test(provenance): make the byte-limit test reject at the gate it names

icecrasher321 · claude · icecrasher321 · commit fdfb43905a81 · 2026-08-11T12:14:36.000-07:00
Three limits can reject this value and my previous fix still tripped the wrong
one. `projectResolvedSecretModelJsonContent` checks the raw encoding, then walks
the content against a running budget, then re-encodes the projected object — and
only the last is what the test is for. At 16 the walk charged the key `a` and
then measured the 17-byte alias against the remaining 15, so it failed before the
re-encoding ran; at 25 everything passed. Neither assertion touched the check.

Twenty is the band that isolates it: the walk admits the alias against its
remaining 19, so a rejection there can only come from re-encoding the 25-byte
result. Asserting the content projection succeeds at the same limit pins that,
and deleting the re-encoding check now fails the test rather than leaving it
green.

Co-Authored-By: Claude Opus 5 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/apps/sim/executor/utils/resolved-secret-content-projection.test.ts b/apps/sim/executor/utils/resolved-secret-content-projection.test.ts
@@ -425,11 +425,18 @@ describe('projectResolvedSecretModelJsonContent', () => {
     expect(registry.recordResolved('X_LONGER_NAME', 'xxxxxxxx')).toBe(true)
 
     /**
-     * `{"a":"xxxxxxxx"}` is 16 bytes and fits; projecting it to
-     * `{"a":"{{X_LONGER_NAME}}"}` takes it to 25. The limit has to be applied to the projected
-     * bytes, so the first call must fail and the second must not.
+     * Three separate limits can reject this value, and only the last one is what this test is for:
+     * the raw encoding (16 bytes), the content walk's running budget, and the JSON re-encoding of
+     * the projected object (25 bytes). A limit of 20 is the only band that isolates the third —
+     * the walk charges the key `a` and then admits the 17-byte alias against the remaining 19, so
+     * anything that rejects at 20 can only be the wire check. Pinning both halves keeps it that
+     * way: drop the re-encoding check and the second assertion starts passing.
      */
-    expect(projectResolvedSecretModelJsonContent({ a: 'xxxxxxxx' }, registry, 16)).toEqual({
+    expect(projectResolvedSecretModelContent({ a: 'xxxxxxxx' }, registry, 20)).toEqual({
+      safe: true,
+      value: { a: '{{X_LONGER_NAME}}' },
+    })
+    expect(projectResolvedSecretModelJsonContent({ a: 'xxxxxxxx' }, registry, 20)).toEqual({
       safe: false,
     })
     expect(projectResolvedSecretModelJsonContent({ a: 'xxxxxxxx' }, registry, 25)).toEqual({
