@cosyte/dicom 0.0.11 → 0.0.12

package/dist/index.d.cts

@@ -307,6 +307,26 @@ interface ParseOptions {
      * When `true`, every Tier-2 warning is escalated to a thrown
      * `DicomParseError` carrying the warning code. Default `false`.
      *
+     * 🛑 **THE ESCALATED DIAGNOSTIC CARRIES SOURCE BYTES THAT THE WARNING DOES
+     * NOT.** A `DicomParseWarning.message` is a frozen registry string with only
+     * structural tokens filled in, so it is safe to log whole; the
+     * `DicomParseError` this option raises in its place also carries `snippet`,
+     * **16 raw bytes, unredacted** (D-10), read at the warning's own `byteOffset`.
+     * **Which element those bytes belong to is not contracted**: that offset's
+     * frame follows where the element was read - file-absolute at the root,
+     * relative to the enclosing slice inside a defined-length Sequence or Item,
+     * and into the inflated stream under Deflated Explicit VR LE - while the
+     * snippet is cut from whichever buffer the parse is holding, so the two can
+     * disagree and the bytes can be an unrelated element's value. Do not reason
+     * from a code's message to what its snippet holds - **measure it, and treat
+     * every one of them as document content.**
+     *
+     * That is the documented design of `snippet` rather than a defect in any one
+     * code, and turning this option on does not change what any of them means -
+     * but a message-only PHI review of the lenient path does not transfer to the
+     * strict one. Log `err.code`, `err.byteOffset` and `err.message`; treat
+     * `err.snippet` as PHI.
+     *
      * Omit (do not pass `undefined`) to use the default.
      */
     readonly strict?: boolean;
@@ -420,6 +440,7 @@ declare const WARNING_CODES: {
     readonly DICOM_BURNED_IN_ANNOTATION_NOT_REMOVED: "DICOM_BURNED_IN_ANNOTATION_NOT_REMOVED";
     readonly DICOM_DEIDENT_EMBEDDED_ATTRIBUTE_REMOVED: "DICOM_DEIDENT_EMBEDDED_ATTRIBUTE_REMOVED";
     readonly DICOM_DEIDENT_METHOD_NOT_ADDED: "DICOM_DEIDENT_METHOD_NOT_ADDED";
+    readonly DICOM_DEIDENT_METHOD_NOT_LO: "DICOM_DEIDENT_METHOD_NOT_LO";
     readonly DICOM_DEIDENT_METHOD_PRIOR_RETAINED: "DICOM_DEIDENT_METHOD_PRIOR_RETAINED";
     readonly DICOM_DEIDENT_SEQUENCE_NOT_AUDITABLE: "DICOM_DEIDENT_SEQUENCE_NOT_AUDITABLE";
     readonly DICOM_DEIDENT_UNDEFINED_VR_NOT_AUDITABLE: "DICOM_DEIDENT_UNDEFINED_VR_NOT_AUDITABLE";
@@ -2692,6 +2713,19 @@ interface DeidentifyOptions {
      * Text **added to** `(0012,0063)` De-identification Method. Default names the
      * Basic Profile and the active options.
      *
+     * **The default is multi-valued, one Value per name, and that is a conformance
+     * fix rather than a style choice.** PS3.5 2026c Table 6.2-1 caps an `LO` at
+     * **64 characters per Value**, and `(0012,0063)` is `1-n`; the single-value
+     * default this replaced measured 76 characters with no options and 272 with
+     * all nine, so every run this library ever made wrote a value no `LO` may
+     * legally carry. The Profile name is now one Value of 61 characters and each
+     * active option is its own, so no option subset can exceed the maximum.
+     *
+     * **Your string is not bounded here.** A value of your own longer than 64
+     * characters is written through as given, with no warning: it is yours, and
+     * splitting or truncating it would invent a record you did not write. Split it
+     * on `\` yourself if a strict receiver is in your path.
+     *
      * PS3.15 E.1.1 says this string is "inserted in or added to" the attribute, so
      * a value the incoming Data Set already carried is kept and this one is
      * appended after a `\` as a further value of the `1-n` attribute - the
@@ -2721,7 +2755,10 @@ interface DeidentifyOptions {
      *
      * `DICOM_DEIDENT_METHOD_NOT_ADDED` means "the length ceiling was reached", never
      * "every fallback is disclosed": a `(0012,0063)` a file encoded under a VR other
-     * than `LO` is also replaced, and that one is silent.
+     * than `LO` is also replaced, and that one raises `DICOM_DEIDENT_METHOD_NOT_LO`.
+     * Two codes rather than one because the causes are unrelated - the chain outgrew
+     * the VR, or the bytes were never in that VR at all - and a prior value that is
+     * empty or padding only raises neither, because nothing was lost.
      *
      * When the prior value **is** kept, `report.warnings` carries
      * `DICOM_DEIDENT_METHOD_PRIOR_RETAINED`: `(0012,0063)` is not in Table E.1-1, so

package/dist/index.d.ts

@@ -307,6 +307,26 @@ interface ParseOptions {
      * When `true`, every Tier-2 warning is escalated to a thrown
      * `DicomParseError` carrying the warning code. Default `false`.
      *
+     * 🛑 **THE ESCALATED DIAGNOSTIC CARRIES SOURCE BYTES THAT THE WARNING DOES
+     * NOT.** A `DicomParseWarning.message` is a frozen registry string with only
+     * structural tokens filled in, so it is safe to log whole; the
+     * `DicomParseError` this option raises in its place also carries `snippet`,
+     * **16 raw bytes, unredacted** (D-10), read at the warning's own `byteOffset`.
+     * **Which element those bytes belong to is not contracted**: that offset's
+     * frame follows where the element was read - file-absolute at the root,
+     * relative to the enclosing slice inside a defined-length Sequence or Item,
+     * and into the inflated stream under Deflated Explicit VR LE - while the
+     * snippet is cut from whichever buffer the parse is holding, so the two can
+     * disagree and the bytes can be an unrelated element's value. Do not reason
+     * from a code's message to what its snippet holds - **measure it, and treat
+     * every one of them as document content.**
+     *
+     * That is the documented design of `snippet` rather than a defect in any one
+     * code, and turning this option on does not change what any of them means -
+     * but a message-only PHI review of the lenient path does not transfer to the
+     * strict one. Log `err.code`, `err.byteOffset` and `err.message`; treat
+     * `err.snippet` as PHI.
+     *
      * Omit (do not pass `undefined`) to use the default.
      */
     readonly strict?: boolean;
@@ -420,6 +440,7 @@ declare const WARNING_CODES: {
     readonly DICOM_BURNED_IN_ANNOTATION_NOT_REMOVED: "DICOM_BURNED_IN_ANNOTATION_NOT_REMOVED";
     readonly DICOM_DEIDENT_EMBEDDED_ATTRIBUTE_REMOVED: "DICOM_DEIDENT_EMBEDDED_ATTRIBUTE_REMOVED";
     readonly DICOM_DEIDENT_METHOD_NOT_ADDED: "DICOM_DEIDENT_METHOD_NOT_ADDED";
+    readonly DICOM_DEIDENT_METHOD_NOT_LO: "DICOM_DEIDENT_METHOD_NOT_LO";
     readonly DICOM_DEIDENT_METHOD_PRIOR_RETAINED: "DICOM_DEIDENT_METHOD_PRIOR_RETAINED";
     readonly DICOM_DEIDENT_SEQUENCE_NOT_AUDITABLE: "DICOM_DEIDENT_SEQUENCE_NOT_AUDITABLE";
     readonly DICOM_DEIDENT_UNDEFINED_VR_NOT_AUDITABLE: "DICOM_DEIDENT_UNDEFINED_VR_NOT_AUDITABLE";
@@ -2692,6 +2713,19 @@ interface DeidentifyOptions {
      * Text **added to** `(0012,0063)` De-identification Method. Default names the
      * Basic Profile and the active options.
      *
+     * **The default is multi-valued, one Value per name, and that is a conformance
+     * fix rather than a style choice.** PS3.5 2026c Table 6.2-1 caps an `LO` at
+     * **64 characters per Value**, and `(0012,0063)` is `1-n`; the single-value
+     * default this replaced measured 76 characters with no options and 272 with
+     * all nine, so every run this library ever made wrote a value no `LO` may
+     * legally carry. The Profile name is now one Value of 61 characters and each
+     * active option is its own, so no option subset can exceed the maximum.
+     *
+     * **Your string is not bounded here.** A value of your own longer than 64
+     * characters is written through as given, with no warning: it is yours, and
+     * splitting or truncating it would invent a record you did not write. Split it
+     * on `\` yourself if a strict receiver is in your path.
+     *
      * PS3.15 E.1.1 says this string is "inserted in or added to" the attribute, so
      * a value the incoming Data Set already carried is kept and this one is
      * appended after a `\` as a further value of the `1-n` attribute - the
@@ -2721,7 +2755,10 @@ interface DeidentifyOptions {
      *
      * `DICOM_DEIDENT_METHOD_NOT_ADDED` means "the length ceiling was reached", never
      * "every fallback is disclosed": a `(0012,0063)` a file encoded under a VR other
-     * than `LO` is also replaced, and that one is silent.
+     * than `LO` is also replaced, and that one raises `DICOM_DEIDENT_METHOD_NOT_LO`.
+     * Two codes rather than one because the causes are unrelated - the chain outgrew
+     * the VR, or the bytes were never in that VR at all - and a prior value that is
+     * empty or padding only raises neither, because nothing was lost.
      *
      * When the prior value **is** kept, `report.warnings` carries
      * `DICOM_DEIDENT_METHOD_PRIOR_RETAINED`: `(0012,0063)` is not in Table E.1-1, so

package/dist/index.mjs

@@ -9,7 +9,7 @@ var __export = (target, all) => {
 };
 
 // src/version.ts
-var VERSION = "0.0.11";
+var VERSION = "0.0.12";
 
 // src/dictionary/index.ts
 var dictionary_exports = {};
@@ -11746,6 +11746,8 @@ var WARNING_CODES = {
   // emitted by deidentify(), never by the parser
   DICOM_DEIDENT_METHOD_NOT_ADDED: "DICOM_DEIDENT_METHOD_NOT_ADDED",
   // emitted by deidentify(), never by the parser
+  DICOM_DEIDENT_METHOD_NOT_LO: "DICOM_DEIDENT_METHOD_NOT_LO",
+  // emitted by deidentify(), never by the parser
   DICOM_DEIDENT_METHOD_PRIOR_RETAINED: "DICOM_DEIDENT_METHOD_PRIOR_RETAINED",
   // emitted by deidentify(), never by the parser
   DICOM_DEIDENT_SEQUENCE_NOT_AUDITABLE: "DICOM_DEIDENT_SEQUENCE_NOT_AUDITABLE",
@@ -11795,6 +11797,11 @@ var WARNING_MESSAGES = Object.freeze({
   // constant of this code rather than composed from input, as in the two
   // (0002,0000) messages above.
   DICOM_DEIDENT_METHOD_NOT_ADDED: "The De-identification Method this run recorded could not be added beside the value (0012,0063) already carried without exceeding the largest Value Length that VR can encode, so the earlier value was replaced (PS3.15 E.1.1). The replaced text is not in the output.",
+  // No value, no length AND NO VR. The VR is two bytes read from the file, and a
+  // fabricated header makes those two bytes document content - the shape that
+  // put "ITHS" into DICOM_NONZERO_RESERVED_BYTES. Naming the VR here would read
+  // as harmless and is exactly the same defect.
+  DICOM_DEIDENT_METHOD_NOT_LO: "The (0012,0063) value the source file carried is encoded under a Value Representation other than LO, which is not a De-identification Method this run can add its own text to (PS3.15 E.1.1), so the earlier value was replaced. The replaced text is not in the output. The text and the VR are both withheld from this message.",
   // No value and no length, for the same reason as the code above: the retained
   // text is the file's own. The tag is a constant of this code.
   DICOM_DEIDENT_METHOD_PRIOR_RETAINED: "A De-identification Method (0012,0063) value the source file already carried was kept beside the one this run recorded, as PS3.15 E.1.1 requires. That attribute is not in Table E.1-1, so no rule in this run inspected, audited or redacted those bytes: if the sender wrote identifying text there it is in the de-identified output, under (0012,0062) = YES. The text is withheld from this message.",
@@ -11913,6 +11920,9 @@ function burnedInAnnotationNotRemoved(position) {
 function deidentMethodNotAdded(position) {
   return build(WARNING_CODES.DICOM_DEIDENT_METHOD_NOT_ADDED, position);
 }
+function deidentMethodNotLo(position) {
+  return build(WARNING_CODES.DICOM_DEIDENT_METHOD_NOT_LO, position);
+}
 function deidentMethodPriorRetained(position) {
   return build(WARNING_CODES.DICOM_DEIDENT_METHOD_PRIOR_RETAINED, position);
 }
@@ -15349,19 +15359,23 @@ function rebuildFileMeta(fileMeta, ctx) {
     mediaStorageSOPInstanceUID: ctx.remap.map(fileMeta.mediaStorageSOPInstanceUID)
   };
 }
+var DEFAULT_METHOD_PROFILE = "@cosyte/dicom Basic Application Level Confidentiality Profile";
 function defaultMethod(active) {
-  const base = "Cosyte @cosyte/dicom: PS3.15 Basic Application Level Confidentiality Profile";
-  return active.size === 0 ? base : `${base} + ${[...active].join(", ")}`;
+  const options = DEIDENTIFY_OPTIONS.filter((option) => active.has(option));
+  return [DEFAULT_METHOD_PROFILE, ...options].join(String.fromCharCode(VALUE_DELIMITER));
 }
 var VALUE_DELIMITER = 92;
 var MAX_SHORT_FORM_VALUE_BYTES = 65534;
 function addDeidentificationMethod(existing, method) {
   const added = trimTrailingPad(Buffer.from(method, "latin1"));
-  if (existing === void 0 || existing.vr !== "LO") {
-    return { value: added, replacedPrior: false, retainedPrior: false };
+  const none = { replacedPrior: false, retainedPrior: false, replacedNonLoPrior: false };
+  if (existing === void 0) return { value: added, ...none };
+  if (existing.vr !== "LO") {
+    const lost = trimTrailingPad(existing.rawBytes).length > 0;
+    return { value: added, ...none, replacedNonLoPrior: lost };
   }
   const kept = Buffer.from(trimTrailingPad(existing.rawBytes));
-  if (kept.length === 0) return { value: added, replacedPrior: false, retainedPrior: false };
+  if (kept.length === 0) return { value: added, ...none };
   const keptValues = splitValues(kept).map(trimTrailingPad);
   const missing = added.length === 0 ? [] : splitValues(added).filter((v) => !keptValues.some((k) => k.equals(trimTrailingPad(v))));
   const parts = [kept];
@@ -15370,9 +15384,9 @@ function addDeidentificationMethod(existing, method) {
   }
   const value = trimTrailingPad(Buffer.concat(parts));
   if (value.length > MAX_SHORT_FORM_VALUE_BYTES) {
-    return { value: added, replacedPrior: true, retainedPrior: false };
+    return { value: added, ...none, replacedPrior: true };
   }
-  return { value, replacedPrior: false, retainedPrior: true };
+  return { value, ...none, retainedPrior: true };
 }
 function trimTrailingPad(value) {
   let end = value.length;
@@ -15444,6 +15458,11 @@ function deidentify(ds, options = {}) {
       deidentMethodPriorRetained({ byteOffset: priorMethod?.byteOffset ?? 0, fileMeta: false })
     );
   }
+  if (deidentMethod.replacedNonLoPrior) {
+    warnings.push(
+      deidentMethodNotLo({ byteOffset: priorMethod?.byteOffset ?? 0, fileMeta: false })
+    );
+  }
   if (hasUncleanedBurnedIn(ds)) {
     const offset = ds.get(TAG_PIXEL_DATA)?.byteOffset ?? 0;
     warnings.push(burnedInAnnotationNotRemoved({ byteOffset: offset, fileMeta: false }));