@cosyte/astm 0.0.10 → 0.0.13

package/CHANGELOG.md

@@ -11,6 +11,215 @@ this file is maintained by hand (Changesets handles the version bump and publish
 
 ### Fixed
 
+- **A delimiter set colliding with a record's type letter emitted a stream that read back as
+  DIFFERENT records, and in its silent branch it fabricated a final lab result out of patient
+  identifiers** (`ASTM-FRAME-RESIDUALS`, defect 5). `PRE-EXISTING`, byte-identical on `7253098`,
+  before any of `ASTM-EMIT-RESIDUALS`. `serializeAstmRecords` / `serializeAstmRecord` now throw
+  `AstmSerializeError` with the new code `ASTM_EMIT_TYPE_LETTER_COLLISION` (a third member of
+  `AstmSerializeErrorCode`), carrying the `recordIndex` and quoting nothing from the record: not the
+  value, and not the type letter either, which on an unsupported record is a byte off the wire.
+
+  **The recorded defect said the record "re-reads as an unsupported record, one result in, zero out".
+  That describes one branch of two, and the branch it does not describe is silent.** A record's type
+  letter is just another leaf to the escape encoder, so a set naming that letter escapes it away: an
+  `R` record emitted with `field` = `R` goes out as `&F&R1R…`, reads back as `unsupported`, and
+  `ASTM_RECORD_UNKNOWN_TYPE` does fire. But the encoder writes an escaped character as
+  escape + mnemonic + escape, so **when the escape character is itself a record type letter the
+  escaped type letter begins with a real letter** and no unknown-type warning fires at all. Measured:
+  a `P` record emitted with `field` = `P` and `escape` = `R` comes back as an `R` record whose
+  `value` is the patient's laboratory ID, whose `units` are the practice-assigned identifier, and
+  whose `resultStatus` is `F`, so `results()` returns a fabricated **final** result built out of
+  patient identifiers. The stream's only warning is `ASTM_NONSTANDARD_DELIMITERS`, which is what a
+  **clean** non-canonical stream carries too and which is on the profile safety gate's tolerable
+  allow-list, so `{ strict: true }` accepts it under a profile the gate permits. That allow-list
+  entry reasons that "a record's type letter is the first character of its line" is read before any
+  delimiter-driven tokenization: true of the parse, and no protection when the **emit** is what chose
+  that character.
+
+  **The rule is derived from the reader and checked on the bytes, not on the delimiter set.**
+  `parseAstmRecords` takes a record's type from `line.charAt(0)`, so the condition emit has to meet
+  is that the first character it writes is the letter the record models. Testing the output rather
+  than enumerating dangerous roles is what makes a type letter equal to the **escape** character fall
+  out as accepted without a special case: it is written starting with that letter, so the record
+  re-reads as its own type. The familiar `letter` + `E` + `letter` shape is not general and the guard
+  does not rely on it: the encoder protects the escape character it introduces but not the `E`/`F`/`S`
+  mnemonics, so under `{ field: "E", escape: "R" }` an `R` encodes to `RRFRR` and its type field
+  decodes back to `RER`, not `R`. What holds across every such set is the only thing checked, the
+  first character written. Measured over 137,632
+  delimiter sets (two roles at a time, every printable ASCII character each, against a stream
+  carrying one record of every modeled type plus an unsupported one), the refusal is
+  **biconditional** with the old serializer losing a type letter: zero over-refusals and zero
+  under-refusals. Over a second sweep of 3,690 emits across nine record-set shapes, 750 streams
+  previously read back as something other than the records that produced them, **303 of them accepted
+  by `{ strict: true }`**; all 750 are now refused and the remaining 2,940 are byte-unchanged.
+
+  This is a **narrowing on a published package**, in exactly the cases that were being corrupted.
+  **It is a transcoding condition, not a judgement on the set the caller passed, so it fires with no
+  delimiter argument at all** and "emit against the canonical delimiters" is not a remedy for it: a
+  stream whose header declares a vendor set and which carries one garbled line beginning `|` parses
+  to an unsupported record whose type letter is `|`, and the canonical set escapes that `|` away, so
+  `serializeAstmRecords(msg)`, `serializeAstmRecord(record)` and `serializeFramedAstm(msg)` all
+  refuse it where the base emitted a record whose `rawType` came back as `&`. Callers passing a set
+  explicitly (`serializeAstmRecords(msg, msg.delimiters)`) reach it too. The three
+  set-level conditions are unchanged and still raise `ASTM_EMIT_INVALID_DELIMITERS`; this is a
+  separate, per-record check because whether a set collides depends on which record is being written.
+  **What it does not promise, stated rather than left to be found:** it guarantees a record re-reads
+  as its own **type**, not that every field lands where it did (an escape sequence whose body is a
+  delimiter is still an opaque atom, reported on the parse side as `ASTM_UNKNOWN_ESCAPE_SEQUENCE`),
+  and `encodeComponent` / `serializeField` take no record, so a caller assembling a line out of them
+  is outside the check. Pinned in `test/records/type-letter-collision.test.ts`, asserted on what the
+  old serializer produced, rebuilt from the shipped `serializeField` so nothing is transcribed twice.
+  **No clause is claimed**: LIS02-A2 §5.4/§6.2 stay withheld from CLSI's free sample and the
+  paywalled editions were not read; the grounding is this package's own reader.
+
+- **A raw `STX`, `ETB` or `ETX` byte in a value was framed as given, and in its worst branch a whole
+  result record disappeared into the previous record's text with `warnings: []` at BOTH layers**
+  (`ASTM-RAW-ETX-SWALLOWS-A-RECORD`). `PRE-EXISTING`, shipped since the frame encoder did.
+  `composeAstmFrames` now throws `AstmFrameEncodeError` with the new code `ASTM_FRAME_RESERVED_BYTE`
+  (a third member of `AstmFrameEncodeErrorCode`), carrying `recordIndex` and `characterIndex` and
+  never the bytes.
+
+  **The recorded reason for deferring this said it "fails loudly". That was false, and the
+  correction is what re-ranked it.** A frame's text ends at the first `ETB`/`ETX` after its `STX`, so
+  an embedded one truncates the frame there, and the two bytes that follow are then read as that
+  short frame's checksum. When they match, the truncated frame **verifies**, `decode.ts` resumes at
+  `termIndex + 3` and skips the rest of the record as inter-frame bytes, and the next frame number is
+  still in sequence. Measured on this package's own round trip: a `C` comment ending `…HEMOLYZED` +
+  `ETX` + the two matching characters reassembled without its terminating `CR`, so the following `R`
+  merged into the comment's free text (`"SPECIMEN SLIGHTLY HEMOLYZEDR"`) and a `28.6 U/L` result
+  vanished, `results()` returning `[]` where the input carried one. **An embedded `ETB` reaches the
+  same silence by the other door**, which the defect record did not have: it leaves the record open,
+  so the _next_ record's text is appended to the truncated one and two records read back as one, with
+  every field of the result hanging off the comment. The precondition is a coincidence in the two
+  bytes that follow: they must both read as hex digits and must equal the truncated frame's checksum,
+  which is about 1 in 34,600 for uniform-random bytes (1 in 256 once they are hex digits, which is
+  where the earlier 1-in-256 figure came from), and trivially constructible on purpose. That bounds
+  the likelihood, not the harm.
+  Both silent branches, and the loud ones, are pinned in `test/frames/reserved-structure-byte.test.ts`
+  asserted on what the old encoder produced, so a weakened guard reds a test rather than passing
+  unnoticed.
+
+  **The refusal has no bytes-instead escape hatch, unlike the `U+00FF` one beside it.** A
+  `Uint8Array` is checked too, because the byte is unframable however it arrives: framing has no
+  escape sequence for it, and emit has no warning channel, so the only alternatives to refusing are
+  substituting a byte the sender did not send or dropping one they did. The three bytes are derived
+  from what `decodeAstmFrames` actually reads as structure, not from a control-character class:
+  `CR`/`LF` are deliberately absent (they are read only _after_ a frame's checksum, and a record's own
+  `CR` sits inside frame text on every stream this encoder writes), and `ENQ`/`ACK`/`NAK`/`EOT` are
+  absent too (structure only _between_ frames; measured to round-trip byte-exactly inside one).
+  **No clause is claimed:** LIS02-A2 §5.4/§6.2 are withheld from CLSI's free sample and the paywalled
+  editions were not read. The grounding is this library's own decoder, in this repo.
+
+  **The record layer is deliberately UNCHANGED, and that was the cost this slice turned on.**
+  Refusing the byte in `serializeAstmRecord` would refuse a byte the caller genuinely supplied, for
+  consumers who never frame anything. Measured, in every modeled value: all three
+  bytes round-trip through parse → serialize → parse byte for byte, value, units and status intact,
+  byte-stable, `warnings: []` on both generations. The byte becomes structure only when a frame is
+  built, and `composeAstmFrames` is the total gate on that route, including through
+  `serializeFramedAstm`. `CR`/`LF` remain the record layer's own refusal, because they end a _record_.
+
+  **That claim is about VALUES, and one position on a record line is not a value.** The surplus of a
+  header's delimiter declaration drops any control character silently on emit, so a header that
+  arrived as `H|\^&` + `ETX` goes back out without it, `warnings: []`, byte-stable, and the
+  round-trip is not byte-exact there. `PRE-EXISTING` and deliberately unchanged: that rule is argued
+  at `declarationResidual` and long predates the frame-layer refusal, and it is the better of the two
+  dispositions now, since carrying the byte through would turn a spec-clean header into a refused
+  stream. Pinned in `test/frames/reserved-structure-byte.test.ts` so the scoped sentence stays
+  measured. Found by the `conformance-refuter` grading this slice.
+
+  **What this does not close.** A delimiter colliding with a record's type letter still frames and
+  de-frames byte-exactly and re-reads as a different record; framing integrity is not record-layer
+  readback. And a caller reaching `composeAstmFrames` from JavaScript with some other typed array is
+  still outside the declared signature, and **this guard does not reach that route either**: the
+  check compares elements against the three byte values, so a `Uint16Array` element of `0x0103` is
+  not one of them and is not refused, while `Uint8Array.from` later takes its low byte and writes an
+  `ETX` after all. Measured on all three (`0x0102`/`0x0103`/`0x0117`): framed, then lost at decode
+  with a bad checksum or an unterminated frame. That is the same out-of-signature residue already
+  recorded for the low-byte truncation, unchanged here in either direction, and stated rather than
+  left to be found. Pass a `Uint8Array` or a string.
+
+- **A symbolic link under a scan root read CLEAN on BOTH of the PHI scanner's enumerating routes, so
+  a link pointing at a file full of real identifiers passed the gate twice over**
+  (`PHI-SCAN-SYMLINK-BLIND-ON-BOTH-ROUTES`). Development tooling only: `scripts/phi-scan.ts` ships in
+  no tarball and the package's public surface is unchanged.
+
+  Reproduced on `8e8012d` before any fix, with a synthetic name-bearing payload (an ASTM `P` record
+  carrying a patient name, a mother's maiden name and a birthdate, plus a dashed SSN and an email at
+  a non-test domain) placed outside the walk roots and a link to it at `src/leak.ts`. `pnpm phi-scan`
+  printed `OK: no hits` and exited **0**; `pnpm phi-scan --staged`, after `git add`, printed
+  `OK: no hits` and exited **0**. Naming the link's target explicitly on the command line reported
+  **six** hits and exited 1, so the payload was always detectable, and detectable by this package's
+  own structured `P`-record detectors rather than only by the cross-cutting SSN/email floor. The two
+  routes simply never looked at it.
+
+  The two blindnesses are separate mechanisms and needed separate fixes. The walk enumerates
+  `Dirent.isFile()`, which is an **lstat** answer, so a link is neither a file nor a directory and
+  fell out of the loop with no record that anything had been skipped, and `isDirectory()` answers
+  false for a linked directory too, so a whole subtree could disappear the same way. The `--staged`
+  route reads content with `git show :<path>`, and **git stores a symbolic link as its target path
+  under mode `120000`**, so it was handed the target's path text and scanned that. That second route
+  is this repo's `pre-commit` hook, which is exactly where the claim that `--staged` covers a link
+  would have been trusted.
+
+  **Neither route is made to follow the link.** Following would read bytes the enumeration does not
+  control (outside the repo, a loop, a device, a FIFO that blocks the gate forever) and git does not
+  carry those bytes anyway, so a hit on them would be a claim about something no commit contains.
+  Instead the enumeration is narrowed: an entry under a scan root that is not a regular file
+  **refuses the scan** (exit 2, the existing "could not complete" code), naming every offender rather
+  than the first. The walk classifies by `Dirent` (symbolic link, FIFO, socket, block device,
+  character device); `--staged` now reads `git diff --cached --raw -z` instead of `--name-only` so
+  the destination mode is visible, and refuses mode `120000` and `160000` (a gitlink) wherever that
+  route's own path scope reaches them. A `--raw` record that does not parse refuses as well, rather
+  than being skipped into a silently shortened list.
+
+  **`T` (typechange) is in the `--diff-filter`, and leaving it out would have made the mode check
+  unreachable whenever the file being replaced was already tracked.** Replacing a **tracked** regular
+  file with a link is neither an add nor a modify: git raises `:100644 120000 <sha> <sha> T`, so
+  `--diff-filter=AM` deletes the record before any mode can be read. Measured on git 2.39.5 on this
+  tree: with `AM` the raw output for that stage is empty, and the unfixed scanner passed that stage
+  green. Typechange carries a single path, exactly like `A` and `M`, so admitting it costs the record
+  stride nothing, and it means the reverse typechange, a link replaced by a real file, is now scanned
+  as the ordinary file it became.
+
+  **A refusal names the entry's own repo-relative path and an engine-owned token for its kind, and
+  never the link target**, because a target path is text off the working tree and can itself carry
+  PHI. That is asserted rather than argued: the pinning payload and the target's own filename both
+  carry a synthetic person name, and every refusal message is checked to contain none of it. 10 of
+  the file's 30 cases are red on `8e8012d`.
+
+  **What this does not cover, stated narrowly, each measured.** Explicit-path mode already read
+  through a link and reported the target's hits; it is unchanged. The `--staged` path scope is
+  unchanged, still `test/fixtures/**` and `src/**.ts`, so a staged link outside it is still not
+  looked at; narrowing what a scope admits is not widening the scope. That scope also bounds the
+  gitlink half: a submodule staged at `test/fixtures/nested` is refused, while one at `src/nested` is
+  a directory name that fails the `.ts` suffix and is not looked at. `R` (rename) and `C` (copy) are
+  still **not** enumerated by `--staged` at all, so a staged rename that also appends PHI passes that
+  route; pre-existing, unchanged here, and admitting it needs the two-path record shape handled,
+  which is a scope decision rather than this one. A tracked file **absent from the worktree** is
+  still caught at `git add` time only.
+
+  **And this scanner still has no rule that a sweep observing ZERO targets must refuse**, which is
+  worth naming rather than leaving to be discovered. Measured: run from a tree with no `src/` and no
+  `test/fixtures/`, all-mode prints `OK: no hits` and exits 0, so a clean report can be a report
+  about a tree the scan never looked at, and **nothing backstops it**: the all-mode sweep is the
+  route with the hole, so it cannot be its own compensating control, and neither the `pre-commit`
+  hook nor CI asserts that the sweep observed anything. Five of the sibling scanners carry that rule
+  (`ccda`, `hl7`, `mllp`, `ncpdp`, `synth`) and the rest, this one included, do not; do not read that
+  as a majority practice. It is unchanged by this slice in either direction, and adding it is its own
+  slice, because the threshold is a judgement about this repo's corpus rather than a consequence of
+  anything here.
+
+  **The enumerate-then-read race is deliberately NOT closed here, and the deferral is measured
+  rather than assumed.** The scanner still has no tolerance for a file that vanishes between
+  enumeration and read, so a transient appearing under a walk root can refuse a whole sweep (exit 2,
+  fails closed). This repo's walk roots are `test/fixtures/` and `src/`, and nothing was observed
+  landing in either: polling both roots continuously across a real `pnpm build` saw only the tracked
+  corpus, while `tsup.config.bundled_*.mjs` (the transient that blocked a sibling's publish) appeared
+  at the **repo root**, which is not a walk root here. This repo's own suite writes its throwaway
+  trees under the OS temp directory, not under a scan root. So the shape is present and its trigger
+  is not, which makes closing it a separate slice with its own argument rather than a rider on a PHI
+  blindness fix. It is a different defect and it fails in the safe direction.
+
 - **The frame encoder no longer writes a different character than the one it was handed**
   (`ASTM-FRAME-BYTE-RESIDUALS`, closing known defect 7). `composeAstmFrames` turned a record given
   as a `string` into bytes with `charCodeAt(i) & 0xff`, so any character above `U+00FF` was replaced
@@ -76,6 +285,44 @@ this file is maintained by hand (Changesets handles the version bump and publish
   refuse the record string or reproduce it byte for byte" is asserted over 2,000 generated cases,
   with its bound written into the test and a non-vacuity check that both sides of it are reached.
 
+- **The `attw` publish gate now fails when the packed tarball carries no types, where the CLI exits
+  `0`** (`ATTW-FALSE-GREEN-PORT`). The `attw` script was the bare `attw --pack .`.
+  `@arethetypeswrong/cli` opens `getExitCode()` with `if (!analysis.types) return 0`, returning
+  before it ever reads the problem list, because an untyped package is a legitimate npm package and
+  the CLI treats "no types at all" as a description rather than a problem. No `--profile`,
+  `--ignore-rules` or config setting reaches that branch. For a package that ships types the same
+  result means the declarations were **not in the tarball**, which is a broken publish reported as a
+  pass. A false red costs an hour; a false green merges.
+
+  Measured on this package at `0.0.9`, on a quiet box with **no** concurrency, both states printing
+  "This package does not contain types." and exiting `0`: `rm -rf dist`, and
+  `rm -f dist/index.d.ts dist/index.d.cts`. The second is the realistic one, and the trigger is the
+  build rather than any race: timed on one real `tsup` run here, `dist/index.mjs` and
+  `dist/index.cjs` appeared at 1,176 ms and `dist/index.d.ts` and `dist/index.d.cts` at 3,063 ms, a
+  **1,887 ms window** in which `dist/` held JS and no declarations. A concurrent build or `clean` in
+  the same working tree lands the gate in that window. This is deliberately **not** answered with a
+  lock or a build queue: the gate has to be able to report that its own inputs were missing,
+  whatever removed them.
+
+  `attw` is now `node scripts/attw.mjs`, which keeps two nets because they catch different things. A
+  **preflight** checks that every relative path `package.json` promises (`main`, `module`, `types`,
+  `typings`, and every string leaf of `exports`) exists and is non-empty, and names the missing file
+  rather than leaving it to be inferred. A **post-check** promotes `attw`'s untyped sentence to a
+  failure, catching what the preflight structurally cannot: declarations present on disk but
+  excluded from the tarball by `files` or an `.npmignore`. No instance of that second case is on
+  record in this repo. Because the post-check reads a printed string, the routes that would hide it
+  are refused rather than tolerated: `--quiet`, `--format`, a `.attw.json` setting either, and
+  `--config-path` at a file setting either were each measured here to restore the exact exit `0`. The
+  refusal is by option name, wholesale, not by value, and the list is a record of what is closed
+  rather than a proof that the post-check cannot be blinded at all: `--definitely-typed` suppresses
+  the sentence by making the analysis typed, is equally true of the bare CLI, and is deliberately not
+  refused. The preflight is the net that reads no string. Other arguments are forwarded, so
+  `--profile node16` still works. `test/scripts/attw-gate.test.ts` pins the upstream exit `0` itself,
+  so an `attw` upgrade that fixes it or rewords the sentence reds the suite instead of letting the
+  net go quietly slack, and it carries a negative control plus a real `attw` failure, because a gate
+  that only ever fails is not a gate and one that swallows the status is not one either. **No
+  runtime code changed and the built output is identical.**
+
 ### Added
 
 - **`ASTM_RECORD_FIELDS_UNSEPARATED`: a record that lost its fields no longer loses them in

package/README.md

@@ -39,10 +39,21 @@ reference parser, [`@cosyte/hl7`](https://github.com/cosyte/hl7).
   frame them with computed checksums, frame numbers, and the 240-byte split. Both layers round-trip by
   construction, and a delimiter set that fails any of the three conditions readback requires (one
   character per separator, no `CR`/`LF`, no two the same) is a typed error rather than bytes written
-  and lost. A frame carries **bytes**, so a record handed to `composeAstmFrames` as a `string` is one
+  and lost. Those three read the set alone, so each record is additionally checked against the set it
+  is written with: a separator equal to a record's own type letter escapes that letter away and the
+  record re-reads as a different record, which is `ASTM_EMIT_TYPE_LETTER_COLLISION` rather than
+  output. That second check is about **transcoding**, not about which set you asked for, so it can
+  fire with no delimiter argument at all: a stream read under a vendor's own set may carry a record
+  whose type letter the canonical set escapes away, and `serializeFramedAstm` refuses it for the same
+  reason. A frame carries **bytes**, so a record handed to `composeAstmFrames` as a `string` is one
   byte per character and a character above `U+00FF` is a typed error too: the encoder will not pick a
   character encoding for you, and it never quietly writes a different character than the one you gave
-  it. Encode such content yourself and pass the `Uint8Array`.
+  it. Encode such content yourself and pass the `Uint8Array`. A raw `STX`, `ETB` or `ETX` **byte** in a
+  record is a typed error as well, in either form: those three are what the decoder reads as the shape
+  of a frame, framing has no escape sequence for them, and writing one through truncated the frame at
+  that byte, silently losing a whole record whenever the two bytes after it happened to be the short
+  frame's checksum. The **record** layer still carries them, because a returned string is not yet on a
+  wire and a raw-transport consumer round-trips such a value exactly.
 - **Vendor profiles.** `defineAstmProfile()` builds a provenance-backed profile whose tolerances
   downgrade _expected_, non-safety-critical deviations to a `PROFILE_QUIRK_APPLIED` warning without
   ever altering a value, behind a safety gate that refuses to tolerate any result value, flag,

package/dist/index.cjs

@@ -1387,7 +1387,8 @@ var AstmSerializeError = class extends Error {
   /**
    * Stable discriminant. `ASTM_EMIT_UNENCODABLE_VALUE` for a `CR`/`LF` in a value;
    * `ASTM_EMIT_INVALID_DELIMITERS` for a delimiter set that cannot be emitted
-   * reversibly.
+   * reversibly; `ASTM_EMIT_TYPE_LETTER_COLLISION` for a record whose own type
+   * letter the set being emitted with would escape away.
    */
   code;
   /** 0-based ordinal of the record within the message, when known. */
@@ -1451,10 +1452,24 @@ function serializeAstmRecord(record, d = CANONICAL_DELIMITERS) {
   return serializeRecordChecked(record, d);
 }
 function serializeRecordChecked(record, d) {
+  return assertTypeLetterSurvives(serializeRecordText(record, d), record);
+}
+function serializeRecordText(record, d) {
   if (record.type === "M" || record.type === "S") return serializeVerbatimRecord(record, d);
   if (record.type === "H") return serializeHeader(record, d);
   return record.fields.map((f) => encodeField(f.repeats, d, record.recordIndex)).join(d.field);
 }
+function recordTypeLetter(record) {
+  return record.type === "unsupported" ? record.rawType : record.type;
+}
+function assertTypeLetterSurvives(text, record) {
+  if (text.charAt(0) === recordTypeLetter(record)) return text;
+  throw new AstmSerializeError(
+    "A record's type letter is escaped away by the delimiters being emitted with, so the record would read back as a different record. The record's index is on the error; the letter itself is not quoted, because on an unsupported record it is a byte off the wire.",
+    record.recordIndex,
+    "ASTM_EMIT_TYPE_LETTER_COLLISION"
+  );
+}
 function serializeVerbatimRecord(record, d) {
   if (recoversVerbatim(record, d)) return record.rawLine;
   return record.fields.map((f) => encodeField(f.repeats, d, record.recordIndex)).join(d.field);
@@ -2229,7 +2244,9 @@ var AstmFrameEncodeError = class extends Error {
   /**
    * Position of the offending character within that record, when applicable:
    * its index in the string, never the character itself and never its code
-   * point. Enough to find it in the caller's own data.
+   * point. Enough to find it in the caller's own data. For a record supplied as
+   * a `Uint8Array` this is the offending byte's index, which is the same
+   * position: a record string is a byte string, so the two indices coincide.
    */
   characterIndex;
   /** @internal */
@@ -2259,6 +2276,20 @@ function toBytes(input, recordIndex) {
   }
   return out;
 }
+var RESERVED_STRUCTURE_BYTES = /* @__PURE__ */ new Set([STX, ETB, ETX]);
+function assertFramable(bytes, recordIndex) {
+  for (let i = 0; i < bytes.length; i += 1) {
+    const byte = bytes[i];
+    if (byte !== void 0 && RESERVED_STRUCTURE_BYTES.has(byte)) {
+      throw new AstmFrameEncodeError(
+        "A record contains a byte the framing layer reads as structure (STX, ETB or ETX). A frame has no escape sequence for one, so it cannot be carried inside a frame: remove it from the record before framing.",
+        recordIndex,
+        "ASTM_FRAME_RESERVED_BYTE",
+        i
+      );
+    }
+  }
+}
 function encodeFrame(text, frameNumber, isFinal) {
   const term = isFinal ? ETX : ETB;
   const bytes = [STX, FN_ZERO + frameNumber, ...text, term];
@@ -2280,6 +2311,7 @@ function composeAstmFrames(records, options = {}) {
         recordIndex
       );
     }
+    assertFramable(bytes, recordIndex);
     for (let offset = 0; offset < bytes.length; offset += MAX_FRAME_TEXT) {
       const chunk = bytes.subarray(offset, offset + MAX_FRAME_TEXT);
       const isFinal = offset + MAX_FRAME_TEXT >= bytes.length;
@@ -2315,7 +2347,7 @@ function concatBytes3(chunks) {
 }
 
 // src/index.ts
-var VERSION = "0.0.10";
+var VERSION = "0.0.13";
 
 exports.ALL_ASTM_WARNING_CODES = ALL_ASTM_WARNING_CODES;
 exports.AMBIGUOUS_CODES = AMBIGUOUS_CODES;