import { describe, expect, it, vi } from "vitest";

describe("provider output limiter", () => {
  it("counts secret-bearing bytes without retaining or forwarding them", async () => {
    const { createProviderOutputLimiter } = await import(
      "../../scripts/lib/provider-output-limiter.ts"
    );
    const exceeded = vi.fn();
    const limiter = createProviderOutputLimiter(64, exceeded);
    const credential = Buffer.from("provider-credential-must-not-reach-ci");
    const stdout = vi.spyOn(process.stdout, "write");
    const stderr = vi.spyOn(process.stderr, "write");
    try {
      limiter.consume(credential);
      expect(limiter.bytes()).toBe(credential.byteLength);
      expect(exceeded).not.toHaveBeenCalled();
      expect(stdout).not.toHaveBeenCalled();
      expect(stderr).not.toHaveBeenCalled();
      expect(JSON.stringify(limiter)).not.toContain(credential.toString("utf8"));
    } finally {
      stdout.mockRestore();
      stderr.mockRestore();
    }
  });

  it("signals once when aggregate stdout and stderr exceed the byte budget", async () => {
    const { createProviderOutputLimiter } = await import(
      "../../scripts/lib/provider-output-limiter.ts"
    );
    const exceeded = vi.fn();
    const limiter = createProviderOutputLimiter(5, exceeded);
    limiter.consume(Buffer.from("abc"));
    limiter.consume("def");
    limiter.consume("ignored");

    expect(limiter.bytes()).toBe(6);
    expect(exceeded).toHaveBeenCalledTimes(1);
  });
});