@cosyte/hl7 0.0.4 → 0.0.6

package/CHANGELOG.md

@@ -32,6 +32,28 @@ per the cosyte version ladder (`0.0.x` until first alpha).
   because it is what a screen reader on the npm page reads out, so "banner", "logo", or the file
   name would all be a wasted line.
 
+  **SUPERSEDED on 2026-07-31 by `1aee04b`, which replaced this banner with the shared Cosyte lockup
+  in a `<picture>` block.** The two paragraphs above are left exactly as they shipped rather than
+  corrected, because they were true of the tree and right on the evidence available when they were
+  written, and they record a real state the package passed through. This note says what changed
+  under them. It shipped verbatim inside the `@cosyte/hl7@0.0.4` tarball, so it is text a consumer
+  already has on disk.
+
+  **The claim the new evidence overturns is the second one: "whether npm's markdown sanitizer
+  preserves a `<picture>` element is unverified".** That is measured now. The first claim, that the
+  banner is a markdown image and "not `<img>` and not `<picture>`", was a consequence of the second
+  rather than an independent choice, so it went when its premise did; it is no longer true of the
+  tree either way, since `README.md` now opens with a `<picture>`. What was measured: **GitHub
+  honours the `prefers-color-scheme` switch**, verified on `@cosyte/astm` in dark mode, where the
+  rendered image's `currentSrc` resolves to the on-dark tile and its parent element is `PICTURE`.
+  **On the npm package page the `<img>` is hoisted out of its `<picture>` by the anchor wrapper**,
+  so the inner fallback renders rather than the element being stripped or broken; and **npmjs.com
+  has no dark mode** (founder-confirmed), so the light cut is the correct image there regardless.
+  The GitHub and npm measurements above were taken on `astm` and reported into this repo rather
+  than re-taken here; what was re-checked directly for `hl7` was that both tile URLs return
+  `200 image/png`. **PNG only** and **alt text is content, not decoration** are both unchanged and
+  still hold; only the element choice and its stated premise moved.
+
 - **The published JSDoc is swept, and `src/` doc comments are gated
   (`pnpm check:no-internal-refs` third pass; `PUBLIC-SURFACE-HYGIENE`).** Doc comments compile
   into `dist/index.d.ts` and `dist/index.d.cts`, `dist` is the first entry in `files`, and every
@@ -414,6 +436,129 @@ kind, value)`** sets one at a field or `field[rep]` dot-path. Component values a
 
 ### Changed
 
+- **The PHI gate's own enumeration no longer lets a vanished build transient refuse an entire sweep
+  (`PHI-SCAN-ENUMERATE-THEN-READ-CLASS`).** `scripts/phi-scan.ts` all-mode lists its roots and reads
+  each file afterwards; a file deleted inside that window threw `ENOENT` and the scanner refused with
+  exit 2. `@cosyte/ccda` is where that landed for real (`ccda#80`, `747ac20`): its walk starts at the
+  **repo root**, `tsup` writes and then removes `tsup.config.bundled_<hash>.mjs` there, and a
+  publish-time sweep refused, failing `prepublishOnly` and blocking a real publish.
+
+  **No CI or publish run in this repo was reachable through that window, so this is hardening, not
+  the repair of a live defect here.** Say so plainly, because the temptation is to claim the bigger
+  thing. The walk is rooted at `test/fixtures` and `src`, so the repo-root transient is never
+  enumerated. **Verified in both directions rather than assumed, and re-derived three times in three
+  separate runs:** a real `tsup` build was polled while it ran and the only transient observed each
+  time was a `tsup.config.bundled_<hash>.mjs` **at the repo root**, outside both walk roots, with
+  zero files appearing under either root; and the pre-fix scanner, driven against a throwaway repo
+  with an untracked decoy placed **inside** `src/`, refused the whole sweep with exit 2 on the first
+  read. The hash differs on every build, which is why no specific filename is quoted here. The
+  immunity is scope, not design. Nothing gitignores that name (`git check-ignore` exits 1 on it),
+  and `test/docs-content.test.ts` really does run a build from inside the suite while this scanner
+  sweeps in all mode from another worker, so the two halves already race. **Widening a walk root,
+  for any reason, reintroduces it verbatim.**
+
+  **A narrower case was already live on a developer box rather than in CI, and the review gate found
+  it. It is a class, not one filename.** `.gitignore` covers `*.swp` and `*.swo` and **nothing else
+  of the kind**, so editor and atomic-save transients create and remove un-ignored files **inside a
+  walk root**. Verified un-ignored: `src/index.ts~`, `src/.index.ts.swn`, `src/#index.ts#`,
+  `src/index.ts___jb_tmp___`, `src/.goutputstream-abc123`, `src/4913`, and `.tmp` / `.orig` / `.bak`
+  beside a source file. Before this change each is a spurious exit 2 on a developer's machine; none
+  reaches CI or a publish, which is why the claim above is scoped to those.
+
+  **The refusal was correct; the enumeration was unsound.** Refusing a scan it could not complete is
+  what makes this gate worth having and it is untouched. Exactly one case is now tolerated: a file
+  the walk enumerated **itself**, that git does **not track**, failing with **`ENOENT`**. It is
+  written to stderr as skipped, never dropped silently, and the clean line on **stdout** is
+  qualified to match (`OK: no hits (N untracked file(s) skipped, see stderr)`), so a reader watching
+  stdout alone cannot take an unqualified OK from a sweep that did not observe everything it
+  enumerated. A clean sweep still prints the bare line, and a test pins it exactly.
+
+  **Five of the six bounds are pinned by a test, and which five is measured, not asserted.** Each
+  was confirmed by a mutant that only its own test kills:
+  - a **tracked** file that cannot be read (mutant: tolerate tracked files too);
+  - any **non-`ENOENT`** failure, since `EACCES` / `EISDIR` is a scan that failed, not a file that
+    went away (mutant: tolerate any errno);
+  - a `git` that cannot report the tracked set, which switches the tolerance off rather than
+    guessing (mutant: return an empty set instead of `null`);
+  - a tracked set that comes back **empty**, the one state in which the tracked-file bound stops
+    existing (same mutant). A **removed** `.git/index` makes `git ls-files` exit 0 with no output,
+    which is what the `size > 0` guard catches; a **corrupt** one exits non-zero and was already
+    caught by the `catch`;
+  - an all-mode sweep that **observed no files at all** (mutant: drop the guard), so the tolerance
+    can never decay into a clean report of a tree nothing was read from.
+
+  **The sixth is UNPINNED and named as the gap it is:** a tolerated file that is **back on disk**
+  when the sweep ends still refuses, but no test drives it. The scanner calls `git` only before the
+  first read, so there is no deterministic post-read hook, and `walk()` enumerates regular files
+  only, so a FIFO cannot be used as a blocking one either (both measured). Reaching it needs a timed
+  re-create against a deliberately slowed sweep, and a load-sensitive sleep in a suite guarding a
+  load-dependent race is the failure that race teaches. Losing that branch would cost the re-check,
+  never the tolerance's bounds. **Unpinned is not unverified:** the review gate drove the branch by
+  hand against a deliberately slowed sweep and it refused correctly with exit 2, and deleting the
+  re-check outright still leaves all 29 tests green, which is what makes "unpinned" the accurate
+  word rather than an understatement.
+
+  **The test technique is the reusable part: no sleep and no real build.** The scanner runs
+  `git check-ignore` and `git ls-files` between the walk and the first read, so a `git` shim placed
+  first on `PATH` is a deterministic hook into exactly that gap. Every case runs against a throwaway
+  git repo, so no decoy is ever written into this one. As a negative control the same tolerance case
+  was replayed against all twelve sibling scanners, and every sibling that has not yet taken this
+  change refuses it with exit 2, so the new assertion is not one a sibling's code satisfies by
+  accident. **No count is quoted, deliberately:** the same command returned a different tally on
+  three consecutive runs while sibling repos landed the same change underneath it, so any number
+  written here would be wrong by the time it is read.
+
+  **Residual, stated rather than closed:** the post-sweep re-check is keyed on the enumerated path,
+  not on content, so the class is **content that survives at a path the walk did not enumerate**. An
+  untracked file **renamed** inside the window is the obvious instance and goes unscanned under a
+  clean report; a hard link followed by an unlink is the other. Both legs of the boundedness
+  argument were driven by the review gate rather than argued: after `git add` the all-mode sweep
+  catches the renamed file, and `--staged` reports the hit from the index **even with the file
+  deleted from disk**. Closing it needs a content-addressed sweep, which is a different design
+  rather than a wider bound. The `--staged` pre-commit path reads blobs from the git index
+  (`git show :path`) and never depended on any of this.
+
+  **Two PRE-EXISTING scope limits of the walk are now written down** so they are not confused with
+  the window above. Both were measured, and an earlier draft of this entry claimed `--staged` covers
+  the commit path in both cases; **the review gate refuted that and it is false, so read `--staged`
+  as a compensating control for neither.**
+  - **Regular files only**, the sharper of the two. A symlink under a walk root pointing at a
+    PHI-bearing file is not enumerated, so all-mode never reads it, **and** git stores a symlink as
+    its target string (mode `120000`), so `git show :path` hands `--staged` the path text rather
+    than the pointed-to bytes. **Both routes report clean, driven and reproduced independently.**
+    What lands in the commit is the link, not the capture, but an identifying _filename_ still
+    reaches the tree and gets only the shape pass, which has no name detection. A FIFO is skipped
+    rather than blocking the sweep.
+  - **Working tree only.** A tracked file absent from the worktree is never enumerated in all-mode.
+    `--staged` catches such a file when it is **added** (measured, exit 1), so that coverage is at
+    add time and past tense: once it is committed and removed from the worktree, both routes report
+    clean.
+
+  Neither limit is changed here, and widening the walk to close either is a separate slice.
+
+- **`README.md` now opens with the shared Cosyte lockup in a `<picture>` block, replacing the
+  per-package banner (`1aee04b`).** The dark-ground org tile sits behind a
+  `prefers-color-scheme: dark` media query with the light-ground tile as the inner `<img>`, so on a
+  renderer that honours the switch the mark sits on a ground matching the page it is read on. One
+  markdown image line out, four lines in: the `# @cosyte/hl7` H1, the blockquote tagline, the badge
+  row and everything below are untouched.
+
+  **Why the per-package banner goes.** It baked the package name and the one-line tagline into
+  pixels, and the two lines directly beneath it repeated both. The shared lockup reads "Cosyte"
+  while the H1 reads `@cosyte/hl7`, so the strings differ, the duplication goes away, and the
+  heading stays.
+
+  **The failure mode is safe**: a renderer that strips `<source>` renders the inner `<img>`, so the
+  worst case is a light-ground mark on a dark page, never a missing or broken image. The block was
+  copied out of `astm/README.md` rather than retyped and the two URLs then diffed byte for byte
+  against that file, because a transcription error in one of them is a broken image on a public
+  package page. Both were re-verified `200 image/png` (10513 and 10455 bytes) immediately before
+  the push: the `live` flag in the `assets` manifest is a declaration made on evidence from another
+  repo, not a fact checked here. The alt text describes the mark rather than the package, since it
+  is what a screen reader on the npm page reads out and what a reader gets when the image fails.
+  This supersedes the `ASSETS-P8` banner entry under **Added** above, which is annotated in place
+  rather than rewritten. Documentation only: no runtime, API or packaging change.
+
 - **Corrected stale "not yet published to npm / unpublished" language in the docs site
   (README-ORG-SWEEP).** `@cosyte/hl7` is now published on npm at `0.0.1` and public, so the
   `docs-content/installation.md` Status blockquote ("not yet published… the shape it will take at

package/README.md

@@ -1,4 +1,7 @@
-![@cosyte/hl7: parse real-world, vendor-quirky HL7 v2 messages and extract the fields you need in one line](https://cosyte.com/social/cosyte-banner-hl7-1200x300.png)
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://cosyte.com/tile/cosyte-lockup-tile-on-dark-1200x300.png">
+  <img alt="Cosyte: a plus mark set in two overlapping rounded squares, one solid and one outlined, beside the Cosyte wordmark" src="https://cosyte.com/tile/cosyte-lockup-tile-on-light-1200x300.png">
+</picture>
 
 # @cosyte/hl7
 

package/dist/index.cjs

@@ -6874,7 +6874,7 @@ async function* parseStream(source, optionsOrProfile) {
 }
 
 // src/index.ts
-var VERSION = "0.0.4";
+var VERSION = "0.0.6";
 
 exports.ACK_CODES = ACK_CODES;
 exports.ACK_CONDITIONS = ACK_CONDITIONS;