fix(source-map): bound local FSH scans (signed DCO replacement)

Merged
TH
14d ago
+81-1

Signed replacement for #199 — issue #198

This is a fresh canonical-main child with the exact same final Git tree as the previously green but unsigned #199. It was created on the authorized Windows Abdulaziz computer using git commit -S -s, and GitHub independently reports a Verified SSH signature and DCO trailer.

  • Commit: 2cd16b428351b9a34005fb00743fe26254a1849f
  • Canonical base: f82565cca917d119e1c774b2c470e2ac20e0d6dd
  • Git tree: e99781d18688e9d14ec2411e04ed76f2189bbbb7, byte-identical to original #199 head 2ea31ab198dfc3ddfbff0601f3a70c6b751e7758.
  • cargo fmt --all -- --check, git apply --check and git diff --cached --check passed in the shallow local canonical-main checkout before signing. No force-push, rebase or history rewrite; the original PR remains archived as evidence.

Feature

source_line_count for CF-09 FSH source mapping rejects already-oversized local files using opened-file metadata before line enumeration, limits actual reads to 64 MiB + one byte to detect growth, and reports a path-free SourceMapError::SourceTooLarge. The helper preserves exact line counts for empty/trailing/nontrailing-newline inputs. A sparse-file integration regression checks actual build_source_mapped_check_report refusal; the CF-09 spec records scope and non-atomic file freshness limitations.

Qualification and governance

Original #199 successfully passed 15/15 technical CI checks; the new signed SHA must independently pass all required checks before any normal merge. Actual independent last-push-valid human Code Owner APPROVED review and resolved threads are still required under issue #195. Bot COMMENTED or NEUTRAL cannot approve it. Keep issue #198 open until actual merge plus post-main proof. No protected AF-02 authority, FHIR oracle, dependency or workflow changes, clinical assertions, or full product completion.

Summary by cubic

Bounded FSH source file scans to 64 MiB so oversized local files fail closed instead of being fully read into memory.

  • Rejects files already over the bound using opened-file metadata before line enumeration.
  • Caps actual reads at 64 MiB plus a one-byte probe, so files that grow mid-scan also fail.
  • Adds a dedicated SourceTooLarge error that omits source location and absolute paths.
  • Covers oversized and sparse files with unit and integration tests, and documents the bound and its non-atomic freshness limits in the CF-09 spec.