@cosyte/terminology 0.0.2 → 0.0.5

package/CHANGELOG.md

@@ -11,6 +11,76 @@ this file is maintained by hand (Changesets handles the version bump and publish
 
 ### Fixed
 
+- **`LICENSE` was unqualified MIT over a tree that also distributes third-party material**
+  (`TERMINOLOGY-LICENSE-THIRD-PARTY`, residuals 1 and 2 of `TERMINOLOGY-RESIDUALS`). The README had
+  already grown a "What is bundled" carve-out; the licence file had not, so the two consumer-facing
+  licence statements disagreed. The MIT text is unchanged and still covers this package's own code.
+  A `THIRD-PARTY MATERIALS` section is appended, stating for each item what is distributed and under
+  whose copyright: the **UCUM unit table** (`ucum-essence.xml` v2.2, revision-date 2024-06-17,
+  copyright 1999-2024 Regenstrief Institute, Inc., verbatim under the UCUM Copyright Notice and
+  License, embedded byte-for-byte in the build) with its grant recorded as **revocable**, its
+  no-different-standard and no-derivative-works restrictions, its warranty disclaimer and a pointer
+  to `vendor/ucum/NOTICE.md`, which ships in the tarball and remains the notice of record; the
+  **UCUM functional-test suite** (EPL v1.0, repository-only, not distributed on npm);
+  **`SYSTEM_IDENTITIES`**; the **SNOMED CT identifiers the crosswalk resolver names**; and
+  **RxNorm's relationship and term-type names**. The notice itself is deliberately untouched: it was
+  verified against `ucum.org/license` on 2026-07-30 and already carries all four things the licence
+  requires of a distributor.
+  The last of those closes the second residual. "The engine ships no RxNorm **content**" was
+  unscoped in the way the UCUM claim once was, because `RELA` / `RELA_INVERSE` / `TERM_TYPES` do
+  ship RxNorm's relationship and term-type names; every site now reads "no RxNorm **release**", the
+  same narrowing already applied to the code-system claim, and the names that do ship are named.
+  `Ships no SNOMED content` on the complex-map loader is narrowed to "no SNOMED CT release or
+  refset" for the same reason. **No engine behaviour, API surface or bundled content changes.**
+  Both surfaces that carry the claim move together, as they must: `README.md` and the package JSDoc
+  compiled into `dist/index.d.ts` / `dist/index.d.cts`, plus four `docs-content/` pages, two of
+  which carried a grammatically **closed** bundled-list that the new `LICENSE` would otherwise have
+  contradicted. The enumerated items are derived from the build, not from prose, and every list
+  reads "includes the following" rather than closing the set. Beyond the named constants,
+  individual SNOMED CT, ICD-10-CM and **RxNorm** identifiers ship inside the API documentation
+  examples, with their real names and term types, and those examples reach a consumer in three
+  places rather than one: `README.md`, the compiled declaration files, and the build's sourcemaps,
+  whose `sourcesContent` carries every source comment verbatim. No absolute negative is written
+  over those files: a draft said "no RxNorm release, drug concept or NDC is distributed", which the
+  build falsifies (`RXCUI` `316151` ships as "lisinopril 10 MG"), so the claim is scoped to the
+  release rather than reworded around it.
+  Gated by `test/license-third-party.test.ts` (bytes read with `node:fs`, never a `grep` pipeline):
+  the MIT grant is intact; the third-party section names the UCUM copyright holder, licence URL,
+  revocability, no-derivative-works restriction, warranty disclaimer and `NOTICE.md` pointer;
+  `LICENSE`, `README.md`, the package JSDoc and the four `docs-content/` pages all name the same
+  distributed items, so one surface cannot be updated while another is left contradicting it; no
+  prose file in `LICENSE`, `README.md`, `docs-content/` or **all** of `src/` contains the phrase
+  "RxNorm content" or "SNOMED content"; and every checked-in path in `package.json`'s `files`
+  exists, which is the check `0.0.1` lacked when it pointed consumers at a `NOTICE.md` the tarball
+  did not contain. The anchor list is explicit rather than inferred, so a sixth bundled item still
+  needs the anchors updated by hand.
+  That guard bans the **phrase**, not a determiner pattern, and the reason is recorded because it
+  was got wrong first: a version matching `no\s+(\*\*)?RxNorm(\*\*)?\s+content` put the optional
+  bold markers after the space, so it matched `no **RxNorm content` and missed `**no** RxNorm
+content` — the form every historical instance actually took — and read green over the whole
+  pre-fix tree, 0 of 6 real forms firing. A self-test now asserts the matcher fires on all eight
+  historical spellings and stays quiet on the correct wording. The file list also **walks** `src/`
+  rather than naming files, because a hand-written list omitted `src/rxnorm/rela.ts` and
+  `src/rxnorm/tty.ts`, whose doc comments compile into the declaration files.
+
+- **Three published documentation pages carried a link form that MDX cannot compile, and it stopped
+  docs.cosyte.com building for every package** (`TERMINOLOGY-MDX-AUTOLINK`). `docs-content/intro.md`,
+  `troubleshooting.md` and `concepts-archetype.md` linked the UCUM licence as the CommonMark autolink
+  `<https://ucum.org/license>`. `cosyte/docs` compiles fetched content as **MDX**, which is stricter:
+  it reads the `<` as the start of an element, `https` as a tag name and `:` as a namespace separator,
+  then fails on the `/` with `Unexpected character '/' (U+002F) before local name`. Docusaurus SSG
+  failure is **global**, so three lines in this package's tarball did not degrade one page, they
+  stopped the whole documentation site deploying, for all nine packages it hosts. It went live when
+  `0.0.2` published (2026-07-29T19:20Z) and broke the next push to that repository's `main`.
+  Rewritten as `[https://ucum.org/license](https://ucum.org/license)`, which renders identically and
+  is the form MDX's own error message recommends. **No engine behaviour, API surface or bundled
+  content changes.**
+  `README.md`, `vendor/ucum/NOTICE.md` and `scripts/generate-ucum-essence-data.ts` use the same
+  autolink form and are **deliberately untouched**: verified against the published `0.0.2` assets,
+  `docs-content.tar.gz` ships only the narrative pages plus `sidebars.json` and `source.tar.gz` ships
+  only `package.json` + `src/`, so nothing outside `docs-content/` reaches MDX, and the form renders
+  correctly on GitHub and the registry where those files are actually read.
+
 - **The package claimed to bundle no copyrighted content while bundling the UCUM table, and its
   attribution never reached the tarball** (`TERMINOLOGY-LICENSING-ACCURACY`). Four statements shipped
   in `0.0.1`, live on the registry and on docs.cosyte.com, that the tree falsifies:
@@ -126,6 +196,32 @@ has_ingredient IN`). RxNorm authors no such relationship in any release: the ing
   below is left as written: it records what the docs said at the time, hours before the release
   landed.)
 
+### Added
+
+- **A gate over `docs-content/` that fails on an MDX-hostile link form**
+  (`test/docs-content-mdx-safety.test.ts`). A published release is immutable and the documentation
+  site re-fetches it indefinitely, so a bad link in a tarball cannot be recalled: fixing this
+  repository's `main` does nothing for the version that shipped it. The gate reports the offending
+  file and line with the replacement form, runs inside the required `ci / verify` context (so it
+  cannot be silently un-required by being split into its own job), and carries a **self-test** proving
+  the matcher can see a real autolink, so a green result cannot come from a pattern that matches
+  nothing. It reads bytes directly rather than shelling out to `grep`, which this repository has
+  already been burned by. Scoped to `docs-content/` only, for the reason above.
+- **The README opens with the Cosyte mark, which follows the reader's color scheme.** A `<picture>`
+  block above the H1 offers a dark-ground tile behind a `prefers-color-scheme: dark` media query and
+  carries the light-ground tile as the inner `<img>`, so on a renderer that honors the switch the
+  mark sits on a ground that matches the page it is read on. This README carried no image at all
+  before, so the block is purely additive: the `# @cosyte/terminology` heading, the blockquote
+  tagline and every section below are unchanged, and because the lockup reads "Cosyte" while the
+  heading reads `@cosyte/terminology`, nothing is duplicated. The failure mode is safe: a renderer
+  that strips `<source>` renders the inner `<img>`, so the worst case is a light-ground mark on a
+  dark page, never a missing image. On the npm package page the `<img>` is hoisted out of its
+  `<picture>` by the anchor wrapper, so the light cut renders there, which is the correct one
+  because npmjs.com has no dark mode. The alt text describes the artwork rather than the package,
+  since it is what a screen reader reads out and what a reader gets when the image fails. Both tile
+  URLs were rechecked before push and returned `200 image/png`. No behaviour, API surface or bundled
+  content changed.
+
 ### Changed
 
 - **Internal project bookkeeping is gone from every surface a consumer reads, and a gate now keeps

package/LICENSE

@@ -19,3 +19,86 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
+
+
+================================================================================
+THIRD-PARTY MATERIALS
+================================================================================
+
+The MIT license above covers Cosyte's own code. This repository and the published
+npm package also distribute third-party materials. Those materials stay under
+their own copyright and license terms, and the MIT grant above does not extend to
+them. What is distributed includes the following.
+
+1. The UCUM unit table (vendor/ucum/ucum-essence.xml)
+
+   The Unified Code for Units of Measure (UCUM), also known as the "UCUM
+   Specification," is copyright (c) 1999-2024, Regenstrief Institute, Inc. All
+   rights reserved.
+
+   Version 2.2, revision-date 2024-06-17, is reproduced verbatim under the UCUM
+   Copyright Notice and License, https://ucum.org/license, and is embedded
+   byte-for-byte in the published build. That License grants a worldwide,
+   non-exclusive, no-charge, royalty-free, revocable license to reproduce,
+   publicly display, publicly perform and distribute the Work, and it permits
+   developing and commercializing software that interoperates with UCUM. It does
+   not permit using the Work to develop or promulgate a different standard, and it
+   does not permit derivative works: the content may not be modified and its
+   meaning must remain unchanged. This copy is unmodified, and no derivative of it
+   is distributed.
+
+   Disclaimer of warranties: the UCUM Specification is provided "as is" without
+   warranty of any kind. See the License at the URL above for the full disclaimer.
+
+   The complete notice ships inside this package at vendor/ucum/NOTICE.md. That
+   file, not this summary, is the notice, and it is the copy to read.
+
+2. The UCUM functional-test suite (vendor/ucum/UcumFunctionalTests.xml)
+
+   Copyright (c) 2008-2009 Grahame Grieve and other contributors (Gunther Schadow,
+   Lloyd Mackenzie, Vladimir Alexiev), reproduced verbatim under the Eclipse
+   Public License v1.0, https://www.eclipse.org/legal/epl-v10.html. It is used
+   only as a test fixture in this repository: package.json's "files" does not name
+   it, so it is not distributed in the npm package.
+
+3. Code-system identity facts (SYSTEM_IDENTITIES)
+
+   The OID and canonical-URI pairings, names and mnemonics for the code systems
+   the resolver recognizes. These identify the systems; no system's code list is
+   distributed.
+
+4. SNOMED CT concept identifiers named by the crosswalk resolver
+
+   SNOMED CT identifiers are distributed with their descriptions: the complex-map
+   category concepts in MAP_CATEGORIES (447637006, 447638001, 447639009,
+   447640006) that a map row's mapCategoryId refers to, and the gender findings
+   248152002 (Female) and 248153007 (Male) that a gender IFA rule is written
+   against. Further SNOMED CT identifiers, and ICD-10-CM codes, appear in the API
+   documentation examples, which are distributed in the compiled declaration
+   files (dist/index.d.ts, dist/index.d.cts) and in the build's sourcemaps, whose
+   sourcesContent carries every source comment verbatim.
+   SNOMED CT is copyright (c) International Health Terminology Standards
+   Development Organisation. No SNOMED CT release or refset is distributed; you
+   supply the map rows under your own SNOMED CT licence.
+
+5. RxNorm relationship and term-type names (RELA, RELA_INVERSE, TERM_TYPES)
+
+   The drug-graph API is written against RxNorm's own vocabulary, and those names
+   are distributed: the relationship names in RELA and RELA_INVERSE
+   (has_ingredient, ingredient_of, tradename_of, and the rest), and the term-type
+   codes in TERM_TYPES, each with its name as published by the U.S. National
+   Library of Medicine ("SCD" reads "Semantic Clinical Drug"). Individual RxNorm
+   identifiers also appear in the API documentation examples, with their RxNorm
+   names and term types (for instance RXCUI 316151, "lisinopril 10 MG"), and in
+   README.md as well as the declaration files and sourcemaps named above. RxNorm
+   is produced by the National Library of Medicine. No RxNorm release is
+   distributed; you supply it.
+
+Beyond what is named above, no code-system release is distributed with this
+package. SNOMED CT, CPT, LOINC, UMLS and RxNorm releases, the CMS GEM files, the
+NLM complex-map refset and VSAC value sets are all supplied by the caller, under
+whatever terms their steward sets.
+
+This section states what is distributed and under whose copyright. It is not legal
+advice, and it makes no claim about whether any particular use of these materials
+is permitted to you.

package/README.md

@@ -1,3 +1,8 @@
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://cosyte.com/tile/cosyte-lockup-tile-on-dark-1200x300.png">
+  <img alt="Cosyte: a plus mark set in two overlapping rounded squares, one solid and one outlined, beside the Cosyte wordmark" src="https://cosyte.com/tile/cosyte-lockup-tile-on-light-1200x300.png">
+</picture>
+
 # @cosyte/terminology
 
 > A **zero-dependency terminology engine** for US healthcare code systems — FHIR-shaped, BYO-data,
@@ -8,9 +13,9 @@
 resources. It is the sibling engine `@cosyte/transform` and, later, the parsers' code-system
 recognition consume. It ships the **engine, and no code-system release** — SNOMED CT, CPT, LOINC,
 UMLS/RxNorm, and VSAC value sets are strictly bring-your-own. It is not content-free, though: what it
-_does_ bundle — the UCUM unit table, the code-system _identities_ (OID ↔ canonical URI), and the
-SNOMED CT concepts the crosswalk resolver names — is listed with its copyright under
-[What is bundled](#what-is-bundled).
+_does_ bundle, including the UCUM unit table, the code-system _identities_ (OID ↔ canonical URI), the
+SNOMED CT concepts the crosswalk resolver names and RxNorm's relationship and term-type names, is
+listed with its copyright under [What is bundled](#what-is-bundled).
 
 > **Status:** pre-alpha (`0.0.x`), **published on npm.** The **engine is complete** — every
 > operation below ships today. The surface:
@@ -178,8 +183,9 @@ resolveNdc(graph, "00000000001"); // { resolved: true, rxcui: "314076", status:
 ingredientsOf(graph, "99999999"); // { found: false, code: "TERM_RXNORM_UNKNOWN_RXCUI" } — never a guess
 ```
 
-The engine ships **no** RxNorm content — you supply the release (the public-domain Current Prescribable
-Content subset, or the full BYO release).
+The engine ships **no** RxNorm release; you supply it (the public-domain Current Prescribable
+Content subset, or the full BYO release). What it does ship is RxNorm's relationship and term-type
+_names_, listed under [What is bundled](#what-is-bundled).
 
 ## The invariants this engine is built on
 
@@ -189,7 +195,7 @@ Content subset, or the full BYO release).
 - **Never invert.** A directional map is read in its authored direction only; reverse translation
   needs an explicit inverse map, never a mechanical inversion.
 - **BYO data, engine-only.** No code-system release is bundled (a licensing wall, not a gap); the
-  engine operates over your own FHIR resources. The UCUM unit table and the two identity sets that
+  engine operates over your own FHIR resources. The UCUM unit table and the identity sets that
   **are** bundled are named, with their copyright, under [What is bundled](#what-is-bundled).
 - **Liberal load, conservative assertion.** Malformed input degrades to a typed diagnostic; a 1:many
   mapping returns the full candidate set, never collapsed to one.
@@ -215,9 +221,18 @@ with its copyright:
 - **The SNOMED CT concepts the crosswalk resolver names**, each with its description: the four
   map-category concepts in `MAP_CATEGORIES` (`447637006`, `447638001`, `447639009`, `447640006`) that
   a complex-map row's `mapCategoryId` refers to, and the two gender findings (`248152002` Female,
-  `248153007` Male) that a gender `IFA` rule is written against. SNOMED CT is copyright
+  `248153007` Male) that a gender `IFA` rule is written against. Further SNOMED CT identifiers, and
+  ICD-10-CM codes, appear in the API documentation examples, which are distributed in the compiled
+  declaration files and in the build's sourcemaps. SNOMED CT is copyright
   © International Health Terminology Standards Development Organisation. **No SNOMED CT release or
   refset is bundled** — you supply the map rows under your own SNOMED CT licence.
+- **The RxNorm relationship and term-type names** the drug-graph API is written against: the
+  relationship names in `RELA` / `RELA_INVERSE` (`has_ingredient`, `tradename_of`, …), and the
+  term-type codes in `TERM_TYPES`, each with its name as published by the U.S. National Library of
+  Medicine (`SCD` reads "Semantic Clinical Drug"). Individual RxNorm identifiers also appear in the
+  API documentation examples, with their RxNorm names and term types (for instance `RXCUI` `316151`,
+  "lisinopril 10 MG"), and in this README as well as the places named above. RxNorm is produced by the
+  National Library of Medicine. **No RxNorm release is bundled**; you supply it.
 
 This section states what is distributed and under whose copyright. It is not legal advice, and makes
 no claim about whether any particular use of these materials is permitted to you.
@@ -225,4 +240,5 @@ no claim about whether any particular use of these materials is permitted to you
 ## License
 
 MIT © Cosyte — this package's own code. The bundled third-party materials above stay under their own
-copyright and licences.
+copyright and licences; the `LICENSE` file that ships with this package carries the MIT text and a
+third-party notices section naming each of them.

package/dist/index.cjs

@@ -4703,7 +4703,7 @@ function approximateMatch(graph, query, options = {}) {
 }
 
 // src/index.ts
-var VERSION = "0.0.2";
+var VERSION = "0.0.5";
 
 exports.COMPLEX_MAP_SOURCE_SYSTEM = COMPLEX_MAP_SOURCE_SYSTEM;
 exports.DIAGNOSTIC_CODES = DIAGNOSTIC_CODES;