/**
 * Plaintext NDJSON audit on the personal drive (no sealed vault material).
 */

import b4a from 'b4a'

/**
 * Append a non-secret rotation / handoff checkpoint to the personal drive (plaintext NDJSON audit).
 * Signing keys stay in the vault; this records operator metadata only.
 * Rows may include **`kind`**: **`vault_save`** (after vault snapshot) or rotation handoff fields from callers.
 * @param {Record<string, unknown>} ctx
 * @param {Record<string, unknown>} row
 */
export async function bareOsAppendVaultRotationCheckpoint(ctx, row) {
  const drive = ctx.personalDrive
  if (!drive || typeof drive.put !== 'function') {
    throw new Error('bareOsAppendVaultRotationCheckpoint: personal drive unavailable')
  }
  const line =
    JSON.stringify({
      schema: 1,
      ts: Date.now(),
      ...row
    }) + '\n'
  const path = '/.bare/vault-rotation-audit.ndjson'
  let prev = ''
  try {
    const b = await drive.get(path, { follow: false })
    if (b) prev = b4a.toString(b)
  } catch {
    /* new */
  }
  await drive.put(path, b4a.from(prev + line))
}