/**
 * Optional peer admission gate from **`BARE_OS_PEER_ALLOWLIST_HEX`**
 * (comma-separated hex public keys; empty = allow all).
 * @param {Record<string, unknown> | null | undefined} env
 * @param {string} peerKeyHex
 */
export function evaluateBareOsPeerAdmission(env, peerKeyHex) {
  const raw = String(env?.BARE_OS_PEER_ALLOWLIST_HEX || '').trim()
  if (!raw) {
    return {
      schema: 1,
      verdict: 'allow',
      note: 'No allowlist; all peers admitted (subject to Hyperswarm topic).'
    }
  }
  const want = String(peerKeyHex || '')
    .trim()
    .toLowerCase()
    .replace(/^0x/, '')
  const set = new Set(
    raw
      .split(/[\s,]+/)
      .map((s) => s.trim().toLowerCase().replace(/^0x/, ''))
      .filter(Boolean)
  )
  const ok = want && set.has(want)
  return {
    schema: 1,
    verdict: ok ? 'allow' : 'deny',
    allowlistSize: set.size,
    atMs: Date.now()
  }
}