */\nexport { AtomicFileSystem, BunChildProcessSpawner, BunCrypto, BunFileSystem, HostLiveness, ProcessReaper }\n\n/**\n * The complete closed Host service union provided by Bun.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport type BunHost =\n  | FileSystem\n  | Path.Path\n  | ChildProcessSpawner\n  | Jj\n  | HttpClient\n  | KernelProcessConfinement.ProcessConfinement\n\n/**\n * The stable codes a `BunHost` factory refuses with.\n *\n * A code is the contract a caller branches on; the message beside it is for a\n * person. `invalid_repository_root` is the root handed to {@link layerAt} or\n * {@link layerContainedAt} not being absolute or containing NUL, the empty\n * string included.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type BunHostErrorCode = \"invalid_repository_root\"\n\n/**\n * The refusal a `BunHost` factory throws before it builds a layer.\n *\n * It is thrown rather than failed because a factory is called while a program\n * composes its layers, where there is no fiber to fail yet and a wrong root is\n * a composition mistake, not a runtime outcome. It is this package's class,\n * not the `Jj` adapter's, because a Bun caller composes `BunHost` and should\n * learn nothing about the adapter behind the `Jj` slot from an error message.\n *\n * @category errors\n * @since 1.0.0-rc.0\n */\nexport class BunHostError extends Schema.TaggedError<BunHostError>()(\"@smthrs/platform-bun/BunHostError\", {\n  code: Schema.Literal(\"invalid_repository_root\"),\n  message: Schema.String\n}) {\n  override readonly name = \"BunHostError\"\n}\n\n/** The longest message a factory refuses with, in UTF-16 code units. */\nconst messageLimit = 255\n\n/** How many code points of a refused root the message repeats at most. */\nconst previewLimit = 64\n\n/**\n * A bounded, quoted excerpt of a refused root that fits in `budget` code\n * units of the message.\n *\n * Counted in code points rather than UTF-16 units so a cut never splits a\n * surrogate pair, and passed through `JSON.stringify` so a newline in the root\n * cannot break the log line the message lands on. Each code point is encoded\n * on its own and admitted only while the quoted excerpt plus the length\n * suffix still fit, so a control character that widens to a `\\u0001` escape\n * shortens the excerpt instead of lengthening the message, and a cut never\n * lands inside an escape.\n */\nconst preview = (root: string, budget: number): string => {\n  const points = Array.from(root)\n  const whole = JSON.stringify(root)\n  if (points.length <= previewLimit && whole.length <= budget) return whole\n  const suffix = `... (${points.length} characters)`\n  const room = budget - suffix.length - 2\n  let excerpt = \"\"\n  for (const point of points.slice(0, previewLimit)) {\n    const encoded = JSON.stringify(point).slice(1, -1)\n    if (excerpt.length + encoded.length > room) break\n    excerpt += encoded\n  }\n  return `\"${excerpt}\"${suffix}`\n}\n\n/**\n * Refuses a root the `Jj` adapter underneath would refuse, here and in this\n * package's name.\n *\n * `BunJj.layerAt` and `BunJj.layerSpawnerAt` are `NodeJj`'s, and those throw a\n * bare `TypeError` that names `NodeJj`, carries no code, and echoes the whole\n * string. The predicate includes the same `isAbsolute` the adapter applies, so\n * a root that passes this check cannot reach that throw. An absolute root\n * containing NUL is refused too: no filesystem or process API can represent it.\n */\nconst absoluteRoot = (factory: \"layerAt\" | \"layerContainedAt\", root: string): string => {\n  // An absolute root with NUL names that defect, not absoluteness it already has.\n  const requirement = !isAbsolute(root)\n    ? \"an absolute repository root\"\n    : root.includes(\"\\0\")\n    ? \"a repository root without NUL\"\n    : undefined\n  if (requirement === undefined) return root\n  const prefix = `BunHost.${factory} requires ${requirement}, got `\n  throw new BunHostError({\n    code: \"invalid_repository_root\",\n    message: `${prefix}${preview(root, messageLimit - prefix.length)}`\n  })\n}\n\n/**\n * Stable implementation identities keyed by the closed Host service slots.\n *\n * Each value names the module behind that slot in the raw host bundle.\n * Contained POSIX factories replace the spawner with {@link ProcessReaper.layerSpawner}.\n * These are identity\n * tokens rather than import specifiers: the filesystem entry is\n * `@smthrs/platform-node/AtomicFileSystem` because that is the implementation,\n * even though a consumer reaches it through `@smthrs/platform-bun`.\n *\n * Nothing digests them yet. `@smthrs/plan`'s step key carries a `layers`\n * component these values are meant to feed, but no planner derives it from a\n * host bundle today, so changing one invalidates no cached step.\n *\n * The keys are written as literals rather than `HostServiceIds` positions so\n * that reordering the closed list cannot silently pair a slot with another\n * slot's implementation.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const implementationIds: Readonly<Record<(typeof HostServiceIds)[number], string>> = {\n  \"effect/FileSystem\": \"@smthrs/platform-node/AtomicFileSystem\",\n  \"effect/Path\": \"@effect/platform-bun/BunPath\",\n  \"effect/process/ChildProcessSpawner\": \"@effect/platform-bun/BunChildProcessSpawner\",\n  \"@smthrs/jj/Jj\": \"@smthrs/jj/bun/BunJj\",\n  \"effect/HttpClient\": \"@smthrs/platform-node/EgressHttpClient\"\n}\n\n/**\n * What a caller may configure about containment.\n *\n * `ContainedSpawner.Options.platform` is deliberately not part of it. It\n * decides one thing, whether a command that names no `detached` option gets a\n * process group of its own, and this native host detaches by `process.platform`\n * whatever a record claims. A\n * caller-supplied `\"win32\"` on a POSIX host would therefore record\n * `pgid: null` for a child that really does lead a group, and\n * {@link ProcessReaper.reap} would retire that record as `no-group` and leave\n * the orphan running forever: a durable lie rather than a compile error.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type ContainedOptions = ProcessReaper.SpawnerOptions & ProcessReaper.Options\n\n/** The reaper half of {@link ContainedOptions}. */\nconst reaping = (options?: ContainedOptions): ProcessReaper.Options => ({\n  ownerPid: options?.ownerPid,\n  system: options?.system\n})\n\n/** The two services `BunChildProcessSpawner` resolves paths and files with. */\nconst platform = Layer.mergeAll(BunFileSystem.layer, BunPath.layer, BunCrypto.layer)\n\n/**\n * The network slot on its own: the shared egress client, which never follows a\n * redirect. A `3xx` comes back to the caller with its `location` intact and the\n * second origin uncontacted; following a redirect is `@smthrs/kernel`'s guarded\n * `HttpClient.layer`, which rechecks every hop.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerHttpClient: Layer.Layer<HttpClient> = EgressHttpClient.layer(process.env)\n\n/**\n * Provides all five Bun Host services, including the runtime-independent Path\n * service.\n *\n * Builds on a host without jj. The `Jj` slot probes `jj --version` on its\n * first operation and fails that operation with `JjError` carrying\n * `not_installed` or `unsupported_version`; a program that never calls `Jj`\n * runs without jj. `Jj` requires jj 0.39.0 or later.\n *\n * @category layers\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const layer: Layer.Layer<BunHost | Crypto.Crypto> = Layer.mergeAll(\n  ProcessConfinement.layer(),\n  platform,\n  Layer.provide(BunChildProcessSpawner.layer, platform),\n  BunJj.layer,\n  layerHttpClient\n)\n\n/**\n * Provides all five Bun Host services bound to one absolute repository root.\n *\n * Throws {@link BunHostError} with code `invalid_repository_root` when `root`\n * is not absolute or contains NUL; the empty string counts. The check runs\n * when the factory is called, before any layer exists.\n *\n * Builds without jj exactly as {@link layer} does: the `Jj` slot probes\n * `jj --version` on its first operation.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerAt = (root: string): Layer.Layer<BunHost | Crypto.Crypto> => {\n  const repositoryRoot = absoluteRoot(\"layerAt\", root)\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    Layer.provide(BunChildProcessSpawner.layer, platform),\n    BunJj.layerAt(repositoryRoot),\n    layerHttpClient\n  )\n}\n\n/**\n * Provides the Bun host with process containment turned on.\n *\n * Bun uses the same prepared native process lifecycle as Node on POSIX, while\n * preserving its underlying runtime spawner on Windows. `ContainedSpawner` gives\n * every child an escalation deadline and a ledger entry, and\n * `ProcessReaper` sweeps the entries a crashed incarnation of this host left\n * behind. The reaper module lives in `@smthrs/platform-node` because the calls\n * it makes, `process.kill` and `taskkill`, are Node's, and Bun implements\n * them unchanged.\n *\n * Builds without jj exactly as {@link layer} does; here the first\n * operation's `jj --version` probe runs through the contained spawner, so its\n * record enters and leaves the ledger like any other child.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerContained = (\n  options?: ContainedOptions\n): Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger> => {\n  const spawner = Layer.provide(\n    ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),\n    Layer.provide(BunChildProcessSpawner.layer, platform)\n  )\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    layerHttpClient,\n    // jj goes through the CONTAINED spawner here, not around it, exactly as in\n    // `NodeHost.layerContained`: a jj child that starts its own process leads\n    // no recorded group, is in no ledger, and outlives the host that ran it.\n    Layer.provideMerge(BunJj.layerSpawner, spawner)\n  ).pipe(Layer.provideMerge(ProcessReaper.layer(reaping(options))))\n}\n\n/**\n * Provides the contained Bun host bound to one absolute repository root.\n *\n * Refuses a root exactly as {@link layerAt} does: {@link BunHostError} with\n * code `invalid_repository_root`, thrown when the factory is called.\n * Builds without jj exactly as {@link layerContained} does.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerContainedAt = (\n  root: string,\n  options?: ContainedOptions\n): Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger> => {\n  const repositoryRoot = absoluteRoot(\"layerContainedAt\", root)\n  const spawner = Layer.provide(\n    ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),\n    Layer.provide(BunChildProcessSpawner.layer, platform)\n  )\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    layerHttpClient,\n    Layer.provideMerge(BunJj.layerSpawnerAt(repositoryRoot), spawner)\n  ).pipe(Layer.provideMerge(ProcessReaper.layer(reaping(options))))\n}\n"]}

package/docs/README.md

@@ -37,13 +37,16 @@ is Effect's Node spawner re-exported; contained POSIX variants use
 
 ## Install
 
-Not on npm yet; see [Installation](https://github.com/smithersai/smithers/blob/main/packages/smithers/flows/flow/docs/installation.md#use-the-libraries).
+```bash
+bun add @smthrs/platform-bun@1.0.0-rc.9 effect
+```
 
 `effect` is a required peer in the range `^4.0.4`. `@effect/platform-bun` is
-bundled privately, built from `effect@4.0.4`. The filesystem slot
-also needs the `smithers-jj-export` helper, and every complete bundle needs
-jj 0.39.0 or later because it probes jj while the layer is built.
-[Installation](./installation.md) covers all three and the import forms.
+bundled privately, built from `effect@4.0.4`. The filesystem slot runs the
+`smithers-jj-export` helper that the required peer `@smthrs/platform-node`
+ships. The `Jj` slot needs jj 0.39.0 or later, checked on its first operation;
+every bundle builds without jj. [Installation](./installation.md) covers all
+three and the import forms.
 
 ## Run a command and a file operation through the host
 
@@ -107,8 +110,8 @@ that runs them is yours, and this package when that program runs on Bun.
 
 ## Where to go next
 
-- [Installation](./installation.md): the peer dependency, the
-  `smithers-jj-export` helper, the supported runtimes, and the import forms.
+- [Installation](./installation.md): the install line, the peer dependencies,
+  the `smithers-jj-export` helper, the supported runtimes, and the import forms.
 - [Quickstart](./quickstart.md): the program above, run twice, the second time
   with containment on and a child visible in the ledger.
 - [The Host surface on Bun](./concepts/host-surface.md): what each of the five

package/docs/api.md

@@ -27,13 +27,13 @@ a browser; a page composes
 [`@smthrs/platform-browser`](/api/platform-browser) instead.
 :::
 
-The complete host bundles require jj 0.39.0 or newer. Each bundle checks its jj
-executable before exposing repository operations. Construction can fail with
-`JjError`, including `not_installed` or `unsupported_version`. The contained
-bundles route that probe
-through their process spawner and retire its ledger entry when it exits. Probe
-results are cached per resolved absolute executable path and runner; contained
-spawners share a result only within the same spawner instance.
+Every host bundle builds without jj. The `Jj` slot requires jj 0.39.0 or newer
+and checks its executable on its first operation, which fails with `JjError`
+`not_installed` or `unsupported_version` when jj is missing or older. The
+contained bundles route that probe through their process spawner and retire its
+ledger entry when it exits. Probe results are cached per resolved absolute
+executable path and runner; contained spawners share a result only within the
+same spawner instance.
 
 ## Entry points
 
@@ -52,24 +52,24 @@ Supported runtimes are Bun >=1.4.0 and Node.js >=26.4.0.
 
 ## BunHost
 
-The complete closed Host bundle: layers, construction errors, models,
+The complete closed Host bundle: layers, root errors, models,
 implementation identities, and platform module re-exports.
 
 ### Layers
 
-| Export             | Signature                                                                                                     |
-| ------------------ | ------------------------------------------------------------------------------------------------------------- |
-| `layer`            | `Layer.Layer<BunHost \| Crypto.Crypto, JjError>`                                                              |
-| `layerAt`          | `(root: string) => Layer.Layer<BunHost \| Crypto.Crypto, JjError>`                                            |
-| `layerContained`   | `(options?: ContainedOptions) => Layer.Layer<BunHost \| Crypto.Crypto, JjError, ProcessLedger>`               |
-| `layerContainedAt` | `(root: string, options?: ContainedOptions) => Layer.Layer<BunHost \| Crypto.Crypto, JjError, ProcessLedger>` |
-| `layerHttpClient`  | `Layer.Layer<HttpClient>`                                                                                     |
+| Export             | Signature                                                                                                   |
+| ------------------ | ----------------------------------------------------------------------------------------------------------- |
+| `layer`            | `Layer.Layer<BunHost \| Crypto.Crypto>`                                                                     |
+| `layerAt`          | `(root: string) => Layer.Layer<BunHost \| Crypto.Crypto>`                                                   |
+| `layerContained`   | `(options?: ContainedOptions) => Layer.Layer<BunHost \| Crypto.Crypto, never, ProcessLedger>`               |
+| `layerContainedAt` | `(root: string, options?: ContainedOptions) => Layer.Layer<BunHost \| Crypto.Crypto, never, ProcessLedger>` |
+| `layerHttpClient`  | `Layer.Layer<HttpClient>`                                                                                   |
 
 `layer` provides all five Host services, including the runtime-independent
 `Path`. `Jj` is bound to the process working directory.
 
 `layerAt` is `layer` with `Jj` bound to `root` instead. `root` must be an
-absolute path; see [BunHostError](#bunhosterror).
+absolute path without NUL; see [BunHostError](#bunhosterror).
 
 `layerContained` is `layer` with process containment turned on: every child is
 spawned through `@smthrs/kernel`'s `ContainedSpawner` with
@@ -117,10 +117,10 @@ type BunHostErrorCode = "invalid_repository_root"
 ```
 
 The refusal `layerAt` and `layerContainedAt` throw when `root` is not absolute,
-the empty string included. It is thrown rather than failed because a factory
-runs while a program composes its layers, where there is no fiber to fail into
-and a wrong root is a composition mistake, not a runtime outcome. The check
-runs when the factory is called, before any layer exists.
+the empty string included, or contains NUL. It is thrown rather than failed
+because a factory runs while a program composes its layers, where there is no
+fiber to fail into and a wrong root is a composition mistake, not a runtime
+outcome. The check runs when the factory is called, before any layer exists.
 
 It is this package's class rather than the `Jj` adapter's: a Bun caller
 composed `BunHost` and should learn nothing about the adapter behind the `Jj`

package/docs/guides/bind-a-repository-root.md

@@ -42,8 +42,8 @@ BunHost.layerContainedAt("/srv/repositories/app", { graceMs: 2_000 })
 
 ## Pass an absolute root
 
-Both factories require an absolute path. A relative root, and the empty string,
-are refused:
+Both factories require an absolute path without NUL. A relative root, the
+empty string, and an absolute root containing NUL are refused:
 
 ```ts
 BunHost.layerAt("repositories/app")

package/docs/guides/configure-the-filesystem-helper.md

@@ -9,20 +9,17 @@ the `smithers-jj-export` helper the adapter spawns, which is what makes the
 operation descriptor-relative and no-follow: a symlink swapped in after
 authorization cannot redirect it somewhere else.
 
-The adapter uses the first of `executable`, `SMITHERS_WORKSPACE_JJ_EXPORT_BINARY`,
-the package's `bin/<platform>-<arch>/smithers-jj-export`, a source checkout's
+The required peer `@smthrs/platform-node` ships the helper for macOS (arm64,
+x64), Linux (arm64, x64), and Windows (x64), so an npm or Bun install needs no
+configuration. The adapter uses the first of `executable`,
+`SMITHERS_WORKSPACE_JJ_EXPORT_BINARY`, that package's
+`bin/<platform>-<arch>/smithers-jj-export`, a source checkout's
 `target/release` or `target/debug` build, and
 `/usr/local/bin/smithers-jj-export`. It never searches `PATH`.
 
-## Build or name the helper
+## Name another helper
 
-In a source checkout:
-
-```bash
-cargo build --locked --release -p smithers-ffi --bin smithers-jj-export
-```
-
-Anywhere else, set the absolute path:
+To run a different helper, set the absolute path:
 
 ```bash
 export SMITHERS_WORKSPACE_JJ_EXPORT_BINARY=/opt/smithers/bin/smithers-jj-export
@@ -40,6 +37,13 @@ The executable is re-validated on every request rather than read once when the
 layer is built, because the file a path names can be replaced while the host
 runs.
 
+A source checkout of the Smithers repository has no packaged helper; build one
+there with:
+
+```bash
+cargo build --locked --release -p smithers-ffi --bin smithers-jj-export
+```
+
 ## Use it as the whole host's filesystem slot
 
 `BunHost.layer` builds its filesystem slot from `BunFileSystem.layer`, which

package/docs/guides/contain-child-processes.md

@@ -130,16 +130,18 @@ const status = Effect.flatMap(Jj, (jj) => jj.status()).pipe(
 ```
 
 That is the observable difference: the same call under `BunHost.layer` leaves
-the ledger empty. The initial `jj --version` probe uses the selected runner
-too, so a contained host records and retires it before exposing `Jj`. Probe
-results are cached per resolved absolute executable path and runner, with a
-separate cache for each spawner instance.
-
-Every aggregate host waits up to 5000 ms for the startup probe, then interrupts
-it and awaits process cleanup. The typed `JjError` has `method: "version"`,
-`code: "unknown"`, `cause.code: "ETIMEDOUT"`, and the executable path in its
-command and message. Cleanup can add the contained spawner's shutdown grace
-period to the startup budget. Raw hosts close the probe's pipes and kill its
+the ledger empty. The `jj --version` probe that the first `Jj` operation runs
+uses the selected runner too, so a contained host records and retires it like
+any other child. Building the host spawns nothing. Probe results are cached per
+resolved absolute executable path and runner, with a separate cache for each
+spawner instance.
+
+The first `Jj` operation on every aggregate host waits up to 5000 ms for the
+version probe, then interrupts it and awaits process cleanup. A probe that misses this budget, or that the
+spawner was too busy to start in time, is retried once. A second timeout fails
+the operation with a typed `JjError` that has `method: "version"`, `code: "unknown"`,
+`cause.code: "ETIMEDOUT"`, and the executable path in its command and message.
+Cleanup can add the contained spawner's shutdown grace period to each attempt. Raw hosts close the probe's pipes and kill its
 direct child; they do not add a ledger entry.
 
 Override the budget per host layer through the shared Node and Bun adapter:
@@ -153,7 +155,7 @@ const boundedHost = host.pipe(
 ```
 
 The budget is a positive, finite number of milliseconds, at most 2147483647.
-Timeout and interruption allow a later construction to retry the probe.
+Timeout and interruption allow the next operation to retry the probe.
 
 ## What the reaper refuses to kill
 

package/docs/installation.md

@@ -1,30 +1,35 @@
 ---
 title: "Installation"
-description: "Install @smthrs/platform-bun, its required peers, the smithers-jj-export helper the filesystem slot needs, the jj executable every complete bundle probes at startup, and the import forms for each entry point."
+description: "Install @smthrs/platform-bun from npm with its required peers, the smithers-jj-export helper @smthrs/platform-node ships for the filesystem slot, the jj executable the Jj slot probes on first use, and the import forms for each entry point."
 sidebar:
   order: 1
 ---
 
 ## Install the package and its peers
 
-Not on npm yet; see [Installation](https://github.com/smithersai/smithers/blob/main/packages/smithers/flows/flow/docs/installation.md#use-the-libraries).
+The package is on npm under the `next` tag, which carries the 1.0 release
+candidates. Install the current candidate with Bun:
 
-Version 1.0.0-rc.0 is not on npm yet. Until it is published, take the package
-from [the repository](https://github.com/smithersai/smithers); the rest of this
-page applies either way.
+```bash
+bun add @smthrs/platform-bun@1.0.0-rc.9 effect @smthrs/kernel@1.0.0-rc.9
+```
+
+`@smthrs/kernel` is on the line because the [Quickstart](./quickstart.md)'s
+`contained.ts` imports its `ProcessLedger`, which the contained bundles require.
+Bun's isolated linker and pnpm link only the packages a project declares.
 
 The manifest declares two required peers, neither optional:
 
-| Peer                    | Version      | Why                                                       |
-| ----------------------- | ------------ | --------------------------------------------------------- |
-| `effect`                | `^4.0.4`     | The runtime every service tag belongs to.                 |
-| `@smthrs/platform-node` | `1.0.0-rc.0` | The atomic filesystem slot and the containment machinery. |
+| Peer                    | Version                        | Why                                                       |
+| ----------------------- | ------------------------------ | --------------------------------------------------------- |
+| `effect`                | `^4.0.4`                       | The runtime every service tag belongs to.                 |
+| `@smthrs/platform-node` | exactly this package's version | The atomic filesystem slot and the containment machinery. |
 
-Package managers that resolve required peers install both automatically.
-Install one `effect` in that range so the host shares one Effect runtime.
-`@effect/platform-bun`, `@effect/platform-node` and
-`@effect/platform-node-shared` are bundled privately, built from
-`effect@4.0.4`.
+Bun installs required peers, so the line above also installs
+`@smthrs/platform-node` at the matching version. Install one `effect` in the
+peer range so the host shares one Effect runtime. `@effect/platform-bun`,
+`@effect/platform-node` and `@effect/platform-node-shared` are bundled
+privately, built from `effect@4.0.4`, so your project installs none of them.
 
 ## Supported runtimes
 
@@ -34,32 +39,31 @@ Bun 1.4.0 or later, and Node.js 26.4.0 or later. Both are declared in
 [Runtime parity with Node](./concepts/runtime-parity.md) for what that does and
 does not buy you.
 
-## Install the filesystem helper
+## The filesystem helper
 
 The filesystem slot is `@smthrs/platform-node`'s `AtomicFileSystem`, which
 carries the kernel's atomic host extension. That extension does not run
 in-process: it executes each guarded path operation through the
 `smithers-jj-export` helper so the operation is descriptor-relative and
-no-follow. From a source checkout, build it with:
-
-```bash
-cargo build --locked --release -p smithers-ffi --bin smithers-jj-export
-```
+no-follow.
 
-Elsewhere, set `SMITHERS_WORKSPACE_JJ_EXPORT_BINARY` to its absolute path; see
+`@smthrs/platform-node` ships the helper prebuilt for macOS (arm64, x64), Linux
+(arm64, x64), and Windows (x64), so installing the package installs it; there
+is nothing to build. `SMITHERS_WORKSPACE_JJ_EXPORT_BINARY` only overrides the
+packaged helper with another absolute path; see
 [Configure the filesystem helper](./guides/configure-the-filesystem-helper.md).
 
 Windows is unsupported for this slot.
 
-## Install Jujutsu for the complete bundles
+## Install Jujutsu for the Jj slot
 
-Every complete bundle, `BunHost.layer`, `layerAt`, `layerContained`, and
-`layerContainedAt`, requires jj 0.39.0 or later on the host, whether or not
-the program uses the `Jj` slot. Each factory merges its `Jj` layer with the
-other four, and that layer runs one `jj --version` probe while the layer is
-built. On a host without the executable, or with an older one, construction
-fails with `JjError` carrying `not_installed` or `unsupported_version` before
-the program body runs, even for a program that asked for only `FileSystem`.
+Every bundle, `BunHost.layer`, `layerAt`, `layerContained`, and
+`layerContainedAt`, builds without jj, so a program that never calls `Jj` runs
+on a host without it. The `Jj` slot requires jj 0.39.0 or later: its first
+operation runs one `jj --version` probe, and on a host without the executable,
+or with an older one, that operation fails with `JjError` carrying
+`not_installed` or `unsupported_version`. The slot selects the executable when
+the layer is built, so restart the program after installing jj.
 
 Install [Jujutsu](https://jj-vcs.github.io), a version-control system that
 works on a Git repository, and confirm the version:
@@ -72,9 +76,9 @@ This package vendors no binaries. [`@smthrs/jj`](/api/jj) documents the
 resolution order and the `SMITHERS_JJ_PATH` override for an executable that is
 not on `PATH`.
 
-A program that must run without jj composes the individual service layers
-instead of a complete bundle: `BunFileSystem.layer`, `Path.layer`, and the
-spawner and HTTP client layers each build without a probe. See
+A program that wants only some of the services composes the individual service
+layers instead of a complete bundle: `BunFileSystem.layer`, `Path.layer`, and
+the spawner and HTTP client layers. See
 [The Host surface on Bun](./concepts/host-surface.md) for taking one service
 without the other four.
 
@@ -117,9 +121,9 @@ page composes [`@smthrs/platform-browser`](/api/platform-browser) instead.
   [Contain and reap child processes](./guides/contain-child-processes.md).
 
 The `Jj` slot spawns the `jj` command that
-[Install Jujutsu for the complete bundles](#install-jujutsu-for-the-complete-bundles)
-covers. A bundle probes it at construction, so the executable is a startup
-requirement rather than a slot the program opts into.
+[Install Jujutsu for the Jj slot](#install-jujutsu-for-the-jj-slot) covers. The
+slot probes it on its first operation, so jj is a requirement of the programs
+that call `Jj`, not of every host.
 
 ## Next step
 

package/docs/quickstart.md

@@ -13,15 +13,18 @@ appear in, and disappear from, the process ledger.
 ## Prerequisites
 
 - Bun 1.4.0 or later, or Node.js 26.4.0 or later.
-- The `smithers-jj-export` helper. See
-  [Installation](./installation.md#install-the-filesystem-helper).
-- [Jujutsu](https://jj-vcs.github.io) at jj 0.39.0 or later on `PATH`. Confirm
-  it with `jj --version`. Neither program below touches `Jj`, but every
-  complete bundle probes jj while the layer is built and fails with `JjError`
-  before the program body runs when it is missing. See
-  [Installation](./installation.md) for `SMITHERS_JJ_PATH` and for composing
-  service layers without jj.
-- A package with the dependencies installed. Not on npm yet; see [Installation](https://github.com/smithersai/smithers/blob/main/packages/smithers/flows/flow/docs/installation.md#use-the-libraries).
+- A project with the packages installed:
+  `bun add @smthrs/platform-bun@1.0.0-rc.9 effect @smthrs/kernel@1.0.0-rc.9`.
+  That also installs the required peer `@smthrs/platform-node`, which ships the
+  `smithers-jj-export` helper the filesystem slot runs. `@smthrs/kernel` is on
+  the line because `contained.ts` imports its `ProcessLedger`, and Bun's
+  isolated linker and pnpm link only the packages a project declares. See
+  [Installation](./installation.md).
+- [Jujutsu](https://jj-vcs.github.io) at jj 0.39.0 or later on `PATH`, only for
+  a program that calls `Jj`. Neither program below does, and every bundle
+  builds without jj; a `Jj` operation on a host without it fails with
+  `JjError` `not_installed`. See [Installation](./installation.md) for
+  `SMITHERS_JJ_PATH`.
 
 ## Run a file operation and a command
 
@@ -63,8 +66,9 @@ bun run quickstart.ts
 ```
 
 `BunHost.layer` provided all five slots; the program used two of them. The
-other three were built and never asked for, and building `Jj` is where the
-jj version probe ran.
+other three were built and never asked for. Building `Jj` spawned nothing: its
+jj version probe runs on the first `Jj` operation, which this program never
+makes.
 
 ## Turn containment on
 

package/docs/troubleshooting.md

@@ -1,33 +1,12 @@
 ---
 title: "Troubleshooting"
-description: "The failures @smthrs/platform-bun produces: a missing required peer, a refused repository root, a filesystem guard that fails closed, an unfollowed redirect, a missing process ledger, and a browser bundle that will not resolve."
+description: "The failures @smthrs/platform-bun produces: a refused repository root, a filesystem guard that fails closed, an unfollowed redirect, a missing process ledger, and a browser bundle that will not resolve."
 ---
 
 Find the symptom, read the cause, apply the fix. Every failure here is one this
 package or its slots actually produce; the signatures behind them are on the
 [API reference](./api.md).
 
-## ERR_MODULE_NOT_FOUND for @effect/platform-bun/BunChildProcessSpawner
-
-**Symptom.** The first `import { BunHost } from "@smthrs/platform-bun"`, or
-`import * as BunHost from "@smthrs/platform-bun/BunHost"`, throws
-`ERR_MODULE_NOT_FOUND` before any of your code runs.
-
-**Cause.** The install is missing the required `@effect/platform-bun` peer,
-which both the root entry point and `BunHost` import at module load. This can
-happen with an older package version that marked it optional, or when peer
-installation was disabled.
-
-**Fix.** Install it yourself, at the version your composition's `effect` is
-built against:
-
-```bash
-pnpm add @effect/platform-bun @effect/platform-node-shared
-```
-
-`@smthrs/platform-bun/BunFileSystem` is the one entry point that resolves
-without it, because it imports nothing from `@effect/platform-bun`.
-
 ## BunHostError: requires an absolute repository root
 
 **Symptom.** `BunHost.layerAt` or `BunHost.layerContainedAt` throws while your
@@ -35,10 +14,12 @@ program is still composing its layers:
 
 ```text
 BunHostError: BunHost.layerAt requires an absolute repository root, got "repositories/app"
+BunHostError: BunHost.layerAt requires a repository root without NUL, got "/repo\u0000"
 ```
 
-**Cause.** The root is not absolute. The empty string counts, and so does a
-path that looks absolute only after the process working directory is applied.
+**Cause.** The root is not absolute, or it contains NUL, which no filesystem
+or process API can represent. The empty string is not absolute, and neither is
+a path that looks absolute only after the process working directory is applied.
 
 **Fix.** Resolve the root before you hand it over, and branch on
 `error.code === "invalid_repository_root"` rather than on the message text. The
@@ -63,9 +44,12 @@ the one it was told to spawn is missing or not executable. The guard fails close
 operation, because a path-based fallback is exactly the symlink race the
 extension exists to prevent.
 
-**Fix.** Run `cargo build --locked --release -p smithers-ffi --bin smithers-jj-export`
-in a source checkout, or set `SMITHERS_WORKSPACE_JJ_EXPORT_BINARY` to an
-absolute helper path. See
+**Fix.** Install `@smthrs/platform-node`, the required peer that ships the
+helper for macOS, Linux, and Windows, at this package's version. If
+`SMITHERS_WORKSPACE_JJ_EXPORT_BINARY` is set, it overrides the packaged helper:
+point it at an executable helper or unset it. A source checkout of the
+repository has no packaged helper; build one there with
+`cargo build --locked --release -p smithers-ffi --bin smithers-jj-export`. See
 [Configure the filesystem helper](./guides/configure-the-filesystem-helper.md).
 
 This failure is unguarded-path-safe: it appears only under
@@ -112,7 +96,7 @@ your code.
 `@smthrs/kernel/ProcessLedger`.
 
 **Cause.** Both contained factories return
-`Layer.Layer<BunHost | Crypto.Crypto, JjError, ProcessLedger.ProcessLedger>`.
+`Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger>`.
 The ledger is a
 requirement rather than a built-in default, because the durable half is only as
 good as the journal underneath it, and only your program knows whether it has
@@ -164,15 +148,16 @@ between them does not change. See
 
 ## Jj fails with not_installed
 
-**Symptom.** Building any complete bundle fails with a `JjError` whose code
-is `not_installed` or `unsupported_version` before the program body runs,
-even when the program never asks for `Jj`.
+**Symptom.** A `Jj` operation fails with a `JjError` whose code is
+`not_installed` or `unsupported_version` and whose method is `version`. The
+host built and every other service works.
 
-**Cause.** No usable `jj` executable, or one older than 0.39.0. Every
-`BunHost` factory builds its `Jj` layer eagerly, and that layer probes
-`jj --version` at construction. This package vendors no binaries and installs
-nothing on your behalf.
+**Cause.** No usable `jj` executable, or one older than 0.39.0. The `Jj` slot
+probes `jj --version` on its first operation, and the operation that triggered
+the probe did not run. This package vendors no binaries and installs nothing on
+your behalf.
 
 **Fix.** Install [Jujutsu](https://jj-vcs.github.io), which provides the `jj`
-command, or set `SMITHERS_JJ_PATH` to the executable you want spawned.
+command, or set `SMITHERS_JJ_PATH` to the executable you want spawned, then
+restart the program: the slot selects the executable when the layer is built.
 [`@smthrs/jj`](/api/jj) documents the resolution order and the failure codes.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@smthrs/platform-bun",
   "type": "module",
-  "version": "1.0.0-rc.7",
+  "version": "1.0.0-rc.9",
   "license": "MIT",
   "smthrs": {
     "group": "engine",
@@ -102,15 +102,15 @@
     "tag": "next"
   },
   "dependencies": {
-    "@smthrs/jj": "1.0.0-rc.7",
-    "@smthrs/kernel": "1.0.0-rc.7",
+    "@smthrs/jj": "1.0.0-rc.9",
+    "@smthrs/kernel": "1.0.0-rc.9",
     "undici": "8.11.2",
     "redis": "6.2.1",
     "@types/ws": "8.18.2",
     "ws": "8.22.0"
   },
   "peerDependencies": {
-    "@smthrs/platform-node": "1.0.0-rc.7",
+    "@smthrs/platform-node": "1.0.0-rc.9",
     "effect": "^4.0.4"
   },
   "devDependencies": {
@@ -120,7 +120,7 @@
     "@effect/platform-node-shared": "4.0.4",
     "@effect/vitest": "4.0.4",
     "@eslint/js": "9.39.5",
-    "@smthrs/platform-node": "1.0.0-rc.7",
+    "@smthrs/platform-node": "1.0.0-rc.9",
     "@types/node": "26.4.1",
     "@vitest/coverage-v8": "5.0.0",
     "dprint": "0.57.1",
@@ -135,7 +135,7 @@
     "typescript": "5.9.3",
     "typescript-eslint": "8.69.0",
     "vitest": "5.0.0",
-    "@smthrs/artifacts": "1.0.0-rc.7"
+    "@smthrs/artifacts": "1.0.0-rc.9"
   },
   "scripts": {
     "lint": "eslint src --max-warnings=0 && dprint check",

package/src/BunHost.ts

@@ -25,7 +25,7 @@
 import * as BunChildProcessSpawner from "@effect/platform-bun/BunChildProcessSpawner"
 import * as BunCrypto from "@effect/platform-bun/BunCrypto"
 import * as BunPath from "@effect/platform-bun/BunPath"
-import type { Jj, JjError } from "@smthrs/jj"
+import type { Jj } from "@smthrs/jj"
 import * as BunJj from "@smthrs/jj/bun/BunJj"
 import type { HostServiceIds } from "@smthrs/kernel/HostServices"
 import type * as KernelProcessConfinement from "@smthrs/kernel/ProcessConfinement"
@@ -84,7 +84,8 @@ export type BunHost =
  *
  * A code is the contract a caller branches on; the message beside it is for a
  * person. `invalid_repository_root` is the root handed to {@link layerAt} or
- * {@link layerContainedAt} not being absolute, the empty string included.
+ * {@link layerContainedAt} not being absolute or containing NUL, the empty
+ * string included.
  *
  * @category models
  * @since 1.0.0-rc.0
@@ -149,12 +150,19 @@ const preview = (root: string, budget: number): string => {
  *
  * `BunJj.layerAt` and `BunJj.layerSpawnerAt` are `NodeJj`'s, and those throw a
  * bare `TypeError` that names `NodeJj`, carries no code, and echoes the whole
- * string. The predicate here is the same `isAbsolute` the adapter applies, so
- * a root that passes this check cannot reach that throw.
+ * string. The predicate includes the same `isAbsolute` the adapter applies, so
+ * a root that passes this check cannot reach that throw. An absolute root
+ * containing NUL is refused too: no filesystem or process API can represent it.
  */
 const absoluteRoot = (factory: "layerAt" | "layerContainedAt", root: string): string => {
-  if (isAbsolute(root)) return root
-  const prefix = `BunHost.${factory} requires an absolute repository root, got `
+  // An absolute root with NUL names that defect, not absoluteness it already has.
+  const requirement = !isAbsolute(root)
+    ? "an absolute repository root"
+    : root.includes("\0")
+    ? "a repository root without NUL"
+    : undefined
+  if (requirement === undefined) return root
+  const prefix = `BunHost.${factory} requires ${requirement}, got `
   throw new BunHostError({
     code: "invalid_repository_root",
     message: `${prefix}${preview(root, messageLimit - prefix.length)}`
@@ -232,16 +240,16 @@ export const layerHttpClient: Layer.Layer<HttpClient> = EgressHttpClient.layer(p
  * Provides all five Bun Host services, including the runtime-independent Path
  * service.
  *
- * Fails at construction with {@link JjError} carrying `not_installed` or
- * `unsupported_version`: the `Jj` slot is merged eagerly and probes
- * `jj --version` while the layer is built, before the program body runs and
- * whether or not the program asks for `Jj`. Requires jj 0.39.0 or later.
+ * Builds on a host without jj. The `Jj` slot probes `jj --version` on its
+ * first operation and fails that operation with `JjError` carrying
+ * `not_installed` or `unsupported_version`; a program that never calls `Jj`
+ * runs without jj. `Jj` requires jj 0.39.0 or later.
  *
  * @category layers
  * @since 1.0.0-rc.0
  * @slop
  */
-export const layer: Layer.Layer<BunHost | Crypto.Crypto, JjError> = Layer.mergeAll(
+export const layer: Layer.Layer<BunHost | Crypto.Crypto> = Layer.mergeAll(
   ProcessConfinement.layer(),
   platform,
   Layer.provide(BunChildProcessSpawner.layer, platform),
@@ -253,16 +261,16 @@ export const layer: Layer.Layer<BunHost | Crypto.Crypto, JjError> = Layer.mergeA
  * Provides all five Bun Host services bound to one absolute repository root.
  *
  * Throws {@link BunHostError} with code `invalid_repository_root` when `root`
- * is not absolute; the empty string counts. The check runs when the factory is
- * called, before any layer exists.
+ * is not absolute or contains NUL; the empty string counts. The check runs
+ * when the factory is called, before any layer exists.
  *
- * Fails at construction with {@link JjError} exactly as {@link layer} does:
- * the `Jj` slot probes `jj --version` while the layer is built.
+ * Builds without jj exactly as {@link layer} does: the `Jj` slot probes
+ * `jj --version` on its first operation.
  *
  * @category layers
  * @since 1.0.0-rc.0
  */
-export const layerAt = (root: string): Layer.Layer<BunHost | Crypto.Crypto, JjError> => {
+export const layerAt = (root: string): Layer.Layer<BunHost | Crypto.Crypto> => {
   const repositoryRoot = absoluteRoot("layerAt", root)
   return Layer.mergeAll(
     ProcessConfinement.layer(),
@@ -284,8 +292,8 @@ export const layerAt = (root: string): Layer.Layer<BunHost | Crypto.Crypto, JjEr
  * it makes, `process.kill` and `taskkill`, are Node's, and Bun implements
  * them unchanged.
  *
- * Fails at construction with {@link JjError} exactly as {@link layer} does;
- * here the `jj --version` probe runs through the contained spawner, so its
+ * Builds without jj exactly as {@link layer} does; here the first
+ * operation's `jj --version` probe runs through the contained spawner, so its
  * record enters and leaves the ledger like any other child.
  *
  * @category layers
@@ -293,7 +301,7 @@ export const layerAt = (root: string): Layer.Layer<BunHost | Crypto.Crypto, JjEr
  */
 export const layerContained = (
   options?: ContainedOptions
-): Layer.Layer<BunHost | Crypto.Crypto, JjError, ProcessLedger.ProcessLedger> => {
+): Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger> => {
   const spawner = Layer.provide(
     ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),
     Layer.provide(BunChildProcessSpawner.layer, platform)
@@ -314,8 +322,7 @@ export const layerContained = (
  *
  * Refuses a root exactly as {@link layerAt} does: {@link BunHostError} with
  * code `invalid_repository_root`, thrown when the factory is called.
- * Fails at construction with {@link JjError} exactly as {@link layerContained}
- * does.
+ * Builds without jj exactly as {@link layerContained} does.
  *
  * @category layers
  * @since 1.0.0-rc.0
@@ -323,7 +330,7 @@ export const layerContained = (
 export const layerContainedAt = (
   root: string,
   options?: ContainedOptions
-): Layer.Layer<BunHost | Crypto.Crypto, JjError, ProcessLedger.ProcessLedger> => {
+): Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger> => {
   const repositoryRoot = absoluteRoot("layerContainedAt", root)
   const spawner = Layer.provide(
     ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),