fix(executor): bound Rhai→JSON materialization to prevent anonymous OOM

The per-element Rhai sandbox caps (max_string_size 64 KiB, max_array_size /
max_map_size 10 000) do NOT bound the *materialized* size: Rhai shares strings
and arrays by Rc, so a 10 000-element array of one aliased 64 KiB string is
cheap to build (~10 000 ops, far under the 1 M op budget) yet dealiases to
~640 MiB of distinct JSON. Every Dynamic→JSON conversion deep-copies the
aliases; the HTTP response body path had NO size cap at all, and the KV/docs
value caps run only AFTER full materialization — so a handful of anonymous
requests could OOM the node (32 concurrent × ~640 MiB ≈ 20 GiB) on the stated
consumer-hardware target.

Add a byte-budgeted materializer that bails the moment the budget is exceeded,
so the transient allocation is bounded regardless of aliasing:
- bridge.rs: `dynamic_to_json_capped(value, max) -> Result<Json, JsonSizeError>`
  (charges a running budget) + `MAX_JSON_MATERIALIZE_BYTES` (16 MiB hard rail,
  far above the 256 KiB business caps). `dynamic_to_json` stays infallible for
  best-effort paths (logging) but is now internally bounded — it collapses an
  over-limit value to a marker string instead of OOMing.
- Route every user-value boundary through the fail-closed capped form: KV
  set/set_if (+ the CAS `expected`), docs create/update/find, secrets set,
  http request body, workflow input, `json::stringify`, and the HTTP RESPONSE
  body (previously the one fully-uncapped exit → now a 500). `invoke` args and
  the pubsub/queue message materializers get the same byte budget in place.
- `impl From<JsonSizeError> for Box<EvalAltResult>` so SDK sites protect
  themselves with a bare `?`.

Pinned by bridge unit tests: an aliased 10 000×64 KiB array errors on the
budget rather than materializing, and the infallible wrapper yields a marker
instead of OOMing. Workspace 914 + journeys 157/157 green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/executor-core/src/sdk/pubsub.rs

@@ -24,7 +24,7 @@ use rhai::{Array, Dynamic, Engine as RhaiEngine, EvalAltResult, Map, Module};
 use serde_json::Value as Json;
 use tokio::runtime::Handle as TokioHandle;
 
-use super::bridge::block_on;
+use super::bridge::{block_on, MAX_JSON_MATERIALIZE_BYTES};
 
 pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<SdkCallCx>) {
     let svc = services.pubsub.clone();
@@ -35,7 +35,7 @@ pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<Sdk
         module.set_native_fn(
             "publish_durable",
             move |topic: &str, message: Dynamic| -> Result<(), Box<EvalAltResult>> {
-                let json = message_to_json(&message);
+                let json = message_to_json(&message)?;
                 let svc = svc.clone();
                 let cx = cx.clone();
                 block_on("pubsub", async move {
@@ -110,7 +110,7 @@ fn shared_publish(
     subtopic: &str,
     message: Dynamic,
 ) -> Result<(), Box<EvalAltResult>> {
-    let json = message_to_json(&message);
+    let json = message_to_json(&message)?;
     let service = h.service.clone();
     let cx = h.cx.clone();
     let namespace = h.namespace.clone();
@@ -189,38 +189,81 @@ fn mint_token(
 
 /// Convert a Rhai `Dynamic` message into JSON, base64-encoding any
 /// `Blob` (at any nesting depth). Mirrors `bridge::dynamic_to_json` but
-/// adds the blob arm the pub/sub wire contract requires.
-fn message_to_json(value: &Dynamic) -> Json {
+/// adds the blob arm the pub/sub wire contract requires. Bounded by
+/// [`MAX_JSON_MATERIALIZE_BYTES`] so a cheaply-aliased huge message can't OOM
+/// the node on materialization (the per-message wire cap is enforced later, on
+/// the already-materialized value).
+fn message_to_json(value: &Dynamic) -> Result<Json, Box<EvalAltResult>> {
+    let mut remaining = MAX_JSON_MATERIALIZE_BYTES;
+    message_to_json_bounded(value, &mut remaining)
+}
+
+fn msg_charge(remaining: &mut usize, n: usize) -> Result<(), Box<EvalAltResult>> {
+    match remaining.checked_sub(n) {
+        Some(left) => {
+            *remaining = left;
+            Ok(())
+        }
+        None => Err(EvalAltResult::ErrorRuntime(
+            format!("pubsub: message too large to serialize (exceeds the {MAX_JSON_MATERIALIZE_BYTES}-byte limit)").into(),
+            rhai::Position::NONE,
+        )
+        .into()),
+    }
+}
+
+fn message_to_json_bounded(
+    value: &Dynamic,
+    remaining: &mut usize,
+) -> Result<Json, Box<EvalAltResult>> {
     // Blob must be checked before the generic array path (a Blob is a
     // `Vec<u8>`, distinct from a Rhai `Array`).
     if value.is_blob() {
         let blob = value.clone().into_blob().unwrap_or_default();
-        return Json::String(STANDARD.encode(&blob));
+        let encoded = STANDARD.encode(&blob);
+        msg_charge(remaining, encoded.len() + 2)?;
+        return Ok(Json::String(encoded));
     }
     if value.is_unit() {
-        return Json::Null;
+        msg_charge(remaining, 4)?;
+        return Ok(Json::Null);
     }
     if let Ok(b) = value.as_bool() {
-        return Json::Bool(b);
+        msg_charge(remaining, 5)?;
+        return Ok(Json::Bool(b));
     }
     if let Ok(i) = value.as_int() {
-        return Json::Number(i.into());
+        msg_charge(remaining, 8)?;
+        return Ok(Json::Number(i.into()));
     }
     if let Ok(f) = value.as_float() {
-        return serde_json::Number::from_f64(f).map_or(Json::Null, Json::Number);
+        msg_charge(remaining, 8)?;
+        return Ok(serde_json::Number::from_f64(f).map_or(Json::Null, Json::Number));
     }
     if value.is_string() {
-        return Json::String(value.clone().into_string().unwrap_or_default());
+        let s = value.clone().into_string().unwrap_or_default();
+        msg_charge(remaining, s.len() + 2)?;
+        return Ok(Json::String(s));
     }
     if let Some(arr) = value.clone().try_cast::<Array>() {
-        return Json::Array(arr.iter().map(message_to_json).collect());
+        msg_charge(remaining, 2)?;
+        let mut out = Vec::with_capacity(arr.len().min(1024));
+        for v in &arr {
+            msg_charge(remaining, 1)?;
+            out.push(message_to_json_bounded(v, remaining)?);
+        }
+        return Ok(Json::Array(out));
     }
     if let Some(map) = value.clone().try_cast::<Map>() {
+        msg_charge(remaining, 2)?;
         let mut out = serde_json::Map::new();
         for (k, v) in map {
-            out.insert(k.to_string(), message_to_json(&v));
+            msg_charge(remaining, k.len() + 4)?;
+            out.insert(k.to_string(), message_to_json_bounded(&v, remaining)?);
         }
-        return Json::Object(out);
+        return Ok(Json::Object(out));
     }
-    Json::String(value.to_string())
+    let s = value.to_string();
+    msg_charge(remaining, s.len() + 2)?;
+    Ok(Json::String(s))
 }