@cosyte/transform 0.0.5 → 0.0.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +129 -16
- package/README.md +6 -4
- package/dist/index.cjs +1 -1
- package/dist/index.cjs.map +1 -1
- package/dist/index.mjs +1 -1
- package/dist/index.mjs.map +1 -1
- package/package.json +3 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,19 +1,134 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
## 0.0.7
|
|
4
4
|
|
|
5
|
-
|
|
6
|
-
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
|
-
Versions and publishing are managed with [Changesets](https://github.com/changesets/changesets);
|
|
8
|
-
this file is maintained by hand (Changesets handles the version bump and publish only).
|
|
5
|
+
### Patch Changes
|
|
9
6
|
|
|
10
|
-
|
|
7
|
+
- a9c522a: No runtime impact: a repository-internal CI check now verifies this repository's own contributor instructions, which are not part of the published package.
|
|
11
8
|
|
|
12
|
-
The
|
|
13
|
-
|
|
9
|
+
The instructions live in two files, one always read and one read on demand, and until now nothing checked that the second one existed, that the sections it declares had any content, or that the cross-references between the two resolved. A new check refuses all three, refuses a cross-reference pointing at a file or path the repository does not carry, and refuses a relocated section that nothing points at any more.
|
|
10
|
+
|
|
11
|
+
It also refuses to report a clean run over a corpus it did not actually open: the files it read are reconciled against the list of files tracked by version control, and an empty or unreadable list is treated as a failure to run rather than as nothing to check.
|
|
12
|
+
|
|
13
|
+
- 9fd8f24: The npm `description` no longer carries an em dash (`EMDASH-CONFORMANCE`).
|
|
14
|
+
|
|
15
|
+
The brand rule bans U+2014 on every cosyte surface, and this string is the most visible one the
|
|
16
|
+
package has: it is the subtitle on the npm package page and the one line shown in every npm search
|
|
17
|
+
result. It now reads with a colon, which is what the rule's own remedy list names first.
|
|
18
|
+
|
|
19
|
+
The `→` in the same string is U+2192, not an em dash, and it is load-bearing: it names the direction
|
|
20
|
+
of the transformation. It stays.
|
|
21
|
+
|
|
22
|
+
Scoped deliberately to the description alone. The full tree sweep for this repo is a separate unit,
|
|
23
|
+
still queued, and lands with the CI gate that keeps it swept.
|
|
24
|
+
|
|
25
|
+
- 9fb82e8: The README lockup now links to cosyte.com (`ASSETS`).
|
|
26
|
+
|
|
27
|
+
The `<picture>` block above the H1 is wrapped in an anchor to https://cosyte.com, per the founder
|
|
28
|
+
requirement of 2026-08-06. Nothing inside the block moved: the `<source>`, the `<img>`, the alt text
|
|
29
|
+
and both tile URLs are byte-identical.
|
|
30
|
+
|
|
31
|
+
What the anchor does was measured on both surfaces by `fhir`, not assumed, because fourteen READMEs
|
|
32
|
+
carry this shape. On GitHub the anchor works and the colour-scheme switch keeps working, because the
|
|
33
|
+
`<img>` stays a direct child of `<picture>`, which is the condition the HTML spec puts on `<source>`
|
|
34
|
+
applying at all. On an npm package page the anchor is lost: npm wraps a README image in its own
|
|
35
|
+
anchor to the image file, a nested anchor is not representable, so the parser closes ours early and
|
|
36
|
+
the image ends up linked to the image file rather than to cosyte.com. Shipped anyway by founder
|
|
37
|
+
decision of 2026-08-07: on npm that is no worse than the unlinked lockup it replaces, and GitHub is
|
|
38
|
+
where these READMEs are read.
|
|
39
|
+
|
|
40
|
+
- 7f4d59b: The published changelog no longer describes its own contents as unreleased: a release now writes its own version heading and its own entry into `CHANGELOG.md`.
|
|
41
|
+
|
|
42
|
+
`CHANGELOG.md` ships inside the npm tarball, and for the whole of this package's public history it carried no version heading at all. A single `[Unreleased]` heading spanned everything, and the preamble above it said the first pre-alpha release "will ship" the API surface listed below it, in a tarball that had already shipped that surface several versions earlier. Changesets now generates the changelog, so a release writes the version heading and the entry, and there is no hand-maintained section left to go stale.
|
|
43
|
+
|
|
44
|
+
The hand-written history is kept verbatim beneath a `Released before this file was generated` divider, with generated release sections above it, newest first. No entry was reworded, re-sorted or removed. What was dropped was scaffolding for the old hand-written workflow: the file's former header, the `[Unreleased]` heading and its link definition, the note beneath that heading promising a first release which had in fact already shipped, and the empty section stubs that existed to receive the next hand-written entry.
|
|
45
|
+
|
|
46
|
+
## Released before this file was generated
|
|
47
|
+
|
|
48
|
+
Every release section above this heading is written by
|
|
49
|
+
[Changesets](https://github.com/changesets/changesets) from the changesets in `.changeset/`, newest
|
|
50
|
+
release first. The release writes its own version heading, so nothing above this line is maintained
|
|
51
|
+
by hand: a change is recorded by adding a changeset, and that changeset's summary is the entry a
|
|
52
|
+
reader sees here.
|
|
53
|
+
|
|
54
|
+
Everything below this heading was maintained by hand. It sat under a single `[Unreleased]` heading
|
|
55
|
+
that no release ever rolled over, so it went on describing already-published code as unreleased,
|
|
56
|
+
inside the published tarball, for the whole of this package's public history. It is left as it was
|
|
57
|
+
written rather than re-sorted into version sections: the file never recorded which release each
|
|
58
|
+
entry went out in, and this is the text that installed copies already carry on disk. No entry was
|
|
59
|
+
reworded, re-sorted or removed. What was dropped was scaffolding for the hand-written workflow that
|
|
60
|
+
no longer runs: the file's former header, the `[Unreleased]` heading and its link definition at the
|
|
61
|
+
foot of the file, the note beneath that heading promising a first release which had in fact already
|
|
62
|
+
shipped, and the empty section stubs that existed to receive the next hand-written entry.
|
|
63
|
+
|
|
64
|
+
The entries below follow [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); the generated
|
|
65
|
+
sections above use the format Changesets writes, which is a version heading and a list of the
|
|
66
|
+
changes that release consumed. Versions follow the cosyte pre-alpha ladder, `0.0.x` until first
|
|
67
|
+
alpha, rather than [Semantic Versioning](https://semver.org/spec/v2.0.0.html) alone.
|
|
14
68
|
|
|
15
69
|
### Fixed
|
|
16
70
|
|
|
71
|
+
- **A staged rename walked a symbolic link, or a real patient name, straight into a scan root
|
|
72
|
+
without the pre-commit PHI gate ever looking at it** (`PHI-SCAN-RENAME-BLIND-AT-PRECOMMIT`; port of
|
|
73
|
+
the graded fix in `dicom#60`). `R` (rename) and `C` (copy) records are returned by neither `AM` nor
|
|
74
|
+
`AMT`, so the `--staged` route's `--diff-filter=AMT` deleted the whole two-path record before any
|
|
75
|
+
mode or any content was read. Measured on this repo's own scanner before the fix, on both shapes it
|
|
76
|
+
reaches: `git mv notes/leak.txt src/leak.ts` over a link to a name-bearing synthetic payload staged
|
|
77
|
+
as `:120000 120000 <sha> <sha> R100` (`git ls-files --stage` reading `120000` on the destination)
|
|
78
|
+
and reported a clean scan, exiting **0**; `git mv notes/payload.txt src/payload.ts` over an ordinary
|
|
79
|
+
file full of the same payload passed identically. Both are ordinary developer actions, not
|
|
80
|
+
contrived ones.
|
|
81
|
+
|
|
82
|
+
**The gap is at PRE-COMMIT.** The hook is `phi-scan --staged`; the all-mode walk CI runs does
|
|
83
|
+
enumerate the renamed entry, so the exposure was "PHI enters a local commit or a pushed branch",
|
|
84
|
+
not "PHI merges". Stated because the containment is the difference between a defect and an
|
|
85
|
+
incident.
|
|
86
|
+
|
|
87
|
+
**The remedy is `--no-renames`, and it costs no stride work.** With detection off git cannot emit
|
|
88
|
+
`R` or `C` at all, so the destination arrives as an ordinary single-path `A`
|
|
89
|
+
(`:000000 120000 0000000 <sha> A`) and the source as a `D` the filter drops. No two-path record
|
|
90
|
+
shape is needed, and the enumeration is a strict **superset** of the previous one: re-measured
|
|
91
|
+
under `diff.renames=true|copies|false|1` and `renameLimit=1`, every setting yields that same
|
|
92
|
+
single-path `A`, so the flag also makes the two-field stride **structural** rather than conditional
|
|
93
|
+
on whatever a caller has configured. This repo previously disclosed the residual as "admitting them
|
|
94
|
+
needs the two-path record shape, a scope decision"; **that framing was false**, and it had been
|
|
95
|
+
carried in from a sibling repo rather than measured here.
|
|
96
|
+
|
|
97
|
+
**Unmerged (`U`) records were dropped by the same filter and are now refused rather than admitted.**
|
|
98
|
+
A conflicted path has no stage-0 entry, so `git show :<path>` answers
|
|
99
|
+
`fatal: path ... is in the index, but not at stage 0` rather than any content. It now refuses
|
|
100
|
+
(exit 2) through the same closed-set path as a link or a gitlink, naming the path and an
|
|
101
|
+
engine-owned kind and nothing else. The refusal keys on the **status**, not the mode, and that is
|
|
102
|
+
measured rather than assumed: across six conflict flavours (both-modified, add/add, modify/delete,
|
|
103
|
+
delete/modify, rename/rename, symlink/symlink) the status is always `U` and the destination mode
|
|
104
|
+
always `000000`, while the source mode and the set of index stages present both vary.
|
|
105
|
+
|
|
106
|
+
**One route this does not close, measured and disclosed rather than quietly left out:** a scan
|
|
107
|
+
root's **own path** staged as a non-regular entry is still outside the `--staged` route's scope,
|
|
108
|
+
because that scope tests `test/fixtures/` and `src/` as path prefixes. Measured on both trees:
|
|
109
|
+
`ln -s elsewhere src && git add -A` stages `:000000 120000 0000000 <sha> A src`, and `--staged`
|
|
110
|
+
reports clean and exits 0 while the all-mode walk over the same tree exits 1 on the payload behind
|
|
111
|
+
it. Pre-existing and unchanged by this slice; the reference implementation this was ported from
|
|
112
|
+
carries a guard for it that did not come across, and closing it is its own item.
|
|
113
|
+
|
|
114
|
+
Pinned in `test/scripts/phi-scan.test.ts` against throwaway git repos under `os.tmpdir()`, with the
|
|
115
|
+
premise itself pinned (git really does stage `git mv <link>` as `R100` at mode `120000`, and `AMT`
|
|
116
|
+
really does return nothing for it) so the fix cannot come to rest on a claim about git that stopped
|
|
117
|
+
being true. **Six of the new cases run red against the previous scanner**, including a repo whose
|
|
118
|
+
own `diff.renames` is set to `copies`. Two controls stay green on both trees deliberately: a rename
|
|
119
|
+
landing **outside** a scan root still passes (the fix narrows what the route's existing scope
|
|
120
|
+
admits; it does not widen the scope), and a stage mixing an add, a modify and a rename still
|
|
121
|
+
reports the violator behind them.
|
|
122
|
+
|
|
123
|
+
- **The PHI scanner exited `1`, its code for HITS FOUND, when it could not run at all.**
|
|
124
|
+
`loadAllowList()` runs outside every `try` in `main`, so a missing `scripts/phi-allow-list.txt`
|
|
125
|
+
threw out of the process and left node's uncaught-exception status, `1`. A `readdirSync` failure
|
|
126
|
+
under a walk root did the same. A caller keying on the exit code therefore read a gate that never
|
|
127
|
+
ran as a gate that ran and fired: the wrong direction to be wrong in. Every failure to complete
|
|
128
|
+
now exits **2**: `run()` at the foot of the file is the outermost net, and `walk` names an
|
|
129
|
+
unreadable directory and its errno itself instead of throwing raw. An unexpected throw still
|
|
130
|
+
prints its stack, deliberately.
|
|
131
|
+
|
|
17
132
|
- **The exported `VERSION` constant said `"0.0.0"` on a package published as `0.0.4`, and the
|
|
18
133
|
documented install smoke test told an installer to print exactly that constant**
|
|
19
134
|
(`VERSION-CONSTANT-DRIFT`). Measured on the released tarball, not inferred from source:
|
|
@@ -107,6 +222,12 @@ dependency: peer @cosyte/fhir@">=0.0.0" from @cosyte/transform@0.0.4`.
|
|
|
107
222
|
exposure is a local commit or a pushed branch, not a merge. And this scanner has no
|
|
108
223
|
refuse-a-scan-that-observed-nothing rule, so an empty enumeration still reports clean.
|
|
109
224
|
|
|
225
|
+
**▶ SUPERSEDED IN THIS SAME RELEASE, AND THE FRAMING ABOVE WAS FALSE.** The `R`/`C` residual is
|
|
226
|
+
closed by `PHI-SCAN-RENAME-BLIND-AT-PRECOMMIT` (the first entry in this section): the remedy is
|
|
227
|
+
`--no-renames`, which needs neither the two-path record shape nor a scope decision. The paragraph
|
|
228
|
+
above is kept as written because the two bullets ship as one release note and a reader will meet
|
|
229
|
+
both; what would mislead is leaving it as the last word. The other two residuals it names stand.
|
|
230
|
+
|
|
110
231
|
- **The `attw` publish gate passed an untyped pack, so a tarball with no type declarations in it
|
|
111
232
|
would have merged and published as green** (`ATTW-FALSE-GREEN-PORT`; port of the graded fix in
|
|
112
233
|
`terminology#28`, `bf153cb`). `@arethetypeswrong/cli@0.18.4` opens `getExitCode()` with
|
|
@@ -465,10 +586,6 @@ dependency: peer @cosyte/fhir@">=0.0.0" from @cosyte/transform@0.0.4`.
|
|
|
465
586
|
`parseTransform` / `WARNING_CODES` / `FATAL_CODES` parser stubs and the round-trip property test;
|
|
466
587
|
rewrote `docs-content/`, `README`, and this repo's `CLAUDE.md` for the transformation library.
|
|
467
588
|
|
|
468
|
-
### Deprecated
|
|
469
|
-
|
|
470
|
-
### Removed
|
|
471
|
-
|
|
472
589
|
### Fixed
|
|
473
590
|
|
|
474
591
|
- **The README no longer says this package is unpublished.** It is on npm, and the sentence sat a
|
|
@@ -477,7 +594,3 @@ dependency: peer @cosyte/fhir@">=0.0.0" from @cosyte/transform@0.0.4`.
|
|
|
477
594
|
rendered directly beneath npm's own header, which shows the version being served. The replacement
|
|
478
595
|
names no version deliberately. A version written into prose is the part that goes stale, and the
|
|
479
596
|
registry is the only thing that knows which one is current.
|
|
480
|
-
|
|
481
|
-
### Security
|
|
482
|
-
|
|
483
|
-
[Unreleased]: https://github.com/cosyte/transform/commits/main
|
package/README.md
CHANGED
|
@@ -1,7 +1,9 @@
|
|
|
1
|
-
<
|
|
2
|
-
<
|
|
3
|
-
|
|
4
|
-
|
|
1
|
+
<a href="https://cosyte.com">
|
|
2
|
+
<picture>
|
|
3
|
+
<source media="(prefers-color-scheme: dark)" srcset="https://cosyte.com/tile/cosyte-lockup-tile-on-dark-1200x300.png">
|
|
4
|
+
<img alt="Cosyte: a plus mark set in two overlapping rounded squares, one solid and one outlined, beside the Cosyte wordmark" src="https://cosyte.com/tile/cosyte-lockup-tile-on-light-1200x300.png">
|
|
5
|
+
</picture>
|
|
6
|
+
</a>
|
|
5
7
|
|
|
6
8
|
# @cosyte/transform
|
|
7
9
|
|
package/dist/index.cjs
CHANGED