replace duplicate validation with Zod schemas

Optimizations #6 & #7:
- #6: verified early exit optimization already implemented in FollowService
- #7: created validation.utils.ts with Zod schemas for array validation
- replaced 3 duplicate validation blocks with reusable Zod schemas
- updated batch-follow-users, check-follow-status, batch-search-actors

netlify/functions/batch-follow-users.ts

···
 import { SessionService } from "./services/SessionService";
 import { FollowService } from "./services/FollowService";
 import { MatchRepository } from "./repositories";
-import { successResponse } from "./utils";
+import { successResponse, validateArrayInput, ValidationSchemas } from "./utils";
 import { withAuthErrorHandling } from "./core/middleware";
-import { ValidationError } from "./core/errors";
 
 const batchFollowHandler: AuthenticatedHandler = async (context) => {
   const body = JSON.parse(context.event.body || "{}");
-  const dids: string[] = body.dids || [];
+  const dids = validateArrayInput<string>(
+    context.event.body,
+    "dids",
+    ValidationSchemas.didsArray,
+  );
   const followLexicon: string = body.followLexicon || "app.bsky.graph.follow";
-
-  if (!Array.isArray(dids) || dids.length === 0) {
-    throw new ValidationError("dids array is required and must not be empty");
-  }
-
-  if (dids.length > 100) {
-    throw new ValidationError("Maximum 100 DIDs per batch");
-  }
 
   const { agent } = await SessionService.getAgentForSession(
     context.sessionId,

netlify/functions/batch-search-actors.ts

···
 import { AuthenticatedHandler } from "./core/types";
 import { SessionService } from "./services/SessionService";
-import { successResponse } from "./utils";
+import { successResponse, validateArrayInput, ValidationSchemas } from "./utils";
 import { withAuthErrorHandling } from "./core/middleware";
-import { ValidationError } from "./core/errors";
 import { normalize } from "./utils/string.utils";
 import { FollowService } from "./services/FollowService";
 
 const batchSearchHandler: AuthenticatedHandler = async (context) => {
   const body = JSON.parse(context.event.body || "{}");
-  const usernames: string[] = body.usernames || [];
-
-  if (!Array.isArray(usernames) || usernames.length === 0) {
-    throw new ValidationError(
-      "usernames array is required and must not be empty",
-    );
-  }
-
-  if (usernames.length > 50) {
-    throw new ValidationError("Maximum 50 usernames per batch");
-  }
+  const usernames = validateArrayInput<string>(
+    context.event.body,
+    "usernames",
+    ValidationSchemas.usernamesArray,
+  );
 
   const { agent } = await SessionService.getAgentForSession(
     context.sessionId,

netlify/functions/check-follow-status.ts

···
 import { AuthenticatedHandler } from "./core/types";
 import { SessionService } from "./services/SessionService";
 import { FollowService } from "./services/FollowService";
-import { successResponse } from "./utils";
+import { successResponse, validateArrayInput, ValidationSchemas } from "./utils";
 import { withAuthErrorHandling } from "./core/middleware";
-import { ValidationError } from "./core/errors";
 
 const checkFollowStatusHandler: AuthenticatedHandler = async (context) => {
   const body = JSON.parse(context.event.body || "{}");
-  const dids: string[] = body.dids || [];
+  const dids = validateArrayInput<string>(
+    context.event.body,
+    "dids",
+    ValidationSchemas.didsArray,
+  );
   const followLexicon: string = body.followLexicon || "app.bsky.graph.follow";
-
-  if (!Array.isArray(dids) || dids.length === 0) {
-    throw new ValidationError("dids array is required and must not be empty");
-  }
-
-  if (dids.length > 100) {
-    throw new ValidationError("Maximum 100 DIDs per batch");
-  }
 
   const { agent } = await SessionService.getAgentForSession(
     context.sessionId,

netlify/functions/utils/index.ts

···
 export * from "./response.utils";
 export * from "./string.utils";
 export * from "./encryption.utils";
+export * from "./validation.utils";

netlify/functions/utils/validation.utils.ts

···
+import { z } from "zod";
+import { ValidationError } from "../core/errors";
+
+/**
+ * Validation utility schemas using Zod
+ * Provides type-safe validation with clear error messages
+ */
+
+/**
+ * Generic array validation schema factory
+ * @param itemSchema - Zod schema for array items
+ * @param maxLength - Maximum array length
+ * @param fieldName - Name of field for error messages
+ */
+export function createArraySchema<T extends z.ZodTypeAny>(
+  itemSchema: T,
+  maxLength: number,
+  fieldName: string = "items",
+) {
+  return z
+    .array(itemSchema)
+    .min(1, `${fieldName} array is required and must not be empty`)
+    .max(maxLength, `Maximum ${maxLength} ${fieldName} per batch`);
+}
+
+/**
+ * Common validation schemas
+ */
+export const ValidationSchemas = {
+  // DIDs array (max 100)
+  didsArray: createArraySchema(z.string(), 100, "DIDs"),
+
+  // Usernames array (max 50)
+  usernamesArray: createArraySchema(z.string(), 50, "usernames"),
+
+  // Generic string array with custom max
+  stringArray: (maxLength: number, fieldName: string = "items") =>
+    createArraySchema(z.string(), maxLength, fieldName),
+};
+
+/**
+ * Validates input against a Zod schema and throws ValidationError on failure
+ * @param schema - Zod schema to validate against
+ * @param data - Data to validate
+ * @returns Parsed and validated data
+ * @throws ValidationError if validation fails
+ */
+export function validateInput<T>(schema: z.ZodSchema<T>, data: unknown): T {
+  const result = schema.safeParse(data);
+
+  if (!result.success) {
+    // Extract first error message for cleaner API responses
+    const firstError = result.error.issues[0];
+    const message = firstError.message;
+    throw new ValidationError(message);
+  }
+
+  return result.data;
+}
+
+/**
+ * Parses request body and validates array input
+ * Common pattern: JSON.parse(body) -> extract array -> validate
+ */
+export function validateArrayInput<T>(
+  body: string | null,
+  fieldName: string,
+  schema: z.ZodArray<any>,
+): T[] {
+  const parsed = JSON.parse(body || "{}");
+  const data = parsed[fieldName];
+
+  return validateInput(schema, data);
+}