/**
 * Capability word 6 optional `/proc/bare_os/*.json` payloads (env-injected or derived; bounded, non-secret).
 * @param {string} id
 * @param {Record<string, string>} env
 * @param {{
 *   ipcStats?: Record<string, unknown> | null,
 *   delegateInflight?: unknown,
 *   delegateRateBuckets?: unknown
 * }} [extras]
 */
export function buildBareOsReplicationOperatorSurfaceProcJson(id, env, extras = {}) {
  const now = Date.now()
  const esc = (k) => String(env[k] ?? '').trim()

  function parseJsonEnv(key) {
    const raw = esc(key)
    if (!raw) return null
    try {
      const o = JSON.parse(raw)
      return o && typeof o === 'object' ? o : null
    } catch {
      return { schema: 1, error: 'invalid_json', key, atMs: now }
    }
  }

  switch (id) {
    case 'udx_extended':
      return {
        schema: 1,
        extended: parseJsonEnv('BARE_OS_UDX_EXTENDED_STATS_JSON'),
        note: 'UDX / transport extended counters from host via env.',
        atMs: now
      }
    case 'dht_status':
      return {
        schema: 1,
        dht: parseJsonEnv('BARE_OS_DHT_STATUS_JSON'),
        note: 'Bounded DHT reachability sketch; guest does not verify routing.',
        atMs: now
      }
    case 'replication_backpressure':
      return {
        schema: 1,
        backpressure: parseJsonEnv('BARE_OS_REPLICATION_BACKPRESSURE_JSON'),
        atMs: now
      }
    case 'ipc_backpressure': {
      const st = extras.ipcStats
      return {
        schema: 1,
        ipc: st && typeof st === 'object' ? st : null,
        note: 'FIFO / channel depth snapshot from bareOsIpc.stats when available.',
        atMs: now
      }
    }
    case 'delegate_red':
      return {
        schema: 1,
        template: 'rate-errors-duration',
        delegateInflight: extras.delegateInflight ?? null,
        delegateRateBuckets: extras.delegateRateBuckets ?? null,
        overlay: parseJsonEnv('BARE_OS_DELEGATE_RED_JSON'),
        atMs: now
      }
    case 'build_attestation_pointer':
      return {
        schema: 1,
        pointer: parseJsonEnv('BARE_OS_BUILD_ATTESTATION_POINTER_JSON'),
        note: 'Opaque pointer only; no attestation verification in-guest.',
        atMs: now
      }
    case 'pear_ipc_health':
      return {
        schema: 1,
        health: parseJsonEnv('BARE_OS_PEAR_IPC_HEALTH_JSON'),
        atMs: now
      }
    case 'hypercore_lengths':
      return {
        schema: 1,
        lengths: parseJsonEnv('BARE_OS_HYPERCORE_LENGTHS_JSON'),
        atMs: now
      }
    case 'slo_hints':
      return {
        schema: 1,
        slo: parseJsonEnv('BARE_OS_SLO_HINTS_JSON'),
        note: 'Documentation-first SLO targets for replication.',
        atMs: now
      }
    case 'locale':
      return {
        schema: 1,
        locale: esc('BARE_OS_LOCALE') || null,
        charset: esc('BARE_OS_CHARSET') || 'utf-8',
        atMs: now
      }
    case 'worker_budget':
      return {
        schema: 1,
        wallMsMax: esc('BARE_OS_BIN_WORKER_WALL_MS_MAX') || null,
        note: 'Optional per-invocation wall clock cap for bin-worker offload.',
        atMs: now
      }
    case 'sandbox_profile':
      return {
        schema: 1,
        profile: esc('BARE_OS_SANDBOX_PROFILE_NAME') || null,
        capabilities: parseJsonEnv('BARE_OS_SANDBOX_CAPABILITIES_JSON'),
        note: 'Host-interpreted capability JSON; guest makes no seccomp claims.',
        atMs: now
      }
    case 'dns_map_active':
      return {
        schema: 1,
        summary: summarizeDnsMap(esc('BARE_OS_DNS_MAP_JSON')),
        atMs: now
      }
    case 'git_delegate_stats':
      return {
        schema: 1,
        stats: parseJsonEnv('BARE_OS_GIT_DELEGATE_STATS_JSON'),
        atMs: now
      }
    default:
      return { schema: 1, error: 'unknown_wave6_proc', id, atMs: now }
  }
}

/**
 * @param {string} raw
 */
function summarizeDnsMap(raw) {
  if (!raw) return { active: false, entryCount: 0 }
  try {
    const o = JSON.parse(raw)
    if (!o || typeof o !== 'object') return { active: false, entryCount: 0 }
    const keys = Object.keys(o)
    return {
      active: true,
      entryCount: Math.min(keys.length, 256),
      sampleKeys: keys.slice(0, 8)
    }
  } catch {
    return { active: false, error: 'invalid_BARE_OS_DNS_MAP_JSON' }
  }
}