fhirsmith 0.11.2 → 0.12.0

package/CHANGELOG.md

@@ -5,7 +5,77 @@ All notable changes to the Health Intersections Node Server will be documented i
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## 0.11.2 - 2026-08-12
+## [0.12.0] - 2026-08-27
+
+### Added
+
+- `$cache-control?mode=check`: ask the server whether a cache-id is still alive. The check is
+  also a keepalive - it resets the cache's idle clock - because a client whose own local cache is
+  absorbing the work is invisible to the server, and its cache would otherwise time out mid-job.
+  An unknown id answers 200 with `valid` = false (not 404), so a client can tell "the server says
+  my cache is gone" from "I could not reach the server"; a live cache also reports `sealed`,
+  `resource-count`, `idle` and the server's idle timeout, so a client can work out how often to
+  check instead of guessing
+- Cache tombstones: the server now records why a cache-id it issued stopped existing - closed by
+  the client, expired after N minutes idle, or cleared with everything else - and says which in
+  the error, with the timings. New `CACHE_ID_CLOSED`, `CACHE_ID_EXPIRED` and `CACHE_ID_CLEARED`
+  messages; `CACHE_ID_UNKNOWN` now means "never issued here", and says that a cache-id is only
+  valid on the server instance and endpoint that issued it (#279)
+- SNOMED CT: MRCM validation of postcoordinated expressions - attribute domain (including the
+  lateralizable body structure rule), range (evaluated as ECL, or as a concrete-value range such
+  as `dec(>#0..)`), cardinality and grouping. A constraint that cannot be resolved leaves the
+  value unchecked rather than rejecting it. The MRCM and lateralizable reference sets are now
+  included in the test SNOMED distribution
+- `$translate`: R4 parameter names are accepted as aliases for the R5 ones (`source`/`target` for
+  the scopes, `targetsystem`, `targetcode`), and R4's `reverse` parameter now does literally what
+  it says - swaps the source and target sides once the parameters are read - while remaining an
+  error in R5+, which names the target concept directly instead
+- `$translate`: reverse translation by naming the target concept (`targetCode`, `targetCoding`,
+  `targetCodeableConcept`), with the source system saying which system the answers come from
+- `$translate`: `ConceptMap.group.element.comment` is read from R6 resources and from the
+  cross-version extension on R5 ones, so a preadopted R5 map and a native R6 map behave the same
+- `$translate`: `originMap` names where a chain of maps started, with every other map consulted
+  along the way reported as a `used-conceptmap`; `group.unmapped` is applied per group, so a
+  mapping in one group no longer suppresses another group's fallback
+- Persistent usage statistics: request counts per module, endpoint and operation are written to a
+  SQLite database every `intervalMinutes`, with both the interval count and the all-time total, so
+  they survive restarts and upgrades. New optional `stats` config block (#255)
+- Support for `ValueSet.compose.property` (R6): a value set can name the properties to return in
+  its own expansion, rather than leaving it to the request
+- Publisher: input validation for GitHub owner and repository, git branch, package id and version -
+  enforced on the server, with matching patterns on the form so the browser objects first
+- Publisher: `large-file-archive` config setting - files the IG Publisher leaves in the web output
+  that are too big for GitHub (>100MB) are moved aside for GitHub-hosted websites, instead of
+  leaving the push to fail
+
+### Changed
+
+- `tx/params.js`: parameter names are now interpreted in exactly one place (`seeParameter`), used
+  by both the request `Parameters` resource and the `valueset-expansion-parameter` extension. A
+  parameter from the request always wins over one embedded in a ValueSet's expansion parameters;
+  accumulating parameters (version rules, designations, properties, supplements) still add
+- An inactive display is now governed by `lenient-display-validation` like every other display
+  check - a warning (and `result` = true) when lenient, an error when not - rather than always
+  being a warning. The display is a designation of the concept, just not a current one
+- tx.fhir.org now loads `fhir.tx.support` rather than `fhir.tx.support.r4`
+
+### Fixed
+
+- `$expand`: `status` was lost from imported property declarations, and a concept carrying the
+  same property more than once had the repeats collapsed to a single value
+- Expansion properties are de-duplicated when they arrive from more than one place (the request,
+  an expansion parameter extension, `compose.property`) - a repeat emitted the property twice and
+  changed the cache key
+- `no-cache=true` never busted the cache: the parameter wrote `uid`, which nothing read, instead of
+  the field the cache key hashes
+- Boolean parameters passed as strings (as they always are on a GET) are now accepted, which
+  revives five parameters that were dead on GET requests
+
+### Tx Conformance Statement
+
+FHIRsmith passed all 2822 HL7 terminology service tests (modes tx.fhir.org+omop+general+snomed, tests v1.9.3, runner v6.10.3)
+
+## [0.11.2] - 2026-08-12
 
 ### Fixed
 
@@ -14,7 +84,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 
 - Fix snomed designation handling for languages
-- Fix for SSEF protection in the validator- 
+- Fix for SSRF protection in the validator- 
 
 ### Tx Conformance Statement
 

package/config-template.json

@@ -6,6 +6,18 @@
       "credentials": true
     }
   },
+  // Usage statistics. Request counts are kept per module, per endpoint and per
+  // operation, and written to a SQLite database every intervalMinutes so they
+  // survive restarts and upgrades. Each row carries both the count for that
+  // interval and the all-time total. The whole block is optional.
+  "stats": {
+    // set false to keep statistics in memory only (nothing is written to disk)
+    "enabled": true,
+    // relative paths resolve under the data folder's databases directory
+    "database": "stats.db",
+    // how often the counters are written out
+    "intervalMinutes": 10
+  },
   "modules": {
     "shl": {
       "enabled": false,
@@ -64,7 +76,12 @@
       "database": "/absolute/path/to/publisher.db",
       "sessionSecret": "change-this-to-a-secure-random-string",
       "workspaceRoot": "/absolute/path/to/workspaces",
-      "igPublisherTimeoutMinutes": 60
+      "igPublisherTimeoutMinutes": 60,
+      // where to put files the IG Publisher leaves in the web folder that are too big for GitHub
+      // (>100MB). Only applies to websites whose publish-setup.json has $.website.github = true.
+      // Omit to leave them in place - the push will then fail. Relative paths resolve under the
+      // publisher data folder
+      "large-file-archive": "/absolute/path/to/large-file-archive"
     },
     "npmprojector": {
       "enabled": true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fhirsmith",
-  "version": "0.11.2",
+  "version": "0.12.0",
   "txVersion": "1.9.3",
   "description": "A Node.js server that provides a collection of tools to serve the FHIR ecosystem",
   "main": "server.js",

package/publisher/publisher.js

@@ -1,6 +1,7 @@
 const express = require('express');
 const path = require('path');
 const fs = require('fs');
+const validation = require('./validation');
 const Database = require('sqlite3').Database;
 const bcrypt = require('bcrypt');
 const session = require('express-session');
@@ -8,6 +9,10 @@ const folders = require('../library/folder-setup');
 const escape = require('escape-html');
 const {Utilities} = require("../library/utilities");
 
+// GitHub refuses any file larger than this at the pre-receive hook, and the rejection takes down
+// the whole push rather than just the offending file.
+const GITHUB_MAX_FILE_SIZE = 100 * 1024 * 1024;
+
 
 class PublisherModule {
   constructor(stats) {
@@ -928,6 +933,137 @@ class PublisherModule {
     }
   }
 
+  // The IG Publisher can leave a file in the web folder that GitHub will not accept - typically a
+  // technical correction archive, which is a zip of an entire published version folder and so
+  // carries that folder's own full-ig.zip inside it. GitHub rejects the entire push over one such
+  // file, at the very last step of a publication run. The IG Publisher will keep these out of the
+  // web folder itself from the next release; until then, move them aside here.
+  //
+  // Does nothing unless publisher.large-file-archive says where to put them, and the website is
+  // one that's hosted on GitHub in the first place.
+  async archiveLargeFiles(task, website) {
+    const configured = this.config['large-file-archive'];
+    if (!configured || !this.isGitHubHosted(website)) {
+      return;
+    }
+    const root = website.git_root || website.local_folder;
+    const oversized = this.findLargeFiles(root, GITHUB_MAX_FILE_SIZE);
+    if (oversized.length === 0) {
+      return;
+    }
+
+    const archiveDir = path.isAbsolute(configured)
+        ? configured
+        : folders.filePath('publisher', configured);
+    if (!fs.existsSync(archiveDir)) {
+      fs.mkdirSync(archiveDir, { recursive: true });
+    }
+
+    for (const file of oversized) {
+      const sizeMB = Math.round(fs.statSync(file).size / (1024 * 1024));
+      const dest = this.nonClashingPath(archiveDir, path.basename(file));
+      this.moveFile(file, dest);
+      await this.logTaskMessage(task.id, 'warn', 'Large file ' + path.relative(root, file) + ' (' + sizeMB +
+          ' MB) is over the 100 MB GitHub limit - moved to ' + dest + ' instead of being published');
+    }
+  }
+
+  // Only a website kept in a GitHub repository has a 100MB problem - others can carry files of any
+  // size. $.website.github in the web root's publish-setup.json says which is which; if that can't
+  // be read, or doesn't say, assume not and leave the files where they are.
+  isGitHubHosted(website) {
+    if (!website.local_folder) {
+      return false;
+    }
+    const setupPath = path.join(website.local_folder, 'publish-setup.json');
+    try {
+      const setup = JSON.parse(fs.readFileSync(setupPath, 'utf8'));
+      return !!(setup.website && setup.website.github === true);
+    } catch (err) {
+      this.logger.warn('Could not read ' + setupPath + ' to check whether the website is on GitHub: ' + err.message);
+      return false;
+    }
+  }
+
+  // Files in the web folder that are too big to push. Never descends into .git: a pack file over the
+  // limit is perfectly normal there, and moving it would destroy the repository. Files git is already
+  // ignoring are left alone, since they were never going to be pushed anyway.
+  findLargeFiles(root, limit) {
+    const found = [];
+    const walk = (dir) => {
+      let entries;
+      try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+      } catch (err) {
+        this.logger.warn('Large file scan could not read ' + dir + ': ' + err.message);
+        return;
+      }
+      for (const entry of entries) {
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+          if (entry.name !== '.git') {
+            walk(full);
+          }
+        } else if (entry.isFile()) {
+          try {
+            if (fs.statSync(full).size > limit) {
+              found.push(full);
+            }
+          } catch (err) {
+            // the file went away between readdir and stat - nothing left to move
+          }
+        }
+      }
+    };
+    walk(root);
+    return found.length === 0 ? found : this.removeGitIgnored(root, found);
+  }
+
+  removeGitIgnored(root, files) {
+    try {
+      const result = require('child_process').spawnSync('git', ['check-ignore', '--stdin'],
+          { cwd: root, input: files.join('\n'), encoding: 'utf8' });
+      // exit 0: at least one path is ignored. 1: none are. anything else: git could not tell us,
+      // in which case treat everything as pushable rather than leaving a file that breaks the push.
+      if (result.status !== 0 || !result.stdout) {
+        return files;
+      }
+      const ignored = new Set(result.stdout.split('\n').map((s) => s.trim()).filter((s) => s));
+      return files.filter((f) => !ignored.has(f));
+    } catch (err) {
+      this.logger.warn('Could not check the gitignore status of large files: ' + err.message);
+      return files;
+    }
+  }
+
+  nonClashingPath(dir, name) {
+    let candidate = path.join(dir, name);
+    if (!fs.existsSync(candidate)) {
+      return candidate;
+    }
+    const ext = path.extname(name);
+    const stem = path.basename(name, ext);
+    let i = 2;
+    do {
+      candidate = path.join(dir, stem + '-' + i + ext);
+      i++;
+    } while (fs.existsSync(candidate));
+    return candidate;
+  }
+
+  // rename() fails across filesystems, and the archive folder will not always be on the same one
+  moveFile(src, dest) {
+    try {
+      fs.renameSync(src, dest);
+    } catch (err) {
+      if (err.code !== 'EXDEV') {
+        throw err;
+      }
+      fs.copyFileSync(src, dest);
+      fs.unlinkSync(src);
+    }
+  }
+
   async runPublication(task) {
     const website = await this.getWebsite(task.website_id);
     if (!website) {
@@ -1016,6 +1152,9 @@ class PublisherModule {
     // url - can survive into the web tree. Catch that here, before anything is committed.
     await this.verifyPublishedPackage(task, website, draftDir);
 
+    // Step 5c: Move anything too big for GitHub out of the web folder, before it gets staged
+    await this.archiveLargeFiles(task, website);
+
     // Step 6: Commit and push the web folder
     await this.logTaskMessage(task.id, 'info', 'Committing changes to web folder...');
     const gitUrl = 'https://github.com/' + task.github_org + '/' + task.github_repo + '.git';
@@ -1363,23 +1502,23 @@ class PublisherModule {
           content += '</div>';
           content += '<div class="col-md-3">';
           content += '<label for="github_org" class="form-label">GitHub Org</label>';
-          content += '<input type="text" class="form-control" id="github_org" name="github_org" required placeholder="hl7">';
+          content += '<input type="text" class="form-control" id="github_org" name="github_org" required maxlength="39" pattern="' + validation.HTML_PATTERNS.github_org + '" title="Letters, digits and single hyphens" placeholder="hl7">';
           content += '</div>';
           content += '<div class="col-md-3">';
           content += '<label for="github_repo" class="form-label">GitHub Repo</label>';
-          content += '<input type="text" class="form-control" id="github_repo" name="github_repo" required placeholder="fhir-us-core">';
+          content += '<input type="text" class="form-control" id="github_repo" name="github_repo" required maxlength="100" pattern="' + validation.HTML_PATTERNS.github_repo + '" title="Letters, digits, dots, hyphens and underscores" placeholder="fhir-us-core">';
           content += '</div>';
           content += '<div class="col-md-3">';
           content += '<label for="git_branch" class="form-label">Branch</label>';
-          content += '<input type="text" class="form-control" id="git_branch" name="git_branch" required placeholder="main">';
+          content += '<input type="text" class="form-control" id="git_branch" name="git_branch" required maxlength="255" pattern="' + validation.HTML_PATTERNS.git_branch + '" title="A git branch name - slashes are fine, but not spaces, backslashes or any of ~ ^ : ? * [" placeholder="main">';
           content += '</div>';
           content += '<div class="col-md-4">';
           content += '<label for="npm_package_id" class="form-label">NPM Package ID</label>';
-          content += '<input type="text" class="form-control" id="npm_package_id" name="npm_package_id" required placeholder="hl7.fhir.us.core">';
+          content += '<input type="text" class="form-control" id="npm_package_id" name="npm_package_id" required maxlength="128" pattern="' + validation.HTML_PATTERNS.npm_package_id + '" title="Letters, digits, dots, hyphens and underscores" placeholder="hl7.fhir.us.core">';
           content += '</div>';
           content += '<div class="col-md-4">';
           content += '<label for="version" class="form-label">Version</label>';
-          content += '<input type="text" class="form-control" id="version" name="version" required placeholder="6.0.0">';
+          content += '<input type="text" class="form-control" id="version" name="version" required maxlength="64" pattern="' + validation.HTML_PATTERNS.version + '" title="Letters, digits, dots, hyphens and plus signs" placeholder="6.0.0">';
           content += '</div>';
           content += '<div class="col-md-4 d-flex align-items-end">';
           content += '<button type="submit" class="btn btn-primary">Create Task</button>';
@@ -1495,6 +1634,15 @@ class PublisherModule {
       try {
         const {website_id, github_org, github_repo, git_branch, npm_package_id, version} = req.body;
 
+        // Check the input before it goes anywhere near a git command line or a
+        // file name. The browser checks these too (see HTML_PATTERNS), but the
+        // form isn't the only way to reach this route.
+        const problems = validation.validateTaskInput(req.body);
+        if (problems.length > 0) {
+          this.logger.warn('Rejected task creation from user ' + req.session.userId + ': ' + problems.join('; '));
+          return res.status(400).send('Invalid task details: ' + problems.join('; '));
+        }
+
         // Verify user has permission for this website
         const canQueue = await this.userCanQueue(req.session.userId, website_id);
         if (!canQueue) {

package/publisher/validation.js

@@ -0,0 +1,198 @@
+/**
+ * Validation for the fields a user types into the publication task form.
+ *
+ * None of these values can cause command injection - they're passed to spawn()
+ * as argv, and nothing goes near a shell - but they do end up in git command
+ * lines, in URLs, and in file names, so they're checked at the boundary rather
+ * than trusted to be harmless everywhere they're later used.
+ *
+ * The rules are the ones GitHub and git themselves enforce (see
+ * git-check-ref-format(1) for the branch rules): anything rejected here would
+ * have failed at clone time anyway, with a much worse error.
+ */
+
+// GitHub owner names: letters, digits and single hyphens, no hyphen at either
+// end, 39 characters at most.
+const MAX_OWNER = 39;
+// Repository names: letters, digits, dot, hyphen, underscore, 100 at most.
+const MAX_REPO = 100;
+// git imposes no length limit on a ref, but a branch name past this is a
+// filesystem problem waiting to happen.
+const MAX_BRANCH = 255;
+const MAX_PACKAGE_ID = 128;
+const MAX_VERSION = 64;
+
+/**
+ * A GitHub organisation or user name.
+ */
+function validateGithubOwner(value) {
+  if (!value) {
+    return 'GitHub org is required';
+  }
+  if (value.length > MAX_OWNER) {
+    return `GitHub org must be ${MAX_OWNER} characters or less`;
+  }
+  if (!/^[A-Za-z0-9](?:-?[A-Za-z0-9])*$/.test(value)) {
+    return 'GitHub org may only contain letters, digits and single hyphens, and may not start or end with a hyphen';
+  }
+  return null;
+}
+
+/**
+ * A GitHub repository name.
+ */
+function validateGithubRepo(value) {
+  if (!value) {
+    return 'GitHub repo is required';
+  }
+  if (value.length > MAX_REPO) {
+    return `GitHub repo must be ${MAX_REPO} characters or less`;
+  }
+  if (!/^[A-Za-z0-9._-]+$/.test(value)) {
+    return 'GitHub repo may only contain letters, digits, dots, hyphens and underscores';
+  }
+  if (value === '.' || value === '..') {
+    return 'GitHub repo is not a valid name';
+  }
+  // the code appends '.git' when it builds the clone URL, and GitHub won't
+  // create a repository with that suffix anyway
+  if (value.toLowerCase().endsWith('.git')) {
+    return 'GitHub repo should not include the .git suffix';
+  }
+  return null;
+}
+
+/**
+ * A branch name, by the rules in git-check-ref-format(1). Slashes are fine -
+ * that's how branches are grouped - but the characters git reserves for
+ * revision syntax are not. Note that git itself rejects a backslash in a ref
+ * name, so this does too.
+ */
+function validateGitBranch(value) {
+  if (!value) {
+    return 'Branch is required';
+  }
+  if (value.length > MAX_BRANCH) {
+    return `Branch must be ${MAX_BRANCH} characters or less`;
+  }
+  // space, the ASCII control characters, and DEL
+  // eslint-disable-next-line no-control-regex
+  if (/[\u0000-\u001F\u007F ]/.test(value)) {
+    return 'Branch may not contain spaces or control characters';
+  }
+  // the characters git reserves for revision syntax
+  if (/[~^:?*[\\]/.test(value)) {
+    return 'Branch may not contain any of ~ ^ : ? * [ \\';
+  }
+  if (value.includes('..')) {
+    return 'Branch may not contain ..';
+  }
+  if (value.includes('@{')) {
+    return 'Branch may not contain @{';
+  }
+  if (value === '@') {
+    return 'Branch may not be @';
+  }
+  if (value.startsWith('-')) {
+    return 'Branch may not start with a hyphen';
+  }
+  if (value.startsWith('/') || value.endsWith('/') || value.includes('//')) {
+    return 'Branch may not start or end with /, or contain //';
+  }
+  if (value.endsWith('.')) {
+    return 'Branch may not end with .';
+  }
+  for (const part of value.split('/')) {
+    if (part.startsWith('.')) {
+      return 'No part of a branch name may start with .';
+    }
+    if (part.endsWith('.lock')) {
+      return 'No part of a branch name may end with .lock';
+    }
+  }
+  return null;
+}
+
+/**
+ * An NPM package id. This one is not about git at all: the package id and the
+ * version are concatenated into file names under the zips directory
+ * (<id>#<version>.log, <id>#<version>-announcement.txt), so a value containing
+ * a path separator would look outside that directory.
+ */
+function validatePackageId(value) {
+  if (!value) {
+    return 'NPM package id is required';
+  }
+  if (value.length > MAX_PACKAGE_ID) {
+    return `NPM package id must be ${MAX_PACKAGE_ID} characters or less`;
+  }
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(value)) {
+    return 'NPM package id may only contain letters, digits, dots, hyphens and underscores, and must start with a letter or digit';
+  }
+  if (value.includes('..')) {
+    return 'NPM package id may not contain ..';
+  }
+  return null;
+}
+
+/**
+ * A package version. Loose enough for semver with pre-release and build
+ * metadata, tight enough that it can't become a path.
+ */
+function validateVersion(value) {
+  if (!value) {
+    return 'Version is required';
+  }
+  if (value.length > MAX_VERSION) {
+    return `Version must be ${MAX_VERSION} characters or less`;
+  }
+  if (!/^[A-Za-z0-9][A-Za-z0-9.+-]*$/.test(value)) {
+    return 'Version may only contain letters, digits, dots, hyphens and plus signs, and must start with a letter or digit';
+  }
+  if (value.includes('..')) {
+    return 'Version may not contain ..';
+  }
+  return null;
+}
+
+/**
+ * Validate everything the task form collects.
+ * @returns {string[]} the problems found, empty if the input is acceptable
+ */
+function validateTaskInput(input) {
+  const errors = [];
+  const checks = [
+    validateGithubOwner(input.github_org),
+    validateGithubRepo(input.github_repo),
+    validateGitBranch(input.git_branch),
+    validatePackageId(input.npm_package_id),
+    validateVersion(input.version)
+  ];
+  for (const error of checks) {
+    if (error) {
+      errors.push(error);
+    }
+  }
+  return errors;
+}
+
+// Patterns for the HTML form, so the browser objects before the round trip.
+// Deliberately a subset of the checks above - the server is what decides -
+// but they catch the obvious mistakes as the user types.
+const HTML_PATTERNS = {
+  github_org: '[A-Za-z0-9](-?[A-Za-z0-9])*',
+  github_repo: '[A-Za-z0-9._-]+',
+  git_branch: '[^\\\\ ~^:?*\\[]+',
+  npm_package_id: '[A-Za-z0-9][A-Za-z0-9._-]*',
+  version: '[A-Za-z0-9][A-Za-z0-9.+-]*'
+};
+
+module.exports = {
+  validateGithubOwner,
+  validateGithubRepo,
+  validateGitBranch,
+  validatePackageId,
+  validateVersion,
+  validateTaskInput,
+  HTML_PATTERNS
+};

package/server.js

@@ -99,13 +99,13 @@ let stats = null;
 
 // Initialize modules based on configuration
 async function initializeModules() {
-  stats = new ServerStats();
+  stats = new ServerStats(config.stats, serverLog);
 
   // Initialize SHL module
   if (config.modules?.shl?.enabled) {
     try {
       serverLog.info('Initializing module: shl...');
-      modules.shl = new SHLModule(stats);
+      modules.shl = new SHLModule(stats.forModule('shl'));
       await modules.shl.initialize(config.modules.shl);
       app.use('/shl', modules.shl.router);
     } catch (error) {
@@ -118,7 +118,7 @@ async function initializeModules() {
   if (config.modules?.vcl?.enabled) {
     try {
       serverLog.info('Initializing module: vcl...');
-      modules.vcl = new VCLModule(stats);
+      modules.vcl = new VCLModule(stats.forModule('vcl'));
       await modules.vcl.initialize(config.modules.vcl);
       app.use('/VCL', modules.vcl.router);
     } catch (error) {
@@ -131,7 +131,7 @@ async function initializeModules() {
   if (config.modules?.xig?.enabled) {
     try {
       serverLog.info('Initializing module: xig...');
-      await xigModule.initializeXigModule(stats, config.modules.xig);
+      await xigModule.initializeXigModule(stats.forModule('xig'), config.modules.xig);
       app.use('/xig', xigModule.router);
       modules.xig = xigModule;
     } catch (error) {
@@ -144,7 +144,7 @@ async function initializeModules() {
   if (config.modules?.packages?.enabled) {
     try {
       serverLog.info('Initializing module: packages...');
-      modules.packages = new PackagesModule(stats);
+      modules.packages = new PackagesModule(stats.forModule('packages'));
       await modules.packages.initialize(config.modules.packages);
       app.use('/packages', modules.packages.router);
     } catch (error) {
@@ -158,7 +158,7 @@ async function initializeModules() {
   if (config.modules?.registry?.enabled) {
     try {
       serverLog.info('Initializing module: registry...');
-      modules.registry = new RegistryModule(stats);
+      modules.registry = new RegistryModule(stats.forModule('registry'));
       await modules.registry.initialize(config.modules.registry);
       app.use('/tx-reg', modules.registry.router);
     } catch (error) {
@@ -171,7 +171,7 @@ async function initializeModules() {
   if (config.modules?.publisher?.enabled) {
     try {
       serverLog.info('Initializing module: publisher...');
-      modules.publisher = new PublisherModule(stats);
+      modules.publisher = new PublisherModule(stats.forModule('publisher'));
       await modules.publisher.initialize(config.modules.publisher);
       app.use('/publisher', modules.publisher.router);
     } catch (error) {
@@ -184,7 +184,7 @@ async function initializeModules() {
   if (config.modules?.token?.enabled) {
     try {
       serverLog.info('Initializing module: token...');
-      modules.token = new TokenModule(stats);
+      modules.token = new TokenModule(stats.forModule('token'));
       await modules.token.initialize(config.modules.token);
       app.use('/token', modules.token.router);
     } catch (error) {
@@ -197,7 +197,7 @@ async function initializeModules() {
   if (config.modules?.npmprojector?.enabled) {
     try {
       serverLog.info('Initializing module: npmprojector...');
-      modules.npmprojector = new NpmProjectorModule(stats);
+      modules.npmprojector = new NpmProjectorModule(stats.forModule('npmprojector'));
       await modules.npmprojector.initialize(config.modules.npmprojector);
       const basePath = NpmProjectorModule.getBasePath(config.modules.npmprojector);
       app.use(basePath, modules.npmprojector.router);
@@ -211,7 +211,7 @@ async function initializeModules() {
   if (config.modules?.['ext-tracker']?.enabled) {
     try {
       serverLog.info('Initializing module: ext-tracker...');
-      modules.extTracker = new ExtensionTrackerModule(stats);
+      modules.extTracker = new ExtensionTrackerModule(stats.forModule('ext-tracker'));
       await modules.extTracker.initialize(config.modules['ext-tracker'], app);
     } catch (error) {
       serverLog.error('Failed to initialize extension tracker module:', error);
@@ -224,7 +224,7 @@ async function initializeModules() {
   if (config.modules?.tx?.enabled) {
     try {
       serverLog.info('Initializing module: tx...');
-      modules.tx = new TXModule(stats);
+      modules.tx = new TXModule(stats.forModule('tx'));
       await modules.tx.initialize(config.modules.tx, app);
     } catch (error) {
       serverLog.error('Failed to initialize TX module:', error);
@@ -235,7 +235,7 @@ async function initializeModules() {
   if (config.modules?.folder?.enabled) {
     try {
       serverLog.info('Initializing module: folder...');
-      modules.folder = new FolderModule(stats);
+      modules.folder = new FolderModule(stats.forModule('folder'));
       await modules.folder.initialize(config.modules.folder, app);
       // mount the router
     } catch (error) {