fix(core): bound durable media usage projection work

.changeset/calm-mice-admit.md

@@ -0,0 +1,5 @@
+---
+"emdash": patch
+---
+
+Adds resource limits to durable Media Usage indexing so already-oversized changed projections are rejected before the worker updates their index.

packages/core/package.json

@@ -205,6 +205,7 @@
     "typecheck": "tsgo --noEmit",
     "check": "publint && attw --pack --ignore-rules=cjs-resolves-to-esm --ignore-rules=no-resolution --ignore-rules=internal-resolution-error",
     "test": "vitest",
+    "test:workerd": "vitest run --config vitest.workerd.config.ts",
     "test:smoke": "vitest run --config vitest.smoke.config.ts",
     "test:integration": "vitest run --config vitest.integration.config.ts",
     "test:repro": "vitest run --config vitest.repro.config.ts"
@@ -278,6 +279,7 @@
   "devDependencies": {
     "@apidevtools/swagger-parser": "^12.1.0",
     "@arethetypeswrong/cli": "catalog:",
+    "@cloudflare/vitest-pool-workers": "catalog:",
     "@emdash-cms/blocks": "workspace:*",
     "@types/better-sqlite3": "^7.6.12",
     "@types/pg": "^8.16.0",

packages/core/src/database/repositories/media-usage.ts

@@ -33,7 +33,6 @@ type MediaUsageSourceNullableStringColumn =
 	| "updated_at"
 	| "last_attempted_at"
 	| "last_error_code";
-
 const OCCURRENCE_BIND_COLUMNS = 13;
 export const MEDIA_USAGE_GENERATION_WRITE_LEASE_MS = 60 * 60 * 1000;
 const OCCURRENCE_INSERT_BATCH_SIZE = Math.max(
@@ -184,6 +183,12 @@ export interface MediaUsageGuardedAttemptResult {
 	source: MediaUsageSource | null;
 }
 
+export interface MediaUsageSourceGenerationDeletionMeasurement {
+	occurrenceCount: number;
+	occurrenceBytes: number;
+	exceedsOccurrenceLimit: boolean;
+}
+
 export interface MediaUsageCleanupCursor {
 	createdAt: string;
 	id: string;
@@ -537,6 +542,38 @@ export class MediaUsageRepository {
 		return sources;
 	}
 
+	async measureSourceGenerationDeletion(
+		sourceKey: string,
+		generation: string,
+		maxOccurrences: number,
+	): Promise<MediaUsageSourceGenerationDeletionMeasurement> {
+		if (!Number.isSafeInteger(maxOccurrences) || maxOccurrences < 0) {
+			throw new Error("Media usage deletion measurement requires a non-negative row limit");
+		}
+		const payload = sql<string>`
+			COALESCE(field_slug, '') || COALESCE(field_path, '') ||
+			COALESCE(reference_type, '') || COALESCE(media_id, '') ||
+			COALESCE(provider, '') || COALESCE(provider_asset_id, '') ||
+			COALESCE(media_kind, '') || COALESCE(mime_type, '')
+		`;
+		const occurrenceBytes = isPostgres(this.db)
+			? sql<number>`octet_length(${payload})`
+			: sql<number>`length(CAST(${payload} AS BLOB))`;
+		const rows = await this.db
+			.selectFrom("_emdash_media_usage")
+			.select(occurrenceBytes.as("occurrence_bytes"))
+			.where("source_key", "=", sourceKey)
+			.where("generation", "=", generation)
+			.limit(maxOccurrences + 1)
+			.execute();
+
+		return {
+			occurrenceCount: rows.length,
+			occurrenceBytes: rows.reduce((total, row) => total + Number(row.occurrence_bytes), 0),
+			exceedsOccurrenceLimit: rows.length > maxOccurrences,
+		};
+	}
+
 	async replaceSourceIfMatching(
 		source: MediaUsageSourceInput,
 		occurrences: readonly MediaUsageOccurrenceInput[],