fhirsmith 0.15.0 → 0.16.0

package/packages/utilities/dedupe-versions.js

@@ -0,0 +1,242 @@
+#!/usr/bin/env node
+//
+// Copyright 2026, Health Intersections Pty Ltd (http://www.healthintersections.com.au)
+//
+// Licensed under BSD-3: https://opensource.org/license/bsd-3-clause
+//
+
+/**
+ * One-off repair of a package server's database and mirror, for a database built before
+ * the crawler stored each id#version only once.
+ *
+ *   node packages/utilities/dedupe-versions.js -db <packages.db> -mirror <mirror folder> [-apply] [-verbose]
+ *
+ * Without -apply it reports what it would do and changes nothing. Back up the database
+ * first. It is safe to run while the server is up, but best between crawler runs. It can be
+ * run with sudo: rewritten mirror files keep the owner, group and mode of the files they replace.
+ *
+ * 1. Duplicate rows. For each id#version stored more than once, it keeps one row, using the
+ *    crawler's rule: a direct copy beats a Simplifier copy (a secondary echo); otherwise the
+ *    first stored wins. Two direct copies with different content are a conflict - only their
+ *    Simplifier rows are removed, and they are listed for manual cleanup. Deleted rows'
+ *    download counts are added to the kept row.
+ * 2. The unique index on (Id, Version), once there are no duplicates left.
+ * 3. The mirror. Every row's mirror file must be the bytes that row's Hash describes; a file
+ *    that is missing or different is rewritten from the row's Content. Conflicts are skipped.
+ *    The report separates the two: a different file is served with the wrong checksum; a
+ *    missing one isn't served at all. -verbose lists every missing file.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+// node:sqlite (built into Node 24) rather than an npm package, so this file runs on its own:
+// copy it to the server and run it with node, no install needed
+const { DatabaseSync } = require('node:sqlite');
+
+const UNIQUE_INDEX = 'CREATE UNIQUE INDEX IF NOT EXISTS SK_PackageVersions_IdVersion ON PackageVersions (Id, Version)';
+
+// These two must match PackageCrawler.isSimplifierGuid and PackageCrawler.fixPrefix
+// (tests/packages/package-crawler-versions.test.js checks that they do)
+function isSimplifier(guid) {
+  return /^https?:\/\/packages\.simplifier\.net\//i.test(guid || '');
+}
+
+function fixPrefix(id) {
+  return id && id.startsWith('@') && id.includes('/') ? id.replace('@', '$$').replace('/', '$') : id;
+}
+
+const mirrorName = (id, version) => `${fixPrefix(id)}-${version}.tgz`;
+
+// When run with sudo, a rewritten file would otherwise belong to root. Give it the owner,
+// group and mode of the file it replaces (or of the mirror folder, for a missing file).
+function keepOwnership(file, like) {
+  const st = fs.statSync(like);
+  if (process.getuid && process.getuid() === 0) {
+    fs.chownSync(file, st.uid, st.gid);
+  }
+  fs.chmodSync(file, st.isDirectory() ? st.mode & 0o666 : st.mode & 0o7777);
+}
+const sha1 = buf => crypto.createHash('sha1').update(buf).digest('hex');
+
+// Which rows of one id#version to keep and delete. rows are in PackageVersionKey order.
+function plan(rows) {
+  const direct = rows.filter(r => !isSimplifier(r.GUID));
+  if (direct.length === 0) {
+    return { keep: [rows[0]], conflict: false };
+  }
+  if (new Set(direct.map(r => r.Hash)).size === 1) {
+    return { keep: [direct[0]], conflict: false };
+  }
+  return { keep: direct, conflict: true };
+}
+
+function dedupe({ dbPath, mirrorPath, apply = false, verbose = false, log = console.log }) {
+  if (!fs.existsSync(dbPath)) {
+    throw new Error(`No database at ${dbPath}`); // DatabaseSync would create an empty one
+  }
+  const db = new DatabaseSync(dbPath);
+  db.exec('PRAGMA busy_timeout = 10000');
+  const report = { groups: 0, deleted: [], conflicts: [], indexCreated: false, mirror: { checked: 0, ok: 0, rewritten: [], badContent: [] } };
+
+  try {
+    // 1. duplicate rows
+    const groups = db.prepare('SELECT Id, Version FROM PackageVersions GROUP BY Id, Version HAVING COUNT(*) > 1').all();
+    const rowsOf = db.prepare(`SELECT PackageVersionKey, GUID, Hash, DownloadCount FROM PackageVersions
+                               WHERE Id = ? AND Version = ? ORDER BY PackageVersionKey`);
+    const changes = [];
+    for (const g of groups) {
+      const rows = rowsOf.all(g.Id, g.Version);
+      const { keep, conflict } = plan(rows);
+      const del = rows.filter(r => !keep.includes(r));
+      if (conflict) {
+        report.conflicts.push({ id: g.Id, version: g.Version, kept: keep.map(r => r.GUID) });
+      }
+      if (del.length > 0) {
+        changes.push({ id: g.Id, version: g.Version, keep: keep[0], del });
+        for (const r of del) {
+          report.deleted.push({ id: g.Id, version: g.Version, guid: r.GUID, keptGuid: keep[0].GUID });
+        }
+      }
+    }
+    report.groups = groups.length;
+    const toDelete = new Set(changes.flatMap(c => c.del.map(r => r.PackageVersionKey)));
+    const conflicted = new Set(report.conflicts.map(c => `${c.id}#${c.version}`));
+
+    if (apply && changes.length > 0) {
+      const delRelated = ['PackageFHIRVersions', 'PackageDependencies', 'PackageURLs']
+        .map(t => db.prepare(`DELETE FROM ${t} WHERE PackageVersionKey = ?`));
+      const delRow = db.prepare('DELETE FROM PackageVersions WHERE PackageVersionKey = ?');
+      const addCount = db.prepare('UPDATE PackageVersions SET DownloadCount = DownloadCount + ? WHERE PackageVersionKey = ?');
+      const latest = db.prepare(`SELECT PackageVersionKey, Canonical FROM PackageVersions
+                                 WHERE Id = ? AND Version != 'current' ORDER BY PubDate DESC, Version DESC LIMIT 1`);
+      const setCurrent = db.prepare('UPDATE Packages SET CurrentVersion = ?, Canonical = ? WHERE Id = ?');
+      db.exec('BEGIN IMMEDIATE');
+      try {
+        const ids = new Set();
+        for (const c of changes) {
+          for (const r of c.del) {
+            delRelated.forEach(s => s.run(r.PackageVersionKey));
+            delRow.run(r.PackageVersionKey);
+            addCount.run(r.DownloadCount || 0, c.keep.PackageVersionKey);
+          }
+          ids.add(c.id);
+        }
+        for (const id of ids) {
+          const l = latest.get(id);
+          if (l) {
+            setCurrent.run(l.PackageVersionKey, l.Canonical, id);
+          }
+        }
+        db.exec('COMMIT');
+      } catch (e) {
+        db.exec('ROLLBACK');
+        throw e;
+      }
+    }
+    log(`${report.groups} id#versions stored more than once; ${report.deleted.length} rows ${apply ? 'deleted' : 'to delete'}; ${report.conflicts.length} conflicts left for manual cleanup`);
+    for (const c of report.conflicts) {
+      log(`  conflict: ${c.id}#${c.version} has different direct copies: ${c.kept.join(', ')}`);
+    }
+
+    // 2. unique index
+    const remaining = db.prepare('SELECT COUNT(*) AS n FROM (SELECT 1 FROM PackageVersions GROUP BY Id, Version HAVING COUNT(*) > 1)').get().n;
+    if (apply && remaining === 0) {
+      db.exec(UNIQUE_INDEX);
+      report.indexCreated = true;
+      log('unique index on (Id, Version) created');
+    } else if (remaining > 0) {
+      log(`unique index on (Id, Version) not created: ${apply ? remaining : report.groups} id#versions still duplicated`);
+    }
+
+    // 3. mirror
+    if (mirrorPath) {
+      const content = db.prepare('SELECT Content FROM PackageVersions WHERE PackageVersionKey = ?');
+      for (const row of db.prepare('SELECT PackageVersionKey, Id, Version, Hash FROM PackageVersions ORDER BY Id, Version').iterate()) {
+        if (toDelete.has(row.PackageVersionKey)) {
+          continue; // a dry run, and -apply would delete this row
+        }
+        if (conflicted.has(`${row.Id}#${row.Version}`)) {
+          continue; // two rows share the file; left for manual cleanup
+        }
+        report.mirror.checked++;
+        const file = path.join(mirrorPath, mirrorName(row.Id, row.Version));
+        const actual = fs.existsSync(file) ? sha1(fs.readFileSync(file)) : null;
+        if (actual === row.Hash) {
+          report.mirror.ok++;
+          continue;
+        }
+        const buf = Buffer.from(content.get(row.PackageVersionKey).Content);
+        if (sha1(buf) !== row.Hash) {
+          report.mirror.badContent.push(`${row.Id}#${row.Version}`);
+          continue;
+        }
+        report.mirror.rewritten.push({ id: row.Id, version: row.Version, was: actual || 'missing', hash: row.Hash });
+        if (apply) {
+          const tmp = `${file}.tmp-${process.pid}`;
+          fs.writeFileSync(tmp, buf);
+          keepOwnership(tmp, fs.existsSync(file) ? file : mirrorPath);
+          fs.renameSync(tmp, file);
+        }
+      }
+      const missing = report.mirror.rewritten.filter(r => r.was === 'missing');
+      const different = report.mirror.rewritten.filter(r => r.was !== 'missing');
+      const will = apply ? 'was written' : 'will be written';
+      log(`mirror ${mirrorPath}: ${report.mirror.checked} database rows checked against their mirror file`);
+      log(`  ${report.mirror.ok} files match the database`);
+      log(`  ${missing.length} files are missing from the mirror: the package is in the database, so the file ${will} from it`);
+      if (missing.length > report.mirror.checked / 2) {
+        log('    (most of the mirror is missing: check that -mirror is the folder the server\'s mirrorPath setting names)');
+      }
+      for (const r of verbose ? missing : missing.slice(0, 5)) {
+        log(`    ${r.id}#${r.version}`);
+      }
+      if (!verbose && missing.length > 5) {
+        log(`    ... and ${missing.length - 5} more (-verbose lists them all)`);
+      }
+      log(`  ${different.length} files differ from the database - these are the ones served with the wrong checksum; each ${will} from the database`);
+      for (const r of different) {
+        log(`    ${r.id}#${r.version}: file sha1 ${r.was}, database ${r.hash}`);
+      }
+      if (report.mirror.badContent.length > 0) {
+        log(`  ${report.mirror.badContent.length} database rows whose content doesn't match their own hash - not touched:`);
+        for (const b of report.mirror.badContent) {
+          log(`    ${b}`);
+        }
+      }
+    }
+  } finally {
+    db.close();
+  }
+  return report;
+}
+
+function main(argv) {
+  const arg = name => {
+    const i = argv.indexOf(name);
+    return i >= 0 ? argv[i + 1] : undefined;
+  };
+  const dbPath = arg('-db');
+  const mirrorPath = arg('-mirror');
+  if (!dbPath) {
+    console.error('usage: node packages/utilities/dedupe-versions.js -db <packages.db> [-mirror <mirror folder>] [-apply] [-verbose]');
+    return 1;
+  }
+  const apply = argv.includes('-apply');
+  if (!apply) {
+    console.log('Dry run: nothing will be changed (use -apply)');
+  }
+  try {
+    dedupe({ dbPath, mirrorPath, apply, verbose: argv.includes('-verbose') });
+  } catch (e) {
+    console.error(e.message);
+    return 1;
+  }
+  return 0;
+}
+
+if (require.main === module) {
+  process.exitCode = main(process.argv.slice(2));
+}
+
+module.exports = { dedupe, plan, isSimplifier, fixPrefix };

package/registry/registry.js

@@ -582,9 +582,16 @@ class RegistryModule {
   // what the server says about its release (CapabilityStatement.software.releaseDate) -
   // the only source for software other than FHIRsmith
   _reportedReleaseDay(row) {
-    // the day as the server gives it - converting to UTC can move it a day
-    const m = /^(\d{4}-\d{2}-\d{2})/.exec(row.softwareReleaseDate || '');
-    return m ? m[1] : '';
+    const value = row.softwareReleaseDate || '';
+    const m = /^(\d{4}-\d{2}-\d{2})/.exec(value);
+    if (!m) {
+      return '';
+    }
+    // a date is the day as given. A dateTime is an instant, and different servers running
+    // the same release report it in their own time zones (2026-09-05T00:37:46+10:00 and
+    // 2026-09-04T16:37:46+02:00), so the day is the UTC day, to be the same for all of them
+    const t = value.length > 10 ? new Date(value).getTime() : NaN;
+    return isNaN(t) ? m[1] : new Date(t).toISOString().substring(0, 10);
   }
 
   _renderReportedReleaseCells(row, now) {

package/token/token.js

@@ -11,7 +11,6 @@ const crypto = require('crypto');
 const path = require('path');
 const fs = require('fs');
 const session = require('express-session');
-const SQLiteStore = require('connect-sqlite3')(session);
 const passport = require('passport');
 const GoogleStrategy = require('passport-google-oauth20').Strategy;
 const FacebookStrategy = require('passport-facebook').Strategy;
@@ -19,6 +18,7 @@ const GitHubStrategy = require('passport-github2').Strategy;
 const rateLimit = require('express-rate-limit');
 const lusca = require('lusca');
 const folders = require('../library/folder-setup');
+const { SqliteSessionStore } = require('../library/sqlite-session-store');
 const escape = require('escape-html');
 
 
@@ -155,17 +155,11 @@ class TokenModule {
   }
 
   initializeSession() {
-    const configDb = this.config.database || 'token.db';
-    const sessionDbPath = path.isAbsolute(configDb)
-      ? configDb
-      : folders.ensureFilePath('token', configDb);
+    // sessions live in the module's own database (initializeDatabase has opened it)
+    this.sessionStore = new SqliteSessionStore({ db: this.db, table: 'sessions' });
 
     const sessionConfig = {
-      store: new SQLiteStore({
-        dir: path.dirname(sessionDbPath),
-        db: path.basename(sessionDbPath),
-        table: 'sessions'
-      }),
+      store: this.sessionStore,
       secret: this.config.sessionSecret || crypto.randomBytes(64).toString('hex'),
       name: 'fhir.token.sid', // Don't use default session name
       resave: false,
@@ -1287,6 +1281,9 @@ class TokenModule {
   }
 
   async shutdown() {
+    if (this.sessionStore) {
+      this.sessionStore.close();
+    }
     if (this.db) {
       await new Promise((resolve) => {
         this.db.close((err) => {

package/translations/Messages.properties

@@ -377,6 +377,8 @@ HTA_LOINC_DESC = LOINC
 HTA_LOINC_MESSAGE = This material contains content from <a href="http://loinc.org">LOINC</a>. LOINC is copyright &copy; 1995-2020, Regenstrief Institute, Inc. and the Logical Observation Identifiers Names and Codes (LOINC) Committee and is available at no cost under the <a href="http://loinc.org/license">license</a>. LOINC&reg; is a registered United States trademark of Regenstrief Institute, Inc.
 HTA_SCT_DESC = SNOMED Clinical Terms&reg; (SNOMED CT&reg;)
 HTA_SCT_MESSAGE = This material contains content that is copyright of SNOMED International. Implementers of these specifications must have the appropriate SNOMED CT Affiliate license - for more information contact <a href="https://www.snomed.org/get-snomed">https://www.snomed.org/get-snomed</a> or <a href="mailto:info@snomed.org">info@snomed.org</a>.
+ICD11_PC_NO_AXES = ''{0}'' cannot be postcoordinated onto ''{1}'': that concept declares no postcoordination axes
+ICD11_PC_VALUE_NOT_ON_AXIS = ''{0}'' is not a permitted value on any postcoordination axis of ''{1}''. That stem declares: {2}
 IG_DEPENDENCY_CAN_VERSION_ALONE = The canonical URL specifies the version ''{0}'', while the dependency does not. If a version is specified, it must be in the explicit version property
 IG_DEPENDENCY_CAN_VERSION_ERROR = The canonical URL specifies the version ''{0}'', while the dependency has version ''{1}''. If a version is specified, it must be the same as in the explicit version property 
 IG_DEPENDENCY_CAN_VERSION_NONE = The canonical URL cannot end in ''|''
@@ -1441,6 +1443,7 @@ TEXT_LINK_SELECTOR_INVALID = The textLink selector ''{0}'' is invalid: {1}
 SD_CONTEXT_SHOULD_ELEMENT_NOT_FOUND = The element {0} is not valid
 SD_CONTEXT_SHOULD_ELEMENT_NOT_FOUND_VER = The element {0} is not valid in version {1}
 FILTER_NOT_UNDERSTOOD = The filter "{0} {1} {2}" is not understood or supported
+FILTER_VALUE_UNKNOWN_CODE = The filter value ''{0}'' is not a code in {1}
 XHTML_CONTROL_NO_SOURCE = The xhtml node at ''{0}'' does not have a class attribute to indicate its source (boilerplate, generated, or original) and this is required by the profile {1}
 XHTML_XHTML_MIXED_LANG = The xhtml has some language sections ({0}), and also has content that is not in a language section
 XHTML_CONTROL_NO_LANGS = The xhtml has some language sections ({0}), but language sections are prohibited in this context by the profile {1}

package/tx/cs/cs-api.js

@@ -74,7 +74,12 @@ class CodeSystemProvider {
    * the others report "LOINC".
    * @returns {string} display name for the code system
    */
-  name() { return this.system() + (this.version() ? "|"+this.version() : "") }
+  /**
+   * @param {Languages} [languages] - the request's working languages, for a provider whose name
+   *   is translated; the default ignores them
+   */
+  // eslint-disable-next-line no-unused-vars
+  name(languages) { return this.system() + (this.version() ? "|"+this.version() : "") }
 
   /**
    * @returns {string} uri for the code system

package/tx/cs/cs-icd11.js

@@ -113,8 +113,11 @@ class ICD11Services extends BaseCSServices {
   /**
    * The default is system|version, but $lookup's `name` is meant to be a display name for
    * the code system. OMOP overrides it the same way; WHO returns the linearization title.
+   * It follows the request's languages like any other display, falling back to the primary
+   * title. $lookup passes its working languages (displayLanguage, else Accept-Language),
+   * since displayLanguage never reaches opContext.langs; other callers pass nothing.
    */
-  name() { return this.shared.title; }
+  name(languages) { return this.shared.titles?.[this.#displayLang(languages)] || this.shared.title; }
   description() { return this.shared.title; }
   totalCount() { return this.shared.count; }
   defLang() { return 'en'; }
@@ -191,12 +194,13 @@ class ICD11Services extends BaseCSServices {
     return row ? new ICD11Concept(row) : null;
   }
 
-  /** The three things the expression parser needs from the database. */
+  /** What the expression parser needs: the database, and the request's translations. */
   #expressionContext() {
     return {
       get: (sql, params) => this.#get(sql, params),
       all: (sql, params) => this.#all(sql, params),
       resolve: (text) => this.#resolve(text),
+      translate: (msgId, params) => this.opContext.i18n.translate(msgId, this.opContext.langs, params),
     };
   }
 
@@ -309,8 +313,8 @@ class ICD11Services extends BaseCSServices {
    * iterable of Language, in quality order; the database holds translations keyed on the
    * primary subtag, so that is what is matched.
    */
-  #displayLang() {
-    const langs = this.opContext?.langs;
+  #displayLang(languages) {
+    const langs = languages || this.opContext?.langs;
     if (langs) {
       for (const l of langs) {
         const base = l.language || String(l.code || '').split('-')[0];
@@ -615,8 +619,9 @@ class ICD11Services extends BaseCSServices {
     if (!target) {
       // a value set that names a code that is not there is broken, and saying so is more
       // use than quietly expanding to nothing
-      throw new Issue('error', 'code-invalid', null, null,
-        `The filter value '${value}' is not a code in ${this.system()}`, 'invalid-code', 422);
+      throw new Issue('error', 'code-invalid', null, 'FILTER_VALUE_UNKNOWN_CODE',
+        this.opContext.i18n.translate('FILTER_VALUE_UNKNOWN_CODE', this.opContext.langs, [value, this.system()]),
+        'invalid-code', 422);
     }
     filterContext.filters.push(new ICD11FilterSet('isa', {
       ancestorId: target.id, minDepth: op === 'is-a' ? 0 : 1, value,
@@ -749,12 +754,24 @@ class ICD11ServicesFactory extends CodeSystemFactoryProvider {
       }
       const count = await get('SELECT COUNT(*) n FROM concept WHERE system = ?', [sys.id]);
       const langs = await get("SELECT value FROM meta WHERE key = 'languages'", []);
+      // per-language titles; a database built before system_title existed has none
+      const all = (sql, p) => new Promise((res, rej) =>
+        db.all(sql, p, (e, r) => e ? rej(e) : res(r || [])));
+      const titles = {};
+      const hasTitles = await get(
+        "SELECT 1 x FROM sqlite_master WHERE type = 'table' AND name = 'system_title'", []);
+      if (hasTitles) {
+        for (const r of await all('SELECT lang, title FROM system_title WHERE system = ?', [sys.id])) {
+          titles[r.lang] = r.title;
+        }
+      }
       this._shared = {
         systemCode: sys.code,
         systemId: sys.id,
         url: sys.url,
         version: sys.version,
         title: sys.title,
+        titles,
         isTree: !!sys.is_tree,
         count: count.n,
         languages: (langs?.value || 'en').split(','),

package/tx/cs/icd11-expressions.js

@@ -232,12 +232,11 @@ async function parseExpression(ctx, text) {
  */
 function notOnAnyAxis(ctx, stem, token) {
   const axes = stem.axes.map(a => a.axis_name).join(', ');
-  const msg = axes
-    ? `'${token.text}' is not a permitted value on any postcoordination axis of `
-      + `'${stem.stem.text}'. That stem declares: ${axes}`
-    : `'${token.text}' cannot be postcoordinated onto '${stem.stem.text}': that concept `
-      + `declares no postcoordination axes`;
-  return new Issue('error', 'code-invalid', null, null, msg, 'invalid-code', 400).handleAsOO(400);
+  const [msgId, params] = axes
+    ? ['ICD11_PC_VALUE_NOT_ON_AXIS', [token.text, stem.stem.text, axes]]
+    : ['ICD11_PC_NO_AXES', [token.text, stem.stem.text]];
+  return new Issue('error', 'code-invalid', null, msgId, ctx.translate(msgId, params),
+    'invalid-code', 400).handleAsOO(400);
 }
 
 module.exports = { ICD11Expression, ExpressionToken, parseExpression, tokenize, SCHEMA_NS };

package/tx/importers/icd11-schema.md

@@ -42,6 +42,7 @@ text lives in `designation`. The untouched native JSON for each concept is kept
 |---|---|
 | `meta` | key/value: release, languages, endpoints, tool version, request count |
 | `system` | one row per code system — `mms`, `icf`, `foundation` — with its canonical url, release and `is_tree` |
+| `system_title` | the code system's title per language (`system.title` is the primary one); only titles WHO actually translated |
 | `concept` | one row per entity |
 | `concept_parent` | parent/child edges, `seq` preserving the API's order |
 | `concept_closure` | transitive closure including the reflexive row, so is-a never needs recursion |

package/tx/importers/import-icd11.js

@@ -55,6 +55,15 @@ CREATE TABLE IF NOT EXISTS system (
   uri_stem  TEXT NOT NULL           -- versioned uri prefix used by the native API
 );
 
+-- the code system's own title, per language crawled (system.title is the primary language).
+-- Only a title WHO actually translated is recorded -- an English fallback is not a French title.
+CREATE TABLE IF NOT EXISTS system_title (
+  system  INTEGER NOT NULL REFERENCES system(id),
+  lang    TEXT NOT NULL,
+  title   TEXT NOT NULL,
+  PRIMARY KEY (system, lang)
+);
+
 -- one row per concept
 CREATE TABLE IF NOT EXISTS concept (
   id           INTEGER PRIMARY KEY,
@@ -374,6 +383,8 @@ class Icd11Importer {
       setMeta: db.prepare(`INSERT INTO meta(key,value) VALUES (?,?)
                            ON CONFLICT(key) DO UPDATE SET value=excluded.value`),
       getMeta: db.prepare(`SELECT value FROM meta WHERE key=?`),
+      insSystemTitle: db.prepare(`INSERT INTO system_title(system,lang,title) VALUES (?,?,?)
+                                  ON CONFLICT(system,lang) DO UPDATE SET title=excluded.title`),
       insSystem: db.prepare(`INSERT INTO system(code,url,version,title,is_tree,api_root,uri_stem)
                              VALUES (@code,@url,@version,@title,@is_tree,@api_root,@uri_stem)
                              ON CONFLICT(code) DO UPDATE SET
@@ -566,6 +577,8 @@ class Icd11Importer {
 
     for (const lang of languages) {
       const isPrimary = lang === primaryLang;
+      // before the resume check: a language whose concepts are all done still needs its title
+      await this.storeSystemTitle(systemId, def, lang, isPrimary ? root : null);
       const done = new Set(this.stmt.doneLangs.all(systemId, lang).map(r => r.uri));
       const todo = uris.filter(u => !done.has(unversion(u)));
       if (!todo.length) { this.log(`  [${lang}] already complete`); continue; }
@@ -609,6 +622,32 @@ class Icd11Importer {
     return systemId;
   }
 
+  /**
+   * Record the linearization root's title in one language. `root` is the document already
+   * fetched for the primary language; other languages cost one extra call each. The root's
+   * title carries the language WHO actually answered in, so an untranslated title (WHO falls
+   * back to English) is skipped rather than stored under the requested language.
+   */
+  async storeSystemTitle(systemId, def, lang, root) {
+    if (!root) {
+      const r = await this.getEntity(WHO + def.apiRoot, lang);
+      if (!r.ok) {
+        this.problem('title-failed', r.error, { system: def.code, lang, uri: def.apiRoot });
+        this.warn(`  ! could not read the ${lang} title of ${def.apiRoot}: ${r.error}`);
+        return;
+      }
+      root = r.body;
+    }
+    const title = textOf(root.title);
+    if (!title) return;
+    const got = langOf(root.title, lang);
+    if (got.split('-')[0] !== lang.split('-')[0]) {
+      this.log(`  [${lang}] no translated title (WHO answered in ${got})`);
+      return;
+    }
+    this.stmt.insSystemTitle.run(systemId, lang, title);
+  }
+
   /**
    * Turn the parent and scale-entity uris collected during the crawl into real ids.
    * `rootUri` is the linearization root, which the top-level concepts name as their

package/tx/importers/import-rxnorm.module.js

@@ -780,7 +780,7 @@ class RxNormImporter {
     if (this.options.verbose) console.log('Generating word stems...');
 
     // Simple English stemmer implementation
-    var natural = require('natural');
+    var natural = require('natural/lib/natural/stemmers'); // just the stemmers: the package index also loads its storage backends, and dotenv with them
     const stems = new Map();
 
     // Get all RXNORM concepts

package/tx/importers/import-sct.module.js

@@ -4,7 +4,7 @@ const inquirer = require('inquirer');
 const path = require('path');
 const readline = require('readline');
 const chalk = require('chalk');
-const natural = require('natural');
+const natural = require('natural/lib/natural/stemmers'); // just the stemmers: the package index also loads its storage backends, and dotenv with them
 
 const {
   SnomedStrings, SnomedWords, SnomedStems, SnomedReferences,

package/tx/library/designations.js

@@ -1,6 +1,6 @@
 const { LanguagePartType, Languages, Language, LanguageDefinitions} = require('../../library/languages');
 const {validateParameter, validateOptionalParameter, validateArrayParameter} = require("../../library/utilities");
-const natural = require('natural');
+const natural = require('natural/lib/natural/stemmers'); // just the stemmers: the package index also loads its storage backends, and dotenv with them
 /**
  * Display checking modes for concept designations
  */

package/tx/sct/text-index.js

@@ -27,7 +27,7 @@
  * event loop as it goes, and a search takes milliseconds once it exists.
  */
 
-const natural = require('natural');
+const natural = require('natural/lib/natural/stemmers'); // just the stemmers: the package index also loads its storage backends, and dotenv with them
 
 const stemmer = natural.PorterStemmer;
 

package/tx/tx.fhir.org.yml

@@ -45,7 +45,7 @@ sources:
   - npm:us.cdc.phinvads=cdc
   - npm:hl7.fhir.uv.sdc=sdc
   - internal:vsac=vsac
-  - icd11:icd11-2026-01.db
+  - icd11:icd11-2026-01-b.db
 
 ignored:
   - urn:iso:std:iso:3166#20210120

package/tx/workers/lookup.js

@@ -7,7 +7,7 @@
 // POST /CodeSystem/{id}/$lookup
 //
 
-const { TerminologyWorker } = require('./worker');
+const { TerminologyWorker, Unknown_Code_in_VersionSCT, SCTVersion } = require('./worker');
 const { FhirCodeSystemProvider } = require('../cs/cs-cs');
 const { Designations} = require("../library/designations");
 const {TxParameters} = require("../params");
@@ -251,13 +251,16 @@ class LookupWorker extends TerminologyWorker {
     const locateResult = await csProvider.locate(code);
 
     if (!locateResult || !locateResult.context) {
-      let message = `Unable to find code '${code}' in ${csProvider.system()} version ${csProvider.version() || 'unknown'}`
+      const system = csProvider.system();
+      const version = csProvider.version();
+      const msgId = Unknown_Code_in_VersionSCT(system, version);
+      let message = this.i18n.translate(msgId, params.HTTPLanguages, [code, system, version, SCTVersion(system, version)]);
       if (locateResult?.message) {
         message += ' ('+locateResult.message+')';
       }
       // invalid-code, not not-found: the code system was found, the code in it was not.
       // not-found is for a code system or value set that could not be resolved at all.
-      throw new Issue('error', 'not-found', null, null, message, 'invalid-code', 404);
+      throw new Issue('error', 'not-found', null, msgId, message, 'invalid-code', 404);
     }
 
     const ctxt = locateResult.context;
@@ -268,7 +271,7 @@ class LookupWorker extends TerminologyWorker {
     // name (required)
     responseParams.push({
       name: 'name',
-      valueString: csProvider.name()
+      valueString: csProvider.name(params.workingLanguages())
     });
     responseParams.push({
       name: 'code',