import { describe, expect, it } from 'vitest';
import { createProbeRegistry } from '../probe/registry.js';
import { InMemoryCredentialVault } from './InMemoryCredentialVault.js';
import { wrapVaultWithProbes } from './instrumentation.js';
const tenant = 'tnt_acme';
const connector = 'conn_x';
describe('wrapVaultWithProbes', () => {
    it('emits vault_lookup with found:true when retrieve hits', async () => {
        const reg = createProbeRegistry();
        const seen = [];
        reg.onAny((event) => seen.push(event));
        const inner = new InMemoryCredentialVault();
        const ref = await inner.store(tenant, connector, 'k', { type: 'apiKey', apiKey: 's' });
        const wrapped = wrapVaultWithProbes(inner, { probes: reg, vaultId: 'in-memory' });
        const result = await wrapped.retrieve(ref.id);
        expect(result).toBeDefined();
        expect(seen.length).toBe(1);
        const event = seen[0];
        expect(event.type).toBe('vault_lookup');
        expect(event.found).toBe(true);
        expect(event.vaultId).toBe('in-memory');
        expect(event.credentialId).toBe(ref.id);
    });
    it('emits vault_lookup with found:false when retrieve misses', async () => {
        const reg = createProbeRegistry();
        const seen = [];
        reg.onAny((event) => seen.push(event));
        const wrapped = wrapVaultWithProbes(new InMemoryCredentialVault(), {
            probes: reg,
            vaultId: 'in-memory',
        });
        const missing = 'cred_missing';
        const result = await wrapped.retrieve(missing);
        expect(result).toBeUndefined();
        expect(seen.length).toBe(1);
        const event = seen[0];
        expect(event.found).toBe(false);
        expect(event.credentialId).toBe(missing);
    });
    it('does not emit on store/revoke/list — retrieve is the audit point', async () => {
        const reg = createProbeRegistry();
        const seen = [];
        reg.onAny((event) => seen.push(event));
        const wrapped = wrapVaultWithProbes(new InMemoryCredentialVault(), { probes: reg });
        const ref = await wrapped.store(tenant, connector, 'k', {
            type: 'apiKey',
            apiKey: 's',
        });
        await wrapped.list(tenant);
        await wrapped.revoke(ref.id);
        expect(seen.length).toBe(0);
    });
    it('does not leak the secret value in the emitted event', async () => {
        const reg = createProbeRegistry();
        const seen = [];
        reg.onAny((event) => seen.push(event));
        const inner = new InMemoryCredentialVault();
        const ref = await inner.store(tenant, connector, 'k', {
            type: 'apiKey',
            apiKey: 'super-secret-value',
        });
        const wrapped = wrapVaultWithProbes(inner, { probes: reg });
        await wrapped.retrieve(ref.id);
        const event = seen[0];
        const serialized = JSON.stringify(event);
        expect(serialized).not.toContain('super-secret-value');
    });
    it('falls back to constructor.name as vaultId when not specified', async () => {
        const reg = createProbeRegistry();
        const seen = [];
        reg.onAny((event) => seen.push(event));
        const inner = new InMemoryCredentialVault();
        const ref = await inner.store(tenant, connector, 'k', { type: 'apiKey', apiKey: 's' });
        const wrapped = wrapVaultWithProbes(inner, { probes: reg });
        await wrapped.retrieve(ref.id);
        const event = seen[0];
        expect(event.vaultId).toBe('InMemoryCredentialVault');
    });
});
//# sourceMappingURL=instrumentation.test.js.map