Perfuse v0.1.6

Everything since v0.1.5. Each item was checked against real software; docs/verification.md says what with, and what remains unverified.

SMART on FHIR

• A built-in SMART authorization server: standalone and EHR launch with PKCE, consent, refresh and ID tokens; Backend Services; granular scopes enforced, includes held to the caller's scopes; token introspection and revocation; CORS for browser apps.
• Inferno SMART App Launch STU2.2: 80 of 80 with a public client.

Prior authorization (CMS-0057)

• A Da Vinci PAS 2.2.1 payer server: Claim/$submit, $inquire and a reviewer's $decide, with pended decisions delivered by subscription. Inferno PAS Server suite 82 of 84.
• DTR: stored value sets, $expand/$validate-code, adaptive questionnaires ($next-question). Inferno DTR Payer Server 2.2.0: 43 of 45.
• CRD passes Inferno's CRD Server 2.2.1 suite.

FHIR server

• Inferno US Core 6.1.0 FHIR API: from 225 to 323 passing (multiple-or search, POST _search, a public capability statement, date ranges).

Public health

• eCR: Reportability Responses are received at $process-message (serve -ecr-responses) and stored where the sent report said to look; serve -ecr-agency plays an agency for testing. Proven between two Perfuse servers; the RR validates with 0 errors against eCR 2.1.2.
• ELR: perfuse elr reshapes a lab's ORU^R01 into an HL7 2.5.1 ELR message.

HL7 v2 to FHIR

• Checked on Microsoft FHIR-Converter's 139 samples, 81 French national and NHS Wales samples, and the NHS nw-gmsa set.
• Embedded PDFs whose Base64 holds spaces are now decoded (27 of nw-gmsa's 28 CE-labelled PDFs, previously 9); undecodable data stays text, never a code.
• An EVN-1 that disagrees with MSH-9 is reported; ICD codes sent without the dot get it; vital signs get their category.

Operations

• Team dashboards: one per persona, saved views, Grafana export, connection checks.

Fixes

• bearer_token: ${VAR} on FHIR, CDA and HTTP destinations, and the HTTP password, were sent as the literal text. They are now read from the environment, as the configuration recommends.
• A granular SMART scope's query was read as permission letters.
• A time of birth with no offset anywhere is dropped rather than labelled UTC.