fhirsmith 0.14.2 → 0.15.1

package/packages/utilities/dedupe-versions.js

@@ -0,0 +1,242 @@
+#!/usr/bin/env node
+//
+// Copyright 2026, Health Intersections Pty Ltd (http://www.healthintersections.com.au)
+//
+// Licensed under BSD-3: https://opensource.org/license/bsd-3-clause
+//
+
+/**
+ * One-off repair of a package server's database and mirror, for a database built before
+ * the crawler stored each id#version only once.
+ *
+ *   node packages/utilities/dedupe-versions.js -db <packages.db> -mirror <mirror folder> [-apply] [-verbose]
+ *
+ * Without -apply it reports what it would do and changes nothing. Back up the database
+ * first. It is safe to run while the server is up, but best between crawler runs. It can be
+ * run with sudo: rewritten mirror files keep the owner, group and mode of the files they replace.
+ *
+ * 1. Duplicate rows. For each id#version stored more than once, it keeps one row, using the
+ *    crawler's rule: a direct copy beats a Simplifier copy (a secondary echo); otherwise the
+ *    first stored wins. Two direct copies with different content are a conflict - only their
+ *    Simplifier rows are removed, and they are listed for manual cleanup. Deleted rows'
+ *    download counts are added to the kept row.
+ * 2. The unique index on (Id, Version), once there are no duplicates left.
+ * 3. The mirror. Every row's mirror file must be the bytes that row's Hash describes; a file
+ *    that is missing or different is rewritten from the row's Content. Conflicts are skipped.
+ *    The report separates the two: a different file is served with the wrong checksum; a
+ *    missing one isn't served at all. -verbose lists every missing file.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+// node:sqlite (built into Node 24) rather than an npm package, so this file runs on its own:
+// copy it to the server and run it with node, no install needed
+const { DatabaseSync } = require('node:sqlite');
+
+const UNIQUE_INDEX = 'CREATE UNIQUE INDEX IF NOT EXISTS SK_PackageVersions_IdVersion ON PackageVersions (Id, Version)';
+
+// These two must match PackageCrawler.isSimplifierGuid and PackageCrawler.fixPrefix
+// (tests/packages/package-crawler-versions.test.js checks that they do)
+function isSimplifier(guid) {
+  return /^https?:\/\/packages\.simplifier\.net\//i.test(guid || '');
+}
+
+function fixPrefix(id) {
+  return id && id.startsWith('@') && id.includes('/') ? id.replace('@', '$$').replace('/', '$') : id;
+}
+
+const mirrorName = (id, version) => `${fixPrefix(id)}-${version}.tgz`;
+
+// When run with sudo, a rewritten file would otherwise belong to root. Give it the owner,
+// group and mode of the file it replaces (or of the mirror folder, for a missing file).
+function keepOwnership(file, like) {
+  const st = fs.statSync(like);
+  if (process.getuid && process.getuid() === 0) {
+    fs.chownSync(file, st.uid, st.gid);
+  }
+  fs.chmodSync(file, st.isDirectory() ? st.mode & 0o666 : st.mode & 0o7777);
+}
+const sha1 = buf => crypto.createHash('sha1').update(buf).digest('hex');
+
+// Which rows of one id#version to keep and delete. rows are in PackageVersionKey order.
+function plan(rows) {
+  const direct = rows.filter(r => !isSimplifier(r.GUID));
+  if (direct.length === 0) {
+    return { keep: [rows[0]], conflict: false };
+  }
+  if (new Set(direct.map(r => r.Hash)).size === 1) {
+    return { keep: [direct[0]], conflict: false };
+  }
+  return { keep: direct, conflict: true };
+}
+
+function dedupe({ dbPath, mirrorPath, apply = false, verbose = false, log = console.log }) {
+  if (!fs.existsSync(dbPath)) {
+    throw new Error(`No database at ${dbPath}`); // DatabaseSync would create an empty one
+  }
+  const db = new DatabaseSync(dbPath);
+  db.exec('PRAGMA busy_timeout = 10000');
+  const report = { groups: 0, deleted: [], conflicts: [], indexCreated: false, mirror: { checked: 0, ok: 0, rewritten: [], badContent: [] } };
+
+  try {
+    // 1. duplicate rows
+    const groups = db.prepare('SELECT Id, Version FROM PackageVersions GROUP BY Id, Version HAVING COUNT(*) > 1').all();
+    const rowsOf = db.prepare(`SELECT PackageVersionKey, GUID, Hash, DownloadCount FROM PackageVersions
+                               WHERE Id = ? AND Version = ? ORDER BY PackageVersionKey`);
+    const changes = [];
+    for (const g of groups) {
+      const rows = rowsOf.all(g.Id, g.Version);
+      const { keep, conflict } = plan(rows);
+      const del = rows.filter(r => !keep.includes(r));
+      if (conflict) {
+        report.conflicts.push({ id: g.Id, version: g.Version, kept: keep.map(r => r.GUID) });
+      }
+      if (del.length > 0) {
+        changes.push({ id: g.Id, version: g.Version, keep: keep[0], del });
+        for (const r of del) {
+          report.deleted.push({ id: g.Id, version: g.Version, guid: r.GUID, keptGuid: keep[0].GUID });
+        }
+      }
+    }
+    report.groups = groups.length;
+    const toDelete = new Set(changes.flatMap(c => c.del.map(r => r.PackageVersionKey)));
+    const conflicted = new Set(report.conflicts.map(c => `${c.id}#${c.version}`));
+
+    if (apply && changes.length > 0) {
+      const delRelated = ['PackageFHIRVersions', 'PackageDependencies', 'PackageURLs']
+        .map(t => db.prepare(`DELETE FROM ${t} WHERE PackageVersionKey = ?`));
+      const delRow = db.prepare('DELETE FROM PackageVersions WHERE PackageVersionKey = ?');
+      const addCount = db.prepare('UPDATE PackageVersions SET DownloadCount = DownloadCount + ? WHERE PackageVersionKey = ?');
+      const latest = db.prepare(`SELECT PackageVersionKey, Canonical FROM PackageVersions
+                                 WHERE Id = ? AND Version != 'current' ORDER BY PubDate DESC, Version DESC LIMIT 1`);
+      const setCurrent = db.prepare('UPDATE Packages SET CurrentVersion = ?, Canonical = ? WHERE Id = ?');
+      db.exec('BEGIN IMMEDIATE');
+      try {
+        const ids = new Set();
+        for (const c of changes) {
+          for (const r of c.del) {
+            delRelated.forEach(s => s.run(r.PackageVersionKey));
+            delRow.run(r.PackageVersionKey);
+            addCount.run(r.DownloadCount || 0, c.keep.PackageVersionKey);
+          }
+          ids.add(c.id);
+        }
+        for (const id of ids) {
+          const l = latest.get(id);
+          if (l) {
+            setCurrent.run(l.PackageVersionKey, l.Canonical, id);
+          }
+        }
+        db.exec('COMMIT');
+      } catch (e) {
+        db.exec('ROLLBACK');
+        throw e;
+      }
+    }
+    log(`${report.groups} id#versions stored more than once; ${report.deleted.length} rows ${apply ? 'deleted' : 'to delete'}; ${report.conflicts.length} conflicts left for manual cleanup`);
+    for (const c of report.conflicts) {
+      log(`  conflict: ${c.id}#${c.version} has different direct copies: ${c.kept.join(', ')}`);
+    }
+
+    // 2. unique index
+    const remaining = db.prepare('SELECT COUNT(*) AS n FROM (SELECT 1 FROM PackageVersions GROUP BY Id, Version HAVING COUNT(*) > 1)').get().n;
+    if (apply && remaining === 0) {
+      db.exec(UNIQUE_INDEX);
+      report.indexCreated = true;
+      log('unique index on (Id, Version) created');
+    } else if (remaining > 0) {
+      log(`unique index on (Id, Version) not created: ${apply ? remaining : report.groups} id#versions still duplicated`);
+    }
+
+    // 3. mirror
+    if (mirrorPath) {
+      const content = db.prepare('SELECT Content FROM PackageVersions WHERE PackageVersionKey = ?');
+      for (const row of db.prepare('SELECT PackageVersionKey, Id, Version, Hash FROM PackageVersions ORDER BY Id, Version').iterate()) {
+        if (toDelete.has(row.PackageVersionKey)) {
+          continue; // a dry run, and -apply would delete this row
+        }
+        if (conflicted.has(`${row.Id}#${row.Version}`)) {
+          continue; // two rows share the file; left for manual cleanup
+        }
+        report.mirror.checked++;
+        const file = path.join(mirrorPath, mirrorName(row.Id, row.Version));
+        const actual = fs.existsSync(file) ? sha1(fs.readFileSync(file)) : null;
+        if (actual === row.Hash) {
+          report.mirror.ok++;
+          continue;
+        }
+        const buf = Buffer.from(content.get(row.PackageVersionKey).Content);
+        if (sha1(buf) !== row.Hash) {
+          report.mirror.badContent.push(`${row.Id}#${row.Version}`);
+          continue;
+        }
+        report.mirror.rewritten.push({ id: row.Id, version: row.Version, was: actual || 'missing', hash: row.Hash });
+        if (apply) {
+          const tmp = `${file}.tmp-${process.pid}`;
+          fs.writeFileSync(tmp, buf);
+          keepOwnership(tmp, fs.existsSync(file) ? file : mirrorPath);
+          fs.renameSync(tmp, file);
+        }
+      }
+      const missing = report.mirror.rewritten.filter(r => r.was === 'missing');
+      const different = report.mirror.rewritten.filter(r => r.was !== 'missing');
+      const will = apply ? 'was written' : 'will be written';
+      log(`mirror ${mirrorPath}: ${report.mirror.checked} database rows checked against their mirror file`);
+      log(`  ${report.mirror.ok} files match the database`);
+      log(`  ${missing.length} files are missing from the mirror: the package is in the database, so the file ${will} from it`);
+      if (missing.length > report.mirror.checked / 2) {
+        log('    (most of the mirror is missing: check that -mirror is the folder the server\'s mirrorPath setting names)');
+      }
+      for (const r of verbose ? missing : missing.slice(0, 5)) {
+        log(`    ${r.id}#${r.version}`);
+      }
+      if (!verbose && missing.length > 5) {
+        log(`    ... and ${missing.length - 5} more (-verbose lists them all)`);
+      }
+      log(`  ${different.length} files differ from the database - these are the ones served with the wrong checksum; each ${will} from the database`);
+      for (const r of different) {
+        log(`    ${r.id}#${r.version}: file sha1 ${r.was}, database ${r.hash}`);
+      }
+      if (report.mirror.badContent.length > 0) {
+        log(`  ${report.mirror.badContent.length} database rows whose content doesn't match their own hash - not touched:`);
+        for (const b of report.mirror.badContent) {
+          log(`    ${b}`);
+        }
+      }
+    }
+  } finally {
+    db.close();
+  }
+  return report;
+}
+
+function main(argv) {
+  const arg = name => {
+    const i = argv.indexOf(name);
+    return i >= 0 ? argv[i + 1] : undefined;
+  };
+  const dbPath = arg('-db');
+  const mirrorPath = arg('-mirror');
+  if (!dbPath) {
+    console.error('usage: node packages/utilities/dedupe-versions.js -db <packages.db> [-mirror <mirror folder>] [-apply] [-verbose]');
+    return 1;
+  }
+  const apply = argv.includes('-apply');
+  if (!apply) {
+    console.log('Dry run: nothing will be changed (use -apply)');
+  }
+  try {
+    dedupe({ dbPath, mirrorPath, apply, verbose: argv.includes('-verbose') });
+  } catch (e) {
+    console.error(e.message);
+    return 1;
+  }
+  return 0;
+}
+
+if (require.main === module) {
+  process.exitCode = main(process.argv.slice(2));
+}
+
+module.exports = { dedupe, plan, isSimplifier, fixPrefix };

package/registry/crawler.js

@@ -339,6 +339,20 @@ class RegistryCrawler {
     return version;
   }
 
+  /**
+   * CapabilityStatement.software.releaseDate, if it means anything. A date within a few
+   * minutes of now is the server's clock, not a release date: FHIRsmith up to 0.14.2 filled
+   * it in with the time of the request, and other software may do the same.
+   */
+  reportedReleaseDate(software, now = Date.now()) {
+    const value = software && software.releaseDate;
+    const t = value ? new Date(value).getTime() : NaN;
+    if (isNaN(t) || Math.abs(now - t) < 10 * 60 * 1000) {
+      return '';
+    }
+    return String(value);
+  }
+
   /**
    * A server that can't be reached this time is still running whatever it was running
    * last time we saw it - keep that, so the software page doesn't lose track of it
@@ -353,6 +367,7 @@ class RegistryCrawler {
           if (prev.address === version.address && prev.software) {
             version.software = prev.software;
             version.softwareVersion = prev.softwareVersion || '';
+            version.softwareReleaseDate = prev.softwareReleaseDate || '';
             return;
           }
         }
@@ -371,6 +386,7 @@ class RegistryCrawler {
     version.version = capability.fhirVersion || '3.0.2';
     version.software = capability.software ? capability.software.name : "unknown";
     version.softwareVersion = capability.software && capability.software.version ? String(capability.software.version) : '';
+    version.softwareReleaseDate = this.reportedReleaseDate(capability.software);
 
     // Get terminology capabilities (R3 uses Parameters resource)
     try {
@@ -416,6 +432,7 @@ class RegistryCrawler {
     version.version = capability.fhirVersion || defVersion;
     version.software = capability.software ? capability.software.name : "unknown";
     version.softwareVersion = capability.software && capability.software.version ? String(capability.software.version) : '';
+    version.softwareReleaseDate = this.reportedReleaseDate(capability.software);
 
     let set = new Set();
 

package/registry/fhirsmith-releases.js

@@ -6,7 +6,7 @@
 // succeeds (or if it can't be reached), the dated headings in this server's own
 // CHANGELOG.md are used instead - those only go up to this server's own version.
 
-const fs = require('fs');
+const { readReleaseDates } = require('../library/changelog');
 const path = require('path');
 const axios = require('axios');
 
@@ -72,12 +72,9 @@ class FhirsmithReleases {
    */
   loadFromChangelog(changelogPath = path.join(__dirname, '..', 'CHANGELOG.md')) {
     try {
-      const text = fs.readFileSync(changelogPath, 'utf8');
       const list = [];
-      const re = /^##\s*\[v?(\d+\.\d+\.\d+)\]\s*-\s*(\d{4}-\d{2}-\d{2})\s*$/gm;
-      let m;
-      while ((m = re.exec(text)) !== null) {
-        list.push({ version: m[1], date: new Date(m[2] + 'T00:00:00Z') });
+      for (const [version, date] of readReleaseDates(changelogPath)) {
+        list.push({ version, date: new Date(date + 'T00:00:00Z') });
       }
       this.setReleases(list, 'CHANGELOG.md');
     } catch (error) {

package/registry/model.js

@@ -12,6 +12,7 @@ class ServerVersionInformation {
     this.lastTat = '';
     this.software = ''; // what software is running
     this.softwareVersion = ''; // CapabilityStatement.software.version, if the server reports one
+    this.softwareReleaseDate = ''; // CapabilityStatement.software.releaseDate, if it is a real date
     this.codeSystems = []; // Array of strings (sorted, unique)
     this.valueSets = []; // Array of strings (sorted, unique)
   }
@@ -60,6 +61,7 @@ class ServerVersionInformation {
       terminologies: this.codeSystems,
       software: this.software,
       'software-version': this.softwareVersion,
+      'software-release-date': this.softwareReleaseDate,
       valuesets: this.valueSets
     };
   }
@@ -74,6 +76,7 @@ class ServerVersionInformation {
     instance.lastTat = json.lastTat || '';
     instance.software = json.software;
     instance.softwareVersion = json['software-version'] || '';
+    instance.softwareReleaseDate = json['software-release-date'] || '';
     instance.codeSystems = json.terminologies || [];
     instance.valueSets = json.valuesets || [];
     return instance;

package/registry/registry.js

@@ -512,6 +512,7 @@ class RegistryModule {
             fhirVersion: version.version || '',
             software: version.software && version.software !== 'unknown' ? version.software : '',
             softwareVersion: version.softwareVersion || '',
+            softwareReleaseDate: version.softwareReleaseDate || '',
             error: version.error,
             lastSuccess: version.lastSuccess
           });
@@ -556,7 +557,7 @@ class RegistryModule {
 
   _renderReleaseCells(row, now) {
     if (!isFhirsmith(row.software) || !this.releases) {
-      return '<td></td><td></td>';
+      return this._renderReportedReleaseCells(row, now);
     }
     const d = this.releases.describe(row.softwareVersion, now);
     const behind = d.behind ? ` (${d.behind} release${d.behind === 1 ? '' : 's'} behind)` : '';
@@ -571,11 +572,35 @@ class RegistryModule {
           `<td><span class="${cls}">${describeAge(d.ageDays)}${behind}</span></td>`;
       }
       case 'dev':
-        return '<td></td><td>development build' +
+        return `<td>${this._reportedReleaseDay(row)}</td><td>development build` +
           (d.release ? ` after v${escape(d.release.version)}` : '') + behind + '</td>';
       default:
-        return '<td></td><td><i>unknown</i></td>';
+        return this._renderReportedReleaseCells(row, now);
+    }
+  }
+
+  // what the server says about its release (CapabilityStatement.software.releaseDate) -
+  // the only source for software other than FHIRsmith
+  _reportedReleaseDay(row) {
+    const value = row.softwareReleaseDate || '';
+    const m = /^(\d{4}-\d{2}-\d{2})/.exec(value);
+    if (!m) {
+      return '';
+    }
+    // a date is the day as given. A dateTime is an instant, and different servers running
+    // the same release report it in their own time zones (2026-09-05T00:37:46+10:00 and
+    // 2026-09-04T16:37:46+02:00), so the day is the UTC day, to be the same for all of them
+    const t = value.length > 10 ? new Date(value).getTime() : NaN;
+    return isNaN(t) ? m[1] : new Date(t).toISOString().substring(0, 10);
+  }
+
+  _renderReportedReleaseCells(row, now) {
+    const day = this._reportedReleaseDay(row);
+    if (!day) {
+      return '<td></td><td></td>';
     }
+    const days = Math.max(0, Math.floor((now - new Date(row.softwareReleaseDate).getTime()) / (24 * 60 * 60 * 1000)));
+    return `<td>${day}</td><td>${describeAge(days)}</td>`;
   }
 
   /**

package/translations/Messages.properties

@@ -377,6 +377,8 @@ HTA_LOINC_DESC = LOINC
 HTA_LOINC_MESSAGE = This material contains content from <a href="http://loinc.org">LOINC</a>. LOINC is copyright &copy; 1995-2020, Regenstrief Institute, Inc. and the Logical Observation Identifiers Names and Codes (LOINC) Committee and is available at no cost under the <a href="http://loinc.org/license">license</a>. LOINC&reg; is a registered United States trademark of Regenstrief Institute, Inc.
 HTA_SCT_DESC = SNOMED Clinical Terms&reg; (SNOMED CT&reg;)
 HTA_SCT_MESSAGE = This material contains content that is copyright of SNOMED International. Implementers of these specifications must have the appropriate SNOMED CT Affiliate license - for more information contact <a href="https://www.snomed.org/get-snomed">https://www.snomed.org/get-snomed</a> or <a href="mailto:info@snomed.org">info@snomed.org</a>.
+ICD11_PC_NO_AXES = ''{0}'' cannot be postcoordinated onto ''{1}'': that concept declares no postcoordination axes
+ICD11_PC_VALUE_NOT_ON_AXIS = ''{0}'' is not a permitted value on any postcoordination axis of ''{1}''. That stem declares: {2}
 IG_DEPENDENCY_CAN_VERSION_ALONE = The canonical URL specifies the version ''{0}'', while the dependency does not. If a version is specified, it must be in the explicit version property
 IG_DEPENDENCY_CAN_VERSION_ERROR = The canonical URL specifies the version ''{0}'', while the dependency has version ''{1}''. If a version is specified, it must be the same as in the explicit version property 
 IG_DEPENDENCY_CAN_VERSION_NONE = The canonical URL cannot end in ''|''
@@ -1441,6 +1443,7 @@ TEXT_LINK_SELECTOR_INVALID = The textLink selector ''{0}'' is invalid: {1}
 SD_CONTEXT_SHOULD_ELEMENT_NOT_FOUND = The element {0} is not valid
 SD_CONTEXT_SHOULD_ELEMENT_NOT_FOUND_VER = The element {0} is not valid in version {1}
 FILTER_NOT_UNDERSTOOD = The filter "{0} {1} {2}" is not understood or supported
+FILTER_VALUE_UNKNOWN_CODE = The filter value ''{0}'' is not a code in {1}
 XHTML_CONTROL_NO_SOURCE = The xhtml node at ''{0}'' does not have a class attribute to indicate its source (boilerplate, generated, or original) and this is required by the profile {1}
 XHTML_XHTML_MIXED_LANG = The xhtml has some language sections ({0}), and also has content that is not in a language section
 XHTML_CONTROL_NO_LANGS = The xhtml has some language sections ({0}), but language sections are prohibited in this context by the profile {1}

package/tx/README.md

@@ -237,12 +237,28 @@ shouldn't be - too big. Note that that files in the list below are considered to
 Each source entry follows the format:
 
 ```
-type[!]:details
+type[!]:details[=prefix]
 ```
 
 - **type**: The source type (see Source Types below)
 - **!** (optional): Append to type to mark this source as the default for its code system. When multiple versions of the same code system are loaded, the default is used when no version is specified.
 - **details**: Type-specific configuration (filename, package name, or internal provider name)
+- **prefix** (optional): The id prefix for the resources the source provides - see [Resource Ids](#resource-ids). Everything after the last `=` in the entry is the prefix, so a `url` source whose url contains a `=` must give one.
+
+### Resource Ids
+
+Every CodeSystem, ValueSet and ConceptMap is served with an id in the id space of the source it came from: the source's prefix, `-`, and the id the resource has in the source. With
+
+```yaml
+- npm:hl7.terminology=tho
+```
+
+THO's v3-ActCode code system is `CodeSystem/tho-v3-ActCode`. No resource is served on the id it has in its source - different sources can use the same ids (hl7.terminology and the FHIR core packages both have a CodeSystem `v3-MaritalStatus`), so an unprefixed id can't say which one is meant, and it finds nothing.
+
+- A prefix may contain letters, digits and `.` (no `-`), up to 32 characters, and each prefix may only be given once
+- If a source isn't given a prefix, it gets a number. Numbers depend on the order of the sources (and on which sources provide which kinds of resource), so they change when the YAML changes. Give every source that provides resources a prefix if its ids should stay the same - i.e. on any server where people link to resources by id
+- `core` is the FHIR core package each endpoint loads for its FHIR version (`CodeSystem/core-administrative-gender`), and `x` is the code systems the server implements natively (`CodeSystem/x-...`); neither can be given as a prefix
+- Sources that only provide code systems natively (`internal`, `snomed`, `loinc` etc.) don't serve resources by id, so a prefix does nothing for them
 
 ### Source Types
 
@@ -464,9 +480,9 @@ sources:
   - snomed:sct_us_20250901.cache
   
   # FHIR packages
-  - npm:hl7.terminology
-  - npm:hl7.fhir.us.core
-  - npm:us.nlm.vsac
+  - npm:hl7.terminology=tho
+  - npm:hl7.fhir.us.core=us
+  - npm:us.nlm.vsac=vsac
 ```
 
 Also see tx.fhir.org.yml for the production configuration for tx.fhir.org

package/tx/cm/cm-api.js

@@ -1,22 +1,37 @@
+const { assignIdSpace } = require('../library/resource-ids');
+
 /**
  * Abstract base class for Concept Map providers
  * Defines the interface that all Concept Map providers must implement
  */
 class AbstractConceptMapProvider {
   /**
-   * {int} Unique number assigned to this provider
+   * {string} The prefix of this provider's id space (set by assignIds) - given for its source in the library
+   * YAML, autonumbered, or 'core' for an endpoint's core package. Every concept map this
+   * provider provides has an id that starts with spaceId + '-' (see tx/library/resource-ids.js)
    */
   spaceId;
 
   /**
-   * ensure that the ids on the Concept Maps are unique, if they are
-   * in the global namespace
+   * Put this provider in an id space: set spaceId, and prefix the ids of the concept maps it
+   * provides with spaceId + '-'. A provider is put in one id space, once - asking for a
+   * different one later is an error (see assignIdSpace)
    *
-   * @param {Set<String>} ids
+   * @param {string} spaceId
    */
-  // eslint-disable-next-line no-unused-vars
-  assignIds(ids) {
-    throw new Error('assignIds must be implemented by AbstractConceptMapProvider subclass');
+  assignIds(spaceId) {
+    if (assignIdSpace(this, spaceId)) {
+      this.prefixIds();
+    }
+  }
+
+  /**
+   * Prefix the ids of the concept maps this provider provides with spaceId + '-', once spaceId
+   * is set (by assignIds). Concept maps the provider loads later must be given ids
+   * in the same space.
+   */
+  prefixIds() {
+    throw new Error('prefixIds must be implemented by AbstractConceptMapProvider subclass');
   }
 
   /**
@@ -32,11 +47,11 @@ class AbstractConceptMapProvider {
   }
 
   /**
-   * Fetches a specific Concept Map by id. ConceptMap providers must enforce that Concept Map ids are unique
-   * either globally (as enforced by assignIds) or in their space
+   * Fetches a specific Concept Map by id. The id is in this provider's space (spaceId + '-' +
+   * the concept map's own id); an id that isn't - including an unprefixed one - finds nothing
    *
    * @param {string} id - The id of the Concept Map
-   * @returns {Promise<ConceptMap>} The requested Concept Map
+   * @returns {Promise<ConceptMap>} The requested Concept Map, or null
    * @throws {Error} Must be implemented by subclasses
    */
   // eslint-disable-next-line no-unused-vars

package/tx/cm/cm-database.js

@@ -733,10 +733,6 @@ class ConceptMapDatabase {
     return { query, params };
   }
 
-  // eslint-disable-next-line no-unused-vars
-  assignIds(ids) {
-    // nothing - we don't do any assigning.
-  }
 }
 
 module.exports = {

package/tx/cm/cm-package.js

@@ -5,6 +5,7 @@ const { ConceptMapDatabase } = require('./cm-database');
 const { VersionUtilities } = require('../../library/version-utilities');
 const {validateParameter} = require("../../library/utilities");
 const {ConceptMap} = require("../library/conceptmap");
+const { applyIdPrefix, stripIdPrefix } = require('../library/resource-ids');
 
 /**
  * Package-based ConceptMap provider using shared database layer
@@ -34,6 +35,7 @@ class PackageConceptMapProvider extends AbstractConceptMapProvider {
     if (this.initialized) {
       return;
     }
+    await this.packageLoader.initialize();
 
     const dbExists = await this.database.exists();
 
@@ -43,6 +45,8 @@ class PackageConceptMapProvider extends AbstractConceptMapProvider {
     }
 
     this.conceptMapMap = await this.database.loadAllConceptMaps();
+    // nothing, unless the spaceId was assigned before the provider was initialized
+    this.#applyIdPrefix();
     this.initialized = true;
   }
 
@@ -128,7 +132,9 @@ class PackageConceptMapProvider extends AbstractConceptMapProvider {
     this._validateSearchParams(searchParams);
 
     if (this.USE_DATABASE_SEARCH) {
-      return await this.database.search(this.spaceId, searchParams, elements);
+      const results = await this.database.search(this.spaceId, searchParams, elements);
+      return this.#excludedIds.size === 0 ? results
+        : results.filter(r => !this.#excludedIds.has(stripIdPrefix(r.id, this.spaceId)));
     } else {
       const matches = [];
       const seen = new Set(); // Track by URL to avoid duplicates from versioned keys
@@ -194,9 +200,8 @@ class PackageConceptMapProvider extends AbstractConceptMapProvider {
 
         if (isMatch) {
           seen.add(vsUrl);
-          // Return with prefixed id
-          const result = { ...json, id: `${this.spaceId}-${json.id}` };
-          matches.push(result);
+          // the id is already prefixed (see assignIds)
+          matches.push(json);
         }
       }
 
@@ -298,19 +303,53 @@ class PackageConceptMapProvider extends AbstractConceptMapProvider {
   }
 
   async fetchConceptMapById(id) {
-    if (!this.spaceId) {
-      return this.conceptMapMap.get(id);
-    } else if (id.startsWith(this.spaceId+"-")) {
-      let key = id.substring(this.spaceId.length + 1);
-      return this.conceptMapMap.get(key);
-    } else {
-      return null;
+    // the map is keyed by the concept map's own id (and its url); the concept map itself
+    // carries the prefixed id, which is how a url key that happens to match is excluded
+    const cm = this.conceptMapMap.get(stripIdPrefix(id, this.spaceId));
+    return cm && cm.id === id ? cm : null;
+  }
+
+  sourcePackage() {
+    return this.packageLoader.id();
+  }
+
+  // the concept maps left out by excludeUrls, by their own (unprefixed) id
+  #excludedIds = new Set();
+
+  /**
+   * Leave out the concept maps with any of these urls: they can't be fetched, they aren't
+   * found by search, and they aren't used for translation. The FHIR core package's concept
+   * maps are left out where hl7.terminology provides the same url (see
+   * Provider.applyTHOPrecedence). Must be called once the provider is initialized - the
+   * database is shared, so it isn't changed.
+   *
+   * @param {Set<string>} urls
+   */
+  excludeUrls(urls) {
+    const excluded = new Set();
+    for (const cm of this.conceptMapMap.values()) {
+      if (cm && urls.has(cm.url)) {
+        excluded.add(cm);
+      }
+    }
+    for (const [key, cm] of [...this.conceptMapMap]) {
+      if (excluded.has(cm)) {
+        this.conceptMapMap.delete(key);
+      }
     }
+    for (const cm of excluded) {
+      this.#excludedIds.add(stripIdPrefix(cm.id, this.spaceId) ?? cm.id);
+    }
+  }
+
+  prefixIds() {
+    this.#applyIdPrefix();
   }
 
-  // eslint-disable-next-line no-unused-vars
-  assignIds(ids) {
-    // nothing - we don't do any assigning.
+  #applyIdPrefix() {
+    for (const cm of new Set(this.conceptMapMap.values())) {
+      applyIdPrefix(cm, this.spaceId);
+    }
   }
 
   async findConceptMapForTranslation(opContext, conceptMaps, sourceSystem, sourceScope, targetScope, targetSystem) {

package/tx/cs/cs-api.js

@@ -74,7 +74,12 @@ class CodeSystemProvider {
    * the others report "LOINC".
    * @returns {string} display name for the code system
    */
-  name() { return this.system() + (this.version() ? "|"+this.version() : "") }
+  /**
+   * @param {Languages} [languages] - the request's working languages, for a provider whose name
+   *   is translated; the default ignores them
+   */
+  // eslint-disable-next-line no-unused-vars
+  name(languages) { return this.system() + (this.version() ? "|"+this.version() : "") }
 
   /**
    * @returns {string} uri for the code system