feat(fhir): raise the MedicationAdministration cap to 5000 and make it configurable

Raise the per-export administration ceiling from 1000 to 5000 (~3.5 years
at four doses a day) and resolve it from FHIR_MAX_MEDICATION_ADMINISTRATIONS,
bounded 1..50000 with a fallback to 5000 on an unset or out-of-range value.
The windowed-then-capped newest-first behaviour and the honest-truncation
narrative are unchanged; this only raises the ceiling so it bites far less
often. Add the var to the compose environment whitelist and the production
env example so it reaches the container and check-env stays green.

.env.production.example

@@ -62,6 +62,17 @@ API_TOKEN_HMAC_KEY="<openssl rand -hex 32>"
 # BACKUP_ENCRYPTION_KEY=""
 
 
+# -----------------------------------------------------------------------------
+# FHIR health-record export -- optional
+# -----------------------------------------------------------------------------
+# Per-export ceiling on the number of MedicationAdministration rows in the
+# FHIR Bundle. The report window already scopes the set; this is a coarse
+# safety ceiling on the serialised Bundle size. Bounded 1..50000; any unset
+# or out-of-range value falls back to the default of 5000. Raise it only for
+# an unusual multi-year, many-medication workload.
+# FHIR_MAX_MEDICATION_ADMINISTRATIONS="5000"
+
+
 # -----------------------------------------------------------------------------
 # Dashboard snapshot -- BUILD-TIME toggle (default ON)
 # -----------------------------------------------------------------------------

docker-compose.yml

@@ -50,6 +50,11 @@ services:
       BACKUP_S3_SECRET_KEY: "${BACKUP_S3_SECRET_KEY:-}"
       BACKUP_S3_REGION: "${BACKUP_S3_REGION:-auto}"
       BACKUP_RETENTION_DAYS: "${BACKUP_RETENTION_DAYS:-30}"
+      # Per-export ceiling on MedicationAdministration rows in the FHIR
+      # health-record Bundle. Bounded 1..50000, default 5000. Listed here so
+      # an operator override in .env actually reaches the container (the
+      # `environment:` block is a whitelist).
+      FHIR_MAX_MEDICATION_ADMINISTRATIONS: "${FHIR_MAX_MEDICATION_ADMINISTRATIONS:-}"
     depends_on:
       db:
         condition: service_healthy

src/lib/doctor-report-data.ts

@@ -207,19 +207,46 @@ const MAX_RANGE_DAYS = 730;
 const DEFAULT_RANGE_DAYS = 90;
 
 /**
- * v1.9.0 — hard ceiling on the number of `MedicationAdministration`
- * source rows materialised per export. The report window is already
- * bounded at {@link MAX_RANGE_DAYS} (730 days), but a chronic medication
- * dosed several times a day across that window — multiplied by several
- * such medications — can still produce thousands of administration
- * resources in a single Bundle (e.g. 4×/day × 730 days ≈ 2 920 per med).
- * Cap at the MOST-RECENT 1 000 acted intakes overall: that preserves the
- * recent-adherence picture a clinician cares about while bounding the
- * in-memory array and the serialised Bundle. When the cap trims rows the
- * aggregator flags it so the FHIR narrative can disclose the truncation
- * rather than silently dropping history.
+ * Default ceiling on the number of `MedicationAdministration` source rows
+ * materialised per export, and the bounds an operator override is clamped
+ * to. The report window is already bounded at {@link MAX_RANGE_DAYS}
+ * (730 days), but a chronic medication dosed several times a day across
+ * that window — multiplied by several such medications — can still produce
+ * thousands of administration resources in a single Bundle. The default of
+ * 5 000 covers ~3.5 years at four doses a day, so it effectively never bites
+ * on a realistic report period while still bounding a pathological export.
  */
-const MAX_MEDICATION_ADMINISTRATIONS = 1000;
+const DEFAULT_MAX_MEDICATION_ADMINISTRATIONS = 5000;
+const MIN_MEDICATION_ADMINISTRATIONS = 1;
+const MAX_MEDICATION_ADMINISTRATIONS_CEILING = 50000;
+
+/**
+ * Resolve the administration ceiling from `FHIR_MAX_MEDICATION_ADMINISTRATIONS`.
+ * Accepts a positive integer within `[1, 50000]`; any unset / non-integer /
+ * out-of-range value falls back to the default. Exported as a pure function so
+ * the resolution can be tested without import-time env coupling.
+ */
+export function resolveMaxMedicationAdministrations(
+  raw: string | undefined,
+): number {
+  const parsed = Number(raw);
+  return Number.isInteger(parsed) &&
+    parsed >= MIN_MEDICATION_ADMINISTRATIONS &&
+    parsed <= MAX_MEDICATION_ADMINISTRATIONS_CEILING
+    ? parsed
+    : DEFAULT_MAX_MEDICATION_ADMINISTRATIONS;
+}
+
+/**
+ * The cap is a coarse safety ceiling resolved once at module load, not a
+ * per-request knob — the report window is the natural bound; this only
+ * guards a pathological multi-year, many-medication export. When it trims
+ * rows the aggregator flags it so the FHIR narrative discloses the
+ * truncation rather than silently dropping history.
+ */
+const MAX_MEDICATION_ADMINISTRATIONS = resolveMaxMedicationAdministrations(
+  process.env.FHIR_MAX_MEDICATION_ADMINISTRATIONS,
+);
 
 export interface DoctorReportRange {
   /** Start of the reporting window (UTC, inclusive). */