@cosyte/terminology 0.0.8 → 0.0.9

package/CHANGELOG.md

@@ -23,8 +23,165 @@ this file is maintained by hand (Changesets handles the version bump and publish
   without evaluating a part expansion still has to report. Reading `d.system` is now a type error.
   The rationale, and the other three sites, are under **Fixed** below.
 
+- **The test suite no longer sets a global timeout, and its one repeated start-up tax is gone**
+  (`PARSER-TESTTIMEOUT-ASSERTS-AN-IDLE-BOX`). Development tooling only — `vitest.config.ts` and the
+  test suite. No source file, no build output and no part of the public surface is touched.
+
+  **The trim came first, and it was the larger win.** `test/scripts/phi-scan.test.ts` spawns the
+  scanner at twenty call sites, and the cost of each spawn was start-up, not scanning — the fixtures
+  are a few hundred bytes. Measured on a 12-CPU cgroup quota, warmed runs of each against the same
+  scanner and argv: a `tsx` start had a median around **470–500 ms** against **141–200 ms** for
+  `node` running the same TypeScript through its native type stripping — roughly 300 ms a spawn.
+  That roughly halved the file: a plain base run measured **13,925 ms** over 21 cases, and plain runs
+  after the change measured **5,657 ms and 6,853 ms** over 22. Both runners were checked to produce
+  byte-identical stdout and stderr and the same exit code, on a clean file and on a violator, before
+  the change; several cases assert on stderr exactly.
+
+  `pnpm phi-scan` still runs `tsx`, so one case still spawns it and asserts the two runners **agree**
+  on exit code, stdout and stderr — a parity assertion, so a divergence reds rather than letting the
+  sweep quietly test something the gate does not run. Node's type stripping is on by default from
+  **22.18** while `engines.node` is `>=22.0.0`; the CI matrix is 22 + 24 and both resolve above that,
+  but a developer on 22.0–22.17 would need a newer 22 to run the suite.
+
+  **`testTimeout: 10_000` and `hookTimeout: 10_000` are removed**; the shared `@cosyte/vitest-config`
+  sets no timeout at all. A global timeout asserts the **machine**, not the code: sized for the
+  slowest test in the repo and then inherited by every other test, so a genuinely hung fast test
+  looks merely slow instead of broken. `hookTimeout` was pure noise — Vitest's default hook timeout
+  is **exactly** 10,000 ms, so the literal restated it. Both defaults were established by measuring a
+  deliberately over-running test and hook, not by reading the documentation.
+
+  **Per-test, never global.** Every test whose cost is not fixed now declares its own budget beside
+  the work. The `attw-gate` cases that run a real `npm pack` have carried an explicit 60 s one all
+  along; three groups were added — the two 200,000-row bulk cases in
+  `test/rxnorm/term-types.test.ts`, the single `tsx`-parity case, and **all of `test/property/**`**,
+  whose runtime varies with the fast-check draw as well as with the box, since this package pins no
+  seed by design. With those declared, every remaining test peaked at **689 ms\*\*, a ~7x margin
+  against the 5 s default the config now inherits.
+
+  **The method is part of the claim.** Ten full runs on a contended box (12-CPU cgroup quota,
+  fourteen-worker fleet), of which **six were `vitest run --coverage`**. That is not optional: CI
+  gates on `pnpm test` _and_ `pnpm test:coverage`, and the instrumented run is materially slower,
+  roughly doubling the property-suite peaks. An earlier draft of this change measured only the plain
+  run, recorded 499 ms, and was refuted for it.
+
+  **Two things measurement corrected.** The argument-refusal cases in `attw-gate` look like they
+  belong with the slow ones and do not: the wrapper rejects the flag before invoking `attw`, so they
+  run no `npm pack` and finish in ~200 ms. And the case that actually approached the old ceiling —
+  **9,318 ms against 10,000 ms** under load, a 682 ms margin on correct code — was an `attw` case
+  that already had its own 60 s budget, so the global was never what stood between it and a false
+  red. The `attw` cost itself is genuine work (a real `npm pack` runs ~1,550 ms), so it is bounded
+  rather than trimmed. These figures describe one box on one day and are recorded so the next reader
+  re-measures rather than inherits them.
+
 ### Fixed
 
+- **The publish gate's argument guard refused a fixed LIST of blinding spellings, and `-fjson` was
+  not on it — a value fused to a short flag hid the one sentence the gate reads, and it handed back a
+  pass over a tarball carrying no types** (`ATTW-GUARD-ALLOWLIST`). Development tooling only —
+  `scripts/attw.mjs` ships in no tarball, and the public surface, build output and runtime behaviour
+  are unchanged.
+
+  **The rules of the gate are stated once, in `scripts/attw.mjs`'s docblock. This entry points at it
+  rather than repeating them**, and `CLAUDE.md`'s paragraph now does the same. The guard was
+  described in several committed files at once and the copies drifted: `CLAUDE.md` claimed a refusal "by
+  option name, wholesale" that a fused short option walked past, and called `--config-path` refused
+  "by inference, not measurement" when the real-file half takes one command to measure.
+
+  **The remedy is an ALLOW-LIST, so no spelling is enumerated.** The gate forwards `--profile` and
+  `--no-definitely-typed` and refuses everything else, including options that blind nothing:
+  "harmless" is not a judgement a script can make from an option name. Measured on `7bdd5f5` against
+  this repo's pinned `@arethetypeswrong/cli@0.18.4`, on a fixture whose tarball carries no types —
+  `-fjson`, `-Pf json` and `-Pfjson` each exited **0** with the untyped sentence absent and a
+  non-empty transcript, so the empty-output net could not backstop them; `--help`, `-h`, `--version`
+  and `-V` did the same. `--config-path` naming a real file that sets `format` blinded identically,
+  while the nonexistent path the old test named blinds **nothing** — `readConfig()` swallows the
+  `ENOENT` and the sentence is still printed, so that test asserted a refusal over a case that could
+  not have hurt the gate. Both halves are pinned now.
+
+  **The preflight walks two promises it used to skip**, each measured to leave bare `attw` at exit 0:
+  `bin`, which `attw` does not look at at all, so a manifest could promise a command absent from the
+  tarball; and a path written without a leading `./`, which is legal and is the spelling npm's own
+  documentation uses, so `"main": "dist/index.js"` was dropped silently while the gate reported it
+  had checked. This package declares no `bin` — that half is pinned on a fixture that does, because
+  every sibling copies this file.
+
+  **A false explanation of a correct red is deleted rather than reworded.** The preflight used to
+  name the exit code `attw` "would have" produced. It reads the manifest and never the tarball, and
+  the tarball decides: `analysis.types` is `containsTypes()` in `@arethetypeswrong/core`, which is
+  `listFiles(directory).some(ts.hasTSFileExtension)` — any TypeScript-extension file in the packed
+  tarball, computed before an entrypoint is resolved. A package packing a whole `dist/` can lose
+  every declared declaration and still hand `attw` an undeclared chunk declaration, at which point it
+  exits 1 and the sentence is false. The failure now says what it checked and that it cannot speak
+  for `attw`.
+
+  **A limit found while grading this, filed rather than closed.** The `.attw.json` refusal names
+  `quiet` and `format`, but `readConfig()` sets an option value for **every** key except
+  `configPath`, `help` and `version` — so a committed config reaches options this gate does not name,
+  `definitelyTyped` pointed at a `.tgz` among them, which merges those types in and can make an
+  untyped tarball analyse as typed. It predates this change, and the allow-list closes only its argv
+  half — `--definitely-typed` on argv is now refused, where the deny-list forwarded it — while the
+  config route is untouched. Adding a key would rebuild, on the config side, the deny-list this
+  change retires on the argument side.
+
+- **A symbolic link under a scan root read CLEAN on BOTH of the PHI scanner's enumerating routes, so
+  a link pointing at a file full of real identifiers passed the gate twice over**
+  (`PHI-SCAN-SYMLINK-BLIND-ON-BOTH-ROUTES`). Development tooling only — `scripts/phi-scan.ts` ships in
+  no tarball and the package's public surface is unchanged.
+
+  Reproduced on `80a8cc7` before any fix, with a synthetic name-bearing payload (a person name, a
+  DOB, a dashed SSN and an email at a non-test domain) placed outside the walk roots and a link to it
+  at `src/leak.ts`. `pnpm phi-scan` printed `OK — no hits` and exited **0**; `pnpm phi-scan --staged`,
+  after `git add`, printed `OK — no hits` and exited **0**. Naming the link's target explicitly on the
+  command line found both shapes and exited 1, so the payload was always detectable — the two routes
+  simply never looked at it.
+
+  The two blindnesses are separate mechanisms and needed separate fixes. The walk enumerates
+  `Dirent.isFile()`, which is an **lstat** answer, so a link is neither a file nor a directory and
+  fell out of the loop with no record that anything had been skipped — and `isDirectory()` answers
+  false for a linked directory too, so a whole subtree could disappear the same way. The `--staged`
+  route reads content with `git show :<path>`, and **git stores a symbolic link as its target path
+  under mode `120000`**, so it was handed the target's path text and scanned that. That second route
+  is this repo's `pre-commit` hook, which is exactly where the claim that `--staged` covers a link
+  would have been trusted.
+
+  **Neither route is made to follow the link.** Following would read bytes the enumeration does not
+  control — outside the repo, a loop, a device, a FIFO that blocks the gate forever — and git does not
+  carry those bytes anyway, so a hit on them would be a claim about something no commit contains.
+  Instead the enumeration is narrowed: an entry under a scan root that is not a regular file **refuses
+  the scan** (exit 2, the existing "could not complete" code), naming every offender rather than the
+  first. The walk classifies by `Dirent` (symbolic link, FIFO, socket, block device, character
+  device); `--staged` now reads `git diff --cached --raw -z` instead of `--name-only` so the
+  destination mode is visible, and refuses mode `120000` and `160000` (a gitlink) wherever that
+  route's own path scope reaches them. A `--raw` record that does not parse refuses as well, rather
+  than being skipped into a silently shortened list.
+
+  **`T` (typechange) is in the `--diff-filter`, and leaving it out made the mode check unreachable
+  whenever the file being replaced was already tracked.** Replacing a **tracked** regular file with a link is neither an add nor a
+  modify: git raises `:100644 120000 <sha> <sha> T`, so `--diff-filter=AM` deleted the record before
+  any mode could be read and the hook passed the link green. Measured on git 2.39.5: with `AM` the
+  raw output for that stage is empty. Typechange carries a single path, exactly like `A` and `M`, so
+  admitting it costs the record stride nothing — and it means the reverse typechange, a link replaced
+  by a real file, is now scanned as the ordinary file it became.
+
+  **A refusal names the entry's own repo-relative path and an engine-owned token for its kind, and
+  never the link target** — a target path is text off the working tree and can itself carry PHI. That
+  is asserted, not asserted-in-prose: the pinning payload and the target's own filename both carry a
+  synthetic person name, and every refusal message is checked to contain none of it.
+
+  **What this does not cover, stated narrowly, each measured.** Explicit-path mode already read
+  through a link and reported the target's hits; it is unchanged. The `--staged` path scope is
+  unchanged — still `test/fixtures/**` and `src/**.ts` — so a staged link outside it is still not
+  looked at; narrowing what a scope admits is not widening the scope. That scope also bounds the
+  gitlink half: a submodule staged at `test/fixtures/nested` is refused, while one at `src/nested` is
+  a directory name that fails the `.ts` suffix and is not looked at. `R` (rename) and `C` (copy) are
+  still **not** enumerated by `--staged` at all, so a staged rename that also appends PHI passes that
+  route — pre-existing, unchanged here, and admitting it needs the two-path record shape handled,
+  which is a scope decision rather than this one; CI's all-mode sweep does read the resulting
+  worktree file. A tracked file **absent from the worktree** is still caught at `git add` time only.
+  And the scanner still has no tolerance for a file that vanishes between enumeration and read, so an
+  untracked transient appearing under a walk root can still refuse a whole sweep; that is a different
+  defect, it fails closed, and it is not addressed here.
+
 - **A loaded GEM map, complex map and RxNorm drug graph froze their wrapper and handed out plain
   `Map`s inside it, so whoever held one could delete a diagnosis mapping, add a target the steward's
   file never authored, or empty a medication's ingredient edges** (`TERMINOLOGY-INNER-MAPS-UNSEALED`).

package/dist/index.cjs

@@ -4776,7 +4776,7 @@ function approximateMatch(graph, query, options = {}) {
 }
 
 // src/index.ts
-var VERSION = "0.0.8";
+var VERSION = "0.0.9";
 
 exports.COMPLEX_MAP_SOURCE_SYSTEM = COMPLEX_MAP_SOURCE_SYSTEM;
 exports.DIAGNOSTIC_CODES = DIAGNOSTIC_CODES;