fix(housekeeping): harden preference persistence

src/features/housekeeping/foundation/preferences/schema.ts

@@ -1,5 +1,9 @@
 import { z } from "zod";
 
+export const HOUSEKEEPING_PREFERENCE_MAX_IDENTIFIER_LENGTH = 128;
+export const HOUSEKEEPING_PREFERENCE_MAX_ITEMS_PER_ARRAY = 64;
+export const HOUSEKEEPING_PREFERENCE_MAX_SERIALIZED_BYTES = 4096;
+
 export interface HousekeepingPreferences {
 	schemaVersion: 1;
 	pinnedRouteIds: string[];
@@ -10,7 +14,10 @@ export interface HousekeepingPreferences {
 }
 
 const uniqueIdentifiers = z
-	.array(z.string().trim().min(1))
+	.array(
+		z.string().trim().min(1).max(HOUSEKEEPING_PREFERENCE_MAX_IDENTIFIER_LENGTH),
+	)
+	.max(HOUSEKEEPING_PREFERENCE_MAX_ITEMS_PER_ARRAY)
 	.superRefine((values, context) => {
 		const seen = new Set<string>();
 		for (const [index, value] of values.entries()) {
@@ -35,7 +42,18 @@ export const housekeepingPreferencesSchema: z.ZodType<HousekeepingPreferences> =
 			widgetOrder: uniqueIdentifiers,
 			enabledOptionalWidgetIds: uniqueIdentifiers,
 		})
-		.strict();
+		.strict()
+		.superRefine((preferences, context) => {
+			if (
+				JSON.stringify(preferences).length >
+				HOUSEKEEPING_PREFERENCE_MAX_SERIALIZED_BYTES
+			) {
+				context.addIssue({
+					code: "custom",
+					message: "housekeeping preferences payload is too large",
+				});
+			}
+		});
 
 export function defaultHousekeepingPreferences(): HousekeepingPreferences {
 	return {