/**
 * GET /api/admin/accounts?q=&by=email|username|name|sub&cursor= (accounts.search, ADMIN.md §8): one filtered Cognito
 * ListUsers page (≤ 60) with each row's deletion hold. Rows carry the masked email only; the full email and name are
 * on the detail endpoint. Never an unfiltered listing: an empty or too-short query is a 400.
 */
export const GET = adminRoute("accounts.search", async (request) => {
  const params = new URL(request.url).searchParams;
  const by = (params.get("by") ?? "email") as SearchBy;
  if (!SEARCH_BY.includes(by)) throw invalid("by must be email, username, name or sub.");
  const page = await searchUsers({ q: params.get("q") ?? "", by, cursor: params.get("cursor") || undefined });
  return adminJson({ items: await withHolds(page.items), cursor: page.cursor ?? null });
}, { rateLimit: "accounts.search" });