bare-operating-system/packages/bare-os-booter/lib/proc/bare-os-proc-pear-inspect-logger-tls.js

import {
  bareOsProcBlindPeerRelayHintsExposed,
  bareOsProcBlindPeerRelayHintsMinimal
} from './bare-os-proc-blind-peer-relay-gate.js'

/**
 * Capability word 10 optional `/proc/bare_os/*.json` payloads (env-injected; bounded, non-secret).
 * Maps Holepunch `bare-*` / `pear-*` stacks — no Node `node:*` built-ins in guest paths.
 * @param {string} id
 * @param {Record<string, string>} env
 * @param {{ swarm?: Record<string, unknown> | null }} [runtimeHints]
 */
export function buildBareOsPearInspectLoggerTlsProcJson(id, env, runtimeHints) {
  const now = Date.now()
  const esc = (k) => String(env[k] ?? '').trim()

  function parseJsonEnv(key) {
    const raw = esc(key)
    if (!raw) return null
    try {
      const o = JSON.parse(raw)
      return o && typeof o === 'object' ? o : null
    } catch {
      return { schema: 1, error: 'invalid_json', key, atMs: now }
    }
  }

  switch (id) {
    case 'pear_doctor_state':
      return {
        schema: 2,
        state: parseJsonEnv('BARE_OS_PEAR_DOCTOR_STATE_JSON'),
        runtimeVersion: esc('BARE_OS_PEAR_RUNTIME_VERSION') || undefined,
        pearInspectProbe:
          esc('BARE_OS_PEAR_INSPECT_PROBE') === '1' ||
          esc('BARE_OS_PEAR_INSPECT_PROBE') === 'true',
        pearDoctorModuleHint: esc('BARE_OS_PEAR_DOCTOR_MODULE') || undefined,
        note: 'pear-doctor + pear-runtime parity (schema 2): merge env with pear-inspect / pear-runtime-updater host wiring.',
        atMs: now
      }
    case 'pear_workshop_flags':
      return {
        schema: 1,
        flags: parseJsonEnv('BARE_OS_PEAR_WORKSHOP_FLAGS_JSON'),
        note: 'pear-workshop dev flags.',
        atMs: now
      }
    case 'pear_user_dirs_map':
      return {
        schema: 1,
        map: parseJsonEnv('BARE_OS_PEAR_USER_DIRS_MAP_JSON'),
        note: 'pear-user-dirs map (non-secret).',
        atMs: now
      }
    case 'pear_api_allowlist_sketch':
      return {
        schema: 1,
        allowlist: parseJsonEnv('BARE_OS_PEAR_API_ALLOWLIST_SKETCH_JSON'),
        note: 'pear-api surface allow sketch.',
        atMs: now
      }
    case 'pear_rti_pointer':
      return {
        schema: 1,
        pointer: parseJsonEnv('BARE_OS_PEAR_RTI_POINTER_JSON'),
        note: 'pear-rti pointer doc.',
        atMs: now
      }
    case 'bare_boot_phase_map':
      return {
        schema: 1,
        phases: parseJsonEnv('BARE_OS_BARE_BOOT_PHASE_MAP_JSON'),
        note: 'bare-boot phase alignment map.',
        atMs: now
      }
    case 'bare_rpc_registry_sketch':
      return {
        schema: 1,
        registry: parseJsonEnv('BARE_OS_BARE_RPC_REGISTRY_SKETCH_JSON'),
        note: 'bare-rpc registry summary (names only).',
        atMs: now
      }
    case 'bare_logger_policy':
      return {
        schema: 1,
        policy: parseJsonEnv('BARE_OS_BARE_LOGGER_POLICY_JSON'),
        note: 'bare-logger / bare-file-logger sink class.',
        atMs: now
      }
    case 'bare_performance_counters':
      return {
        schema: 1,
        counters: parseJsonEnv('BARE_OS_BARE_PERFORMANCE_COUNTERS_JSON'),
        note: 'bare-performance / bare-hrtime counters sketch.',
        atMs: now
      }
    case 'bare_inspect_policy':
      return {
        schema: 1,
        policy: parseJsonEnv('BARE_OS_BARE_INSPECT_POLICY_JSON'),
        guestMetricsPath:
          esc('BARE_OS_INSPECT_GUEST_METRICS_PATH') ||
          '/run/bare-os/profiles/',
        note: 'bare-inspect policy; CPU profiles may land under guestMetricsPath when enabled on host.',
        atMs: now
      }
    case 'bare_signals_mask':
      return {
        schema: 1,
        mask: parseJsonEnv('BARE_OS_BARE_SIGNALS_MASK_JSON'),
        note: 'bare-signals mask summary.',
        atMs: now
      }
    case 'bare_timers_budget':
      return {
        schema: 1,
        budget: parseJsonEnv('BARE_OS_BARE_TIMERS_BUDGET_JSON'),
        note: 'bare-timers budget.',
        atMs: now
      }
    case 'bare_stream_backpressure':
      return {
        schema: 1,
        backpressure: parseJsonEnv('BARE_OS_BARE_STREAM_BACKPRESSURE_JSON'),
        note: 'bare-stream / bare-pipe class.',
        atMs: now
      }
    case 'bare_ws_gateway_sketch':
      return {
        schema: 1,
        gateway: parseJsonEnv('BARE_OS_BARE_WS_GATEWAY_SKETCH_JSON'),
        note: 'bare-ws gateway policy.',
        atMs: now
      }
    case 'bare_tls_session_hint':
      return {
        schema: 1,
        tls: parseJsonEnv('BARE_OS_BARE_TLS_SESSION_HINT_JSON'),
        note: 'bare-tls session cache / pin class.',
        atMs: now
      }
    case 'autobase_writer_hint':
      return {
        schema: 1,
        writer: parseJsonEnv('BARE_OS_AUTOBASE_WRITER_HINT_JSON'),
        note: 'autobase writer hint (non-secret).',
        atMs: now
      }
    case 'blind_pairing_sketch':
      if (!bareOsProcBlindPeerRelayHintsExposed(env)) {
        return bareOsProcBlindPeerRelayHintsMinimal(now)
      }
      return {
        schema: 2,
        exposed: true,
        sketch: parseJsonEnv('BARE_OS_BLIND_PAIRING_SKETCH_JSON'),
        swarm: runtimeHints?.swarm ?? null,
        note: 'Env pairing sketch plus live swarm aggregates when booter supplies runtimeHints.',
        atMs: now
      }
    case 'broadcast_encryption_hint':
      return {
        schema: 1,
        hint: parseJsonEnv('BARE_OS_BROADCAST_ENCRYPTION_HINT_JSON'),
        note: 'broadcast-encryption capability hint.',
        atMs: now
      }
    case 'activity_queue_depth':
      return {
        schema: 1,
        depth: parseJsonEnv('BARE_OS_ACTIVITY_QUEUE_DEPTH_JSON'),
        note: 'activity-queue depth sketch.',
        atMs: now
      }
    default:
      return {
        schema: 1,
        error: 'unknown_wave10_proc_id',
        id,
        atMs: now
      }
  }
}