fhirsmith 0.17.0 → 0.18.1

package/stats.js

@@ -43,6 +43,15 @@ class ModuleStats {
   get staticRequestCount() { return this.parent.staticRequestCount; }
   get history() { return this.parent.history; }
   get startTime() { return this.parent.startTime; }
+
+  /**
+   * What this module served in (since, now]: {total, operations: {name: count},
+   * endpoints: {endpoint: {name: count}}} - see ServerStats.countsSince(). This
+   * is what a module's dailyReport() builds its numbers from.
+   */
+  countsSince(since, now = Date.now()) {
+    return this.parent.countsSince(since, now, this.module);
+  }
 }
 
 class ServerStats {
@@ -62,6 +71,13 @@ class ServerStats {
   // key (module/endpoint/operation) -> counter. See countRequest().
   counters = new Map();
   db = null;
+  // this run's row in server_runs, and what the earlier runs add up to - see overallUptime()
+  runId = null;
+  earlierRuns = {firstStart: null, runningMs: 0};
+  // how often this run says "still alive"; a crash loses at most this much
+  // from the overall uptime figure
+  heartbeatMs = 60 * 1000;
+  heartbeat = null;
 
   constructor(config, log) {
     this.config = config || {};
@@ -146,16 +162,94 @@ class ServerStats {
     }
   }
 
-  markStarted() {
+  markStarted(version = null) {
     this.started = true;
+    this.version = version;
     this.startMem = process.memoryUsage().heapUsed;
     this.startTime = Date.now();
     this.lastTime = this.startTime;
     this.eventLoopMonitor = monitorEventLoopDelay({ resolution: 20 });
     this.eventLoopMonitor.enable();
+    this.startRun();
     this.recordMetrics();
   }
 
+  /**
+   * Record this run in the database and start the heartbeat that keeps its
+   * last_seen current. As with everything else here, a failure is logged and
+   * the overall uptime just isn't available for this run.
+   */
+  startRun() {
+    if (!this.db) {
+      return;
+    }
+    try {
+      this.runId = this.db.startRun(this.startTime, this.version);
+      this.earlierRuns = this.db.loadRunHistory(this.runId);
+    } catch (e) {
+      this.log.error(`Unable to record the server run: ${e.message}. Overall uptime will not be available`);
+      this.runId = null;
+      return;
+    }
+    this.heartbeat = setInterval(() => this.touchRun(), this.heartbeatMs);
+    if (typeof this.heartbeat.unref === 'function') {
+      this.heartbeat.unref();
+    }
+  }
+
+  /**
+   * The server's runs since `since`, oldest first, each {started, lastSeen,
+   * version, current}, preceded by the run before that (if any) - see
+   * StatsDatabase.loadRuns(). The current run is reported as seen now, not as
+   * of its last heartbeat. null if the history isn't being kept.
+   */
+  runHistory(since, now = Date.now()) {
+    if (this.runId == null) {
+      return null;
+    }
+    let runs;
+    try {
+      runs = this.db.loadRuns(since);
+    } catch (e) {
+      this.log.error(`Unable to read the server run history: ${e.message}`);
+      return null;
+    }
+    return runs.map(r => r.id === this.runId
+      ? {started: r.started, lastSeen: now, version: r.version, current: true}
+      : {started: r.started, lastSeen: r.lastSeen, version: r.version, current: false});
+  }
+
+  touchRun() {
+    if (this.db && this.runId != null) {
+      try {
+        this.db.touchRun(this.runId, Date.now());
+      } catch (e) {
+        this.log.error(`Unable to record the server heartbeat: ${e.message}`);
+      }
+    }
+  }
+
+  /**
+   * The proportion of time the server has been up, over every run recorded
+   * in the statistics database: time it was known to be running (each run,
+   * from its start to the last heartbeat it wrote, plus this run up to now)
+   * as a percentage of the time since the first recorded run started.
+   *
+   * Returns {percent, since} or null if the history isn't being kept.
+   */
+  overallUptime(now = Date.now()) {
+    if (this.runId == null) {
+      return null;
+    }
+    const since = this.earlierRuns.firstStart == null ? this.startTime : Math.min(this.earlierRuns.firstStart, this.startTime);
+    const elapsed = now - since;
+    if (elapsed <= 0) {
+      return {percent: 100, since: since};
+    }
+    const running = this.earlierRuns.runningMs + (now - this.startTime);
+    return {percent: Math.min(100, (running * 100) / elapsed), since: since};
+  }
+
   /**
    * The counter for one (module, endpoint, operation), created on first use.
    *
@@ -215,6 +309,7 @@ class ServerStats {
       }
     }
     if (rows.length === 0) {
+      this.lastFlush = now;
       return 0;
     }
     try {
@@ -227,9 +322,53 @@ class ServerStats {
       counter.countDelta = 0;
       counter.timeDelta = 0;
     }
+    this.lastFlush = now;
     return rows.length;
   }
 
+  /**
+   * Write out whatever has been counted since the last flush, so that a
+   * countsSince() up to `now` sees everything. Used by the daily report.
+   */
+  flushNow(now = Date.now()) {
+    this.flushCounters(now, now - (this.lastFlush || this.lastTime || this.startTime));
+  }
+
+  /**
+   * The requests a module served in (since, now], from the persisted rows plus
+   * anything counted since the last flush. Without the database only the
+   * unflushed counts are known, so persisted is false to say the numbers are
+   * partial.
+   */
+  countsSince(since, now, module) {
+    const result = {total: 0, operations: {}, endpoints: {}, persisted: Boolean(this.db)};
+    const add = (endpoint, operation, count) => {
+      if (!count) {
+        return;
+      }
+      result.total += count;
+      result.operations[operation] = (result.operations[operation] || 0) + count;
+      const ep = result.endpoints[endpoint] || (result.endpoints[endpoint] = {});
+      ep[operation] = (ep[operation] || 0) + count;
+    };
+    if (this.db) {
+      try {
+        for (const row of this.db.countsSince(since, now, module)) {
+          add(row.endpoint, row.operation, row.count);
+        }
+      } catch (e) {
+        this.log.error(`Unable to read request counts: ${e.message}`);
+        result.persisted = false;
+      }
+    }
+    for (const counter of this.counters.values()) {
+      if (counter.module === module) {
+        add(counter.endpoint, counter.operation, counter.countDelta);
+      }
+    }
+    return result;
+  }
+
   addTask(name, frequency) {
     let info = {};
     this.taskMap.set(name, info);
@@ -265,6 +404,19 @@ class ServerStats {
     }
   }
 
+  /**
+   * The background tasks whose last run failed: [{name, state, frequency, date}]
+   */
+  failedTasks() {
+    const failed = [];
+    for (const [name, info] of this.taskMap) {
+      if (info.status === 'error') {
+        failed.push({name: name, state: info.state, frequency: info.frequency, date: info.date});
+      }
+    }
+    return failed;
+  }
+
   taskDetails() {
     if (this.taskMap.size == 0) {
       return "";
@@ -290,6 +442,11 @@ class ServerStats {
 
   finishStats() {
     clearInterval(this.timer);
+    if (this.heartbeat) {
+      clearInterval(this.heartbeat);
+      this.heartbeat = null;
+    }
+    this.touchRun();
     // Synchronous, so the last partial interval is on disk before server.js
     // calls process.exit().
     this.flushCounters(Date.now(), Date.now() - (this.lastTime || this.startTime));

package/testing/search.js

@@ -60,113 +60,7 @@ const MODIFIERS = {
 // parameters that control the search rather than filter it
 const CONTROL = new Set(['_sort', '_count', '_offset', '_summary', '_format', '_total', '_pretty']);
 
-const PREFIXES = ['eq', 'ne', 'gt', 'lt', 'ge', 'le', 'sa', 'eb', 'ap'];
-
-const DATE_RE = /^(\d{4})(?:-(\d{2})(?:-(\d{2})(?:T(\d{2}):(\d{2})(?::(\d{2})(\.\d+)?)?(Z|[+-]\d{2}:\d{2})?)?)?)?$/;
-
-/**
- * The range of instants a FHIR date, dateTime or instant covers, as [lo, hi) in epoch
- * milliseconds. "2026" covers the whole year; "2026-09-24T10:00:00.5Z" covers 100ms.
- * A time with no zone is taken as UTC (FHIR requires a zone, but search values often
- * leave it off).
- *
- * @param {string} value
- * @returns {{lo: number, hi: number}|null} null if the value isn't a date
- */
-function dateRange(value) {
-  if (typeof value !== 'string') {
-    return null;
-  }
-  const m = DATE_RE.exec(value.trim());
-  if (!m) {
-    return null;
-  }
-  const [, y, mo, d, h, mi, s, frac, tz] = m;
-  const year = parseInt(y, 10);
-  if (!mo) {
-    return { lo: Date.UTC(year, 0, 1), hi: Date.UTC(year + 1, 0, 1) };
-  }
-  const month = parseInt(mo, 10) - 1;
-  if (month < 0 || month > 11) {
-    return null;
-  }
-  if (!d) {
-    return { lo: Date.UTC(year, month, 1), hi: Date.UTC(year, month + 1, 1) };
-  }
-  const day = parseInt(d, 10);
-  if (day < 1 || day > new Date(Date.UTC(year, month + 1, 0)).getUTCDate()) {
-    return null;
-  }
-  if (!h) {
-    return { lo: Date.UTC(year, month, day), hi: Date.UTC(year, month, day + 1) };
-  }
-  const zone = tz || 'Z';
-  const text = `${y}-${mo}-${d}T${h}:${mi}:${s || '00'}${frac || ''}${zone}`;
-  const lo = Date.parse(text);
-  if (Number.isNaN(lo) || parseInt(h, 10) > 23 || parseInt(mi, 10) > 59 || (s && parseInt(s, 10) > 59)) {
-    return null;
-  }
-  let width;
-  if (!s) {
-    width = 60000;
-  } else if (!frac) {
-    width = 1000;
-  } else {
-    // .5 is 100ms wide, .50 10ms, .500 and beyond 1ms
-    width = Math.max(1, Math.pow(10, 3 - (frac.length - 1)));
-  }
-  return { lo, hi: lo + width };
-}
-
-function splitPrefix(value) {
-  const p = value.substring(0, 2);
-  if (PREFIXES.includes(p) && value.length > 2 && !/^[a-z]/.test(value.substring(2))) {
-    return { prefix: p, rest: value.substring(2) };
-  }
-  return { prefix: 'eq', rest: value };
-}
-
-function escapeLike(value) {
-  return value.replace(/[\\%_]/g, (c) => '\\' + c);
-}
-
-/**
- * Split a parameter value on commas, honouring \, as an escaped comma.
- */
-function splitValues(value) {
-  const out = [];
-  let cur = '';
-  for (let i = 0; i < value.length; i++) {
-    const c = value[i];
-    if (c === '\\' && i + 1 < value.length) {
-      cur += value[i + 1];
-      i++;
-    } else if (c === ',') {
-      out.push(cur);
-      cur = '';
-    } else {
-      cur += c;
-    }
-  }
-  out.push(cur);
-  return out.filter(v => v.length > 0);
-}
-
-function dateClause(def, prefix, range) {
-  const { lo, hi } = def;
-  switch (prefix) {
-    case 'eq': return { sql: `(${lo} >= ? AND ${hi} <= ?)`, args: [range.lo, range.hi] };
-    case 'ne': return { sql: `NOT (${lo} >= ? AND ${hi} <= ?)`, args: [range.lo, range.hi] };
-    case 'gt': return { sql: `${hi} > ?`, args: [range.hi] };
-    case 'lt': return { sql: `${lo} < ?`, args: [range.lo] };
-    case 'ge': return { sql: `${hi} > ?`, args: [range.lo] };
-    case 'le': return { sql: `${lo} < ?`, args: [range.hi] };
-    case 'sa': return { sql: `${lo} >= ?`, args: [range.hi] };
-    case 'eb': return { sql: `${hi} <= ?`, args: [range.lo] };
-    case 'ap': return { sql: `(${lo} < ? AND ${hi} > ?)`, args: [range.hi, range.lo] };
-  }
-  return null;
-}
+const { dateRange, splitPrefix, escapeLike, splitValues, dateClause: dateRangeClause } = require('../library/fhir-search-values');
 
 function numberClause(col, prefix, text) {
   if (!/^[+-]?\d+(\.\d+)?([eE][+-]?\d+)?$/.test(text)) {
@@ -230,7 +124,7 @@ function valueClause(def, modifier, value) {
     case 'date': {
       const { prefix, rest } = splitPrefix(value);
       const range = dateRange(rest);
-      return range ? dateClause(def, prefix, range) : null;
+      return range ? dateRangeClause(def, prefix, range) : null;
     }
   }
   return null;

package/testing/store.js

@@ -256,6 +256,11 @@ class TestReportStore {
     return this.stmts.count.get().n;
   }
 
+  /** How many reports were received in (sinceMs, nowMs] */
+  countReceived(sinceMs, nowMs) {
+    return this.db.prepare('SELECT COUNT(*) AS n FROM reports WHERE received_ms > ? AND received_ms <= ?').get(sinceMs, nowMs).n;
+  }
+
   /**
    * Run a parsed search (see search.js).
    *

package/testing/testing.js

@@ -286,6 +286,26 @@ class TestingModule {
     this.retentionTimer.unref();
   }
 
+  /**
+   * The paragraph for the server's daily report: pages served, reports received
+   * in the period, and how many are held.
+   */
+  dailyReport({since, now}) {
+    const {plural} = require('../library/daily-report');
+    const sentences = [];
+    if (this.stats) {
+      const counts = this.stats.countsSince(since, now);
+      sentences.push(`${plural(counts.total, 'page')} ${counts.total === 1 ? 'was' : 'were'} served.`);
+    }
+    if (this.store) {
+      const received = this.store.countReceived(since, now);
+      sentences.push(`${plural(received, 'test report')} ${received === 1 ? 'was' : 'were'} received; ${plural(this.store.count(), 'report')} ${this.store.count() === 1 ? 'is' : 'are'} held.`);
+    } else {
+      sentences.push('The report store is not open.');
+    }
+    return sentences.join(' ');
+  }
+
   async shutdown() {
     if (this.retentionTimer) {
       clearInterval(this.retentionTimer);

package/token/token-template.html

@@ -150,23 +150,24 @@
 
 <div class="api-docs">
   <h4>API Documentation</h4>
-  <p>Use these endpoints to validate and track API key usage:</p>
+  <p>Use these endpoints to validate and track API key usage. Send the key in a header:
+    <code>Authorization: Bearer {api_key}</code> (or <code>X-API-Key: {api_key}</code>).</p>
   
   <div class="mb-3">
     <strong>Validate API Key:</strong>
-    <div class="api-endpoint">GET /token/api/validate/{api_key}</div>
+    <div class="api-endpoint">GET /token/api/validate</div>
     <p>Returns user information and allowed request count.</p>
   </div>
   
   <div class="mb-3">
     <strong>Record Usage:</strong>
-    <div class="api-endpoint">POST /token/api/usage/{api_key}</div>
+    <div class="api-endpoint">POST /token/api/usage</div>
     <p>Records API usage. Send <code>{"count": 1}</code> in request body.</p>
   </div>
   
   <div class="mb-3">
     <strong>Get Usage Statistics:</strong>
-    <div class="api-endpoint">GET /token/api/stats/{api_key}?days=30</div>
+    <div class="api-endpoint">GET /token/api/stats?days=30</div>
     <p>Returns usage statistics for the specified number of days.</p>
   </div>
 </div>

package/token/token.js

@@ -435,12 +435,19 @@ class TokenModule {
     this.router.post('/keys', this.requireAuth.bind(this), this.createApiKey.bind(this));
     this.router.delete('/keys/:id', this.requireAuth.bind(this), this.deleteApiKey.bind(this));
     
-    // JSON API routes for other servers
-    this.router.get('/api/validate/:key', this.validateApiKey.bind(this));
-    this.router.post('/api/usage/:key', this.recordUsage.bind(this));
+    // JSON API routes for other servers. The key goes in a header (Authorization: Bearer, or
+    // X-API-Key), not the path, so that it doesn't end up in access logs
+    this.router.get('/api/validate', this.validateApiKey.bind(this));
+    this.router.post('/api/usage', this.recordUsage.bind(this));
     
     // Statistics
-    this.router.get('/api/stats/:key', this.getUsageStats.bind(this));
+    this.router.get('/api/stats', this.getUsageStats.bind(this));
+  }
+
+  // The API key a request carries: Authorization: Bearer <key>, or X-API-Key: <key>
+  apiKeyFrom(req) {
+    const auth = /^Bearer\s+(\S+)$/i.exec(req.get('Authorization') || '');
+    return auth ? auth[1] : (req.get('X-API-Key') || null);
   }
 
   // Middleware
@@ -627,7 +634,7 @@ class TokenModule {
     try {
 
       try {
-        const apiKey = req.params.key;
+        const apiKey = this.apiKeyFrom(req);
 
         if (!apiKey || !apiKey.startsWith('tk_')) {
           return res.status(400).json({
@@ -700,7 +707,7 @@ class TokenModule {
     try {
 
       try {
-        const apiKey = req.params.key;
+        const apiKey = this.apiKeyFrom(req);
         const {count = 1} = req.body;
 
         if (!apiKey || !apiKey.startsWith('tk_')) {
@@ -737,8 +744,8 @@ class TokenModule {
     try {
 
       try {
-        const apiKey = req.params.key;
-        const days = Math.min(parseInt(req.query.days) || 30, 365); // Max 1 year
+        const apiKey = this.apiKeyFrom(req);
+        const days = Math.max(1, Math.min(parseInt(req.query.days) || 30, 365)); // Max 1 year
 
         if (!apiKey || !apiKey.startsWith('tk_')) {
           return res.status(400).json({error: 'Invalid key format'});
@@ -989,7 +996,7 @@ class TokenModule {
   async getApiKeyUsageStats(keyId, days = 30) {
     return new Promise((resolve, reject) => {
       this.db.all(`
-        SELECT date, request_count, last_request_ip
+        SELECT date, request_count
         FROM usage_stats 
         WHERE api_key_id = ? AND date >= date('now', '-${days} days')
         ORDER BY date DESC
@@ -1134,7 +1141,7 @@ class TokenModule {
             <td><span class="${statusClass}">${status}</span></td>
             <td>
               ${key.is_active ? 
-                `<button class="btn btn-sm btn-danger" onclick="deleteKey(${key.id}, '${escape(key.name)}')">Delete</button>` :
+                `<button class="btn btn-sm btn-danger" onclick="deleteKey(${Number(key.id)})">Delete</button>` :
                 '<span class="text-muted">-</span>'
               }
             </td>

package/translations/Messages.properties

@@ -181,6 +181,9 @@ CONCEPTMAP_GROUP_TARGET_PROPERTY_TYPE_NO_SYSTEM = Since no system has been provi
 CONCEPTMAP_GROUP_TARGET_PROPERTY_TYPE_UNKNOWN_SYSTEM = The code system {0} could not be found, so code values can''t be checked
 CONCEPTMAP_GROUP_TARGET_SERVER_SIDE = Target Code System {0} is only supported on the terminology server, so the target codes are not validated for performance reasons
 CONCEPTMAP_GROUP_TARGET_UNKNOWN = The Target Code System {0} is not fully defined and populated, and no targetScope is specified, so the target code checking will not be performed
+TRANSLATE_TARGET_CS_UNKNOWN = The code system {0} is not known, and the code ''{1}'' has not been validated
+TRANSLATE_SCT_EDITION_TOP_LEVEL_ONE = No translation: the only {0} ancestor of {1} is the top-level hierarchy concept {2}
+TRANSLATE_SCT_EDITION_TOP_LEVEL_MANY = No translation: the only {0} ancestors of {1} are the top-level hierarchy concepts {2}
 CONCEPTMAP_SHAREABLE_EXTRA_MISSING = Published concept maps SHOULD conform to the ShareableConceptMap profile, which says that the element ConceptMap.{0} should be present, but it is not
 CONCEPTMAP_SHAREABLE_EXTRA_MISSING_HL7 = Concept maps published by HL7 SHALL conform to the ShareableConceptMap profile, which says that the element ConceptMap.{0} should be present, but it is not
 CONCEPTMAP_SHAREABLE_MISSING = Published concept maps SHOULD conform to the ShareableConceptMap profile, which says that the element ConceptMap.{0} is mandatory, but it is not present
@@ -377,6 +380,11 @@ HTA_LOINC_DESC = LOINC
 HTA_LOINC_MESSAGE = This material contains content from <a href="http://loinc.org">LOINC</a>. LOINC is copyright &copy; 1995-2020, Regenstrief Institute, Inc. and the Logical Observation Identifiers Names and Codes (LOINC) Committee and is available at no cost under the <a href="http://loinc.org/license">license</a>. LOINC&reg; is a registered United States trademark of Regenstrief Institute, Inc.
 HTA_SCT_DESC = SNOMED Clinical Terms&reg; (SNOMED CT&reg;)
 HTA_SCT_MESSAGE = This material contains content that is copyright of SNOMED International. Implementers of these specifications must have the appropriate SNOMED CT Affiliate license - for more information contact <a href="https://www.snomed.org/get-snomed">https://www.snomed.org/get-snomed</a> or <a href="mailto:info@snomed.org">info@snomed.org</a>.
+ICD11_CLASSIFICATION_CODE_NONE = The classificationCode extension says ''{0}'', but ''{1}'' has no classification code
+ICD11_CLASSIFICATION_CODE_NOT_ID = The classificationCode extension is only used when the code is an entity id, and ''{0}'' is not one (the entity id is ''{1}'')
+ICD11_CLASSIFICATION_CODE_SYSTEM = The classificationCode extension is only defined for ICD-11 MMS and ICF codings, not {0}
+ICD11_CLASSIFICATION_CODE_WRONG = The classificationCode extension says ''{0}'', but the classification code of ''{1}'' is ''{2}''
+ICD11_PC_AXIS_NOT_MULTIPLE = ''{0}'' takes one value on its {1} axis, but has several: {2}
 ICD11_PC_NO_AXES = ''{0}'' cannot be postcoordinated onto ''{1}'': that concept declares no postcoordination axes
 ICD11_PC_VALUE_NOT_ON_AXIS = ''{0}'' is not a permitted value on any postcoordination axis of ''{1}''. That stem declares: {2}
 IG_DEPENDENCY_CAN_VERSION_ALONE = The canonical URL specifies the version ''{0}'', while the dependency does not. If a version is specified, it must be in the explicit version property
@@ -412,6 +420,7 @@ Internal_INT_Bad_Type = Unhandled fixed value type {0}
 INV_FAILED = Constraint failed: {0}: ''{1}''
 INV_FAILED_SOURCE = Constraint failed: {0}: ''{1}'' (defined in {2})
 INVALID_DISPLAY_NAME = Invalid displayLanguage: ''{0}''
+LOOKUP_DISPLAY_LANGUAGE_FALLBACK = There is no display in the language ''{0}'' for the code ''{1}'' in {2}, so the display is in the default language ''{3}''
 Invalid_slicing__there_is_more_than_one_type_slice_at__but_one_of_them__has_min__1_so_the_other_slices_cannot_exist=Invalid slicing: there is more than one type slice at {0}, but one of them ({1}) has min = 1, so the other slices cannot exist
 JSON_COMMA_EXTRA = There is an extra comma at the end of the {0} in the JSON
 JSON_COMMA_MISSING = A Comma is missing in the JSON
@@ -1120,6 +1129,7 @@ CLOSURE_NAME_NOT_UUID = The closure table name ''{0}'' is not valid: this server
 CLOSURE_PARAM_UNKNOWN = The parameter ''{0}'' is not supported by $closure on this server
 CLOSURE_CONCEPT_AND_VERSION = A $closure request can add concepts or resynchronise from a version, but not both at once
 CLOSURE_RESET_AND_VERSION = A $closure request can reset the closure table or resynchronise from a version, but not both at once
+CLOSURE_DISPOSE_NOT_ALONE = A $closure request that disposes of the closure table can only name the table: it cannot also add concepts, resynchronise, reset or configure it
 CLOSURE_TABLE_EXISTS = The closure table ''{0}'' already exists. To discard its content and start again, include the parameter reset = true
 CLOSURE_TABLE_UNKNOWN = The closure table ''{0}'' does not exist on this server. Initialise it first, with a $closure request that names it and has no concepts
 CLOSURE_CONFIG_NOT_ALLOWED = The parameter ''{0}'' configures a closure table, so it can only be supplied when the table is initialised (or reset)

package/tx/README.md

@@ -148,6 +148,58 @@ The file is read from disk per request, so editing it is reflected immediately -
 this means the published file can be ahead of what the running server actually loaded, if it
 has been edited since startup.
 
+### Syndication feed
+
+`syndication.enabled` publishes the content the library loads as a
+[Terminology Syndication Feed](https://build.fhir.org/ig/FHIR/fhir-syndication-ig/en/)
+(Atom, NCTS ASF profile), so that Ontoserver, other FHIRsmith servers and people can follow
+what the server loads. It is off by default.
+
+```json
+"syndication": { "enabled": true }
+```
+
+**The store.** As the library loads its sources, each one is recorded in the syndication store,
+`<data>/terminology-cache/syndication` (`syndication.json` plus `files/`). The store is defined
+from the moment syndication is turned on: content loaded before then is not back-filled, but
+since induction happens as content loads, everything the server loads after that is recorded
+the first time the store sees it, with the time it was recorded. The store only grows -
+entries are never changed or removed, there are no retract entries, and a later update to
+the same content is a new entry (so `contentItemVersion` is not unique - a deliberate departure
+from the IG). One store serves all the endpoints.
+
+| Source | Entry | Link | Category |
+|--------|-------|------|----------|
+| `npm:` / `url:` packages, and each endpoint's core package | the package | `https://npm.fhir.org/web/{id}-{version}.tgz` (a `url:` source: its url) | `FHIR_Package` |
+| `file:` / `folder:` | each resource that has a version | a copy in the store | `FHIR_CodeSystem` / `FHIR_ValueSet` / `FHIR_ConceptMap` |
+| `snomed`, `loinc`, `rxnorm`, `ndc`, `unii`, `omop`, `icd11`, `cpt` (fragment only) | the file | `base.url` + file name | `SNOMED_CACHE`, `LOINC_DB` ... in `http://healthintersections.com.au/syndication/fhirsmith/1.0.0` |
+
+Not syndicated: `internal:` sources (including VSAC), OCL, `#current`/build packages, resources
+without a version, the full CPT database, and binaries that are not published at `base.url`
+(checked with a HEAD request - a binary that is only local is a development build). Binary
+entries carry `<rights>`. Every link carries `ncts:sha256Hash`: a package is downloaded once to
+hash it, then discarded. Only the core packages are FHIR version specific; everything else
+appears in every endpoint's feed, with that endpoint's `ncts:fhirVersion`.
+
+Induction runs in the background, one item at a time, so it never holds up startup; a failure
+is logged and tried again the next time the content loads.
+
+**The feed** uses RFC 5005 archived feeds, 30 entries a page:
+
+| URL | Content |
+|-----|---------|
+| `/{path}/syndication` | the newest entries (fewer than 30), linked to the newest archive |
+| `/{path}/syndication/archive/{n}` | archive *n* (1 = oldest), linked back to *n*-1 - never changes once it exists |
+| `/{path}/syndication/files/{name}` | a resource file copied into the store |
+
+The links in the feed are built from the server's `hostName` (top level of config.json) as
+`https://{hostName}{path}`, never from the request's Host header; only archives built that way
+are served as cacheable forever. Without a `hostName` the links follow the request, and
+archives are `no-cache`.
+
+A browser (`Accept: text/html`) gets the feed as a page; `?_format=atom` forces Atom. The IG's
+query-string filters are not supported. A **Syndication** item appears in the tx navigation bar.
+
 ## OpenAPI description
 
 Each R5 endpoint is described by an OpenAPI 3.1 spec (the R4 and R3 endpoints work the same

package/tx/closure/closure-store.js

@@ -286,6 +286,20 @@ class ClosureStore {
     return tx();
   }
 
+  /**
+   * Delete a table, and everything in it. The caller holds the table's lock.
+   * @param {string} name
+   * @returns {boolean} whether there was a table to delete
+   */
+  dropTable(name) {
+    const existing = this.stmt.getTable.get(name);
+    if (!existing) {
+      return false;
+    }
+    this.stmt.deleteTable.run(existing.id);
+    return true;
+  }
+
   /**
    * The parameters the table was initialised with, as Parameters.parameter entries.
    */