@ultimat3/admin 5.0.1 → 7.0.0

package/README.md

@@ -58,7 +58,7 @@ export const admin = defineAdmin({
   audit: memoryAuditLog({ sinks: [auditTable] }),
 });
 
-export const routes = adminRoutes(admin); // generated views `spa`, custom pages `ssr`, all gated
+export const routes = adminRoutes(admin); // every view `ssr`, gated — an admin screen is per-actor
 ```
 
 ### The views are TSX, and the pieces come apart

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/admin",
-  "version": "5.0.1",
+  "version": "7.0.0",
   "description": "Two dashboards: the /_x framework dev panels and the generated, AI-first app admin",
   "license": "MIT",
   "type": "module",
@@ -32,20 +32,20 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/action": "5.0.1",
-    "@ultimat3/ai": "5.0.1",
-    "@ultimat3/cache": "5.0.1",
-    "@ultimat3/core": "5.0.1",
-    "@ultimat3/db": "5.0.1",
-    "@ultimat3/entity": "5.0.1",
-    "@ultimat3/i18n": "5.0.1",
-    "@ultimat3/jobs": "5.0.1",
-    "@ultimat3/mcp": "5.0.1",
-    "@ultimat3/money": "5.0.1",
-    "@ultimat3/policy": "5.0.1",
-    "@ultimat3/query": "5.0.1",
-    "@ultimat3/render": "5.0.1",
-    "@ultimat3/schema": "5.0.1",
-    "@ultimat3/ui": "5.0.1"
+    "@ultimat3/action": "7.0.0",
+    "@ultimat3/ai": "7.0.0",
+    "@ultimat3/cache": "7.0.0",
+    "@ultimat3/core": "7.0.0",
+    "@ultimat3/db": "7.0.0",
+    "@ultimat3/entity": "7.0.0",
+    "@ultimat3/i18n": "7.0.0",
+    "@ultimat3/jobs": "7.0.0",
+    "@ultimat3/mcp": "7.0.0",
+    "@ultimat3/money": "7.0.0",
+    "@ultimat3/policy": "7.0.0",
+    "@ultimat3/query": "7.0.0",
+    "@ultimat3/render": "7.0.0",
+    "@ultimat3/schema": "7.0.0",
+    "@ultimat3/ui": "7.0.0"
   }
 }

package/src/dev/facts.ts

@@ -14,7 +14,7 @@
  */
 export interface RouteFact {
   readonly path: string;
-  /** `RouteDescriptor.mode` — `ssr`, `isr`, `static`, `stream`, `spa`. */
+  /** `RouteDescriptor.mode` — `static`, `isr`, `ssr`, `stream`. */
   readonly render: string;
   readonly offline: string;
   readonly hydrate: string;

package/src/routes.ts

@@ -1,7 +1,7 @@
 // The one bridge from the admin's route table to @ultimat3/render, and the one place a policy
-// is composed onto an admin page. A generated view is `spa`: it is behind auth, so there is
-// nothing to prerender and nothing a CDN may hold — and `network-only` keeps a stale org's rows
-// out of a service worker cache. A custom page is `ssr`, because its guard runs on the server.
+// is composed onto an admin page. Every admin route is `ssr`: it is behind auth, so its guard runs
+// on the server, there is nothing to prerender and nothing a CDN may hold — and `network-only`
+// keeps a stale org's rows out of a service worker cache.
 
 import { t } from '@ultimat3/i18n';
 import { defineRoute, type RouteGuard } from '@ultimat3/render';
@@ -31,12 +31,11 @@ export interface AdminRouteConfig {
  * which is the whole mechanism. The coarse gate is `permissions[0]` (always `admin:read`, put
  * there by `permissionsForOperation`/`pagePermissions`); the rest of the pair is decided per
  * request by `decideAll`, in `crud.ts` for a generated view and in `page-guard.tsx` for a page.
- * An empty list is refused here too: `render: 'spa'` and `'ssr'` would both ship a public shell.
+ * An empty list is refused here too: `render: 'ssr'` with no policy is a public dashboard.
  */
 export function adminRouteConfig(route: AdminRoute): AdminRouteConfig {
   const permission = route.permissions[0];
   if (permission === undefined) throw new AdminPageUnguardedError({ path: route.path });
-  const custom = route.component !== undefined;
   const policy: RouteGuard = { permission };
 
   return {
@@ -47,11 +46,18 @@ export function adminRouteConfig(route: AdminRoute): AdminRouteConfig {
     component: route.component === undefined ? null : guardedPage(route, route.component),
     policy,
     config: defineRoute({
-      // A custom page renders server data behind the guard; a generated view is a shell that
-      // fetches through the admin's own gated calls. One mode each, never an author's choice.
-      render: custom ? 'ssr' : 'spa',
+      // One mode for every admin route, never an author's choice. A generated view was `spa` — a
+      // shell the browser was supposed to fill — until `spa` was deleted: nothing ever built the
+      // client bundle it preloaded and `renderSpa` never read the route's component, so every
+      // generated view served an empty `<div id="x-root">`. `ssr` renders the same rows behind the
+      // same guard, once per request, and `hydrate: 'never'` means the screen ships no JS at all:
+      // an admin view is a pure function of its props (no `createSignal`, no local state), so
+      // there is nothing to hydrate. `never` is a REFUSAL and not just a default — an `island()`
+      // rendered on this route throws `X_ISLAND_NOT_HYDRATED` (`@ultimat3/render`'s
+      // `island-collector.ts`), and no admin module declares one.
+      render: 'ssr',
       offline: 'network-only',
-      hydrate: custom ? 'never' : 'idle',
+      hydrate: 'never',
       policy,
       meta: () => ({ title: t(route.titleKey) }),
     }),