@ultimat3/admin 15.0.0 → 17.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/admin",
-  "version": "15.0.0",
+  "version": "17.0.0",
   "description": "Two dashboards: the /_x framework dev panels and the generated, AI-first app admin",
   "license": "MIT",
   "type": "module",
@@ -32,20 +32,20 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/action": "15.0.0",
-    "@ultimat3/ai": "15.0.0",
-    "@ultimat3/cache": "15.0.0",
-    "@ultimat3/core": "15.0.0",
-    "@ultimat3/db": "15.0.0",
-    "@ultimat3/entity": "15.0.0",
-    "@ultimat3/i18n": "15.0.0",
-    "@ultimat3/jobs": "15.0.0",
-    "@ultimat3/mcp": "15.0.0",
-    "@ultimat3/money": "15.0.0",
-    "@ultimat3/policy": "15.0.0",
-    "@ultimat3/query": "15.0.0",
-    "@ultimat3/render": "15.0.0",
-    "@ultimat3/schema": "15.0.0",
-    "@ultimat3/ui": "15.0.0"
+    "@ultimat3/action": "17.0.0",
+    "@ultimat3/ai": "17.0.0",
+    "@ultimat3/cache": "17.0.0",
+    "@ultimat3/core": "17.0.0",
+    "@ultimat3/db": "17.0.0",
+    "@ultimat3/entity": "17.0.0",
+    "@ultimat3/i18n": "17.0.0",
+    "@ultimat3/jobs": "17.0.0",
+    "@ultimat3/mcp": "17.0.0",
+    "@ultimat3/money": "17.0.0",
+    "@ultimat3/policy": "17.0.0",
+    "@ultimat3/query": "17.0.0",
+    "@ultimat3/render": "17.0.0",
+    "@ultimat3/schema": "17.0.0",
+    "@ultimat3/ui": "17.0.0"
   }
 }

package/src/audit.ts

@@ -2,12 +2,15 @@
 // If it isn't logged, it didn't happen — so denied and failed attempts are logged too, and
 // there is deliberately no update or delete on this interface.
 
-import { canonicalJson } from '@ultimat3/core';
+import { canonicalJson, finiteCount } from '@ultimat3/core';
 import type { AdminActor, AdminDecision } from './authz';
 import type { AdminRow } from './registry';
 
 export const REDACTED = '[redacted]';
 
+/** Named once, so both refusals below say the same thing about the same call. */
+const SUBJECT = 'memoryAuditLog';
+
 export interface AuditFieldDiff {
   readonly field: string;
   readonly before: unknown;
@@ -91,7 +94,10 @@ export function auditEntry(draft: AuditDraft, id: string, at: Date): AuditEntry
 export function memoryAuditLog(opts: AuditLogOptions = {}): AuditLog {
   const now = opts.now ?? ((): Date => new Date());
   const nextId = opts.nextId ?? ((): string => crypto.randomUUID());
-  const capacity = opts.capacity ?? 1000;
+  // `log.length > NaN` is false for every length, so a capacity that is not a number does not make
+  // the ring bigger — it removes the ring, and this buffer then grows for the life of the process.
+  // At least 1, because a ring that keeps nothing is an audit log that records nothing.
+  const capacity = finiteCount(SUBJECT, 'capacity', opts.capacity ?? 1000, 1);
   const sinks = opts.sinks ?? [];
   const log: AuditEntry[] = [];
 
@@ -113,7 +119,12 @@ export function memoryAuditLog(opts: AuditLogOptions = {}): AuditLog {
           (query.actorId === undefined || entry.actor.id === query.actorId),
       );
       const newestFirst = [...filtered].reverse();
-      return query.limit === undefined ? newestFirst : newestFirst.slice(0, query.limit);
+      // The opposite failure to `capacity`, from the same missing check: `slice(0, NaN)` is `[]`,
+      // so an unreadable limit answers "nothing was ever logged" and reads as a successful read.
+      // 0 stays legal — asking for none is a coherent request.
+      return query.limit === undefined
+        ? newestFirst
+        : newestFirst.slice(0, finiteCount(SUBJECT, 'entries limit', query.limit));
     },
   };
 }

package/src/resource.ts

@@ -3,6 +3,7 @@
 // the default sort, i18n keys become labels. Every derived decision is overridable per
 // field, but the zero-config result is the one the generator emits and the one the docs show.
 
+import { finiteCount } from '@ultimat3/core';
 import { type AdminColumnFacts, adminColumnsOf } from './entity-columns';
 import {
   AdminEntityUnknownError,
@@ -278,7 +279,11 @@ export function adminResource<Row extends AdminRow = AdminRow>(
     filters: fields.filter((field) => field.filterable),
     searchFields: fields.filter((field) => field.searchable),
     defaultSort: opts.defaultSort ?? defaultSortOf(fields, idField),
-    pageSize: opts.pageSize ?? DEFAULT_PAGE_SIZE,
+    // Refused here rather than at the first listing, because `pagination.ts` clamps with
+    // `Math.max(1, Math.min(x, 200))` and neither of those validates: a `NaN` survives both, so
+    // `fetched.length > NaN` is false, the page is never trimmed, `hasMore` is false and the repo
+    // is asked for `limit: NaN`. At least 1 — a page with no rows on it is not a page.
+    pageSize: finiteCount('adminResource', 'pageSize', opts.pageSize ?? DEFAULT_PAGE_SIZE, 1),
     operations: opts.operations ?? ADMIN_OPERATIONS,
     actions,
     ...(opts.repo === undefined ? {} : { repo: opts.repo }),

package/src/search.ts

@@ -2,6 +2,7 @@
 // search config to drift from the entities, and no result an actor could not have opened —
 // the same `admin:read` + `<entity>:read` pair gates the hit and the detail page it links to.
 
+import { finiteCount } from '@ultimat3/core';
 import { expectedQueryLoop } from '@ultimat3/db';
 import { type AuditEntry, deniedDraft } from './audit';
 import { denied } from './authz';
@@ -104,7 +105,16 @@ const SKIPPED_FORBIDDEN = 'admin.search.skipped.forbidden';
 export async function adminSearch(input: AdminSearchInput): Promise<AdminSearchResult> {
   const { ctx } = input;
   const term = input.term.trim();
-  const limit = input.limitPerResource ?? DEFAULT_LIMIT_PER_RESOURCE;
+  // Both consumers of this number fail silently on a `NaN`, in opposite directions:
+  // `hits.length >= NaN` is false, so the early return never fires and every field of every
+  // resource is queried, and `repo.list({ limit: NaN })` hands the repo a limit no `LIMIT` clause
+  // carries. At least 1 — a cap of zero is a search that is guaranteed to find nothing.
+  const limit = finiteCount(
+    'adminSearch',
+    'limitPerResource',
+    input.limitPerResource ?? DEFAULT_LIMIT_PER_RESOURCE,
+    1,
+  );
   const searched: string[] = [];
   const skipped: { entity: string; reason: string }[] = [];
   const hits: AdminSearchHit[] = [];