fhirsmith 0.18.1 → 1.0.0

package/library/worker-count.js

@@ -0,0 +1,192 @@
+/**
+ * How many tx-workers the launcher starts when server.cluster.workers is not given
+ * (cluster.md, "How many workers").
+ *
+ * The inputs: the vCPUs this process may use (os.availableParallelism()), the physical cores
+ * among them (Linux sysfs topology; elsewhere taken to be the vCPUs), and a cgroup v2 cpu.max
+ * quota, which caps the cores. A rule turns them into a number; the launcher then lowers it if
+ * the processes won't fit in memory. The rule is the engine's: 'classic' here, and an engine
+ * whose processes use the CPU differently registers its own (registerWorkerRule) and makes it
+ * the default, or server.cluster.workerRule names one.
+ *
+ * @module library/worker-count
+ */
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+/**
+ * A CPU list as the kernel writes it ("0-3,8,10-11") to the CPU numbers.
+ * @param {string} text
+ * @returns {number[]}
+ */
+function parseCpuList(text) {
+  const cpus = [];
+  for (const part of String(text).trim().split(',')) {
+    const m = /^(\d+)(?:-(\d+))?$/.exec(part.trim());
+    if (!m) {
+      continue;
+    }
+    const lo = Number(m[1]);
+    const hi = m[2] !== undefined ? Number(m[2]) : lo;
+    for (let c = lo; c <= hi; c++) {
+      cpus.push(c);
+    }
+  }
+  return cpus;
+}
+
+function readText(file) {
+  try {
+    return fs.readFileSync(file, 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The physical cores among the CPUs this process may run on (its affinity mask), from
+ * /sys/devices/system/cpu/cpuN/topology/core_cpus_list (thread_siblings_list on older kernels).
+ * @param {Object} [opts] - for tests: other locations
+ * @param {string} [opts.sysCpu='/sys/devices/system/cpu']
+ * @param {string} [opts.procStatus='/proc/self/status']
+ * @returns {{cpus: number, cores: number}|null} null where the topology can't be read
+ */
+function readTopology(opts = {}) {
+  const sysCpu = opts.sysCpu || '/sys/devices/system/cpu';
+  const status = readText(opts.procStatus || '/proc/self/status');
+  const m = status && /^Cpus_allowed_list:\s*(\S+)/m.exec(status);
+  const allowed = m ? m[1] : readText(path.join(sysCpu, 'online'));
+  const cpus = allowed ? parseCpuList(allowed) : [];
+  if (!cpus.length) {
+    return null;
+  }
+  const cores = new Set();
+  for (const cpu of cpus) {
+    const dir = path.join(sysCpu, 'cpu' + cpu, 'topology');
+    const siblings = readText(path.join(dir, 'core_cpus_list')) ?? readText(path.join(dir, 'thread_siblings_list'));
+    if (siblings === null) {
+      return null;
+    }
+    cores.add(parseCpuList(siblings).join(','));
+  }
+  return { cpus: cpus.length, cores: cores.size };
+}
+
+/**
+ * A cgroup v2 cpu.max quota on this process's cgroup or one enclosing it, in CPUs (the smallest).
+ * @param {Object} [opts]
+ * @param {string} [opts.procFile='/proc/self/cgroup']
+ * @param {string} [opts.cgroupRoot='/sys/fs/cgroup']
+ * @returns {number|null} null: none
+ */
+function readCpuQuota(opts = {}) {
+  const cgroupRoot = opts.cgroupRoot || '/sys/fs/cgroup';
+  const proc = readText(opts.procFile || '/proc/self/cgroup') || '';
+  const line = proc.split('\n').find(l => l.startsWith('0::'));
+  let p = path.posix.normalize(line ? line.slice(3).trim() || '/' : '/');
+  let quota = null;
+  for (;;) {
+    const raw = readText(path.join(cgroupRoot, p, 'cpu.max'));
+    const m = raw && /^(\d+)\s+(\d+)/.exec(raw.trim());
+    if (m && Number(m[2]) > 0) {
+      const q = Number(m[1]) / Number(m[2]);
+      if (quota === null || q < quota) {
+        quota = q;
+      }
+    }
+    if (p === '/' || p === '.') {
+      break;
+    }
+    p = path.posix.dirname(p);
+  }
+  return quota;
+}
+
+/**
+ * The inputs to a rule.
+ * @param {Object} [opts]
+ * @param {number} [opts.vcpu] - default os.availableParallelism()
+ * @param {number} [opts.cores] - server.cluster.cores: overrides the detected physical cores
+ * @param {Object} [opts.topology], [opts.quota] - for tests (see readTopology, readCpuQuota)
+ * @returns {{vcpu: number, cores: number, coresFrom: string, smt: number, quota: number|null}}
+ */
+function cpuInputs(opts = {}) {
+  const vcpu = Math.max(1, Math.floor(opts.vcpu ?? (os.availableParallelism ? os.availableParallelism() : os.cpus().length)));
+  const topo = opts.topology !== undefined ? opts.topology : readTopology(opts.sysfs);
+  const quota = opts.quota !== undefined ? opts.quota : readCpuQuota(opts.cgroup);
+  let cores;
+  let coresFrom;
+  if (opts.cores !== undefined && opts.cores !== null) {
+    cores = Math.max(1, Math.floor(Number(opts.cores)));
+    coresFrom = 'server.cluster.cores';
+  } else if (topo) {
+    cores = topo.cores;
+    coresFrom = 'physical';
+  } else {
+    cores = vcpu;
+    coresFrom = 'vCPU (no topology)';
+  }
+  const smt = topo && topo.cores ? Math.round(topo.cpus / topo.cores) : 1;
+  if (quota !== null) {
+    cores = Math.max(1, Math.min(cores, Math.ceil(quota)));
+  }
+  return { vcpu, cores, coresFrom, smt, quota };
+}
+
+// the rules: (inputs) => { workers, formula }. Measured in cluster.md, "How many workers"
+const RULES = {
+  classic: ({ cores, vcpu }) => ({
+    workers: Math.min(cores, Math.round(0.6 * vcpu)),
+    formula: `min(${cores}, round(0.6×${vcpu}))`
+  })
+};
+let defaultRule = 'classic';
+
+/**
+ * Add a rule; with makeDefault, it is used when server.cluster.workerRule doesn't name one.
+ * @param {string} name
+ * @param {function({vcpu: number, cores: number}): {workers: number, formula: string}} rule
+ * @param {boolean} [makeDefault]
+ */
+function registerWorkerRule(name, rule, makeDefault = false) {
+  RULES[name] = rule;
+  if (makeDefault) {
+    defaultRule = name;
+  }
+}
+
+/**
+ * The default number of workers, before the memory check.
+ * @param {Object} [opts] - cpuInputs' options, and rule (a name)
+ * @returns {{workers: number, rule: string, formula: string, inputs: Object}}
+ */
+function defaultWorkers(opts = {}) {
+  const rule = opts.rule || defaultRule;
+  if (!RULES[rule]) {
+    throw new Error(`server.cluster.workerRule '${rule}' is not one of ${Object.keys(RULES).join(', ')}`);
+  }
+  const inputs = cpuInputs(opts);
+  const { workers, formula } = RULES[rule](inputs);
+  return { workers: Math.max(1, workers), rule, formula, inputs };
+}
+
+/**
+ * The inputs and the decision, in one line for the launcher's log.
+ * @param {{workers: number, rule: string, formula: string, inputs: Object}} d - from defaultWorkers
+ * @param {number} workers - what starts
+ * @param {string} memory - e.g. 'memory fits 11'
+ * @param {boolean} given - server.cluster.workers was given
+ */
+function describeDecision(d, workers, memory, given) {
+  const i = d.inputs;
+  const cores = i.coresFrom === 'physical' ? `${i.cores} physical cores (${i.vcpu} vCPU, SMT ${i.smt})`
+    : `${i.cores} cores from ${i.coresFrom} (${i.vcpu} vCPU)`;
+  const quota = i.quota === null ? 'none' : `${+i.quota.toFixed(2)} CPU`;
+  const why = given ? `given (server.cluster.workers; ${d.rule} rule would give ${d.workers})`
+    : `${d.rule} rule ${d.formula}` + (workers < d.workers ? ` = ${d.workers}, lowered to fit memory` : '');
+  return `workers ${workers}: ${cores}, quota ${quota}, ${memory} → ${why}`;
+}
+
+module.exports = { parseCpuList, readTopology, readCpuQuota, cpuInputs, defaultWorkers, registerWorkerRule, describeDecision, RULES };

package/nginx.md

@@ -2,7 +2,8 @@
 
 FHIRsmith has no built-in TLS, rate limiting or access control. In production it always runs
 behind a reverse proxy, which handles those things. This page covers nginx, which is what the
-public servers (tx.fhir.org, packages.fhir.org and so on) use.
+public servers (tx.fhir.org, packages.fhir.org and so on) use, and is what all the documentation is based
+on. We have no experience with any other reverse proxy.
 
 * [General configuration](#general-configuration) - what nginx should hand across to the server
 * [Rate limiting](#rate-limiting) - approaches that suit terminology traffic
@@ -47,6 +48,8 @@ them:
 * `Accept-Language` - the display language and the language of error messages
 * `X-Cache-Id` - the terminology cache protocol (see [Routing to multiple servers](#routing-to-multiple-servers))
 
+Note: the terminology ecosystem test cases also use the custom header `X-TOO-COSTLY-THRESHOLD` for a few tests.
+
 ### Trusting the proxy
 
 By default FHIRsmith believes the `X-Forwarded-*` headers only when the request comes from
@@ -79,9 +82,11 @@ upstream fhirsmith {
 
 ### Sizes and timeouts
 
-* **Body size.** FHIRsmith accepts request bodies up to 50 MB. Set `client_max_body_size`
-  to match: if nginx allows more, oversized requests get past nginx and then fail with an
-  unhelpful error from the server.
+* **Body size.** FHIRsmith accepts request bodies up to `server.maxBodyMB` (default 50 MB).
+  nginx's `client_max_body_size` is applied first: if it is lower, nginx refuses a bigger
+  body with its own 413 HTML page before FHIRsmith sees it, so set it at or above `maxBodyMB`
+  to get FHIRsmith's OperationOutcome; if it is higher, `maxBodyMB` applies. Requests of
+  over 100 MB have been seen, caused by client-side issues: choose both limits with that in mind.
 * **Timeouts.** Some terminology operations are slow, particularly large SNOMED CT
   expansions and batch validations. The public servers use 600s for
   `proxy_read_timeout`/`proxy_send_timeout`. If you set a shorter timeout, nginx returns
@@ -237,6 +242,14 @@ limit_conn_zone $limit_key zone=perip:10m;
 
 ## Routing to multiple servers
 
+The instructions here are for using multiple independent FHIRsmith instances. Alternatively, 
+you can use a single instance with multiple servers in a [cluster](cluster.md). If you're doing that, 
+you can skip this section, and just set up the cluster as a single server from the point of view of nginx.
+
+Note: Only the terminology module should run in the pool. Modules that keep their own state
+(`publisher`, `packages`, `shl`, `token`) belong on a single instance, with their own
+location or server name routed to it.
+
 Most terminology operations keep no state between requests, so a pool of identical
 FHIRsmith instances could share traffic in any order. The exception is the **terminology
 cache** (`$cache-control`). A client starts a cache on one server, loads resources into it,
@@ -262,7 +275,7 @@ Give each instance a short code in its config.json:
 ```
 
 The server prefixes every cache-id it issues with its code and a dot, e.g.
-`tx1.4f0c2d1e-…`. Codes must be unique within the pool, and 1-16 letters and digits.
+`tx1.mhp4x2k9.4f0c2d1e-…` (`<code>.<start>.<uuid>`, below). Codes must be unique within the pool, and 1-16 letters and digits.
 A client never has to understand the prefix: to the client, the cache-id stays an opaque
 string.
 
@@ -324,7 +337,9 @@ Notes:
 * Routing only works on the **header**. The older `cache-id` request parameter sits in the
   request body, where nginx can't see it. Current clients (fhir-core) send the header.
 * A restarted instance loses its caches. Clients recover by starting a new one, just as
-  they do after a cache expires.
+  they do after a cache expires. A cache-id is `<code>.<start>.<uuid>`, where `<start>` is
+  when the instance started, so the restarted instance reports an id it issued before the
+  restart as "lost to a server restart", and one it never issued as never issued.
 
 ### What must be the same on every instance
 
@@ -336,10 +351,6 @@ are kept per instance, which is fine:
 * expansion caches (each instance warms its own)
 * usage statistics (each instance reports its own share)
 
-Only the terminology module should run in the pool. Modules that keep their own state
-(`publisher`, `packages`, `shl`, `token`) belong on a single instance, with their own
-location or server name routed to it.
-
 ## Managing closure
 
 `$closure` stores state on the server between client sessions. (It is defined on ConceptMap,
@@ -348,6 +359,8 @@ a named closure table, adds concepts to it over days or months, and asks for the
 since the version it last saw. The table lives in the database of the instance that holds
 it.
 
+### Closure on multiple servers 
+
 **Route every `$closure` request to one designated instance.**
 
 ```nginx
@@ -375,7 +388,7 @@ server {
 
 `$closure` traffic is light, so a single instance is not a bottleneck.
 
-### Why this doesn't conflict with cache routing
+#### Why this doesn't conflict with cache routing
 
 It might look as if a `$closure` request could carry an `X-Cache-Id` that belongs to a
 different instance. That doesn't cause a problem, because closure can't depend on the
@@ -397,3 +410,9 @@ the cache ends, and the table would silently change meaning. So `$closure` ignor
   about. An outage is better than that: clients see a failure and retry later.
 * **Moving the designated instance** means moving its closure database with it, then
   changing the upstream.
+
+### A master and tx workers on one machine
+
+When the server is running as a [cluster](cluster.md), the nginx configuration says nothing 
+about closure, nor about the cluster generally.
+

package/npmprojector/indexer.js

@@ -4,6 +4,7 @@
 //
 
 const fhirpath = require('fhirpath');
+const indexerLog = require('../library/logger').getInstance().child({ module: 'npmprojector' });
 
 class FHIRIndexer {
   constructor(fhirModel = null) {
@@ -85,9 +86,9 @@ class FHIRIndexer {
           }
         }
       } catch (err) {
-        console.log(err);
-        // FHIRPath evaluation failed - skip this param for this resource
-        // Logged at debug level to avoid noise
+        // FHIRPath evaluation failed - skip this param for this resource. Logged at debug level
+        // to avoid noise
+        indexerLog.debug(`search parameter ${paramName}: ${err.message}`);
       }
     }
   }
@@ -249,7 +250,7 @@ class FHIRIndexer {
       const trimmedValue = value.trim();
 
       switch (paramType) {
-        case 'string':
+        case 'string': {
           // String search: case-insensitive starts-with by default
           const lowerValue = trimmedValue.toLowerCase();
           for (const [indexedValue, ids] of paramIndex) {
@@ -258,22 +259,25 @@ class FHIRIndexer {
             }
           }
           break;
+        }
 
-        case 'token':
+        case 'token': {
           // Token search: exact match on system|code, |code, or code
           const tokenMatches = this.matchToken(trimmedValue, paramIndex);
           tokenMatches.forEach(id => matchingIds.add(id));
           break;
+        }
 
-        case 'reference':
+        case 'reference': {
           // Reference search: exact match
           const refIds = paramIndex.get(trimmedValue);
           if (refIds) {
             refIds.forEach(id => matchingIds.add(id));
           }
           break;
+        }
 
-        case 'date':
+        case 'date': {
           // Simple prefix matching for dates (no range support as specified)
           for (const [indexedValue, ids] of paramIndex) {
             if (indexedValue.startsWith(trimmedValue)) {
@@ -281,9 +285,10 @@ class FHIRIndexer {
             }
           }
           break;
+        }
 
         case 'number':
-        case 'quantity':
+        case 'quantity': {
           // Numeric equality
           const numValue = parseFloat(trimmedValue);
           if (!isNaN(numValue)) {
@@ -293,21 +298,24 @@ class FHIRIndexer {
             }
           }
           break;
+        }
 
-        case 'uri':
+        case 'uri': {
           // Exact match for URI
           const uriIds = paramIndex.get(trimmedValue);
           if (uriIds) {
             uriIds.forEach(id => matchingIds.add(id));
           }
           break;
+        }
 
-        default:
+        default: {
           // Default: exact match (case-insensitive)
           const defaultIds = paramIndex.get(trimmedValue.toLowerCase());
           if (defaultIds) {
             defaultIds.forEach(id => matchingIds.add(id));
           }
+        }
       }
     }
 

package/package.json

@@ -1,15 +1,15 @@
 {
   "name": "fhirsmith",
-  "version": "0.18.1",
-  "txVersion": "1.10.0",
+  "version": "1.0.0",
+  "txVersion": "1.11.1-snapshot",
   "description": "A Node.js server that provides a collection of tools to serve the FHIR ecosystem",
   "main": "server.js",
   "engines": {
     "node": ">=24"
   },
   "scripts": {
-    "start": "node server.js",
-    "dev": "node --watch server.js",
+    "start": "node --expose-gc server.js",
+    "dev": "node --expose-gc --watch server.js",
     "test": "jest",
     "test:watch": "jest --watch",
     "test:coverage": "jest --coverage",
@@ -48,7 +48,7 @@
     "express-rate-limit": "^7.4.1",
     "express-session": "^1.19.0",
     "fast-xml-parser": "^5.3.4",
-    "fhir-validator-wrapper": "1.5.0",
+    "fhir-validator-wrapper": "1.7.0",
     "fhirpath": "^5.2.1",
     "fs-extra": "^11.3.3",
     "ini": "^6.0.0",
@@ -68,13 +68,15 @@
     "properties-file": "^3.6.4",
     "qrcode-generator": "^2.0.4",
     "re2js": "^2.8.0",
-    "rimraf": "^5.0.10",
     "sqlite3": "^6.0.1",
     "tar": "^7.5.7",
     "winston": "^3.19.0",
     "winston-daily-rotate-file": "^4.7.1",
     "yaml": "^2.8.2"
   },
+  "optionalDependencies": {
+    "koffi": "^3.3.6"
+  },
   "devDependencies": {
     "@types/jest": "^30.0.0",
     "@typescript-eslint/eslint-plugin": "^8.54.0",
@@ -109,7 +111,7 @@
     "smart-health-card"
   ],
   "author": "Health Intersections Pty Ltd",
-  "license": "BSD-3",
+  "license": "BSD-3-Clause",
   "overrides": {
     "@istanbuljs/load-nyc-config": {
       "js-yaml": "^4.1.0"
@@ -117,7 +119,8 @@
   },
   "bin": {
     "tx-import": "./tx/importers/tx-import.js",
-    "fhirsmith": "./server.js"
+    "fhirsmith": "./server.js",
+    "fhirsmith-cluster": "./cluster.js"
   },
   "repository": {
     "type": "git",

package/packages/feed-check-page.js

@@ -0,0 +1,117 @@
+//
+// Copyright 2026, Health Intersections Pty Ltd (http://www.healthintersections.com.au)
+//
+// Licensed under BSD-3: https://opensource.org/license/bsd-3-clause
+//
+
+// HTML for /packages/feed-check: the form, and a run's report (see feed-check.js)
+
+const escape = require('escape-html');
+
+function form(values = {}) {
+  let html = '<form method="get" action="/packages/feed-check" class="mb-4">';
+  html += '<p><label for="url">Package feed URL</label> ';
+  html += `<input type="url" id="url" name="url" size="70" required maxlength="500" placeholder="https://example.org/fhir/package-feed.xml" value="${escape(values.url || '')}"> `;
+  html += '<button type="submit" class="btn btn-primary">Check the feed</button></p>';
+  html += '<p><label for="signing">Signing keys (optional)</label><br>';
+  html += '<textarea id="signing" name="signing" rows="6" cols="90" maxlength="5000" aria-describedby="signing-help" ' +
+    'placeholder=\'{"required": false, "keys": [{"keyid": "SHA256:...", "key": "MFkw...", "expires": null}]}\'>' +
+    `${escape(values.signing || '')}</textarea><br>`;
+  html += '<small id="signing-help">The feed\'s <code>signing</code> block as JSON, as it would be in package-feeds.json (or the feed\'s whole entry). ' +
+    'Signatures are checked against these keys instead of the ones the registry lists for the feed - so a feed can be tested before its keys are registered.</small></p>';
+  html += '<p><small>Reads the feed the way this registry\'s crawler does - each item, its package and its signature - ' +
+    'and reports what it finds. Nothing is stored. Packages are downloaded, so a large feed takes a while; ' +
+    'the check stops after a set number of items.</small></p>';
+  html += '</form>';
+  return html;
+}
+
+function renderForm(values) {
+  return form(values);
+}
+
+const SIGNATURE = {
+  confirmed: '<span class="text-success">confirmed</span>',
+  rejected: '<span class="text-danger">rejected</span>',
+  unfetchable: '<span class="text-danger">couldn\'t be fetched</span>',
+  unchecked: 'not checked',
+  absent: '<span class="text-muted">absent</span>'
+};
+
+function item(r) {
+  let html = '<tr>';
+  const status = r.status === 'ok' ? '<span class="text-success">ok</span>'
+    : r.status === 'error' ? '<span class="text-danger">error</span>' : '<span class="text-muted">skipped</span>';
+  html += `<td>${status}</td>`;
+  html += `<td>${r.link ? `<a href="${escape(r.link)}">${escape(r.title || '(no title)')}</a>` : escape(r.title || '(no title)')}</td>`;
+  html += `<td>${r.package ? escape(r.package.fhirVersions || '') : ''}</td>`;
+  html += `<td>${r.date ? escape(r.date.substring(0, 10)) : ''}</td>`;
+  html += `<td>${r.package ? r.package.sizeKB.toLocaleString() + ' KB' : ''}</td>`;
+  if (r.signature) {
+    const label = SIGNATURE[r.signature.state] || escape(r.signature.state);
+    html += `<td>${r.signature.url ? `<a href="${escape(r.signature.url)}">${label}</a>` : label}` +
+      (r.signature.detail && r.signature.state !== 'absent' ? `<br><small>${escape(r.signature.detail)}</small>` : '') + '</td>';
+  } else {
+    html += '<td></td>';
+  }
+  html += `<td>${escape(r.held || '')}</td>`;
+  const notes = [...r.problems.map(p => `<li class="text-danger">${escape(p)}</li>`),
+    ...r.warnings.map(w => `<li>${escape(w)}</li>`),
+    ...(r.skipped ? [`<li>${escape(r.skipped)}</li>`] : [])];
+  html += `<td>${notes.length ? `<ul class="mb-0">${notes.join('')}</ul>` : ''}</td>`;
+  html += '</tr>';
+  return html;
+}
+
+// job: {id, url, state (running, done, failed), report, error}
+function renderJob(job) {
+  const r = job.report;
+  let html = `<p>Feed: <a href="${escape(job.url)}">${escape(job.url)}</a></p>`;
+  if (job.state === 'running') {
+    html += `<div class="alert alert-info" role="status">Checking... ${r ? r.items.length : 0} item(s) so far. ` +
+      `This page reloads every few seconds until the check finishes (<a href="/packages/feed-check/${escape(job.id)}">reload now</a>).</div>`;
+  } else if (job.state === 'failed') {
+    html += `<div class="alert alert-danger">The check failed: ${escape(job.error || 'unknown error')}</div>`;
+  }
+  if (r) {
+    if (r.registered) {
+      html += `<p>In the registry's feed list as <strong>${escape(r.registered.name || '(no name)')}</strong>.`;
+      html += r.signing && r.signingSource === 'registry' ? ` Signing keys: ${r.signing.keys.map(k => `<code>${escape(k)}</code>`).join(', ')}${r.signing.required ? ' (signatures required)' : ''}.`
+        : r.signingSource === 'given' ? '' : ' It lists no signing keys.';
+      html += '</p>';
+    }
+    if (r.signingSource === 'given') {
+      html += `<p>Signatures checked against the keys given with the check: ${r.signing.keys.map(k => `<code>${escape(k)}</code>`).join(', ')}${r.signing.required ? ' (signatures required)' : ''}.</p>`;
+    }
+    for (const n of r.notes) {
+      html += `<div class="alert alert-warning">${escape(n)}</div>`;
+    }
+    for (const e of r.errors) {
+      html += `<div class="alert alert-danger">${escape(e)}</div>`;
+    }
+    if (job.state !== 'running') {
+      const counts = { ok: 0, error: 0, skipped: 0 };
+      r.items.forEach(i => counts[i.status]++);
+      const sigs = {};
+      r.items.forEach(i => {
+        if (i.signature) {
+          sigs[i.signature.state] = (sigs[i.signature.state] || 0) + 1;
+        }
+      });
+      html += `<p><strong>${r.items.length}</strong> item(s) on ${r.pages.length} page(s): ${counts.ok} ok, ${counts.error} with errors, ${counts.skipped} skipped. ` +
+        `Signatures: ${Object.entries(sigs).map(([k, v]) => `${v} ${escape(k)}`).join(', ') || 'none'}. ` +
+        `${r.downloadedMB} MB downloaded.${r.truncated ? ' <strong>The check stopped at its item limit; the feed has more.</strong>' : ''}</p>`;
+    }
+    if (r.items.length > 0) {
+      html += '<div class="table-responsive"><table class="table table-striped">';
+      html += '<thead><tr><th>Status</th><th>Package</th><th>FHIR version</th><th>Published</th><th>Size</th><th>Signature</th><th>Held here</th><th>Notes</th></tr></thead><tbody>';
+      html += r.items.map(item).join('');
+      html += '</tbody></table></div>';
+    }
+  }
+  html += '<h3 class="mt-4">Check another feed</h3>';
+  html += form({});
+  return html;
+}
+
+module.exports = { renderForm, renderJob };