/**
 * Loader audit NDJSON under /run/bare-os/loader-audit.ndjson.
 */
import b4a from 'b4a'

/**
 * @param {{
 *   env: Record<string, string | undefined>,
 *   vfs: { readFile?: Function, writeFile?: Function } | null | undefined,
 *   sessionId: string
 * }} deps
 */
export function createKernelLoaderAuditAppend(deps) {
  const { env, vfs, sessionId } = deps

  /**
   * Cap-gated via BARE_OS_LOADER_AUDIT.
   * @param {Record<string, unknown>} rec
   */
  return async function appendKernelLoaderAuditLine(rec) {
    if (
      env.BARE_OS_LOADER_AUDIT !== '1' &&
      env.BARE_OS_LOADER_AUDIT !== 'true'
    )
      return
    if (
      !vfs ||
      typeof vfs.readFile !== 'function' ||
      typeof vfs.writeFile !== 'function'
    )
      return
    const line =
      JSON.stringify({
        type: 'loader_audit',
        ts: Date.now(),
        sessionId,
        ...rec
      }) + '\n'
    try {
      let prev = ''
      try {
        const buf = await vfs.readFile('/run/bare-os/loader-audit.ndjson')
        prev = b4a.toString(buf)
      } catch {
        /* new */
      }
      await vfs.writeFile(
        '/run/bare-os/loader-audit.ndjson',
        b4a.from(prev + line)
      )
    } catch {
      /* ignore */
    }
  }
}