fhirsmith 0.15.0 → 0.16.0

package/CHANGELOG.md

@@ -5,6 +5,56 @@ All notable changes to Health Intersections FHIRsmith will be documented in this
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.16.0] - 2026-10-15
+
+### Security
+- 
+- Token: the login session store is now FHIRsmith's own (`library/sqlite-session-store.js`), in place of connect-sqlite3. connect-sqlite3 depends on sqlite3 5, which brought node-gyp 8, tar 6 and @tootallnate/once into every npm install of FHIRsmith (12 advisories, one critical). The `overrides` in package.json kept them out of a clone + `npm ci` (and so out of the Docker image and the repo's own `npm audit`), but npm ignores overrides when installing the published package, so `npm install -g fhirsmith` still got them. Sessions are kept in the same `sessions` table of the token database, in the same layout, so existing logins carry over
+- Dependencies: fhirpath 5 (its ucum-lhc no longer brings csv-parse 4) and node-cron 4 (no longer depends on uuid), for the same reason: the csv-parse and uuid overrides didn't reach npm installs. The csv-parse override is gone
+- Dependencies: natural 8 (uuid 13). Its stemmers are unchanged - every stemmer we use gives the same stem as natural 6 on ~1.6M words (RxNorm, LOINC's translations, and English, French, Spanish, Italian and Portuguese word lists), so existing SNOMED caches and RxNorm databases don't need rebuilding. FHIRsmith now loads only `natural/lib/natural/stemmers`: the package index also loads natural's storage backends, which run dotenv (reading any `.env` in the working directory into the environment, and in natural 8 printing a banner to stdout)
+- Development: jest 30 and jest-junit 17, and `npm run dev` uses Node's own `node --watch` in place of nodemon. With these, `npm audit` is clean for the dev tooling too (jest 29 and nodemon brought braces, and jest's coverage tooling sprintf-js, neither of which has a fixed version). The package.json overrides are down to one, js-yaml 4 for @istanbuljs/load-nyc-config, which only affects the dev install; the rest were no longer doing anything
+- The PR pipeline fails on high/critical advisories anywhere in the dependency tree, on moderate ones in what ships, and audits a fresh install of the packed package (installed the way users install it, so the repo's overrides don't apply)
+
+### Changed
+
+- The npm audit self-check looks up the latest FHIRsmith release, and only tells the administrator to upgrade when there is a newer release to upgrade to; a server already on the latest release says so instead
+
+### Tx Conformance Statement
+
+FHIRsmith v0.16.0 passed all 3630 HL7 terminology service tests (modes tx.fhir.org+omop+general+snomed+mimetypes+icd-11+closure, tests v1.9.6, runner v7.0.1)
+
+## [0.15.1] - 2026-10-15
+
+### Security
+
+- Packages: the SSRF guard on the crawler's outbound requests could be bypassed with an IP address in the URL (`http://127.0.0.1/`, `http://169.254.169.254/`, `http://[::1]/`), because Node makes no DNS lookup for an IP address and the guard only ran there. IP addresses are now checked too
+
+### Added
+
+- Packages: `/packages/npm-check` checks any registry against the npm registry protocol, the way npm clients use it (search by name, package document, version document, tarball), and reports each check with the reason for any failure. In a browser it is a form; otherwise it returns the report as JSON. The checks also run once a day against registry.npmjs.org, and the page says if any fail there. Requests are limited in time and size, may not go to non-public addresses other than loopback (so a server can check itself), and are rate limited per client. `npmCheck` in the packages config sets the limits; `"enabled": false` turns it off
+- Packages: npm-protocol test suites that run the same checks against registry.npmjs.org (the control: if npm changes its behaviour, this is where it shows), and against the packages module with known content
+- Packages: the package document has npm's `time` (each version's publication date, plus `created` and `modified`)
+- Packages: `latest` can be used in place of a version (`/packages/{id}/latest`)
+- Packages: `packages/dedupe-versions.js`, a one-off repair for an existing database: removes duplicate id#version rows, rewrites mirror files that don't match the database, and adds the unique index. It needs nothing but Node 24; see Repairing an older database in packages/readme.md
+
+### Changed
+
+- Packages: `GET /packages/{id}/{version}` returns npm's version document (JSON) when the request's `Accept` asks for `application/json` (or `application/vnd.npm.install-v1+json`), and the tarball otherwise. On the npm registry this URL is always the version document, and npm clients and tools that treat this server as an npm registry (including the HL7 Java tools, when they are configured with a server of npm type) ask for it with `Accept: application/json` and then download from `dist.tarball`. But FHIR clients have always downloaded the tarball from this URL - the Java tools without sending an `Accept` header at all, browsers and curl with ones that don't ask for JSON - so the tarball stays the default, and only a request that explicitly asks for JSON gets the document. The risk is a client that downloads the tarball from here while asking for JSON (typically a generic HTTP wrapper that sets `Accept: application/json` on every request). For those, and as a guarantee for the Java tools, a request with a `FHIR-Package-Download` header (any value; the Java PackageClient sends `tarball`) always gets the tarball, whatever its `Accept`. The response carries `Vary: Accept, FHIR-Package-Download` so caches keep the two apart
+- Packages: `/packages/-/v1/search` puts the package whose id is the whole search text first, as npm does. `/packages/catalog` is unchanged
+- Packages: each id#version is stored once. Simplifier republishes packages that other feeds publish directly, so its copy is a secondary echo: a version already held is not fetched from Simplifier, and a version held only from Simplifier is replaced when it arrives directly from its publisher's feed. A second direct copy from a different GUID is logged as an error and ignored. The database enforces this with a unique index on (Id, Version); on an existing database the server logs a warning until `dedupe-versions.js` has been run
+- Packages: package downloads keep the bytes the server sent: a `.tgz` labelled `Content-Encoding: gzip` is no longer unzipped by the HTTP client
+
+### Fixed
+
+- Packages: the tarball served for some versions didn't match the shasum in the package document (46 of 6961 versions on packages2.fhir.org), so npm clients would reject them. Two causes: the same id#version stored twice from different feeds (the document showed one copy's hash, the mirror held the other), and a tarball that failed validation (e.g. a draft flagged `notForPublication`) overwriting the mirror file before it was rejected. The mirror file is now written only after the package has been validated and stored
+- Packages: packages from feeds that label `.tgz` files `Content-Encoding: x-gzip` (e.g. doc.mednet.swiss) failed with "incorrect header check"
+- Packages: the search, catalog and updates log lines showed `[object Object]` instead of the query
+- Packages: the crawler log showed `??` for an item skipped because another feed had it in the same crawl
+
+### Tx Conformance Statement
+
+FHIRsmith v0.15.1 passed all 3630 HL7 terminology service tests (modes tx.fhir.org+omop+general+snomed+mimetypes+icd-11+closure, tests v1.9.6, runner v7.0.1)
+
 ## [0.15.0] - 2026-10-08
 
 ### Added
@@ -619,7 +669,7 @@ FHIRsmith passed all 2729 HL7 terminology service tests (modes tx.fhir.org+omop+
 
 FHIRsmith passed all 2729 HL7 terminology service tests (modes tx.fhir.org+omop+general+snomed, tests v1.9.2, runner v6.9.12)
 
-## [v0.11.0] - 2026-mm-dd
+## [v0.11.0] - 2026-07-30
 
 ### Added
 

package/config-template.json

@@ -74,6 +74,16 @@
       "crawler": {
         "enabled": true,
         "schedule": "0 * * * *"
+      },
+      // /packages/npm-check: checks any registry against the npm registry protocol. On by
+      // default; the other settings are the defaults. "control": false stops the daily
+      // check against the npm registry itself.
+      "npmCheck": {
+        "enabled": true,
+        "maxConcurrentRuns": 2,
+        "runsPerWindow": 10,
+        "requestTimeout": 30000,
+        "maxDownloadMB": 50
       }
     },
     "registry": {

package/library/npm-audit.js

@@ -6,9 +6,17 @@
 // The package list comes from node_modules/.package-lock.json (what is actually
 // installed), falling back to package-lock.json. Dev dependencies are left out, and
 // fhirsmith itself is included, so an advisory published against fhirsmith shows up too.
+// A server installed with `npm install -g fhirsmith` has neither - npm doesn't publish the
+// lock file, and keeps no hidden one for a global package - so then the package list is read
+// from the package.json files in node_modules (a published install has no dev dependencies).
 //
 // Config (all optional), top level of config.json:
 //   "npmAudit": { "enabled": true, "intervalHours": 24 }
+//
+// Each check also looks up the latest fhirsmith release on npm, so the advice can say
+// whether upgrading will help. When this server is already on the latest release it won't:
+// npm ignores our package.json "overrides" for anything but a clone + npm ci, so an
+// npm-installed server can carry transitive versions the repo itself has overridden away.
 
 const fs = require('fs');
 const path = require('path');
@@ -16,6 +24,7 @@ const axios = require('axios');
 const escape = require('escape-html');
 
 const DEFAULT_URL = 'https://registry.npmjs.org/-/npm/v1/security/advisories/bulk';
+const DEFAULT_LATEST_URL = 'https://registry.npmjs.org/fhirsmith/latest';
 const SEVERITIES = ['critical', 'high', 'moderate', 'low', 'info'];
 const HOUR_MS = 60 * 60 * 1000;
 const FIRST_RUN_DELAY_MS = 60 * 1000; // let startup finish first
@@ -35,11 +44,34 @@ function describeAgo(time, now = Date.now()) {
   return `${Math.floor(hours / 24)} days ago`;
 }
 
+/**
+ * Compare two x.y.z versions numerically (pre-release and build suffixes ignored).
+ * Returns <0, 0 or >0, or null if either can't be read
+ */
+function compareVersions(a, b) {
+  const parse = v => {
+    const m = /^v?(\d+)\.(\d+)\.(\d+)/.exec(String(v || '').trim());
+    return m ? m.slice(1).map(Number) : null;
+  };
+  const x = parse(a);
+  const y = parse(b);
+  if (!x || !y) {
+    return null;
+  }
+  for (let i = 0; i < 3; i++) {
+    if (x[i] !== y[i]) {
+      return x[i] - y[i];
+    }
+  }
+  return 0;
+}
+
 class NpmAudit {
   constructor(config = {}, logger = null, appDir = path.join(__dirname, '..'), stats = null) {
     this.enabled = config.enabled !== false;
     this.intervalHours = config.intervalHours > 0 ? config.intervalHours : 24;
     this.url = config.url || DEFAULT_URL;
+    this.latestUrl = config.latestUrl || DEFAULT_LATEST_URL;
     this.timeout = config.timeout || 60000;
     this.logger = logger;
     this.appDir = appDir;
@@ -52,6 +84,8 @@ class NpmAudit {
     this.findings = []; // [{name, installed: [versions], id, severity, title, url, range}]
     this.lastError = null; // message from the last attempt, if it failed
     this.lastAttempt = null;
+    this.installedVersion = null; // this server's fhirsmith version, from package.json
+    this.latestVersion = null; // the latest fhirsmith release on npm, if it could be found
   }
 
   /**
@@ -67,9 +101,6 @@ class NpmAudit {
         // try the next one
       }
     }
-    if (!lock || !lock.packages) {
-      throw new Error('No package-lock.json found to audit');
-    }
     const found = new Map();
     const add = (name, version) => {
       if (!found.has(name)) {
@@ -77,18 +108,23 @@ class NpmAudit {
       }
       found.get(name).add(version);
     };
-    for (const [key, info] of Object.entries(lock.packages)) {
-      if (!key || !info || info.dev || info.link || !info.version) {
-        continue;
+    if (lock && lock.packages) {
+      for (const [key, info] of Object.entries(lock.packages)) {
+        if (!key || !info || info.dev || info.link || !info.version) {
+          continue;
+        }
+        const marker = 'node_modules/';
+        const name = info.name || key.substring(key.lastIndexOf(marker) + marker.length);
+        add(name, info.version);
       }
-      const marker = 'node_modules/';
-      const name = info.name || key.substring(key.lastIndexOf(marker) + marker.length);
-      add(name, info.version);
+    } else if (!this.scanInstalled(path.join(this.appDir, 'node_modules'), add)) {
+      throw new Error('No package-lock.json or node_modules found to audit');
     }
     try {
       const pkg = JSON.parse(fs.readFileSync(path.join(this.appDir, 'package.json'), 'utf8'));
       if (pkg.name && pkg.version) {
         add(pkg.name, pkg.version);
+        this.installedVersion = pkg.version;
       }
     } catch (e) {
       // no package.json - nothing to add
@@ -100,6 +136,88 @@ class NpmAudit {
     return result;
   }
 
+  /**
+   * Read the installed packages from the package.json files under a node_modules folder,
+   * including scoped packages and the node_modules nested inside packages. Linked packages
+   * (symlinks) are left out, as they are from a lock file.
+   *
+   * @returns {boolean} false if there is no node_modules folder
+   */
+  scanInstalled(dir, add) {
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch (e) {
+      return false;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory() || entry.name.startsWith('.')) {
+        continue;
+      }
+      const dirs = [];
+      if (entry.name.startsWith('@')) {
+        let scoped = [];
+        try {
+          scoped = fs.readdirSync(path.join(dir, entry.name), { withFileTypes: true });
+        } catch (e) {
+          // unreadable scope folder - nothing in it
+        }
+        for (const s of scoped) {
+          if (s.isDirectory()) {
+            dirs.push(path.join(dir, entry.name, s.name));
+          }
+        }
+      } else {
+        dirs.push(path.join(dir, entry.name));
+      }
+      for (const pkgDir of dirs) {
+        try {
+          const pkg = JSON.parse(fs.readFileSync(path.join(pkgDir, 'package.json'), 'utf8'));
+          if (pkg.name && pkg.version) {
+            add(pkg.name, pkg.version);
+          }
+        } catch (e) {
+          // not a package
+        }
+        this.scanInstalled(path.join(pkgDir, 'node_modules'), add);
+      }
+    }
+    return true;
+  }
+
+  /**
+   * Look up the latest fhirsmith release. A failure only means the advice is less specific,
+   * so it is logged and otherwise ignored (the previous answer is kept)
+   */
+  async checkLatest() {
+    try {
+      const response = await axios.get(this.latestUrl, { timeout: this.timeout, headers: { 'Accept': 'application/json' } });
+      const version = response.data && response.data.version;
+      if (typeof version === 'string' && compareVersions(version, version) === 0) {
+        this.latestVersion = version;
+      }
+    } catch (error) {
+      if (this.logger) {
+        this.logger.info('npm audit: could not look up the latest FHIRsmith release: ' + error.message);
+      }
+    }
+  }
+
+  /**
+   * What the administrator can do about the findings
+   */
+  advice() {
+    const cmp = compareVersions(this.installedVersion, this.latestVersion);
+    if (cmp === null) {
+      return 'The server administrator should upgrade to the latest FHIRsmith release.';
+    }
+    if (cmp < 0) {
+      return `The server administrator should upgrade to FHIRsmith ${this.latestVersion} (this server is running ${this.installedVersion}).`;
+    }
+    return `This server is already running the latest FHIRsmith release (${this.installedVersion}), ` +
+      'so these will be fixed by a future FHIRsmith release.';
+  }
+
   async run() {
     if (this.running) {
       return;
@@ -137,6 +255,7 @@ class NpmAudit {
       this.lastError = null;
       const summary = this.summary();
       if (findings.length > 0) {
+        await this.checkLatest();
         if (this.logger) {
           this.logger.warn(`npm audit: ${summary} in ${this.packageCount} packages: ` +
             findings.map(f => `${f.name} (${f.severity}) ${f.url}`).join('; '));
@@ -225,7 +344,7 @@ class NpmAudit {
     return `<div class="alert ${cls}" role="alert"><strong>Security:</strong> npm audit found ` +
       `${escape(this.summary())} in the packages this server uses ` +
       `(checked ${escape(describeAgo(this.checkedAt.getTime(), now))}). ` +
-      'The server administrator should upgrade to the latest FHIRsmith release. ' +
+      `${escape(this.advice())} ` +
       '<a href="/dashboard#npm-audit">Details</a></div>';
   }
 
@@ -250,6 +369,7 @@ class NpmAudit {
     }
     html += '</p>';
     if (this.findings.length > 0) {
+      html += `<p>${escape(this.advice())}</p>`;
       html += '<table class="grid"><tr><th>Severity</th><th>Package</th><th>Installed</th><th>Vulnerable</th><th>Advisory</th></tr>';
       for (const f of this.findings) {
         const link = /^https:\/\//.test(f.url) ? `<a href="${escape(f.url)}">${escape(f.title || f.url)}</a>` : escape(f.title);
@@ -262,4 +382,4 @@ class NpmAudit {
   }
 }
 
-module.exports = { NpmAudit, describeAgo };
+module.exports = { NpmAudit, describeAgo, compareVersions };

package/library/sqlite-session-store.js

@@ -0,0 +1,133 @@
+// library/sqlite-session-store.js
+// An express-session store kept in a table of an already-open sqlite3 database.
+//
+// This replaces connect-sqlite3, which depends on sqlite3 ^5 and so brought a second, old
+// copy of sqlite3 (and with it node-gyp 8 and tar 6) into every npm install of FHIRsmith.
+// Our package.json "overrides" hid that from npm audit in the repo, but npm ignores
+// overrides for anyone installing the published package.
+//
+// The table layout is the one connect-sqlite3 used - (sid PRIMARY KEY, expired, sess),
+// with expired in epoch ms and sess as JSON - so sessions in an existing database carry over.
+
+const session = require('express-session');
+
+const ONE_DAY_MS = 24 * 60 * 60 * 1000;
+const TABLE_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+class SqliteSessionStore extends session.Store {
+  /**
+   * @param {object} options
+   * @param {object} options.db - an open sqlite3 Database; the caller owns it and closes it
+   * @param {string} [options.table='sessions']
+   * @param {number} [options.cleanupIntervalMs=one day] - how often expired sessions are deleted
+   */
+  constructor(options = {}) {
+    super();
+    if (!options.db) {
+      throw new Error('SqliteSessionStore needs an open sqlite3 database');
+    }
+    const table = options.table || 'sessions';
+    if (!TABLE_NAME.test(table)) {
+      throw new Error('Invalid session table name: ' + table);
+    }
+    this.db = options.db;
+    this.table = table;
+    this.timer = null;
+    this.ready = this.run(`CREATE TABLE IF NOT EXISTS ${table} (sid PRIMARY KEY, expired, sess)`)
+      .then(() => this.cleanup());
+    this.ready.catch(() => { /* reported by the first operation that waits on it */ });
+    const interval = options.cleanupIntervalMs > 0 ? options.cleanupIntervalMs : ONE_DAY_MS;
+    this.timer = setInterval(() => void this.cleanup().catch(() => {}), interval);
+    if (this.timer.unref) {
+      this.timer.unref();
+    }
+  }
+
+  run(sql, params = []) {
+    return new Promise((resolve, reject) => {
+      this.db.run(sql, params, function (err) {
+        if (err) {
+          reject(err);
+        } else {
+          resolve(this);
+        }
+      });
+    });
+  }
+
+  query(method, sql, params = []) {
+    return new Promise((resolve, reject) => {
+      this.db[method](sql, params, (err, result) => err ? reject(err) : resolve(result));
+    });
+  }
+
+  // adapt a promise to express-session's callback style
+  done(promise, cb) {
+    promise.then(result => cb && cb(null, result), err => cb && cb(err));
+  }
+
+  cleanup() {
+    return this.run(`DELETE FROM ${this.table} WHERE expired < ?`, [Date.now()]);
+  }
+
+  static expiry(sess) {
+    if (sess && sess.cookie) {
+      if (sess.cookie.expires) {
+        const t = new Date(sess.cookie.expires).getTime();
+        if (!isNaN(t)) {
+          return t;
+        }
+      }
+      if (sess.cookie.maxAge) {
+        return Date.now() + sess.cookie.maxAge;
+      }
+    }
+    return Date.now() + ONE_DAY_MS;
+  }
+
+  get(sid, cb) {
+    this.done(this.ready
+      .then(() => this.query('get', `SELECT sess FROM ${this.table} WHERE sid = ? AND expired >= ?`, [sid, Date.now()]))
+      .then(row => row ? JSON.parse(row.sess) : null), cb);
+  }
+
+  set(sid, sess, cb) {
+    this.done(this.ready
+      .then(() => this.run(`INSERT OR REPLACE INTO ${this.table} (sid, expired, sess) VALUES (?, ?, ?)`,
+        [sid, SqliteSessionStore.expiry(sess), JSON.stringify(sess)]))
+      .then(() => undefined), cb);
+  }
+
+  touch(sid, sess, cb) {
+    this.done(this.ready
+      .then(() => this.run(`UPDATE ${this.table} SET expired = ? WHERE sid = ? AND expired >= ?`,
+        [SqliteSessionStore.expiry(sess), sid, Date.now()]))
+      .then(() => undefined), cb);
+  }
+
+  destroy(sid, cb) {
+    this.done(this.ready
+      .then(() => this.run(`DELETE FROM ${this.table} WHERE sid = ?`, [sid]))
+      .then(() => undefined), cb);
+  }
+
+  length(cb) {
+    this.done(this.ready
+      .then(() => this.query('get', `SELECT COUNT(*) AS count FROM ${this.table} WHERE expired >= ?`, [Date.now()]))
+      .then(row => row.count), cb);
+  }
+
+  clear(cb) {
+    this.done(this.ready.then(() => this.run(`DELETE FROM ${this.table}`)).then(() => undefined), cb);
+  }
+
+  /** Stop the cleanup timer. The database itself belongs to the caller. */
+  close() {
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+  }
+}
+
+module.exports = { SqliteSessionStore };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fhirsmith",
-  "version": "0.15.0",
-  "txVersion": "1.9.5-SNAPSHOT",
+  "version": "0.16.0",
+  "txVersion": "1.9.6",
   "description": "A Node.js server that provides a collection of tools to serve the FHIR ecosystem",
   "main": "server.js",
   "engines": {
@@ -9,18 +9,18 @@
   },
   "scripts": {
     "start": "node server.js",
-    "dev": "nodemon server.js",
+    "dev": "node --watch server.js",
     "test": "jest",
     "test:watch": "jest --watch",
     "test:coverage": "jest --coverage",
     "test:ci": "jest --ci --coverage --watchAll=false --reporters=default --reporters=jest-junit --verbose",
-    "test:shl": "jest --testPathPattern=shl",
-    "test:vcl": "jest --testPathPattern=vcl",
-    "test:xig": "jest --testPathPattern=xig",
-    "test:packages": "jest --testPathPattern=packages",
-    "test:token": "jest --testPathPattern=token",
-    "test:integration": "jest --testPathPattern=integration",
-    "test:unit": "jest --testPathPattern=unit",
+    "test:shl": "jest --testPathPatterns=shl",
+    "test:vcl": "jest --testPathPatterns=vcl",
+    "test:xig": "jest --testPathPatterns=xig",
+    "test:packages": "jest --testPathPatterns=packages",
+    "test:token": "jest --testPathPatterns=token",
+    "test:integration": "jest --testPathPatterns=integration",
+    "test:unit": "jest --testPathPatterns=unit",
     "lint": "eslint . --ext .js --ignore-path .gitignore",
     "lint:fix": "eslint . --fix --ignore-pattern 'static/assets/js/html5shiv.js'",
     "lint:relaxed": "eslint . --config .eslintrc.relaxed.js",
@@ -41,21 +41,20 @@
     "cli-progress": "^3.12.0",
     "commander": "^14.0.3",
     "commonmark": "^0.31.2",
-    "connect-sqlite3": "^0.9.18",
     "cors": "^2.8.6",
     "express": "^5.2.1",
     "express-rate-limit": "^7.4.1",
     "express-session": "^1.19.0",
     "fast-xml-parser": "^5.3.4",
     "fhir-validator-wrapper": "1.4.0",
-    "fhirpath": "^4.8.3",
+    "fhirpath": "^5.2.1",
     "fs-extra": "^11.3.3",
     "ini": "^6.0.0",
     "inquirer": "^8.2.5",
     "liquidjs": "^10.25.5",
     "lusca": "^1.7.0",
-    "natural": "^6.12.0",
-    "node-cron": "^3.0.3",
+    "natural": "^8.1.1",
+    "node-cron": "^4.6.0",
     "pako": "^2.1.0",
     "passport": "^0.7.0",
     "passport-facebook": "^3.0.0",
@@ -71,18 +70,17 @@
     "yaml": "^2.8.2"
   },
   "devDependencies": {
-    "@types/jest": "^29.5.8",
+    "@types/jest": "^30.0.0",
     "@typescript-eslint/eslint-plugin": "^8.54.0",
     "@typescript-eslint/parser": "^8.54.0",
     "ajv": "^8.20.0",
     "eslint": "^8.57.1",
     "eslint-plugin-promise": "^7.2.1",
-    "jest": "^29.7.0",
-    "jest-environment-node": "^29.7.0",
-    "jest-junit": "^16.0.0",
+    "jest": "^30.5.2",
+    "jest-environment-node": "^30.5.2",
+    "jest-junit": "^17.0.0",
     "mock-fs": "^5.5.0",
     "nock": "^13.4.0",
-    "nodemon": "^3.1.11",
     "supertest": "^7.2.2",
     "tmp": "^0.2.5"
   },
@@ -107,16 +105,8 @@
   "author": "Health Intersections Pty Ltd",
   "license": "BSD-3",
   "overrides": {
-    "tar": "^7.5.7",
-    "fast-xml-parser": "^5.3.4",
-    "inquirer": {
-      "lodash": "4.18.1"
-    },
-    "brace-expansion": "^5.0.8",
-    "csv-parse": "^7.0.3",
-    "uuid": "^11.1.1",
-    "connect-sqlite3": {
-      "sqlite3": "$sqlite3"
+    "@istanbuljs/load-nyc-config": {
+      "js-yaml": "^4.1.0"
     }
   },
   "bin": {

package/packages/npm-check-page.js

@@ -0,0 +1,108 @@
+//
+// Copyright 2026, Health Intersections Pty Ltd (http://www.healthintersections.com.au)
+//
+// Licensed under BSD-3: https://opensource.org/license/bsd-3-clause
+//
+
+// HTML for /packages/npm-check: the form, and the report of a run (see npm-check.js)
+
+const escape = require('escape-html');
+
+const PASS = '<span style="color: #198754; font-weight: bold">&#10003;</span>';
+const FAIL = '<span style="color: #dc3545; font-weight: bold">&#10007;</span>';
+
+function when(iso) {
+  return escape(new Date(iso).toUTCString());
+}
+
+function form(values) {
+  let html = '<form method="get" action="/packages/npm-check" class="mb-4">';
+  html += '<table class="grid">';
+  html += `<tr><td><label for="registry">Registry URL</label></td><td><input type="url" id="registry" name="registry" size="60" required maxlength="500" placeholder="https://registry.example.org/packages" value="${escape(values.registry || '')}"></td></tr>`;
+  html += `<tr><td><label for="package">Package</label></td><td><input type="text" id="package" name="package" size="40" required maxlength="100" value="${escape(values.package || 'hl7.fhir.r4.core')}"></td></tr>`;
+  html += `<tr><td><label for="version">Version</label></td><td><input type="text" id="version" name="version" size="20" required maxlength="50" value="${escape(values.version || '4.0.1')}"></td></tr>`;
+  html += '</table>';
+  html += '<p class="mt-2"><button type="submit" class="btn btn-primary">Run the checks</button> ';
+  html += '<small>A run makes about ten requests to the registry, including downloading the package\'s tarball, and can take up to a minute.</small></p>';
+  html += '</form>';
+  return html;
+}
+
+function controlSummary(control, controlReport) {
+  if (!control) {
+    return '';
+  }
+  const what = `${escape(control.registry)} (${escape(control.pkg)} ${escape(control.version)})`;
+  if (!controlReport) {
+    return `<p><small>The checks are verified daily against the npm registry itself, ${what}. That hasn't run yet; reload this page in a minute to see it.</small></p>`;
+  }
+  const total = controlReport.passed + controlReport.failed;
+  if (controlReport.failed === 0) {
+    return `<p><small>${PASS} The checks are verified daily against the npm registry itself: all ${total} passed against ${what} on ${when(controlReport.finished)}.</small></p>`;
+  }
+  let html = `<div class="alert alert-warning"><p>${FAIL} The checks are verified daily against the npm registry itself, and on ${when(controlReport.finished)} ${controlReport.failed} of ${total} failed against ${what}. The npm registry is the reference, so those checks may be out of date - treat their results below with caution:</p><ul>`;
+  for (const step of controlReport.steps) {
+    for (const c of step.checks.filter(x => x.status === 'fail')) {
+      html += `<li>${escape(step.title)}: ${escape(c.title)} - ${escape(c.message)}</li>`;
+    }
+  }
+  return html + '</ul></div>';
+}
+
+function intro() {
+  let html = '<p>Checks a registry against the npm registry protocol, the way an npm client uses it: search for a package by name, ';
+  html += 'read its package document, read one version\'s document, and download that version\'s tarball. ';
+  html += 'At each step it checks the parts of the response that npm clients depend on. ';
+  html += 'Give the registry\'s base URL (the one you would pass to <code>npm --registry</code>) and a package version it holds.</p>';
+  return html;
+}
+
+function renderForm({ values = {}, control, controlReport }) {
+  return intro() + form(values) + controlSummary(control, controlReport);
+}
+
+function renderReport({ report, control, controlReport }) {
+  const total = report.passed + report.failed;
+  let html = '';
+  html += `<p><strong>Registry:</strong> ${escape(report.registry)}<br>`;
+  html += `<strong>Package:</strong> ${escape(report.package)} ${escape(report.version)}<br>`;
+  html += `<strong>Run:</strong> ${when(report.started)}</p>`;
+  if (report.failed === 0) {
+    html += `<div class="alert alert-success">${PASS} All ${total} checks passed.</div>`;
+  } else {
+    html += `<div class="alert alert-danger">${FAIL} ${report.failed} of ${total} checks failed.</div>`;
+  }
+  html += controlSummary(control, controlReport);
+
+  for (const step of report.steps) {
+    html += `<h4 class="mt-4">${escape(step.title)}: <code>${escape(step.request)}</code></h4>`;
+    html += '<table class="grid">';
+    for (const c of step.checks) {
+      html += `<tr><td>${c.status === 'pass' ? PASS : FAIL}</td><td>${escape(c.title)}`;
+      if (c.status !== 'pass') {
+        html += `<br><span style="color: #dc3545">${escape(c.message)}</span>`;
+        const urls = [...new Set(c.uses.map(u => report.requests[u]?.url).filter(Boolean))];
+        if (urls.length > 0) {
+          html += `<br><small>${urls.map(escape).join('<br>')}</small>`;
+        }
+      }
+      html += '</td></tr>';
+    }
+    html += '</table>';
+  }
+
+  html += '<h4 class="mt-4">Requests</h4>';
+  html += '<table class="grid"><tr><td><b>URL</b></td><td><b>Result</b></td></tr>';
+  for (const r of Object.values(report.requests)) {
+    const result = r.error ? `<span style="color: #dc3545">${escape(r.error)}</span>`
+      : `${escape(String(r.status))} ${escape(r.contentType || '')} (${escape(String(r.bytes))} bytes)`;
+    html += `<tr><td><small>${escape(r.url)}</small></td><td><small>${result}</small></td></tr>`;
+  }
+  html += '</table>';
+
+  html += '<h4 class="mt-4">Check again</h4>';
+  html += form({ registry: report.registry, package: report.package, version: report.version });
+  return html;
+}
+
+module.exports = { renderForm, renderReport };