import { z } from 'zod';

/**
 * Auditor T1D (2026-06-01): hand-parsed query string for /api/search.
 *
 * The route previously called `searchParams.get('q')?.toLowerCase()` with
 * only a `length < 2` guard. No upper bound, no type assertion. A 5MB
 * query string was bounded only by Node's URL parser.
 *
 * Zod schema enforces sensible bounds before the value reaches Prisma's
 * LIKE patterns (which scan b-tree indexes on every char). Anything
 * longer than 200 chars is rejected — covers every real search use.
 */
export const searchQuerySchema = z.object({
    q: z.string().min(2, 'Query must be at least 2 characters').max(200, 'Query is too long'),
});

export type SearchQuery = z.infer<typeof searchQuerySchema>;