@smthrs/platform-bun 1.0.0-rc.8 → 1.0.0-rc.9

package/README.md

@@ -23,7 +23,7 @@ package is that object for a process running on Bun.
 ## Install
 
 ```bash
-bun add @smthrs/platform-bun@1.0.0-rc.8 effect
+bun add @smthrs/platform-bun@1.0.0-rc.9 effect
 ```
 
 `@smthrs/platform-node` and `effect` are required peers, as `package.json`
@@ -58,12 +58,13 @@ The program names Bun nowhere. It asks for a service tag, and the layer decides
 what fills it, so swapping `BunHost.layer` for `NodeHost.layer` from
 `@smthrs/platform-node` does not change a character of it.
 
-The complete host bundles require jj 0.39.0 or newer. Each bundle builds its jj
-layer with one version probe; construction can fail with `JjError`, including
-`not_installed` or `unsupported_version`. The version probe and repository commands use the
-selected process runner. Contained bundles record and retire the probe in the
-host process ledger. Probe results are cached per resolved absolute executable
-path and runner, with a separate cache for each spawner instance.
+Every host bundle builds without jj. The `Jj` slot needs jj 0.39.0 or newer: its
+first operation runs one version probe and fails with `JjError` `not_installed`
+or `unsupported_version` when jj is missing or older. The version probe and
+repository commands use the selected process runner. Contained bundles record
+and retire the probe in the host process ledger. Probe results are cached per
+resolved absolute executable path and runner, with a separate cache for each
+spawner instance.
 
 ## Modules
 

package/dist/cjs/BunHost.d.ts

@@ -23,7 +23,7 @@
  */
 import * as BunChildProcessSpawner from "../vendor/cjs/bun/BunChildProcessSpawner.js";
 import * as BunCrypto from "../vendor/cjs/bun/BunCrypto.js";
-import type { Jj, JjError } from "@smthrs/jj";
+import type { Jj } from "@smthrs/jj";
 import type { HostServiceIds } from "@smthrs/kernel/HostServices";
 import type * as KernelProcessConfinement from "@smthrs/kernel/ProcessConfinement";
 import type * as ProcessLedger from "@smthrs/kernel/ProcessLedger";
@@ -69,7 +69,8 @@ export type BunHost = FileSystem | Path.Path | ChildProcessSpawner | Jj | HttpCl
  *
  * A code is the contract a caller branches on; the message beside it is for a
  * person. `invalid_repository_root` is the root handed to {@link layerAt} or
- * {@link layerContainedAt} not being absolute, the empty string included.
+ * {@link layerContainedAt} not being absolute or containing NUL, the empty
+ * string included.
  *
  * @category models
  * @since 1.0.0-rc.0
@@ -147,30 +148,30 @@ export declare const layerHttpClient: Layer.Layer<HttpClient>;
  * Provides all five Bun Host services, including the runtime-independent Path
  * service.
  *
- * Fails at construction with {@link JjError} carrying `not_installed` or
- * `unsupported_version`: the `Jj` slot is merged eagerly and probes
- * `jj --version` while the layer is built, before the program body runs and
- * whether or not the program asks for `Jj`. Requires jj 0.39.0 or later.
+ * Builds on a host without jj. The `Jj` slot probes `jj --version` on its
+ * first operation and fails that operation with `JjError` carrying
+ * `not_installed` or `unsupported_version`; a program that never calls `Jj`
+ * runs without jj. `Jj` requires jj 0.39.0 or later.
  *
  * @category layers
  * @since 1.0.0-rc.0
  * @slop
  */
-export declare const layer: Layer.Layer<BunHost | Crypto.Crypto, JjError>;
+export declare const layer: Layer.Layer<BunHost | Crypto.Crypto>;
 /**
  * Provides all five Bun Host services bound to one absolute repository root.
  *
  * Throws {@link BunHostError} with code `invalid_repository_root` when `root`
- * is not absolute; the empty string counts. The check runs when the factory is
- * called, before any layer exists.
+ * is not absolute or contains NUL; the empty string counts. The check runs
+ * when the factory is called, before any layer exists.
  *
- * Fails at construction with {@link JjError} exactly as {@link layer} does:
- * the `Jj` slot probes `jj --version` while the layer is built.
+ * Builds without jj exactly as {@link layer} does: the `Jj` slot probes
+ * `jj --version` on its first operation.
  *
  * @category layers
  * @since 1.0.0-rc.0
  */
-export declare const layerAt: (root: string) => Layer.Layer<BunHost | Crypto.Crypto, JjError>;
+export declare const layerAt: (root: string) => Layer.Layer<BunHost | Crypto.Crypto>;
 /**
  * Provides the Bun host with process containment turned on.
  *
@@ -182,24 +183,23 @@ export declare const layerAt: (root: string) => Layer.Layer<BunHost | Crypto.Cry
  * it makes, `process.kill` and `taskkill`, are Node's, and Bun implements
  * them unchanged.
  *
- * Fails at construction with {@link JjError} exactly as {@link layer} does;
- * here the `jj --version` probe runs through the contained spawner, so its
+ * Builds without jj exactly as {@link layer} does; here the first
+ * operation's `jj --version` probe runs through the contained spawner, so its
  * record enters and leaves the ledger like any other child.
  *
  * @category layers
  * @since 1.0.0-rc.0
  */
-export declare const layerContained: (options?: ContainedOptions) => Layer.Layer<BunHost | Crypto.Crypto, JjError, ProcessLedger.ProcessLedger>;
+export declare const layerContained: (options?: ContainedOptions) => Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger>;
 /**
  * Provides the contained Bun host bound to one absolute repository root.
  *
  * Refuses a root exactly as {@link layerAt} does: {@link BunHostError} with
  * code `invalid_repository_root`, thrown when the factory is called.
- * Fails at construction with {@link JjError} exactly as {@link layerContained}
- * does.
+ * Builds without jj exactly as {@link layerContained} does.
  *
  * @category layers
  * @since 1.0.0-rc.0
  */
-export declare const layerContainedAt: (root: string, options?: ContainedOptions) => Layer.Layer<BunHost | Crypto.Crypto, JjError, ProcessLedger.ProcessLedger>;
+export declare const layerContainedAt: (root: string, options?: ContainedOptions) => Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger>;
 //# sourceMappingURL=BunHost.d.ts.map

package/dist/cjs/BunHost.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BunHost.d.ts","sourceRoot":"","sources":["../../src/BunHost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,sBAAsB,MAAM,6CAA6C,CAAA;AACrF,OAAO,KAAK,SAAS,MAAM,gCAAgC,CAAA;AAE3D,OAAO,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAE7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,KAAK,KAAK,wBAAwB,MAAM,mCAAmC,CAAA;AAClF,OAAO,KAAK,KAAK,aAAa,MAAM,8BAA8B,CAAA;AAClE,OAAO,KAAK,gBAAgB,MAAM,wCAAwC,CAAA;AAE1E,OAAO,KAAK,YAAY,MAAM,oCAAoC,CAAA;AAElE,OAAO,KAAK,aAAa,MAAM,qCAAqC,CAAA;AACpE,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,KAAK,IAAI,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAC7E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,CAAA;AAE1G;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,GACf,UAAU,GACV,IAAI,CAAC,IAAI,GACT,mBAAmB,GACnB,EAAE,GACF,UAAU,GACV,wBAAwB,CAAC,kBAAkB,CAAA;AAE/C;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG,yBAAyB,CAAA;;;;;AAExD;;;;;;;;;;;GAWG;AACH,qBAAa,YAAa,SAAQ,iBAGhC;IACA,SAAkB,IAAI,kBAAiB;CACxC;AAqDD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAMvF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC,cAAc,GAAG,aAAa,CAAC,OAAO,CAAA;AAWnF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAuC,CAAA;AAE3F;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAM/D,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,MAAM,KAAG,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CASlF,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,GACzB,UAAU,gBAAgB,KACzB,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,aAAa,CAc3E,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,GAC3B,MAAM,MAAM,EACZ,UAAU,gBAAgB,KACzB,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,aAAa,CAY3E,CAAA"}
+{"version":3,"file":"BunHost.d.ts","sourceRoot":"","sources":["../../src/BunHost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,sBAAsB,MAAM,6CAA6C,CAAA;AACrF,OAAO,KAAK,SAAS,MAAM,gCAAgC,CAAA;AAE3D,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,YAAY,CAAA;AAEpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,KAAK,KAAK,wBAAwB,MAAM,mCAAmC,CAAA;AAClF,OAAO,KAAK,KAAK,aAAa,MAAM,8BAA8B,CAAA;AAClE,OAAO,KAAK,gBAAgB,MAAM,wCAAwC,CAAA;AAE1E,OAAO,KAAK,YAAY,MAAM,oCAAoC,CAAA;AAElE,OAAO,KAAK,aAAa,MAAM,qCAAqC,CAAA;AACpE,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,KAAK,IAAI,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAC7E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,CAAA;AAE1G;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,GACf,UAAU,GACV,IAAI,CAAC,IAAI,GACT,mBAAmB,GACnB,EAAE,GACF,UAAU,GACV,wBAAwB,CAAC,kBAAkB,CAAA;AAE/C;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GAAG,yBAAyB,CAAA;;;;;AAExD;;;;;;;;;;;GAWG;AACH,qBAAa,YAAa,SAAQ,iBAGhC;IACA,SAAkB,IAAI,kBAAiB;CACxC;AA4DD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAMvF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC,cAAc,GAAG,aAAa,CAAC,OAAO,CAAA;AAWnF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAuC,CAAA;AAE3F;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAMtD,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,MAAM,KAAG,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CASzE,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,GACzB,UAAU,gBAAgB,KACzB,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,aAAa,CAczE,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAC3B,MAAM,MAAM,EACZ,UAAU,gBAAgB,KACzB,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,aAAa,CAYzE,CAAA"}

package/dist/cjs/BunHost.js

@@ -79,8 +79,9 @@ const preview = (root, budget) => {
   return `"${excerpt}"${suffix}`;
 };
 const absoluteRoot = (factory, root) => {
-  if ((0, import_node_path.isAbsolute)(root)) return root;
-  const prefix = `BunHost.${factory} requires an absolute repository root, got `;
+  const requirement = !(0, import_node_path.isAbsolute)(root) ? "an absolute repository root" : root.includes("\0") ? "a repository root without NUL" : void 0;
+  if (requirement === void 0) return root;
+  const prefix = `BunHost.${factory} requires ${requirement}, got `;
   throw new BunHostError({
     code: "invalid_repository_root",
     message: `${prefix}${preview(root, messageLimit - prefix.length)}`

package/dist/cjs/BunHost.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/BunHost.ts"],
-  "sourcesContent": ["/**\n * Aggregate Bun Host bundle.\n *\n * Runtime-specific dependencies stay inside this package; callers get the same\n * closed five-service Host surface every other bundle provides, plus native\n * `ProcessConfinement` for guarded commands.\n *\n * There is no Bun shell module: running a command is Effect's\n * `ChildProcessSpawner`, and `@effect/platform-bun`'s implementation is\n * `@effect/platform-node-shared`'s re-exported: the same code on both\n * runtimes, so no runtime detection is needed here.\n *\n * Outgoing HTTP uses the shared EgressHttpClient on both runtimes. Web\n * requests pin approved addresses; ordinary requests retain the shared pool.\n * Redirects remain visible to the capability kernel, and proxy routing follows\n * the host environment.\n *\n * The filesystem slot is `@smthrs/platform-node`'s `AtomicFileSystem`, byte for\n * byte the layer `NodeHost` uses, so a guarded path operation is\n * descriptor-relative and no-follow on both runtimes.\n *\n * @since 1.0.0-rc.0\n */\n\nimport * as BunChildProcessSpawner from \"@effect/platform-bun/BunChildProcessSpawner\"\nimport * as BunCrypto from \"@effect/platform-bun/BunCrypto\"\nimport * as BunPath from \"@effect/platform-bun/BunPath\"\nimport type { Jj, JjError } from \"@smthrs/jj\"\nimport * as BunJj from \"@smthrs/jj/bun/BunJj\"\nimport type { HostServiceIds } from \"@smthrs/kernel/HostServices\"\nimport type * as KernelProcessConfinement from \"@smthrs/kernel/ProcessConfinement\"\nimport type * as ProcessLedger from \"@smthrs/kernel/ProcessLedger\"\nimport * as AtomicFileSystem from \"@smthrs/platform-node/AtomicFileSystem\"\nimport * as EgressHttpClient from \"@smthrs/platform-node/EgressHttpClient\"\nimport * as HostLiveness from \"@smthrs/platform-node/HostLiveness\"\nimport * as ProcessConfinement from \"@smthrs/platform-node/ProcessConfinement\"\nimport * as ProcessReaper from \"@smthrs/platform-node/ProcessReaper\"\nimport type * as Crypto from \"effect/Crypto\"\nimport type { FileSystem } from \"effect/FileSystem\"\nimport type { HttpClient } from \"effect/http/HttpClient\"\nimport * as Layer from \"effect/Layer\"\nimport type * as Path from \"effect/Path\"\nimport type { ChildProcessSpawner } from \"effect/process/ChildProcessSpawner\"\nimport * as Schema from \"effect/Schema\"\nimport { isAbsolute } from \"node:path\"\nimport * as BunFileSystem from \"./BunFileSystem.ts\"\n\n/**\n * Bun platform modules for selectively providing individual services.\n *\n * `AtomicFileSystem` is here for the same reason `NodeHost` re-exports it: it\n * owns the only configuration escape hatch the filesystem slot has, and a Bun\n * program with a different packaged helper path needs to reach\n * `AtomicFileSystem.layerWith` without hand-composing the other four tags.\n *\n * `BunJj` is deliberately absent: it belongs to `@smthrs/jj` and is imported\n * from there, never re-exported here. So is `@effect/platform-bun/BunHttpClient`:\n * its `layer` follows redirects to origins the capability kernel never\n * authorized. The network slot on its own is {@link layerHttpClient}.\n *\n * @category re-exports\n * @since 1.0.0-rc.0\n * @slop\n */\nexport { AtomicFileSystem, BunChildProcessSpawner, BunCrypto, BunFileSystem, HostLiveness, ProcessReaper }\n\n/**\n * The complete closed Host service union provided by Bun.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport type BunHost =\n  | FileSystem\n  | Path.Path\n  | ChildProcessSpawner\n  | Jj\n  | HttpClient\n  | KernelProcessConfinement.ProcessConfinement\n\n/**\n * The stable codes a `BunHost` factory refuses with.\n *\n * A code is the contract a caller branches on; the message beside it is for a\n * person. `invalid_repository_root` is the root handed to {@link layerAt} or\n * {@link layerContainedAt} not being absolute, the empty string included.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type BunHostErrorCode = \"invalid_repository_root\"\n\n/**\n * The refusal a `BunHost` factory throws before it builds a layer.\n *\n * It is thrown rather than failed because a factory is called while a program\n * composes its layers, where there is no fiber to fail yet and a wrong root is\n * a composition mistake, not a runtime outcome. It is this package's class,\n * not the `Jj` adapter's, because a Bun caller composes `BunHost` and should\n * learn nothing about the adapter behind the `Jj` slot from an error message.\n *\n * @category errors\n * @since 1.0.0-rc.0\n */\nexport class BunHostError extends Schema.TaggedError<BunHostError>()(\"@smthrs/platform-bun/BunHostError\", {\n  code: Schema.Literal(\"invalid_repository_root\"),\n  message: Schema.String\n}) {\n  override readonly name = \"BunHostError\"\n}\n\n/** The longest message a factory refuses with, in UTF-16 code units. */\nconst messageLimit = 255\n\n/** How many code points of a refused root the message repeats at most. */\nconst previewLimit = 64\n\n/**\n * A bounded, quoted excerpt of a refused root that fits in `budget` code\n * units of the message.\n *\n * Counted in code points rather than UTF-16 units so a cut never splits a\n * surrogate pair, and passed through `JSON.stringify` so a newline in the root\n * cannot break the log line the message lands on. Each code point is encoded\n * on its own and admitted only while the quoted excerpt plus the length\n * suffix still fit, so a control character that widens to a `\\u0001` escape\n * shortens the excerpt instead of lengthening the message, and a cut never\n * lands inside an escape.\n */\nconst preview = (root: string, budget: number): string => {\n  const points = Array.from(root)\n  const whole = JSON.stringify(root)\n  if (points.length <= previewLimit && whole.length <= budget) return whole\n  const suffix = `... (${points.length} characters)`\n  const room = budget - suffix.length - 2\n  let excerpt = \"\"\n  for (const point of points.slice(0, previewLimit)) {\n    const encoded = JSON.stringify(point).slice(1, -1)\n    if (excerpt.length + encoded.length > room) break\n    excerpt += encoded\n  }\n  return `\"${excerpt}\"${suffix}`\n}\n\n/**\n * Refuses a root the `Jj` adapter underneath would refuse, here and in this\n * package's name.\n *\n * `BunJj.layerAt` and `BunJj.layerSpawnerAt` are `NodeJj`'s, and those throw a\n * bare `TypeError` that names `NodeJj`, carries no code, and echoes the whole\n * string. The predicate here is the same `isAbsolute` the adapter applies, so\n * a root that passes this check cannot reach that throw.\n */\nconst absoluteRoot = (factory: \"layerAt\" | \"layerContainedAt\", root: string): string => {\n  if (isAbsolute(root)) return root\n  const prefix = `BunHost.${factory} requires an absolute repository root, got `\n  throw new BunHostError({\n    code: \"invalid_repository_root\",\n    message: `${prefix}${preview(root, messageLimit - prefix.length)}`\n  })\n}\n\n/**\n * Stable implementation identities keyed by the closed Host service slots.\n *\n * Each value names the module behind that slot in the raw host bundle.\n * Contained POSIX factories replace the spawner with {@link ProcessReaper.layerSpawner}.\n * These are identity\n * tokens rather than import specifiers: the filesystem entry is\n * `@smthrs/platform-node/AtomicFileSystem` because that is the implementation,\n * even though a consumer reaches it through `@smthrs/platform-bun`.\n *\n * Nothing digests them yet. `@smthrs/plan`'s step key carries a `layers`\n * component these values are meant to feed, but no planner derives it from a\n * host bundle today, so changing one invalidates no cached step.\n *\n * The keys are written as literals rather than `HostServiceIds` positions so\n * that reordering the closed list cannot silently pair a slot with another\n * slot's implementation.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const implementationIds: Readonly<Record<(typeof HostServiceIds)[number], string>> = {\n  \"effect/FileSystem\": \"@smthrs/platform-node/AtomicFileSystem\",\n  \"effect/Path\": \"@effect/platform-bun/BunPath\",\n  \"effect/process/ChildProcessSpawner\": \"@effect/platform-bun/BunChildProcessSpawner\",\n  \"@smthrs/jj/Jj\": \"@smthrs/jj/bun/BunJj\",\n  \"effect/HttpClient\": \"@smthrs/platform-node/EgressHttpClient\"\n}\n\n/**\n * What a caller may configure about containment.\n *\n * `ContainedSpawner.Options.platform` is deliberately not part of it. It\n * decides one thing, whether a command that names no `detached` option gets a\n * process group of its own, and this native host detaches by `process.platform`\n * whatever a record claims. A\n * caller-supplied `\"win32\"` on a POSIX host would therefore record\n * `pgid: null` for a child that really does lead a group, and\n * {@link ProcessReaper.reap} would retire that record as `no-group` and leave\n * the orphan running forever: a durable lie rather than a compile error.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type ContainedOptions = ProcessReaper.SpawnerOptions & ProcessReaper.Options\n\n/** The reaper half of {@link ContainedOptions}. */\nconst reaping = (options?: ContainedOptions): ProcessReaper.Options => ({\n  ownerPid: options?.ownerPid,\n  system: options?.system\n})\n\n/** The two services `BunChildProcessSpawner` resolves paths and files with. */\nconst platform = Layer.mergeAll(BunFileSystem.layer, BunPath.layer, BunCrypto.layer)\n\n/**\n * The network slot on its own: the shared egress client, which never follows a\n * redirect. A `3xx` comes back to the caller with its `location` intact and the\n * second origin uncontacted; following a redirect is `@smthrs/kernel`'s guarded\n * `HttpClient.layer`, which rechecks every hop.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerHttpClient: Layer.Layer<HttpClient> = EgressHttpClient.layer(process.env)\n\n/**\n * Provides all five Bun Host services, including the runtime-independent Path\n * service.\n *\n * Fails at construction with {@link JjError} carrying `not_installed` or\n * `unsupported_version`: the `Jj` slot is merged eagerly and probes\n * `jj --version` while the layer is built, before the program body runs and\n * whether or not the program asks for `Jj`. Requires jj 0.39.0 or later.\n *\n * @category layers\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const layer: Layer.Layer<BunHost | Crypto.Crypto, JjError> = Layer.mergeAll(\n  ProcessConfinement.layer(),\n  platform,\n  Layer.provide(BunChildProcessSpawner.layer, platform),\n  BunJj.layer,\n  layerHttpClient\n)\n\n/**\n * Provides all five Bun Host services bound to one absolute repository root.\n *\n * Throws {@link BunHostError} with code `invalid_repository_root` when `root`\n * is not absolute; the empty string counts. The check runs when the factory is\n * called, before any layer exists.\n *\n * Fails at construction with {@link JjError} exactly as {@link layer} does:\n * the `Jj` slot probes `jj --version` while the layer is built.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerAt = (root: string): Layer.Layer<BunHost | Crypto.Crypto, JjError> => {\n  const repositoryRoot = absoluteRoot(\"layerAt\", root)\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    Layer.provide(BunChildProcessSpawner.layer, platform),\n    BunJj.layerAt(repositoryRoot),\n    layerHttpClient\n  )\n}\n\n/**\n * Provides the Bun host with process containment turned on.\n *\n * Bun uses the same prepared native process lifecycle as Node on POSIX, while\n * preserving its underlying runtime spawner on Windows. `ContainedSpawner` gives\n * every child an escalation deadline and a ledger entry, and\n * `ProcessReaper` sweeps the entries a crashed incarnation of this host left\n * behind. The reaper module lives in `@smthrs/platform-node` because the calls\n * it makes, `process.kill` and `taskkill`, are Node's, and Bun implements\n * them unchanged.\n *\n * Fails at construction with {@link JjError} exactly as {@link layer} does;\n * here the `jj --version` probe runs through the contained spawner, so its\n * record enters and leaves the ledger like any other child.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerContained = (\n  options?: ContainedOptions\n): Layer.Layer<BunHost | Crypto.Crypto, JjError, ProcessLedger.ProcessLedger> => {\n  const spawner = Layer.provide(\n    ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),\n    Layer.provide(BunChildProcessSpawner.layer, platform)\n  )\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    layerHttpClient,\n    // jj goes through the CONTAINED spawner here, not around it, exactly as in\n    // `NodeHost.layerContained`: a jj child that starts its own process leads\n    // no recorded group, is in no ledger, and outlives the host that ran it.\n    Layer.provideMerge(BunJj.layerSpawner, spawner)\n  ).pipe(Layer.provideMerge(ProcessReaper.layer(reaping(options))))\n}\n\n/**\n * Provides the contained Bun host bound to one absolute repository root.\n *\n * Refuses a root exactly as {@link layerAt} does: {@link BunHostError} with\n * code `invalid_repository_root`, thrown when the factory is called.\n * Fails at construction with {@link JjError} exactly as {@link layerContained}\n * does.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerContainedAt = (\n  root: string,\n  options?: ContainedOptions\n): Layer.Layer<BunHost | Crypto.Crypto, JjError, ProcessLedger.ProcessLedger> => {\n  const repositoryRoot = absoluteRoot(\"layerContainedAt\", root)\n  const spawner = Layer.provide(\n    ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),\n    Layer.provide(BunChildProcessSpawner.layer, platform)\n  )\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    layerHttpClient,\n    Layer.provideMerge(BunJj.layerSpawnerAt(repositoryRoot), spawner)\n  ).pipe(Layer.provideMerge(ProcessReaper.layer(reaping(options))))\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAwBA,6BAAwC;AACxC,gBAA2B;AAC3B,cAAyB;AAEzB,YAAuB;AAIvB,uBAAkC;AAClC,uBAAkC;AAClC,mBAA8B;AAC9B,yBAAoC;AACpC,oBAA+B;AAI/B,YAAuB;AAGvB,aAAwB;AACxB,uBAA2B;AAC3B,oBAA+B;AA4DxB,MAAM,qBAAqB,OAAO,YAA0B,EAAE,qCAAqC;AAAA,EACxG,MAAM,OAAO,QAAQ,yBAAyB;AAAA,EAC9C,SAAS,OAAO;AAClB,CAAC,EAAE;AAAA,EACiB,OAAO;AAC3B;AAGA,MAAM,eAAe;AAGrB,MAAM,eAAe;AAcrB,MAAM,UAAU,CAAC,MAAc,WAA2B;AACxD,QAAM,SAAS,MAAM,KAAK,IAAI;AAC9B,QAAM,QAAQ,KAAK,UAAU,IAAI;AACjC,MAAI,OAAO,UAAU,gBAAgB,MAAM,UAAU,OAAQ,QAAO;AACpE,QAAM,SAAS,QAAQ,OAAO,MAAM;AACpC,QAAM,OAAO,SAAS,OAAO,SAAS;AACtC,MAAI,UAAU;AACd,aAAW,SAAS,OAAO,MAAM,GAAG,YAAY,GAAG;AACjD,UAAM,UAAU,KAAK,UAAU,KAAK,EAAE,MAAM,GAAG,EAAE;AACjD,QAAI,QAAQ,SAAS,QAAQ,SAAS,KAAM;AAC5C,eAAW;AAAA,EACb;AACA,SAAO,IAAI,OAAO,IAAI,MAAM;AAC9B;AAWA,MAAM,eAAe,CAAC,SAAyC,SAAyB;AACtF,UAAI,6BAAW,IAAI,EAAG,QAAO;AAC7B,QAAM,SAAS,WAAW,OAAO;AACjC,QAAM,IAAI,aAAa;AAAA,IACrB,MAAM;AAAA,IACN,SAAS,GAAG,MAAM,GAAG,QAAQ,MAAM,eAAe,OAAO,MAAM,CAAC;AAAA,EAClE,CAAC;AACH;AAwBO,MAAM,oBAA+E;AAAA,EAC1F,qBAAqB;AAAA,EACrB,eAAe;AAAA,EACf,sCAAsC;AAAA,EACtC,iBAAiB;AAAA,EACjB,qBAAqB;AACvB;AAoBA,MAAM,UAAU,CAAC,aAAuD;AAAA,EACtE,UAAU,SAAS;AAAA,EACnB,QAAQ,SAAS;AACnB;AAGA,MAAM,WAAW,MAAM,SAAS,cAAc,OAAO,QAAQ,OAAO,UAAU,KAAK;AAW5E,MAAM,kBAA2C,iBAAiB,MAAM,QAAQ,GAAG;AAenF,MAAM,QAAuD,MAAM;AAAA,EACxE,mBAAmB,MAAM;AAAA,EACzB;AAAA,EACA,MAAM,QAAQ,uBAAuB,OAAO,QAAQ;AAAA,EACpD,MAAM;AAAA,EACN;AACF;AAeO,MAAM,UAAU,CAAC,SAAgE;AACtF,QAAM,iBAAiB,aAAa,WAAW,IAAI;AACnD,SAAO,MAAM;AAAA,IACX,mBAAmB,MAAM;AAAA,IACzB;AAAA,IACA,MAAM,QAAQ,uBAAuB,OAAO,QAAQ;AAAA,IACpD,MAAM,QAAQ,cAAc;AAAA,IAC5B;AAAA,EACF;AACF;AAoBO,MAAM,iBAAiB,CAC5B,YAC+E;AAC/E,QAAM,UAAU,MAAM;AAAA,IACpB,cAAc,aAAa,EAAE,SAAS,SAAS,QAAQ,CAAC;AAAA,IACxD,MAAM,QAAQ,uBAAuB,OAAO,QAAQ;AAAA,EACtD;AACA,SAAO,MAAM;AAAA,IACX,mBAAmB,MAAM;AAAA,IACzB;AAAA,IACA;AAAA;AAAA;AAAA;AAAA,IAIA,MAAM,aAAa,MAAM,cAAc,OAAO;AAAA,EAChD,EAAE,KAAK,MAAM,aAAa,cAAc,MAAM,QAAQ,OAAO,CAAC,CAAC,CAAC;AAClE;AAaO,MAAM,mBAAmB,CAC9B,MACA,YAC+E;AAC/E,QAAM,iBAAiB,aAAa,oBAAoB,IAAI;AAC5D,QAAM,UAAU,MAAM;AAAA,IACpB,cAAc,aAAa,EAAE,SAAS,SAAS,QAAQ,CAAC;AAAA,IACxD,MAAM,QAAQ,uBAAuB,OAAO,QAAQ;AAAA,EACtD;AACA,SAAO,MAAM;AAAA,IACX,mBAAmB,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA,MAAM,aAAa,MAAM,eAAe,cAAc,GAAG,OAAO;AAAA,EAClE,EAAE,KAAK,MAAM,aAAa,cAAc,MAAM,QAAQ,OAAO,CAAC,CAAC,CAAC;AAClE;",
+  "sourcesContent": ["/**\n * Aggregate Bun Host bundle.\n *\n * Runtime-specific dependencies stay inside this package; callers get the same\n * closed five-service Host surface every other bundle provides, plus native\n * `ProcessConfinement` for guarded commands.\n *\n * There is no Bun shell module: running a command is Effect's\n * `ChildProcessSpawner`, and `@effect/platform-bun`'s implementation is\n * `@effect/platform-node-shared`'s re-exported: the same code on both\n * runtimes, so no runtime detection is needed here.\n *\n * Outgoing HTTP uses the shared EgressHttpClient on both runtimes. Web\n * requests pin approved addresses; ordinary requests retain the shared pool.\n * Redirects remain visible to the capability kernel, and proxy routing follows\n * the host environment.\n *\n * The filesystem slot is `@smthrs/platform-node`'s `AtomicFileSystem`, byte for\n * byte the layer `NodeHost` uses, so a guarded path operation is\n * descriptor-relative and no-follow on both runtimes.\n *\n * @since 1.0.0-rc.0\n */\n\nimport * as BunChildProcessSpawner from \"@effect/platform-bun/BunChildProcessSpawner\"\nimport * as BunCrypto from \"@effect/platform-bun/BunCrypto\"\nimport * as BunPath from \"@effect/platform-bun/BunPath\"\nimport type { Jj } from \"@smthrs/jj\"\nimport * as BunJj from \"@smthrs/jj/bun/BunJj\"\nimport type { HostServiceIds } from \"@smthrs/kernel/HostServices\"\nimport type * as KernelProcessConfinement from \"@smthrs/kernel/ProcessConfinement\"\nimport type * as ProcessLedger from \"@smthrs/kernel/ProcessLedger\"\nimport * as AtomicFileSystem from \"@smthrs/platform-node/AtomicFileSystem\"\nimport * as EgressHttpClient from \"@smthrs/platform-node/EgressHttpClient\"\nimport * as HostLiveness from \"@smthrs/platform-node/HostLiveness\"\nimport * as ProcessConfinement from \"@smthrs/platform-node/ProcessConfinement\"\nimport * as ProcessReaper from \"@smthrs/platform-node/ProcessReaper\"\nimport type * as Crypto from \"effect/Crypto\"\nimport type { FileSystem } from \"effect/FileSystem\"\nimport type { HttpClient } from \"effect/http/HttpClient\"\nimport * as Layer from \"effect/Layer\"\nimport type * as Path from \"effect/Path\"\nimport type { ChildProcessSpawner } from \"effect/process/ChildProcessSpawner\"\nimport * as Schema from \"effect/Schema\"\nimport { isAbsolute } from \"node:path\"\nimport * as BunFileSystem from \"./BunFileSystem.ts\"\n\n/**\n * Bun platform modules for selectively providing individual services.\n *\n * `AtomicFileSystem` is here for the same reason `NodeHost` re-exports it: it\n * owns the only configuration escape hatch the filesystem slot has, and a Bun\n * program with a different packaged helper path needs to reach\n * `AtomicFileSystem.layerWith` without hand-composing the other four tags.\n *\n * `BunJj` is deliberately absent: it belongs to `@smthrs/jj` and is imported\n * from there, never re-exported here. So is `@effect/platform-bun/BunHttpClient`:\n * its `layer` follows redirects to origins the capability kernel never\n * authorized. The network slot on its own is {@link layerHttpClient}.\n *\n * @category re-exports\n * @since 1.0.0-rc.0\n * @slop\n */\nexport { AtomicFileSystem, BunChildProcessSpawner, BunCrypto, BunFileSystem, HostLiveness, ProcessReaper }\n\n/**\n * The complete closed Host service union provided by Bun.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport type BunHost =\n  | FileSystem\n  | Path.Path\n  | ChildProcessSpawner\n  | Jj\n  | HttpClient\n  | KernelProcessConfinement.ProcessConfinement\n\n/**\n * The stable codes a `BunHost` factory refuses with.\n *\n * A code is the contract a caller branches on; the message beside it is for a\n * person. `invalid_repository_root` is the root handed to {@link layerAt} or\n * {@link layerContainedAt} not being absolute or containing NUL, the empty\n * string included.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type BunHostErrorCode = \"invalid_repository_root\"\n\n/**\n * The refusal a `BunHost` factory throws before it builds a layer.\n *\n * It is thrown rather than failed because a factory is called while a program\n * composes its layers, where there is no fiber to fail yet and a wrong root is\n * a composition mistake, not a runtime outcome. It is this package's class,\n * not the `Jj` adapter's, because a Bun caller composes `BunHost` and should\n * learn nothing about the adapter behind the `Jj` slot from an error message.\n *\n * @category errors\n * @since 1.0.0-rc.0\n */\nexport class BunHostError extends Schema.TaggedError<BunHostError>()(\"@smthrs/platform-bun/BunHostError\", {\n  code: Schema.Literal(\"invalid_repository_root\"),\n  message: Schema.String\n}) {\n  override readonly name = \"BunHostError\"\n}\n\n/** The longest message a factory refuses with, in UTF-16 code units. */\nconst messageLimit = 255\n\n/** How many code points of a refused root the message repeats at most. */\nconst previewLimit = 64\n\n/**\n * A bounded, quoted excerpt of a refused root that fits in `budget` code\n * units of the message.\n *\n * Counted in code points rather than UTF-16 units so a cut never splits a\n * surrogate pair, and passed through `JSON.stringify` so a newline in the root\n * cannot break the log line the message lands on. Each code point is encoded\n * on its own and admitted only while the quoted excerpt plus the length\n * suffix still fit, so a control character that widens to a `\\u0001` escape\n * shortens the excerpt instead of lengthening the message, and a cut never\n * lands inside an escape.\n */\nconst preview = (root: string, budget: number): string => {\n  const points = Array.from(root)\n  const whole = JSON.stringify(root)\n  if (points.length <= previewLimit && whole.length <= budget) return whole\n  const suffix = `... (${points.length} characters)`\n  const room = budget - suffix.length - 2\n  let excerpt = \"\"\n  for (const point of points.slice(0, previewLimit)) {\n    const encoded = JSON.stringify(point).slice(1, -1)\n    if (excerpt.length + encoded.length > room) break\n    excerpt += encoded\n  }\n  return `\"${excerpt}\"${suffix}`\n}\n\n/**\n * Refuses a root the `Jj` adapter underneath would refuse, here and in this\n * package's name.\n *\n * `BunJj.layerAt` and `BunJj.layerSpawnerAt` are `NodeJj`'s, and those throw a\n * bare `TypeError` that names `NodeJj`, carries no code, and echoes the whole\n * string. The predicate includes the same `isAbsolute` the adapter applies, so\n * a root that passes this check cannot reach that throw. An absolute root\n * containing NUL is refused too: no filesystem or process API can represent it.\n */\nconst absoluteRoot = (factory: \"layerAt\" | \"layerContainedAt\", root: string): string => {\n  // An absolute root with NUL names that defect, not absoluteness it already has.\n  const requirement = !isAbsolute(root)\n    ? \"an absolute repository root\"\n    : root.includes(\"\\0\")\n    ? \"a repository root without NUL\"\n    : undefined\n  if (requirement === undefined) return root\n  const prefix = `BunHost.${factory} requires ${requirement}, got `\n  throw new BunHostError({\n    code: \"invalid_repository_root\",\n    message: `${prefix}${preview(root, messageLimit - prefix.length)}`\n  })\n}\n\n/**\n * Stable implementation identities keyed by the closed Host service slots.\n *\n * Each value names the module behind that slot in the raw host bundle.\n * Contained POSIX factories replace the spawner with {@link ProcessReaper.layerSpawner}.\n * These are identity\n * tokens rather than import specifiers: the filesystem entry is\n * `@smthrs/platform-node/AtomicFileSystem` because that is the implementation,\n * even though a consumer reaches it through `@smthrs/platform-bun`.\n *\n * Nothing digests them yet. `@smthrs/plan`'s step key carries a `layers`\n * component these values are meant to feed, but no planner derives it from a\n * host bundle today, so changing one invalidates no cached step.\n *\n * The keys are written as literals rather than `HostServiceIds` positions so\n * that reordering the closed list cannot silently pair a slot with another\n * slot's implementation.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const implementationIds: Readonly<Record<(typeof HostServiceIds)[number], string>> = {\n  \"effect/FileSystem\": \"@smthrs/platform-node/AtomicFileSystem\",\n  \"effect/Path\": \"@effect/platform-bun/BunPath\",\n  \"effect/process/ChildProcessSpawner\": \"@effect/platform-bun/BunChildProcessSpawner\",\n  \"@smthrs/jj/Jj\": \"@smthrs/jj/bun/BunJj\",\n  \"effect/HttpClient\": \"@smthrs/platform-node/EgressHttpClient\"\n}\n\n/**\n * What a caller may configure about containment.\n *\n * `ContainedSpawner.Options.platform` is deliberately not part of it. It\n * decides one thing, whether a command that names no `detached` option gets a\n * process group of its own, and this native host detaches by `process.platform`\n * whatever a record claims. A\n * caller-supplied `\"win32\"` on a POSIX host would therefore record\n * `pgid: null` for a child that really does lead a group, and\n * {@link ProcessReaper.reap} would retire that record as `no-group` and leave\n * the orphan running forever: a durable lie rather than a compile error.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type ContainedOptions = ProcessReaper.SpawnerOptions & ProcessReaper.Options\n\n/** The reaper half of {@link ContainedOptions}. */\nconst reaping = (options?: ContainedOptions): ProcessReaper.Options => ({\n  ownerPid: options?.ownerPid,\n  system: options?.system\n})\n\n/** The two services `BunChildProcessSpawner` resolves paths and files with. */\nconst platform = Layer.mergeAll(BunFileSystem.layer, BunPath.layer, BunCrypto.layer)\n\n/**\n * The network slot on its own: the shared egress client, which never follows a\n * redirect. A `3xx` comes back to the caller with its `location` intact and the\n * second origin uncontacted; following a redirect is `@smthrs/kernel`'s guarded\n * `HttpClient.layer`, which rechecks every hop.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerHttpClient: Layer.Layer<HttpClient> = EgressHttpClient.layer(process.env)\n\n/**\n * Provides all five Bun Host services, including the runtime-independent Path\n * service.\n *\n * Builds on a host without jj. The `Jj` slot probes `jj --version` on its\n * first operation and fails that operation with `JjError` carrying\n * `not_installed` or `unsupported_version`; a program that never calls `Jj`\n * runs without jj. `Jj` requires jj 0.39.0 or later.\n *\n * @category layers\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const layer: Layer.Layer<BunHost | Crypto.Crypto> = Layer.mergeAll(\n  ProcessConfinement.layer(),\n  platform,\n  Layer.provide(BunChildProcessSpawner.layer, platform),\n  BunJj.layer,\n  layerHttpClient\n)\n\n/**\n * Provides all five Bun Host services bound to one absolute repository root.\n *\n * Throws {@link BunHostError} with code `invalid_repository_root` when `root`\n * is not absolute or contains NUL; the empty string counts. The check runs\n * when the factory is called, before any layer exists.\n *\n * Builds without jj exactly as {@link layer} does: the `Jj` slot probes\n * `jj --version` on its first operation.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerAt = (root: string): Layer.Layer<BunHost | Crypto.Crypto> => {\n  const repositoryRoot = absoluteRoot(\"layerAt\", root)\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    Layer.provide(BunChildProcessSpawner.layer, platform),\n    BunJj.layerAt(repositoryRoot),\n    layerHttpClient\n  )\n}\n\n/**\n * Provides the Bun host with process containment turned on.\n *\n * Bun uses the same prepared native process lifecycle as Node on POSIX, while\n * preserving its underlying runtime spawner on Windows. `ContainedSpawner` gives\n * every child an escalation deadline and a ledger entry, and\n * `ProcessReaper` sweeps the entries a crashed incarnation of this host left\n * behind. The reaper module lives in `@smthrs/platform-node` because the calls\n * it makes, `process.kill` and `taskkill`, are Node's, and Bun implements\n * them unchanged.\n *\n * Builds without jj exactly as {@link layer} does; here the first\n * operation's `jj --version` probe runs through the contained spawner, so its\n * record enters and leaves the ledger like any other child.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerContained = (\n  options?: ContainedOptions\n): Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger> => {\n  const spawner = Layer.provide(\n    ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),\n    Layer.provide(BunChildProcessSpawner.layer, platform)\n  )\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    layerHttpClient,\n    // jj goes through the CONTAINED spawner here, not around it, exactly as in\n    // `NodeHost.layerContained`: a jj child that starts its own process leads\n    // no recorded group, is in no ledger, and outlives the host that ran it.\n    Layer.provideMerge(BunJj.layerSpawner, spawner)\n  ).pipe(Layer.provideMerge(ProcessReaper.layer(reaping(options))))\n}\n\n/**\n * Provides the contained Bun host bound to one absolute repository root.\n *\n * Refuses a root exactly as {@link layerAt} does: {@link BunHostError} with\n * code `invalid_repository_root`, thrown when the factory is called.\n * Builds without jj exactly as {@link layerContained} does.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerContainedAt = (\n  root: string,\n  options?: ContainedOptions\n): Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger> => {\n  const repositoryRoot = absoluteRoot(\"layerContainedAt\", root)\n  const spawner = Layer.provide(\n    ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),\n    Layer.provide(BunChildProcessSpawner.layer, platform)\n  )\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    layerHttpClient,\n    Layer.provideMerge(BunJj.layerSpawnerAt(repositoryRoot), spawner)\n  ).pipe(Layer.provideMerge(ProcessReaper.layer(reaping(options))))\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAwBA,6BAAwC;AACxC,gBAA2B;AAC3B,cAAyB;AAEzB,YAAuB;AAIvB,uBAAkC;AAClC,uBAAkC;AAClC,mBAA8B;AAC9B,yBAAoC;AACpC,oBAA+B;AAI/B,YAAuB;AAGvB,aAAwB;AACxB,uBAA2B;AAC3B,oBAA+B;AA6DxB,MAAM,qBAAqB,OAAO,YAA0B,EAAE,qCAAqC;AAAA,EACxG,MAAM,OAAO,QAAQ,yBAAyB;AAAA,EAC9C,SAAS,OAAO;AAClB,CAAC,EAAE;AAAA,EACiB,OAAO;AAC3B;AAGA,MAAM,eAAe;AAGrB,MAAM,eAAe;AAcrB,MAAM,UAAU,CAAC,MAAc,WAA2B;AACxD,QAAM,SAAS,MAAM,KAAK,IAAI;AAC9B,QAAM,QAAQ,KAAK,UAAU,IAAI;AACjC,MAAI,OAAO,UAAU,gBAAgB,MAAM,UAAU,OAAQ,QAAO;AACpE,QAAM,SAAS,QAAQ,OAAO,MAAM;AACpC,QAAM,OAAO,SAAS,OAAO,SAAS;AACtC,MAAI,UAAU;AACd,aAAW,SAAS,OAAO,MAAM,GAAG,YAAY,GAAG;AACjD,UAAM,UAAU,KAAK,UAAU,KAAK,EAAE,MAAM,GAAG,EAAE;AACjD,QAAI,QAAQ,SAAS,QAAQ,SAAS,KAAM;AAC5C,eAAW;AAAA,EACb;AACA,SAAO,IAAI,OAAO,IAAI,MAAM;AAC9B;AAYA,MAAM,eAAe,CAAC,SAAyC,SAAyB;AAEtF,QAAM,cAAc,KAAC,6BAAW,IAAI,IAChC,gCACA,KAAK,SAAS,IAAI,IAClB,kCACA;AACJ,MAAI,gBAAgB,OAAW,QAAO;AACtC,QAAM,SAAS,WAAW,OAAO,aAAa,WAAW;AACzD,QAAM,IAAI,aAAa;AAAA,IACrB,MAAM;AAAA,IACN,SAAS,GAAG,MAAM,GAAG,QAAQ,MAAM,eAAe,OAAO,MAAM,CAAC;AAAA,EAClE,CAAC;AACH;AAwBO,MAAM,oBAA+E;AAAA,EAC1F,qBAAqB;AAAA,EACrB,eAAe;AAAA,EACf,sCAAsC;AAAA,EACtC,iBAAiB;AAAA,EACjB,qBAAqB;AACvB;AAoBA,MAAM,UAAU,CAAC,aAAuD;AAAA,EACtE,UAAU,SAAS;AAAA,EACnB,QAAQ,SAAS;AACnB;AAGA,MAAM,WAAW,MAAM,SAAS,cAAc,OAAO,QAAQ,OAAO,UAAU,KAAK;AAW5E,MAAM,kBAA2C,iBAAiB,MAAM,QAAQ,GAAG;AAenF,MAAM,QAA8C,MAAM;AAAA,EAC/D,mBAAmB,MAAM;AAAA,EACzB;AAAA,EACA,MAAM,QAAQ,uBAAuB,OAAO,QAAQ;AAAA,EACpD,MAAM;AAAA,EACN;AACF;AAeO,MAAM,UAAU,CAAC,SAAuD;AAC7E,QAAM,iBAAiB,aAAa,WAAW,IAAI;AACnD,SAAO,MAAM;AAAA,IACX,mBAAmB,MAAM;AAAA,IACzB;AAAA,IACA,MAAM,QAAQ,uBAAuB,OAAO,QAAQ;AAAA,IACpD,MAAM,QAAQ,cAAc;AAAA,IAC5B;AAAA,EACF;AACF;AAoBO,MAAM,iBAAiB,CAC5B,YAC6E;AAC7E,QAAM,UAAU,MAAM;AAAA,IACpB,cAAc,aAAa,EAAE,SAAS,SAAS,QAAQ,CAAC;AAAA,IACxD,MAAM,QAAQ,uBAAuB,OAAO,QAAQ;AAAA,EACtD;AACA,SAAO,MAAM;AAAA,IACX,mBAAmB,MAAM;AAAA,IACzB;AAAA,IACA;AAAA;AAAA;AAAA;AAAA,IAIA,MAAM,aAAa,MAAM,cAAc,OAAO;AAAA,EAChD,EAAE,KAAK,MAAM,aAAa,cAAc,MAAM,QAAQ,OAAO,CAAC,CAAC,CAAC;AAClE;AAYO,MAAM,mBAAmB,CAC9B,MACA,YAC6E;AAC7E,QAAM,iBAAiB,aAAa,oBAAoB,IAAI;AAC5D,QAAM,UAAU,MAAM;AAAA,IACpB,cAAc,aAAa,EAAE,SAAS,SAAS,QAAQ,CAAC;AAAA,IACxD,MAAM,QAAQ,uBAAuB,OAAO,QAAQ;AAAA,EACtD;AACA,SAAO,MAAM;AAAA,IACX,mBAAmB,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA,MAAM,aAAa,MAAM,eAAe,cAAc,GAAG,OAAO;AAAA,EAClE,EAAE,KAAK,MAAM,aAAa,cAAc,MAAM,QAAQ,OAAO,CAAC,CAAC,CAAC;AAClE;",
   "names": []
 }

package/dist/esm/BunHost.d.ts

@@ -23,7 +23,7 @@
  */
 import * as BunChildProcessSpawner from "../vendor/bun/BunChildProcessSpawner.js";
 import * as BunCrypto from "../vendor/bun/BunCrypto.js";
-import type { Jj, JjError } from "@smthrs/jj";
+import type { Jj } from "@smthrs/jj";
 import type { HostServiceIds } from "@smthrs/kernel/HostServices";
 import type * as KernelProcessConfinement from "@smthrs/kernel/ProcessConfinement";
 import type * as ProcessLedger from "@smthrs/kernel/ProcessLedger";
@@ -69,7 +69,8 @@ export type BunHost = FileSystem | Path.Path | ChildProcessSpawner | Jj | HttpCl
  *
  * A code is the contract a caller branches on; the message beside it is for a
  * person. `invalid_repository_root` is the root handed to {@link layerAt} or
- * {@link layerContainedAt} not being absolute, the empty string included.
+ * {@link layerContainedAt} not being absolute or containing NUL, the empty
+ * string included.
  *
  * @category models
  * @since 1.0.0-rc.0
@@ -147,30 +148,30 @@ export declare const layerHttpClient: Layer.Layer<HttpClient>;
  * Provides all five Bun Host services, including the runtime-independent Path
  * service.
  *
- * Fails at construction with {@link JjError} carrying `not_installed` or
- * `unsupported_version`: the `Jj` slot is merged eagerly and probes
- * `jj --version` while the layer is built, before the program body runs and
- * whether or not the program asks for `Jj`. Requires jj 0.39.0 or later.
+ * Builds on a host without jj. The `Jj` slot probes `jj --version` on its
+ * first operation and fails that operation with `JjError` carrying
+ * `not_installed` or `unsupported_version`; a program that never calls `Jj`
+ * runs without jj. `Jj` requires jj 0.39.0 or later.
  *
  * @category layers
  * @since 1.0.0-rc.0
  * @slop
  */
-export declare const layer: Layer.Layer<BunHost | Crypto.Crypto, JjError>;
+export declare const layer: Layer.Layer<BunHost | Crypto.Crypto>;
 /**
  * Provides all five Bun Host services bound to one absolute repository root.
  *
  * Throws {@link BunHostError} with code `invalid_repository_root` when `root`
- * is not absolute; the empty string counts. The check runs when the factory is
- * called, before any layer exists.
+ * is not absolute or contains NUL; the empty string counts. The check runs
+ * when the factory is called, before any layer exists.
  *
- * Fails at construction with {@link JjError} exactly as {@link layer} does:
- * the `Jj` slot probes `jj --version` while the layer is built.
+ * Builds without jj exactly as {@link layer} does: the `Jj` slot probes
+ * `jj --version` on its first operation.
  *
  * @category layers
  * @since 1.0.0-rc.0
  */
-export declare const layerAt: (root: string) => Layer.Layer<BunHost | Crypto.Crypto, JjError>;
+export declare const layerAt: (root: string) => Layer.Layer<BunHost | Crypto.Crypto>;
 /**
  * Provides the Bun host with process containment turned on.
  *
@@ -182,24 +183,23 @@ export declare const layerAt: (root: string) => Layer.Layer<BunHost | Crypto.Cry
  * it makes, `process.kill` and `taskkill`, are Node's, and Bun implements
  * them unchanged.
  *
- * Fails at construction with {@link JjError} exactly as {@link layer} does;
- * here the `jj --version` probe runs through the contained spawner, so its
+ * Builds without jj exactly as {@link layer} does; here the first
+ * operation's `jj --version` probe runs through the contained spawner, so its
  * record enters and leaves the ledger like any other child.
  *
  * @category layers
  * @since 1.0.0-rc.0
  */
-export declare const layerContained: (options?: ContainedOptions) => Layer.Layer<BunHost | Crypto.Crypto, JjError, ProcessLedger.ProcessLedger>;
+export declare const layerContained: (options?: ContainedOptions) => Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger>;
 /**
  * Provides the contained Bun host bound to one absolute repository root.
  *
  * Refuses a root exactly as {@link layerAt} does: {@link BunHostError} with
  * code `invalid_repository_root`, thrown when the factory is called.
- * Fails at construction with {@link JjError} exactly as {@link layerContained}
- * does.
+ * Builds without jj exactly as {@link layerContained} does.
  *
  * @category layers
  * @since 1.0.0-rc.0
  */
-export declare const layerContainedAt: (root: string, options?: ContainedOptions) => Layer.Layer<BunHost | Crypto.Crypto, JjError, ProcessLedger.ProcessLedger>;
+export declare const layerContainedAt: (root: string, options?: ContainedOptions) => Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger>;
 //# sourceMappingURL=BunHost.d.ts.map

package/dist/esm/BunHost.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BunHost.d.ts","sourceRoot":"","sources":["../../src/BunHost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,sBAAsB,MAAM,6CAA6C,CAAA;AACrF,OAAO,KAAK,SAAS,MAAM,gCAAgC,CAAA;AAE3D,OAAO,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAE7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,KAAK,KAAK,wBAAwB,MAAM,mCAAmC,CAAA;AAClF,OAAO,KAAK,KAAK,aAAa,MAAM,8BAA8B,CAAA;AAClE,OAAO,KAAK,gBAAgB,MAAM,wCAAwC,CAAA;AAE1E,OAAO,KAAK,YAAY,MAAM,oCAAoC,CAAA;AAElE,OAAO,KAAK,aAAa,MAAM,qCAAqC,CAAA;AACpE,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,KAAK,IAAI,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAC7E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,CAAA;AAE1G;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,GACf,UAAU,GACV,IAAI,CAAC,IAAI,GACT,mBAAmB,GACnB,EAAE,GACF,UAAU,GACV,wBAAwB,CAAC,kBAAkB,CAAA;AAE/C;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG,yBAAyB,CAAA;;;;;AAExD;;;;;;;;;;;GAWG;AACH,qBAAa,YAAa,SAAQ,iBAGhC;IACA,SAAkB,IAAI,kBAAiB;CACxC;AAqDD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAMvF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC,cAAc,GAAG,aAAa,CAAC,OAAO,CAAA;AAWnF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAuC,CAAA;AAE3F;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAM/D,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,MAAM,KAAG,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CASlF,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,GACzB,UAAU,gBAAgB,KACzB,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,aAAa,CAc3E,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,GAC3B,MAAM,MAAM,EACZ,UAAU,gBAAgB,KACzB,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,aAAa,CAY3E,CAAA"}
+{"version":3,"file":"BunHost.d.ts","sourceRoot":"","sources":["../../src/BunHost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,sBAAsB,MAAM,6CAA6C,CAAA;AACrF,OAAO,KAAK,SAAS,MAAM,gCAAgC,CAAA;AAE3D,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,YAAY,CAAA;AAEpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,KAAK,KAAK,wBAAwB,MAAM,mCAAmC,CAAA;AAClF,OAAO,KAAK,KAAK,aAAa,MAAM,8BAA8B,CAAA;AAClE,OAAO,KAAK,gBAAgB,MAAM,wCAAwC,CAAA;AAE1E,OAAO,KAAK,YAAY,MAAM,oCAAoC,CAAA;AAElE,OAAO,KAAK,aAAa,MAAM,qCAAqC,CAAA;AACpE,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,KAAK,IAAI,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAC7E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,CAAA;AAE1G;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,GACf,UAAU,GACV,IAAI,CAAC,IAAI,GACT,mBAAmB,GACnB,EAAE,GACF,UAAU,GACV,wBAAwB,CAAC,kBAAkB,CAAA;AAE/C;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GAAG,yBAAyB,CAAA;;;;;AAExD;;;;;;;;;;;GAWG;AACH,qBAAa,YAAa,SAAQ,iBAGhC;IACA,SAAkB,IAAI,kBAAiB;CACxC;AA4DD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAMvF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC,cAAc,GAAG,aAAa,CAAC,OAAO,CAAA;AAWnF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAuC,CAAA;AAE3F;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAMtD,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,MAAM,KAAG,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CASzE,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,GACzB,UAAU,gBAAgB,KACzB,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,aAAa,CAczE,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAC3B,MAAM,MAAM,EACZ,UAAU,gBAAgB,KACzB,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,aAAa,CAYzE,CAAA"}

package/dist/esm/BunHost.js

@@ -108,13 +108,20 @@ const preview = (root, budget) => {
  *
  * `BunJj.layerAt` and `BunJj.layerSpawnerAt` are `NodeJj`'s, and those throw a
  * bare `TypeError` that names `NodeJj`, carries no code, and echoes the whole
- * string. The predicate here is the same `isAbsolute` the adapter applies, so
- * a root that passes this check cannot reach that throw.
+ * string. The predicate includes the same `isAbsolute` the adapter applies, so
+ * a root that passes this check cannot reach that throw. An absolute root
+ * containing NUL is refused too: no filesystem or process API can represent it.
  */
 const absoluteRoot = (factory, root) => {
-    if (isAbsolute(root))
+    // An absolute root with NUL names that defect, not absoluteness it already has.
+    const requirement = !isAbsolute(root)
+        ? "an absolute repository root"
+        : root.includes("\0")
+            ? "a repository root without NUL"
+            : undefined;
+    if (requirement === undefined)
         return root;
-    const prefix = `BunHost.${factory} requires an absolute repository root, got `;
+    const prefix = `BunHost.${factory} requires ${requirement}, got `;
     throw new BunHostError({
         code: "invalid_repository_root",
         message: `${prefix}${preview(root, messageLimit - prefix.length)}`
@@ -170,10 +177,10 @@ export const layerHttpClient = EgressHttpClient.layer(process.env);
  * Provides all five Bun Host services, including the runtime-independent Path
  * service.
  *
- * Fails at construction with {@link JjError} carrying `not_installed` or
- * `unsupported_version`: the `Jj` slot is merged eagerly and probes
- * `jj --version` while the layer is built, before the program body runs and
- * whether or not the program asks for `Jj`. Requires jj 0.39.0 or later.
+ * Builds on a host without jj. The `Jj` slot probes `jj --version` on its
+ * first operation and fails that operation with `JjError` carrying
+ * `not_installed` or `unsupported_version`; a program that never calls `Jj`
+ * runs without jj. `Jj` requires jj 0.39.0 or later.
  *
  * @category layers
  * @since 1.0.0-rc.0
@@ -184,11 +191,11 @@ export const layer = Layer.mergeAll(ProcessConfinement.layer(), platform, Layer.
  * Provides all five Bun Host services bound to one absolute repository root.
  *
  * Throws {@link BunHostError} with code `invalid_repository_root` when `root`
- * is not absolute; the empty string counts. The check runs when the factory is
- * called, before any layer exists.
+ * is not absolute or contains NUL; the empty string counts. The check runs
+ * when the factory is called, before any layer exists.
  *
- * Fails at construction with {@link JjError} exactly as {@link layer} does:
- * the `Jj` slot probes `jj --version` while the layer is built.
+ * Builds without jj exactly as {@link layer} does: the `Jj` slot probes
+ * `jj --version` on its first operation.
  *
  * @category layers
  * @since 1.0.0-rc.0
@@ -208,8 +215,8 @@ export const layerAt = (root) => {
  * it makes, `process.kill` and `taskkill`, are Node's, and Bun implements
  * them unchanged.
  *
- * Fails at construction with {@link JjError} exactly as {@link layer} does;
- * here the `jj --version` probe runs through the contained spawner, so its
+ * Builds without jj exactly as {@link layer} does; here the first
+ * operation's `jj --version` probe runs through the contained spawner, so its
  * record enters and leaves the ledger like any other child.
  *
  * @category layers
@@ -228,8 +235,7 @@ export const layerContained = (options) => {
  *
  * Refuses a root exactly as {@link layerAt} does: {@link BunHostError} with
  * code `invalid_repository_root`, thrown when the factory is called.
- * Fails at construction with {@link JjError} exactly as {@link layerContained}
- * does.
+ * Builds without jj exactly as {@link layerContained} does.
  *
  * @category layers
  * @since 1.0.0-rc.0

package/dist/esm/BunHost.js.map

@@ -1 +1 @@
-{"version":3,"file":"BunHost.js","sourceRoot":"","sources":["../../src/BunHost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,sBAAsB,MAAM,6CAA6C,CAAA;AACrF,OAAO,KAAK,SAAS,MAAM,gCAAgC,CAAA;AAC3D,OAAO,KAAK,OAAO,MAAM,8BAA8B,CAAA;AAEvD,OAAO,KAAK,KAAK,MAAM,sBAAsB,CAAA;AAI7C,OAAO,KAAK,gBAAgB,MAAM,wCAAwC,CAAA;AAC1E,OAAO,KAAK,gBAAgB,MAAM,wCAAwC,CAAA;AAC1E,OAAO,KAAK,YAAY,MAAM,oCAAoC,CAAA;AAClE,OAAO,KAAK,kBAAkB,MAAM,0CAA0C,CAAA;AAC9E,OAAO,KAAK,aAAa,MAAM,qCAAqC,CAAA;AAIpE,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAGrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,CAAA;AA6B1G;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,WAAW,EAAgB,CAAC,mCAAmC,EAAE;IACxG,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;IACkB,IAAI,GAAG,cAAc,CAAA;CACxC;AAED,wEAAwE;AACxE,MAAM,YAAY,GAAG,GAAG,CAAA;AAExB,0EAA0E;AAC1E,MAAM,YAAY,GAAG,EAAE,CAAA;AAEvB;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,MAAc,EAAU,EAAE;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,MAAM,CAAC,MAAM,IAAI,YAAY,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM;QAAE,OAAO,KAAK,CAAA;IACzE,MAAM,MAAM,GAAG,QAAQ,MAAM,CAAC,MAAM,cAAc,CAAA;IAClD,MAAM,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;IACvC,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAClD,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI;YAAE,MAAK;QACjD,OAAO,IAAI,OAAO,CAAA;IACpB,CAAC;IACD,OAAO,IAAI,OAAO,IAAI,MAAM,EAAE,CAAA;AAChC,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,CAAC,OAAuC,EAAE,IAAY,EAAU,EAAE;IACrF,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACjC,MAAM,MAAM,GAAG,WAAW,OAAO,6CAA6C,CAAA;IAC9E,MAAM,IAAI,YAAY,CAAC;QACrB,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE;KACnE,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA8D;IAC1F,mBAAmB,EAAE,wCAAwC;IAC7D,aAAa,EAAE,8BAA8B;IAC7C,oCAAoC,EAAE,6CAA6C;IACnF,eAAe,EAAE,sBAAsB;IACvC,mBAAmB,EAAE,wCAAwC;CAC9D,CAAA;AAmBD,mDAAmD;AACnD,MAAM,OAAO,GAAG,CAAC,OAA0B,EAAyB,EAAE,CAAC,CAAC;IACtE,QAAQ,EAAE,OAAO,EAAE,QAAQ;IAC3B,MAAM,EAAE,OAAO,EAAE,MAAM;CACxB,CAAC,CAAA;AAEF,+EAA+E;AAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAA;AAEpF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAA4B,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;AAE3F;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,KAAK,GAAkD,KAAK,CAAC,QAAQ,CAChF,kBAAkB,CAAC,KAAK,EAAE,EAC1B,QAAQ,EACR,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,EACrD,KAAK,CAAC,KAAK,EACX,eAAe,CAChB,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAiD,EAAE;IACrF,MAAM,cAAc,GAAG,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IACpD,OAAO,KAAK,CAAC,QAAQ,CACnB,kBAAkB,CAAC,KAAK,EAAE,EAC1B,QAAQ,EACR,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,EACrD,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,eAAe,CAChB,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,OAA0B,EACkD,EAAE;IAC9E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAC3B,aAAa,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EACzD,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CACtD,CAAA;IACD,OAAO,KAAK,CAAC,QAAQ,CACnB,kBAAkB,CAAC,KAAK,EAAE,EAC1B,QAAQ,EACR,eAAe;IACf,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAChD,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;AACnE,CAAC,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,IAAY,EACZ,OAA0B,EACkD,EAAE;IAC9E,MAAM,cAAc,GAAG,YAAY,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAA;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAC3B,aAAa,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EACzD,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CACtD,CAAA;IACD,OAAO,KAAK,CAAC,QAAQ,CACnB,kBAAkB,CAAC,KAAK,EAAE,EAC1B,QAAQ,EACR,eAAe,EACf,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,CAClE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;AACnE,CAAC,CAAA","sourcesContent":["/**\n * Aggregate Bun Host bundle.\n *\n * Runtime-specific dependencies stay inside this package; callers get the same\n * closed five-service Host surface every other bundle provides, plus native\n * `ProcessConfinement` for guarded commands.\n *\n * There is no Bun shell module: running a command is Effect's\n * `ChildProcessSpawner`, and `@effect/platform-bun`'s implementation is\n * `@effect/platform-node-shared`'s re-exported: the same code on both\n * runtimes, so no runtime detection is needed here.\n *\n * Outgoing HTTP uses the shared EgressHttpClient on both runtimes. Web\n * requests pin approved addresses; ordinary requests retain the shared pool.\n * Redirects remain visible to the capability kernel, and proxy routing follows\n * the host environment.\n *\n * The filesystem slot is `@smthrs/platform-node`'s `AtomicFileSystem`, byte for\n * byte the layer `NodeHost` uses, so a guarded path operation is\n * descriptor-relative and no-follow on both runtimes.\n *\n * @since 1.0.0-rc.0\n */\n\nimport * as BunChildProcessSpawner from \"@effect/platform-bun/BunChildProcessSpawner\"\nimport * as BunCrypto from \"@effect/platform-bun/BunCrypto\"\nimport * as BunPath from \"@effect/platform-bun/BunPath\"\nimport type { Jj, JjError } from \"@smthrs/jj\"\nimport * as BunJj from \"@smthrs/jj/bun/BunJj\"\nimport type { HostServiceIds } from \"@smthrs/kernel/HostServices\"\nimport type * as KernelProcessConfinement from \"@smthrs/kernel/ProcessConfinement\"\nimport type * as ProcessLedger from \"@smthrs/kernel/ProcessLedger\"\nimport * as AtomicFileSystem from \"@smthrs/platform-node/AtomicFileSystem\"\nimport * as EgressHttpClient from \"@smthrs/platform-node/EgressHttpClient\"\nimport * as HostLiveness from \"@smthrs/platform-node/HostLiveness\"\nimport * as ProcessConfinement from \"@smthrs/platform-node/ProcessConfinement\"\nimport * as ProcessReaper from \"@smthrs/platform-node/ProcessReaper\"\nimport type * as Crypto from \"effect/Crypto\"\nimport type { FileSystem } from \"effect/FileSystem\"\nimport type { HttpClient } from \"effect/http/HttpClient\"\nimport * as Layer from \"effect/Layer\"\nimport type * as Path from \"effect/Path\"\nimport type { ChildProcessSpawner } from \"effect/process/ChildProcessSpawner\"\nimport * as Schema from \"effect/Schema\"\nimport { isAbsolute } from \"node:path\"\nimport * as BunFileSystem from \"./BunFileSystem.ts\"\n\n/**\n * Bun platform modules for selectively providing individual services.\n *\n * `AtomicFileSystem` is here for the same reason `NodeHost` re-exports it: it\n * owns the only configuration escape hatch the filesystem slot has, and a Bun\n * program with a different packaged helper path needs to reach\n * `AtomicFileSystem.layerWith` without hand-composing the other four tags.\n *\n * `BunJj` is deliberately absent: it belongs to `@smthrs/jj` and is imported\n * from there, never re-exported here. So is `@effect/platform-bun/BunHttpClient`:\n * its `layer` follows redirects to origins the capability kernel never\n * authorized. The network slot on its own is {@link layerHttpClient}.\n *\n * @category re-exports\n * @since 1.0.0-rc.0\n * @slop\n */\nexport { AtomicFileSystem, BunChildProcessSpawner, BunCrypto, BunFileSystem, HostLiveness, ProcessReaper }\n\n/**\n * The complete closed Host service union provided by Bun.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport type BunHost =\n  | FileSystem\n  | Path.Path\n  | ChildProcessSpawner\n  | Jj\n  | HttpClient\n  | KernelProcessConfinement.ProcessConfinement\n\n/**\n * The stable codes a `BunHost` factory refuses with.\n *\n * A code is the contract a caller branches on; the message beside it is for a\n * person. `invalid_repository_root` is the root handed to {@link layerAt} or\n * {@link layerContainedAt} not being absolute, the empty string included.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type BunHostErrorCode = \"invalid_repository_root\"\n\n/**\n * The refusal a `BunHost` factory throws before it builds a layer.\n *\n * It is thrown rather than failed because a factory is called while a program\n * composes its layers, where there is no fiber to fail yet and a wrong root is\n * a composition mistake, not a runtime outcome. It is this package's class,\n * not the `Jj` adapter's, because a Bun caller composes `BunHost` and should\n * learn nothing about the adapter behind the `Jj` slot from an error message.\n *\n * @category errors\n * @since 1.0.0-rc.0\n */\nexport class BunHostError extends Schema.TaggedError<BunHostError>()(\"@smthrs/platform-bun/BunHostError\", {\n  code: Schema.Literal(\"invalid_repository_root\"),\n  message: Schema.String\n}) {\n  override readonly name = \"BunHostError\"\n}\n\n/** The longest message a factory refuses with, in UTF-16 code units. */\nconst messageLimit = 255\n\n/** How many code points of a refused root the message repeats at most. */\nconst previewLimit = 64\n\n/**\n * A bounded, quoted excerpt of a refused root that fits in `budget` code\n * units of the message.\n *\n * Counted in code points rather than UTF-16 units so a cut never splits a\n * surrogate pair, and passed through `JSON.stringify` so a newline in the root\n * cannot break the log line the message lands on. Each code point is encoded\n * on its own and admitted only while the quoted excerpt plus the length\n * suffix still fit, so a control character that widens to a `\\u0001` escape\n * shortens the excerpt instead of lengthening the message, and a cut never\n * lands inside an escape.\n */\nconst preview = (root: string, budget: number): string => {\n  const points = Array.from(root)\n  const whole = JSON.stringify(root)\n  if (points.length <= previewLimit && whole.length <= budget) return whole\n  const suffix = `... (${points.length} characters)`\n  const room = budget - suffix.length - 2\n  let excerpt = \"\"\n  for (const point of points.slice(0, previewLimit)) {\n    const encoded = JSON.stringify(point).slice(1, -1)\n    if (excerpt.length + encoded.length > room) break\n    excerpt += encoded\n  }\n  return `\"${excerpt}\"${suffix}`\n}\n\n/**\n * Refuses a root the `Jj` adapter underneath would refuse, here and in this\n * package's name.\n *\n * `BunJj.layerAt` and `BunJj.layerSpawnerAt` are `NodeJj`'s, and those throw a\n * bare `TypeError` that names `NodeJj`, carries no code, and echoes the whole\n * string. The predicate here is the same `isAbsolute` the adapter applies, so\n * a root that passes this check cannot reach that throw.\n */\nconst absoluteRoot = (factory: \"layerAt\" | \"layerContainedAt\", root: string): string => {\n  if (isAbsolute(root)) return root\n  const prefix = `BunHost.${factory} requires an absolute repository root, got `\n  throw new BunHostError({\n    code: \"invalid_repository_root\",\n    message: `${prefix}${preview(root, messageLimit - prefix.length)}`\n  })\n}\n\n/**\n * Stable implementation identities keyed by the closed Host service slots.\n *\n * Each value names the module behind that slot in the raw host bundle.\n * Contained POSIX factories replace the spawner with {@link ProcessReaper.layerSpawner}.\n * These are identity\n * tokens rather than import specifiers: the filesystem entry is\n * `@smthrs/platform-node/AtomicFileSystem` because that is the implementation,\n * even though a consumer reaches it through `@smthrs/platform-bun`.\n *\n * Nothing digests them yet. `@smthrs/plan`'s step key carries a `layers`\n * component these values are meant to feed, but no planner derives it from a\n * host bundle today, so changing one invalidates no cached step.\n *\n * The keys are written as literals rather than `HostServiceIds` positions so\n * that reordering the closed list cannot silently pair a slot with another\n * slot's implementation.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const implementationIds: Readonly<Record<(typeof HostServiceIds)[number], string>> = {\n  \"effect/FileSystem\": \"@smthrs/platform-node/AtomicFileSystem\",\n  \"effect/Path\": \"@effect/platform-bun/BunPath\",\n  \"effect/process/ChildProcessSpawner\": \"@effect/platform-bun/BunChildProcessSpawner\",\n  \"@smthrs/jj/Jj\": \"@smthrs/jj/bun/BunJj\",\n  \"effect/HttpClient\": \"@smthrs/platform-node/EgressHttpClient\"\n}\n\n/**\n * What a caller may configure about containment.\n *\n * `ContainedSpawner.Options.platform` is deliberately not part of it. It\n * decides one thing, whether a command that names no `detached` option gets a\n * process group of its own, and this native host detaches by `process.platform`\n * whatever a record claims. A\n * caller-supplied `\"win32\"` on a POSIX host would therefore record\n * `pgid: null` for a child that really does lead a group, and\n * {@link ProcessReaper.reap} would retire that record as `no-group` and leave\n * the orphan running forever: a durable lie rather than a compile error.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type ContainedOptions = ProcessReaper.SpawnerOptions & ProcessReaper.Options\n\n/** The reaper half of {@link ContainedOptions}. */\nconst reaping = (options?: ContainedOptions): ProcessReaper.Options => ({\n  ownerPid: options?.ownerPid,\n  system: options?.system\n})\n\n/** The two services `BunChildProcessSpawner` resolves paths and files with. */\nconst platform = Layer.mergeAll(BunFileSystem.layer, BunPath.layer, BunCrypto.layer)\n\n/**\n * The network slot on its own: the shared egress client, which never follows a\n * redirect. A `3xx` comes back to the caller with its `location` intact and the\n * second origin uncontacted; following a redirect is `@smthrs/kernel`'s guarded\n * `HttpClient.layer`, which rechecks every hop.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerHttpClient: Layer.Layer<HttpClient> = EgressHttpClient.layer(process.env)\n\n/**\n * Provides all five Bun Host services, including the runtime-independent Path\n * service.\n *\n * Fails at construction with {@link JjError} carrying `not_installed` or\n * `unsupported_version`: the `Jj` slot is merged eagerly and probes\n * `jj --version` while the layer is built, before the program body runs and\n * whether or not the program asks for `Jj`. Requires jj 0.39.0 or later.\n *\n * @category layers\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const layer: Layer.Layer<BunHost | Crypto.Crypto, JjError> = Layer.mergeAll(\n  ProcessConfinement.layer(),\n  platform,\n  Layer.provide(BunChildProcessSpawner.layer, platform),\n  BunJj.layer,\n  layerHttpClient\n)\n\n/**\n * Provides all five Bun Host services bound to one absolute repository root.\n *\n * Throws {@link BunHostError} with code `invalid_repository_root` when `root`\n * is not absolute; the empty string counts. The check runs when the factory is\n * called, before any layer exists.\n *\n * Fails at construction with {@link JjError} exactly as {@link layer} does:\n * the `Jj` slot probes `jj --version` while the layer is built.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerAt = (root: string): Layer.Layer<BunHost | Crypto.Crypto, JjError> => {\n  const repositoryRoot = absoluteRoot(\"layerAt\", root)\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    Layer.provide(BunChildProcessSpawner.layer, platform),\n    BunJj.layerAt(repositoryRoot),\n    layerHttpClient\n  )\n}\n\n/**\n * Provides the Bun host with process containment turned on.\n *\n * Bun uses the same prepared native process lifecycle as Node on POSIX, while\n * preserving its underlying runtime spawner on Windows. `ContainedSpawner` gives\n * every child an escalation deadline and a ledger entry, and\n * `ProcessReaper` sweeps the entries a crashed incarnation of this host left\n * behind. The reaper module lives in `@smthrs/platform-node` because the calls\n * it makes, `process.kill` and `taskkill`, are Node's, and Bun implements\n * them unchanged.\n *\n * Fails at construction with {@link JjError} exactly as {@link layer} does;\n * here the `jj --version` probe runs through the contained spawner, so its\n * record enters and leaves the ledger like any other child.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerContained = (\n  options?: ContainedOptions\n): Layer.Layer<BunHost | Crypto.Crypto, JjError, ProcessLedger.ProcessLedger> => {\n  const spawner = Layer.provide(\n    ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),\n    Layer.provide(BunChildProcessSpawner.layer, platform)\n  )\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    layerHttpClient,\n    // jj goes through the CONTAINED spawner here, not around it, exactly as in\n    // `NodeHost.layerContained`: a jj child that starts its own process leads\n    // no recorded group, is in no ledger, and outlives the host that ran it.\n    Layer.provideMerge(BunJj.layerSpawner, spawner)\n  ).pipe(Layer.provideMerge(ProcessReaper.layer(reaping(options))))\n}\n\n/**\n * Provides the contained Bun host bound to one absolute repository root.\n *\n * Refuses a root exactly as {@link layerAt} does: {@link BunHostError} with\n * code `invalid_repository_root`, thrown when the factory is called.\n * Fails at construction with {@link JjError} exactly as {@link layerContained}\n * does.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerContainedAt = (\n  root: string,\n  options?: ContainedOptions\n): Layer.Layer<BunHost | Crypto.Crypto, JjError, ProcessLedger.ProcessLedger> => {\n  const repositoryRoot = absoluteRoot(\"layerContainedAt\", root)\n  const spawner = Layer.provide(\n    ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),\n    Layer.provide(BunChildProcessSpawner.layer, platform)\n  )\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    layerHttpClient,\n    Layer.provideMerge(BunJj.layerSpawnerAt(repositoryRoot), spawner)\n  ).pipe(Layer.provideMerge(ProcessReaper.layer(reaping(options))))\n}\n"]}
+{"version":3,"file":"BunHost.js","sourceRoot":"","sources":["../../src/BunHost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,sBAAsB,MAAM,6CAA6C,CAAA;AACrF,OAAO,KAAK,SAAS,MAAM,gCAAgC,CAAA;AAC3D,OAAO,KAAK,OAAO,MAAM,8BAA8B,CAAA;AAEvD,OAAO,KAAK,KAAK,MAAM,sBAAsB,CAAA;AAI7C,OAAO,KAAK,gBAAgB,MAAM,wCAAwC,CAAA;AAC1E,OAAO,KAAK,gBAAgB,MAAM,wCAAwC,CAAA;AAC1E,OAAO,KAAK,YAAY,MAAM,oCAAoC,CAAA;AAClE,OAAO,KAAK,kBAAkB,MAAM,0CAA0C,CAAA;AAC9E,OAAO,KAAK,aAAa,MAAM,qCAAqC,CAAA;AAIpE,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAGrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,CAAA;AA8B1G;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,WAAW,EAAgB,CAAC,mCAAmC,EAAE;IACxG,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;IACkB,IAAI,GAAG,cAAc,CAAA;CACxC;AAED,wEAAwE;AACxE,MAAM,YAAY,GAAG,GAAG,CAAA;AAExB,0EAA0E;AAC1E,MAAM,YAAY,GAAG,EAAE,CAAA;AAEvB;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,MAAc,EAAU,EAAE;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,MAAM,CAAC,MAAM,IAAI,YAAY,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM;QAAE,OAAO,KAAK,CAAA;IACzE,MAAM,MAAM,GAAG,QAAQ,MAAM,CAAC,MAAM,cAAc,CAAA;IAClD,MAAM,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;IACvC,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAClD,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI;YAAE,MAAK;QACjD,OAAO,IAAI,OAAO,CAAA;IACpB,CAAC;IACD,OAAO,IAAI,OAAO,IAAI,MAAM,EAAE,CAAA;AAChC,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,YAAY,GAAG,CAAC,OAAuC,EAAE,IAAY,EAAU,EAAE;IACrF,gFAAgF;IAChF,MAAM,WAAW,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QACnC,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACrB,CAAC,CAAC,+BAA+B;YACjC,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAC1C,MAAM,MAAM,GAAG,WAAW,OAAO,aAAa,WAAW,QAAQ,CAAA;IACjE,MAAM,IAAI,YAAY,CAAC;QACrB,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE;KACnE,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA8D;IAC1F,mBAAmB,EAAE,wCAAwC;IAC7D,aAAa,EAAE,8BAA8B;IAC7C,oCAAoC,EAAE,6CAA6C;IACnF,eAAe,EAAE,sBAAsB;IACvC,mBAAmB,EAAE,wCAAwC;CAC9D,CAAA;AAmBD,mDAAmD;AACnD,MAAM,OAAO,GAAG,CAAC,OAA0B,EAAyB,EAAE,CAAC,CAAC;IACtE,QAAQ,EAAE,OAAO,EAAE,QAAQ;IAC3B,MAAM,EAAE,OAAO,EAAE,MAAM;CACxB,CAAC,CAAA;AAEF,+EAA+E;AAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAA;AAEpF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAA4B,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;AAE3F;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,KAAK,GAAyC,KAAK,CAAC,QAAQ,CACvE,kBAAkB,CAAC,KAAK,EAAE,EAC1B,QAAQ,EACR,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,EACrD,KAAK,CAAC,KAAK,EACX,eAAe,CAChB,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAwC,EAAE;IAC5E,MAAM,cAAc,GAAG,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IACpD,OAAO,KAAK,CAAC,QAAQ,CACnB,kBAAkB,CAAC,KAAK,EAAE,EAC1B,QAAQ,EACR,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,EACrD,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,eAAe,CAChB,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,OAA0B,EACgD,EAAE;IAC5E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAC3B,aAAa,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EACzD,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CACtD,CAAA;IACD,OAAO,KAAK,CAAC,QAAQ,CACnB,kBAAkB,CAAC,KAAK,EAAE,EAC1B,QAAQ,EACR,eAAe;IACf,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAChD,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;AACnE,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,IAAY,EACZ,OAA0B,EACgD,EAAE;IAC5E,MAAM,cAAc,GAAG,YAAY,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAA;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAC3B,aAAa,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EACzD,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CACtD,CAAA;IACD,OAAO,KAAK,CAAC,QAAQ,CACnB,kBAAkB,CAAC,KAAK,EAAE,EAC1B,QAAQ,EACR,eAAe,EACf,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,CAClE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;AACnE,CAAC,CAAA","sourcesContent":["/**\n * Aggregate Bun Host bundle.\n *\n * Runtime-specific dependencies stay inside this package; callers get the same\n * closed five-service Host surface every other bundle provides, plus native\n * `ProcessConfinement` for guarded commands.\n *\n * There is no Bun shell module: running a command is Effect's\n * `ChildProcessSpawner`, and `@effect/platform-bun`'s implementation is\n * `@effect/platform-node-shared`'s re-exported: the same code on both\n * runtimes, so no runtime detection is needed here.\n *\n * Outgoing HTTP uses the shared EgressHttpClient on both runtimes. Web\n * requests pin approved addresses; ordinary requests retain the shared pool.\n * Redirects remain visible to the capability kernel, and proxy routing follows\n * the host environment.\n *\n * The filesystem slot is `@smthrs/platform-node`'s `AtomicFileSystem`, byte for\n * byte the layer `NodeHost` uses, so a guarded path operation is\n * descriptor-relative and no-follow on both runtimes.\n *\n * @since 1.0.0-rc.0\n */\n\nimport * as BunChildProcessSpawner from \"@effect/platform-bun/BunChildProcessSpawner\"\nimport * as BunCrypto from \"@effect/platform-bun/BunCrypto\"\nimport * as BunPath from \"@effect/platform-bun/BunPath\"\nimport type { Jj } from \"@smthrs/jj\"\nimport * as BunJj from \"@smthrs/jj/bun/BunJj\"\nimport type { HostServiceIds } from \"@smthrs/kernel/HostServices\"\nimport type * as KernelProcessConfinement from \"@smthrs/kernel/ProcessConfinement\"\nimport type * as ProcessLedger from \"@smthrs/kernel/ProcessLedger\"\nimport * as AtomicFileSystem from \"@smthrs/platform-node/AtomicFileSystem\"\nimport * as EgressHttpClient from \"@smthrs/platform-node/EgressHttpClient\"\nimport * as HostLiveness from \"@smthrs/platform-node/HostLiveness\"\nimport * as ProcessConfinement from \"@smthrs/platform-node/ProcessConfinement\"\nimport * as ProcessReaper from \"@smthrs/platform-node/ProcessReaper\"\nimport type * as Crypto from \"effect/Crypto\"\nimport type { FileSystem } from \"effect/FileSystem\"\nimport type { HttpClient } from \"effect/http/HttpClient\"\nimport * as Layer from \"effect/Layer\"\nimport type * as Path from \"effect/Path\"\nimport type { ChildProcessSpawner } from \"effect/process/ChildProcessSpawner\"\nimport * as Schema from \"effect/Schema\"\nimport { isAbsolute } from \"node:path\"\nimport * as BunFileSystem from \"./BunFileSystem.ts\"\n\n/**\n * Bun platform modules for selectively providing individual services.\n *\n * `AtomicFileSystem` is here for the same reason `NodeHost` re-exports it: it\n * owns the only configuration escape hatch the filesystem slot has, and a Bun\n * program with a different packaged helper path needs to reach\n * `AtomicFileSystem.layerWith` without hand-composing the other four tags.\n *\n * `BunJj` is deliberately absent: it belongs to `@smthrs/jj` and is imported\n * from there, never re-exported here. So is `@effect/platform-bun/BunHttpClient`:\n * its `layer` follows redirects to origins the capability kernel never\n * authorized. The network slot on its own is {@link layerHttpClient}.\n *\n * @category re-exports\n * @since 1.0.0-rc.0\n * @slop\n */\nexport { AtomicFileSystem, BunChildProcessSpawner, BunCrypto, BunFileSystem, HostLiveness, ProcessReaper }\n\n/**\n * The complete closed Host service union provided by Bun.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport type BunHost =\n  | FileSystem\n  | Path.Path\n  | ChildProcessSpawner\n  | Jj\n  | HttpClient\n  | KernelProcessConfinement.ProcessConfinement\n\n/**\n * The stable codes a `BunHost` factory refuses with.\n *\n * A code is the contract a caller branches on; the message beside it is for a\n * person. `invalid_repository_root` is the root handed to {@link layerAt} or\n * {@link layerContainedAt} not being absolute or containing NUL, the empty\n * string included.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type BunHostErrorCode = \"invalid_repository_root\"\n\n/**\n * The refusal a `BunHost` factory throws before it builds a layer.\n *\n * It is thrown rather than failed because a factory is called while a program\n * composes its layers, where there is no fiber to fail yet and a wrong root is\n * a composition mistake, not a runtime outcome. It is this package's class,\n * not the `Jj` adapter's, because a Bun caller composes `BunHost` and should\n * learn nothing about the adapter behind the `Jj` slot from an error message.\n *\n * @category errors\n * @since 1.0.0-rc.0\n */\nexport class BunHostError extends Schema.TaggedError<BunHostError>()(\"@smthrs/platform-bun/BunHostError\", {\n  code: Schema.Literal(\"invalid_repository_root\"),\n  message: Schema.String\n}) {\n  override readonly name = \"BunHostError\"\n}\n\n/** The longest message a factory refuses with, in UTF-16 code units. */\nconst messageLimit = 255\n\n/** How many code points of a refused root the message repeats at most. */\nconst previewLimit = 64\n\n/**\n * A bounded, quoted excerpt of a refused root that fits in `budget` code\n * units of the message.\n *\n * Counted in code points rather than UTF-16 units so a cut never splits a\n * surrogate pair, and passed through `JSON.stringify` so a newline in the root\n * cannot break the log line the message lands on. Each code point is encoded\n * on its own and admitted only while the quoted excerpt plus the length\n * suffix still fit, so a control character that widens to a `\\u0001` escape\n * shortens the excerpt instead of lengthening the message, and a cut never\n * lands inside an escape.\n */\nconst preview = (root: string, budget: number): string => {\n  const points = Array.from(root)\n  const whole = JSON.stringify(root)\n  if (points.length <= previewLimit && whole.length <= budget) return whole\n  const suffix = `... (${points.length} characters)`\n  const room = budget - suffix.length - 2\n  let excerpt = \"\"\n  for (const point of points.slice(0, previewLimit)) {\n    const encoded = JSON.stringify(point).slice(1, -1)\n    if (excerpt.length + encoded.length > room) break\n    excerpt += encoded\n  }\n  return `\"${excerpt}\"${suffix}`\n}\n\n/**\n * Refuses a root the `Jj` adapter underneath would refuse, here and in this\n * package's name.\n *\n * `BunJj.layerAt` and `BunJj.layerSpawnerAt` are `NodeJj`'s, and those throw a\n * bare `TypeError` that names `NodeJj`, carries no code, and echoes the whole\n * string. The predicate includes the same `isAbsolute` the adapter applies, so\n * a root that passes this check cannot reach that throw. An absolute root\n * containing NUL is refused too: no filesystem or process API can represent it.\n */\nconst absoluteRoot = (factory: \"layerAt\" | \"layerContainedAt\", root: string): string => {\n  // An absolute root with NUL names that defect, not absoluteness it already has.\n  const requirement = !isAbsolute(root)\n    ? \"an absolute repository root\"\n    : root.includes(\"\\0\")\n    ? \"a repository root without NUL\"\n    : undefined\n  if (requirement === undefined) return root\n  const prefix = `BunHost.${factory} requires ${requirement}, got `\n  throw new BunHostError({\n    code: \"invalid_repository_root\",\n    message: `${prefix}${preview(root, messageLimit - prefix.length)}`\n  })\n}\n\n/**\n * Stable implementation identities keyed by the closed Host service slots.\n *\n * Each value names the module behind that slot in the raw host bundle.\n * Contained POSIX factories replace the spawner with {@link ProcessReaper.layerSpawner}.\n * These are identity\n * tokens rather than import specifiers: the filesystem entry is\n * `@smthrs/platform-node/AtomicFileSystem` because that is the implementation,\n * even though a consumer reaches it through `@smthrs/platform-bun`.\n *\n * Nothing digests them yet. `@smthrs/plan`'s step key carries a `layers`\n * component these values are meant to feed, but no planner derives it from a\n * host bundle today, so changing one invalidates no cached step.\n *\n * The keys are written as literals rather than `HostServiceIds` positions so\n * that reordering the closed list cannot silently pair a slot with another\n * slot's implementation.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const implementationIds: Readonly<Record<(typeof HostServiceIds)[number], string>> = {\n  \"effect/FileSystem\": \"@smthrs/platform-node/AtomicFileSystem\",\n  \"effect/Path\": \"@effect/platform-bun/BunPath\",\n  \"effect/process/ChildProcessSpawner\": \"@effect/platform-bun/BunChildProcessSpawner\",\n  \"@smthrs/jj/Jj\": \"@smthrs/jj/bun/BunJj\",\n  \"effect/HttpClient\": \"@smthrs/platform-node/EgressHttpClient\"\n}\n\n/**\n * What a caller may configure about containment.\n *\n * `ContainedSpawner.Options.platform` is deliberately not part of it. It\n * decides one thing, whether a command that names no `detached` option gets a\n * process group of its own, and this native host detaches by `process.platform`\n * whatever a record claims. A\n * caller-supplied `\"win32\"` on a POSIX host would therefore record\n * `pgid: null` for a child that really does lead a group, and\n * {@link ProcessReaper.reap} would retire that record as `no-group` and leave\n * the orphan running forever: a durable lie rather than a compile error.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type ContainedOptions = ProcessReaper.SpawnerOptions & ProcessReaper.Options\n\n/** The reaper half of {@link ContainedOptions}. */\nconst reaping = (options?: ContainedOptions): ProcessReaper.Options => ({\n  ownerPid: options?.ownerPid,\n  system: options?.system\n})\n\n/** The two services `BunChildProcessSpawner` resolves paths and files with. */\nconst platform = Layer.mergeAll(BunFileSystem.layer, BunPath.layer, BunCrypto.layer)\n\n/**\n * The network slot on its own: the shared egress client, which never follows a\n * redirect. A `3xx` comes back to the caller with its `location` intact and the\n * second origin uncontacted; following a redirect is `@smthrs/kernel`'s guarded\n * `HttpClient.layer`, which rechecks every hop.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerHttpClient: Layer.Layer<HttpClient> = EgressHttpClient.layer(process.env)\n\n/**\n * Provides all five Bun Host services, including the runtime-independent Path\n * service.\n *\n * Builds on a host without jj. The `Jj` slot probes `jj --version` on its\n * first operation and fails that operation with `JjError` carrying\n * `not_installed` or `unsupported_version`; a program that never calls `Jj`\n * runs without jj. `Jj` requires jj 0.39.0 or later.\n *\n * @category layers\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const layer: Layer.Layer<BunHost | Crypto.Crypto> = Layer.mergeAll(\n  ProcessConfinement.layer(),\n  platform,\n  Layer.provide(BunChildProcessSpawner.layer, platform),\n  BunJj.layer,\n  layerHttpClient\n)\n\n/**\n * Provides all five Bun Host services bound to one absolute repository root.\n *\n * Throws {@link BunHostError} with code `invalid_repository_root` when `root`\n * is not absolute or contains NUL; the empty string counts. The check runs\n * when the factory is called, before any layer exists.\n *\n * Builds without jj exactly as {@link layer} does: the `Jj` slot probes\n * `jj --version` on its first operation.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerAt = (root: string): Layer.Layer<BunHost | Crypto.Crypto> => {\n  const repositoryRoot = absoluteRoot(\"layerAt\", root)\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    Layer.provide(BunChildProcessSpawner.layer, platform),\n    BunJj.layerAt(repositoryRoot),\n    layerHttpClient\n  )\n}\n\n/**\n * Provides the Bun host with process containment turned on.\n *\n * Bun uses the same prepared native process lifecycle as Node on POSIX, while\n * preserving its underlying runtime spawner on Windows. `ContainedSpawner` gives\n * every child an escalation deadline and a ledger entry, and\n * `ProcessReaper` sweeps the entries a crashed incarnation of this host left\n * behind. The reaper module lives in `@smthrs/platform-node` because the calls\n * it makes, `process.kill` and `taskkill`, are Node's, and Bun implements\n * them unchanged.\n *\n * Builds without jj exactly as {@link layer} does; here the first\n * operation's `jj --version` probe runs through the contained spawner, so its\n * record enters and leaves the ledger like any other child.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerContained = (\n  options?: ContainedOptions\n): Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger> => {\n  const spawner = Layer.provide(\n    ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),\n    Layer.provide(BunChildProcessSpawner.layer, platform)\n  )\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    layerHttpClient,\n    // jj goes through the CONTAINED spawner here, not around it, exactly as in\n    // `NodeHost.layerContained`: a jj child that starts its own process leads\n    // no recorded group, is in no ledger, and outlives the host that ran it.\n    Layer.provideMerge(BunJj.layerSpawner, spawner)\n  ).pipe(Layer.provideMerge(ProcessReaper.layer(reaping(options))))\n}\n\n/**\n * Provides the contained Bun host bound to one absolute repository root.\n *\n * Refuses a root exactly as {@link layerAt} does: {@link BunHostError} with\n * code `invalid_repository_root`, thrown when the factory is called.\n * Builds without jj exactly as {@link layerContained} does.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerContainedAt = (\n  root: string,\n  options?: ContainedOptions\n): Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger> => {\n  const repositoryRoot = absoluteRoot(\"layerContainedAt\", root)\n  const spawner = Layer.provide(\n    ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),\n    Layer.provide(BunChildProcessSpawner.layer, platform)\n  )\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    layerHttpClient,\n    Layer.provideMerge(BunJj.layerSpawnerAt(repositoryRoot), spawner)\n  ).pipe(Layer.provideMerge(ProcessReaper.layer(reaping(options))))\n}\n"]}

package/docs/README.md

@@ -38,15 +38,15 @@ is Effect's Node spawner re-exported; contained POSIX variants use
 ## Install
 
 ```bash
-bun add @smthrs/platform-bun@1.0.0-rc.8 effect
+bun add @smthrs/platform-bun@1.0.0-rc.9 effect
 ```
 
 `effect` is a required peer in the range `^4.0.4`. `@effect/platform-bun` is
 bundled privately, built from `effect@4.0.4`. The filesystem slot runs the
 `smithers-jj-export` helper that the required peer `@smthrs/platform-node`
-ships, and every complete bundle needs jj 0.39.0 or later because it probes jj
-while the layer is built. [Installation](./installation.md) covers all three
-and the import forms.
+ships. The `Jj` slot needs jj 0.39.0 or later, checked on its first operation;
+every bundle builds without jj. [Installation](./installation.md) covers all
+three and the import forms.
 
 ## Run a command and a file operation through the host
 

package/docs/api.md

@@ -27,13 +27,13 @@ a browser; a page composes
 [`@smthrs/platform-browser`](/api/platform-browser) instead.
 :::
 
-The complete host bundles require jj 0.39.0 or newer. Each bundle checks its jj
-executable before exposing repository operations. Construction can fail with
-`JjError`, including `not_installed` or `unsupported_version`. The contained
-bundles route that probe
-through their process spawner and retire its ledger entry when it exits. Probe
-results are cached per resolved absolute executable path and runner; contained
-spawners share a result only within the same spawner instance.
+Every host bundle builds without jj. The `Jj` slot requires jj 0.39.0 or newer
+and checks its executable on its first operation, which fails with `JjError`
+`not_installed` or `unsupported_version` when jj is missing or older. The
+contained bundles route that probe through their process spawner and retire its
+ledger entry when it exits. Probe results are cached per resolved absolute
+executable path and runner; contained spawners share a result only within the
+same spawner instance.
 
 ## Entry points
 
@@ -52,24 +52,24 @@ Supported runtimes are Bun >=1.4.0 and Node.js >=26.4.0.
 
 ## BunHost
 
-The complete closed Host bundle: layers, construction errors, models,
+The complete closed Host bundle: layers, root errors, models,
 implementation identities, and platform module re-exports.
 
 ### Layers
 
-| Export             | Signature                                                                                                     |
-| ------------------ | ------------------------------------------------------------------------------------------------------------- |
-| `layer`            | `Layer.Layer<BunHost \| Crypto.Crypto, JjError>`                                                              |
-| `layerAt`          | `(root: string) => Layer.Layer<BunHost \| Crypto.Crypto, JjError>`                                            |
-| `layerContained`   | `(options?: ContainedOptions) => Layer.Layer<BunHost \| Crypto.Crypto, JjError, ProcessLedger>`               |
-| `layerContainedAt` | `(root: string, options?: ContainedOptions) => Layer.Layer<BunHost \| Crypto.Crypto, JjError, ProcessLedger>` |
-| `layerHttpClient`  | `Layer.Layer<HttpClient>`                                                                                     |
+| Export             | Signature                                                                                                   |
+| ------------------ | ----------------------------------------------------------------------------------------------------------- |
+| `layer`            | `Layer.Layer<BunHost \| Crypto.Crypto>`                                                                     |
+| `layerAt`          | `(root: string) => Layer.Layer<BunHost \| Crypto.Crypto>`                                                   |
+| `layerContained`   | `(options?: ContainedOptions) => Layer.Layer<BunHost \| Crypto.Crypto, never, ProcessLedger>`               |
+| `layerContainedAt` | `(root: string, options?: ContainedOptions) => Layer.Layer<BunHost \| Crypto.Crypto, never, ProcessLedger>` |
+| `layerHttpClient`  | `Layer.Layer<HttpClient>`                                                                                   |
 
 `layer` provides all five Host services, including the runtime-independent
 `Path`. `Jj` is bound to the process working directory.
 
 `layerAt` is `layer` with `Jj` bound to `root` instead. `root` must be an
-absolute path; see [BunHostError](#bunhosterror).
+absolute path without NUL; see [BunHostError](#bunhosterror).
 
 `layerContained` is `layer` with process containment turned on: every child is
 spawned through `@smthrs/kernel`'s `ContainedSpawner` with
@@ -117,10 +117,10 @@ type BunHostErrorCode = "invalid_repository_root"
 ```
 
 The refusal `layerAt` and `layerContainedAt` throw when `root` is not absolute,
-the empty string included. It is thrown rather than failed because a factory
-runs while a program composes its layers, where there is no fiber to fail into
-and a wrong root is a composition mistake, not a runtime outcome. The check
-runs when the factory is called, before any layer exists.
+the empty string included, or contains NUL. It is thrown rather than failed
+because a factory runs while a program composes its layers, where there is no
+fiber to fail into and a wrong root is a composition mistake, not a runtime
+outcome. The check runs when the factory is called, before any layer exists.
 
 It is this package's class rather than the `Jj` adapter's: a Bun caller
 composed `BunHost` and should learn nothing about the adapter behind the `Jj`

package/docs/guides/bind-a-repository-root.md

@@ -42,8 +42,8 @@ BunHost.layerContainedAt("/srv/repositories/app", { graceMs: 2_000 })
 
 ## Pass an absolute root
 
-Both factories require an absolute path. A relative root, and the empty string,
-are refused:
+Both factories require an absolute path without NUL. A relative root, the
+empty string, and an absolute root containing NUL are refused:
 
 ```ts
 BunHost.layerAt("repositories/app")

package/docs/guides/contain-child-processes.md

@@ -130,15 +130,16 @@ const status = Effect.flatMap(Jj, (jj) => jj.status()).pipe(
 ```
 
 That is the observable difference: the same call under `BunHost.layer` leaves
-the ledger empty. The initial `jj --version` probe uses the selected runner
-too, so a contained host records and retires it before exposing `Jj`. Probe
-results are cached per resolved absolute executable path and runner, with a
-separate cache for each spawner instance.
-
-Every aggregate host waits up to 5000 ms for the startup probe, then interrupts
-it and awaits process cleanup. A probe that misses this budget, or that the
+the ledger empty. The `jj --version` probe that the first `Jj` operation runs
+uses the selected runner too, so a contained host records and retires it like
+any other child. Building the host spawns nothing. Probe results are cached per
+resolved absolute executable path and runner, with a separate cache for each
+spawner instance.
+
+The first `Jj` operation on every aggregate host waits up to 5000 ms for the
+version probe, then interrupts it and awaits process cleanup. A probe that misses this budget, or that the
 spawner was too busy to start in time, is retried once. A second timeout fails
-with a typed `JjError` that has `method: "version"`, `code: "unknown"`,
+the operation with a typed `JjError` that has `method: "version"`, `code: "unknown"`,
 `cause.code: "ETIMEDOUT"`, and the executable path in its command and message.
 Cleanup can add the contained spawner's shutdown grace period to each attempt. Raw hosts close the probe's pipes and kill its
 direct child; they do not add a ledger entry.
@@ -154,7 +155,7 @@ const boundedHost = host.pipe(
 ```
 
 The budget is a positive, finite number of milliseconds, at most 2147483647.
-Timeout and interruption allow a later construction to retry the probe.
+Timeout and interruption allow the next operation to retry the probe.
 
 ## What the reaper refuses to kill
 

package/docs/installation.md

@@ -1,6 +1,6 @@
 ---
 title: "Installation"
-description: "Install @smthrs/platform-bun from npm with its required peers, the smithers-jj-export helper @smthrs/platform-node ships for the filesystem slot, the jj executable every complete bundle probes at startup, and the import forms for each entry point."
+description: "Install @smthrs/platform-bun from npm with its required peers, the smithers-jj-export helper @smthrs/platform-node ships for the filesystem slot, the jj executable the Jj slot probes on first use, and the import forms for each entry point."
 sidebar:
   order: 1
 ---
@@ -11,9 +11,13 @@ The package is on npm under the `next` tag, which carries the 1.0 release
 candidates. Install the current candidate with Bun:
 
 ```bash
-bun add @smthrs/platform-bun@1.0.0-rc.8 effect
+bun add @smthrs/platform-bun@1.0.0-rc.9 effect @smthrs/kernel@1.0.0-rc.9
 ```
 
+`@smthrs/kernel` is on the line because the [Quickstart](./quickstart.md)'s
+`contained.ts` imports its `ProcessLedger`, which the contained bundles require.
+Bun's isolated linker and pnpm link only the packages a project declares.
+
 The manifest declares two required peers, neither optional:
 
 | Peer                    | Version                        | Why                                                       |
@@ -51,15 +55,15 @@ packaged helper with another absolute path; see
 
 Windows is unsupported for this slot.
 
-## Install Jujutsu for the complete bundles
+## Install Jujutsu for the Jj slot
 
-Every complete bundle, `BunHost.layer`, `layerAt`, `layerContained`, and
-`layerContainedAt`, requires jj 0.39.0 or later on the host, whether or not
-the program uses the `Jj` slot. Each factory merges its `Jj` layer with the
-other four, and that layer runs one `jj --version` probe while the layer is
-built. On a host without the executable, or with an older one, construction
-fails with `JjError` carrying `not_installed` or `unsupported_version` before
-the program body runs, even for a program that asked for only `FileSystem`.
+Every bundle, `BunHost.layer`, `layerAt`, `layerContained`, and
+`layerContainedAt`, builds without jj, so a program that never calls `Jj` runs
+on a host without it. The `Jj` slot requires jj 0.39.0 or later: its first
+operation runs one `jj --version` probe, and on a host without the executable,
+or with an older one, that operation fails with `JjError` carrying
+`not_installed` or `unsupported_version`. The slot selects the executable when
+the layer is built, so restart the program after installing jj.
 
 Install [Jujutsu](https://jj-vcs.github.io), a version-control system that
 works on a Git repository, and confirm the version:
@@ -72,9 +76,9 @@ This package vendors no binaries. [`@smthrs/jj`](/api/jj) documents the
 resolution order and the `SMITHERS_JJ_PATH` override for an executable that is
 not on `PATH`.
 
-A program that must run without jj composes the individual service layers
-instead of a complete bundle: `BunFileSystem.layer`, `Path.layer`, and the
-spawner and HTTP client layers each build without a probe. See
+A program that wants only some of the services composes the individual service
+layers instead of a complete bundle: `BunFileSystem.layer`, `Path.layer`, and
+the spawner and HTTP client layers. See
 [The Host surface on Bun](./concepts/host-surface.md) for taking one service
 without the other four.
 
@@ -117,9 +121,9 @@ page composes [`@smthrs/platform-browser`](/api/platform-browser) instead.
   [Contain and reap child processes](./guides/contain-child-processes.md).
 
 The `Jj` slot spawns the `jj` command that
-[Install Jujutsu for the complete bundles](#install-jujutsu-for-the-complete-bundles)
-covers. A bundle probes it at construction, so the executable is a startup
-requirement rather than a slot the program opts into.
+[Install Jujutsu for the Jj slot](#install-jujutsu-for-the-jj-slot) covers. The
+slot probes it on its first operation, so jj is a requirement of the programs
+that call `Jj`, not of every host.
 
 ## Next step
 

package/docs/quickstart.md

@@ -13,16 +13,18 @@ appear in, and disappear from, the process ledger.
 ## Prerequisites
 
 - Bun 1.4.0 or later, or Node.js 26.4.0 or later.
-- A project with the package installed:
-  `bun add @smthrs/platform-bun@1.0.0-rc.8 effect`. That also installs the
-  required peer `@smthrs/platform-node`, which ships the `smithers-jj-export`
-  helper the filesystem slot runs. See [Installation](./installation.md).
-- [Jujutsu](https://jj-vcs.github.io) at jj 0.39.0 or later on `PATH`. Confirm
-  it with `jj --version`. Neither program below touches `Jj`, but every
-  complete bundle probes jj while the layer is built and fails with `JjError`
-  before the program body runs when it is missing. See
-  [Installation](./installation.md) for `SMITHERS_JJ_PATH` and for composing
-  service layers without jj.
+- A project with the packages installed:
+  `bun add @smthrs/platform-bun@1.0.0-rc.9 effect @smthrs/kernel@1.0.0-rc.9`.
+  That also installs the required peer `@smthrs/platform-node`, which ships the
+  `smithers-jj-export` helper the filesystem slot runs. `@smthrs/kernel` is on
+  the line because `contained.ts` imports its `ProcessLedger`, and Bun's
+  isolated linker and pnpm link only the packages a project declares. See
+  [Installation](./installation.md).
+- [Jujutsu](https://jj-vcs.github.io) at jj 0.39.0 or later on `PATH`, only for
+  a program that calls `Jj`. Neither program below does, and every bundle
+  builds without jj; a `Jj` operation on a host without it fails with
+  `JjError` `not_installed`. See [Installation](./installation.md) for
+  `SMITHERS_JJ_PATH`.
 
 ## Run a file operation and a command
 
@@ -64,8 +66,9 @@ bun run quickstart.ts
 ```
 
 `BunHost.layer` provided all five slots; the program used two of them. The
-other three were built and never asked for, and building `Jj` is where the
-jj version probe ran.
+other three were built and never asked for. Building `Jj` spawned nothing: its
+jj version probe runs on the first `Jj` operation, which this program never
+makes.
 
 ## Turn containment on
 

package/docs/troubleshooting.md

@@ -1,33 +1,12 @@
 ---
 title: "Troubleshooting"
-description: "The failures @smthrs/platform-bun produces: a missing required peer, a refused repository root, a filesystem guard that fails closed, an unfollowed redirect, a missing process ledger, and a browser bundle that will not resolve."
+description: "The failures @smthrs/platform-bun produces: a refused repository root, a filesystem guard that fails closed, an unfollowed redirect, a missing process ledger, and a browser bundle that will not resolve."
 ---
 
 Find the symptom, read the cause, apply the fix. Every failure here is one this
 package or its slots actually produce; the signatures behind them are on the
 [API reference](./api.md).
 
-## ERR_MODULE_NOT_FOUND for @effect/platform-bun/BunChildProcessSpawner
-
-**Symptom.** The first `import { BunHost } from "@smthrs/platform-bun"`, or
-`import * as BunHost from "@smthrs/platform-bun/BunHost"`, throws
-`ERR_MODULE_NOT_FOUND` before any of your code runs.
-
-**Cause.** The install is missing the required `@effect/platform-bun` peer,
-which both the root entry point and `BunHost` import at module load. This can
-happen with an older package version that marked it optional, or when peer
-installation was disabled.
-
-**Fix.** Install it yourself, at the version your composition's `effect` is
-built against:
-
-```bash
-pnpm add @effect/platform-bun @effect/platform-node-shared
-```
-
-`@smthrs/platform-bun/BunFileSystem` is the one entry point that resolves
-without it, because it imports nothing from `@effect/platform-bun`.
-
 ## BunHostError: requires an absolute repository root
 
 **Symptom.** `BunHost.layerAt` or `BunHost.layerContainedAt` throws while your
@@ -35,10 +14,12 @@ program is still composing its layers:
 
 ```text
 BunHostError: BunHost.layerAt requires an absolute repository root, got "repositories/app"
+BunHostError: BunHost.layerAt requires a repository root without NUL, got "/repo\u0000"
 ```
 
-**Cause.** The root is not absolute. The empty string counts, and so does a
-path that looks absolute only after the process working directory is applied.
+**Cause.** The root is not absolute, or it contains NUL, which no filesystem
+or process API can represent. The empty string is not absolute, and neither is
+a path that looks absolute only after the process working directory is applied.
 
 **Fix.** Resolve the root before you hand it over, and branch on
 `error.code === "invalid_repository_root"` rather than on the message text. The
@@ -115,7 +96,7 @@ your code.
 `@smthrs/kernel/ProcessLedger`.
 
 **Cause.** Both contained factories return
-`Layer.Layer<BunHost | Crypto.Crypto, JjError, ProcessLedger.ProcessLedger>`.
+`Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger>`.
 The ledger is a
 requirement rather than a built-in default, because the durable half is only as
 good as the journal underneath it, and only your program knows whether it has
@@ -167,15 +148,16 @@ between them does not change. See
 
 ## Jj fails with not_installed
 
-**Symptom.** Building any complete bundle fails with a `JjError` whose code
-is `not_installed` or `unsupported_version` before the program body runs,
-even when the program never asks for `Jj`.
+**Symptom.** A `Jj` operation fails with a `JjError` whose code is
+`not_installed` or `unsupported_version` and whose method is `version`. The
+host built and every other service works.
 
-**Cause.** No usable `jj` executable, or one older than 0.39.0. Every
-`BunHost` factory builds its `Jj` layer eagerly, and that layer probes
-`jj --version` at construction. This package vendors no binaries and installs
-nothing on your behalf.
+**Cause.** No usable `jj` executable, or one older than 0.39.0. The `Jj` slot
+probes `jj --version` on its first operation, and the operation that triggered
+the probe did not run. This package vendors no binaries and installs nothing on
+your behalf.
 
 **Fix.** Install [Jujutsu](https://jj-vcs.github.io), which provides the `jj`
-command, or set `SMITHERS_JJ_PATH` to the executable you want spawned.
+command, or set `SMITHERS_JJ_PATH` to the executable you want spawned, then
+restart the program: the slot selects the executable when the layer is built.
 [`@smthrs/jj`](/api/jj) documents the resolution order and the failure codes.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@smthrs/platform-bun",
   "type": "module",
-  "version": "1.0.0-rc.8",
+  "version": "1.0.0-rc.9",
   "license": "MIT",
   "smthrs": {
     "group": "engine",
@@ -102,15 +102,15 @@
     "tag": "next"
   },
   "dependencies": {
-    "@smthrs/jj": "1.0.0-rc.8",
-    "@smthrs/kernel": "1.0.0-rc.8",
+    "@smthrs/jj": "1.0.0-rc.9",
+    "@smthrs/kernel": "1.0.0-rc.9",
     "undici": "8.11.2",
     "redis": "6.2.1",
     "@types/ws": "8.18.2",
     "ws": "8.22.0"
   },
   "peerDependencies": {
-    "@smthrs/platform-node": "1.0.0-rc.8",
+    "@smthrs/platform-node": "1.0.0-rc.9",
     "effect": "^4.0.4"
   },
   "devDependencies": {
@@ -120,7 +120,7 @@
     "@effect/platform-node-shared": "4.0.4",
     "@effect/vitest": "4.0.4",
     "@eslint/js": "9.39.5",
-    "@smthrs/platform-node": "1.0.0-rc.8",
+    "@smthrs/platform-node": "1.0.0-rc.9",
     "@types/node": "26.4.1",
     "@vitest/coverage-v8": "5.0.0",
     "dprint": "0.57.1",
@@ -135,7 +135,7 @@
     "typescript": "5.9.3",
     "typescript-eslint": "8.69.0",
     "vitest": "5.0.0",
-    "@smthrs/artifacts": "1.0.0-rc.8"
+    "@smthrs/artifacts": "1.0.0-rc.9"
   },
   "scripts": {
     "lint": "eslint src --max-warnings=0 && dprint check",

package/src/BunHost.ts

@@ -25,7 +25,7 @@
 import * as BunChildProcessSpawner from "@effect/platform-bun/BunChildProcessSpawner"
 import * as BunCrypto from "@effect/platform-bun/BunCrypto"
 import * as BunPath from "@effect/platform-bun/BunPath"
-import type { Jj, JjError } from "@smthrs/jj"
+import type { Jj } from "@smthrs/jj"
 import * as BunJj from "@smthrs/jj/bun/BunJj"
 import type { HostServiceIds } from "@smthrs/kernel/HostServices"
 import type * as KernelProcessConfinement from "@smthrs/kernel/ProcessConfinement"
@@ -84,7 +84,8 @@ export type BunHost =
  *
  * A code is the contract a caller branches on; the message beside it is for a
  * person. `invalid_repository_root` is the root handed to {@link layerAt} or
- * {@link layerContainedAt} not being absolute, the empty string included.
+ * {@link layerContainedAt} not being absolute or containing NUL, the empty
+ * string included.
  *
  * @category models
  * @since 1.0.0-rc.0
@@ -149,12 +150,19 @@ const preview = (root: string, budget: number): string => {
  *
  * `BunJj.layerAt` and `BunJj.layerSpawnerAt` are `NodeJj`'s, and those throw a
  * bare `TypeError` that names `NodeJj`, carries no code, and echoes the whole
- * string. The predicate here is the same `isAbsolute` the adapter applies, so
- * a root that passes this check cannot reach that throw.
+ * string. The predicate includes the same `isAbsolute` the adapter applies, so
+ * a root that passes this check cannot reach that throw. An absolute root
+ * containing NUL is refused too: no filesystem or process API can represent it.
  */
 const absoluteRoot = (factory: "layerAt" | "layerContainedAt", root: string): string => {
-  if (isAbsolute(root)) return root
-  const prefix = `BunHost.${factory} requires an absolute repository root, got `
+  // An absolute root with NUL names that defect, not absoluteness it already has.
+  const requirement = !isAbsolute(root)
+    ? "an absolute repository root"
+    : root.includes("\0")
+    ? "a repository root without NUL"
+    : undefined
+  if (requirement === undefined) return root
+  const prefix = `BunHost.${factory} requires ${requirement}, got `
   throw new BunHostError({
     code: "invalid_repository_root",
     message: `${prefix}${preview(root, messageLimit - prefix.length)}`
@@ -232,16 +240,16 @@ export const layerHttpClient: Layer.Layer<HttpClient> = EgressHttpClient.layer(p
  * Provides all five Bun Host services, including the runtime-independent Path
  * service.
  *
- * Fails at construction with {@link JjError} carrying `not_installed` or
- * `unsupported_version`: the `Jj` slot is merged eagerly and probes
- * `jj --version` while the layer is built, before the program body runs and
- * whether or not the program asks for `Jj`. Requires jj 0.39.0 or later.
+ * Builds on a host without jj. The `Jj` slot probes `jj --version` on its
+ * first operation and fails that operation with `JjError` carrying
+ * `not_installed` or `unsupported_version`; a program that never calls `Jj`
+ * runs without jj. `Jj` requires jj 0.39.0 or later.
  *
  * @category layers
  * @since 1.0.0-rc.0
  * @slop
  */
-export const layer: Layer.Layer<BunHost | Crypto.Crypto, JjError> = Layer.mergeAll(
+export const layer: Layer.Layer<BunHost | Crypto.Crypto> = Layer.mergeAll(
   ProcessConfinement.layer(),
   platform,
   Layer.provide(BunChildProcessSpawner.layer, platform),
@@ -253,16 +261,16 @@ export const layer: Layer.Layer<BunHost | Crypto.Crypto, JjError> = Layer.mergeA
  * Provides all five Bun Host services bound to one absolute repository root.
  *
  * Throws {@link BunHostError} with code `invalid_repository_root` when `root`
- * is not absolute; the empty string counts. The check runs when the factory is
- * called, before any layer exists.
+ * is not absolute or contains NUL; the empty string counts. The check runs
+ * when the factory is called, before any layer exists.
  *
- * Fails at construction with {@link JjError} exactly as {@link layer} does:
- * the `Jj` slot probes `jj --version` while the layer is built.
+ * Builds without jj exactly as {@link layer} does: the `Jj` slot probes
+ * `jj --version` on its first operation.
  *
  * @category layers
  * @since 1.0.0-rc.0
  */
-export const layerAt = (root: string): Layer.Layer<BunHost | Crypto.Crypto, JjError> => {
+export const layerAt = (root: string): Layer.Layer<BunHost | Crypto.Crypto> => {
   const repositoryRoot = absoluteRoot("layerAt", root)
   return Layer.mergeAll(
     ProcessConfinement.layer(),
@@ -284,8 +292,8 @@ export const layerAt = (root: string): Layer.Layer<BunHost | Crypto.Crypto, JjEr
  * it makes, `process.kill` and `taskkill`, are Node's, and Bun implements
  * them unchanged.
  *
- * Fails at construction with {@link JjError} exactly as {@link layer} does;
- * here the `jj --version` probe runs through the contained spawner, so its
+ * Builds without jj exactly as {@link layer} does; here the first
+ * operation's `jj --version` probe runs through the contained spawner, so its
  * record enters and leaves the ledger like any other child.
  *
  * @category layers
@@ -293,7 +301,7 @@ export const layerAt = (root: string): Layer.Layer<BunHost | Crypto.Crypto, JjEr
  */
 export const layerContained = (
   options?: ContainedOptions
-): Layer.Layer<BunHost | Crypto.Crypto, JjError, ProcessLedger.ProcessLedger> => {
+): Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger> => {
   const spawner = Layer.provide(
     ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),
     Layer.provide(BunChildProcessSpawner.layer, platform)
@@ -314,8 +322,7 @@ export const layerContained = (
  *
  * Refuses a root exactly as {@link layerAt} does: {@link BunHostError} with
  * code `invalid_repository_root`, thrown when the factory is called.
- * Fails at construction with {@link JjError} exactly as {@link layerContained}
- * does.
+ * Builds without jj exactly as {@link layerContained} does.
  *
  * @category layers
  * @since 1.0.0-rc.0
@@ -323,7 +330,7 @@ export const layerContained = (
 export const layerContainedAt = (
   root: string,
   options?: ContainedOptions
-): Layer.Layer<BunHost | Crypto.Crypto, JjError, ProcessLedger.ProcessLedger> => {
+): Layer.Layer<BunHost | Crypto.Crypto, never, ProcessLedger.ProcessLedger> => {
   const repositoryRoot = absoluteRoot("layerContainedAt", root)
   const spawner = Layer.provide(
     ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),