pysof 0.2.3__tar.gz → 0.2.4__tar.gz

{pysof-0.2.3 → pysof-0.2.4}/Cargo.toml

@@ -17,8 +17,8 @@ crate-type = ["cdylib"]
 
 [dependencies]
 pyo3 = { version = ">=0.29", features = ["extension-module", "generate-import-lib"] }
-helios-sof = { path = "../sof", version = "0.2.3", default-features = false }
-helios-fhir = { path = "../fhir", version = "0.2.3", default-features = false }
+helios-sof = { path = "../sof", version = "0.2.4", default-features = false }
+helios-fhir = { path = "../fhir", version = "0.2.4", default-features = false }
 serde = { workspace = true }
 serde_json = { workspace = true }
 chrono = { version = "0.4", features = ["serde"] }

{pysof-0.2.3 → pysof-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pysof
-Version: 0.2.3
+Version: 0.2.4
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11

{pysof-0.2.3 → pysof-0.2.4}/crates/fhir/Cargo.toml

@@ -24,9 +24,9 @@ xml = ["helios-serde-support/xml"]
 serde = { workspace = true }
 serde_json = { workspace = true, features = ["raw_value"] }
 clap = { version = "4.0", features = ["derive"] }
-helios-fhir-macro = { path = "../fhir-macro", version = "0.2.3" }
-helios-serde-support = { path = "../serde-support", version = "0.2.3" }
-helios-fhirpath-support = { path = "../fhirpath-support", version = "0.2.3" }
+helios-fhir-macro = { path = "../fhir-macro", version = "0.2.4" }
+helios-serde-support = { path = "../serde-support", version = "0.2.4" }
+helios-fhirpath-support = { path = "../fhirpath-support", version = "0.2.4" }
 time = "0.3"
 chrono = { workspace = true }
 # Re-add serde-with-arbitrary-precision, keep macros

{pysof-0.2.3 → pysof-0.2.4}/crates/fhir/src/r4.rs

@@ -165598,6 +165598,15 @@ pub enum ViewDefinitionVersionAlgorithm {
     summary_fields = "id,meta,implicit_rules,modifier_extension,url,identifier,version,version_algorithm,name,title,status,experimental,date,publisher,contact,use_context,jurisdiction,effective_period"
 )]
 pub struct ViewDefinition {
+    /// Canonical of the definition of this additional resource
+    ///
+    /// The versioned canonical URL of the StructureDefinition that defines this
+    /// resource type. Instances of an additional resource - a resource type defined
+    /// outside the core FHIR specification - carry it alongside resourceType.
+    ///
+    /// ## Cardinality: Optional (0..1)
+    #[fhir_serde(rename = "resourceDefinition")]
+    pub resource_definition: Option<Canonical>,
     /// Logical id of this artifact
     ///
     /// The logical id of the resource, as used in the URL for the resource. Once
@@ -190545,6 +190554,7 @@ pub static FIELD_TYPES: &[(&str, &str, &str, bool)] = &[
     ("ViewDefinition", "purpose", "markdown", false),
     ("ViewDefinition", "relatedArtifact", "RelatedArtifact", true),
     ("ViewDefinition", "resource", "code", false),
+    ("ViewDefinition", "resourceDefinition", "canonical", false),
     ("ViewDefinition", "reviewer", "ContactDetail", true),
     ("ViewDefinition", "select", "ViewDefinitionSelect", true),
     ("ViewDefinition", "status", "code", false),

{pysof-0.2.3 → pysof-0.2.4}/crates/fhir/src/r4b.rs

@@ -169276,6 +169276,15 @@ pub enum ViewDefinitionVersionAlgorithm {
     summary_fields = "id,meta,implicit_rules,modifier_extension,url,identifier,version,version_algorithm,name,title,status,experimental,date,publisher,contact,use_context,jurisdiction,effective_period"
 )]
 pub struct ViewDefinition {
+    /// Canonical of the definition of this additional resource
+    ///
+    /// The versioned canonical URL of the StructureDefinition that defines this
+    /// resource type. Instances of an additional resource - a resource type defined
+    /// outside the core FHIR specification - carry it alongside resourceType.
+    ///
+    /// ## Cardinality: Optional (0..1)
+    #[fhir_serde(rename = "resourceDefinition")]
+    pub resource_definition: Option<Canonical>,
     /// Logical id of this artifact
     ///
     /// The logical id of the resource, as used in the URL for the resource. Once
@@ -194576,6 +194585,7 @@ pub static FIELD_TYPES: &[(&str, &str, &str, bool)] = &[
     ("ViewDefinition", "purpose", "markdown", false),
     ("ViewDefinition", "relatedArtifact", "RelatedArtifact", true),
     ("ViewDefinition", "resource", "code", false),
+    ("ViewDefinition", "resourceDefinition", "canonical", false),
     ("ViewDefinition", "reviewer", "ContactDetail", true),
     ("ViewDefinition", "select", "ViewDefinitionSelect", true),
     ("ViewDefinition", "status", "code", false),

{pysof-0.2.3 → pysof-0.2.4}/crates/fhir/src/r5.rs

@@ -212700,6 +212700,15 @@ pub enum ViewDefinitionVersionAlgorithm {
     summary_fields = "id,meta,implicit_rules,modifier_extension,url,identifier,version,version_algorithm,name,title,status,experimental,date,publisher,contact,use_context,jurisdiction,effective_period"
 )]
 pub struct ViewDefinition {
+    /// Canonical of the definition of this additional resource
+    ///
+    /// The versioned canonical URL of the StructureDefinition that defines this
+    /// resource type. Instances of an additional resource - a resource type defined
+    /// outside the core FHIR specification - carry it alongside resourceType.
+    ///
+    /// ## Cardinality: Optional (0..1)
+    #[fhir_serde(rename = "resourceDefinition")]
+    pub resource_definition: Option<Canonical>,
     /// Logical id of this artifact
     ///
     /// The logical id of the resource, as used in the URL for the resource. Once
@@ -244724,6 +244733,7 @@ pub static FIELD_TYPES: &[(&str, &str, &str, bool)] = &[
     ("ViewDefinition", "purpose", "markdown", false),
     ("ViewDefinition", "relatedArtifact", "RelatedArtifact", true),
     ("ViewDefinition", "resource", "code", false),
+    ("ViewDefinition", "resourceDefinition", "canonical", false),
     ("ViewDefinition", "reviewer", "ContactDetail", true),
     ("ViewDefinition", "select", "ViewDefinitionSelect", true),
     ("ViewDefinition", "status", "code", false),

{pysof-0.2.3 → pysof-0.2.4}/crates/fhir/src/r6.rs

@@ -174780,6 +174780,15 @@ pub enum ViewDefinitionVersionAlgorithm {
     summary_fields = "id,meta,implicit_rules,modifier_extension,url,identifier,version,version_algorithm,name,title,status,experimental,date,publisher,contact,use_context,jurisdiction,effective_period"
 )]
 pub struct ViewDefinition {
+    /// Canonical of the definition of this additional resource
+    ///
+    /// The versioned canonical URL of the StructureDefinition that defines this
+    /// resource type. Instances of an additional resource - a resource type defined
+    /// outside the core FHIR specification - carry it alongside resourceType.
+    ///
+    /// ## Cardinality: Optional (0..1)
+    #[fhir_serde(rename = "resourceDefinition")]
+    pub resource_definition: Option<Canonical>,
     /// Logical id of this artifact
     ///
     /// The logical id of the resource, as used in the URL for the resource. Once
@@ -202780,6 +202789,7 @@ pub static FIELD_TYPES: &[(&str, &str, &str, bool)] = &[
     ("ViewDefinition", "purpose", "markdown", false),
     ("ViewDefinition", "relatedArtifact", "RelatedArtifact", true),
     ("ViewDefinition", "resource", "code", false),
+    ("ViewDefinition", "resourceDefinition", "canonical", false),
     ("ViewDefinition", "reviewer", "ContactDetail", true),
     ("ViewDefinition", "select", "ViewDefinitionSelect", true),
     ("ViewDefinition", "status", "code", false),

{pysof-0.2.3 → pysof-0.2.4}/crates/fhir/src/search/loader.rs

@@ -20,6 +20,21 @@ use super::registry::{
 };
 use super::types::SearchParamType;
 
+/// Whether `code` is usable as a search parameter name on this server: one or
+/// more ASCII letters, digits, `-` or `_`.
+///
+/// Every code the specification defines has this shape, and it is stricter
+/// than R6's `spd-4` (no `.`, `$`, `|` or whitespace): a code is a query-string
+/// key, is split on `:` for modifiers and `.` for chains, and names index rows,
+/// so anything else either cannot be searched on or has no business reaching
+/// a storage backend.
+pub fn is_valid_search_parameter_code(code: &str) -> bool {
+    !code.is_empty()
+        && code
+            .bytes()
+            .all(|b| b.is_ascii_alphanumeric() || b == b'-' || b == b'_')
+}
+
 /// Transforms FHIRPath expressions to replace `as` operator/function with `ofType`.
 ///
 /// Per FHIRPath spec, `as(type)` requires singleton input and throws an error for
@@ -494,6 +509,15 @@ impl SearchParameterLoader {
                 url: Some(url.clone()),
             })?
             .to_string();
+        if !is_valid_search_parameter_code(&code) {
+            return Err(LoaderError::InvalidResource {
+                message: format!(
+                    "SearchParameter.code {code:?} may contain only ASCII letters, digits, \
+                     '-' and '_'"
+                ),
+                url: Some(url),
+            });
+        }
 
         let type_str = resource
             .get("type")
@@ -923,6 +947,33 @@ mod tests {
         assert_eq!(param.status, SearchParameterStatus::Active);
     }
 
+    /// A code outside `[A-Za-z0-9_-]` is refused, so it never reaches the
+    /// registry or a storage backend's query text.
+    #[test]
+    fn test_parse_resource_rejects_an_unsafe_code() {
+        let loader = SearchParameterLoader::new(FhirVersion::default());
+        for code in ["ev'il", "a b", "a.b", "a:b", "", "a\\b"] {
+            let resource = serde_json::json!({
+                "resourceType": "SearchParameter",
+                "url": "http://example.org/sp/x",
+                "code": code,
+                "base": ["Patient"],
+                "type": "string",
+                "expression": "Patient.name.family",
+                "status": "active",
+            });
+            assert!(
+                matches!(
+                    loader.parse_resource(&resource),
+                    Err(LoaderError::InvalidResource { .. })
+                ),
+                "{code:?}"
+            );
+        }
+        assert!(is_valid_search_parameter_code("value-quantity"));
+        assert!(is_valid_search_parameter_code("_lastUpdated"));
+    }
+
     #[test]
     fn test_parse_resource_missing_field() {
         let loader = SearchParameterLoader::new(FhirVersion::default());

{pysof-0.2.3 → pysof-0.2.4}/crates/fhir-macro/Cargo.toml

@@ -20,4 +20,4 @@ proc-macro2 = "1.0"
 serde = { workspace = true }
 serde_json = { workspace = true }
 heck = "0.5" # For case conversion
-helios-fhirpath-support = { path = "../fhirpath-support", version = "0.2.3" }
+helios-fhirpath-support = { path = "../fhirpath-support", version = "0.2.4" }

{pysof-0.2.3 → pysof-0.2.4}/crates/fhirpath/Cargo.toml

@@ -21,9 +21,9 @@ R6 = ["helios-fhir/R6"]
 otel = ["helios-observability/otel"]
 
 [dependencies]
-helios-fhir = { path = "../fhir", version = "0.2.3", default-features = false }
-helios-fhirpath-support = { path = "../fhirpath-support", version = "0.2.3" }
-helios-observability = { path = "../observability", version = "0.2.3" }
+helios-fhir = { path = "../fhir", version = "0.2.4", default-features = false }
+helios-fhirpath-support = { path = "../fhirpath-support", version = "0.2.4" }
+helios-observability = { path = "../observability", version = "0.2.4" }
 chumsky = "0.10"
 roxmltree = "0.20"
 chrono = { workspace = true } # For date/time parsing and functions

{pysof-0.2.3 → pysof-0.2.4}/crates/fhirpath/src/lib.rs

@@ -368,23 +368,119 @@ pub fn evaluate_expression(
     })
 }
 
+/// The maximum `(`/`[`/`{` nesting depth the parser accepts.
+///
+/// The FHIRPath grammar is recursive-descent, so an expression's nesting
+/// depth bounds the parser's stack use. Left unchecked, a pathologically
+/// nested expression (thousands of `(` deep) overflows the worker thread's
+/// stack and aborts the whole process — there is no unwinding a stack
+/// overflow. Every public parse entry point refuses input past this depth
+/// with an ordinary parse error first. The limit is far above any real
+/// expression: FHIRPath paths in the wild nest a handful deep, and the SQL
+/// compiler, search extractor, patch paths and ViewDefinition columns that
+/// feed untrusted text through here never approach it.
+pub const MAX_NESTING_DEPTH: usize = 100;
+
+/// Nesting depth safe to parse inline on any thread HFS runs on, including a
+/// 2 MB tokio worker in a debug build. Real FHIRPath expressions nest at most
+/// two or three deep (measured across the bundled spec search parameters), so
+/// the inline fast path covers all of them.
+const INLINE_PARSE_DEPTH: usize = 6;
+
+/// Stack for the off-thread parse of a deeply — but legally, within
+/// [`MAX_NESTING_DEPTH`] — nested expression. 32 MB parses depth 100 in a
+/// debug build with room to spare; 64 MB is margin. The address space is
+/// reserved, not committed, so the reservation is free until touched.
+const DEEP_PARSE_STACK_BYTES: usize = 64 * 1024 * 1024;
+
+/// The deepest `(`/`[`/`{` nesting in `expression`, ignoring brackets inside
+/// single-quoted string literals and backtick-delimited identifiers (both
+/// with `\` escapes). One linear, allocation-free pass; used to reject input
+/// that would overflow the recursive-descent parser (see [`MAX_NESTING_DEPTH`]).
+fn max_nesting_depth(expression: &str) -> usize {
+    let mut depth: usize = 0;
+    let mut max: usize = 0;
+    let mut quote: Option<char> = None;
+    let mut escaped = false;
+    for c in expression.chars() {
+        if let Some(q) = quote {
+            if escaped {
+                escaped = false;
+            } else if c == '\\' {
+                escaped = true;
+            } else if c == q {
+                quote = None;
+            }
+            continue;
+        }
+        match c {
+            '\'' | '`' => quote = Some(c),
+            '(' | '[' | '{' => {
+                depth += 1;
+                max = max.max(depth);
+            }
+            ')' | ']' | '}' => depth = depth.saturating_sub(1),
+            _ => {}
+        }
+    }
+    max
+}
+
+/// Runs `parse` inline when `depth` is shallow, or on a dedicated large-stack
+/// thread when it is deeper, so a deeply nested expression cannot overflow the
+/// caller's (possibly 2 MB) stack. Depth past [`MAX_NESTING_DEPTH`] is the
+/// caller's to reject before calling this. The recursive-descent parser's
+/// stack use grows with nesting; before this guard a few-thousand-deep column
+/// path in a ViewDefinition overflowed the tokio worker and aborted the whole
+/// process, which a stack overflow gives no chance to unwind.
+fn run_parse<T: Send>(depth: usize, parse: impl FnOnce() -> T + Send) -> T {
+    if depth <= INLINE_PARSE_DEPTH {
+        return parse();
+    }
+    std::thread::scope(|scope| {
+        std::thread::Builder::new()
+            .stack_size(DEEP_PARSE_STACK_BYTES)
+            .spawn_scoped(scope, parse)
+            .expect("spawn FHIRPath deep-parse thread")
+            .join()
+            .expect("FHIRPath deep-parse thread panicked")
+    })
+}
+
+/// The [`ParseDiagnostic`] returned when an expression is nested past
+/// [`MAX_NESTING_DEPTH`]: it spans the whole expression, since the depth is a
+/// property of the input as a whole rather than of one position in it.
+fn nesting_diagnostic(expression: &str) -> ParseDiagnostic {
+    ParseDiagnostic {
+        span: (0, expression.chars().count()),
+        message: format!("nesting exceeds the maximum depth of {MAX_NESTING_DEPTH}"),
+    }
+}
+
 /// Parse a FHIRPath expression source string into a typed [`parser::Expression`] AST.
 ///
 /// Provides a chumsky-free entry point for consumers that need the AST
 /// (e.g. compiling FHIRPath to SQL) without taking a dependency on the
 /// parser-combinator crate.
 pub fn parse_expression(expression: &str) -> Result<parser::Expression, String> {
-    use chumsky::Parser;
-
-    parser::parser()
-        .parse(expression)
-        .into_result()
-        .map_err(|e| {
-            format!(
-                "Failed to parse FHIRPath expression '{}': {:?}",
-                expression, e
-            )
-        })
+    let depth = max_nesting_depth(expression);
+    if depth > MAX_NESTING_DEPTH {
+        return Err(format!(
+            "Failed to parse FHIRPath expression: nesting exceeds the maximum depth of {MAX_NESTING_DEPTH}"
+        ));
+    }
+    run_parse(depth, || {
+        use chumsky::Parser;
+        parser::parser()
+            .parse(expression)
+            .into_result()
+            .map_err(|e| {
+                format!(
+                    "Failed to parse FHIRPath expression '{}': {:?}",
+                    expression, e
+                )
+            })
+    })
 }
 
 /// A single parse error from [`parse_expression_diagnostics`], with its span
@@ -435,26 +531,31 @@ pub struct ParseDiagnostic {
 pub fn parse_expression_diagnostics(
     expression: &str,
 ) -> Result<parser::Expression, Vec<ParseDiagnostic>> {
-    use chumsky::Parser;
-
-    parser::parser()
-        .parse(expression)
-        .into_result()
-        .map_err(|errors| {
-            errors
-                .iter()
-                .map(|error| {
-                    let span = error.span();
-                    ParseDiagnostic {
-                        span: (
-                            byte_to_char_offset(expression, span.start),
-                            byte_to_char_offset(expression, span.end),
-                        ),
-                        message: error.to_string(),
-                    }
-                })
-                .collect()
-        })
+    let depth = max_nesting_depth(expression);
+    if depth > MAX_NESTING_DEPTH {
+        return Err(vec![nesting_diagnostic(expression)]);
+    }
+    run_parse(depth, || {
+        use chumsky::Parser;
+        parser::parser()
+            .parse(expression)
+            .into_result()
+            .map_err(|errors| {
+                errors
+                    .iter()
+                    .map(|error| {
+                        let span = error.span();
+                        ParseDiagnostic {
+                            span: (
+                                byte_to_char_offset(expression, span.start),
+                                byte_to_char_offset(expression, span.end),
+                            ),
+                            message: error.to_string(),
+                        }
+                    })
+                    .collect()
+            })
+    })
 }
 
 /// Converts a UTF-8 byte offset into `s` (assumed to already fall on a
@@ -498,26 +599,31 @@ fn byte_to_char_offset(s: &str, byte_offset: usize) -> usize {
 pub fn parse_expression_spanned(
     expression: &str,
 ) -> Result<parser::SpannedExpression, Vec<ParseDiagnostic>> {
-    use chumsky::Parser;
-
-    parser::spanned_parser()
-        .parse(expression)
-        .into_result()
-        .map_err(|errors| {
-            errors
-                .iter()
-                .map(|error| {
-                    let span = error.span();
-                    ParseDiagnostic {
-                        span: (
-                            byte_to_char_offset(expression, span.start),
-                            byte_to_char_offset(expression, span.end),
-                        ),
-                        message: error.to_string(),
-                    }
-                })
-                .collect()
-        })
+    let depth = max_nesting_depth(expression);
+    if depth > MAX_NESTING_DEPTH {
+        return Err(vec![nesting_diagnostic(expression)]);
+    }
+    run_parse(depth, || {
+        use chumsky::Parser;
+        parser::spanned_parser()
+            .parse(expression)
+            .into_result()
+            .map_err(|errors| {
+                errors
+                    .iter()
+                    .map(|error| {
+                        let span = error.span();
+                        ParseDiagnostic {
+                            span: (
+                                byte_to_char_offset(expression, span.start),
+                                byte_to_char_offset(expression, span.end),
+                            ),
+                            message: error.to_string(),
+                        }
+                    })
+                    .collect()
+            })
+    })
 }
 
 /// Converts a byte-offset [`parser::ExprSpan`] (as produced by

{pysof-0.2.3 → pysof-0.2.4}/crates/fhirpath/src/not_function.rs

@@ -73,12 +73,11 @@ pub fn not_function(
     // Convert invocation_base to its 3-valued logic boolean form.
     // This handles singletons (Boolean, Integer, String, etc.) and empty/singleton collections.
     // Pass R4 compatibility flag based on FHIR version
-    use helios_fhir::FhirVersion;
     let r4_compat = match context.fhir_version {
         #[cfg(feature = "R4")]
-        FhirVersion::R4 => true,
+        helios_fhir::FhirVersion::R4 => true,
         #[cfg(feature = "R4B")]
-        FhirVersion::R4B => true,
+        helios_fhir::FhirVersion::R4B => true,
         #[allow(unreachable_patterns)]
         _ => false,
     };

{pysof-0.2.3 → pysof-0.2.4}/crates/fhirpath/src/reference_key_functions.rs

@@ -100,6 +100,31 @@ pub fn get_reference_key_function(
     };
 
     match invocation_base {
+        // A repeating Reference element (e.g. Encounter.episodeOfCare) arrives as a
+        // collection, even when it holds a single item: map over the items and drop
+        // the ones that yield no key.
+        EvaluationResult::Collection {
+            items,
+            has_undefined_order,
+            ..
+        } => {
+            let mut keys = Vec::new();
+            for item in items {
+                match get_reference_key_function(item, args)? {
+                    EvaluationResult::Empty => {}
+                    key => keys.push(key),
+                }
+            }
+            Ok(match keys.len() {
+                0 => EvaluationResult::Empty,
+                1 => keys.remove(0),
+                _ => EvaluationResult::Collection {
+                    items: keys,
+                    has_undefined_order: *has_undefined_order,
+                    type_info: None,
+                },
+            })
+        }
         EvaluationResult::Object { map, .. } => {
             // Look for the reference field
             if let Some(reference_value) = map.get("reference") {
@@ -220,6 +245,58 @@ mod tests {
         assert!(matches!(result, EvaluationResult::Empty));
     }
 
+    #[test]
+    fn test_get_reference_key_function_on_collection() {
+        let reference = |value: &str| {
+            let mut map = HashMap::new();
+            map.insert(
+                "reference".to_string(),
+                EvaluationResult::String(value.to_string(), None, None),
+            );
+            EvaluationResult::Object {
+                map,
+                type_info: None,
+            }
+        };
+        let collection = |items| EvaluationResult::Collection {
+            items,
+            has_undefined_order: false,
+            type_info: None,
+        };
+        let filter = EvaluationResult::String("EpisodeOfCare".to_string(), None, None);
+
+        // A single-item collection yields the bare key
+        let single = collection(vec![reference("EpisodeOfCare/eoc1")]);
+        let result = get_reference_key_function(&single, std::slice::from_ref(&filter)).unwrap();
+        assert!(matches!(result, EvaluationResult::String(ref key, _, _) if key == "eoc1"));
+
+        // Items that do not match the type filter are dropped
+        let mixed = collection(vec![
+            reference("EpisodeOfCare/eoc1"),
+            reference("Patient/p1"),
+            reference("EpisodeOfCare/eoc2"),
+        ]);
+        let result = get_reference_key_function(&mixed, std::slice::from_ref(&filter)).unwrap();
+        match result {
+            EvaluationResult::Collection { items, .. } => {
+                let keys: Vec<_> = items
+                    .iter()
+                    .map(|item| match item {
+                        EvaluationResult::String(key, _, _) => key.as_str(),
+                        _ => panic!("Expected string item"),
+                    })
+                    .collect();
+                assert_eq!(keys, ["eoc1", "eoc2"]);
+            }
+            _ => panic!("Expected collection result"),
+        }
+
+        // Nothing matching yields Empty
+        let none = collection(vec![reference("Patient/p1")]);
+        let result = get_reference_key_function(&none, &[filter]).unwrap();
+        assert!(matches!(result, EvaluationResult::Empty));
+    }
+
     #[test]
     fn test_parse_reference() {
         assert_eq!(

{pysof-0.2.3 → pysof-0.2.4}/crates/fhirpath/src/server.rs

@@ -256,8 +256,15 @@ pub async fn run_server(config: ServerConfig) -> Result<(), Box<dyn std::error::
     // Create the server
     let listener = tokio::net::TcpListener::bind(addr).await?;
 
-    // Start the server
-    axum::serve(listener, app).await?;
+    // Start the server; drain on Ctrl-C or SIGTERM.
+    axum::serve(listener, app)
+        .with_graceful_shutdown(async {
+            let signal = helios_observability::shutdown::signal().await;
+            info!(signal, "Shutdown signal received, draining connections");
+        })
+        .await?;
+    // After the drain, so spans from the draining requests are exported too.
+    helios_observability::telemetry::shutdown();
 
     Ok(())
 }

pysof-0.2.4/crates/fhirpath/tests/nesting_depth.rs

@@ -0,0 +1,56 @@
+//! A pathologically nested FHIRPath expression is refused with a parse error
+//! rather than overflowing the recursive-descent parser's stack and aborting
+//! the process. Found by fuzzing the SQL-on-FHIR ViewDefinition column path on
+//! 2026-09-30: a column `path` a few thousand parentheses deep crashed the
+//! whole `hfs` process ("thread 'tokio-rt-worker' has overflowed its stack"),
+//! taking every in-flight request with it — a stack overflow cannot be caught.
+
+use helios_fhirpath::{
+    MAX_NESTING_DEPTH, parse_expression, parse_expression_diagnostics, parse_expression_spanned,
+};
+
+/// `id` wrapped in `depth` layers of parentheses — valid FHIRPath that parses
+/// to the same thing as `id`, but drives the parser `depth` levels deep.
+fn nested(depth: usize) -> String {
+    format!("{}id{}", "(".repeat(depth), ")".repeat(depth))
+}
+
+#[test]
+fn depth_at_the_limit_still_parses() {
+    assert!(parse_expression(&nested(MAX_NESTING_DEPTH)).is_ok());
+    assert!(parse_expression_diagnostics(&nested(MAX_NESTING_DEPTH)).is_ok());
+    assert!(parse_expression_spanned(&nested(MAX_NESTING_DEPTH)).is_ok());
+}
+
+#[test]
+fn depth_past_the_limit_is_a_parse_error_not_a_crash() {
+    // Deep enough to overflow the stack without the guard; the guard turns it
+    // into an ordinary error on every entry point.
+    let expr = nested(20_000);
+
+    let err = parse_expression(&expr).unwrap_err();
+    assert!(err.contains("nesting"), "{err}");
+
+    let diags = parse_expression_diagnostics(&expr).unwrap_err();
+    assert!(
+        diags.iter().any(|d| d.message.contains("nesting")),
+        "{diags:?}"
+    );
+
+    let diags = parse_expression_spanned(&expr).unwrap_err();
+    assert!(
+        diags.iter().any(|d| d.message.contains("nesting")),
+        "{diags:?}"
+    );
+}
+
+#[test]
+fn brackets_inside_a_string_literal_do_not_count_toward_depth() {
+    // A string literal full of parentheses nests the parser one level, not 500,
+    // so it must parse rather than trip the guard.
+    let expr = format!("'{}'", "(".repeat(500));
+    assert!(
+        parse_expression(&expr).is_ok(),
+        "string literal was miscounted"
+    );
+}

{pysof-0.2.3 → pysof-0.2.4}/crates/observability/Cargo.toml

@@ -45,8 +45,9 @@ chrono.workspace = true
 async-trait = "0.1"
 
 # The dashboard snapshot cache refreshes in a background task ("rt") and paces
-# its cold-start wait ("time"); see `dashboard::snapshot`.
-tokio = { version = "1", features = ["rt", "time"] }
+# its cold-start wait ("time"); see `dashboard::snapshot`. `shutdown::signal`
+# needs "signal" and "macros" (for `select!`).
+tokio = { version = "1", features = ["rt", "time", "signal", "macros"] }
 
 # OpenTelemetry (feature-gated). Versions pinned to a mutually compatible set:
 # core 0.32 / tracing-opentelemetry 0.33 (runs one minor ahead of core).