@cosyte/cli 0.0.6 → 0.1.0

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { R as RunDeps } from './io-B2EobRzC.js';
-export { r as readFileBytes, a as readStreamBytes } from './io-B2EobRzC.js';
+import { a as CliError, b as RunResult, R as RunDeps } from './io-C9bSG2zF.js';
+export { c as CLI_CODES, C as CliCode, E as EXIT, d as ExitCode, e as errorResult, f as fileChunks, g as formatDiagnostic, r as readFileBytes, h as readStreamBytes, s as streamChunks, t as toCliError } from './io-C9bSG2zF.js';
 import 'node:stream';
 
 /**
@@ -28,229 +28,6 @@ import 'node:stream';
  */
 declare const VERSION: string;
 
-/**
- * The `cosyte` CLI **exit-code contract**: a designed, documented surface that CI pipelines and
- * shell scripts branch on. Grounded in the Unix `sysexits.h` conventions.
- *
- * The load-bearing rule: **the CLI never prints a reassuring line and exits `0` on input it could not
- * handle.** An undetectable format, an unreadable file, or a parser that throws each map to a
- * distinct, stable non-zero code, never a silent success.
- *
- * | Code | Name       | Meaning                                                              |
- * |------|------------|----------------------------------------------------------------------|
- * | `0`  | `OK`       | success: the operation completed; `validate` found the input **valid** |
- * | `1`  | `INVALID`  | operation-level failure: `validate` found the input **invalid** (a real, expected CI signal: the message is bad, the tool worked) |
- * | `2`  | `USAGE`    | usage error: unknown command, bad flag, missing argument (EX_USAGE) |
- * | `65` | `DATAERR`  | data error: input could not be parsed / format not detected (EX_DATAERR) |
- * | `66` | `NOINPUT`  | no input: the file does not exist or is unreadable (EX_NOINPUT)     |
- * | `69` | `UNAVAILABLE` | a required capability is not yet available: e.g. `redact` before `@cosyte/deid` is wired (EX_UNAVAILABLE) |
- * | `70` | `SOFTWARE` | internal error: an unexpected exception, i.e. a bug (EX_SOFTWARE)   |
- *
- * The load-bearing `validate` rule: a **parseable-but-invalid** message is exit `1`, never exit `0`.
- * The CLI must never print a reassuring line and exit green on a bad message. Exit `65` is reserved
- * for input that could not be **parsed** at all (a distinct signal from "parsed, but does not
- * conform").
- *
- * @packageDocumentation
- */
-/**
- * The stable exit-code map. Adding a code is a documented, tested change to the CLI's contract;
- * renaming or repurposing one is a breaking change.
- *
- * @example
- * ```ts
- * import { EXIT } from "@cosyte/cli";
- *
- * process.exitCode = EXIT.OK; // => 0
- * ```
- */
-declare const EXIT: {
-    /** Success: the operation completed; `validate` found the input **valid**. */
-    readonly OK: 0;
-    /** Operation-level failure: `validate` found the input **invalid** (parseable but non-conformant):
-     * a real, expected CI signal that the message is bad and the tool worked. Never emitted for
-     * unparseable input (that is `DATAERR`). */
-    readonly INVALID: 1;
-    /** Usage error: unknown command, bad flag, missing argument (`EX_USAGE`). */
-    readonly USAGE: 2;
-    /** Data error: input could not be parsed or its format could not be detected (`EX_DATAERR`). */
-    readonly DATAERR: 65;
-    /** No input: the named file does not exist or is unreadable (`EX_NOINPUT`). */
-    readonly NOINPUT: 66;
-    /** Unavailable: a required capability is not yet wired (e.g. `redact` before `@cosyte/deid`), a
-     * distinct non-zero signal that is never a fake success (`EX_UNAVAILABLE`). */
-    readonly UNAVAILABLE: 69;
-    /** Internal error: an unexpected exception (a bug), distinct from a handled bad input (`EX_SOFTWARE`). */
-    readonly SOFTWARE: 70;
-};
-/**
- * A value from {@link EXIT}: the exit code a CLI invocation resolves to.
- */
-type ExitCode = (typeof EXIT)[keyof typeof EXIT];
-
-/**
- * The result of running a CLI invocation, as data: decoupled from `process` so the whole command
- * tree is testable. The thin `bin` entry writes {@link RunResult.stdout} to `process.stdout`,
- * {@link RunResult.stderr} to `process.stderr`, and exits with {@link RunResult.exit}.
- *
- * The two channels carry the CLI's PHI posture: **stdout is the data channel** (the
- * user's explicit request: the parsed model), while **stderr is value-free**: codes and positions
- * only, never an input value.
- *
- * @packageDocumentation
- */
-
-/**
- * A fully-resolved CLI invocation.
- *
- * @example
- * ```ts
- * import { EXIT, type RunResult } from "@cosyte/cli";
- *
- * const r: RunResult = { stdout: "{}\n", stderr: "", exit: EXIT.OK };
- * r.exit; // => 0
- * ```
- */
-interface RunResult {
-    /** The data channel: the parsed model or requested output. May contain the user's data by design. */
-    readonly stdout: string;
-    /** The diagnostic channel is **value-free**: codes, positions, file paths, format names only. */
-    readonly stderr: string;
-    /** The exit code the invocation resolves to. */
-    readonly exit: ExitCode;
-}
-
-/**
- * The CLI's **value-free diagnostic channel**. Every error the CLI raises on its own behalf carries a
- * stable `CLI_*` code, a fixed exit code, and a **PHI-safe** message built only from positional /
- * structural context: a segment or field index, a byte offset, a file path, a format name, a warning
- * code. **A diagnostic never echoes an input value** (a name, a DOB, an MRN, a result). This is the
- * parsers' "warning = code + position, never a value" rule applied at the CLI edge.
- *
- * @packageDocumentation
- */
-
-/**
- * Stable **CLI diagnostic code** registry: errors the CLI owns (routing, I/O, argument handling),
- * distinct from the wrapped library's own warning/issue codes which are passed through unchanged.
- * Each code is its own value (`key === value`) so the set survives `Object.values(...)`; renaming or
- * removing one is a **breaking change** because scripts branch on the stderr text.
- *
- * @example
- * ```ts
- * import { CLI_CODES } from "@cosyte/cli";
- *
- * if (diagnostic.code === CLI_CODES.CLI_FORMAT_UNDETECTED) {
- *   // ask the user for --format
- * }
- * ```
- */
-declare const CLI_CODES: {
-    /** A required argument was missing or a flag was invalid. Exit `2`. */
-    readonly CLI_USAGE: "CLI_USAGE";
-    /** The named file does not exist or could not be read. Exit `66`. */
-    readonly CLI_NO_INPUT: "CLI_NO_INPUT";
-    /** The input was empty, no bytes to detect or parse. Exit `65`. */
-    readonly CLI_EMPTY_INPUT: "CLI_EMPTY_INPUT";
-    /** No format signature matched; the CLI will not guess. Names the candidates, never the bytes. Exit `65`. */
-    readonly CLI_FORMAT_UNDETECTED: "CLI_FORMAT_UNDETECTED";
-    /** More than one format signature matched; the CLI will not guess. Names the candidates, never the bytes. Exit `65`. */
-    readonly CLI_FORMAT_AMBIGUOUS: "CLI_FORMAT_AMBIGUOUS";
-    /** A recognised format whose parser does not support the requested operation (e.g. `parse` on a
-     * format wired only for `inspect`). Names the format + operation, never the bytes. Exit `65`. */
-    readonly CLI_FORMAT_UNSUPPORTED: "CLI_FORMAT_UNSUPPORTED";
-    /** The optional parser package for a recognised format is not installed. The six breadth parsers
-     * (dicom/x12/ccda/ncpdp/astm/mllp) are `optionalDependencies`: normally installed, but if
-     * one is absent the CLI degrades to this value-free signal rather than crashing. Exit `69`. */
-    readonly CLI_PARSER_UNAVAILABLE: "CLI_PARSER_UNAVAILABLE";
-    /** The wrapped parser rejected the input. Positional context only, never the offending bytes. Exit `65`. */
-    readonly CLI_PARSE_FAILED: "CLI_PARSE_FAILED";
-    /** The BYO ConceptMap supplied to `map-codes` is not valid JSON or not a loadable FHIR ConceptMap.
-     * Names the stable terminology-loader code, never the map's bytes. Exit `65`. */
-    readonly CLI_MAP_INVALID: "CLI_MAP_INVALID";
-    /** A command whose ground-layer library is not yet wired (e.g. `redact` before `@cosyte/deid` is
-     * wired). Never a fake success: a distinct, value-free "unavailable" signal. Exit `69`. */
-    readonly CLI_NOT_IMPLEMENTED: "CLI_NOT_IMPLEMENTED";
-    /** An unexpected internal error (a bug). Exit `70`. */
-    readonly CLI_INTERNAL: "CLI_INTERNAL";
-};
-/**
- * A value from {@link CLI_CODES}: the stable code carried by a {@link CliError}.
- */
-type CliCode = (typeof CLI_CODES)[keyof typeof CLI_CODES];
-/**
- * A typed, PHI-safe CLI error. Its {@link CliError.message | message} is **value-free by
- * construction**: callers must build it from codes, indices, offsets, format names, and file paths,
- * never from an input value. It carries the {@link ExitCode} the invocation resolves to.
- *
- * @example
- * ```ts
- * import { CliError, CLI_CODES, EXIT } from "@cosyte/cli";
- *
- * throw new CliError(CLI_CODES.CLI_NO_INPUT, EXIT.NOINPUT, "cannot read the named file");
- * ```
- */
-declare class CliError extends Error {
-    /** The stable diagnostic code. */
-    readonly code: CliCode;
-    /** The exit code this error resolves the invocation to. */
-    readonly exit: ExitCode;
-    /**
-     * @param code - A stable {@link CliCode}.
-     * @param exit - The {@link ExitCode} to resolve to.
-     * @param message - A **value-free** explanation (positional/structural context only, never PHI).
-     */
-    constructor(code: CliCode, exit: ExitCode, message: string);
-}
-/**
- * Render a {@link CliError} as a single value-free `stderr` line: `cosyte: <CODE>: <message>`. The
- * message is already value-free by the {@link CliError} contract; this only prefixes the tool name
- * and the code so scripts and humans can branch on a stable token.
- *
- * @param err - The CLI error to render.
- * @returns The stderr line (no trailing newline).
- * @example
- * ```ts
- * import { CliError, CLI_CODES, EXIT, formatDiagnostic } from "@cosyte/cli";
- *
- * formatDiagnostic(new CliError(CLI_CODES.CLI_USAGE, EXIT.USAGE, "missing <file> argument"));
- * // => "cosyte: CLI_USAGE: missing <file> argument"
- * ```
- */
-declare function formatDiagnostic(err: CliError): string;
-/**
- * Resolve a {@link CliError} into a value-free {@link RunResult}: empty `stdout` (nothing reaches the
- * data channel on an error), the rendered diagnostic on `stderr`, and the error's exit code. The
- * single place the CLI turns an owned error into a result, so every command and the dispatcher render
- * errors identically.
- *
- * @param err - The CLI error to resolve.
- * @returns The value-free {@link RunResult}.
- * @example
- * ```ts
- * import { CliError, CLI_CODES, EXIT, errorResult } from "@cosyte/cli";
- *
- * errorResult(new CliError(CLI_CODES.CLI_USAGE, EXIT.USAGE, "missing <file>")).exit; // => 2
- * ```
- */
-declare function errorResult(err: CliError): RunResult;
-/**
- * Coerce an unknown thrown value into a {@link CliError}. A {@link CliError} passes through; anything
- * else becomes a `CLI_INTERNAL` / {@link EXIT.SOFTWARE} error whose message is a **fixed, value-free
- * string**: the original message is deliberately discarded so a parser exception that embedded input
- * bytes can never reach stderr.
- *
- * @param err - The caught value.
- * @returns A {@link CliError} safe to render to stderr.
- * @example
- * ```ts
- * import { toCliError } from "@cosyte/cli";
- *
- * toCliError(new Error("boom")).code; // => "CLI_INTERNAL"
- * ```
- */
-declare function toCliError(err: unknown): CliError;
-
 /**
  * **Content-based format autodetection**: the feature that makes `cosyte parse <file>` feel magic,
  * and the one that must **fail safe**. Detection sniffs the leading bytes' *content*, never the file
@@ -298,6 +75,20 @@ interface DetectResult {
     /** The matching candidate formats (0 for `none`, 1 for `certain`, ≥2 for `ambiguous`). Value-free. */
     readonly candidates: readonly CosyteFormat[];
 }
+/**
+ * How many leading bytes detection reads. Small: every signature lives in the first line (the
+ * deepest is DICOM's magic at byte 128). Exported because a **streaming** caller has to know how much
+ * of the input to hold back before it can detect the format, and reading a different amount than
+ * detection uses would make the two disagree.
+ *
+ * @example
+ * ```ts
+ * import { DETECT_PREFIX_BYTES } from "@cosyte/cli";
+ *
+ * DETECT_PREFIX_BYTES; // => 512
+ * ```
+ */
+declare const DETECT_PREFIX_BYTES = 512;
 /** The formats content-autodetection can recognise (every format now carries a signature). */
 declare const DETECTABLE_FORMATS: readonly CosyteFormat[];
 /**
@@ -369,6 +160,194 @@ declare const KNOWN_FORMATS: readonly CosyteFormat[];
  */
 declare function asCosyteFormat(value: string): CosyteFormat | null;
 
+/**
+ * The CLI's **own input-size ceiling**, and the value-free refusal it raises.
+ *
+ * Node has two hard allocation ceilings a byte pipeline can walk into: a single `Buffer` cannot
+ * exceed `buffer.constants.MAX_LENGTH` and a single string cannot exceed
+ * `buffer.constants.MAX_STRING_LENGTH`. Crossing either raises a *platform* exception, which is
+ * indistinguishable, at the CLI edge, from a bug: it would be reported as an internal error even
+ * though the input was merely large. That is a lie about whose fault it is, and it is the reason this
+ * module exists.
+ *
+ * So the CLI declares a limit of its **own**, far below both ceilings, checks it against the
+ * **running total as input is read** (never after a whole oversized input has been assembled), and
+ * refuses an over-limit invocation with a stable, value-free diagnostic and the **data-error** exit
+ * code. The number is a documented part of the command surface: it is stated in `cosyte --help` and
+ * in the command reference, and both are rendered from {@link MAX_INPUT_BYTES} so they cannot drift.
+ *
+ * @packageDocumentation
+ */
+
+/**
+ * The maximum number of input bytes `cosyte parse` reads in one invocation: **67108864 bytes
+ * (64 MiB)**.
+ *
+ * Chosen to sit far below the smaller of Node's two allocation ceilings
+ * (`buffer.constants.MAX_STRING_LENGTH`, 536870888 characters), because the bytes read are not the
+ * peak: a parsed model rendered as JSON is routinely several times the size of the input that
+ * produced it, so the limit has to leave room for the output as well as the input. A power of two, so
+ * the byte count and its mebibyte rendering are both exact.
+ *
+ * @example
+ * ```ts
+ * import { MAX_INPUT_BYTES } from "@cosyte/cli";
+ *
+ * MAX_INPUT_BYTES; // => 67108864
+ * ```
+ */
+declare const MAX_INPUT_BYTES: number;
+/**
+ * Render a byte limit as a **concrete number with an explicit byte-based unit**: `"67108864 bytes
+ * (64 MiB)"`. Every surface that states the limit (the refusal diagnostic, `cosyte --help`, the
+ * command reference) renders it through here, so the number a user reads is always the number the
+ * code enforces, and never a vague description of one.
+ *
+ * @param limit - The limit in bytes. Defaults to {@link MAX_INPUT_BYTES}.
+ * @returns The limit as bytes, plus a mebibyte rendering when it is a whole number of mebibytes.
+ * @example
+ * ```ts
+ * import { describeByteLimit } from "@cosyte/cli";
+ *
+ * describeByteLimit(67108864); // => "67108864 bytes (64 MiB)"
+ * describeByteLimit(1000); // => "1000 bytes"
+ * ```
+ */
+declare function describeByteLimit(limit?: number): string;
+/**
+ * Build the value-free over-limit refusal: a stable `CLI_INPUT_TOO_LARGE` code, the **data-error**
+ * exit (`65`, never the internal-error `70`), and a message that names the limit and nothing else.
+ * The offending input's own size is deliberately not reported either: the limit is the actionable
+ * fact, and a size read off the input is a property of the input.
+ *
+ * @param limit - The limit that was exceeded, in bytes. Defaults to {@link MAX_INPUT_BYTES}.
+ * @returns The value-free {@link CliError} to resolve the invocation with.
+ * @example
+ * ```ts
+ * import { inputTooLargeError } from "@cosyte/cli";
+ *
+ * inputTooLargeError().exit; // => 65
+ * inputTooLargeError().code; // => "CLI_INPUT_TOO_LARGE"
+ * ```
+ */
+declare function inputTooLargeError(limit?: number): CliError;
+
+/**
+ * **Record streaming**: turning a stream of input byte chunks into a stream of whole records, so a
+ * multi-record command can emit a record's output *before* the rest of its input has been read.
+ *
+ * Two input shapes are multi-record, and both arrive here as chunks rather than as one buffer: an
+ * **MLLP** stream (each VT-framed frame encloses one HL7 v2 message) and any input under
+ * **`--ndjson`** (each non-empty line is a record). Neither splitter re-implements a wire format: the
+ * MLLP one drives `@cosyte/mllp`'s own streaming `FrameReader`, and the NDJSON one splits on the line
+ * terminator, which is the bulk-data convention's own framing, not a parse of the records inside it.
+ *
+ * The size limit is enforced here too, as {@link withinLimit}: a running byte count over the chunk
+ * stream, so an over-limit input is refused **while it is arriving** rather than after it has been
+ * assembled.
+ *
+ * @packageDocumentation
+ */
+/** A stream of input byte chunks, in arrival order: what every function here consumes. */
+type ByteChunks = AsyncIterable<Uint8Array>;
+/**
+ * Wrap `bytes` as a one-chunk stream, so the streaming record path can also serve a caller that
+ * hands the CLI a whole buffer (an injected reader, or the programmatic API). The path is the same;
+ * only the granularity the input arrives at differs.
+ *
+ * @param bytes - The whole input.
+ * @returns A stream yielding exactly one chunk (or none, when `bytes` is empty).
+ * @example
+ * ```ts
+ * import { oneChunk } from "@cosyte/cli";
+ *
+ * let n = 0;
+ * for await (const c of oneChunk(new Uint8Array([1, 2, 3]))) n += c.length;
+ * n; // => 3
+ * ```
+ */
+declare function oneChunk(bytes: Uint8Array): AsyncGenerator<Uint8Array>;
+/**
+ * Pass chunks through while counting them against the CLI's own size limit, and **refuse the moment
+ * the running total passes it**: the chunk that crosses the limit is never yielded, the source is
+ * never pulled again, and nothing downstream ever allocates memory proportional to an oversized
+ * input. This is why the refusal a caller sees is the CLI's own data error rather than a platform
+ * allocation failure reported as an internal error.
+ *
+ * @param chunks - The input chunk stream.
+ * @param limit - The maximum number of bytes to accept. Defaults to {@link MAX_INPUT_BYTES}.
+ * @returns The same chunks, up to the limit.
+ * @throws {CliError} `CLI_INPUT_TOO_LARGE` (exit `65`) as soon as the running total passes `limit`.
+ * @example
+ * ```ts
+ * import { oneChunk, withinLimit } from "@cosyte/cli";
+ *
+ * const src = withinLimit(oneChunk(new Uint8Array(10)), 4);
+ * await src.next().catch((e: unknown) => (e as { code: string }).code); // => "CLI_INPUT_TOO_LARGE"
+ * ```
+ */
+declare function withinLimit(chunks: ByteChunks, limit?: number): AsyncGenerator<Uint8Array>;
+/**
+ * Drain a chunk stream into one buffer: the single-message path, where the parser needs the whole
+ * message anyway. The size limit is already applied by {@link withinLimit} upstream, so this cannot
+ * accumulate more than the limit allows.
+ *
+ * @param chunks - The input chunk stream.
+ * @returns The concatenated bytes.
+ * @example
+ * ```ts
+ * import { collectChunks, oneChunk } from "@cosyte/cli";
+ *
+ * (await collectChunks(oneChunk(new TextEncoder().encode("MSH|")))).length; // => 4
+ * ```
+ */
+declare function collectChunks(chunks: ByteChunks): Promise<Uint8Array>;
+/**
+ * Split a chunk stream into **NDJSON records**: each non-empty, newline-terminated line, yielded as
+ * soon as its terminator arrives. A record split across two chunks is carried over; a final record
+ * with no trailing newline is yielded at end of stream; a blank line carries no record and is
+ * skipped.
+ *
+ * @param chunks - The input chunk stream.
+ * @returns A stream of record bytes, in input order.
+ * @example
+ * ```ts
+ * import { ndjsonRecords, oneChunk } from "@cosyte/cli";
+ *
+ * const src = oneChunk(new TextEncoder().encode('{"a":1}\n\n{"b":2}\n'));
+ * const out: string[] = [];
+ * for await (const r of ndjsonRecords(src)) out.push(new TextDecoder().decode(r));
+ * out.length; // => 2
+ * ```
+ */
+declare function ndjsonRecords(chunks: ByteChunks): AsyncGenerator<Uint8Array>;
+/**
+ * De-frame a chunk stream into **MLLP frame payloads** (each an enclosed HL7 v2 message), yielded as
+ * each frame completes. The framing is `@cosyte/mllp`'s own streaming `FrameReader`, fed chunk by
+ * chunk; the CLI only tracks where the frame bytes fell so it can tell a **truncated** stream from a
+ * complete one.
+ *
+ * **Truncation is a data error, never a silent drop.** An unterminated trailing frame (a start-of-block
+ * byte after the last end-of-block byte) is delivered by no callback, so it would otherwise vanish
+ * with a green exit. It is detected at end of stream and raised, after the frames that did complete
+ * have already been yielded: their output stands, and the invocation still resolves to the data error.
+ *
+ * @param chunks - The input chunk stream.
+ * @returns A stream of enclosed HL7 payloads, in frame order.
+ * @throws {CliError} `CLI_PARSER_UNAVAILABLE` (exit `69`) if `@cosyte/mllp` is absent;
+ *   `CLI_PARSE_FAILED` (exit `65`) at end of stream on a truncated final frame.
+ * @example
+ * ```ts
+ * import { mllpFrames, oneChunk } from "@cosyte/cli";
+ *
+ * const framed = new Uint8Array([0x0b, 0x4d, 0x53, 0x48, 0x1c, 0x0d]);
+ * const seen: number[] = [];
+ * for await (const p of mllpFrames(oneChunk(framed))) seen.push(p.length);
+ * seen.length; // => 1
+ * ```
+ */
+declare function mllpFrames(chunks: ByteChunks): AsyncGenerator<Uint8Array>;
+
 /**
  * The CLI's **value-free finding** shape and the positional locators that populate it. A finding says
  * *what kind* of thing was observed (a stable code + severity) and *where* (a positional locator),
@@ -752,6 +731,21 @@ declare function deframeMllp(bytes: Uint8Array): Promise<{
     payloads: Buffer[];
     warningCount: number;
 }>;
+/**
+ * The value-free data error for a **truncated MLLP stream**: a frame opened and never closed, which
+ * the streaming reader buffers and delivers to no callback. Built here so the whole-buffer de-framer
+ * above and the chunk-by-chunk one in `core/records.ts` refuse the same input with the same code and
+ * the same words.
+ *
+ * @returns A `CLI_PARSE_FAILED` (exit `65`) {@link CliError}.
+ * @example
+ * ```ts
+ * import { truncatedMllpError } from "@cosyte/cli";
+ *
+ * truncatedMllpError().exit; // => 65
+ * ```
+ */
+declare function truncatedMllpError(): CliError;
 
 /**
  * The shared **input + format resolution** every file-consuming command runs before it touches a
@@ -763,7 +757,13 @@ declare function deframeMllp(bytes: Uint8Array): Promise<{
  *
  * Every failure is a value-free {@link CliError} rendered to a {@link RunResult}: a missing argument
  * is a usage error (`2`), an unreadable file a no-input error (`66`), empty/undetected/unwired input a
- * data error (`65`). None ever echoes an input byte.
+ * data error (`65`), an input past the documented size limit a data error too (`65`, never the
+ * internal-error code). None ever echoes an input byte.
+ *
+ * Two front doors, one contract: {@link resolveInput} hands back the whole input as one buffer, and
+ * {@link resolveInputStream} hands back a chunk stream for a command that emits output before the
+ * input has finished arriving. They share the format-resolution and exit-code decisions, so a bad
+ * `--format`, an undetectable input and an unwired (format, op) resolve identically either way.
  *
  * @packageDocumentation
  */
@@ -794,7 +794,10 @@ type InputResolution = {
  * @param formatOverride - The raw `--format` value, or `undefined` to autodetect by content.
  * @param deps - Injected input readers ({@link RunDeps}).
  * @param op - The wrapping operation the caller will run; the resolved format is confirmed to support
- *   it (else a value-free `CLI_FORMAT_UNSUPPORTED` naming the supporting formats).
+ *   it (else a value-free `CLI_FORMAT_UNSUPPORTED` naming the supporting formats). Pass `null` when
+ *   the caller answers for capability itself: `redact` delegates to `@cosyte/deid`, whose per-format
+ *   coverage is a different matrix with its own two distinct refusals, so applying the parser
+ *   registry's matrix first would answer with the wrong code.
  * @returns `{ ok: true, input }` when the bytes read and the format resolved to a parser supporting
  *   `op`; else `{ ok: false, result }` with a value-free usage/no-input/data-error {@link RunResult}.
  * @throws Propagates a **non-`CliError`** read failure unchanged, so the dispatcher maps it to
@@ -811,7 +814,63 @@ type InputResolution = {
  * if (r.ok) r.input.format; // => "fhir"
  * ```
  */
-declare function resolveInput(source: string | undefined, formatOverride: string | undefined, deps: RunDeps, op: Op): Promise<InputResolution>;
+declare function resolveInput(source: string | undefined, formatOverride: string | undefined, deps: RunDeps, op: Op | null): Promise<InputResolution>;
+/**
+ * A successfully-resolved **streaming** input: the format, plus the input as a stream of chunks with
+ * the leading bytes detection consumed put back in front, so the consumer still sees the whole input
+ * in order.
+ */
+interface ResolvedInputStream {
+    /** The resolved format: guaranteed to satisfy `supportsOp(format, op)` for the requested op. */
+    readonly format: CosyteFormat;
+    /** The whole input as chunks, size-limited: reading past the limit raises `CLI_INPUT_TOO_LARGE`. */
+    readonly chunks: ByteChunks;
+}
+/**
+ * The outcome of {@link resolveInputStream}: the resolved streaming input, or a ready-to-return
+ * value-free {@link RunResult}. The same discriminated-union shape as {@link InputResolution}.
+ */
+type InputStreamResolution = {
+    readonly ok: true;
+    readonly input: ResolvedInputStream;
+} | {
+    readonly ok: false;
+    readonly result: RunResult;
+};
+/**
+ * Resolve the input as a **stream of chunks** rather than one buffer, for a command that can act on a
+ * record before the whole input has arrived.
+ *
+ * It reads only as far as the detection window ({@link DETECT_PREFIX_BYTES}) before deciding the
+ * format, then hands back those bytes followed by the rest of the stream, unread. The size limit is
+ * applied to the running total from the first chunk, so an over-limit input is refused while it is
+ * still arriving and never assembled.
+ *
+ * When the caller's {@link RunDeps} carry no chunk readers, the whole-input readers are wrapped as a
+ * single chunk: the same code path, the same output, only the granularity differs.
+ *
+ * @param source - The positional `<file|->` argument (or `undefined` when it was omitted).
+ * @param formatOverride - The raw `--format` value, or `undefined` to autodetect by content.
+ * @param deps - Injected readers ({@link RunDeps}); the chunk readers are used when present.
+ * @param op - The wrapping operation the caller will run; the resolved format is confirmed to support it.
+ * @param limit - The maximum number of input bytes to accept. Defaults to {@link MAX_INPUT_BYTES}.
+ * @returns `{ ok: true, input }` with the format and the chunk stream, else `{ ok: false, result }`
+ *   carrying the value-free usage / no-input / data-error {@link RunResult}.
+ * @throws Propagates a **non-`CliError`** read failure unchanged, so the dispatcher maps it to
+ *   `CLI_INTERNAL`.
+ * @example
+ * ```ts
+ * import { resolveInputStream } from "@cosyte/cli";
+ *
+ * const deps = {
+ *   readFile: async () => new TextEncoder().encode('{"resourceType":"Patient"}'),
+ *   readStdin: async () => new Uint8Array(),
+ * };
+ * const r = await resolveInputStream("patient.json", undefined, deps, "parse");
+ * if (r.ok) r.input.format; // => "fhir"
+ * ```
+ */
+declare function resolveInputStream(source: string | undefined, formatOverride: string | undefined, deps: RunDeps, op: Op, limit?: number): Promise<InputStreamResolution>;
 
 /**
  * The CLI's **global PHI display posture**: the single mechanism that gates whether *any* input
@@ -948,57 +1007,189 @@ declare function parseFailureResult(format: CosyteFormat, bytes: Uint8Array, pos
 
 /**
  * The **de-identification seam**: the single, documented plug-in point where the `redact` / `deid`
- * command will delegate to **`@cosyte/deid`** once that integration lands and is vetted.
+ * command delegates to **`@cosyte/deid`**. Everything the CLI knows about de-identification lives
+ * here, and it is deliberately little: which formats the delegate covers, how to reach it, and how to
+ * turn its result into the CLI's own value-free shapes.
+ *
+ * ## The CLI ships no redactor of its own (the boundary decision)
+ *
+ * A "minimal built-in Safe-Harbor pass over the obvious PHI loci" (the HL7 `PID` segment,
+ * `Patient.name`/`Patient.address` in FHIR) is **deliberately rejected**. Real messages carry PHI far
+ * beyond those loci: HL7 `NK1`/`GT1`/`IN1`/`OBX`/`NTE`, FHIR extensions and contained resources,
+ * free-text notes. A redactor that scrubs the obvious fields and emits output that *looks*
+ * de-identified while silently leaving PHI behind is a **false-safety impression**. A `redact` that
+ * under-redacts is worse than no `redact`. So the CLI adds no policy, no locus map, no transform and
+ * no fallback scrub: it delegates, or it refuses.
+ *
+ * ## What "covered" means, per format
+ *
+ * A format is covered when the delegate ships an adapter for the standard this CLI actually resolves
+ * **and** the CLI can carry the de-identified result on its text data channel. Both halves bite:
+ *
+ * - `ncpdp`: the delegate's adapter is NCPDP **Telecom**, while this CLI resolves NCPDP **SCRIPT**.
+ *   The subpath exists; the coverage does not.
+ * - `dicom`: the delegate covers it, but its result is a Part 10 **byte** stream and this CLI's data
+ *   channel is a `string`. That is the CLI's own limit, so it is reported as the CLI's own
+ *   unsupported (format, operation) cell rather than blamed on the delegate.
+ * - `astm`, `mllp`: no adapter at all.
+ *
+ * ## The key context, and why it is ephemeral
+ *
+ * The delegate's default policy removes MRN / account / member identifiers rather than replacing
+ * them with a keyed surrogate, so a default run needs no key. The CLI binds a key context anyway,
+ * because a keyed transform with no key context is a fatal there, never an unkeyed fallback, and the
+ * CLI holds no key material and offers no key surface. So it creates a **per-invocation ephemeral
+ * key**: any surrogate the delegate mints is consistent within one output and deliberately **not**
+ * stable across runs (no cross-run linkage). That property is disclosed on the diagnostic channel
+ * rather than left to be discovered.
  *
- * ## Why the CLI ships no built-in redactor (the boundary decision)
+ * @packageDocumentation
+ */
+
+/** The npm package the whole de-identification capability is delegated to. */
+declare const DEID_PACKAGE = "@cosyte/deid";
+/**
+ * What the delegate can do for one format, from this CLI's point of view:
  *
- * The CLI does **not wire `@cosyte/deid` yet**, and the wrapped
- * parsers (`@cosyte/hl7`, `@cosyte/fhir`) expose **no de-identification API**: they redact only
- * their own *diagnostics*, not the parsed model. So there is nothing for the CLI to delegate to
- * today.
+ * - `covered`: an adapter for the standard this CLI resolves, serializable onto the text channel.
+ * - `no-adapter`: the delegate does not de-identify this format (`CLI_NOT_IMPLEMENTED`, exit `69`).
+ * - `unserializable`: the delegate covers it, but the result cannot ride a text stdout
+ *   (`CLI_FORMAT_UNSUPPORTED`, exit `65`: the CLI's own limit, not the delegate's).
+ */
+type DeidCoverage = "covered" | "no-adapter" | "unserializable";
+/** A format the delegate de-identifies and the CLI can serialize. */
+type DeidCoveredFormat = "hl7" | "fhir" | "x12" | "ccda";
+/**
+ * The honest per-format de-identification matrix, the `redact` analogue of the parser registry's
+ * operation matrix. Every one of the eight formats has an entry, so a new format cannot be added
+ * without answering for it here.
  *
- * A tempting alternative, a "minimal built-in Safe-Harbor pass over the obvious PHI loci" (e.g. the
- * HL7 `PID` segment, `Patient.name`/`Patient.address` in FHIR), is **deliberately rejected**. Real
- * messages carry PHI far beyond those loci: HL7 `NK1`/`GT1`/`IN1`/`OBX`/`NTE`, FHIR extensions and
- * contained resources, free-text notes. A redactor that scrubs the obvious fields and emits output
- * that *looks* de-identified while silently leaving PHI behind is a **false-safety impression**. A
- * `redact` that under-redacts is worse than no `redact`.
+ * @example
+ * ```ts
+ * import { DEID_COVERAGE } from "@cosyte/cli";
  *
- * So `redact` is an **honest, typed `CLI_NOT_IMPLEMENTED`** (never a fake success, never a partial
- * scrub presented as de-identified, never invent a capability the ground layer lacks),
- * gated on `@cosyte/deid`, with this seam as its one drop-in point. When that integration lands and is
- * conformance-graded, {@link deidStatus} flips to `available` and the command reads the input, calls
- * the delegated de-identifier, and emits the de-identified model: the command surface (`redact`,
- * `deid`, `<file|->`, `--format`) already exists so that change is additive.
+ * DEID_COVERAGE.hl7; // => "covered"
+ * DEID_COVERAGE.dicom; // => "unserializable"
+ * ```
+ */
+declare const DEID_COVERAGE: Readonly<Record<CosyteFormat, DeidCoverage>>;
+/**
+ * What the delegate can do for `format`.
  *
- * @packageDocumentation
+ * @param format - The resolved format.
+ * @returns That format's {@link DeidCoverage}.
+ * @example
+ * ```ts
+ * import { deidCoverage } from "@cosyte/cli";
+ *
+ * deidCoverage("ncpdp"); // => "no-adapter"
+ * ```
+ */
+declare function deidCoverage(format: CosyteFormat): DeidCoverage;
+/**
+ * Whether `format` is one the delegate de-identifies and the CLI can serialize.
+ *
+ * @param format - The resolved format.
+ * @returns `true` iff `redact` produces output for it.
+ * @example
+ * ```ts
+ * import { isDeidCovered } from "@cosyte/cli";
+ *
+ * isDeidCovered("x12"); // => true
+ * ```
+ */
+declare function isDeidCovered(format: CosyteFormat): format is DeidCoveredFormat;
+/**
+ * The formats `redact` produces output for, sorted: the single source the help text, the published
+ * documentation and the tests all read, so the three cannot drift.
+ *
+ * @returns The covered format names, sorted.
+ * @example
+ * ```ts
+ * import { deidCoveredFormats } from "@cosyte/cli";
+ *
+ * deidCoveredFormats(); // => ["ccda", "fhir", "hl7", "x12"]
+ * ```
+ */
+declare function deidCoveredFormats(): readonly CosyteFormat[];
+/**
+ * One entry of the delegate's value-free manifest, narrowed to the fields the CLI renders. The
+ * `locus` is a **path, never a value**, by the delegate's own contract; nothing here carries an input
+ * value, which is what lets the manifest go on the diagnostic channel at all.
+ */
+interface DeidManifestRecord {
+    /** The identifier category acted on. */
+    readonly category: string;
+    /** The transform applied. */
+    readonly transform: string;
+    /** The structural path acted on: never a value. */
+    readonly locus: string;
+    /** How many values at this locus were acted on. */
+    readonly count: number;
+    /** What happened: `transformed`, `removed`, or the fail-closed `blocked`. */
+    readonly disposition: string;
+    /** The delegate's stable disposition code. */
+    readonly code: string;
+}
+/** The fail-closed disposition: the delegate reports it could not handle the element. */
+declare const DEID_BLOCKED = "blocked";
+/** A completed de-identification pass: the serialized document plus the delegate's manifest. */
+interface RedactOutcome {
+    /** The de-identified document, serialized exactly as this format's wrapped serializer emits it. */
+    readonly output: string;
+    /** The delegate's value-free manifest, in locus order. */
+    readonly manifest: readonly DeidManifestRecord[];
+}
+/**
+ * The delegate, reduced to what the command needs: its own published honesty label and version, and
+ * one call that de-identifies an input. Deliberately CLI-owned shapes, so the delegate's types never
+ * reach this package's published surface.
+ */
+interface DeidDelegate {
+    /** The delegate's own output label, quoted verbatim; the CLI asserts no standard of its own. */
+    readonly label: string;
+    /** The delegate's own version string. */
+    readonly version: string;
+    /**
+     * De-identify one input under the delegate's default policy.
+     *
+     * @param format - A covered format.
+     * @param bytes - The input bytes.
+     * @returns The serialized de-identified document and the value-free manifest.
+     */
+    readonly redact: (format: DeidCoveredFormat, bytes: Uint8Array) => Promise<RedactOutcome>;
+}
+/**
+ * The value-free reason `redact`/`deid` reports when the de-identification library is absent from the
+ * install. It is an `optionalDependency`, so a copy without it degrades rather than crashing.
  */
-/** The value-free reason `redact`/`deid` reports while the ground-layer library is unavailable. */
 declare const DEID_UNAVAILABLE_REASON: string;
 /**
  * Whether de-identification is available, and (while it is not) the value-free reason why. The one
- * function the `redact` command consults **before reading any input**, so a `redact` invocation never
- * touches the PHI it cannot yet safely strip.
+ * function that answers "is the ground layer here?", consulted **before any input is read** so a
+ * `redact` invocation never touches PHI it cannot strip.
  */
 interface DeidAvailability {
-    /** `true` once `@cosyte/deid` is wired; `false` today. */
+    /** `true` when `@cosyte/deid` resolves in this install. */
     readonly available: boolean;
-    /** A value-free explanation shown when {@link DeidAvailability.available} is `false`. */
+    /** A value-free explanation: the delegate's own label and version, or why it is unavailable. */
     readonly reason: string;
 }
 /**
- * Report the current de-identification availability. Today it is always unavailable (see the module
- * docs); this is the single line that flips when `@cosyte/deid` is wired.
+ * Report the current de-identification availability. This is the single documented flip point: it
+ * resolves the delegated library rather than asserting anything about it.
  *
- * @returns The {@link DeidAvailability}: `{ available: false, reason }` until `@cosyte/deid` is wired.
+ * @param load - The delegate loader; injectable so a test can drive the unavailable branch.
+ * @returns `{ available: true }` with the delegate's own label and version, else `{ available: false }`
+ *   with the value-free {@link DEID_UNAVAILABLE_REASON}.
  * @example
  * ```ts
  * import { deidStatus } from "@cosyte/cli";
  *
- * deidStatus().available; // => false
+ * (await deidStatus()).available; // => true when @cosyte/deid is installed
  * ```
  */
-declare function deidStatus(): DeidAvailability;
+declare function deidStatus(load?: () => Promise<DeidDelegate>): Promise<DeidAvailability>;
 
 /**
  * The top-level **subcommand dispatcher**: a small hand-rolled router over Node's built-in
@@ -1010,6 +1201,23 @@ declare function deidStatus(): DeidAvailability;
  * @packageDocumentation
  */
 
+/**
+ * Build the value-free `--help` text. Names commands, flags, the input-size limit, and exit codes,
+ * never any input.
+ *
+ * The limit is **rendered from the constant the code enforces**, not typed in: the help output and
+ * the published command reference state one number because there is only one number to state.
+ *
+ * @param limitBytes - The input-size limit to state. Defaults to {@link MAX_INPUT_BYTES}.
+ * @returns The full help text.
+ * @example
+ * ```ts
+ * import { helpText } from "@cosyte/cli";
+ *
+ * helpText(1024).includes("1024 bytes"); // => true
+ * ```
+ */
+declare function helpText(limitBytes?: number): string;
 /**
  * Run a full `cosyte` invocation as data.
  *
@@ -1041,7 +1249,14 @@ declare function run(argv: string[], deps: RunDeps): Promise<RunResult>;
  * `{ record, error }` line and the stream continues, and the overall exit is a data error (`65`) if any
  * record failed. Two inputs are multi-record: an **MLLP** stream (each VT-framed frame is an enclosed
  * HL7 message) and any input under **`--ndjson`** (each non-empty line is a record: the FHIR bulk-data
- * convention).
+ * convention). Multi-record output is emitted **record by record, as each is parsed**, so the first
+ * line reaches the data channel long before the last byte of input has been read.
+ *
+ * **The size limit.** One invocation reads at most the documented number of input bytes (see
+ * `core/limits.ts`), counted against the running total as the input arrives. A larger input is a
+ * value-free `CLI_INPUT_TOO_LARGE` **data error**, never the internal-error code, and never a partial
+ * record stream presented as a complete one: whatever reached stdout before the refusal stands, and
+ * the invocation still resolves to the failure's own non-zero exit code.
  *
  * The CLI adds **no** parsing of its own: it routes, reads, and shapes output; `cosyte parse` equals the
  * wrapped library's programmatic parse.
@@ -1053,13 +1268,16 @@ declare function run(argv: string[], deps: RunDeps): Promise<RunResult>;
  * Run the `parse` command.
  *
  * @param args - The arguments after the `parse` subcommand token.
- * @param deps - Injected input readers ({@link RunDeps}).
+ * @param deps - Injected I/O ({@link RunDeps}). When it carries the chunk readers and the output
+ *   sink, a multi-record input is read and emitted incrementally; when it does not, the same path
+ *   runs over one chunk and the output comes back on `stdout` instead.
  * @param posture - The resolved {@link PhiPosture}. Defaults to {@link VALUE_FREE}; under
  *   `--unsafe-show-values` a bounded excerpt of the offending input is appended to a `CLI_PARSE_FAILED`
  *   diagnostic (the single, opt-in value-echoing surface): single-record mode only.
  * @returns A {@link RunResult}: the typed-JSON model (or NDJSON records) on `stdout`, a value-free note
- *   (or nothing) on `stderr`, and the resolved exit code. Never throws a {@link CliError}: it resolves
- *   it to a result; unexpected exceptions are caught by the dispatcher and mapped to `CLI_INTERNAL`.
+ *   (or nothing) on `stderr`, and the resolved exit code. An input past the documented size limit is a
+ *   value-free data error naming the limit. Never throws a {@link CliError}: it resolves it to a
+ *   result; unexpected exceptions are caught by the dispatcher and mapped to `CLI_INTERNAL`.
  * @throws Never {@link CliError}; may propagate a truly unexpected error for the dispatcher to map.
  * @example
  * ```ts
@@ -1330,19 +1548,26 @@ declare function mapCodesCommand(args: string[], deps: RunDeps): Promise<RunResu
 
 /**
  * `cosyte redact <file|-> [--format …]` (alias `cosyte deid …`): the command whose *job* is to strip
- * PHI, emitting a de-identified copy of the parsed model.
- *
- * **It is deliberately not implemented yet.** De-identification belongs to **`@cosyte/deid`**, which
- * the CLI does not wire yet, and the wrapped parsers expose no de-id API to delegate to. A
- * built-in "minimal Safe-Harbor" pass over only the obvious PHI loci would leave PHI behind and
- * present a **false-safety impression**: the cardinal hazard `redact` exists to avoid. So this
- * command is an **honest, typed `CLI_NOT_IMPLEMENTED`** (never a fake success, never a partial scrub
- * dressed up as de-identified), gated on the de-identification seam in `core/deid.ts`.
- *
- * To keep that guarantee airtight, the command **never reads the input**: it consults
- * {@link deidStatus} first, and (while de-id is unavailable) reports the value-free reason and exits
- * `EX_UNAVAILABLE` (`69`) without ever touching the file's bytes. The command surface (positional
- * `<file|->`, `--format`) already exists so wiring `@cosyte/deid` later is additive.
+ * identifiers, emitting a de-identified copy of the message on the data channel.
+ *
+ * **It delegates; it never approximates.** The whole policy belongs to **`@cosyte/deid`** (the seam in
+ * `core/deid.ts`): the CLI adds no locus map, no transform and no fallback scrub, because a partial
+ * pass over only the obvious PHI loci would leave PHI behind and present a **false-safety
+ * impression**, the cardinal hazard this command exists to avoid. So anything short of a clean,
+ * fully-handled pass is a non-zero exit with **empty stdout**:
+ *
+ * - the delegate ships no adapter for the resolved format: `CLI_NOT_IMPLEMENTED`, exit `69`;
+ * - the delegate covers it but the CLI cannot carry the result on a text stdout (DICOM's Part 10
+ *   bytes): `CLI_FORMAT_UNSUPPORTED`, exit `65`, the CLI's own limit rather than the delegate's;
+ * - the delegate reports it could not handle an element: `CLI_DEID_INCOMPLETE`, exit `1`;
+ * - the library is absent from the install: `CLI_PARSER_UNAVAILABLE`, exit `69`, decided **before any
+ *   input is read**.
+ *
+ * The diagnostic channel carries the delegate's own value-free manifest (category, transform, the
+ * structural locus, count, disposition code) and the delegate's own published label and version. The
+ * CLI claims no de-identification standard of its own, and never echoes an input value here: not even
+ * under `--unsafe-show-values`, whose bounded excerpt is deliberately not honoured by *this* command,
+ * because an excerpt of the un-stripped input is exactly what `redact` exists to prevent.
  *
  * @packageDocumentation
  */
@@ -1351,18 +1576,27 @@ declare function mapCodesCommand(args: string[], deps: RunDeps): Promise<RunResu
  * Run the `redact` / `deid` command.
  *
  * @param args - The arguments after the `redact`/`deid` subcommand token.
- * @returns A {@link RunResult}. While `@cosyte/deid` is unavailable: empty `stdout`, a value-free
- *   `CLI_NOT_IMPLEMENTED` diagnostic on `stderr`, and exit `EX_UNAVAILABLE` (`69`). A malformed
- *   invocation (an unknown flag) is a usage error (exit `2`). The input is **never read**.
+ * @param deps - Injected input readers ({@link RunDeps}).
+ * @param loadDelegate - The de-identification delegate loader; injectable so a test can drive the
+ *   library-absent path without uninstalling it.
+ * @returns A {@link RunResult}. A clean pass over a covered format: the de-identified document on
+ *   `stdout`, the delegate's attribution and value-free manifest on `stderr`, exit `0`. Otherwise
+ *   empty `stdout` and a typed non-zero exit: `1` when the delegate could not handle an element, `69`
+ *   when it has no adapter for the format or is absent, `65` when the format cannot ride a text
+ *   stdout or the input did not parse, `66` for an unreadable file, `2` for a bad flag.
+ * @throws Never {@link CliError}; may propagate a truly unexpected error for the dispatcher to map.
  * @example
  * ```ts
  * import { redactCommand } from "@cosyte/cli";
  *
- * const r = redactCommand(["message.hl7"]);
- * r.exit; // => 69
+ * const deps = {
+ *   readFile: async () => new TextEncoder().encode('{"resourceType":"Patient","id":"x"}'),
+ *   readStdin: async () => new Uint8Array(),
+ * };
+ * (await redactCommand(["patient.json"], deps)).exit; // => 0
  * ```
  */
-declare function redactCommand(args: string[]): RunResult;
+declare function redactCommand(args: string[], deps: RunDeps, loadDelegate?: () => Promise<DeidDelegate>): Promise<RunResult>;
 
 /**
  * `cosyte completion <bash|zsh|fish>`
@@ -1391,4 +1625,4 @@ declare function redactCommand(args: string[]): RunResult;
  */
 declare function completionCommand(args: string[]): RunResult;
 
-export { CLI_CODES, type CliCode, CliError, type CosyteFormat, DEID_UNAVAILABLE_REASON, DETECTABLE_FORMATS, type DeidAvailability, type DetectResult, EXIT, type ExitCode, type Finding, type FmtResult, type InputResolution, type InspectSummary, KNOWN_FORMATS, OP_SUPPORT, type Op, type ParseResult, type ParseWarning, type PhiPosture, type ResolvedInput, RunDeps, type RunResult, SHOW_VALUES, UNSAFE_EXCERPT_MAX, UNSAFE_SHOW_VALUES_FLAG, VALUE_FREE, VERSION, type Verdict, asCosyteFormat, classifyCandidates, completionCommand, convertCommand, convertOutcome, deframeMllp, deidStatus, detectFormat, detectionError, errorResult, extractPhiPosture, extractStableCode, fmtCommand, fmtFormat, formatDiagnostic, formatHl7Position, formatsSupporting, inspectCommand, inspectFormat, loadOptional, loadOptionalPackage, mapCodesCommand, parseCommand, parseFailureResult, parseFormat, redactCommand, resolveInput, run, supportsOp, toCliError, unsafeInputSuffix, validateCommand, validateFormat, valueFreeLocator };
+export { type ByteChunks, CliError, type CosyteFormat, DEID_BLOCKED, DEID_COVERAGE, DEID_PACKAGE, DEID_UNAVAILABLE_REASON, DETECTABLE_FORMATS, DETECT_PREFIX_BYTES, type DeidAvailability, type DeidCoverage, type DeidCoveredFormat, type DeidDelegate, type DeidManifestRecord, type DetectResult, type Finding, type FmtResult, type InputResolution, type InputStreamResolution, type InspectSummary, KNOWN_FORMATS, MAX_INPUT_BYTES, OP_SUPPORT, type Op, type ParseResult, type ParseWarning, type PhiPosture, type RedactOutcome, type ResolvedInput, type ResolvedInputStream, RunDeps, RunResult, SHOW_VALUES, UNSAFE_EXCERPT_MAX, UNSAFE_SHOW_VALUES_FLAG, VALUE_FREE, VERSION, type Verdict, asCosyteFormat, classifyCandidates, collectChunks, completionCommand, convertCommand, convertOutcome, deframeMllp, deidCoverage, deidCoveredFormats, deidStatus, describeByteLimit, detectFormat, detectionError, extractPhiPosture, extractStableCode, fmtCommand, fmtFormat, formatHl7Position, formatsSupporting, helpText, inputTooLargeError, inspectCommand, inspectFormat, isDeidCovered, loadOptional, loadOptionalPackage, mapCodesCommand, mllpFrames, ndjsonRecords, oneChunk, parseCommand, parseFailureResult, parseFormat, redactCommand, resolveInput, resolveInputStream, run, supportsOp, truncatedMllpError, unsafeInputSuffix, validateCommand, validateFormat, valueFreeLocator, withinLimit };