fix(web): converge session search boundaries (round 9)

packages/host/apiproxy/src/api/sessions.schema.ts

@@ -58,6 +58,26 @@ export const sessionListValueSchema = z.object({
 const SESSION_SEARCH_QUERY_MAX_CHARS = 500
 /** Product response bound validated independently by every client carrier. */
 const SESSION_SEARCH_RESULT_LIMIT = 20
+/** Maximum response snippet length in Unicode code points. */
+const SESSION_SEARCH_SNIPPET_MAX_CODE_POINTS = 240
+
+/** Early-exit Unicode code-point bound without materializing an iterator result. */
+function hasAtMostCodePoints(value: string, maximum: number): boolean {
+  let count = 0
+  let offset = 0
+  while (offset < value.length) {
+    if (count === maximum) return false
+    const first = value.charCodeAt(offset)
+    const paired = first >= 0xD800
+      && first <= 0xDBFF
+      && offset + 1 < value.length
+      && value.charCodeAt(offset + 1) >= 0xDC00
+      && value.charCodeAt(offset + 1) <= 0xDFFF
+    offset += paired ? 2 : 1
+    count++
+  }
+  return true
+}
 
 /** session.search request payload. */
 export const sessionSearchRequestSchema = z.object({
@@ -68,7 +88,10 @@ export const sessionSearchRequestSchema = z.object({
 /** One session.search result. */
 export const sessionSearchItemSchema = z.object({
   sessionId: sessionIdSchema,
-  snippet: z.string(),
+  snippet: z.string().refine(
+    snippet => hasAtMostCodePoints(snippet, SESSION_SEARCH_SNIPPET_MAX_CODE_POINTS),
+    { message: `search snippet must contain at most ${SESSION_SEARCH_SNIPPET_MAX_CODE_POINTS} Unicode code points` },
+  ),
 }) satisfies z.ZodType<Wire<SessionSearchItem>>
 
 /** session.search response value. */