AnonymizingTransport: seven PII transformations, one wrapper.

Relative references

// Before:
{ reference: 'Patient/p-abc-123' }

// After:
{ reference: 'Patient/anon-3f8a2b1c94d7' }

// Pattern matched: /^([A-Za-z]+)\/(.+)$/
// Group 1 = resource type (preserved)
// Group 2 = id (hashed)

Absolute references

// Before:
{ reference: 'https://aidbox.example.com/fhir/Patient/p-abc-123' }

// After:
{ reference: 'https://aidbox.example.com/fhir/Patient/anon-3f8a2b1c94d7' }

// Pattern matched: /^(https?:\/\/.../)([A-Za-z]+)\/([^/]+)$/
// Group 1 = base URL (preserved)
// Group 2 = resource type (preserved)
// Group 3 = id (hashed)

Algorithm

deriveShiftDays(salt):
  hex = SHA-256(salt + ':dateshift')
  return (parseInt(hex.slice(0, 8), 16) % 365) + 1

// Shift applied to each configured date field:
// '2024-03-15' → '2024-08-27'  (shift = 165 days)
// '2024-03-15T14:30:00Z' → '2024-08-27T14:30:00Z'

Example fields shifted

Encounter.period.start / .end
Observation.effectiveDateTime
Observation.effectivePeriod.start / .end
Condition.onsetDateTime
Procedure.performedDateTime
Specimen.processing[].timeDateTime
... (all from DATE_SHIFT_FIELDS catalogue)

Catching typed errors

import {
  AnonymizingTransport,
  FhirDeAnonymizingError,
} from '@polaris/sdk/fhir'

try {
  const t = new AnonymizingTransport(inner)
} catch (err) {
  if (err instanceof FhirDeAnonymizingError) {
    console.error(err.code)    // 'missing_salt'
    console.error(err.docUrl)  // link to docs
    // err.code is typed — switch is exhaustive
    switch (err.code) {
      case 'missing_salt':
        // set up salt...
        break
      case 'ig_version_mismatch':
        // upgrade package...
        break
    }
  }
}

IG version pinning

import { AnonymizingTransport } from '@polaris/sdk/fhir'
import { DE_IDENTIFICATION_IG_VERSION } from '@polaris/fhir-de'

// Current bundled version: 0.11.24
// Pin at startup so version drift surfaces immediately:
const t = new AnonymizingTransport(
  inner,
  undefined,  // use POLARIS_ANON_SALT env var
  { requireIgVersion: '0.11.24' }
)
// Throws ig_version_mismatch if package is
// upgraded to a newer IG before this line is updated.