@cosyte/hl7 0.0.5 → 0.0.7

package/CHANGELOG.md

@@ -436,6 +436,116 @@ kind, value)`** sets one at a field or `field[rep]` dot-path. Component values a
 
 ### Changed
 
+- **The PHI gate's own enumeration no longer lets a vanished build transient refuse an entire sweep
+  (`PHI-SCAN-ENUMERATE-THEN-READ-CLASS`).** `scripts/phi-scan.ts` all-mode lists its roots and reads
+  each file afterwards; a file deleted inside that window threw `ENOENT` and the scanner refused with
+  exit 2. `@cosyte/ccda` is where that landed for real (`ccda#80`, `747ac20`): its walk starts at the
+  **repo root**, `tsup` writes and then removes `tsup.config.bundled_<hash>.mjs` there, and a
+  publish-time sweep refused, failing `prepublishOnly` and blocking a real publish.
+
+  **No CI or publish run in this repo was reachable through that window, so this is hardening, not
+  the repair of a live defect here.** Say so plainly, because the temptation is to claim the bigger
+  thing. The walk is rooted at `test/fixtures` and `src`, so the repo-root transient is never
+  enumerated. **Verified in both directions rather than assumed, and re-derived three times in three
+  separate runs:** a real `tsup` build was polled while it ran and the only transient observed each
+  time was a `tsup.config.bundled_<hash>.mjs` **at the repo root**, outside both walk roots, with
+  zero files appearing under either root; and the pre-fix scanner, driven against a throwaway repo
+  with an untracked decoy placed **inside** `src/`, refused the whole sweep with exit 2 on the first
+  read. The hash differs on every build, which is why no specific filename is quoted here. The
+  immunity is scope, not design. Nothing gitignores that name (`git check-ignore` exits 1 on it),
+  and `test/docs-content.test.ts` really does run a build from inside the suite while this scanner
+  sweeps in all mode from another worker, so the two halves already race. **Widening a walk root,
+  for any reason, reintroduces it verbatim.**
+
+  **A narrower case was already live on a developer box rather than in CI, and the review gate found
+  it. It is a class, not one filename.** `.gitignore` covers `*.swp` and `*.swo` and **nothing else
+  of the kind**, so editor and atomic-save transients create and remove un-ignored files **inside a
+  walk root**. Verified un-ignored: `src/index.ts~`, `src/.index.ts.swn`, `src/#index.ts#`,
+  `src/index.ts___jb_tmp___`, `src/.goutputstream-abc123`, `src/4913`, and `.tmp` / `.orig` / `.bak`
+  beside a source file. Before this change each is a spurious exit 2 on a developer's machine; none
+  reaches CI or a publish, which is why the claim above is scoped to those.
+
+  **The refusal was correct; the enumeration was unsound.** Refusing a scan it could not complete is
+  what makes this gate worth having and it is untouched. Exactly one case is now tolerated: a file
+  the walk enumerated **itself**, that git does **not track**, failing with **`ENOENT`**. It is
+  written to stderr as skipped, never dropped silently, and the clean line on **stdout** is
+  qualified to match (`OK: no hits (N untracked file(s) skipped, see stderr)`), so a reader watching
+  stdout alone cannot take an unqualified OK from a sweep that did not observe everything it
+  enumerated. A clean sweep still prints the bare line, and a test pins it exactly.
+
+  **Five of the six bounds are pinned by a test, and which five is measured, not asserted.** Each
+  was confirmed by a mutant that only its own test kills:
+  - a **tracked** file that cannot be read (mutant: tolerate tracked files too);
+  - any **non-`ENOENT`** failure, since `EACCES` / `EISDIR` is a scan that failed, not a file that
+    went away (mutant: tolerate any errno);
+  - a `git` that cannot report the tracked set, which switches the tolerance off rather than
+    guessing (mutant: return an empty set instead of `null`);
+  - a tracked set that comes back **empty**, the one state in which the tracked-file bound stops
+    existing (same mutant). A **removed** `.git/index` makes `git ls-files` exit 0 with no output,
+    which is what the `size > 0` guard catches; a **corrupt** one exits non-zero and was already
+    caught by the `catch`;
+  - an all-mode sweep that **observed no files at all** (mutant: drop the guard), so the tolerance
+    can never decay into a clean report of a tree nothing was read from.
+
+  **The sixth is UNPINNED and named as the gap it is:** a tolerated file that is **back on disk**
+  when the sweep ends still refuses, but no test drives it. The scanner calls `git` only before the
+  first read, so there is no deterministic post-read hook, and `walk()` enumerates regular files
+  only, so a FIFO cannot be used as a blocking one either (both measured). Reaching it needs a timed
+  re-create against a deliberately slowed sweep, and a load-sensitive sleep in a suite guarding a
+  load-dependent race is the failure that race teaches. Losing that branch would cost the re-check,
+  never the tolerance's bounds. **Unpinned is not unverified:** the review gate drove the branch by
+  hand against a deliberately slowed sweep and it refused correctly with exit 2, and deleting the
+  re-check outright still leaves all 29 tests green, which is what makes "unpinned" the accurate
+  word rather than an understatement.
+
+  **The test technique is the reusable part: no sleep and no real build.** The scanner runs
+  `git check-ignore` and `git ls-files` between the walk and the first read, so a `git` shim placed
+  first on `PATH` is a deterministic hook into exactly that gap. Every case runs against a throwaway
+  git repo, so no decoy is ever written into this one. As a negative control the same tolerance case
+  was replayed against all twelve sibling scanners, and every sibling that has not yet taken this
+  change refuses it with exit 2, so the new assertion is not one a sibling's code satisfies by
+  accident. **No count is quoted, deliberately:** the same command returned a different tally on
+  three consecutive runs while sibling repos landed the same change underneath it, so any number
+  written here would be wrong by the time it is read.
+
+  **Residual, stated rather than closed:** the post-sweep re-check is keyed on the enumerated path,
+  not on content, so the class is **content that survives at a path the walk did not enumerate**. An
+  untracked file **renamed** inside the window is the obvious instance and goes unscanned under a
+  clean report; a hard link followed by an unlink is the other. Both legs of the boundedness
+  argument were driven by the review gate rather than argued: after `git add` the all-mode sweep
+  catches the renamed file, and `--staged` reports the hit from the index **even with the file
+  deleted from disk**. Closing it needs a content-addressed sweep, which is a different design
+  rather than a wider bound. The `--staged` pre-commit path reads blobs from the git index
+  (`git show :path`) and never depended on any of this.
+
+  **Two PRE-EXISTING scope limits of the walk are now written down** so they are not confused with
+  the window above. Both were measured, and an earlier draft of this entry claimed `--staged` covers
+  the commit path in both cases; **the review gate refuted that and it is false, so read `--staged`
+  as a compensating control for neither.**
+  - **Regular files only**, the sharper of the two. A symlink under a walk root pointing at a
+    PHI-bearing file is not enumerated, so all-mode never reads it, **and** git stores a symlink as
+    its target string (mode `120000`), so `git show :path` hands `--staged` the path text rather
+    than the pointed-to bytes. **Both routes report clean, driven and reproduced independently.**
+    What lands in the commit is the link, not the capture, but an identifying _filename_ still
+    reaches the tree and gets only the shape pass, which has no name detection. A FIFO is skipped
+    rather than blocking the sweep.
+  - **Working tree only.** A tracked file absent from the worktree is never enumerated in all-mode.
+    `--staged` catches such a file when it is **added** (measured, exit 1), so that coverage is at
+    add time and past tense: once it is committed and removed from the worktree, both routes report
+    clean.
+
+  Neither limit is changed here, and widening the walk to close either is a separate slice.
+
+  **CLOSED for the first bullet by the "not a regular file" entry below; the second bullet still
+  stands.** The paragraphs above are left exactly as they shipped rather than rewritten, because
+  they described a real state the package passed through and they shipped inside a published
+  tarball, so they are text a consumer already has on disk. What is no longer true of the current
+  code is the whole of the first bullet, in three places rather than one: a symbolic link under a
+  walk root, or staged into `test/fixtures/**` or `src/**.ts`, now **refuses the scan** on both
+  routes instead of reading clean on both; **a FIFO refuses too** rather than being skipped; and the
+  shape pass no longer runs on a link's target _path_, because the entry is refused before anything
+  is read. The second bullet, working-tree-only, still stands exactly as written.
+
 - **`README.md` now opens with the shared Cosyte lockup in a `<picture>` block, replacing the
   per-package banner (`1aee04b`).** The dark-ground org tile sits behind a
   `prefers-color-scheme: dark` media query with the light-ground tile as the inner `<img>`, so on a
@@ -495,6 +605,144 @@ kind, value)`** sets one at a field or `field[rep]` dot-path. Component values a
 
 ### Fixed
 
+- **The PHI scan read a symbolic link as clean on BOTH of its enumerating routes
+  (`PHI-SCAN-SYMLINK-BLIND-ON-BOTH-ROUTES`).** A link under a scan root pointing at a PHI-bearing
+  file passed the gate twice over. **Reproduced on `5debd18` before the fix**, in a throwaway repo,
+  with a synthetic name-bearing HL7 message placed outside the walk roots and a link to it at
+  `test/fixtures/leak.hl7`: all-mode printed `OK: no hits` and exited **0**, `--staged` after
+  `git add` did the same, and naming the target file explicitly exited **1** with seven hits
+  (`PID-5` twice, `PID-7`, `PID-11`, `PID-3`, and the shape pass's `(ssn)` and `(email)`). The
+  payload was always detectable; the two routes never looked at it.
+
+  **Two mechanisms, two fixes, and neither route is made to follow the link.** `walk()` enumerates
+  `Dirent.isFile()`, which is an lstat answer, so a link is neither a file nor a directory and fell
+  out of the loop silently; `isDirectory()` answers false for a **linked directory** too, so a whole
+  subtree left the same way. `--staged` reads content with `git show :<path>`, and git stores a link
+  as its **target path** under mode `120000`, so that route was handed the path text and never the
+  target's bytes. That route is this package's pre-commit hook. Following a link would read bytes
+  the enumeration does not control (outside the repo, a loop, a device, a FIFO that blocks the gate
+  forever), and git does not carry those bytes anyway, so a hit on them would be a claim about
+  something no commit contains. **The enumeration is narrowed instead:** an in-scope entry that is
+  not a regular file **refuses the scan** (exit 2), naming every offender rather than the first.
+  `--staged` reads `git diff --cached --raw -z` so the destination mode is visible, and refuses
+  `120000` and `160000`; an unparseable `--raw` record refuses too, rather than scanning a list that
+  may be short.
+
+  **`--diff-filter=AMT`, and the `T` is load-bearing.** Replacing a **tracked** regular file with a
+  link is neither an add nor a modify: git raises it as a typechange
+  (`:100644 120000 <sha> <sha> T`), so `--diff-filter=AM` deleted the record before any mode could
+  be read and the mode check was unreachable for exactly the files the repo already had. Measured
+  here: with `AM` the raw output for that stage is empty. Admitting `T` also scans the **reverse**
+  typechange, a link replaced by a real file carrying PHI, as the file it became.
+
+  **A refusal names the entry's own repo-relative path and an engine-owned kind token, never the
+  link target**, which is working-tree text that can itself carry PHI. The scanner's docblock states
+  the risky target shape in the abstract rather than showing one, because a diagnostic about a PHI
+  leak is itself a PHI surface and that applies to the prose explaining it.
+
+  **Two behaviour changes that fall out of the same narrowing, both measured, both intended.** A
+  FIFO under a walk root used to be skipped (base exit 0) and now refuses (exit 2, named as
+  `a FIFO`). And an SSN or email shape sitting in a link's target _path_ used to fire on the shape
+  pass under `test/fixtures/` and now never runs, because the entry is refused before anything is
+  read. A refusal that names the entry is a better answer than a hit that only describes a filename,
+  so both are the intended trade rather than a loss.
+
+  **What this does NOT close, stated so it is not read as wider than it is.** `R` (rename) and `C`
+  (copy) are still not enumerated by `--staged` at all, so a staged rename that appends PHI passes
+  that route; admitting them needs the two-path `--raw` record shape handled, which is a scope
+  decision rather than this one. If such a record ever reached the parser the field stride would
+  desync and it refuses, which is the safe outcome. `--staged`'s path scope is unchanged
+  (`test/fixtures/**` and `src/**.ts`), and the walk's gitignore exemption is unchanged: an ignored
+  link is out of scope by the same rule that already excludes an ignored file, though an entry in
+  the index cannot be excused that way. That prefix is literal, so a link staged at exactly
+  `test/fixtures` (the root itself, not an entry under it) is outside the `--staged` filter and is
+  unchanged here; it is not both-routes-blind, because `readdirSync` resolves a symlinked walk root
+  and all-mode reads straight through it (measured, exit 1 on the PHI). A tracked file absent from
+  the worktree is still caught at `git add` time only. The enumerate-then-read tolerance and the
+  refuse-a-sweep-that-observed-nothing rule are untouched.
+
+  Pinned by 19 cases in `test/scripts/phi-scan.test.ts`, **8 of them red on `5debd18`**, all against
+  throwaway git repositories so no link and no violator is ever written into the committed corpus.
+  The payload is name-bearing and the link target's own filename carries a name, so the
+  "never echo the target" assertions are not vacuous.
+
+- **The `attw` publish gate reported a pass on a tarball that carried no types (`ATTW-FALSE-GREEN-PORT`).**
+  `package.json` ran `attw --pack .`, and that command prints "This package does not contain types."
+  and **exits 0**. Every caller that reads the status, including `prepublishOnly` and the shared CI
+  pipeline, read the 0. A false red costs an hour; a false green merges.
+
+  **The defect is `attw`'s exit code, not the invocation and not concurrency.** In this repo's own
+  `@arethetypeswrong/cli@0.18.4`, `dist/getExitCode.js` opens with `if (!analysis.types) return 0`,
+  so the problem list is never consulted. No `--profile`, `--ignore-rules` or config setting reaches
+  that early return. For a package that ships types, "does not contain types" does not mean "fine,
+  untyped"; it means the declarations were not in the tarball, which is a broken publish.
+
+  **Reproduced here with no concurrency at all** (2026-08-03, Node 22): `rm -f dist/index.d.ts
+dist/index.d.cts && pnpm attw` and `rm -rf dist && pnpm attw` both printed the sentence and exited 0. A race only supplies the condition. `tsup` emits the JS bundles in one pass and the declaration
+  files in a later one, so there is a window in every build of this package where `dist/` holds
+  `.mjs`/`.cjs` and no `.d.ts`: timed on two clean builds here, `dist/index.mjs` appeared at 3.57s
+  and 3.58s and `dist/index.d.ts` at 5.81s and 5.65s, a window of 2.24s and 2.07s. A concurrent
+  build or `pnpm clean` in the same working tree lands `attw` in it. **That is deliberately not
+  answered with a lock, a lease or a build queue**: the gate has to be able to say its own inputs
+  were missing, whatever removed them.
+
+  **The fix is `scripts/attw.mjs`, and it carries two nets that catch different things.** A
+  **preflight** checks that every relative artifact path `package.json` promises (`main`, `module`,
+  `types`, `typings`, and every string leaf of `exports`) exists and is non-empty before `attw` runs;
+  it is structural, does no string matching, and names the missing file. A path written **without** a
+  leading `./` counts: `"types": "dist/index.d.ts"` is legal for those four fields and is normalized
+  rather than skipped, since skipping it would leave the preflight quietly narrower than every
+  sentence describing it. Wildcard `exports` patterns (they name a set, not a file), absolute paths
+  and `package.json` itself are skipped. A manifest that declares **nothing** is refused rather than
+  passed, because a preflight with no inputs is not a preflight that succeeded. A **post-check** fails
+  when
+  `attw` still reports an untyped package, which is the case the preflight structurally cannot see:
+  declarations present on disk but excluded from the tarball by `files` or `.npmignore`. **No
+  instance of that second case is on record in this repo.** The post-check reads a printed sentence,
+  so the routes that would hide it are refused rather than tolerated: `--quiet`, `-q`,
+  `--format json`, `-f json`, `--format=json`, `-fjson`, `-qP`, `-Pf json`, a `.attw.json` setting
+  `quiet` or `format`, and `--config-path`. Each of the first nine was measured against this
+  package's own untyped tree to return exit 0 with the sentence absent; `--config-path` is refused by
+  inference, not measurement. The refusal is by option name, wholesale, not by value. Other arguments
+  are still forwarded, so `--profile node16`, `--no-summary`, `--no-emoji` and `--no-color` work.
+
+  **Short options are matched by letter anywhere in the cluster, not by whole token, and that is not
+  cosmetic.** `commander` bundles short options and lets a value ride on the end, so `-fjson`, `-qP`
+  and `-Pf json` are `--format json` and `--quiet` in another spelling. Measured against a package
+  whose declarations sit on disk but are excluded from `files`, which is the one shape only the
+  post-check can see, a token-matching guard returned **exit 0** on `-fjson` and on `-Pf json`.
+  `-qP` was caught, but only by the empty-transcript net rather than by the refusal.
+
+  **A second class of argument is refused for a different reason, and calling it blinding would be
+  wrong.** `--help`, `-h`, `--version` and `-V` print and exit 0 without analysing anything: measured
+  on the untyped fixture at 2766 and 48 bytes of output, exit 0, no untyped sentence. The transcript
+  is non-empty, so the empty-transcript net does not fire either, and the gate would have read a pass
+  off a run that checked nothing. `--definitely-typed` is refused alongside them **by inference, not
+  by measurement**, and the distinction is kept because the measurement was attempted and did not
+  reproduce: with a version range the untyped sentence still printed. It is refused on a reading of
+  the CLI, where a value that looks like a path merges external declarations into the analysis, which
+  would let a package that ships none come back typed. `--no-definitely-typed` is a distinct option
+  name and is deliberately not refused.
+
+  **Both of this repo's manifests are fixed, because the census that matters is manifests rather
+  than repo roots.** `package.json` and `examples/profile-starter-kit/package.json` each ran the
+  bare CLI, and the kit is a template a consumer copies out and publishes from, so leaving it would
+  have re-minted the false green in every generated package. The kit gets its own copy, whose code is
+  **byte-identical** to the root one below the docblock and is pinned that way by a test; only the
+  comment differs, because one is written for a maintainer here and the other for a consumer who
+  copied the kit out. Two copies of a gate drift, and the kit's copy is executed by nothing in this
+  repo's CI, so the identity pin is what makes the behavioural tests true of both.
+
+  `test/scripts/attw-gate.test.ts` pins the defect and the remedy against the real binary: that bare
+  `attw` exits 0 on both shapes (declarations unpacked, and declarations never built) and on
+  `-fjson`, that the wrapper reds each of them, that the preflight names a missing, an empty and a
+  `./`-less artifact and refuses a manifest that declares none, that a real `attw` failure still
+  propagates `attw`'s own status, that the wrapper is transparent on a well-formed package and does
+  not refuse the options that blind nothing, and that each refusal holds. If a future `attw` fixes
+  the exit code or rewords the sentence, the suite reds and sends the reader to the wrapper rather
+  than letting the net go quietly slack. No runtime or API change; this is a build and publish gate
+  only.
+
 - **A warning or error message could carry clinical text into a log line (`HL7-WARN-MSG-PHI`).**
   No options were required to reach it: plain `parseHL7(raw)` on lenient defaults.
 

package/dist/index.cjs

@@ -6874,7 +6874,7 @@ async function* parseStream(source, optionsOrProfile) {
 }
 
 // src/index.ts
-var VERSION = "0.0.5";
+var VERSION = "0.0.7";
 
 exports.ACK_CODES = ACK_CODES;
 exports.ACK_CONDITIONS = ACK_CONDITIONS;