From 044c9705eadf62f7c47ddd42a0b2dc065b26b228 Mon Sep 17 00:00:00 2001
From: morluto <76467478+morluto@users.noreply.github.com>
Date: Sat, 24 Oct 2026 09:47:28 +0800
Subject: [PATCH] refactor(validation): exercise authentication headroom at its
 boundary

Remove the unused estimator export. Check storage and escaping through typed authentication refusals with fixed allowances, preserving bounded traversal and acceptance controls.
---
 .../JsonAuthenticationHeadroom.test.ts        | 41 ++++++++++++++-----
 src/application/JsonAuthenticationHeadroom.ts |  4 --
 2 files changed, 31 insertions(+), 14 deletions(-)

diff --git a/src/application/JsonAuthenticationHeadroom.test.ts b/src/application/JsonAuthenticationHeadroom.test.ts
index 00d9e73822..0ef5ab4f32 100644
--- a/src/application/JsonAuthenticationHeadroom.test.ts
+++ b/src/application/JsonAuthenticationHeadroom.test.ts
@@ -1,8 +1,6 @@
 import { describe, expect, it } from "vitest";
-import {
-  estimateJsonValueBytes,
-  requireAuthenticationHeadroom,
-} from "./JsonAuthenticationHeadroom.js";
+import { requireAuthenticationHeadroom } from "./JsonAuthenticationHeadroom.js";
+import { AnalysisResourceConstraintError } from "../domain/analysisErrorCore.js";
 describe("JSON authentication headroom", () => {
   it("does not queue every row while deciding whether a wide report can fit", () => {
     let pending = 0;
@@ -48,12 +46,28 @@ describe("JSON authentication headroom", () => {
       },
     });
   });
-  it("estimates parsed JSON at no less than its UTF-16 text", () => {
+  it("reports parsed storage in authentication refusals", () => {
     const text = "x".repeat(1000);
-    expect(estimateJsonValueBytes(text)).toBeGreaterThanOrEqual(2000);
-    expect(
-      estimateJsonValueBytes({ outer: [text, { inner: text }] }),
-    ).toBeGreaterThan(2 * estimateJsonValueBytes(text));
+    const projectedBytes: number[] = [];
+    for (const value of [text, { outer: [text, { inner: text }] }]) {
+      const result = requireAuthenticationHeadroom(value, {
+        operation: "inspect_analysis_view",
+        path: "/tmp/bundle.json",
+        description: "Cannot authenticate bundle",
+        availableBytes: 0,
+      });
+      if (result.ok) throw new Error("Expected authentication refusal");
+      expect(result.error).toBeInstanceOf(AnalysisResourceConstraintError);
+      const bytes = result.error.reportedLimits?.projected_value_bytes;
+      if (typeof bytes !== "number")
+        throw new Error("Expected parsed storage bytes in refusal diagnostics");
+      projectedBytes.push(bytes);
+    }
+    const [scalar, nested] = projectedBytes;
+    if (scalar === undefined || nested === undefined)
+      throw new Error("Expected scalar and nested refusal diagnostics");
+    expect(scalar).toBeGreaterThanOrEqual(2000);
+    expect(nested).toBeGreaterThan(2 * scalar);
   });
 
   it("refuses authentication when live heap headroom cannot hold its copies", () => {
@@ -95,17 +109,24 @@ it.each([
   ],
   ["surrogate boundaries", { text: "😀\ud800x\udfff".repeat(2000) }],
 ])("reserves actual escaped JSON storage for %s", (_label, value) => {
+  const allowance = 64 * 1024;
   const result = requireAuthenticationHeadroom(value, {
     operation: "inspect_analysis_view",
     path: "/tmp/bundle.json",
     description: "Cannot authenticate bundle",
-    availableBytes: estimateJsonValueBytes(value) * 2 + 1,
+    availableBytes: allowance,
   });
+  if (result.ok) throw new Error("Expected authentication refusal");
+  expect(result.error).toBeInstanceOf(AnalysisResourceConstraintError);
+  expect(result.error.reportedLimits?.projected_value_bytes).toBeLessThan(
+    allowance / 2,
+  );
   expect(result).toMatchObject({
     ok: false,
     error: {
       _tag: "AnalysisResourceConstraintError",
       reportedLimits: {
+        available_heap_bytes: allowance,
         serialized_json_utf16_bytes: JSON.stringify(value).length * 2,
       },
     },
diff --git a/src/application/JsonAuthenticationHeadroom.ts b/src/application/JsonAuthenticationHeadroom.ts
index 0f21d47ab4..fad48c687a 100644
--- a/src/application/JsonAuthenticationHeadroom.ts
+++ b/src/application/JsonAuthenticationHeadroom.ts
@@ -57,10 +57,6 @@ const estimateJsonStorage = (
   return { valueBytes, serializedUtf16Bytes: serializedCharacters * 2 };
 };
 
-/** Conservative parsed JSON bytes, independent of its escaped representation. */
-export const estimateJsonValueBytes = (value: unknown): number =>
-  estimateJsonStorage(value).valueBytes;
-
 /** Refuse before authentication when live heap headroom cannot hold its validation and commitment working copies. */
 export const requireAuthenticationHeadroom = (
   value: unknown,