Test: Improve recursion depth limit tests for JSON utils

* 🎯 **What:** Improved `tests/unit/json_utils_security.test.ts` to strictly verify the recursion depth limit (1000) in `generateMergePatch` and `applyMergePatch`.
* 📊 **Coverage:** Added boundary tests for depth 1000 (allowed) and depth 1001 (disallowed) using a deterministic `createDeepObject` helper.
* ✨ **Result:** Verified that the safety mechanism correctly enforces the limit without off-by-one errors. Confirmed behavior by temporarily lowering the limit.

Co-authored-by: zknpr <96851588+zknpr@users.noreply.github.com>

Author: google-labs-jules[bot]

tests/unit/json_utils_security.test.ts

@@ -3,16 +3,34 @@ import { describe, it } from 'node:test';
 import assert from 'node:assert';
 import { generateMergePatch, applyMergePatch } from '../../src/core/json-utils';
 
+function createDeepObject(depth: number, leafValue: any = 1) {
+    let obj: any = { leaf: leafValue };
+    for (let i = 0; i < depth; i++) {
+        obj = { next: obj };
+    }
+    return obj;
+}
+
 describe('JSON Merge Patch Security', () => {
-    it('generateMergePatch should throw on deep recursion', () => {
-        const depth = 1100; // > 1000
-        let original: any = { a: 1 };
-        let modified: any = { a: 2 };
-
-        for (let i = 0; i < depth; i++) {
-            original = { next: original };
-            modified = { next: modified };
-        }
+    // MAX_DEPTH is 1000.
+    // Nesting level N creates depth N+1 (recursion for leaf comparison/application).
+    // So Nesting 999 -> Depth 1000 (Allowed).
+    // Nesting 1000 -> Depth 1001 (Throw).
+
+    it('generateMergePatch should allow max depth (1000)', () => {
+        const nesting = 999;
+        const original = createDeepObject(nesting, 1);
+        const modified = createDeepObject(nesting, 2);
+
+        // Should not throw
+        const patch = generateMergePatch(original, modified);
+        assert.notStrictEqual(patch, undefined);
+    });
+
+    it('generateMergePatch should throw on max depth + 1 (1001)', () => {
+        const nesting = 1000;
+        const original = createDeepObject(nesting, 1);
+        const modified = createDeepObject(nesting, 2);
 
         try {
             generateMergePatch(original, modified);
@@ -22,21 +40,25 @@ describe('JSON Merge Patch Security', () => {
         }
     });
 
-    it('applyMergePatch should throw on deep recursion', () => {
-        const depth = 1100; // > 1000
-        let target: any = { a: 1 };
-        let patch: any = { a: 2 };
+    it('applyMergePatch should allow max depth (1000)', () => {
+        const nesting = 999;
+        const target = {};
+        const patch = createDeepObject(nesting, 1);
 
-        for (let i = 0; i < depth; i++) {
-            target = { next: target };
-            patch = { next: patch };
-        }
+        // Should not throw
+        applyMergePatch(target, patch);
+    });
+
+    it('applyMergePatch should throw on max depth + 1 (1001)', () => {
+        const nesting = 1000;
+        const target = {};
+        const patch = createDeepObject(nesting, 1);
 
         try {
-             applyMergePatch(target, patch);
-             assert.fail('Should have thrown depth limit error');
+            applyMergePatch(target, patch);
+            assert.fail('Should have thrown depth limit error');
         } catch (e: any) {
-             assert.match(e.message, /JSON apply merge patch depth limit exceeded/);
+            assert.match(e.message, /JSON apply merge patch depth limit exceeded/);
         }
     });