feat: Add customization URL parameter (#5992)

* Add customization URL parameter

* fix: Preserve should be customizeable

* Update customizations docs

* fix: Overlay items on patient name

* Add customization test

* Fix resolve to absolute path

* fix: Warn on no data in load

* Remove unused customization stuff

* fix: PR comments

* Update stored parameters to only use an array for mulitples

* Remove requires ohif.* special call out

* Remove strict mode

* PR comments

* Document segmentation examples

* Add three examples as requested

* PR comments

* lock

* Remove old customizatoin export

* fix: Ordering issues on customization loads

* fix: Use correct default for dev builds app config

* Fixes for conflicts

* chore: restore pnpm-lock.yaml to match master

The lockfile diff was incidental peer-descriptor churn and carried no
functional dependency change. It tripped the CircleCI security-audit gate
(which only runs when pnpm-lock.yaml is in the PR diff), surfacing a
pre-existing critical `decompress` transitive vuln that also exists on
master. Restoring master's lockfile removes the audit trigger.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(ci): restore json5 lockfile entry; ignore unfixable decompress GHSA

The previous commit restored pnpm-lock.yaml from master, which dropped the
json5@2.2.3 entry that platform/core legitimately depends on (JSONC parsing
for the customization feature). That broke `--frozen-lockfile` install
(ERR_PNPM_OUTDATED_LOCKFILE). This restores the correct lockfile.

Because the lockfile must change (json5), the CircleCI security-audit gate
runs and previously failed on a critical `decompress` <=4.2.1 zip-slip
advisory. This is a pre-existing transitive vuln (present on master too) with
no published patch — decompress's latest release is 4.2.1, so no version
bump/override can resolve it. It reaches the tree only via @itk-wasm/dam, a
build/data-asset extraction tool under @cornerstonejs/labelmap-interpolation.

Add GHSA-mp2f-45pm-3cg9 to the existing pnpm-workspace.yaml auditConfig
ignoreGhsas accepted-risk list, matching how the repo already exempts other
build-tooling advisories. `pnpm audit --audit-level high` now passes locally
(1 critical ignored, 0 high).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(e2e): fix visitStudy URL encoding that broke mpr2 study load

The visitStudy rewrite (added for the ?customization= option) built the URL
with new URLSearchParams({ StudyInstanceUIDs: studyInstanceUID }), which
percent-encodes the value. mpr2.spec.ts embeds an extra param in the UID
string ('<uid>&hangingprotocolid=mpr'), so the & and = were encoded and the
whole thing collapsed into one invalid StudyInstanceUIDs value -> the study
could not be found ('studies are not available'), the viewer never rendered,
and the side-panel-header-right click timed out.

Restore master's raw concatenation for StudyInstanceUIDs (so embedded params
survive as separate query params) while still appending the customization
option separately. Only mpr2 embeds & in the UID, matching the single failure.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* PR comments

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

platform/core/src/utils/formatValue.js

@@ -0,0 +1,22 @@
+/**
+ * Formats values for safe text display.
+ */
+export default function formatValue(value) {
+  if (value == null) {
+    return null;
+  }
+
+  if (typeof value === 'string') {
+    return value;
+  }
+
+  if (typeof value === 'object' && typeof value.Alphabetic === 'string') {
+    return value.Alphabetic;
+  }
+
+  if (typeof value === 'number' || typeof value === 'boolean') {
+    return String(value);
+  }
+
+  return null;
+}

platform/core/src/utils/formatValue.test.js

@@ -0,0 +1,40 @@
+import formatValue from './formatValue';
+
+describe('formatValue', () => {
+  it('returns null for null or undefined', () => {
+    expect(formatValue(null)).toBeNull();
+    expect(formatValue(undefined)).toBeNull();
+  });
+
+  it('returns strings unchanged, including empty strings', () => {
+    expect(formatValue('horse')).toBe('horse');
+    expect(formatValue('')).toBe('');
+  });
+
+  it('extracts the Alphabetic component of a PersonName object', () => {
+    expect(formatValue({ Alphabetic: 'Doe^John' })).toBe('Doe^John');
+  });
+
+  it('coerces numbers to strings, including zero', () => {
+    expect(formatValue(0)).toBe('0');
+    expect(formatValue(42)).toBe('42');
+  });
+
+  it('coerces booleans to strings', () => {
+    expect(formatValue(true)).toBe('true');
+    expect(formatValue(false)).toBe('false');
+  });
+
+  it('returns null for plain objects so they never render as [object Object]', () => {
+    expect(formatValue({})).toBeNull();
+    expect(formatValue({ foo: 'bar' })).toBeNull();
+  });
+
+  it('returns null for objects whose Alphabetic is not a string', () => {
+    expect(formatValue({ Alphabetic: 123 })).toBeNull();
+  });
+
+  it('returns null for arrays', () => {
+    expect(formatValue(['a', 'b'])).toBeNull();
+  });
+});

platform/core/src/utils/index.ts

@@ -15,6 +15,7 @@ import isDicomUid from './isDicomUid';
 import formatDate from './formatDate';
 import formatTime from './formatTime';
 import formatPN from './formatPN';
+import formatValue from './formatValue';
 import generateAcceptHeader from './generateAcceptHeader';
 import resolveObjectPath from './resolveObjectPath';
 import hierarchicalListUtils from './hierarchicalListUtils';
@@ -73,6 +74,7 @@ const utils = {
   formatDate,
   formatTime,
   formatPN,
+  formatValue,
   b64toBlob,
   urlUtil,
   imageIdToURI,
@@ -117,6 +119,7 @@ export {
   absoluteUrl,
   sortBy,
   formatDate,
+  formatValue,
   writeScript,
   b64toBlob,
   urlUtil,