fix(xref): move 1000-cap inside filter() and tighten route validation

- filter(): apply .slice(0, 1000) on the empty-term browse result before
  returning so the MemCache stores a bounded list (not the full unbounded
  DataEntry[]), fixing the memory safety concern
- searchOne(): remove the duplicate post-cache slice(0,1000) guards that
  were the only cap, now redundant since filter() is already bounded
- search.get.ts: remove !types?.length from the 400-guard so that
  ?type=... without specs or term returns a proper 400 instead of
  silently falling through to an empty-string term search that returns
  misleading results; update error message accordingly

Agent-Logs-Url: https://github.com/speced/respec-web-services/sessions/eafb7347-faf9-4e79-a820-4546c4b7b010

Author: Copilot

routes/xref/lib/search.ts

@@ -98,9 +98,7 @@ export function searchOne(
   const filtered = cache.getOr(query.id, () => filter(query, store, options));
 
   let prefereredData = filterBySpecType(filtered, options.spec_type);
-  if (!query.term) prefereredData = prefereredData.slice(0, 1000);
   prefereredData = filterPreferLatestVersion(prefereredData);
-  if (!query.term) prefereredData = prefereredData.slice(0, 1000);
   const result = prefereredData.map(item => pickFields(item, options.fields));
   return result;
 }
@@ -123,11 +121,12 @@ function normalizeQuery(query: Query, options: Options) {
 
 function filter(query: Query, store: Store, options: Options) {
   // When no term is provided but specs are, return all entries from those specs.
+  // Cap at 1000 here so the cached value is memory-bounded.
   if (!query.term && query.specs?.length) {
     const entries = collectBySpecs(query.specs, store);
     const byType = filterByType(entries, query);
     const byForContext = filterByForContext(byType, query, options);
-    return byForContext;
+    return byForContext.slice(0, 1000);
   }
 
   let result: DataEntry[] = [];

routes/xref/search.get.ts

@@ -17,9 +17,9 @@ export default async function route(req: IRequest, res: Response) {
   const { term, for: forContext } = req.query;
   const specs = splitQueryParam(req.query.specs);
   const types = splitQueryParam(req.query.type)?.flat(2) as Query["types"];
-  if (typeof term === "undefined" && !specs?.length && !types?.length) {
+  if (typeof term === "undefined" && !specs?.length) {
     res.status(400).json({
-      message: { type: "error", text: "Missing required query parameter: term (or provide specs or type)" },
+      message: { type: "error", text: "Missing required query parameter: term (or provide specs)" },
     });
     return;
   }