babelfhir-ts 1.4.2 → 1.4.3

package/README.md

@@ -234,6 +234,7 @@ Options:
   --schema <format>        Generate schema files alongside outputs (supported: zod)
   --dicomweb               Generate DICOMweb helpers typed to ImagingStudy profiles in the IG
   --recursive              (update only) Recursively search subdirectories for lib/ folders
+  --force                  (update only) Force regeneration even if version and flags haven't changed
   --outDir <dir>           Output directory (alias for second positional argument)
   --fhir-version <ver>     FHIR version to target: r4, r4b, or r5 (auto-detected from package if omitted)
   --package <pkg[@version]>  Download FHIR package from registry and process it (latest if no version)

package/out/src/cli/installCommand.js

@@ -105,9 +105,10 @@ function npmInstall(packagePath) {
         }
         const { args } = result;
         console.log(`Installing package with ${pmName}...`);
+        // shell required on Windows for .cmd wrappers; disabled on Unix to prevent injection
         const child = spawn(pm.cmd, args, {
             stdio: 'inherit',
-            shell: true
+            shell: process.platform === 'win32'
         });
         child.on('exit', (code) => {
             if (code === 0) {

package/out/src/cli/updateCommand.js

@@ -13,14 +13,14 @@ import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import crypto from 'crypto';
-import { generateIntoPackageDirect, resetFetchFailureTracking } from '../generator/index.js';
+import { generateIntoPackageDirect, resetFetchFailureTracking, GENERATOR_VERSION } from '../generator/index.js';
 import { getFhirPackagesCacheDir } from '../generator/core/cacheConfig.js';
 import { resetDiagnostics, buildQualityReport, formatReportSummary } from '../generator/core/sdDiagnostics.js';
 import { detectPackageManager } from './installCommand.js';
 import { spawn } from 'child_process';
 // ── Public entry point ──────────────────────────────────────────────────────
 export async function handleUpdateCommand(opts) {
-    const { packageFilter, recursive, generationFlags, registry, downloadPackage, confirm } = opts;
+    const { packageFilter, recursive, force, generationFlags, registry, downloadPackage, confirm } = opts;
     const startDir = process.cwd();
     // 1. Discover tgz files
     const libDirs = discoverLibDirs(startDir, recursive ?? false);
@@ -55,11 +55,17 @@ export async function handleUpdateCommand(opts) {
     for (const t of targets)
         console.log(`  ${t.igName}@${t.igVersion}  →  ${path.relative(startDir, t.tgzPath)}`);
     console.log('');
-    // 4. Regenerate each package
+    // 4. Regenerate each package (skip if already up to date)
     let updated = 0;
+    let skipped = 0;
     let failed = 0;
     const updatedPackages = [];
     for (const target of targets) {
+        if (!force && isUpToDate(target, generationFlags)) {
+            skipped++;
+            console.log(`✓ ${target.igName}@${target.igVersion} — already up to date (babelfhir-ts ${target.generatorVersion})`);
+            continue;
+        }
         try {
             await regeneratePackage(target, generationFlags, registry, downloadPackage);
             updatedPackages.push({ generatedName: target.generatedName, tgzPath: target.tgzPath });
@@ -70,25 +76,34 @@ export async function handleUpdateCommand(opts) {
             console.error(`✗ Failed to update ${target.igName}@${target.igVersion}: ${err.message}`);
         }
     }
-    // 5. Patch bun.lock integrity hashes for regenerated packages (avoids full lockfile delete)
+    // 5. Remove stale node_modules/<pkg> so bun re-extracts from the updated tgz
     if (updatedPackages.length > 0) {
-        patchBunLockIntegrity(updatedPackages);
+        removeStaleNodeModules(updatedPackages.map((p) => p.generatedName));
     }
-    // 5b. Remove stale node_modules/<pkg> so bun re-extracts from the updated tgz
+    // 6. Patch bun.lock integrity hashes BEFORE install so bun sees matching hashes
     if (updatedPackages.length > 0) {
-        removeStaleNodeModules(updatedPackages.map((p) => p.generatedName));
+        patchBunLockIntegrity(updatedPackages);
     }
-    // 6. Single npm install at the end
+    // 7. Single npm install at the end
     if (updated > 0) {
         console.log('\nReinstalling dependencies...');
         await runInstall();
     }
-    // 7. Summary
+    // 8. Re-patch bun.lock integrity after install (bun may recompute hashes)
+    if (updatedPackages.length > 0) {
+        patchBunLockIntegrity(updatedPackages);
+    }
+    // 9. Summary
     console.log('');
     if (updated > 0)
         console.log(`✓ Updated ${updated} package${updated === 1 ? '' : 's'}`);
+    if (skipped > 0)
+        console.log(`✓ ${skipped} package${skipped === 1 ? '' : 's'} already up to date`);
     if (failed > 0)
         console.error(`✗ ${failed} package${failed === 1 ? '' : 's'} failed`);
+    if (skipped > 0 && updated === 0 && failed === 0) {
+        console.log('  Use --force to regenerate anyway.');
+    }
     return {};
 }
 // ── Install redirect prompt ─────────────────────────────────────────────────
@@ -200,10 +215,15 @@ async function readTgzMetadata(tgzPath, listFn) {
             igVersion,
             ...(pkg?.fhir?.txServer && { txServer: pkg.fhir.txServer }),
             ...(pkg?.fhir?.displayLanguage && { displayLanguage: pkg.fhir.displayLanguage }),
+            ...(pkg?.fhir?.fhirVersion && { fhirVersion: pkg.fhir.fhirVersion }),
             ...(pkg?.fhir?.dicomweb && { dicomweb: true }),
             ...(pkg?.fhir?.noClient && { noClient: true }),
             ...(pkg?.fhir?.noClasses && { noClasses: true }),
             ...(pkg?.fhir?.schema && { schema: pkg.fhir.schema }),
+            // Extract generator version from devDependencies (e.g. "^1.4.2" → "1.4.2")
+            ...(pkg?.devDependencies?.['babelfhir-ts'] && {
+                generatorVersion: pkg.devDependencies['babelfhir-ts'].replace(/^[^\d]*/, ''),
+            }),
         };
     }
     catch {
@@ -222,6 +242,32 @@ function filterBySpec(all, spec) {
     // No version — match by name only
     return all.filter(t => t.igName === spec);
 }
+// ── Up-to-date check ────────────────────────────────────────────────────────
+/**
+ * Check whether a package was already generated with the current babelfhir-ts
+ * version and the same effective flags. Returns true if regeneration can be skipped.
+ */
+function isUpToDate(target, cliFlags) {
+    // No stored version → was generated before this feature existed → regenerate
+    if (!target.generatorVersion)
+        return false;
+    // Compare generator versions (strip pre-release suffixes for comparison: 1.4.2-dev.xxx → 1.4.2)
+    const storedMajorMinorPatch = target.generatorVersion.split('-')[0];
+    const currentMajorMinorPatch = GENERATOR_VERSION.split('-')[0];
+    if (storedMajorMinorPatch !== currentMajorMinorPatch)
+        return false;
+    // Compare generation flags that affect output
+    const flagKeys = ['txServer', 'displayLanguage', 'fhirVersion', 'dicomweb', 'noClient', 'noClasses', 'schema'];
+    for (const key of flagKeys) {
+        const stored = target[key];
+        const cli = cliFlags[key];
+        // CLI flag explicitly set and differs from stored → needs regeneration
+        if (cli !== undefined && cli !== null && cli !== false && cli !== '' && String(cli) !== String(stored ?? '')) {
+            return false;
+        }
+    }
+    return true;
+}
 // ── Regeneration ────────────────────────────────────────────────────────────
 async function regeneratePackage(target, generationFlags, registry, downloadPackage) {
     const spec = `${target.igName}@${target.igVersion}`;
@@ -238,6 +284,10 @@ async function regeneratePackage(target, generationFlags, registry, downloadPack
         mergedFlags.displayLanguage = target.displayLanguage;
         console.log(`  Using display-language from package metadata: ${target.displayLanguage}`);
     }
+    if (target.fhirVersion && !mergedFlags.fhirVersion) {
+        mergedFlags.fhirVersion = target.fhirVersion;
+        console.log(`  Using fhir-version from package metadata: ${target.fhirVersion}`);
+    }
     if (target.dicomweb && mergedFlags.dicomweb === undefined)
         mergedFlags.dicomweb = true;
     if (target.noClient && mergedFlags.noClient === undefined)
@@ -303,41 +353,46 @@ export function patchBunLockIntegrity(updatedPackages) {
     const pm = detectPackageManager();
     if (!pm.cmd.includes('bun'))
         return;
-    // Walk up to find bun.lock (in monorepos it's at the workspace root, not cwd)
-    let lockPath = null;
+    // Collect ALL bun.lock files walking up (monorepos may have one at the
+    // workspace root AND one in a nested app directory).
+    const lockPaths = [];
     let dir = process.cwd();
     while (true) {
         const candidate = path.join(dir, 'bun.lock');
-        if (fs.existsSync(candidate)) {
-            lockPath = candidate;
-            break;
-        }
+        if (fs.existsSync(candidate))
+            lockPaths.push(candidate);
         const parent = path.dirname(dir);
         if (parent === dir)
             break;
         dir = parent;
     }
-    if (!lockPath)
+    if (lockPaths.length === 0)
         return;
-    let lockContent = fs.readFileSync(lockPath, 'utf8');
-    let patched = 0;
-    for (const { generatedName, tgzPath } of updatedPackages) {
-        // Compute new SHA-512 integrity hash
-        const tgzBytes = fs.readFileSync(tgzPath);
-        const hash = crypto.createHash('sha512').update(tgzBytes).digest('base64');
-        const newIntegrity = `sha512-${hash}`;
-        // Match all entries for this package in bun.lock:
-        //   "hl7.fhir.uv.ips-generated": [..., "sha512-oldHash=="],
-        //   "workspace/hl7.fhir.uv.ips-generated": [..., "sha512-oldHash=="],
-        const pattern = new RegExp(`("(?:[^"]*\\/)?${escapeRegExp(generatedName)}"\\s*:\\s*\\[.*?)(sha512-[A-Za-z0-9+/]+=*)`, 'g');
-        lockContent = lockContent.replace(pattern, (_, prefix, _oldHash) => {
-            patched++;
-            return `${prefix}${newIntegrity}`;
-        });
+    let totalPatched = 0;
+    for (const lockPath of lockPaths) {
+        let lockContent = fs.readFileSync(lockPath, 'utf8');
+        let patched = 0;
+        for (const { generatedName, tgzPath } of updatedPackages) {
+            // Compute new SHA-512 integrity hash
+            const tgzBytes = fs.readFileSync(tgzPath);
+            const hash = crypto.createHash('sha512').update(tgzBytes).digest('base64');
+            const newIntegrity = `sha512-${hash}`;
+            // Match entries with existing integrity hashes and replace them:
+            //   "hl7.fhir.uv.ips-generated": [..., "sha512-oldHash=="],
+            const pattern = new RegExp(`("(?:[^"]*\\/)?${escapeRegExp(generatedName)}"\\s*:\\s*\\[.*?)(sha512-[A-Za-z0-9+/]+=*)`, 'g');
+            lockContent = lockContent.replace(pattern, (_, prefix, _oldHash) => {
+                patched++;
+                return `${prefix}${newIntegrity}`;
+            });
+        }
+        if (patched > 0) {
+            fs.writeFileSync(lockPath, lockContent, 'utf8');
+            totalPatched += patched;
+            console.log(`Patched ${patched} integrity hash${patched === 1 ? '' : 'es'} in ${path.relative(process.cwd(), lockPath) || 'bun.lock'}`);
+        }
     }
-    if (patched > 0) {
-        fs.writeFileSync(lockPath, lockContent, 'utf8');
-        console.log(`Patched ${patched} integrity hash${patched === 1 ? '' : 'es'} in bun.lock`);
+    if (totalPatched === 0) {
+        console.log('No integrity hashes found to patch in bun.lock');
     }
 }
 function escapeRegExp(s) {
@@ -437,7 +492,8 @@ function runInstall() {
         const pm = detectPackageManager();
         const pmName = path.basename(pm.cmd).replace(/\.(cmd|exe)$/, '');
         console.log(`Running ${pmName} install...`);
-        const child = spawn(pm.cmd, ['install'], { stdio: 'inherit', shell: true });
+        // shell required on Windows for .cmd wrappers; disabled on Unix to prevent injection
+        const child = spawn(pm.cmd, ['install'], { stdio: 'inherit', shell: process.platform === 'win32' });
         child.on('exit', (code) => code === 0 ? resolve() : reject(new Error(`${pmName} install failed (exit ${code})`)));
         child.on('error', (err) => reject(new Error(`Failed to run ${pmName}: ${err.message}`)));
     });

package/out/src/generator/core/fetchUtils.js

@@ -5,6 +5,37 @@
 import http from "http";
 import https from "https";
 import { USER_AGENT, FETCH_TIMEOUT_MS } from './constants.js';
+/** Maximum number of HTTP redirects to follow before aborting. */
+const MAX_REDIRECTS = 10;
+/**
+ * Validate that a URL uses an allowed scheme (http/https) and does not target
+ * private/internal network addresses (SSRF mitigation).
+ */
+export function assertSafeUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error(`Invalid URL: ${url}`);
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new Error(`Blocked request to non-HTTP URL: ${url}`);
+    }
+    const host = parsed.hostname.toLowerCase();
+    if (host === 'localhost' ||
+        host === '127.0.0.1' ||
+        host === '::1' ||
+        host === '0.0.0.0' ||
+        host.startsWith('169.254.') ||
+        host.startsWith('10.') ||
+        host.startsWith('192.168.') ||
+        /^172\.(1[6-9]|2\d|3[01])\./.test(host) ||
+        host.endsWith('.internal') ||
+        host.endsWith('.local')) {
+        throw new Error(`Blocked request to private/internal address: ${host}`);
+    }
+}
 /**
  * Default headers for FHIR API requests
  */
@@ -84,15 +115,20 @@ export async function fetchArrayBuffer(url, options = {}) {
  * Fetch with native https module for streaming (used by downloadFile)
  * This provides better control for large file downloads
  */
-export function fetchStream(url) {
+export function fetchStream(url, redirectCount = 0) {
+    assertSafeUrl(url);
     return new Promise((resolve, reject) => {
         const client = url.startsWith('https') ? https : http;
         client.get(url, {
             headers: FHIR_HEADERS
         }, (response) => {
-            // Handle redirects
+            // Handle redirects with depth limit
             if (response.statusCode && response.statusCode >= 300 && response.statusCode < 400 && response.headers.location) {
-                fetchStream(response.headers.location).then(resolve).catch(reject);
+                if (redirectCount >= MAX_REDIRECTS) {
+                    reject(new Error(`Too many redirects (max ${MAX_REDIRECTS})`));
+                    return;
+                }
+                fetchStream(response.headers.location, redirectCount + 1).then(resolve).catch(reject);
                 return;
             }
             if (response.statusCode !== 200) {
@@ -107,7 +143,8 @@ export function fetchStream(url) {
  * Fetch JSON using native https module with timeout support
  * Used for fallback URLs where we need more control
  */
-export function fetchJsonNative(url, options = {}) {
+export function fetchJsonNative(url, options = {}, redirectCount = 0) {
+    assertSafeUrl(url);
     return new Promise((resolve, reject) => {
         const client = url.startsWith('https') ? https : http;
         const req = client.get(url, {
@@ -117,9 +154,13 @@ export function fetchJsonNative(url, options = {}) {
             },
             timeout: options.timeout || FETCH_TIMEOUT_MS
         }, (res) => {
-            // Handle redirects
+            // Handle redirects with depth limit
             if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
-                fetchJsonNative(res.headers.location, options).then(resolve).catch(reject);
+                if (redirectCount >= MAX_REDIRECTS) {
+                    reject(new Error(`Too many redirects (max ${MAX_REDIRECTS})`));
+                    return;
+                }
+                fetchJsonNative(res.headers.location, options, redirectCount + 1).then(resolve).catch(reject);
                 return;
             }
             if (res.statusCode !== 200) {

package/out/src/generator/emitters/validator/validatorConstraintBuilders.js

@@ -26,8 +26,16 @@ export function buildRequiredConstraints(fields, arrayFieldPaths, fieldPathMap,
         let rel = relBase;
         if (!rel)
             return;
-        // Skip slicing-declaration fields for choice[x] when slice fields exist.
-        if (relFull.includes('[x]') && !field.sliceName && !field.typeOptions && slicedChoicePaths.has(relFull)) {
+        // Skip slicing-declaration fields for choice[x] when slice fields exist
+        // AND the field is not required. When a profile slices value[x], the field list
+        // contains both a slicing-declaration field (no typeOptions, inherits base type
+        // like Quantity) and slice fields (with typeOptions). For optional fields, skip
+        // the declaration since the slice field handles the constraint. But for required
+        // fields (min >= 1), we MUST still emit the existence check — e.g.,
+        // medication[x] (min:1) needs "medication.exists()" to verify at least one
+        // concrete medication variant is present.
+        const fieldMin = typeof field.min === 'number' ? field.min : (field.isOptional ? 0 : 1);
+        if (relFull.includes('[x]') && !field.sliceName && !field.typeOptions && slicedChoicePaths.has(relFull) && fieldMin < 1) {
             return;
         }
         // For choice types (value[x]), append the concrete type name to get the correct accessor.

package/out/src/generator/index.js

@@ -25,7 +25,7 @@ const _generatorPkgPath = [
 catch {
     return false;
 } });
-const GENERATOR_VERSION = _generatorPkgPath ? JSON.parse(fs.readFileSync(_generatorPkgPath, 'utf8')).version : 'unknown';
+export const GENERATOR_VERSION = _generatorPkgPath ? JSON.parse(fs.readFileSync(_generatorPkgPath, 'utf8')).version : 'unknown';
 import { resetTimings, startPhase, getTimingSummary, formatTimingSummary } from './timing.js';
 export { getTimingSummary, formatTimingSummary } from './timing.js';
 const log = logger.withTag('generator');
@@ -129,9 +129,10 @@ async function compileTypeScriptToJS(dir) {
         };
         const tsconfigPath = path.join(dir, 'tsconfig.temp.json');
         fs.writeFileSync(tsconfigPath, JSON.stringify(tsconfig, null, 2));
+        // shell required on Windows for .cmd wrappers; disabled on Unix to prevent injection
         const child = spawn(tscCmd, ['-p', tsconfigPath], {
             stdio: 'inherit',
-            shell: true
+            shell: process.platform === 'win32'
         });
         child.on('exit', (code) => {
             // Clean up temp tsconfig
@@ -448,6 +449,7 @@ export async function generateIntoPackage(packageArchivePath, outArchivePath, fl
                 ...(originalPkg.fhirVersions && { fhirVersions: originalPkg.fhirVersions }),
                 ...(flags?.txServer && { txServer: flags.txServer }),
                 ...(flags?.displayLanguage && { displayLanguage: flags.displayLanguage }),
+                ...(flags?.fhirVersion && { fhirVersion: flags.fhirVersion }),
                 ...(flags?.dicomweb && { dicomweb: true }),
                 ...(flags?.noClient && { noClient: true }),
                 ...(flags?.noClasses && { noClasses: true }),
@@ -696,6 +698,7 @@ export async function generateIntoPackageDirect(packageArchivePath, flags) {
             ...(originalPkg.fhirVersions && { fhirVersions: originalPkg.fhirVersions }),
             ...(flags?.txServer && { txServer: flags.txServer }),
             ...(flags?.displayLanguage && { displayLanguage: flags.displayLanguage }),
+            ...(flags?.fhirVersion && { fhirVersion: flags.fhirVersion }),
             ...(flags?.dicomweb && { dicomweb: true }),
             ...(flags?.noClient && { noClient: true }),
             ...(flags?.noClasses && { noClasses: true }),

package/out/src/generator/parser/packageParser.js

@@ -314,7 +314,32 @@ export async function extractPackage(packagePath) {
         await extract({ cwd: extractDir, file: packagePath });
     }
     else if (packagePath.endsWith(".zip")) {
-        await fs.createReadStream(packagePath).pipe(unzipper.Extract({ path: extractDir })).promise();
+        // Use unzipper.Parse to validate each entry path against Zip Slip before extraction
+        const resolvedExtractDir = path.resolve(extractDir);
+        await new Promise((resolve, reject) => {
+            fs.createReadStream(packagePath)
+                .pipe(unzipper.Parse())
+                .on('entry', (entry) => {
+                const entryPath = path.join(extractDir, entry.path);
+                const resolvedEntry = path.resolve(entryPath);
+                // Zip Slip check: reject entries that escape the extraction directory
+                if (!resolvedEntry.startsWith(resolvedExtractDir + path.sep) && resolvedEntry !== resolvedExtractDir) {
+                    logger.warn(`[security] Skipping zip entry with path traversal: ${entry.path}`);
+                    entry.autodrain();
+                    return;
+                }
+                const dir = path.dirname(entryPath);
+                fs.mkdirSync(dir, { recursive: true });
+                if (entry.type === 'Directory') {
+                    entry.autodrain();
+                }
+                else {
+                    entry.pipe(fs.createWriteStream(entryPath));
+                }
+            })
+                .on('close', resolve)
+                .on('error', reject);
+        });
     }
     else {
         throw new Error("Unsupported package format. Only .tgz and .zip are supported.");

package/out/src/main.js

@@ -58,6 +58,7 @@ function printUsage() {
     console.log("  --schema <format>        Generate schema files alongside outputs (supported: zod)");
     console.log("  --dicomweb               Generate DICOMweb helpers typed to ImagingStudy profiles in the IG");
     console.log("  --recursive              (update only) Recursively search subdirectories for lib/ folders");
+    console.log("  --force                  (update only) Force regeneration even if version and flags haven't changed");
     console.log("  --outDir <dir>           Output directory (alias for second positional argument)");
     console.log("  --fhir-version <ver>     FHIR version to target: r4, r4b, or r5 (auto-detected from package if omitted)");
     console.log("  --package <pkg[@version]>  Download FHIR package from registry and process it (latest if no version)");
@@ -234,6 +235,10 @@ export function parseCliArgs(argv) {
             out.flags.recursive = true;
             continue;
         }
+        if (arg === '--force') {
+            out.flags.force = true;
+            continue;
+        }
         if (arg === '--cache-dir') {
             const val = argv[i + 1];
             if (!val || val.startsWith('-'))
@@ -377,6 +382,7 @@ export async function run() {
         const result = await handleUpdateCommand({
             packageFilter: packageSpec || positionals[1] || undefined,
             recursive: !!generationFlags.recursive,
+            force: !!generationFlags.force,
             generationFlags,
             registry,
             downloadPackage,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "babelfhir-ts",
-  "version": "1.4.2",
+  "version": "1.4.3",
   "description": "BabelFHIR-TS: generate TypeScript interfaces, validators, and helper classes from FHIR R4/R4B/R5 StructureDefinitions (profiles) directly inside package archives.",
   "type": "module",
   "main": "out/src/main.js",