@zenixsolutions/streamlined-mcp 0.0.0-stage → 0.1.1

package/dist/shape.js

@@ -0,0 +1,225 @@
+import * as z from "zod/v4";
+/** Notes come back from the API as HTML written by staff, clients and providers; treat them as untrusted text. */
+export const NOTE_TEXT_LIMIT = 600;
+export const NOTES_PER_ORDER = 4;
+export const CONTACTS_PER_ORDER = 5;
+/** Longest upstream string we process at all; everything we output is far shorter. */
+export const MAX_INPUT_CHARS = 20_000;
+const ENTITIES = {
+    amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", nbsp: " ", "#39": "'",
+    rsquo: "’", lsquo: "‘", rdquo: "”", ldquo: "“", sbquo: "‚", bdquo: "„",
+    ndash: "–", mdash: "—", hellip: "…", bull: "•", middot: "·", deg: "°",
+    copy: "©", reg: "®", trade: "™", sect: "§", para: "¶", times: "×", divide: "÷",
+    frac12: "½", frac14: "¼", frac34: "¾", plusmn: "±", cent: "¢", pound: "£", euro: "€",
+    aacute: "á", eacute: "é", iacute: "í", oacute: "ó", uacute: "ú", ntilde: "ñ", uuml: "ü",
+    Aacute: "Á", Eacute: "É", Iacute: "Í", Oacute: "Ó", Uacute: "Ú", Ntilde: "Ñ", Uuml: "Ü"
+};
+function decodeEntities(text) {
+    return text.replace(/&(#x[0-9a-f]{1,6}|#\d{1,7}|[a-z][a-z0-9]{1,7});/gi, (match, code) => {
+        if (code in ENTITIES)
+            return ENTITIES[code];
+        const lower = code.toLowerCase();
+        if (lower in ENTITIES && !/^[a-z]acute$|^[a-z]tilde$|^[a-z]uml$/i.test(code))
+            return ENTITIES[lower];
+        let cp = NaN;
+        if (lower.startsWith("#x"))
+            cp = parseInt(lower.slice(2), 16);
+        else if (lower.startsWith("#"))
+            cp = parseInt(lower.slice(1), 10);
+        if (!Number.isFinite(cp) || cp <= 0 || cp > 0x10ffff || (cp >= 0xd800 && cp <= 0xdfff))
+            return match;
+        return String.fromCodePoint(cp);
+    });
+}
+/**
+ * Removes tags in one linear pass (no backtracking regexes on untrusted input).
+ * <script>/<style> blocks are dropped with their content; an unclosed one drops the rest.
+ * A '<' with no later '>' is kept as text.
+ */
+function stripTags(input) {
+    const s = input.length > MAX_INPUT_CHARS ? input.slice(0, MAX_INPUT_CHARS) : input;
+    let out = "";
+    let i = 0;
+    while (i < s.length) {
+        const lt = s.indexOf("<", i);
+        if (lt === -1) {
+            out += s.slice(i);
+            break;
+        }
+        out += s.slice(i, lt);
+        const gt = s.indexOf(">", lt + 1);
+        if (gt === -1) {
+            out += s.slice(lt); // no tag can close after this point
+            break;
+        }
+        out += " ";
+        const block = /^(script|style)(?=[\s>/])/i.exec(s.slice(lt + 1, Math.min(gt + 1, lt + 8)));
+        if (block) {
+            const close = s.toLowerCase().indexOf(`</${block[1].toLowerCase()}`, gt + 1);
+            if (close === -1) {
+                i = gt + 1; // unclosed block: drop only the opening tag, keep the rest as plain text
+                continue;
+            }
+            const closeEnd = s.indexOf(">", close);
+            i = closeEnd === -1 ? s.length : closeEnd + 1;
+        }
+        else {
+            i = gt + 1;
+        }
+    }
+    return out;
+}
+// Format characters (zero-width, bidi overrides/isolates, tag characters U+E0000-E007F, soft hyphen) and
+// variation selectors are invisible to people but visible to models: remove them. Controls/separators become spaces.
+const INVISIBLE = /(?!\u200d)[\p{Cf}\uFE00-\uFE0F\u{E0100}-\u{E01EF}]/gu; // keeps U+200D for emoji sequences
+const CONTROL = /[\p{Cc}\p{Zl}\p{Zp}]+/gu;
+/** Untrusted HTML → one line of plain text: tags removed, entities decoded, invisible and control characters removed. */
+export function htmlToText(html) {
+    return decodeEntities(stripTags(html))
+        .normalize("NFKC")
+        .replace(INVISIBLE, "")
+        .replace(CONTROL, " ")
+        .replace(/\s+/g, " ")
+        .trim();
+}
+/** Caps text at max code points (never splits a surrogate pair); the ellipsis counts toward max. */
+export function capText(text, max) {
+    if (text.length <= max)
+        return text;
+    const cps = Array.from(text);
+    if (cps.length <= max)
+        return text;
+    return `${cps.slice(0, max - 1).join("")}…`;
+}
+// ---- Upstream schemas (lenient: unknown fields are ignored, missing optional fields become null) ----
+const nstr = z.string().nullish();
+const idLike = z.union([z.number(), z.string()]);
+const ProviderSchema = z.object({ id: z.number().nullish(), name: nstr, phone: nstr, fax: nstr, email: nstr }).nullish();
+const ContactSchema = z.object({
+    id: z.number().nullish(),
+    order_type_id: idLike.nullish(),
+    first: nstr,
+    last: nstr,
+    phone: nstr,
+    fax: nstr,
+    email: nstr
+});
+const NoteSchema = z.object({
+    id: z.number(),
+    notes: nstr,
+    admin_only: z.union([z.boolean(), z.number(), z.string()]).nullish(),
+    created_at: nstr
+});
+export const OrderSchema = z.object({
+    id: z.number(),
+    order_type: idLike.nullish(),
+    created_at: nstr,
+    patient: z.object({ reference_num: nstr }).nullish(),
+    provider: ProviderSchema,
+    provider_contacts: z.array(ContactSchema).nullish(),
+    order_notes: z.array(NoteSchema).nullish()
+});
+export const CURSOR_PATTERN = /^[A-Za-z0-9_\-=]{1,2000}$/;
+export const OrderPageSchema = z.object({
+    total: z.number(),
+    next_cursor: z.string().regex(CURSOR_PATTERN).nullable(),
+    data: z.array(OrderSchema)
+});
+export const OrderTypesSchema = z.array(z.object({ id: z.number(), name: z.string() }));
+export function clean(value, max = 200) {
+    if (value == null)
+        return undefined;
+    const text = capText(htmlToText(value), max);
+    return text || undefined;
+}
+/** Identifiers must round-trip exactly (reference_num is sent back on writes): only invisible/control characters are removed. */
+function cleanId(value) {
+    if (value == null)
+        return null;
+    const text = value.slice(0, 200).replace(INVISIBLE, "").replace(CONTROL, "").trim();
+    return text ? capText(text, 100) : null;
+}
+/** Positive integer ID from a number or digit string; anything else (null, "", "abc", 1.5) is null. */
+export function toId(v) {
+    if (typeof v === "number")
+        return Number.isSafeInteger(v) && v > 0 ? v : null;
+    if (typeof v === "string" && /^\d{1,15}$/.test(v.trim())) {
+        const n = Number(v.trim());
+        return n > 0 ? n : null;
+    }
+    return null;
+}
+function compact(obj) {
+    return Object.fromEntries(Object.entries(obj).filter(([, v]) => v !== undefined));
+}
+function truthyFlag(v) {
+    return v === true || v === 1 || v === "1" || v === "true";
+}
+function time(value) {
+    const t = value ? Date.parse(value) : NaN;
+    return Number.isNaN(t) ? -Infinity : t;
+}
+/** Calendar date (UTC) of an upstream timestamp, or undefined. */
+function day(value) {
+    const t = time(value);
+    return Number.isFinite(t) ? new Date(t).toISOString().slice(0, 10) : undefined;
+}
+export function shapeOrder(raw, typeNames) {
+    const typeId = toId(raw.order_type);
+    const recordType = typeId == null ? null : typeNames.get(typeId) ?? `type ${typeId}`;
+    const provider = compact({
+        name: clean(raw.provider?.name),
+        phone: clean(raw.provider?.phone, 50),
+        fax: clean(raw.provider?.fax, 50),
+        email: clean(raw.provider?.email, 254)
+    });
+    const allContacts = (raw.provider_contacts ?? [])
+        .filter((c) => typeId != null && toId(c.order_type_id) === typeId)
+        .map((c) => compact({
+        name: clean([c.first, c.last].filter(Boolean).join(" ")),
+        phone: clean(c.phone, 50),
+        fax: clean(c.fax, 50),
+        email: clean(c.email, 254)
+    }))
+        .filter((c) => c.phone || c.fax || c.email);
+    const contacts = allContacts.slice(0, CONTACTS_PER_ORDER);
+    // Newest first, and never more than NOTES_PER_ORDER, whatever the API returns
+    const notes = [...(raw.order_notes ?? [])]
+        .sort((a, b) => time(b.created_at) - time(a.created_at) || b.id - a.id)
+        .slice(0, NOTES_PER_ORDER)
+        .map((n) => compact({
+        id: n.id,
+        date: day(n.created_at),
+        internal: truthyFlag(n.admin_only),
+        text: capText(htmlToText(n.notes ?? ""), NOTE_TEXT_LIMIT)
+    }));
+    const out = {
+        order_id: raw.id,
+        reference_num: cleanId(raw.patient?.reference_num),
+        record_type: recordType,
+        created: day(raw.created_at) ?? null,
+        provider,
+        contacts,
+        contacts_source: contacts.length ? "record_type" : "provider_fallback",
+        notes
+    };
+    if (allContacts.length > contacts.length)
+        out.contacts_omitted = allContacts.length - contacts.length;
+    return out;
+}
+/**
+ * Plain text for a new note. The app stores notes as HTML, so a '<' that could start a tag
+ * (followed by a letter, '/', '!' or '?') is replaced with '‹'. Other '<' and '>' are kept, so
+ * "BP < 120" survives. Invisible and control characters are removed; line breaks are kept.
+ */
+export function sanitizeNoteInput(text) {
+    return text
+        .replace(/\r\n?/g, "\n")
+        .replace(INVISIBLE, "")
+        .replace(/(?![\t\n])[\p{Cc}\p{Zl}\p{Zp}]/gu, "")
+        .replace(/\n{3,}/g, "\n\n")
+        .trim()
+        .replace(/<(?=[A-Za-z/!?]|$)/g, "‹")
+        // "&lt;img&gt;" or "&#60;" would become a tag if anything downstream decodes entities: break them up
+        .replace(/&(?=#?[A-Za-z0-9]{1,32};)/g, "& ");
+}