packages/core/src/shareback/metadata/parse-metadata-xml.ts (1)

108-119: Bug: base64 must be decoded before rebuilding path; avoid decoding the rebuilt path

identifier.$.value appears to be base64-encoded. The current code passes it to rebuildUploadsFilePath (which expects a clear-text key or filename) and then attempts to base64-decode the rebuilt value for url and title. This will break for non-base64 strings and/or generate incorrect keys.

Decode first, then rebuild, and use the rebuilt clear-text key directly in url/title.

Apply this diff:

-    const value = rebuildUploadsFilePath(identifier.$.value);
+    const decoded = base64ToString(identifier.$.value);
+    const s3Key = rebuildUploadsFilePath(decoded);
@@
-        docRefContent.attachment = {
+        docRefContent.attachment = {
           ...docRefContent.attachment,
-          url: `https://${Config.getMedicalDocumentsBucketName()}.s3.${Config.getAWSRegion()}.amazonaws.com/${base64ToString(
-            value
-          )}`,
-          title: base64ToString(value),
+          url: `https://${Config.getMedicalDocumentsBucketName()}.s3.${Config.getAWSRegion()}.amazonaws.com/${s3Key}`,
+          title: s3Key,
         };

Follow-up: If ExternalIdentifier.value might sometimes be plain text (not base64), use a safe decoder that falls back to the original string on failure, then rebuild. I can provide a utility if needed.

packages/core/src/external/cda/process-attachments.ts (2)

193-199: Do not log entire FHIR transaction bundles (risk of PHI leakage); log a summary instead

Logging the full bundle likely exposes PHI/PII in logs. Replace with a count or minimal metadata.

Apply:

-  log(`[handleFhirUpload] Transaction bundle: ${JSON.stringify(transactionBundle)}`);
+  const entryCount = transactionBundle.entry?.length ?? 0;
+  log(`[handleFhirUpload] Transaction bundle entries: ${entryCount}`);

---

330-338: normalizeDateFromXml incorrectly truncates ISO dates (e.g., '2024-01-31' becomes '2024')

Splitting on '-' removes month/day for perfectly valid dates. Strip only trailing timezone offsets like +HH:MM or -HHMM.

Use a targeted regex:

-function normalizeDateFromXml(dateString: string) {
-  if (dateString.includes("+")) {
-    return dateString.split("+")[0];
-  }
-  if (dateString.includes("-")) {
-    return dateString.split("-")[0];
-  }
-  return dateString;
-}
+function normalizeDateFromXml(dateString: string) {
+  const ds = dateString.trim().replace(/^["']|["']$/g, "");
+  // Remove only a trailing timezone offset like +HH:MM, -HH:MM, +HHMM or -HHMM (if present).
+  // Keep hyphens within the date (e.g., YYYY-MM-DD).
+  return ds.replace(/([+-]\d{2}:?\d{2})$/u, "");
+}

packages/api/src/external/commonwell-v1/admin/find-patient-duplicates.ts (1)

1-6: Update remaining @metriport/commonwell-sdk imports to use the v1 alias

Our verification shows that while the new import in packages/api/src/external/commonwell-v1/admin/find-patient-duplicates.ts is correct and the v1 package is declared in the relevant package.json files, there are still numerous imports of the non-versioned SDK across the repo. To avoid mixing versions and ensure consistency, please migrate these to "@metriport/commonwell-sdk-v1":

• packages/utils/src/commonwell/coverage-assessment.ts, migrate from "@metriport/commonwell-sdk"
• packages/utils/src/commonwell/migrate-patients.ts, migrate from "@metriport/commonwell-sdk"
• packages/utils/src/commonwell/delete-network-links.ts, migrate from "@metriport/commonwell-sdk"
• packages/commonwell-jwt-maker/src/index.ts, migrate from "@metriport/commonwell-sdk"
• packages/commonwell-cert-runner/src/** (all imports of @metriport/commonwell-sdk)
• packages/api/src/external/commonwell-v2/** (imports of @metriport/commonwell-sdk)

Each consuming package should also confirm that "@metriport/commonwell-sdk-v1" appears in its package.json dependencies. Once all imports are updated, we can safely remove any lingering references to the unversioned SDK.

packages/lambdas/src/cw-enhanced-coverage-link-patients.ts (1)

118-125: Fix inverted array validation for patientIds/cqOrgIds; use strict null/undefined check for done.

As written, this throws when patientIds or cqOrgIds are arrays, which is likely the expected shape. This will cause runtime failures and type mismatches downstream. Also, prefer strict equality for done per guidelines.

Apply this diff:

-  const patientIds = body.patientIds;
-  if (!patientIds) throw new Error(`Missing patientIds in body`);
-  if (Array.isArray(patientIds)) throw new Error(`Invalid patientIds in body`);
+  const patientIds = body.patientIds;
+  if (!Array.isArray(patientIds) || patientIds.length === 0) {
+    throw new Error(`Invalid patientIds in body`);
+  }

-  const cqOrgIds = body.cqOrgIds;
-  if (!cqOrgIds) throw new Error(`Missing cqOrgIds in body`);
-  if (Array.isArray(cqOrgIds)) throw new Error(`Invalid cqOrgIds in body`);
+  const cqOrgIds = body.cqOrgIds;
+  if (!Array.isArray(cqOrgIds) || cqOrgIds.length === 0) {
+    throw new Error(`Invalid cqOrgIds in body`);
+  }

-  if (done == undefined) throw new Error(`Missing 'done' in body`);
+  if (done === undefined || done === null) throw new Error(`Missing 'done' in body`);

If you want to be stricter, we can add element-level type checks (string-only) or switch to a Zod schema for this SQS payload parsing. I can follow up with that if helpful.

Also applies to: 127-127

packages/api/src/external/commonwell-v1/proxy/cw-process-request.ts (1)

42-43: Count parameter handling is broken — clients can’t limit results via _count

• getAllowedSearchParams only allows ["status","date","_summary"], so _count is dropped.
• applyFilterParams wrongly reads params.get("count") (never present) instead of using the parsed _count.
• fromHttpRequestToFHIR parses _count into a count variable but never threads it into the bundle/filter pipeline.

Critical fixes required:

• In processRequest (packages/api/src/external/commonwell-v1/proxy/cw-process-request.ts):
– Change
const bundle = prepareBundle([…], params);
to
const bundle = prepareBundle([…], params, count);

• Update prepareBundle signature to accept count?: number and forward it:

export function prepareBundle(
  resources: Resource[],
  params: URLSearchParams,
  count?: number
): Bundle<Resource> {
  // …
  const filteredDocRefs = applyFilterParams(documentReferences, params, count);
  // …
}

• Change applyFilterParams to accept an explicit count?: number (remove params.get("count") logic) and use it:

export function applyFilterParams(
  docRefs: DocumentReference[],
  params: URLSearchParams,
-   countParam?: any
+   count?: number
): DocumentReference[] {
  // … date/status filtering …
-   const countParam = params.get("count");
-   if (countParam) {
-     const c = parseInt(countParam);
-     if (!isNaN(c)) filteredDocRefs = filteredDocRefs.slice(0, c);
-   }
+   if (typeof count === "number" && !isNaN(count)) {
+     filteredDocRefs = filteredDocRefs.slice(0, count);
+   }
  return filteredDocRefs;
}

• Update unit tests (packages/api/src/external/commonwell-v1/tests/apply-filter-params.test.ts) to call the new signature or to pass a parsed count rather than relying on queryToSearchParams({count}).

Alternative minimal approach: add "_count" to allowedQueryParams and change applyFilterParams to read params.get("_count"), but you’ll still need to adjust tests and ensure consistent FHIR‐style naming.

packages/api/src/external/commonwell-v1/admin/recreate-patients-at-hies.ts (1)

76-83: Potential runtime crash: patient.facilityIds may be undefined.

Indexing patient.facilityIds[0] will throw if facilityIds is missing or not an array. Guard before indexing to reach the “no facilityId” handling branch.

Consider:

-    const facilityId = patient.facilityIds[0];
+    const facilityId = Array.isArray(patient.facilityIds) ? patient.facilityIds[0] : undefined;

packages/api/src/command/hie/unlink-patient-from-organization.ts (1)

367-371: processAsyncError is not being invoked; the error handler is dropped.

processAsyncError("Failed to downgrade link") returns a handler; you’re not calling it with the caught error, so nothing is recorded.

-        ).catch(error => {
-          processAsyncError("Failed to downgrade link");
-          throw error;
-        })
+        ).catch(err => {
+          processAsyncError("Failed to downgrade link")(err);
+          throw err;
+        })

packages/api/src/external/commonwell-v1/cq-bridge/ec-updater-local.ts (1)

38-49: Bug: N^2 writes and cross-patient data bleed in storeECAfterIncludeList.

Inside the per-patient loop you build ecList for all patientIds on each iteration using the existing record of the current patient. This duplicates writes and risks applying one patient’s updated CQ list to others.

Apply this fix to only upsert the current patient and dedupe CQ org IDs:

-          const updatedCQList = [...(existing?.data.cqOrgIds ?? []), ...cqOrgIds];
-          const ecList = patientIds.map(patientId => ({
-            ecId,
-            cxId,
-            patientId,
-            data: {
-              ...(existing?.data ?? {}),
-              cqOrgIds: updatedCQList,
-            },
-          }));
-          await createOrUpdateCoverageEnhancements(ecList, transaction);
+          const updatedCQList = Array.from(
+            new Set([...(existing?.data.cqOrgIds ?? []), ...cqOrgIds])
+          );
+          await createOrUpdateCoverageEnhancements(
+            [
+              {
+                ecId,
+                cxId,
+                patientId,
+                data: {
+                  ...(existing?.data ?? {}),
+                  cqOrgIds: updatedCQList,
+                },
+              },
+            ],
+            transaction
+          );

packages/utils/src/commonwell/cq-org-builder.ts (1)

58-60: Fix typos in CLI help and log (user-facing text)

Two minor user-facing typos:

• "lisf" → "list"
• "Runnning" → "Running"
• Also close the parenthesis in the help string.

Apply:

-    "Rebuild the lisf from the local file without calling the Sequoia API (does not update the list of US states"
+    "Rebuild the list from the local file without calling the Sequoia API (does not update the list of US states)"

-  console.log(`Runnning at ${new Date().toISOString()} - local: ${isLocal}`);
+  console.log(`Running at ${new Date().toISOString()} - local: ${isLocal}`);

Also applies to: 67-67

packages/api/src/command/medical/document/document-conversion-status.ts (1)

106-114: Attach .catch() to fire-and-forget Promises to avoid unhandled rejections

Guidelines require handling errors when not awaiting. Add a catch handler (you can log or use a utility like processAsyncError/emptyFunction if available). Using log keeps it self-contained.

-    // intentionally async
-    recreateConsolidated({
+    // intentionally async
+    void recreateConsolidated({
       patient: updatedPatient,
       conversionType: "pdf",
       context: `Post-DQ getConsolidated ${source}`,
       requestId,
       isDq: true,
-    });
+    }).catch(err => log(`recreateConsolidated (HIE) failed: ${String(err?.message ?? err)}`));
@@
-  } else if (isGlobalConversionCompleted) {
-    // intentionally async
-    recreateConsolidated({
+  } else if (isGlobalConversionCompleted) {
+    // intentionally async
+    void recreateConsolidated({
       patient: updatedPatient,
       context: "Post-DQ getConsolidated GLOBAL",
       requestId,
       isDq: true,
-    });
+    }).catch(err => log(`recreateConsolidated (GLOBAL) failed: ${String(err?.message ?? err)}`));

Also applies to: 116-121

packages/api/src/external/commonwell-v1/link/shared.ts (1)

100-101: Bug: filter(isLOLA2 || isLOLA3) only applies isLOLA2

isLOLA2 || isLOLA3 evaluates to isLOLA2 (functions are truthy), so LOLA3 links are ignored. Use a predicate combining both checks.

Apply this diff:

-    const validLola2or3Links = networkLinks.flatMap(filterTruthy).filter(isLOLA2 || isLOLA3);
-    const invalidLola2or3Links = invalidLinks.flatMap(filterTruthy).filter(isLOLA2 || isLOLA3);
+    const validLola2or3Links = networkLinks
+      .flatMap(filterTruthy)
+      .filter(link => isLOLA2(link) || isLOLA3(link));
+    const invalidLola2or3Links = invalidLinks
+      .flatMap(filterTruthy)
+      .filter(link => isLOLA2(link) || isLOLA3(link));

packages/api/src/external/commonwell-v1/cq-bridge/coverage-enhancer-api-local.ts (1)

7-7: Correct dayjs plugin import and Duration type usage

The default import from "dayjs/plugin/duration" (duration) doesn’t expose a Duration type—this is causing the TS error. Import the plugin under a distinct name and pull in the Duration interface via a type-only import.

Locations to update in
packages/api/src/external/commonwell-v1/cq-bridge/coverage-enhancer-api-local.ts:

• Line 7: plugin import
• Line 13: dayjs.extend(...) call
• Line 43: waitBetweenLinkingAndDocQuery parameter type

-import duration from "dayjs/plugin/duration";
+import durationPlugin from "dayjs/plugin/duration";
+import type { Duration as DayjsDuration } from "dayjs/plugin/duration";
 
 dayjs.extend(duration);
+dayjs.extend(durationPlugin);
 
   public override async enhanceCoverage({
     waitBetweenLinkingAndDocQuery = WAIT_BETWEEN_LINKING_AND_DOC_QUERY,
     startedAt = Date.now(),
     ...params
-  }: CoverageEnhancementParams & {
-    waitBetweenLinkingAndDocQuery: duration.Duration;
+  }: CoverageEnhancementParams & {
+    waitBetweenLinkingAndDocQuery: DayjsDuration;
     startedAt?: number;
   }): Promise<string> {

This change imports the plugin correctly and references the Duration interface from its own type definitions.

packages/lambdas/src/cw-doc-contribution.ts (2)

62-66: Use a temporary redirect (302/307) instead of 301 for pre-signed URLs.

301 is cacheable and can break future downloads when the pre-signed URL expires. Use 302 (Found) or 307 (Temporary Redirect) and add no-store to prevent caching.

Suggested change:

-      return sendResponse({
-        statusCode: 301,
-        headers: {
-          Location: url,
-        },
-        body: "",
-      });
+      return sendResponse({
+        statusCode: 307,
+        headers: {
+          Location: url,
+          "Cache-Control": "no-store"
+        },
+        body: "",
+      });

---

85-88: Avoid logging pre-signed URLs in responses.

sendResponse logs the full response, including the Location header containing a pre-signed URL. This leaks credentials in logs.

Redact before logging:

-function sendResponse(response: lambda.APIGatewayProxyResult) {
-  console.log(`Sending to CW: ${JSON.stringify(response)}`);
-  return response;
-}
+function sendResponse(response: lambda.APIGatewayProxyResult) {
+  const redacted =
+    response.headers && "Location" in response.headers
+      ? { ...response, headers: { ...response.headers, Location: "<redacted>" } }
+      : response;
+  console.log(`Sending to CW: ${JSON.stringify(redacted)}`);
+  return response;
+}