ReadonlyserviceStable, human-readable name for the service. Must be set explicitly on each subclass
because this.constructor.name gets mangled by minification in production builds,
which breaks tracing/observability span names.
ProtectedloggerProtectedrunProtectedspanOptional hook for subclasses to attach extra non-PII span attributes derived from params.
The returned attributes appear on the service.${serviceName} span (and, for jobs,
on job.enqueue.* and job.run.* spans too).
Safe ID-like keys on params (e.g. patientId, templateIds, limit, cursor) are
already auto-extracted via toSpanAttributes("service.input", params) — you don't need
to enumerate them here. Use this hook for derived/computed attributes (counts, flags,
computed names) or for fields you've explicitly verified safe but that aren't in the
global allowlist. Hook output overrides auto-extracted attributes on key collision.
Safe by default: returns {} when not overridden. Only declare keys you've confirmed
are non-PII. Never include emails, names, dob, free-text, etc.
ProtectedspanOptional hook for subclasses to attach extra non-PII span attributes derived from the
successful service result. Only called when run resolves successfully; on error, the
span is marked via markSpanError instead.
Safe by default: returns {} when not overridden. Only declare keys you've confirmed
are non-PII (e.g. counts, status flags, computed summaries). Never include emails,
names, dob, free-text, etc.
Resolve every form field that must never touch an LLM, and report which fields are left for the AI runner.
Contact fields carry a real person's details and manual/static fields carry text an author typed into the template; both are facts already in hand, so inferring them would be pure downside on a document that goes to a payer or into a chart. This service answers them directly and hands back the AI remainder as
remainingFieldIds.Authorization guarantee
This service NEVER renders a contact that does not belong to
entityId, and never lets a contact fill a slot bound to a different contact type. Callers do not have to pre-authorizechosenContactsfor those two properties to hold — an unauthorized or mismatched id yieldsno_answer, not data. This is defense in depth, not a licence to skip validation at the kickoff boundary that captures the choices: that layer still owns rejecting bad input loudly, where a user can be told about it.The only I/O is loading the chosen contacts; all resolution semantics live in
deterministicAnswers.helpers. Nothing is written — the executor persists the returned rows viaformAnswersRepo.bulkUpsert(seetoDeterministicUpsertRows, which also stamps the coordinates snapshot).