#!/usr/bin/env bash
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
SKILL_ROOT="$(dirname "$SCRIPT_DIR")"
source "$SCRIPT_DIR/_common.sh"

main() {
  status="$SKILL_ROOT/outputs/status_matrix.json"
  report="$SKILL_ROOT/outputs/audit_report.md"
  vault_root="$(cat "$SKILL_ROOT/outputs/vault_root.txt" 2>/dev/null || echo "")"

  cat > "$report" <<EOF
# Secrets Vault Audit Report (age + sops)

**Generated:** $(date -Iseconds)  
**Vault Root:** \`$vault_root\`  
**Skill Version:** 1.0.0

## Status Matrix

$(if [[ -f "$status" ]]; then echo '```json'; cat "$status"; echo '```'; else echo "_Missing status_matrix.json_"; fi)

## Operating Rules

- Commit **only ciphertext** (\`*.enc.*\`) to git.
- Never store plaintext secrets in the repo.
- Keep \`~/.config/sops/age/keys.txt\` at **0600**.
- Keep an offline recovery copy of the age identity.

## EU Compliance

EU (Ireland - Dublin), Irish jurisdiction. Secrets remain local-first; git stores ciphertext only.
EOF

  log_info "Wrote $report"
  cat "$report"
}
main "$@"