@precisa-saude/fhir-rnds-sandbox 0.1.0

package/dist/cli.cjs

@@ -0,0 +1,1588 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/cli.ts
+var cli_exports = {};
+__export(cli_exports, {
+  main: () => main,
+  parseArgs: () => parseArgs
+});
+module.exports = __toCommonJS(cli_exports);
+var import_node_fs3 = __toESM(require("fs"), 1);
+var import_node_url = require("url");
+
+// src/scenarios/internacao.ts
+var CPF = "98765432100";
+var CNS = "700000000000020";
+var CNES_HOSPITAL = "3456789";
+var CNS_PROFISSIONAL = "700000000000030";
+var internacao = {
+  data: {
+    organizations: [
+      {
+        active: true,
+        id: CNES_HOSPITAL,
+        identifier: [
+          { system: "http://rnds.saude.gov.br/fhir/r4/NamingSystem/cnes", value: CNES_HOSPITAL }
+        ],
+        name: "Hospital Sint\xE9tico do Cora\xE7\xE3o (sandbox)",
+        resourceType: "Organization"
+      }
+    ],
+    patients: [
+      {
+        birthDate: "1958-02-28",
+        gender: "male",
+        id: CNS,
+        identifier: [
+          { system: "http://rnds.saude.gov.br/fhir/r4/NamingSystem/cpf", value: CPF },
+          { system: "http://rnds.saude.gov.br/fhir/r4/NamingSystem/cns", value: CNS }
+        ],
+        name: [{ family: "Souza", given: ["Carlos", "Henrique"] }],
+        resourceType: "Patient"
+      }
+    ],
+    practitioners: [
+      {
+        active: true,
+        id: CNS_PROFISSIONAL,
+        identifier: [
+          {
+            system: "http://rnds.saude.gov.br/fhir/r4/NamingSystem/cns",
+            value: CNS_PROFISSIONAL
+          }
+        ],
+        name: [{ family: "Mendes", given: ["Roberto"] }],
+        resourceType: "Practitioner"
+      }
+    ],
+    submittedBundles: [
+      {
+        entry: [
+          {
+            request: { method: "POST", url: "Encounter" },
+            resource: {
+              class: { code: "IMP", display: "inpatient encounter" },
+              period: { start: "2026-04-15T10:30:00-03:00" },
+              resourceType: "Encounter",
+              serviceProvider: { reference: `Organization/${CNES_HOSPITAL}` },
+              status: "in-progress",
+              subject: { reference: `Patient/${CNS}` }
+            }
+          },
+          {
+            request: { method: "POST", url: "Condition" },
+            resource: {
+              code: {
+                coding: [
+                  {
+                    code: "I50.0",
+                    display: "Insufici\xEAncia card\xEDaca congestiva",
+                    system: "http://hl7.org/fhir/sid/icd-10"
+                  }
+                ]
+              },
+              recordedDate: "2026-04-15",
+              resourceType: "Condition",
+              subject: { reference: `Patient/${CNS}` }
+            }
+          },
+          {
+            request: { method: "POST", url: "Observation" },
+            resource: {
+              code: {
+                coding: [{ code: "33762-6", display: "NT-proBNP", system: "http://loinc.org" }]
+              },
+              effectiveDateTime: "2026-04-15T11:15:00-03:00",
+              resourceType: "Observation",
+              status: "final",
+              subject: { reference: `Patient/${CNS}` },
+              valueQuantity: {
+                code: "pg/mL",
+                system: "http://unitsofmeasure.org",
+                unit: "pg/mL",
+                value: 4820
+              }
+            }
+          },
+          {
+            request: { method: "POST", url: "Observation" },
+            resource: {
+              code: {
+                coding: [{ code: "49563-0", display: "Troponina I", system: "http://loinc.org" }]
+              },
+              effectiveDateTime: "2026-04-15T11:15:00-03:00",
+              resourceType: "Observation",
+              status: "final",
+              subject: { reference: `Patient/${CNS}` },
+              valueQuantity: {
+                code: "ng/mL",
+                system: "http://unitsofmeasure.org",
+                unit: "ng/mL",
+                value: 0.08
+              }
+            }
+          }
+        ],
+        resourceType: "Bundle",
+        type: "transaction"
+      }
+    ]
+  },
+  description: "Carlos Henrique Souza (CPF 987.654.321-00, CNS 700 0000 0000 0020), 67 anos, internado por insufici\xEAncia card\xEDaca descompensada (CID I50.0). Hospital CNES 3456789.",
+  name: "internacao"
+};
+
+// src/scenarios/paciente-com-exames.ts
+var CPF2 = "12345678901";
+var CNS2 = "700000000000001";
+var CNES_LAB = "2345678";
+var CNS_PROFISSIONAL2 = "700000000000010";
+var pacienteComExames = {
+  data: {
+    organizations: [
+      {
+        active: true,
+        id: CNES_LAB,
+        identifier: [
+          {
+            system: "http://rnds.saude.gov.br/fhir/r4/NamingSystem/cnes",
+            value: CNES_LAB
+          }
+        ],
+        name: "Laborat\xF3rio Sint\xE9tico S\xE3o Paulo (sandbox)",
+        resourceType: "Organization"
+      }
+    ],
+    patients: [
+      {
+        birthDate: "1983-08-12",
+        gender: "female",
+        id: CNS2,
+        identifier: [
+          { system: "http://rnds.saude.gov.br/fhir/r4/NamingSystem/cpf", value: CPF2 },
+          { system: "http://rnds.saude.gov.br/fhir/r4/NamingSystem/cns", value: CNS2 }
+        ],
+        name: [{ family: "Silva", given: ["Joana", "Maria", "da"] }],
+        resourceType: "Patient"
+      }
+    ],
+    practitioners: [
+      {
+        active: true,
+        id: CNS_PROFISSIONAL2,
+        identifier: [
+          {
+            system: "http://rnds.saude.gov.br/fhir/r4/NamingSystem/cns",
+            value: CNS_PROFISSIONAL2
+          }
+        ],
+        name: [{ family: "Pereira", given: ["Ana", "Carolina"] }],
+        resourceType: "Practitioner"
+      }
+    ],
+    submittedBundles: [
+      {
+        entry: [
+          {
+            request: { method: "POST", url: "Observation" },
+            resource: {
+              code: {
+                coding: [
+                  {
+                    code: "2093-3",
+                    display: "Colesterol total",
+                    system: "http://loinc.org"
+                  }
+                ]
+              },
+              effectiveDateTime: "2025-09-10",
+              resourceType: "Observation",
+              status: "final",
+              subject: { reference: `Patient/${CNS2}` },
+              valueQuantity: {
+                code: "mg/dL",
+                system: "http://unitsofmeasure.org",
+                unit: "mg/dL",
+                value: 198
+              }
+            }
+          },
+          {
+            request: { method: "POST", url: "Observation" },
+            resource: {
+              code: {
+                coding: [{ code: "2089-1", display: "LDL-Colesterol", system: "http://loinc.org" }]
+              },
+              effectiveDateTime: "2025-09-10",
+              resourceType: "Observation",
+              status: "final",
+              subject: { reference: `Patient/${CNS2}` },
+              valueQuantity: {
+                code: "mg/dL",
+                system: "http://unitsofmeasure.org",
+                unit: "mg/dL",
+                value: 124
+              }
+            }
+          },
+          {
+            request: { method: "POST", url: "Observation" },
+            resource: {
+              code: {
+                coding: [{ code: "2085-9", display: "HDL-Colesterol", system: "http://loinc.org" }]
+              },
+              effectiveDateTime: "2025-09-10",
+              resourceType: "Observation",
+              status: "final",
+              subject: { reference: `Patient/${CNS2}` },
+              valueQuantity: {
+                code: "mg/dL",
+                system: "http://unitsofmeasure.org",
+                unit: "mg/dL",
+                value: 56
+              }
+            }
+          },
+          {
+            request: { method: "POST", url: "Observation" },
+            resource: {
+              code: {
+                coding: [{ code: "2345-7", display: "Glicose", system: "http://loinc.org" }]
+              },
+              effectiveDateTime: "2025-09-10",
+              resourceType: "Observation",
+              status: "final",
+              subject: { reference: `Patient/${CNS2}` },
+              valueQuantity: {
+                code: "mg/dL",
+                system: "http://unitsofmeasure.org",
+                unit: "mg/dL",
+                value: 96
+              }
+            }
+          }
+        ],
+        resourceType: "Bundle",
+        type: "transaction"
+      }
+    ]
+  },
+  description: "Joana Maria da Silva (CPF 123.456.789-01, CNS 700 0000 0000 0001), 42 anos, com hist\xF3rico de lipidograma e glicemia. Laborat\xF3rio CNES 2345678. Profissional Dr(a). Pereira (CNS 700 0000 0000 0010).",
+  name: "paciente-com-exames"
+};
+
+// src/scenarios/vacina.ts
+var CNS3 = "700000000000040";
+var CNES_UBS = "4567890";
+var CNS_PROFISSIONAL3 = "700000000000050";
+var vacina = {
+  data: {
+    organizations: [
+      {
+        active: true,
+        id: CNES_UBS,
+        identifier: [
+          { system: "http://rnds.saude.gov.br/fhir/r4/NamingSystem/cnes", value: CNES_UBS }
+        ],
+        name: "UBS Sint\xE9tica Vila Sa\xFAde (sandbox)",
+        resourceType: "Organization"
+      }
+    ],
+    patients: [
+      {
+        birthDate: "2017-11-04",
+        gender: "male",
+        id: CNS3,
+        identifier: [{ system: "http://rnds.saude.gov.br/fhir/r4/NamingSystem/cns", value: CNS3 }],
+        name: [{ family: "Almeida", given: ["Pedro", "Lima"] }],
+        resourceType: "Patient"
+      }
+    ],
+    practitioners: [
+      {
+        active: true,
+        id: CNS_PROFISSIONAL3,
+        identifier: [
+          {
+            system: "http://rnds.saude.gov.br/fhir/r4/NamingSystem/cns",
+            value: CNS_PROFISSIONAL3
+          }
+        ],
+        name: [{ family: "Costa", given: ["Fernanda"] }],
+        resourceType: "Practitioner"
+      }
+    ],
+    submittedBundles: [
+      {
+        entry: [
+          {
+            request: { method: "POST", url: "Immunization" },
+            resource: {
+              occurrenceDateTime: "2017-11-05",
+              patient: { reference: `Patient/${CNS3}` },
+              resourceType: "Immunization",
+              status: "completed",
+              vaccineCode: {
+                coding: [{ code: "BCG", display: "BCG", system: "urn:oid:2.16.840.1.113883.6.59" }]
+              }
+            }
+          },
+          {
+            request: { method: "POST", url: "Immunization" },
+            resource: {
+              occurrenceDateTime: "2017-11-05",
+              patient: { reference: `Patient/${CNS3}` },
+              resourceType: "Immunization",
+              status: "completed",
+              vaccineCode: {
+                coding: [
+                  {
+                    code: "HBV",
+                    display: "Hepatite B (RN)",
+                    system: "urn:oid:2.16.840.1.113883.6.59"
+                  }
+                ]
+              }
+            }
+          },
+          {
+            request: { method: "POST", url: "Immunization" },
+            resource: {
+              occurrenceDateTime: "2018-12-12",
+              patient: { reference: `Patient/${CNS3}` },
+              resourceType: "Immunization",
+              status: "completed",
+              vaccineCode: {
+                coding: [
+                  {
+                    code: "MMR",
+                    display: "Tr\xEDplice viral (SCR)",
+                    system: "urn:oid:2.16.840.1.113883.6.59"
+                  }
+                ]
+              }
+            }
+          }
+        ],
+        resourceType: "Bundle",
+        type: "transaction"
+      }
+    ]
+  },
+  description: "Pedro Lima Almeida (CNS 700 0000 0000 0040), 8 anos, com calend\xE1rio vacinal aplicado em UBS CNES 4567890.",
+  name: "vacina"
+};
+
+// src/scenarios/index.ts
+var SCENARIOS = {
+  internacao,
+  "paciente-com-exames": pacienteComExames,
+  vacina,
+  vazio: {
+    data: { organizations: [], patients: [], practitioners: [] },
+    description: "Estado limpo. \xDAtil para testar fluxos do zero.",
+    name: "vazio"
+  }
+};
+function resolveScenario(name) {
+  return SCENARIOS[name ?? "paciente-com-exames"];
+}
+
+// src/server.ts
+var import_node_fs2 = __toESM(require("fs"), 1);
+var import_node_http = __toESM(require("http"), 1);
+var import_node_https = __toESM(require("https"), 1);
+
+// src/keys.ts
+var import_node_crypto = require("crypto");
+var import_node_fs = __toESM(require("fs"), 1);
+var DEFAULT_KEY_ID = "rnds-sandbox-1";
+var cachedDefaultKeys;
+function resolveSigningKeys(options = {}) {
+  const keyId = options.keyId ?? DEFAULT_KEY_ID;
+  if (options.privateKey) {
+    const privatePem = readPem(options.privateKey);
+    const privateKey = (0, import_node_crypto.createPrivateKey)(privatePem);
+    const publicKey = options.publicKey ? (0, import_node_crypto.createPublicKey)(readPem(options.publicKey)) : (0, import_node_crypto.createPublicKey)(privateKey);
+    return { keyId, privateKey, publicKey };
+  }
+  if (keyId === DEFAULT_KEY_ID && cachedDefaultKeys) {
+    return cachedDefaultKeys;
+  }
+  const generated = (0, import_node_crypto.generateKeyPairSync)("rsa", { modulusLength: 2048 });
+  const result = {
+    keyId,
+    privateKey: generated.privateKey,
+    publicKey: generated.publicKey
+  };
+  if (keyId === DEFAULT_KEY_ID) {
+    cachedDefaultKeys = result;
+  }
+  return result;
+}
+function readPem(value) {
+  if (typeof value !== "string") {
+    return value;
+  }
+  if (value.includes("-----BEGIN")) {
+    return value;
+  }
+  return import_node_fs.default.readFileSync(value);
+}
+
+// src/auth.ts
+var import_node_crypto2 = require("crypto");
+var TOKEN_TTL_MS = 30 * 60 * 1e3;
+function issueToken(keys, options = {}) {
+  const now = options.now ?? Date.now();
+  const audience = options.audience ?? "rnds-sandbox";
+  const issuer = options.issuer ?? "https://rnds-sandbox.local";
+  const claims = {
+    aud: audience,
+    exp: Math.floor((now + TOKEN_TTL_MS) / 1e3),
+    iat: Math.floor(now / 1e3),
+    iss: issuer,
+    sub: options.identity?.cn ?? "sandbox",
+    ...options.identity?.cn ? { cn: options.identity.cn } : {},
+    ...options.identity?.cnes ? { cnes: options.identity.cnes } : {}
+  };
+  const accessToken = signJwt(claims, keys);
+  return {
+    access_token: accessToken,
+    expires_in: Math.floor(TOKEN_TTL_MS / 1e3),
+    scope: "rnds:read rnds:write",
+    token_type: "Bearer"
+  };
+}
+function verifyToken(token, keys, options = {}) {
+  const now = options.now ?? Date.now();
+  const expectedAudience = options.audience ?? "rnds-sandbox";
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return { reason: "malformed", valid: false };
+  }
+  const [headerB64, payloadB64, signatureB64] = parts;
+  let header;
+  let payload;
+  try {
+    header = JSON.parse(Buffer.from(headerB64, "base64url").toString("utf-8"));
+    payload = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf-8"));
+  } catch {
+    return { reason: "malformed", valid: false };
+  }
+  if (header.alg !== "RS256") {
+    return { reason: "malformed", valid: false };
+  }
+  if (header.kid && header.kid !== keys.keyId) {
+    return { reason: "wrong-key", valid: false };
+  }
+  const signingInput = `${headerB64}.${payloadB64}`;
+  const verifier = (0, import_node_crypto2.createVerify)("RSA-SHA256").update(signingInput);
+  const signatureValid = verifier.verify(keys.publicKey, Buffer.from(signatureB64, "base64url"));
+  if (!signatureValid) {
+    return { reason: "bad-signature", valid: false };
+  }
+  if (payload.exp * 1e3 < now) {
+    return { reason: "expired", valid: false };
+  }
+  if (payload.aud !== expectedAudience) {
+    return { reason: "wrong-audience", valid: false };
+  }
+  return { claims: payload, valid: true };
+}
+function signJwt(claims, keys) {
+  const header = { alg: "RS256", kid: keys.keyId, typ: "JWT" };
+  const headerB64 = base64UrlJson(header);
+  const payloadB64 = base64UrlJson(claims);
+  const signingInput = `${headerB64}.${payloadB64}`;
+  const signer = (0, import_node_crypto2.createSign)("RSA-SHA256").update(signingInput);
+  const signature = signer.sign(keys.privateKey).toString("base64url");
+  return `${signingInput}.${signature}`;
+}
+function base64UrlJson(value) {
+  return Buffer.from(JSON.stringify(value)).toString("base64url");
+}
+
+// src/jwks.ts
+function buildJwks(keys) {
+  const exported = keys.publicKey.export({ format: "jwk" });
+  if (typeof exported !== "object" || exported === null || exported.kty !== "RSA") {
+    throw new Error("Chave p\xFAblica n\xE3o \xE9 RSA \u2014 JWKS s\xF3 suporta RS256 no sandbox");
+  }
+  if (typeof exported.n !== "string" || typeof exported.e !== "string") {
+    throw new Error("Chave p\xFAblica RSA exportada est\xE1 incompleta (n/e ausentes)");
+  }
+  return {
+    keys: [
+      {
+        alg: "RS256",
+        e: exported.e,
+        kid: keys.keyId,
+        kty: "RSA",
+        n: exported.n,
+        use: "sig"
+      }
+    ]
+  };
+}
+
+// src/validation/helpers.ts
+function issue(severity, code, diagnostics, path) {
+  return { code, diagnostics, expression: [path], severity };
+}
+function requireField(value, label, path) {
+  if (value === void 0 || value === null) {
+    return [issue("error", "required", `${label} \xE9 obrigat\xF3rio`, path)];
+  }
+  return [];
+}
+function requireMinCardinality(value, min, label, path) {
+  if (!Array.isArray(value) || value.length < min) {
+    return [
+      issue(
+        "error",
+        "required",
+        `${label} requer pelo menos ${min} elemento(s); recebido ${Array.isArray(value) ? value.length : 0}`,
+        path
+      )
+    ];
+  }
+  return [];
+}
+function requireOneOf(actual, allowed, label, path) {
+  if (typeof actual !== "string" || !allowed.includes(actual)) {
+    return [
+      issue(
+        "error",
+        "invalid",
+        `${label} deve ser um de [${allowed.join(", ")}]; recebido "${String(actual)}"`,
+        path
+      )
+    ];
+  }
+  return [];
+}
+function get(obj, key) {
+  if (obj && typeof obj === "object") {
+    return obj[key];
+  }
+  return void 0;
+}
+
+// src/validation/profiles.ts
+var NS_CPF = "http://rnds.saude.gov.br/fhir/r4/NamingSystem/cpf";
+var NS_CNS = "http://rnds.saude.gov.br/fhir/r4/NamingSystem/cns";
+var SYS_LOINC = "http://loinc.org";
+var SYS_UCUM = "http://unitsofmeasure.org";
+var SYS_OBS_CATEGORY = "http://terminology.hl7.org/CodeSystem/observation-category";
+var SYS_V2_0074 = "http://terminology.hl7.org/CodeSystem/v2-0074";
+var PATIENT_GENDERS = ["male", "female", "other", "unknown"];
+var LAB_OBS_STATUS = ["final", "amended", "corrected"];
+var DIAG_REPORT_STATUS = ["final", "amended", "corrected"];
+function validateBRPatient(resource, path) {
+  const issues = [];
+  const identifiers = get(resource, "identifier");
+  issues.push(...requireMinCardinality(identifiers, 1, "Patient.identifier", `${path}.identifier`));
+  if (Array.isArray(identifiers)) {
+    const hasBrazilianId = identifiers.some((id) => {
+      const sys = get(id, "system");
+      return sys === NS_CPF || sys === NS_CNS;
+    });
+    if (!hasBrazilianId) {
+      issues.push(
+        issue(
+          "error",
+          "invariant",
+          "Patient deve ter pelo menos um identificador CPF ou CNS (br-patient-identifier)",
+          `${path}.identifier`
+        )
+      );
+    }
+  }
+  const names = get(resource, "name");
+  issues.push(...requireMinCardinality(names, 1, "Patient.name", `${path}.name`));
+  issues.push(
+    ...requireField(get(resource, "birthDate"), "Patient.birthDate", `${path}.birthDate`)
+  );
+  const gender = get(resource, "gender");
+  issues.push(...requireField(gender, "Patient.gender", `${path}.gender`));
+  if (gender !== void 0) {
+    issues.push(...requireOneOf(gender, PATIENT_GENDERS, "Patient.gender", `${path}.gender`));
+  }
+  return issues;
+}
+function validateBRLabObservation(resource, path) {
+  const issues = [];
+  const status = get(resource, "status");
+  issues.push(...requireField(status, "Observation.status", `${path}.status`));
+  if (status !== void 0) {
+    issues.push(...requireOneOf(status, LAB_OBS_STATUS, "Observation.status", `${path}.status`));
+  }
+  const categories = get(resource, "category");
+  issues.push(...requireMinCardinality(categories, 1, "Observation.category", `${path}.category`));
+  if (Array.isArray(categories)) {
+    const hasLab = categories.some((cat) => {
+      const codings = get(cat, "coding");
+      return Array.isArray(codings) && codings.some(
+        (c) => get(c, "system") === SYS_OBS_CATEGORY && get(c, "code") === "laboratory"
+      );
+    });
+    if (!hasLab) {
+      issues.push(
+        issue(
+          "error",
+          "invalid",
+          "Observation.category deve incluir { system: observation-category, code: laboratory }",
+          `${path}.category`
+        )
+      );
+    }
+  }
+  const code = get(resource, "code");
+  issues.push(...requireField(code, "Observation.code", `${path}.code`));
+  if (code) {
+    const codings = get(code, "coding");
+    const hasLoinc = Array.isArray(codings) && codings.some((c) => get(c, "system") === SYS_LOINC);
+    if (!hasLoinc) {
+      issues.push(
+        issue(
+          "error",
+          "required",
+          "Observation.code.coding deve incluir um coding com system http://loinc.org",
+          `${path}.code.coding`
+        )
+      );
+    }
+  }
+  const value = get(resource, "valueQuantity");
+  issues.push(...requireField(value, "Observation.valueQuantity", `${path}.valueQuantity`));
+  if (value) {
+    issues.push(
+      ...requireField(get(value, "value"), "valueQuantity.value", `${path}.valueQuantity.value`)
+    );
+    issues.push(
+      ...requireField(get(value, "unit"), "valueQuantity.unit", `${path}.valueQuantity.unit`)
+    );
+    issues.push(
+      ...requireField(get(value, "code"), "valueQuantity.code", `${path}.valueQuantity.code`)
+    );
+    const sys = get(value, "system");
+    if (sys === void 0) {
+      issues.push(
+        issue(
+          "error",
+          "required",
+          "valueQuantity.system \xE9 obrigat\xF3rio",
+          `${path}.valueQuantity.system`
+        )
+      );
+    } else if (sys !== SYS_UCUM) {
+      issues.push(
+        issue(
+          "error",
+          "invalid",
+          `valueQuantity.system deve ser ${SYS_UCUM}; recebido "${String(sys)}"`,
+          `${path}.valueQuantity.system`
+        )
+      );
+    }
+  }
+  issues.push(...requireField(get(resource, "subject"), "Observation.subject", `${path}.subject`));
+  issues.push(
+    ...requireField(
+      get(resource, "effectiveDateTime"),
+      "Observation.effectiveDateTime",
+      `${path}.effectiveDateTime`
+    )
+  );
+  return issues;
+}
+function validateBRDiagnosticReport(resource, path) {
+  const issues = [];
+  const status = get(resource, "status");
+  issues.push(...requireField(status, "DiagnosticReport.status", `${path}.status`));
+  if (status !== void 0) {
+    issues.push(
+      ...requireOneOf(status, DIAG_REPORT_STATUS, "DiagnosticReport.status", `${path}.status`)
+    );
+  }
+  const categories = get(resource, "category");
+  issues.push(
+    ...requireMinCardinality(categories, 1, "DiagnosticReport.category", `${path}.category`)
+  );
+  if (Array.isArray(categories)) {
+    const hasLab = categories.some((cat) => {
+      const codings = get(cat, "coding");
+      return Array.isArray(codings) && codings.some(
+        (c) => get(c, "system") === SYS_V2_0074 && get(c, "code") === "LAB"
+      );
+    });
+    if (!hasLab) {
+      issues.push(
+        issue(
+          "error",
+          "invalid",
+          "DiagnosticReport.category deve incluir { system: v2-0074, code: LAB }",
+          `${path}.category`
+        )
+      );
+    }
+  }
+  issues.push(...requireField(get(resource, "code"), "DiagnosticReport.code", `${path}.code`));
+  issues.push(
+    ...requireField(get(resource, "subject"), "DiagnosticReport.subject", `${path}.subject`)
+  );
+  issues.push(
+    ...requireField(
+      get(resource, "effectiveDateTime"),
+      "DiagnosticReport.effectiveDateTime",
+      `${path}.effectiveDateTime`
+    )
+  );
+  const results = get(resource, "result");
+  issues.push(...requireMinCardinality(results, 1, "DiagnosticReport.result", `${path}.result`));
+  const performers = get(resource, "performer");
+  issues.push(
+    ...requireMinCardinality(performers, 1, "DiagnosticReport.performer", `${path}.performer`)
+  );
+  return issues;
+}
+
+// src/validation/index.ts
+var PROFILE_URI = {
+  diagnosticReport: "https://fhir-brasil.dev.br/ig/StructureDefinition/br-diagnostic-report",
+  labObservation: "https://fhir-brasil.dev.br/ig/StructureDefinition/br-lab-observation",
+  patient: "https://fhir-brasil.dev.br/ig/StructureDefinition/br-patient"
+};
+function validateBundle(bundle, basePath = "Bundle") {
+  const issues = [];
+  const b = bundle;
+  const entries = b?.entry ?? [];
+  entries.forEach((entry, index) => {
+    const resource = entry?.resource;
+    if (!resource) return;
+    const entryPath = `${basePath}.entry[${index}].resource`;
+    issues.push(...validateResource(resource, entryPath));
+  });
+  return { issues, valid: !issues.some((i) => i.severity === "error" || i.severity === "fatal") };
+}
+function validateResource(resource, path) {
+  const declaredProfiles = resource?.meta?.profile ?? [];
+  if (declaredProfiles.includes(PROFILE_URI.patient)) {
+    return validateBRPatient(resource, path);
+  }
+  if (declaredProfiles.includes(PROFILE_URI.labObservation)) {
+    return validateBRLabObservation(resource, path);
+  }
+  if (declaredProfiles.includes(PROFILE_URI.diagnosticReport)) {
+    return validateBRDiagnosticReport(resource, path);
+  }
+  switch (resource?.resourceType) {
+    case "Patient":
+      return validateBRPatient(resource, path);
+    case "Observation":
+      return looksLikeLabObservation(resource) ? validateBRLabObservation(resource, path) : [];
+    case "DiagnosticReport":
+      return validateBRDiagnosticReport(resource, path);
+    default:
+      return [];
+  }
+}
+var SYS_OBS_CATEGORY2 = "http://terminology.hl7.org/CodeSystem/observation-category";
+function looksLikeLabObservation(resource) {
+  const r = resource;
+  const cats = r?.category;
+  if (!Array.isArray(cats)) return false;
+  return cats.some(
+    (cat) => (cat?.coding ?? []).some((c) => c?.system === SYS_OBS_CATEGORY2 && c?.code === "laboratory")
+  );
+}
+
+// src/router.ts
+var FHIR_PREFIX = "/api/fhir/r4";
+var TOKEN_PATH = "/api/token";
+var JWKS_PATH = "/.well-known/jwks.json";
+var NS = {
+  cns: "http://rnds.saude.gov.br/fhir/r4/NamingSystem/cns",
+  cpf: "http://rnds.saude.gov.br/fhir/r4/NamingSystem/cpf"
+};
+function dispatch(ctx) {
+  if (ctx.method === "GET" && ctx.path === JWKS_PATH) {
+    return { body: buildJwks(ctx.keys), status: 200 };
+  }
+  if (ctx.method === "POST" && ctx.path === TOKEN_PATH) {
+    return handleToken(ctx);
+  }
+  if (!ctx.path.startsWith(FHIR_PREFIX)) {
+    return notFound(`Recurso n\xE3o encontrado: ${ctx.path}`);
+  }
+  if (ctx.strict) {
+    const authError = enforceFhirAuth(ctx);
+    if (authError) {
+      return authError;
+    }
+  }
+  const fhirPath = ctx.path.slice(FHIR_PREFIX.length);
+  if (ctx.method === "GET") {
+    return handleFhirGet(fhirPath, ctx);
+  }
+  if (ctx.method === "POST" && fhirPath === "/Bundle") {
+    return handleSubmitBundle(ctx);
+  }
+  return {
+    body: operationOutcome("error", "not-supported", `${ctx.method} ${ctx.path} n\xE3o suportado`),
+    status: 405
+  };
+}
+function handleToken(ctx) {
+  if (ctx.strict && !ctx.peerCert?.presented) {
+    return {
+      body: operationOutcome(
+        "error",
+        "security",
+        "Certificado mTLS \xE9 obrigat\xF3rio em /api/token quando o sandbox est\xE1 em modo --mtls"
+      ),
+      status: 401
+    };
+  }
+  const tokenPayload = issueToken(ctx.keys, {
+    identity: ctx.peerCert?.presented ? { cn: ctx.peerCert.cn, cnes: ctx.peerCert.cnes } : void 0
+  });
+  return { body: tokenPayload, status: 200 };
+}
+function enforceFhirAuth(ctx) {
+  const bearerHeader = ctx.headers["x-authorization-server"];
+  if (!bearerHeader) {
+    return {
+      body: operationOutcome(
+        "error",
+        "security",
+        "header X-Authorization-Server: Bearer <token> \xE9 obrigat\xF3rio"
+      ),
+      status: 401
+    };
+  }
+  const match = /^Bearer\s+(.+)$/i.exec(bearerHeader);
+  if (!match) {
+    return {
+      body: operationOutcome(
+        "error",
+        "security",
+        'X-Authorization-Server deve usar o esquema "Bearer <token>"'
+      ),
+      status: 401
+    };
+  }
+  const token = match[1].trim();
+  const verification = verifyToken(token, ctx.keys);
+  if (!verification.valid) {
+    return {
+      body: operationOutcome("error", "security", `Token inv\xE1lido (${verification.reason})`),
+      status: 401
+    };
+  }
+  const cnsHeader = ctx.headers["authorization"];
+  if (!cnsHeader) {
+    return {
+      body: operationOutcome(
+        "error",
+        "required",
+        "header Authorization: <CNS-do-profissional> \xE9 obrigat\xF3rio"
+      ),
+      status: 400
+    };
+  }
+  if (!/^\d{15}$/.test(cnsHeader.trim())) {
+    return {
+      body: operationOutcome("error", "invalid", "Authorization deve conter um CNS de 15 d\xEDgitos"),
+      status: 400
+    };
+  }
+  return null;
+}
+var SEARCHABLE_BY_PATIENT = /* @__PURE__ */ new Set([
+  "Observation",
+  "DiagnosticReport",
+  "Immunization",
+  "Condition",
+  "Encounter"
+]);
+function handleFhirGet(fhirPath, ctx) {
+  if (fhirPath === "/Patient") {
+    return handlePatientSearch(ctx);
+  }
+  const patientMatch = /^\/Patient\/([^/]+)$/.exec(fhirPath);
+  if (patientMatch) {
+    const cns = decodeURIComponent(patientMatch[1]);
+    const patient = ctx.store.findPatientByCns(cns);
+    return patient ? { body: patient, status: 200 } : notFound(`Paciente CNS ${cns} n\xE3o encontrado`);
+  }
+  const orgMatch = /^\/Organization\/([^/]+)$/.exec(fhirPath);
+  if (orgMatch) {
+    const cnes = decodeURIComponent(orgMatch[1]);
+    const org = ctx.store.findOrganizationByCnes(cnes);
+    return org ? { body: org, status: 200 } : notFound(`Organiza\xE7\xE3o CNES ${cnes} n\xE3o encontrada`);
+  }
+  const practMatch = /^\/Practitioner\/([^/]+)$/.exec(fhirPath);
+  if (practMatch) {
+    const cns = decodeURIComponent(practMatch[1]);
+    const pract = ctx.store.findPractitionerByCns(cns);
+    return pract ? { body: pract, status: 200 } : notFound(`Profissional CNS ${cns} n\xE3o encontrado`);
+  }
+  const searchMatch = /^\/([A-Z][A-Za-z]+)$/.exec(fhirPath);
+  if (searchMatch) {
+    const resourceType = searchMatch[1];
+    if (SEARCHABLE_BY_PATIENT.has(resourceType)) {
+      return handleResourceSearch(resourceType, ctx);
+    }
+  }
+  return notFound(`Recurso FHIR n\xE3o suportado: ${fhirPath}`);
+}
+function handleResourceSearch(resourceType, ctx) {
+  const ref = ctx.query.get("subject") ?? ctx.query.get("patient");
+  if (!ref) {
+    return {
+      body: operationOutcome(
+        "error",
+        "required",
+        `${resourceType} search exige ?subject=Patient/{cns} ou ?patient=Patient/{cns}`
+      ),
+      status: 400
+    };
+  }
+  const cns = ref.startsWith("Patient/") ? ref.slice("Patient/".length) : ref;
+  const matches = ctx.store.searchResourcesByPatient(resourceType, cns);
+  const entry = matches.map((resource) => ({ resource }));
+  return {
+    body: {
+      entry,
+      resourceType: "Bundle",
+      total: matches.length,
+      type: "searchset"
+    },
+    status: 200
+  };
+}
+function handlePatientSearch(ctx) {
+  const identifier = ctx.query.get("identifier");
+  if (!identifier) {
+    return {
+      body: operationOutcome("error", "required", "par\xE2metro identifier \xE9 obrigat\xF3rio em /Patient"),
+      status: 400
+    };
+  }
+  const [system, value] = identifier.split("|");
+  if (!system || !value) {
+    return {
+      body: operationOutcome("error", "invalid", "identifier deve ser no formato system|value"),
+      status: 400
+    };
+  }
+  let patient = void 0;
+  if (system === NS.cpf) {
+    patient = ctx.store.findPatientByCpf(value);
+  } else if (system === NS.cns) {
+    patient = ctx.store.findPatientByCns(value);
+  } else {
+    return notFound(`NamingSystem n\xE3o suportado: ${system}`);
+  }
+  return patient ? { body: patient, status: 200 } : notFound(`Paciente ${system}|${value} n\xE3o encontrado`);
+}
+function handleSubmitBundle(ctx) {
+  if (typeof ctx.body === "symbol") {
+    return {
+      body: operationOutcome("error", "structure", "corpo da requisi\xE7\xE3o n\xE3o \xE9 JSON v\xE1lido"),
+      status: 400
+    };
+  }
+  const bundle = ctx.body;
+  if (!bundle || typeof bundle !== "object" || bundle.resourceType !== "Bundle") {
+    return {
+      body: operationOutcome("error", "structure", "corpo da requisi\xE7\xE3o n\xE3o \xE9 um Bundle FHIR"),
+      status: 400
+    };
+  }
+  if (bundle.type !== "transaction" && bundle.type !== "batch") {
+    return {
+      body: operationOutcome(
+        "error",
+        "invalid",
+        `Bundle.type "${String(bundle.type)}" n\xE3o suportado \u2014 use transaction ou batch`
+      ),
+      status: 400
+    };
+  }
+  if (ctx.validateProfiles) {
+    const result = validateBundle(bundle);
+    if (!result.valid) {
+      return {
+        body: {
+          issue: result.issues.map((i) => ({
+            code: i.code,
+            diagnostics: i.diagnostics,
+            expression: i.expression,
+            severity: i.severity
+          })),
+          resourceType: "OperationOutcome"
+        },
+        status: 422
+      };
+    }
+  }
+  ctx.store.recordBundle(bundle);
+  const responseEntries = (bundle.entry ?? []).map(() => ({
+    response: {
+      location: `Resource/sandbox-${ctx.store.nextResourceId()}`,
+      status: "201 Created"
+    }
+  }));
+  const response = {
+    entry: responseEntries,
+    resourceType: "Bundle",
+    type: "transaction-response"
+  };
+  return { body: response, status: 200 };
+}
+function notFound(diagnostics) {
+  return {
+    body: operationOutcome("error", "not-found", diagnostics),
+    status: 404
+  };
+}
+function operationOutcome(severity, code, diagnostics) {
+  return {
+    issue: [{ code, diagnostics, severity }],
+    resourceType: "OperationOutcome"
+  };
+}
+
+// src/store.ts
+var NS2 = {
+  cnes: "http://rnds.saude.gov.br/fhir/r4/NamingSystem/cnes",
+  cns: "http://rnds.saude.gov.br/fhir/r4/NamingSystem/cns",
+  cpf: "http://rnds.saude.gov.br/fhir/r4/NamingSystem/cpf"
+};
+var SandboxStore = class {
+  patientsByCpf = /* @__PURE__ */ new Map();
+  patientsByCns = /* @__PURE__ */ new Map();
+  organizationsByCnes = /* @__PURE__ */ new Map();
+  practitionersByCns = /* @__PURE__ */ new Map();
+  submittedBundles = [];
+  resourceSeq = 0;
+  load(scenario) {
+    this.reset();
+    for (const patient of scenario.data.patients) {
+      this.indexPatient(patient);
+    }
+    for (const org of scenario.data.organizations) {
+      this.indexOrganization(org);
+    }
+    for (const pract of scenario.data.practitioners) {
+      this.indexPractitioner(pract);
+    }
+    for (const bundle of scenario.data.submittedBundles ?? []) {
+      this.submittedBundles.push(bundle);
+    }
+  }
+  reset() {
+    this.patientsByCpf.clear();
+    this.patientsByCns.clear();
+    this.organizationsByCnes.clear();
+    this.practitionersByCns.clear();
+    this.submittedBundles = [];
+    this.resourceSeq = 0;
+  }
+  /** Próximo número de sequência global para gerar `Resource/sandbox-N`. */
+  nextResourceId() {
+    this.resourceSeq += 1;
+    return this.resourceSeq;
+  }
+  findPatientByCpf(cpf) {
+    return this.patientsByCpf.get(stripFormatting(cpf));
+  }
+  findPatientByCns(cns) {
+    return this.patientsByCns.get(stripFormatting(cns));
+  }
+  findOrganizationByCnes(cnes) {
+    return this.organizationsByCnes.get(stripFormatting(cnes));
+  }
+  findPractitionerByCns(cns) {
+    return this.practitionersByCns.get(stripFormatting(cns));
+  }
+  recordBundle(bundle) {
+    this.submittedBundles.push(bundle);
+  }
+  getSubmittedBundles() {
+    return this.submittedBundles;
+  }
+  /**
+   * Lista todos os recursos de um tipo presentes nos bundles submetidos
+   * (incluindo os pré-carregados pelo cenário). Usado pelos endpoints
+   * de busca FHIR (`GET /Observation?subject=...`, etc.).
+   */
+  listResourcesByType(resourceType) {
+    const out = [];
+    for (const bundle of this.submittedBundles) {
+      for (const entry of bundle.entry ?? []) {
+        if (entry.resource && entry.resource.resourceType === resourceType) {
+          out.push(entry.resource);
+        }
+      }
+    }
+    return out;
+  }
+  /**
+   * Filtra recursos cujo `subject.reference` ou `patient.reference`
+   * aponta para o paciente indicado (aceita tanto `Patient/{cns}` quanto
+   * apenas o CNS sem prefixo).
+   */
+  searchResourcesByPatient(resourceType, patientCns) {
+    const cns = stripFormatting(patientCns);
+    return this.listResourcesByType(resourceType).filter((resource) => {
+      const subjectRef = resource.subject?.reference;
+      const patientRef = resource.patient?.reference;
+      return subjectRef && referenceMatchesCns(subjectRef, cns) || patientRef && referenceMatchesCns(patientRef, cns);
+    });
+  }
+  indexPatient(patient) {
+    const cns = patient.id ?? findIdentifier(patient.identifier, NS2.cns);
+    if (cns) {
+      this.patientsByCns.set(stripFormatting(cns), patient);
+    }
+    const cpf = findIdentifier(patient.identifier, NS2.cpf);
+    if (cpf) {
+      this.patientsByCpf.set(stripFormatting(cpf), patient);
+    }
+  }
+  indexOrganization(org) {
+    const cnes = org.id ?? findIdentifier(org.identifier, NS2.cnes);
+    if (cnes) {
+      this.organizationsByCnes.set(stripFormatting(cnes), org);
+    }
+  }
+  indexPractitioner(pract) {
+    const cns = pract.id ?? findIdentifier(pract.identifier, NS2.cns);
+    if (cns) {
+      this.practitionersByCns.set(stripFormatting(cns), pract);
+    }
+  }
+};
+function findIdentifier(ids, system) {
+  return ids?.find((id) => id.system === system)?.value;
+}
+function stripFormatting(value) {
+  return value.replace(/[^0-9A-Za-z]/g, "");
+}
+function referenceMatchesCns(ref, cns) {
+  const lastSegment = ref.includes("/") ? ref.slice(ref.lastIndexOf("/") + 1) : ref;
+  return lastSegment === cns;
+}
+
+// src/server.ts
+function createSandboxServer(options = {}) {
+  const log = options.log ?? ((msg) => console.log(`[rnds-sandbox] ${msg}`));
+  const useMtls = options.mtls === true;
+  const strict = options.strict ?? useMtls;
+  const validateProfiles = options.validateSubmissions ?? true;
+  const port = options.port ?? (useMtls ? 8443 : 8080);
+  const host = options.host ?? "127.0.0.1";
+  const store = new SandboxStore();
+  store.load(resolveScenario(options.scenario));
+  const signingKeys = resolveSigningKeys({
+    keyId: options.jwtKeyId,
+    privateKey: options.jwtPrivateKey,
+    publicKey: options.jwtPublicKey
+  });
+  const handler = (req, res) => {
+    handleRequest(req, res, {
+      keys: signingKeys,
+      log,
+      store,
+      strict,
+      useMtls,
+      validateProfiles
+    }).catch((err) => {
+      log(`erro inesperado: ${err instanceof Error ? err.message : String(err)}`);
+      if (res.headersSent) {
+        if (!res.writableEnded) res.end();
+        return;
+      }
+      res.writeHead(500, { "Content-Type": "application/fhir+json; charset=utf-8" });
+      res.end(
+        JSON.stringify({
+          issue: [{ code: "exception", diagnostics: String(err), severity: "fatal" }],
+          resourceType: "OperationOutcome"
+        })
+      );
+    });
+  };
+  const server = useMtls ? import_node_https.default.createServer(buildTlsOptions(options), handler) : import_node_http.default.createServer(handler);
+  return {
+    server,
+    signingKeys,
+    start: () => new Promise((resolve, reject) => {
+      const onError = (err) => {
+        server.off("error", onError);
+        reject(err);
+      };
+      server.once("error", onError);
+      server.listen(port, host, () => {
+        server.off("error", onError);
+        const address = server.address();
+        const actualPort = typeof address === "object" && address ? address.port : port;
+        log(
+          `${useMtls ? "HTTPS+mTLS" : "HTTP"} ouvindo em ${host}:${actualPort} (cen\xE1rio: ${options.scenario ?? "paciente-com-exames"}, strict=${strict}, validate=${validateProfiles}, kid=${signingKeys.keyId})`
+        );
+        resolve({ host, port: actualPort });
+      });
+    }),
+    stop: () => new Promise((resolve, reject) => {
+      server.closeAllConnections?.();
+      server.close((err) => err ? reject(err) : resolve());
+    }),
+    store
+  };
+}
+async function handleRequest(req, res, ctx) {
+  const url = new URL(req.url ?? "/", "http://sandbox.local");
+  const body = await readBody(req);
+  const peerCert = ctx.useMtls ? extractPeerCert(req) : void 0;
+  const headers = lowercaseHeaders(req.headers);
+  const routeCtx = {
+    body,
+    headers,
+    keys: ctx.keys,
+    method: req.method ?? "GET",
+    path: url.pathname,
+    peerCert,
+    query: url.searchParams,
+    store: ctx.store,
+    strict: ctx.strict,
+    validateProfiles: ctx.validateProfiles
+  };
+  const response = dispatch(routeCtx);
+  ctx.log(`${routeCtx.method} ${routeCtx.path} \u2192 ${response.status}`);
+  res.writeHead(response.status, {
+    "Content-Type": "application/fhir+json; charset=utf-8"
+  });
+  res.end(JSON.stringify(response.body));
+}
+var INVALID_BODY = /* @__PURE__ */ Symbol.for("rnds-sandbox.invalidBody");
+async function readBody(req) {
+  if (req.method !== "POST" && req.method !== "PUT") {
+    return void 0;
+  }
+  const chunks = [];
+  for await (const chunk of req) {
+    chunks.push(chunk);
+  }
+  if (chunks.length === 0) {
+    return void 0;
+  }
+  const text = Buffer.concat(chunks).toString("utf-8");
+  if (!text) {
+    return void 0;
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    return INVALID_BODY;
+  }
+}
+function extractPeerCert(req) {
+  const socket = req.socket;
+  if (typeof socket.getPeerCertificate !== "function") {
+    return { presented: false };
+  }
+  const cert = socket.getPeerCertificate();
+  if (!cert || Object.keys(cert).length === 0) {
+    return { presented: false };
+  }
+  const cn = readCommonName(cert.subject);
+  return {
+    cn,
+    cnes: cn ? extractCnesFromCn(cn) : void 0,
+    presented: true
+  };
+}
+function readCommonName(subject) {
+  if (!subject || typeof subject !== "object") {
+    return void 0;
+  }
+  const cnValue = subject.CN;
+  if (typeof cnValue === "string") {
+    return cnValue;
+  }
+  return void 0;
+}
+function extractCnesFromCn(cn) {
+  const match = /\b(\d{7})\b/.exec(cn);
+  return match ? match[1] : void 0;
+}
+function lowercaseHeaders(headers) {
+  const out = {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (Array.isArray(value)) {
+      out[key.toLowerCase()] = value.join(", ");
+    } else {
+      out[key.toLowerCase()] = value;
+    }
+  }
+  return out;
+}
+function buildTlsOptions(options) {
+  const tlsOptions = {
+    rejectUnauthorized: false,
+    requestCert: true
+  };
+  if (options.serverPfx) {
+    tlsOptions.pfx = resolveBuffer(options.serverPfx);
+    if (options.serverPfxPassword) {
+      tlsOptions.passphrase = options.serverPfxPassword;
+    }
+  } else if (options.serverKey && options.serverCert) {
+    tlsOptions.key = resolveBuffer(options.serverKey);
+    tlsOptions.cert = resolveBuffer(options.serverCert);
+  } else {
+    throw new Error("mTLS requer --pfx + --pfx-password OU --server-key + --server-cert (PEM)");
+  }
+  return tlsOptions;
+}
+function resolveBuffer(value) {
+  if (typeof value !== "string") {
+    return value;
+  }
+  if (value.includes("-----BEGIN")) {
+    return Buffer.from(value);
+  }
+  return import_node_fs2.default.readFileSync(value);
+}
+
+// src/cli.ts
+var import_meta = {};
+var HELP = `rnds-sandbox \u2014 mock local da RNDS
+
+Uso:
+  rnds-sandbox start [op\xE7\xF5es]
+  rnds-sandbox scenarios
+  rnds-sandbox --help
+
+Op\xE7\xF5es de start:
+  --port <n>              Porta (padr\xE3o: 8080, ou 8443 se --mtls)
+  --host <h>              Host (padr\xE3o: 127.0.0.1)
+  --scenario <nome>       paciente-com-exames | internacao | vacina | vazio
+
+Modos de fidelidade RNDS:
+  --strict                Exige bearer token + header Authorization: <CNS> em /api/fhir/r4/*
+                          (impl\xEDcito quando --mtls est\xE1 ativo)
+  --mtls                  HTTPS + handshake mTLS (cliente apresenta cert).
+                          /api/token exige cert; FHIR API exige bearer.
+  --no-validate           Desabilita valida\xE7\xE3o contra perfis BR* do IG em POST /Bundle
+                          (default: valida\xE7\xE3o ON, retorna 422 OperationOutcome em falha)
+
+Cert do servidor (use uma forma OU outra):
+  --pfx <caminho>         PFX do servidor
+  --pfx-password <s>      Senha do PFX
+  --server-key <caminho>  PEM da chave privada do servidor
+  --server-cert <caminho> PEM do certificado do servidor
+
+Chaves de assinatura JWT (RS256):
+  --jwt-private-key <p>   PEM da chave privada (padr\xE3o: gera uma RSA-2048 ef\xEAmera)
+  --jwt-public-key <p>    PEM da chave p\xFAblica (opcional \u2014 derivada da privada)
+  --jwt-key-id <s>        kid no JWT/JWKS (padr\xE3o: rnds-sandbox-1)
+
+Exemplos:
+  rnds-sandbox start
+  rnds-sandbox start --strict --jwt-private-key ./jwt.pem
+  rnds-sandbox start --port 9000 --scenario internacao
+  rnds-sandbox start --mtls --pfx ./cert.pfx --pfx-password senha
+  rnds-sandbox start --mtls --server-key ./srv.key --server-cert ./srv.crt
+`;
+var STRING_ARGS = {
+  "--host": (o, v) => {
+    o.host = v;
+  },
+  "--jwt-key-id": (o, v) => {
+    o.jwtKeyId = v;
+  },
+  "--jwt-private-key": (o, v) => {
+    o.jwtPrivateKey = v;
+  },
+  "--jwt-public-key": (o, v) => {
+    o.jwtPublicKey = v;
+  },
+  "--pfx": (o, v) => {
+    o.serverPfx = v;
+  },
+  "--pfx-password": (o, v) => {
+    o.serverPfxPassword = v;
+  },
+  "--server-cert": (o, v) => {
+    o.serverCert = v;
+  },
+  "--server-key": (o, v) => {
+    o.serverKey = v;
+  }
+};
+function parseArgs(argv) {
+  const errors = [];
+  const options = {};
+  let command;
+  const args = [...argv];
+  while (args.length > 0) {
+    const token = args.shift();
+    if (token === "--help" || token === "-h") {
+      command = "help";
+      continue;
+    }
+    if (!command && (token === "start" || token === "scenarios" || token === "help")) {
+      command = token;
+      continue;
+    }
+    if (token === "--port") {
+      const value = args.shift();
+      const port = Number(value);
+      if (!value || Number.isNaN(port)) {
+        errors.push(`--port requer valor num\xE9rico, recebido: ${String(value)}`);
+      } else {
+        options.port = port;
+      }
+      continue;
+    }
+    if (token === "--scenario") {
+      const value = args.shift();
+      if (!value || !(value in SCENARIOS)) {
+        errors.push(
+          `--scenario inv\xE1lido. Dispon\xEDveis: ${Object.keys(SCENARIOS).join(", ")}. Recebido: ${String(value)}`
+        );
+      } else {
+        options.scenario = value;
+      }
+      continue;
+    }
+    if (token === "--mtls") {
+      options.mtls = true;
+      continue;
+    }
+    if (token === "--strict") {
+      options.strict = true;
+      continue;
+    }
+    if (token === "--no-validate") {
+      options.validateSubmissions = false;
+      continue;
+    }
+    const stringSetter = STRING_ARGS[token];
+    if (stringSetter) {
+      const value = args.shift();
+      if (!value) {
+        errors.push(`${token} requer valor`);
+      } else {
+        stringSetter(options, value);
+      }
+      continue;
+    }
+    errors.push(`argumento desconhecido: ${token}`);
+  }
+  return { command, errors, options };
+}
+async function main(argv = process.argv.slice(2)) {
+  const parsed = parseArgs(argv);
+  if (parsed.errors.length > 0) {
+    for (const err of parsed.errors) {
+      process.stderr.write(`erro: ${err}
+`);
+    }
+    process.stderr.write(`
+${HELP}`);
+    return 1;
+  }
+  if (!parsed.command || parsed.command === "help") {
+    process.stdout.write(HELP);
+    return 0;
+  }
+  if (parsed.command === "scenarios") {
+    process.stdout.write("Cen\xE1rios dispon\xEDveis:\n\n");
+    for (const scenario of Object.values(SCENARIOS)) {
+      process.stdout.write(`  ${scenario.name}
+    ${scenario.description}
+
+`);
+    }
+    return 0;
+  }
+  if (parsed.options.mtls) {
+    const hasPfx = parsed.options.serverPfx;
+    const hasKeyAndCert = parsed.options.serverKey && parsed.options.serverCert;
+    if (!hasPfx && !hasKeyAndCert) {
+      process.stderr.write(
+        "erro: --mtls requer --pfx + --pfx-password OU --server-key + --server-cert\n"
+      );
+      return 1;
+    }
+  }
+  const sandbox = createSandboxServer(parsed.options);
+  await sandbox.start();
+  const shutdown = async (signal) => {
+    process.stdout.write(`
+[rnds-sandbox] recebido ${signal}, encerrando...
+`);
+    await sandbox.stop();
+    process.exit(0);
+  };
+  process.on("SIGINT", () => void shutdown("SIGINT"));
+  process.on("SIGTERM", () => void shutdown("SIGTERM"));
+  return 0;
+}
+function isCliEntryPoint() {
+  const argv1 = process.argv[1];
+  if (typeof argv1 !== "string" || argv1.length === 0) return false;
+  try {
+    const here = import_node_fs3.default.realpathSync((0, import_node_url.fileURLToPath)(import_meta.url));
+    const invoked = import_node_fs3.default.realpathSync(argv1);
+    return here === invoked;
+  } catch {
+    return false;
+  }
+}
+if (isCliEntryPoint()) {
+  main().catch((err) => {
+    process.stderr.write(`erro fatal: ${err instanceof Error ? err.message : String(err)}
+`);
+    process.exit(1);
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  main,
+  parseArgs
+});
+//# sourceMappingURL=cli.cjs.map