@cosyte/transform 0.0.3 → 0.0.4

package/CHANGELOG.md

@@ -12,6 +12,121 @@ this file is maintained by hand (Changesets handles the version bump and publish
 The first pre-alpha release (`0.0.1`) will ship the initial public API surface. The package begins
 its public history at `0.0.x`, per the cosyte version ladder (`0.0.x` until first alpha).
 
+### Fixed
+
+- **The PHI scanner read a symbolic link as clean on BOTH of its enumerating routes, so a link
+  under a scan root pointing at a file full of PHI passed the commit gate**
+  (`PHI-SCAN-SYMLINK-BLIND-ON-BOTH-ROUTES`; port of the graded fix in `terminology#37`, `5f81640`).
+  Measured on this repo's own scanner before the fix, over a link under `src/` pointing at a
+  name-bearing synthetic payload: all-mode printed `OK — no hits` and exited **0**, and `--staged`
+  did too. The walk enumerates `Dirent.isFile()`, which is an lstat answer, so a link is neither a
+  file nor a directory and fell out of the loop whatever it pointed at — and a linked _directory_
+  took its whole subtree with it. `--staged` reads content with `git show :<path>`, and git stores a
+  link as its **target path** under mode `120000` (`git ls-files --stage` read `120000` on it), so
+  that route was handed the path text and never the target's bytes.
+
+  **The remedy is to narrow the enumeration and follow nothing it enumerates.** Every entry the scan
+  enumerates, and every path named directly, is now **refused** if it is not a regular file (exit 2,
+  the existing "could not complete" code) rather than being silently skipped. Following such an entry was rejected on purpose: it would read bytes the
+  enumeration does not control (outside the repo, a loop, a device, a FIFO that blocks the gate
+  forever), and git does not carry those bytes anyway, so a hit on them would be a claim about
+  something no commit contains.
+
+  **The third mode — a named `<path>` — was not blind, and it is fixed in the same pass because the
+  invariant has to hold for the whole scanner.** It classified with `statSync`, which
+  **dereferences**, so `pnpm phi-scan src/link.ts` read the target's bytes and reported the hits it
+  found there, including for a target **outside the repository**. That is never a false clean, which
+  is why reading the code does not catch it; it made the scanner's stated rule weaker than one of its
+  own routes. It lstats now and refuses through the same closed set. A dangling link is reported as
+  the link it is rather than as a missing file, because `existsSync` follows.
+
+  **Stated precisely, because a looser wording of it was measured false twice: `lstat` answers for
+  the final path component only.** A named path whose **ancestor** component is a symlink is still
+  followed and still read, and so is a plain absolute or `../` argument. Both predate this change and
+  neither is narrowed by it; they are listed with the other residuals below rather than closed,
+  because closing them means realpath or containment logic, which is a guard growing past the defect
+  it fixes. Neither of the two routes that gate a commit — the pre-commit hook and the walk CI runs —
+  reaches either.
+
+  **`--diff-filter` now admits `T`, and leaving it out is what made the mode check unreachable on a
+  tracked file.** Replacing a tracked regular file with a link is neither an add nor a modify:
+  measured here, `git diff --cached --raw --diff-filter=AM` printed **nothing** for that change
+  while the unfiltered `--raw` printed `:100644 120000 <sha> <sha> T`. Under an `AM` filter the
+  record died before any mode could be read and the hook passed a mode-`120000` blob green.
+  Admitting `T` also covers the reverse typechange — a tracked link replaced by a real file bearing
+  PHI, which is a scan that must happen rather than a refusal. The route reads
+  `git diff --cached --raw -z` so the destination mode is visible at all, and a record it cannot
+  parse refuses rather than shortening the list silently.
+
+  **A refusal names every offender by its own repo-relative path plus an engine-owned kind token,
+  and never the link target.** A target path is working-tree text that can itself carry PHI — a
+  target of the shape `<surname>-<given>-<dob>.txt` is the whole reason, written out as a shape
+  rather than an example because a diagnostic about a PHI leak is itself a PHI surface. The scope of
+  each route is unchanged: the walk still excludes a gitignored entry (so links get no second,
+  stricter boundary of their own) and `--staged` still only looks at `test/fixtures/**` and
+  `src/**.ts`. This narrows what those scopes admit; it does not widen them. The walk itself has no
+  extension scope — it skips regular `*.md` as documentation and takes everything else — so a link at
+  `src/leak.json`, and a linked directory, are refused there too.
+
+  **Three residuals are disclosed rather than closed** — the ancestor-component and absolute/`../`
+  reads above, plus two inherited from the graded reference and
+  re-measured here. `R`/`C` rename and copy records are still not enumerated by `--staged` at all —
+  admitting them needs the two-path record shape handled, which is a scope decision of its own; the
+  stride desync a stray one would cause refuses rather than mis-parses. That residual is reachable by
+  an ordinary action rather than only in principle: `git mv` into a scanned prefix raises `R100`,
+  which the filter drops, so the pre-commit hook reports clean over a staged PHI-bearing file — on
+  the old scanner and on this one alike. The all-mode walk that CI runs does catch it, so the
+  exposure is a local commit or a pushed branch, not a merge. And this scanner has no
+  refuse-a-scan-that-observed-nothing rule, so an empty enumeration still reports clean.
+
+- **The `attw` publish gate passed an untyped pack, so a tarball with no type declarations in it
+  would have merged and published as green** (`ATTW-FALSE-GREEN-PORT`; port of the graded fix in
+  `terminology#28`, `bf153cb`). `@arethetypeswrong/cli@0.18.4` opens `getExitCode()` with
+  `if (!analysis.types) return 0`, returning **before the problem list is read at all** — an untyped
+  package is a legitimate npm package, so the CLI treats "no types" as a description rather than a
+  problem. No `--profile`, `--ignore-rules` or config setting reaches that early return, which is
+  why the remedy is a wrapper (`scripts/attw.mjs`, now what the `attw` script runs) and not a
+  stricter invocation. The old invocation here was the bare `attw --pack .`, on the default strict
+  profile; it was never lenient.
+
+  **Reproduced on this package, on a quiet box, with zero concurrency** — both `rm -rf dist && attw
+--pack .` and `pnpm build && rm -f dist/index.d.ts dist/index.d.cts && attw --pack .` print
+  "This package does not contain types." and exit **0**. The second is the realistic trigger: `tsup`
+  emits the ESM/CJS bundles in one pass and the declarations in a later pass, so **every** build of
+  this package has a window where `dist/` holds JS and no `.d.ts`. Polling `dist/` every 5 ms from
+  the start of `pnpm build`, that window measured **1,600 ms, 1,646 ms and 2,018 ms** across three
+  consecutive builds. Concurrency only widens the window; it is not the defect, and the remedy is
+  therefore **not** a lock, a lease or a build queue (umbrella ADR 0015) — the gate is made able to
+  report that its own inputs were missing, whatever removed them.
+
+  Two nets, catching different things. A **preflight** that every relative path `package.json`
+  promises (`main`, `module`, `types`, `typings`, every string leaf of `exports` — here
+  `./dist/index.{cjs,mjs,d.ts,d.cts}`) exists and is non-empty, which is what catches the build
+  window and names the missing file. A **post-check** that promotes `attw`'s untyped sentence to a
+  failure, which catches what the preflight structurally cannot: declarations present on disk but
+  excluded from the tarball by `files`/`.npmignore`. **No instance of that second case is on record
+  in this repo.** Because the post-check reads a printed string it is blindable, so `--quiet`,
+  `-f/--format` and `--config-path` are refused **by option name, wholesale, not by value**, along
+  with a `.attw.json` setting `quiet` or `format` (`readConfig()` applies those after argv). Three
+  of those four routes were measured here to restore the exact exit-0; `--config-path` is refused by
+  inference, and says so.
+
+  `test/scripts/attw-gate.test.ts` pins both nets against the real binary — including the upstream
+  exit-0 itself, so an `attw` upgrade that fixes the exit code or rewords the sentence reds the
+  suite instead of letting the net go quietly slack — plus a **negative control** on a well-formed
+  package and a check that a real `attw` failure still exits with `attw`'s own status. Reducing the
+  wrapper back to the bare CLI reds 10 of its 13 tests.
+
+  **Two limits, stated rather than left to be discovered.** A **complete but stale `dist/`** passes
+  both nets; that is not live today only because the verify ladder runs `build` before `attw`. And
+  this package's unpublished `@cosyte/fhir` peer (`FHIR-NPM-NAME`, a separate human gate) does not
+  change what `--pack .` can see: a good pack reports "No problems found" and exits 0, and does so
+  identically with `node_modules/@cosyte/fhir` moved out of the way, so `attw` is not resolving that
+  peer either way. Nothing in this entry says a green `attw` speaks to whether a consumer can
+  install the peer; it does not.
+
+  No library code, public API, issue code, mapping or transformed value changes.
+
 ### Added
 
 - **A brand image at the top of `README.md`.** The page opens with the Cosyte lockup, served as a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosyte/transform",
-  "version": "0.0.3",
+  "version": "0.0.4",
   "description": "HL7 v2 → FHIR R4 transformation library for Node.js and TypeScript — IG-grounded, fail-safe, value-free diagnostics; never a confident wrong FHIR value.",
   "keywords": [
     "hl7",
@@ -101,7 +101,7 @@
     "test:coverage": "vitest run --coverage",
     "clean": "rm -rf dist coverage",
     "pack:docs": "bash scripts/build-docs-artifacts.sh",
-    "attw": "attw --pack .",
+    "attw": "node scripts/attw.mjs",
     "version": "changeset version && prettier --write package.json CHANGELOG.md",
     "release": "changeset publish"
   }