fix(fhir): page _offset as far as a series reaches

The 100000 ceiling refused offsets a correctly paging client reaches on
its own: an Observation series with a heart-rate history runs well past
a hundred thousand rows, and the next link the server handed out led
straight into a 400. The 500 the ceiling was added for came from an
offset such as 1e20 that no longer floors to an exact integer and that
the database cannot read as an OFFSET. The refusal now sits at the
largest exact integer, and a next link never carries an offset the
server would refuse.

src/lib/fhir/rest.ts

@@ -92,19 +92,21 @@ export const DEFAULT_COUNT = 50;
 export const MAX_COUNT = 200;
 
 /**
- * Ceiling on `_offset`. No record pages that far (the largest search, the
- * Observation time series, is bounded by the readings in a date range), and
- * an unbounded offset reached the database as a skip it cannot represent and
- * answered 500.
+ * Ceiling on `_offset`: the largest integer a JavaScript number holds
+ * exactly. It is no paging limit (the Observation time series of a heart-rate
+ * history pages well past a hundred thousand rows, and every page's `next`
+ * link must keep working); it refuses only an offset that cannot be passed
+ * on faithfully. Above it `Math.floor` returns a float such as `1e20`, which
+ * the database cannot read as a `bigint` `OFFSET` and which answered 500.
  */
-export const MAX_OFFSET = 100_000;
+export const MAX_OFFSET = Number.MAX_SAFE_INTEGER;
 
 /**
  * Parsed + clamped paging parameters. `count` is bounded to `[1, MAX_COUNT]`;
  * `offset` floors at 0. A non-numeric / negative input collapses to the
  * default rather than erroring — FHIR search is forgiving on paging params.
- * An offset above {@link MAX_OFFSET} is the one refusal: the caller answers
- * it with a 400 `invalid` OperationOutcome.
+ * An offset above {@link MAX_OFFSET} (including `Infinity`) is the one
+ * refusal: the caller answers it with a 400 `invalid` OperationOutcome.
  */
 export function parsePaging(
   searchParams: URLSearchParams,
@@ -127,6 +129,7 @@ export function parsePaging(
  * Build the absolute self link, and a next link when more rows remain. The
  * URL is rebuilt from the request URL with the paging params normalised, so
  * the echoed link always carries the clamped `_count` and concrete `_offset`.
+ * A next link never carries an offset {@link parsePaging} would refuse.
  */
 function pagingLinks(
   requestUrl: URL,
@@ -140,7 +143,7 @@ function pagingLinks(
   const links: FhirBundleLink[] = [{ relation: "self", url: self.toString() }];
 
   const nextOffset = offset + count;
-  if (nextOffset < total) {
+  if (nextOffset < total && nextOffset <= MAX_OFFSET) {
     const next = new URL(requestUrl.toString());
     next.searchParams.set("_count", String(count));
     next.searchParams.set("_offset", String(nextOffset));

src/lib/openapi/routes/health-record.ts

@@ -380,7 +380,7 @@ export const healthRecordPaths: NonNullable<ZodOpenApiObject["paths"]> = {
             .number()
             .optional()
             .describe(
-              "At most 100000; a larger offset is a 400 OperationOutcome.",
+              "Any integer up to 9007199254740991; a larger offset is a 400 OperationOutcome.",
             ),
         }),
       },
@@ -410,7 +410,7 @@ export const healthRecordPaths: NonNullable<ZodOpenApiObject["paths"]> = {
             .number()
             .optional()
             .describe(
-              "At most 100000; a larger offset is a 400 OperationOutcome.",
+              "Any integer up to 9007199254740991; a larger offset is a 400 OperationOutcome.",
             ),
           date: z.string().optional(),
           code: z.string().optional(),
@@ -442,7 +442,7 @@ export const healthRecordPaths: NonNullable<ZodOpenApiObject["paths"]> = {
             .number()
             .optional()
             .describe(
-              "At most 100000; a larger offset is a 400 OperationOutcome.",
+              "Any integer up to 9007199254740991; a larger offset is a 400 OperationOutcome.",
             ),
         }),
       },
@@ -472,7 +472,7 @@ export const healthRecordPaths: NonNullable<ZodOpenApiObject["paths"]> = {
             .number()
             .optional()
             .describe(
-              "At most 100000; a larger offset is a 400 OperationOutcome.",
+              "Any integer up to 9007199254740991; a larger offset is a 400 OperationOutcome.",
             ),
         }),
       },
@@ -502,7 +502,7 @@ export const healthRecordPaths: NonNullable<ZodOpenApiObject["paths"]> = {
             .number()
             .optional()
             .describe(
-              "At most 100000; a larger offset is a 400 OperationOutcome.",
+              "Any integer up to 9007199254740991; a larger offset is a 400 OperationOutcome.",
             ),
         }),
       },
@@ -682,7 +682,7 @@ export const healthRecordPaths: NonNullable<ZodOpenApiObject["paths"]> = {
             .number()
             .optional()
             .describe(
-              "At most 100000; a larger offset is a 400 OperationOutcome.",
+              "Any integer up to 9007199254740991; a larger offset is a 400 OperationOutcome.",
             ),
         }),
       },