babelfhir-ts 1.4.2 → 1.5.0

package/README.md

@@ -233,7 +233,10 @@ Options:
   --no-client              Skip FHIR client generation (client generated by default)
   --schema <format>        Generate schema files alongside outputs (supported: zod)
   --dicomweb               Generate DICOMweb helpers typed to ImagingStudy profiles in the IG
+  --prefab                 Generate Prefab UI render functions per profile (@maxhealth.tech/prefab)
+  --prefab-styles <path>   Path to styles module (.ts/.js) copied into the generated prefab/ folder
   --recursive              (update only) Recursively search subdirectories for lib/ folders
+  --force                  (update only) Force regeneration even if version and flags haven't changed
   --outDir <dir>           Output directory (alias for second positional argument)
   --fhir-version <ver>     FHIR version to target: r4, r4b, or r5 (auto-detected from package if omitted)
   --package <pkg[@version]>  Download FHIR package from registry and process it (latest if no version)

package/out/src/cli/installCommand.js

@@ -105,9 +105,10 @@ function npmInstall(packagePath) {
         }
         const { args } = result;
         console.log(`Installing package with ${pmName}...`);
+        // shell required on Windows for .cmd wrappers; disabled on Unix to prevent injection
         const child = spawn(pm.cmd, args, {
             stdio: 'inherit',
-            shell: true
+            shell: process.platform === 'win32'
         });
         child.on('exit', (code) => {
             if (code === 0) {

package/out/src/cli/updateCommand.js

@@ -13,14 +13,14 @@ import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import crypto from 'crypto';
-import { generateIntoPackageDirect, resetFetchFailureTracking } from '../generator/index.js';
+import { generateIntoPackageDirect, resetFetchFailureTracking, GENERATOR_VERSION } from '../generator/index.js';
 import { getFhirPackagesCacheDir } from '../generator/core/cacheConfig.js';
 import { resetDiagnostics, buildQualityReport, formatReportSummary } from '../generator/core/sdDiagnostics.js';
 import { detectPackageManager } from './installCommand.js';
 import { spawn } from 'child_process';
 // ── Public entry point ──────────────────────────────────────────────────────
 export async function handleUpdateCommand(opts) {
-    const { packageFilter, recursive, generationFlags, registry, downloadPackage, confirm } = opts;
+    const { packageFilter, recursive, force, generationFlags, registry, downloadPackage, confirm } = opts;
     const startDir = process.cwd();
     // 1. Discover tgz files
     const libDirs = discoverLibDirs(startDir, recursive ?? false);
@@ -55,11 +55,17 @@ export async function handleUpdateCommand(opts) {
     for (const t of targets)
         console.log(`  ${t.igName}@${t.igVersion}  →  ${path.relative(startDir, t.tgzPath)}`);
     console.log('');
-    // 4. Regenerate each package
+    // 4. Regenerate each package (skip if already up to date)
     let updated = 0;
+    let skipped = 0;
     let failed = 0;
     const updatedPackages = [];
     for (const target of targets) {
+        if (!force && isUpToDate(target, generationFlags)) {
+            skipped++;
+            console.log(`✓ ${target.igName}@${target.igVersion} — already up to date (babelfhir-ts ${target.generatorVersion})`);
+            continue;
+        }
         try {
             await regeneratePackage(target, generationFlags, registry, downloadPackage);
             updatedPackages.push({ generatedName: target.generatedName, tgzPath: target.tgzPath });
@@ -70,25 +76,34 @@ export async function handleUpdateCommand(opts) {
             console.error(`✗ Failed to update ${target.igName}@${target.igVersion}: ${err.message}`);
         }
     }
-    // 5. Patch bun.lock integrity hashes for regenerated packages (avoids full lockfile delete)
+    // 5. Remove stale node_modules/<pkg> so bun re-extracts from the updated tgz
     if (updatedPackages.length > 0) {
-        patchBunLockIntegrity(updatedPackages);
+        removeStaleNodeModules(updatedPackages.map((p) => p.generatedName));
     }
-    // 5b. Remove stale node_modules/<pkg> so bun re-extracts from the updated tgz
+    // 6. Patch bun.lock integrity hashes BEFORE install so bun sees matching hashes
     if (updatedPackages.length > 0) {
-        removeStaleNodeModules(updatedPackages.map((p) => p.generatedName));
+        patchBunLockIntegrity(updatedPackages);
     }
-    // 6. Single npm install at the end
+    // 7. Single npm install at the end
     if (updated > 0) {
         console.log('\nReinstalling dependencies...');
         await runInstall();
     }
-    // 7. Summary
+    // 8. Re-patch bun.lock integrity after install (bun may recompute hashes)
+    if (updatedPackages.length > 0) {
+        patchBunLockIntegrity(updatedPackages);
+    }
+    // 9. Summary
     console.log('');
     if (updated > 0)
         console.log(`✓ Updated ${updated} package${updated === 1 ? '' : 's'}`);
+    if (skipped > 0)
+        console.log(`✓ ${skipped} package${skipped === 1 ? '' : 's'} already up to date`);
     if (failed > 0)
         console.error(`✗ ${failed} package${failed === 1 ? '' : 's'} failed`);
+    if (skipped > 0 && updated === 0 && failed === 0) {
+        console.log('  Use --force to regenerate anyway.');
+    }
     return {};
 }
 // ── Install redirect prompt ─────────────────────────────────────────────────
@@ -200,10 +215,15 @@ async function readTgzMetadata(tgzPath, listFn) {
             igVersion,
             ...(pkg?.fhir?.txServer && { txServer: pkg.fhir.txServer }),
             ...(pkg?.fhir?.displayLanguage && { displayLanguage: pkg.fhir.displayLanguage }),
+            ...(pkg?.fhir?.fhirVersion && { fhirVersion: pkg.fhir.fhirVersion }),
             ...(pkg?.fhir?.dicomweb && { dicomweb: true }),
             ...(pkg?.fhir?.noClient && { noClient: true }),
             ...(pkg?.fhir?.noClasses && { noClasses: true }),
             ...(pkg?.fhir?.schema && { schema: pkg.fhir.schema }),
+            // Extract generator version from devDependencies (e.g. "^1.4.2" → "1.4.2")
+            ...(pkg?.devDependencies?.['babelfhir-ts'] && {
+                generatorVersion: pkg.devDependencies['babelfhir-ts'].replace(/^[^\d]*/, ''),
+            }),
         };
     }
     catch {
@@ -222,6 +242,32 @@ function filterBySpec(all, spec) {
     // No version — match by name only
     return all.filter(t => t.igName === spec);
 }
+// ── Up-to-date check ────────────────────────────────────────────────────────
+/**
+ * Check whether a package was already generated with the current babelfhir-ts
+ * version and the same effective flags. Returns true if regeneration can be skipped.
+ */
+function isUpToDate(target, cliFlags) {
+    // No stored version → was generated before this feature existed → regenerate
+    if (!target.generatorVersion)
+        return false;
+    // Compare generator versions (strip pre-release suffixes for comparison: 1.4.2-dev.xxx → 1.4.2)
+    const storedMajorMinorPatch = target.generatorVersion.split('-')[0];
+    const currentMajorMinorPatch = GENERATOR_VERSION.split('-')[0];
+    if (storedMajorMinorPatch !== currentMajorMinorPatch)
+        return false;
+    // Compare generation flags that affect output
+    const flagKeys = ['txServer', 'displayLanguage', 'fhirVersion', 'dicomweb', 'noClient', 'noClasses', 'schema'];
+    for (const key of flagKeys) {
+        const stored = target[key];
+        const cli = cliFlags[key];
+        // CLI flag explicitly set and differs from stored → needs regeneration
+        if (cli !== undefined && cli !== null && cli !== false && cli !== '' && String(cli) !== String(stored ?? '')) {
+            return false;
+        }
+    }
+    return true;
+}
 // ── Regeneration ────────────────────────────────────────────────────────────
 async function regeneratePackage(target, generationFlags, registry, downloadPackage) {
     const spec = `${target.igName}@${target.igVersion}`;
@@ -238,6 +284,10 @@ async function regeneratePackage(target, generationFlags, registry, downloadPack
         mergedFlags.displayLanguage = target.displayLanguage;
         console.log(`  Using display-language from package metadata: ${target.displayLanguage}`);
     }
+    if (target.fhirVersion && !mergedFlags.fhirVersion) {
+        mergedFlags.fhirVersion = target.fhirVersion;
+        console.log(`  Using fhir-version from package metadata: ${target.fhirVersion}`);
+    }
     if (target.dicomweb && mergedFlags.dicomweb === undefined)
         mergedFlags.dicomweb = true;
     if (target.noClient && mergedFlags.noClient === undefined)
@@ -303,41 +353,46 @@ export function patchBunLockIntegrity(updatedPackages) {
     const pm = detectPackageManager();
     if (!pm.cmd.includes('bun'))
         return;
-    // Walk up to find bun.lock (in monorepos it's at the workspace root, not cwd)
-    let lockPath = null;
+    // Collect ALL bun.lock files walking up (monorepos may have one at the
+    // workspace root AND one in a nested app directory).
+    const lockPaths = [];
     let dir = process.cwd();
     while (true) {
         const candidate = path.join(dir, 'bun.lock');
-        if (fs.existsSync(candidate)) {
-            lockPath = candidate;
-            break;
-        }
+        if (fs.existsSync(candidate))
+            lockPaths.push(candidate);
         const parent = path.dirname(dir);
         if (parent === dir)
             break;
         dir = parent;
     }
-    if (!lockPath)
+    if (lockPaths.length === 0)
         return;
-    let lockContent = fs.readFileSync(lockPath, 'utf8');
-    let patched = 0;
-    for (const { generatedName, tgzPath } of updatedPackages) {
-        // Compute new SHA-512 integrity hash
-        const tgzBytes = fs.readFileSync(tgzPath);
-        const hash = crypto.createHash('sha512').update(tgzBytes).digest('base64');
-        const newIntegrity = `sha512-${hash}`;
-        // Match all entries for this package in bun.lock:
-        //   "hl7.fhir.uv.ips-generated": [..., "sha512-oldHash=="],
-        //   "workspace/hl7.fhir.uv.ips-generated": [..., "sha512-oldHash=="],
-        const pattern = new RegExp(`("(?:[^"]*\\/)?${escapeRegExp(generatedName)}"\\s*:\\s*\\[.*?)(sha512-[A-Za-z0-9+/]+=*)`, 'g');
-        lockContent = lockContent.replace(pattern, (_, prefix, _oldHash) => {
-            patched++;
-            return `${prefix}${newIntegrity}`;
-        });
+    let totalPatched = 0;
+    for (const lockPath of lockPaths) {
+        let lockContent = fs.readFileSync(lockPath, 'utf8');
+        let patched = 0;
+        for (const { generatedName, tgzPath } of updatedPackages) {
+            // Compute new SHA-512 integrity hash
+            const tgzBytes = fs.readFileSync(tgzPath);
+            const hash = crypto.createHash('sha512').update(tgzBytes).digest('base64');
+            const newIntegrity = `sha512-${hash}`;
+            // Match entries with existing integrity hashes and replace them:
+            //   "hl7.fhir.uv.ips-generated": [..., "sha512-oldHash=="],
+            const pattern = new RegExp(`("(?:[^"]*\\/)?${escapeRegExp(generatedName)}"\\s*:\\s*\\[.*?)(sha512-[A-Za-z0-9+/]+=*)`, 'g');
+            lockContent = lockContent.replace(pattern, (_, prefix, _oldHash) => {
+                patched++;
+                return `${prefix}${newIntegrity}`;
+            });
+        }
+        if (patched > 0) {
+            fs.writeFileSync(lockPath, lockContent, 'utf8');
+            totalPatched += patched;
+            console.log(`Patched ${patched} integrity hash${patched === 1 ? '' : 'es'} in ${path.relative(process.cwd(), lockPath) || 'bun.lock'}`);
+        }
     }
-    if (patched > 0) {
-        fs.writeFileSync(lockPath, lockContent, 'utf8');
-        console.log(`Patched ${patched} integrity hash${patched === 1 ? '' : 'es'} in bun.lock`);
+    if (totalPatched === 0) {
+        console.log('No integrity hashes found to patch in bun.lock');
     }
 }
 function escapeRegExp(s) {
@@ -437,7 +492,8 @@ function runInstall() {
         const pm = detectPackageManager();
         const pmName = path.basename(pm.cmd).replace(/\.(cmd|exe)$/, '');
         console.log(`Running ${pmName} install...`);
-        const child = spawn(pm.cmd, ['install'], { stdio: 'inherit', shell: true });
+        // shell required on Windows for .cmd wrappers; disabled on Unix to prevent injection
+        const child = spawn(pm.cmd, ['install'], { stdio: 'inherit', shell: process.platform === 'win32' });
         child.on('exit', (code) => code === 0 ? resolve() : reject(new Error(`${pmName} install failed (exit ${code})`)));
         child.on('error', (err) => reject(new Error(`Failed to run ${pmName}: ${err.message}`)));
     });

package/out/src/generator/core/fetchUtils.js

@@ -5,6 +5,37 @@
 import http from "http";
 import https from "https";
 import { USER_AGENT, FETCH_TIMEOUT_MS } from './constants.js';
+/** Maximum number of HTTP redirects to follow before aborting. */
+const MAX_REDIRECTS = 10;
+/**
+ * Validate that a URL uses an allowed scheme (http/https) and does not target
+ * private/internal network addresses (SSRF mitigation).
+ */
+export function assertSafeUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error(`Invalid URL: ${url}`);
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new Error(`Blocked request to non-HTTP URL: ${url}`);
+    }
+    const host = parsed.hostname.toLowerCase();
+    if (host === 'localhost' ||
+        host === '127.0.0.1' ||
+        host === '::1' ||
+        host === '0.0.0.0' ||
+        host.startsWith('169.254.') ||
+        host.startsWith('10.') ||
+        host.startsWith('192.168.') ||
+        /^172\.(1[6-9]|2\d|3[01])\./.test(host) ||
+        host.endsWith('.internal') ||
+        host.endsWith('.local')) {
+        throw new Error(`Blocked request to private/internal address: ${host}`);
+    }
+}
 /**
  * Default headers for FHIR API requests
  */
@@ -84,15 +115,20 @@ export async function fetchArrayBuffer(url, options = {}) {
  * Fetch with native https module for streaming (used by downloadFile)
  * This provides better control for large file downloads
  */
-export function fetchStream(url) {
+export function fetchStream(url, redirectCount = 0) {
+    assertSafeUrl(url);
     return new Promise((resolve, reject) => {
         const client = url.startsWith('https') ? https : http;
         client.get(url, {
             headers: FHIR_HEADERS
         }, (response) => {
-            // Handle redirects
+            // Handle redirects with depth limit
             if (response.statusCode && response.statusCode >= 300 && response.statusCode < 400 && response.headers.location) {
-                fetchStream(response.headers.location).then(resolve).catch(reject);
+                if (redirectCount >= MAX_REDIRECTS) {
+                    reject(new Error(`Too many redirects (max ${MAX_REDIRECTS})`));
+                    return;
+                }
+                fetchStream(response.headers.location, redirectCount + 1).then(resolve).catch(reject);
                 return;
             }
             if (response.statusCode !== 200) {
@@ -107,7 +143,8 @@ export function fetchStream(url) {
  * Fetch JSON using native https module with timeout support
  * Used for fallback URLs where we need more control
  */
-export function fetchJsonNative(url, options = {}) {
+export function fetchJsonNative(url, options = {}, redirectCount = 0) {
+    assertSafeUrl(url);
     return new Promise((resolve, reject) => {
         const client = url.startsWith('https') ? https : http;
         const req = client.get(url, {
@@ -117,9 +154,13 @@ export function fetchJsonNative(url, options = {}) {
             },
             timeout: options.timeout || FETCH_TIMEOUT_MS
         }, (res) => {
-            // Handle redirects
+            // Handle redirects with depth limit
             if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
-                fetchJsonNative(res.headers.location, options).then(resolve).catch(reject);
+                if (redirectCount >= MAX_REDIRECTS) {
+                    reject(new Error(`Too many redirects (max ${MAX_REDIRECTS})`));
+                    return;
+                }
+                fetchJsonNative(res.headers.location, options, redirectCount + 1).then(resolve).catch(reject);
                 return;
             }
             if (res.statusCode !== 200) {

package/out/src/generator/emitters/prefab/prefabEmitter.js

@@ -0,0 +1,160 @@
+/**
+ * Prefab UI emitter — writes per-profile render functions and the shared
+ * `prefab/` runtime files (fhirFormat.ts, styles.ts, index.ts).
+ *
+ * Called twice per generation pipeline:
+ *   - {@link writePrefabProfile} once per processed profile during sdProcessor emission
+ *   - {@link finalizePrefabOutput} once after all profiles, to drop shared files + barrel
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { generatePrefabRenderer } from './prefabRenderer.js';
+import { FHIR_FORMAT_TS, DEFAULT_STYLES_TS, REGISTER_FHIR_PIPES_TS, buildPrefabIndexTs, } from './prefabRuntimeAssets.js';
+import { logger } from '../../../logger.js';
+const log = logger.withTag('prefab');
+/** In-memory registry of profiles for which we've written renderer files. outputDir → (interfaceName → resourceType) */
+const emittedProfiles = new Map();
+function prefabDirFor(outputDir) {
+    return path.join(outputDir, 'prefab');
+}
+function ensurePrefabDir(outputDir) {
+    const dir = prefabDirFor(outputDir);
+    if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true });
+    return dir;
+}
+/**
+ * Emit `prefab/<InterfaceName>Prefab.ts` for a single profile.
+ * Registers the profile so {@link finalizePrefabOutput} can build the barrel.
+ */
+export function writePrefabProfile(outputDir, interfaceName, fields, resourceType) {
+    const dir = ensurePrefabDir(outputDir);
+    const { code, fieldCount } = generatePrefabRenderer(interfaceName, fields);
+    const filePath = path.join(dir, `${interfaceName}Prefab.ts`);
+    fs.writeFileSync(filePath, code);
+    let map = emittedProfiles.get(outputDir);
+    if (!map) {
+        map = new Map();
+        emittedProfiles.set(outputDir, map);
+    }
+    map.set(interfaceName, resourceType ?? interfaceName);
+    log.debug(`Emitted prefab renderer for ${interfaceName} (${fieldCount} fields)`);
+}
+/**
+ * Write shared runtime assets (`fhirFormat.ts`, `styles.ts`, `index.ts`) and
+ * the barrel exporting every profile renderer.
+ *
+ * When `prefabStylesPath` is provided, its contents are copied verbatim as
+ * `prefab/styles.ts` so the user's theme travels with the generated package.
+ */
+export function finalizePrefabOutput(outputDir, opts = {}) {
+    const profileMap = emittedProfiles.get(outputDir);
+    if (!profileMap || profileMap.size === 0) {
+        log.debug('finalizePrefabOutput: no profiles emitted, skipping');
+        return;
+    }
+    const names = [...profileMap.keys()];
+    const dir = ensurePrefabDir(outputDir);
+    fs.writeFileSync(path.join(dir, 'fhirFormat.ts'), FHIR_FORMAT_TS);
+    fs.writeFileSync(path.join(dir, 'registerFhirPipes.ts'), REGISTER_FHIR_PIPES_TS);
+    fs.writeFileSync(path.join(dir, 'styles.ts'), resolveStylesContent(opts.prefabStylesPath));
+    fs.writeFileSync(path.join(dir, 'index.ts'), buildPrefabIndexTs(names));
+    fs.writeFileSync(path.join(dir, 'mcpViews.ts'), buildMcpViewsTs(profileMap));
+    log.success(`Generated prefab UI renderers for ${names.length} profile(s)${opts.prefabStylesPath ? ` (using styles from ${opts.prefabStylesPath})` : ''}`);
+}
+/**
+ * Resolve the styles file content.
+ *   - If `prefabStylesPath` is given and exists, its contents are returned.
+ *   - Otherwise, the baked-in default is returned.
+ */
+function resolveStylesContent(prefabStylesPath) {
+    if (!prefabStylesPath)
+        return DEFAULT_STYLES_TS;
+    const resolved = path.resolve(prefabStylesPath);
+    if (!fs.existsSync(resolved)) {
+        log.warn(`--prefab-styles file not found: ${resolved} — falling back to defaults`);
+        return DEFAULT_STYLES_TS;
+    }
+    try {
+        return fs.readFileSync(resolved, 'utf8');
+    }
+    catch (err) {
+        log.warn(`Failed to read --prefab-styles file: ${err.message} — using defaults`);
+        return DEFAULT_STYLES_TS;
+    }
+}
+/** Test / CI helper: reset the in-memory registry between generations. */
+export function resetPrefabState() {
+    emittedProfiles.clear();
+}
+// ── MCP View Registry generator ──────────────────────────────────────────────
+/**
+ * Lower-case the first character(s) of a name, preserving acronym runs.
+ * Mirrors the same logic in prefabRenderer.ts.
+ */
+function lowerFirst(name) {
+    if (!name)
+        return name;
+    let i = 0;
+    while (i < name.length && name[i] >= 'A' && name[i] <= 'Z')
+        i++;
+    if (i <= 1)
+        return name.charAt(0).toLowerCase() + name.slice(1);
+    const acronymEnd = i === name.length ? i : i - 1;
+    return name.slice(0, acronymEnd).toLowerCase() + name.slice(acronymEnd);
+}
+/**
+ * Build the `mcpViews.ts` source — a `FhirViewRegistry` that maps FHIR
+ * resource types to their generated prefab table/detail components.
+ *
+ * When multiple profiles target the same base resource type (e.g.
+ * CHCorePatient and CHCorePatientEPR both extend Patient), the first
+ * one wins. Users can override via programmatic API if needed.
+ */
+function buildMcpViewsTs(profiles) {
+    // Group by resource type — first profile per type wins
+    const byResourceType = new Map();
+    for (const [interfaceName, resourceType] of profiles) {
+        if (!byResourceType.has(resourceType)) {
+            byResourceType.set(resourceType, interfaceName);
+        }
+    }
+    const imports = [];
+    const tableEntries = [];
+    const detailEntries = [];
+    for (const [resourceType, interfaceName] of byResourceType) {
+        const varBase = lowerFirst(interfaceName);
+        imports.push(`import { ${varBase}Table, ${varBase}Detail } from './${interfaceName}Prefab.js';`);
+        tableEntries.push(`  ${JSON.stringify(resourceType)}: (resources) => ${varBase}Table(resources as any),`);
+        detailEntries.push(`  ${JSON.stringify(resourceType)}: (resource) => ${varBase}Detail(resource as any),`);
+    }
+    return `/**
+ * AUTO-GENERATED by babelfhir-ts --prefab — do not edit.
+ *
+ * FhirViewRegistry mapping FHIR resource types to profile-specific
+ * prefab components. Pass to \`createFhirMcpServer({ views })\` for
+ * rich, profile-aware UIs instead of generic auto-layout.
+ *
+ * @see https://babelfhir-ts.dev/generated-code
+ */
+
+import type { FhirViewRegistry } from '@babelfhir-ts/mcp';
+${imports.join('\n')}
+
+const TABLE_MAP: Record<string, (resources: unknown[]) => unknown> = {
+${tableEntries.join('\n')}
+};
+
+const DETAIL_MAP: Record<string, (resource: unknown) => unknown> = {
+${detailEntries.join('\n')}
+};
+
+export const views: FhirViewRegistry = {
+  table: (type, resources) => TABLE_MAP[type]?.(resources),
+  detail: (resource) => {
+    const type = (resource as { resourceType?: string }).resourceType;
+    return type ? DETAIL_MAP[type]?.(resource) : undefined;
+  },
+};
+`;
+}