packages/commonwell-jwt-maker/package.json (1)

13-15: Add a tag to publishConfig for pre-releases

To prevent this alpha from being published under latest, update packages/commonwell-jwt-maker/package.json:

"publishConfig": {
  "access": "public",
+ "tag": "alpha"
},

No other packages currently define a publishConfig.tag, so this introduces the convention for alpha builds. If your release pipeline already applies a tag, you can ignore this.

packages/api/src/external/commonwell-v1/admin/recreate-patients-at-hies.ts (1)

150-153: Bug: Unconditionally deleting the “old” patient can delete the newly created patient

After creating the new CW patient, the code deletes originalCWPatientId unconditionally, even when originalCWPatientId === newCWPatientId. In that case, you’d delete the patient you just created/updated.

Guard the deletion:

-      // remove old patient
-      log(`Deleting old patient from CW...`);
-      await commonWell.deletePatient(queryMeta, originalCWPatientId);
+      // remove old patient only if IDs differ
+      if (originalCWPatientId !== newCWPatientId) {
+        log(`Deleting old patient from CW...`);
+        await commonWell.deletePatient(queryMeta, originalCWPatientId);
+      } else {
+        log(`Skipping deletion: original and new CW patient IDs match.`);
+      }

packages/api/src/external/commonwell-v1/mock.ts (1)

393-395: Method signature mismatch: resetPatientLink missing parameters

CommonWellAPI.resetPatientLink is invoked elsewhere as resetPatientLink(meta, personId, patientId), but the mock defines it with no parameters. This risks interface non-compliance and runtime confusion in tests.

Align the signature:

-  async resetPatientLink(): Promise<void> {
+  async resetPatientLink(
+    meta: sdk.RequestMetadata,
+    personId: string,
+    patientId: string
+  ): Promise<void> {
     return;
   }

packages/api/src/external/commonwell-v1/link/shared.ts (3)

100-100: Fix logical operator usage in filter condition.

The current expression isLOLA2 || isLOLA3 evaluates to true due to both functions being truthy, causing all network links to pass the filter instead of filtering for LOLA2 or LOLA3 links.

Apply this fix to use the logical OR correctly:

-    const validLola2or3Links = networkLinks.flatMap(filterTruthy).filter(isLOLA2 || isLOLA3);
+    const validLola2or3Links = networkLinks.flatMap(filterTruthy).filter(link => isLOLA2(link) || isLOLA3(link));

---

101-101: Fix logical operator usage in filter condition.

Same issue as Line 100 - the expression isLOLA2 || isLOLA3 will always evaluate to true, causing incorrect filtering behavior.

Apply this fix:

-    const invalidLola2or3Links = invalidLinks.flatMap(filterTruthy).filter(isLOLA2 || isLOLA3);
+    const invalidLola2or3Links = invalidLinks.flatMap(filterTruthy).filter(link => isLOLA2(link) || isLOLA3(link));

---

216-216: Improve type safety and handle undefined gender code.

The current code accesses patient?.details.gender.code without null-checking the gender property, which could cause runtime errors if gender is undefined.

Apply this fix to improve safety:

-  const genderCode = patient?.details.gender.code;
+  const genderCode = patient?.details.gender?.code;

packages/api/src/external/commonwell-v1/proxy/cw-process-request.ts (1)

42-42: Bug: _count filter is silently ignored

allowedQueryParams excludes "_count" and applyFilterParams reads "count" instead of "_count". As a result, the requested count limit is never applied.

Apply:

-const allowedQueryParams = ["status", "date", "_summary"];
+const allowedQueryParams = ["status", "date", "_summary", "_count"];

 export function applyFilterParams(
   docRefs: DocumentReference[],
   params: URLSearchParams
 ): DocumentReference[] {
   const date = params.get("date");
-  const countParam = params.get("count");
+  const countStr = params.get("_count");
   const status = params.get("status");
@@
-  if (countParam) {
-    const count = parseInt(countParam);
+  if (countStr) {
+    const count = parseInt(countStr);
     if (!isNaN(count)) {
       filteredDocRefs = filteredDocRefs.slice(0, count);
     }
   }

Also applies to: 203-249

packages/lambdas/src/cw-enhanced-coverage-link-patients.ts (1)

118-131: Bug: patientIds and cqOrgIds validations are inverted (should be arrays), breaking Input contract

The lambda expects lists of patient IDs and CQ org IDs (per the file’s description and typical Input shape for link flows). Current checks reject arrays and allow non-arrays — this will cause runtime failures and/or incorrect payloads passed downstream.

Fix the validations to accept non-empty arrays and ensure 'done' is boolean. Also prefer MetriportError with additional context, consistent with your error handling guidelines.

Apply this diff:

-  const patientIds = body.patientIds;
-  if (!patientIds) throw new Error(`Missing patientIds in body`);
-  if (Array.isArray(patientIds)) throw new Error(`Invalid patientIds in body`);
+  const patientIds = body.patientIds;
+  if (!Array.isArray(patientIds) || patientIds.length === 0) {
+    throw new MetriportError("Invalid patientIds in body", undefined, { body: stringify(body) });
+  }
 
-  const cqOrgIds = body.cqOrgIds;
-  if (!cqOrgIds) throw new Error(`Missing cqOrgIds in body`);
-  if (Array.isArray(cqOrgIds)) throw new Error(`Invalid cqOrgIds in body`);
+  const cqOrgIds = body.cqOrgIds;
+  if (!Array.isArray(cqOrgIds) || cqOrgIds.length === 0) {
+    throw new MetriportError("Invalid cqOrgIds in body", undefined, { body: stringify(body) });
+  }
 
-  const done = body.done;
-  if (done == undefined) throw new Error(`Missing 'done' in body`);
+  const done = body.done;
+  if (typeof done !== "boolean") {
+    throw new MetriportError("Missing or invalid 'done' in body", undefined, { body: stringify(body) });
+  }
 
   if (done) return { cxId, cxOrgOID, patientIds, done };
   return { cxId, cxOrgOID, patientIds, cqOrgIds, done };

packages/shared/src/common/date.ts (1)

42-53: validateDateOfBirth may throw instead of returning false (uses throwing validator by default)

The function claims to return true/false, but the default validateIsPastOrPresent throws on future dates. This will propagate an exception instead of returning false.

Use the safe validator by default and guard against thrown validators.

Apply this diff:

   const {
-    validateDateIsAfter1900: _validateDateIsAfter1900 = validateDateIsAfter1900,
-    validateIsPastOrPresent: _validateIsPastOrPresent = validateIsPastOrPresent,
+    validateDateIsAfter1900: _validateDateIsAfter1900 = validateDateIsAfter1900,
+    validateIsPastOrPresent: _validateIsPastOrPresent = validateIsPastOrPresentSafe,
   } = options || {};
-  return (
-    _validateDateIsAfter1900(parsedDate.format(ISO_DATE)) &&
-    _validateIsPastOrPresent(parsedDate.format(ISO_DATE))
-  );
+  const iso = parsedDate.format(ISO_DATE);
+  const after1900 = _validateDateIsAfter1900(iso);
+  let pastOrPresent = false;
+  try {
+    pastOrPresent = _validateIsPastOrPresent(iso);
+  } catch {
+    pastOrPresent = false;
+  }
+  return after1900 && pastOrPresent;

If you want, I can add unit tests covering valid DOB, future date, invalid strings, and override hooks.

packages/api/src/external/hie/set-doc-query-progress.ts (1)

215-224: Fix aggregation precedence: failed should override completed

Current order returns "completed" even if any source failed (as long as some completed). Prefer:

• processing > failed > completed

Apply this diff:

 export function aggregateStatus(docQueryProgress: DocumentQueryStatus[]): DocumentQueryStatus {
   const hasProcessing = docQueryProgress.some(status => status === "processing");
   const hasFailed = docQueryProgress.some(status => status === "failed");
   const hasCompleted = docQueryProgress.some(status => status === "completed");

-  if (hasProcessing) return "processing";
-  if (hasCompleted) return "completed";
-  if (hasFailed) return "failed";
-  return "completed";
+  if (hasProcessing) return "processing";
+  if (hasFailed) return "failed";
+  if (hasCompleted) return "completed";
+  return "completed";
 }

packages/api/src/external/fhir-converter/converter.ts (1)

27-30: Use strict checks; avoid abstract inequality

Per guidelines, avoid !=. Also no need to union with undefined in the param type.

Apply this diff:

-export function isConvertible(mimeType?: string | undefined): boolean {
-  // TODO move to core's isMimeTypeXML()
-  return mimeType != null && ["text/xml", "application/xml"].includes(mimeType);
-}
+export function isConvertible(mimeType?: string): boolean {
+  // TODO move to core's isMimeTypeXML()
+  return typeof mimeType === "string" && ["text/xml", "application/xml"].includes(mimeType);
+}

packages/api/src/external/commonwell-v1/document/shared.ts (1)

26-35: Fix filename composition to avoid 'undefined' segment and extra underscore

If display is undefined, the template currently injects the string "undefined" into the filename and also always adds an underscore after the prefix. Make the display segment optional and only append the trailing underscore when present.

Apply this diff:

 export function getFileName(patient: Patient, doc: Document): string {
   const prefix = "document_" + patient.id;
-  const display = doc.content?.type?.coding?.length
-    ? doc.content?.type.coding[0]?.display
-    : undefined;
+  const display = doc.content?.type?.coding?.[0]?.display?.trim();
   const suffix = getSuffix(doc.id);
   const extension = getFileExtension(doc.content?.mimeType);
-  const fileName = `${prefix}_${display ? display + "_" : display}${suffix}${extension}`;
+  const displaySegment = display ? `${display}_` : "";
+  const fileName = `${prefix}_${displaySegment}${suffix}${extension}`;
   return fileName.replace(/\s/g, "-");
 }

packages/utils/src/commonwell/cq-org-builder.ts (1)

4-10: Update resultFilename to use v1 path in CQ Org Builder

The builder is currently writing to the non-versioned JSON, but the v1 get-orgs importer reads from the versioned folder. We need to align them:

• File: packages/utils/src/commonwell/cq-org-builder.ts
– Line 34: change the output path to point at commonwell-v1 instead of commonwell

Suggested diff:

--- a/packages/utils/src/commonwell/cq-org-builder.ts
+++ b/packages/utils/src/commonwell/cq-org-builder.ts
@@ 34c34
-const resultFilename = `../../packages/core/src/external/commonwell/cq-bridge/cq-org-list.json`;
+const resultFilename = `../../packages/core/src/external/commonwell-v1/cq-bridge/cq-org-list.json`;

After updating, rerun the builder and verify that packages/core/src/external/commonwell-v1/cq-bridge/cq-org-list.json is correctly overwritten and in sync with getOrgs.

packages/api/src/external/commonwell-v1/document/document-query.ts (1)

314-316: Use organization name with organizationQueryMeta in document-query.ts

The vast majority of v1 call sites pass the org name (e.g. initiator.name) into organizationQueryMeta, and core tests assume that signature. In document-query.ts you’re passing the raw OID instead, which is inconsistent and likely incorrect.

• File: packages/api/src/external/commonwell-v1/document/document-query.ts
Line 315

Suggested change:

- const queryMeta = organizationQueryMeta(initiator.oid, { npi: initiator.npi });
+ const queryMeta = organizationQueryMeta(initiator.name, { npi: initiator.npi });

packages/lambdas/src/cw-session-management.ts (1)

50-55: Avoid logging secrets and credentials (security/PII concern)

Logging secret ARNs and usernames can leak sensitive information into CloudWatch/Sentry logs. Remove or mask these values.

Apply this diff to redact/remove sensitive logs:

-  console.log(
-    `Running with cookieSecretArn: ${cookieSecretArn}, ` +
-      `codeChallengeSecretArn: ${codeChallengeSecretArn}, ` +
-      `baseUrl: ${baseUrl}`
-  );
+  console.log(`Starting CW session management`, { baseUrl });

-    console.log(`...username ${username}, password 🤫`);
+    console.log(`Credentials loaded`);

Also applies to: 68-70

packages/commonwell-sdk/src/models/certificates.ts (1)

28-33: Remove _links from CertificateResp mocks and adjust tests
Since certificateRespSchema now only includes the certificates array, any mock or test that returns or asserts _links on a CertificateResp will fail. Please update all call sites accordingly:

• packages/api/src/external/commonwell-v1/mock.ts
  • In the addCertificateToOrg mock, remove the _links property and return an object shaped like { certificates: [{ purpose: … }] }.
• packages/api/src/external/commonwell-v1/tests/cw.register-facility.test.ts
  • Change the .mockImplementation(() => Promise.resolve({} as CertificateResp)) to return a valid CertificateResp, e.g. Promise.resolve({ certificates: [] }).
• Audit packages/api for any other mocks or consumers that return or reference _links on certificate responses and update them to match the new schema.

packages/commonwell-cert-runner/src/env.ts (1)

25-26: Harden CONTRIB_SERVER_PORT parsing (radix + NaN check)

Ensure radix is specified and fail fast on invalid ports.

Apply this diff:

-export const contribServerPort = parseInt(getEnvOrFail("CONTRIB_SERVER_PORT"));
+const contribServerPortRaw = getEnvOrFail("CONTRIB_SERVER_PORT");
+export const contribServerPort = Number.parseInt(contribServerPortRaw, 10);
+if (Number.isNaN(contribServerPort)) {
+  throw new Error(`Invalid CONTRIB_SERVER_PORT: ${contribServerPortRaw}`);
+}