packages/commonwell-sdk/src/models/organization.ts (1)

60-60: Constrain securityTokenKeyType and normalize empty-string inputs

Broadening to z.string().nullish() weakens validation and allows arbitrary/empty values. If the CW API occasionally sends/accepts empty strings, preprocess them to undefined and keep a constrained enum otherwise. This preserves schema safety while still supporting the runner’s current behavior.

Apply this diff:

-  securityTokenKeyType: z.string().nullish(),
+  securityTokenKeyType: z.preprocess(
+    val => (val === "" ? undefined : val),
+    z.union([
+      z.literal("JWT"),
+      z.literal("BEARER"),
+      z.literal("HOLDER-OF-KEY"),
+    ]).optional()
+  ),

packages/commonwell-cert-runner/src/flows/org-management-initiator-only.ts (3)

30-33: Prefer omitting fields over sending empty/sentinel values

• gateways: setting to [] is fine if CW accepts an empty list; otherwise prefer leaving it undefined.
• securityTokenKeyType: sending an empty string is a weak sentinel. Prefer omitting the field instead.

This reduces payload ambiguity and aligns better with API semantics.

Apply this diff:

-    initiatorOnlyOrgCreate.gateways = [];
-    initiatorOnlyOrgCreate.securityTokenKeyType = "";
-    delete initiatorOnlyOrgCreate.authorizationInformation;
+    initiatorOnlyOrgCreate.gateways = [];
+    delete initiatorOnlyOrgCreate.securityTokenKeyType;
+    delete initiatorOnlyOrgCreate.authorizationInformation;

Please confirm whether CommonWell requires the property to be present (even if empty). If so, we can keep the property but normalize empty strings to undefined at the schema layer (see suggested preprocess in the SDK).

---

40-43: Nit: add a space after the colon; also consider redacting secrets in logs

• Minor formatting: add a space after "Transaction ID:" for consistency.
• Response logs may include authorizationInformation.clientSecret. Consider redacting before logging to avoid accidental secret exposure even in tooling.

Apply this diff for spacing:

-    console.log(">>> Transaction ID:" + commonWellMember.lastTransactionId);
+    console.log(">>> Transaction ID: " + commonWellMember.lastTransactionId);

Optionally, add a small helper to sanitize logs (example):

function safeStringifyOrg(org: unknown): string {
  try {
    const clone = JSON.parse(JSON.stringify(org));
    if (clone && typeof clone === "object" && "authorizationInformation" in clone) {
      // @ts-expect-error runtime guard
      const ai = clone.authorizationInformation;
      if (ai && typeof ai === "object" && "clientSecret" in ai) {
        ai.clientSecret = "***redacted***";
      }
    }
    return JSON.stringify(clone, null, 2);
  } catch {
    return String(org);
  }
}

Then use:

• console.log(">>> Response: " + safeStringifyOrg(respCreateInitiatorOnly));
• console.log(">>> Response: " + safeStringifyOrg(respGetInitiatorOnly));
• console.log(">>> Response: " + safeStringifyOrg(respUpdateInitiatorOnly));

---

51-53: Avoid empty-string sentinels and prefer truthy checks over in

• Prefer omitting securityTokenKeyType rather than setting it to an empty string.
• Align with our guideline to use truthy syntax instead of in.

Apply this diff:

-    initiatorOnlyOrg.securityTokenKeyType = "";
-    if ("authorizationInformation" in initiatorOnlyOrg) {
-      delete initiatorOnlyOrg.authorizationInformation;
-    }
+    delete initiatorOnlyOrg.securityTokenKeyType;
+    if (initiatorOnlyOrg.authorizationInformation) {
+      delete initiatorOnlyOrg.authorizationInformation;
+    }

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled
• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

Learnt from: RamilGaripov
PR: metriport/metriport#4176
File: packages/fhir-converter/src/lib/handlebars-converter/handlebars-helpers.js:296-320
Timestamp: 2025-07-17T21:24:37.077Z
Learning: RamilGaripov prefers to maintain consistency with existing patterns in a file rather than making isolated fixes to coding guideline violations like var vs const declarations, when the pattern is already established throughout the codebase.

Learnt from: leite08
PR: metriport/metriport#4095
File: packages/commonwell-cert-runner/src/flows/org-management.ts:79-85
Timestamp: 2025-07-16T19:02:26.395Z
Learning: In packages/commonwell-cert-runner/src/flows/org-management.ts, the silent error handling in the certificate retrieval catch block is intentional to allow the certification flow to continue processing even when certificate operations fail, as this is a testing tool rather than production code.