bare-operating-system/packages/bare-os-bare-libs

bare-os-bare-libs

Builds trusted IIFE bundles from bare-module-manifest.json entries marked "bundle": true. npm run build runs prebuild: ../../scripts/generate-bare-module-manifest-data.mjs, which refreshes bare-module-manifest.data.mjs for Pear before esbuild. Output:

• kernel/lib/bare/bundles/<ctxKey>.js
• kernel/lib/bare/manifest.json (paths for the booter drive merge)
• Mirrored under packages/bare-os-seeder/kernel/lib/bare/ for seeder parity

When to use: run this build after changing bare-module-manifest.json, bumping Holepunch catalog entries, or refreshing upstream bare-* packages — pretest expects kernel/lib/bare/bundles and bundle-health.json to match.

Documentation: Developer guide ch.12 — Bare modules · Kernel extensions · Kernel tree — lib/bare.

Run from repo root:

npm run build -w bare-os-bare-libs

Catalog bump pipeline (maintainers): refresh Holepunch package metadata with npm run gen:bare-catalog at the repo root (updates docs/bare-holepunch-catalog.json), then rebuild this workspace, run npm test ( verify-bundle-health, verify-bundle-markers, verify-bundle-throws), and sync kernel/lib/bare/ → seeder per verify-kernel-seeder-parity. Intentional large bundle size shifts should add a row under Bundle health log below.

The booter loads these only when BARE_OS_BARE_MODULES is enabled and BARE_OS_BARE_DRIVE_BUNDLES is not disabled; see the developer guide.

Manifest rows may include optional tier (core default when omitted) and risk (low / medium / high) so distributors can filter bundles without reading upstream READMEs. The catalog sync scripts preserve unknown fields when merging from docs/bare-holepunch-catalog.json.

Bundle health, markers, and upstream closure

• docs/audit/bundle-health.json — per-bundle byte sizes; regenerated by npm run build -w bare-os-bare-libs. When a bundle’s size moves by more than roughly 10%, add a dated one-line note under Bundle health log below (or in the same PR description) so reviewers can tell intentional catalog bumps from accidents.
• scripts/verify-bundle-health.mjs — CI compares committed JSON to on-disk bundle sizes.
• scripts/verify-bundle-markers.mjs + docs/audit/bundle-marker-allowlist.json — gate TODO / NOT_IMPLEMENTED substrings inside vendored IIFEs; shrink the allowlist when upgrading Holepunch packages removes markers.
• scripts/verify-bundle-throws.mjs + docs/audit/bundle-throw-allowlist.json — same for throw new Error("not implemented") phrasing.

Scope split: verify-runtime-no-incomplete-markers.mjs applies to first-party kernel/boot/booter sources; verify-bundle-markers.mjs / verify-bundle-throws.mjs apply only to kernel/lib/bare/bundles/*.js. Upstream HTTP helpers may still expose 501 Not Implemented behavior under sanitized method names—that is not the same as an unfinished Bare OS syscall surface (those use documented ENOTSUP in the booter).

See docs/audit/PLACEHOLDER_BASELINE.md § P3 for policy: first-party kernel code stays marker-free via verify-runtime-no-incomplete-markers.mjs; bundle gaps close through version bumps, post-processing (rare), or allowlist shrink. Full table: developer-guide ch.8 — CI marker scope.

Bundle health log

Date (UTC)	Note
Append a row when a bundle size change ≥ ~10% is intentional (catalog version, esbuild flags, or new upstream files).