@cosyte/hl7 0.0.6 → 0.0.7

package/CHANGELOG.md

@@ -536,6 +536,16 @@ kind, value)`** sets one at a field or `field[rep]` dot-path. Component values a
 
   Neither limit is changed here, and widening the walk to close either is a separate slice.
 
+  **CLOSED for the first bullet by the "not a regular file" entry below; the second bullet still
+  stands.** The paragraphs above are left exactly as they shipped rather than rewritten, because
+  they described a real state the package passed through and they shipped inside a published
+  tarball, so they are text a consumer already has on disk. What is no longer true of the current
+  code is the whole of the first bullet, in three places rather than one: a symbolic link under a
+  walk root, or staged into `test/fixtures/**` or `src/**.ts`, now **refuses the scan** on both
+  routes instead of reading clean on both; **a FIFO refuses too** rather than being skipped; and the
+  shape pass no longer runs on a link's target _path_, because the entry is refused before anything
+  is read. The second bullet, working-tree-only, still stands exactly as written.
+
 - **`README.md` now opens with the shared Cosyte lockup in a `<picture>` block, replacing the
   per-package banner (`1aee04b`).** The dark-ground org tile sits behind a
   `prefers-color-scheme: dark` media query with the light-ground tile as the inner `<img>`, so on a
@@ -595,6 +605,144 @@ kind, value)`** sets one at a field or `field[rep]` dot-path. Component values a
 
 ### Fixed
 
+- **The PHI scan read a symbolic link as clean on BOTH of its enumerating routes
+  (`PHI-SCAN-SYMLINK-BLIND-ON-BOTH-ROUTES`).** A link under a scan root pointing at a PHI-bearing
+  file passed the gate twice over. **Reproduced on `5debd18` before the fix**, in a throwaway repo,
+  with a synthetic name-bearing HL7 message placed outside the walk roots and a link to it at
+  `test/fixtures/leak.hl7`: all-mode printed `OK: no hits` and exited **0**, `--staged` after
+  `git add` did the same, and naming the target file explicitly exited **1** with seven hits
+  (`PID-5` twice, `PID-7`, `PID-11`, `PID-3`, and the shape pass's `(ssn)` and `(email)`). The
+  payload was always detectable; the two routes never looked at it.
+
+  **Two mechanisms, two fixes, and neither route is made to follow the link.** `walk()` enumerates
+  `Dirent.isFile()`, which is an lstat answer, so a link is neither a file nor a directory and fell
+  out of the loop silently; `isDirectory()` answers false for a **linked directory** too, so a whole
+  subtree left the same way. `--staged` reads content with `git show :<path>`, and git stores a link
+  as its **target path** under mode `120000`, so that route was handed the path text and never the
+  target's bytes. That route is this package's pre-commit hook. Following a link would read bytes
+  the enumeration does not control (outside the repo, a loop, a device, a FIFO that blocks the gate
+  forever), and git does not carry those bytes anyway, so a hit on them would be a claim about
+  something no commit contains. **The enumeration is narrowed instead:** an in-scope entry that is
+  not a regular file **refuses the scan** (exit 2), naming every offender rather than the first.
+  `--staged` reads `git diff --cached --raw -z` so the destination mode is visible, and refuses
+  `120000` and `160000`; an unparseable `--raw` record refuses too, rather than scanning a list that
+  may be short.
+
+  **`--diff-filter=AMT`, and the `T` is load-bearing.** Replacing a **tracked** regular file with a
+  link is neither an add nor a modify: git raises it as a typechange
+  (`:100644 120000 <sha> <sha> T`), so `--diff-filter=AM` deleted the record before any mode could
+  be read and the mode check was unreachable for exactly the files the repo already had. Measured
+  here: with `AM` the raw output for that stage is empty. Admitting `T` also scans the **reverse**
+  typechange, a link replaced by a real file carrying PHI, as the file it became.
+
+  **A refusal names the entry's own repo-relative path and an engine-owned kind token, never the
+  link target**, which is working-tree text that can itself carry PHI. The scanner's docblock states
+  the risky target shape in the abstract rather than showing one, because a diagnostic about a PHI
+  leak is itself a PHI surface and that applies to the prose explaining it.
+
+  **Two behaviour changes that fall out of the same narrowing, both measured, both intended.** A
+  FIFO under a walk root used to be skipped (base exit 0) and now refuses (exit 2, named as
+  `a FIFO`). And an SSN or email shape sitting in a link's target _path_ used to fire on the shape
+  pass under `test/fixtures/` and now never runs, because the entry is refused before anything is
+  read. A refusal that names the entry is a better answer than a hit that only describes a filename,
+  so both are the intended trade rather than a loss.
+
+  **What this does NOT close, stated so it is not read as wider than it is.** `R` (rename) and `C`
+  (copy) are still not enumerated by `--staged` at all, so a staged rename that appends PHI passes
+  that route; admitting them needs the two-path `--raw` record shape handled, which is a scope
+  decision rather than this one. If such a record ever reached the parser the field stride would
+  desync and it refuses, which is the safe outcome. `--staged`'s path scope is unchanged
+  (`test/fixtures/**` and `src/**.ts`), and the walk's gitignore exemption is unchanged: an ignored
+  link is out of scope by the same rule that already excludes an ignored file, though an entry in
+  the index cannot be excused that way. That prefix is literal, so a link staged at exactly
+  `test/fixtures` (the root itself, not an entry under it) is outside the `--staged` filter and is
+  unchanged here; it is not both-routes-blind, because `readdirSync` resolves a symlinked walk root
+  and all-mode reads straight through it (measured, exit 1 on the PHI). A tracked file absent from
+  the worktree is still caught at `git add` time only. The enumerate-then-read tolerance and the
+  refuse-a-sweep-that-observed-nothing rule are untouched.
+
+  Pinned by 19 cases in `test/scripts/phi-scan.test.ts`, **8 of them red on `5debd18`**, all against
+  throwaway git repositories so no link and no violator is ever written into the committed corpus.
+  The payload is name-bearing and the link target's own filename carries a name, so the
+  "never echo the target" assertions are not vacuous.
+
+- **The `attw` publish gate reported a pass on a tarball that carried no types (`ATTW-FALSE-GREEN-PORT`).**
+  `package.json` ran `attw --pack .`, and that command prints "This package does not contain types."
+  and **exits 0**. Every caller that reads the status, including `prepublishOnly` and the shared CI
+  pipeline, read the 0. A false red costs an hour; a false green merges.
+
+  **The defect is `attw`'s exit code, not the invocation and not concurrency.** In this repo's own
+  `@arethetypeswrong/cli@0.18.4`, `dist/getExitCode.js` opens with `if (!analysis.types) return 0`,
+  so the problem list is never consulted. No `--profile`, `--ignore-rules` or config setting reaches
+  that early return. For a package that ships types, "does not contain types" does not mean "fine,
+  untyped"; it means the declarations were not in the tarball, which is a broken publish.
+
+  **Reproduced here with no concurrency at all** (2026-08-03, Node 22): `rm -f dist/index.d.ts
+dist/index.d.cts && pnpm attw` and `rm -rf dist && pnpm attw` both printed the sentence and exited 0. A race only supplies the condition. `tsup` emits the JS bundles in one pass and the declaration
+  files in a later one, so there is a window in every build of this package where `dist/` holds
+  `.mjs`/`.cjs` and no `.d.ts`: timed on two clean builds here, `dist/index.mjs` appeared at 3.57s
+  and 3.58s and `dist/index.d.ts` at 5.81s and 5.65s, a window of 2.24s and 2.07s. A concurrent
+  build or `pnpm clean` in the same working tree lands `attw` in it. **That is deliberately not
+  answered with a lock, a lease or a build queue**: the gate has to be able to say its own inputs
+  were missing, whatever removed them.
+
+  **The fix is `scripts/attw.mjs`, and it carries two nets that catch different things.** A
+  **preflight** checks that every relative artifact path `package.json` promises (`main`, `module`,
+  `types`, `typings`, and every string leaf of `exports`) exists and is non-empty before `attw` runs;
+  it is structural, does no string matching, and names the missing file. A path written **without** a
+  leading `./` counts: `"types": "dist/index.d.ts"` is legal for those four fields and is normalized
+  rather than skipped, since skipping it would leave the preflight quietly narrower than every
+  sentence describing it. Wildcard `exports` patterns (they name a set, not a file), absolute paths
+  and `package.json` itself are skipped. A manifest that declares **nothing** is refused rather than
+  passed, because a preflight with no inputs is not a preflight that succeeded. A **post-check** fails
+  when
+  `attw` still reports an untyped package, which is the case the preflight structurally cannot see:
+  declarations present on disk but excluded from the tarball by `files` or `.npmignore`. **No
+  instance of that second case is on record in this repo.** The post-check reads a printed sentence,
+  so the routes that would hide it are refused rather than tolerated: `--quiet`, `-q`,
+  `--format json`, `-f json`, `--format=json`, `-fjson`, `-qP`, `-Pf json`, a `.attw.json` setting
+  `quiet` or `format`, and `--config-path`. Each of the first nine was measured against this
+  package's own untyped tree to return exit 0 with the sentence absent; `--config-path` is refused by
+  inference, not measurement. The refusal is by option name, wholesale, not by value. Other arguments
+  are still forwarded, so `--profile node16`, `--no-summary`, `--no-emoji` and `--no-color` work.
+
+  **Short options are matched by letter anywhere in the cluster, not by whole token, and that is not
+  cosmetic.** `commander` bundles short options and lets a value ride on the end, so `-fjson`, `-qP`
+  and `-Pf json` are `--format json` and `--quiet` in another spelling. Measured against a package
+  whose declarations sit on disk but are excluded from `files`, which is the one shape only the
+  post-check can see, a token-matching guard returned **exit 0** on `-fjson` and on `-Pf json`.
+  `-qP` was caught, but only by the empty-transcript net rather than by the refusal.
+
+  **A second class of argument is refused for a different reason, and calling it blinding would be
+  wrong.** `--help`, `-h`, `--version` and `-V` print and exit 0 without analysing anything: measured
+  on the untyped fixture at 2766 and 48 bytes of output, exit 0, no untyped sentence. The transcript
+  is non-empty, so the empty-transcript net does not fire either, and the gate would have read a pass
+  off a run that checked nothing. `--definitely-typed` is refused alongside them **by inference, not
+  by measurement**, and the distinction is kept because the measurement was attempted and did not
+  reproduce: with a version range the untyped sentence still printed. It is refused on a reading of
+  the CLI, where a value that looks like a path merges external declarations into the analysis, which
+  would let a package that ships none come back typed. `--no-definitely-typed` is a distinct option
+  name and is deliberately not refused.
+
+  **Both of this repo's manifests are fixed, because the census that matters is manifests rather
+  than repo roots.** `package.json` and `examples/profile-starter-kit/package.json` each ran the
+  bare CLI, and the kit is a template a consumer copies out and publishes from, so leaving it would
+  have re-minted the false green in every generated package. The kit gets its own copy, whose code is
+  **byte-identical** to the root one below the docblock and is pinned that way by a test; only the
+  comment differs, because one is written for a maintainer here and the other for a consumer who
+  copied the kit out. Two copies of a gate drift, and the kit's copy is executed by nothing in this
+  repo's CI, so the identity pin is what makes the behavioural tests true of both.
+
+  `test/scripts/attw-gate.test.ts` pins the defect and the remedy against the real binary: that bare
+  `attw` exits 0 on both shapes (declarations unpacked, and declarations never built) and on
+  `-fjson`, that the wrapper reds each of them, that the preflight names a missing, an empty and a
+  `./`-less artifact and refuses a manifest that declares none, that a real `attw` failure still
+  propagates `attw`'s own status, that the wrapper is transparent on a well-formed package and does
+  not refuse the options that blind nothing, and that each refusal holds. If a future `attw` fixes
+  the exit code or rewords the sentence, the suite reds and sends the reader to the wrapper rather
+  than letting the net go quietly slack. No runtime or API change; this is a build and publish gate
+  only.
+
 - **A warning or error message could carry clinical text into a log line (`HL7-WARN-MSG-PHI`).**
   No options were required to reach it: plain `parseHL7(raw)` on lenient defaults.
 

package/dist/index.cjs

@@ -6874,7 +6874,7 @@ async function* parseStream(source, optionsOrProfile) {
 }
 
 // src/index.ts
-var VERSION = "0.0.6";
+var VERSION = "0.0.7";
 
 exports.ACK_CODES = ACK_CODES;
 exports.ACK_CONDITIONS = ACK_CONDITIONS;