@cosyte/transform 0.0.7 → 0.0.9

package/CHANGELOG.md

@@ -1,5 +1,56 @@
 # Changelog
 
+## 0.0.9
+
+### Patch Changes
+
+- ad5f2f2: No runtime impact: the repository's own PHI commit-gate read 31 of its 102 tracked files, and it now reads 101 of its 103 and refuses when it cannot account for the rest.
+
+  Both of the gate's enumerating routes covered `test/fixtures/` and `src/` only. Seventy-one tracked files were read by neither of them, twenty-seven of those under `test/`, and eight of those carried inline HL7 v2 patient-identification segments with names, dates of birth and medical record numbers in them. The sharper half is that `test/fixtures/` has never existed in this repository, on any commit: the walk's existence check returned on its first line for that root on every run the gate has ever made, and every one of those runs printed a clean result and exited zero. An unopened root and a clean one are indistinguishable from the outside.
+
+  Neither a file count nor an existence check detects that, and both were considered and rejected: a count counts the roots that did exist, and refusing a missing root leaves an emptied one reporting clean. So the walk now covers every tracked directory plus the files at the repository root, and reconciles what it actually opened against the list of files version control actually carries. A tracked path the walk did not open now refuses, naming each one. A declared root that is a symbolic link, dangling or not, refuses too: the existence check follows a link, so a dangling root read as absent and the whole corpus went unscanned while the run reported success.
+
+  Enumerating more files buys the cross-cutting social security number and email checks and nothing else, and measured on this repository those two find nothing at all in the eight fixture files: they carry no dashed social security number and no email address. What they carry is names, dates of birth, record numbers, one undashed social security number, a street address and two telephone numbers. So a structured pass ships alongside the existing one, never in place of it, reading HL7 v2 patient, next-of-kin, guarantor and insurance segments field by field and component by component. It finds segments inline rather than assuming a file is a message, because this package ships no standalone message file at all: every fixture is a string literal inside TypeScript.
+
+  Every value the structured pass reports is checked against the reviewed synthetic-fixture declaration list, which gains entries for this repository's placeholders. Each was read by hand first and each is named in that file rather than removed, because removing them would destroy the evidence the audit happened. Seventy files are newly read, sixty-nine of which already existed and were read by hand; nothing patient-identifying was found in any of them. The two that stay unread are the vendored compressed archives, whose stored bytes are not the text they carry, and each is declared by its exact path.
+
+  One detection is subtracted and it is the only one. The package manifest carries the publisher's own contact address, which the email check cannot tell from a patient's, so scanning the manifest at all required declaring that one address. It is declared with a path as well as an address, so the same address in any other file still reports and any other address in the manifest still reports, and the cost is that naming the manifest directly no longer reports it. Every other outcome is unchanged or newly caught: a hundred and sixty-eight before-and-after cases, fourteen path shapes by four payload shapes by all three ways the gate can be invoked, with thirty-seven that reported before still reporting, seventy-four newly caught and fifty-six unchanged and quiet.
+
+  Two further blind spots were found while grading this change and were closed rather than written down, because both reported a clean result over content a reader would expect to be caught: a person's name spelled with any character outside the plain English alphabet, and a whole message pasted into a single string with its separators written as escapes. A wrong field position was corrected too, where an insurance segment's relationship code was reported as a telephone number.
+
+  The way the gate's own limits are written changed with them, and that is the more useful half. Grading three times showed that a list of what a scanner does not catch cannot be kept true, because every clause of every segment of the standard would have to appear on it, and both versions of that list were measured incomplete in the direction that flatters the gate. The scanner now states the opposite way round: exactly which fields it reads, with anything not named there not checked. That claim can be checked against the code, and the suite now checks it from both sides in a single run, so a field added to the reader without being added to the statement, or dropped from the reader while the statement keeps promising it, both turn the build red. It also records which of those field numbers are corroborated by something in this repository and which are not, because that is where the remaining risk sits.
+
+  Several limits stay disclosed rather than quietly closed, including that the reconciliation compares path names and not the bytes stored at them, and the complete list of what the gate still cannot see is written at the top of the scanner itself.
+
+## 0.0.8
+
+### Patch Changes
+
+- 9fdde50: No runtime impact: punctuation only, plus a new repository-internal check that keeps it that way.
+
+  The Cosyte brand voice does not use the em dash (U+2014). This package carried 659 of them across
+  75 of its 98 tracked files, including the README, every documentation page that publishes to the
+  documentation site, and the source doc comments that compile into the shipped type declarations and
+  render in an editor on hover. All 609 that were in scope are rewritten with a period, a colon, a
+  comma or parentheses, chosen by what each sentence meant rather than by one blanket substitution.
+
+  No exported name, type, issue code, fatal code or documented behaviour changed. Two strings changed
+  punctuation and nothing else, and both belong to developer tooling rather than to the published
+  package: the PHI scanner's clean-run line, and one diagnostic from the check that verifies this
+  repository's own contributor instructions.
+
+  Two files still carry the character and each is an exemption with a written reason. The changelog's
+  dated archive below its "Released before this file was generated" heading is a frozen record whose
+  entries are byte identical to the tarballs they shipped in, and rewriting it would destroy the
+  evidence a changelog exists to hold. The vendored third-party tarball under `vendor/` holds the
+  character's bytes by coincidence inside a compressed stream, which no edit can remove.
+
+  The check that enforces the rule lands in the same change as the sweep, on purpose: a check arriving
+  before its sweep turns the build red on arrival, and a sweep arriving before its check lets the
+  character grow back. It reads bytes directly rather than shelling out, refuses to report a clean
+  result whenever it cannot prove it read its subject, and holds its own source to the same rule by
+  assembling every banned spelling at runtime instead of writing one down.
+
 ## 0.0.7
 
 ### Patch Changes

package/README.md

@@ -7,7 +7,7 @@
 
 # @cosyte/transform
 
-> HL7 v2 → FHIR R4 transformation for Node.js and TypeScript — **IG-grounded, fail-safe, value-free
+> HL7 v2 → FHIR R4 transformation for Node.js and TypeScript: **IG-grounded, fail-safe, value-free
 > diagnostics; never a confident wrong FHIR value**.
 
 `@cosyte/transform` is the healthcare **transformation** layer of the cosyte suite. Unlike the
@@ -18,9 +18,9 @@ grounded on the official **HL7 Version 2 to FHIR** Implementation Guide (`hl7.fh
 > **Status:** pre-alpha (`0.0.x`), published to npm. This release ships the
 > six safety-critical datatype converters and the value-free diagnostic channel, the
 > message-level assembly, HL7 v2 **ADT → FHIR Patient + Encounter**, the **ORU^R01 → FHIR
-> DiagnosticReport + Observation** results graph, the order-entry graph — **ORM_O01 /
-> OML_O21 → ServiceRequest** and **RXO → MedicationRequest** — the thin IG singles —
-> **VXU_V04 → Immunization**, **SIU_S12 → Appointment**, **MDM_T02 → DocumentReference** — all
+> DiagnosticReport + Observation** results graph, the order-entry graph (**ORM_O01 /
+> OML_O21 → ServiceRequest** and **RXO → MedicationRequest**), the thin IG singles
+> (**VXU_V04 → Immunization**, **SIU_S12 → Appointment**, **MDM_T02 → DocumentReference**), all
 > via `toFhir(msg)`, and **terminology value translation** of coded fields: route/site,
 > appointment type, order priority, and substitution are now value-translated through their IG
 > `mappedVia` ConceptMaps via `toFhirCodeableConceptVia`, fail-safe on any code the IG leaves unmapped.
@@ -33,7 +33,7 @@ grounded on the official **HL7 Version 2 to FHIR** Implementation Guide (`hl7.fh
 npm install @cosyte/transform @cosyte/hl7 @cosyte/fhir
 ```
 
-`@cosyte/hl7` and `@cosyte/fhir` are **peer dependencies** — the transform maps between the models
+`@cosyte/hl7` and `@cosyte/fhir` are **peer dependencies**: the transform maps between the models
 they own. Its own third-party runtime dependencies are **zero**.
 
 **That command does not work yet.** This package is published, but `@cosyte/fhir` is not on the
@@ -53,21 +53,21 @@ const { value, issues } = toFhirHumanName({
 // value: a FHIR HumanName node; issues: [] (clean, fully mapped)
 ```
 
-Each converter returns `{ value, issues }` — the FHIR datatype node it could faithfully produce, plus
+Each converter returns `{ value, issues }`: the FHIR datatype node it could faithfully produce, plus
 the value-free diagnostics it raised.
 
 ## The fail-safe rule
 
-Every conversion is grounded on the IG and **refuses to guess**. On any ambiguity —
+Every conversion is grounded on the IG and **refuses to guess**. On any of these ambiguities:
 
 - a v2 timestamp with a time-of-day but **no timezone** (FHIR forbids time without a zone),
 - an assigning authority that can't be **resolved to a system URI** (never synthesized from a bare
-  namespace — that would merge two patients),
+  namespace, which would merge two patients),
 - a code with an **unrecognized or absent coding system**,
 - a unit that isn't valid **UCUM** (magnitudes are never converted),
 
-— the converter produces what it _can_ (often reduced in precision) and raises a **typed, value-free
-`TransformIssue`**: a stable code, the v2 location, and the FHIR path — never a value. Render a list
+the converter produces what it _can_ (often reduced in precision) and raises a **typed, value-free
+`TransformIssue`**: a stable code, the v2 location, and the FHIR path, never a value. Render a list
 of issues as a FHIR `OperationOutcome` with `toOperationOutcome(issues)`.
 
 ## The six datatype converters
@@ -83,8 +83,8 @@ of issues as a FHIR `OperationOutcome` with `toOperationOutcome(issues)`.
 
 ## Assemble a message
 
-`toFhir(msg)` takes a parsed `@cosyte/hl7` **ADT** message and returns a FHIR R4 **message `Bundle`** —
-a `MessageHeader`, then the `Patient` and `Encounter` (and `RelatedPerson`) it describes — plus the
+`toFhir(msg)` takes a parsed `@cosyte/hl7` **ADT** message and returns a FHIR R4 **message `Bundle`**:
+a `MessageHeader`, then the `Patient` and `Encounter` (and `RelatedPerson`) it describes, plus the
 value-free issues, each map grounded firsthand on the IG's segment/table ConceptMaps.
 
 ```ts
@@ -105,19 +105,19 @@ const { bundle, issues } = toFhir(parseHL7(raw), {
 | NK1     | `RelatedPerson` | NK1-2/3/4 → `name`/`relationship`/`address`                              |
 
 The fail-safe rule holds at the message level: an unmapped patient class, a naked timestamp, or an
-unresolvable authority becomes a typed issue — never a fabricated value. A trigger the IG has no
+unresolvable authority becomes a typed issue, never a fabricated value. A trigger the IG has no
 **message** map for is assembled from the segment maps and flagged, never invented; every emitted
 resource is validated against `@cosyte/fhir` before it ships.
 
 The same `toFhir(msg)` handles the other message families: **ORU^R01** → `DiagnosticReport` (OBR) +
-`Observation` (OBX), and the order-entry graph — **ORM_O01 / OML_O21** ORC/OBR →
-`ServiceRequest`, **RXO** (+ RXR route) → `MedicationRequest`, with `ServiceRequest.status`
+`Observation` (OBX), and the order-entry graph, **ORM_O01 / OML_O21** ORC/OBR →
+`ServiceRequest` and **RXO** (+ RXR route) → `MedicationRequest`, with `ServiceRequest.status`
 grounded on the HL70119 → request-status ConceptMap and withheld when it cannot be grounded, and a
 `MedicationRequest` whose IG-ungrounded status is the honest `unknown` rather than a guess. `RXE` has no
 STU1 IG map and is flagged, never assembled.
 
 The thin single-trigger families complete the IG-covered message set: **VXU_V04** RXA (+
-RXR route, ORC) → `Immunization` (status via the IG's three conditioned rows — a delete action →
+RXR route, ORC) → `Immunization` (status via the IG's three conditioned rows: a delete action →
 `entered-in-error`, an unvalued RXA-20 → `completed`, else the HL70322 → event-status ConceptMap, with a
 valued-but-unmapped code withheld), **SIU_S12** SCH/AIS/PID → `Appointment` (status via the
 HL70278 → appointmentstatus ConceptMap, the Patient wired as the required participant, its IG-unsourced
@@ -126,12 +126,12 @@ grounded only for TXA-19 `AV` → `current`, the document body base64-encoded ve
 interpreted). Timezone-naked instants are dropped and flagged, never assigned a fabricated UTC offset.
 
 `toFhirCodeableConceptVia(cwe, map)` applies a license-clean IG value ConceptMap
-(transcribed and verified firsthand against the raw published IG JSON) — **RXR** route/site
+(transcribed and verified firsthand against the raw published IG JSON): **RXR** route/site
 (HL70162/HL70550), **SCH-8** appointment type (HL70277), **RXO-9** substitution (HL70161), and **OBR-5**
-priority (HL70485) — translating the source table code to its FHIR target coding, additively (the raw
+priority (HL70485), translating the source table code to its FHIR target coding, additively (the raw
 coding is preserved alongside the derived one). It is fail-safe by refusal: a code the IG map leaves in
 its `(unmapped)` group is flagged, never coerced to a neighbour. Fields whose IG target is **SNOMED CT**
-(RXR-4 method, SCH-7 reason) stay structural — SNOMED is not bundled (BYO ConceptMap) — and fields the
+(RXR-4 method, SCH-7 reason) stay structural, because SNOMED is not bundled (BYO ConceptMap), and fields the
 IG ships no value map for (TXA-2 document type, RXA-5 vaccine code) are carried as-is, never invented.
 
 ## License

package/dist/index.cjs

@@ -7,16 +7,16 @@ var crypto = require('crypto');
 // src/diagnostics/codes.ts
 var ISSUE_CODES = {
   /** A v2 DTM/TS carried a time-of-day but no timezone offset. FHIR forbids time-without-zone, so
-   * the value was reduced to date precision (or an explicit sender offset applied via options) —
+   * the value was reduced to date precision (or an explicit sender offset applied via options),
    * **never** a guessed UTC. */
   TRANSFORM_TIMESTAMP_NO_TIMEZONE: "TRANSFORM_TIMESTAMP_NO_TIMEZONE",
   /** A v2 DTM/TS could not be parsed into a valid FHIR date/time; no value was emitted. */
   TRANSFORM_TIMESTAMP_INVALID: "TRANSFORM_TIMESTAMP_INVALID",
   /** The assigning authority (HD) could not be resolved to a FHIR `Identifier.system` URI via the
-   * NamingSystem registry. The identifier is emitted with its value and **no** system — a system URI
+   * NamingSystem registry. The identifier is emitted with its value and **no** system: a system URI
    * is **never** synthesized from HD.1 alone. */
   TRANSFORM_IDENTIFIER_SYSTEM_UNRESOLVED: "TRANSFORM_IDENTIFIER_SYSTEM_UNRESOLVED",
-  /** A coded value could not be mapped to a FHIR concept — either it carried no coding-system context
+  /** A coded value could not be mapped to a FHIR concept: either it carried no coding-system context
    * (CWE.3 absent), or it is a table code the IG ConceptMap has **no target** for (e.g. an OBX-11/
    * OBR-25 result status the HL70085/HL70123 map does not carry, or an OBX-8 abnormal flag absent from
    * HL70078). The original code is preserved / the FHIR value left absent; **never** coerced to a
@@ -26,14 +26,14 @@ var ISSUE_CODES = {
    * be emitted. The code is preserved; a URI is **never** invented. */
   TRANSFORM_CODE_SYSTEM_UNRESOLVED: "TRANSFORM_CODE_SYSTEM_UNRESOLVED",
   /** A unit was not a valid UCUM code (or was not declared UCUM). It is preserved verbatim in
-   * `Quantity.unit`; `Quantity.code`/`.system` are left absent — a UCUM code is **never** fabricated
+   * `Quantity.unit`; `Quantity.code`/`.system` are left absent: a UCUM code is **never** fabricated
    * and a magnitude is **never** converted. */
   TRANSFORM_UNIT_NOT_UCUM: "TRANSFORM_UNIT_NOT_UCUM",
-  /** A v2 numeric value (NM) could not be represented as a FHIR `decimal` without altering it — e.g.
+  /** A v2 numeric value (NM) could not be represented as a FHIR `decimal` without altering it, e.g.
    * a leading `+`, a leading zero, or a trailing dot, which FHIR's `decimal` lexical form forbids. No
    * `Quantity` value is emitted rather than a canonicalized (and therefore altered) magnitude. */
   TRANSFORM_QUANTITY_VALUE_INVALID: "TRANSFORM_QUANTITY_VALUE_INVALID",
-  /** A populated source element was not carried to its FHIR target and was dropped — either because
+  /** A populated source element was not carried to its FHIR target and was dropped, either because
    * the IG map defines no target, or because that target's conversion is **not implemented**
    * (e.g. XTN→ContactPoint telecom, PV1 participants). Surfaced here rather than silently discarded,
    * never a fabricated value. */
@@ -46,13 +46,13 @@ var ISSUE_CODES = {
   TRANSFORM_ADDRESS_USE_UNMAPPED: "TRANSFORM_ADDRESS_USE_UNMAPPED",
   /** The message's trigger event has no IG *message* map, so its resource graph was assembled from
    * the reusable IG *segment* maps rather than a message map. The graph is best-effort and flagged
-   * as such — never a fabricated message map. */
+   * as such, never a fabricated message map. */
   TRANSFORM_SEGMENT_ASSEMBLED: "TRANSFORM_SEGMENT_ASSEMBLED",
   /** A produced FHIR resource failed `@cosyte/fhir` R4 structural validation and was **withheld**
-   * from the bundle rather than emitted as a silently-invalid resource — the conservative-emit gate. */
+   * from the bundle rather than emitted as a silently-invalid resource: the conservative-emit gate. */
   TRANSFORM_RESOURCE_INVALID: "TRANSFORM_RESOURCE_INVALID",
   /** A FHIR-required element's value could not be faithfully derived from the source, so it was
-   * emitted with a `data-absent-reason` extension (value `unknown`) rather than fabricated — e.g.
+   * emitted with a `data-absent-reason` extension (value `unknown`) rather than fabricated, e.g.
    * `MessageHeader.source.endpoint` from an MSH-3 application namespace that is not a URL. */
   TRANSFORM_REQUIRED_ELEMENT_UNKNOWN: "TRANSFORM_REQUIRED_ELEMENT_UNKNOWN"
 };
@@ -165,7 +165,7 @@ function renderIssue(i) {
     prop("severity", fhir.primitive(i.severity)),
     prop("code", fhir.primitive(fhirIssueTypeFor(i.code))),
     prop("details", details),
-    // `diagnostics` carries the v2 source location — positional metadata, never a value.
+    // `diagnostics` carries the v2 source location: positional metadata, never a value.
     prop("diagnostics", fhir.primitive(i.v2Location))
   ];
   if (i.fhirPath !== void 0) {
@@ -1609,7 +1609,7 @@ var EMIT_SCHEMAS = Object.freeze([
   },
   {
     // Immunization: status (1..1 code), vaccineCode (1..1 CodeableConcept), patient (1..1 Reference), and
-    // occurrence[x] (1..1) are all required — the assembler only ever emits the occurrenceDateTime form, so
+    // occurrence[x] (1..1) are all required, and the assembler only ever emits the occurrenceDateTime form, so
     // it is required here. An RXA with no groundable status/vaccine/occurrence, or no bundle Patient, is
     // withheld rather than emitted incomplete.
     type: "Immunization",
@@ -1621,7 +1621,7 @@ var EMIT_SCHEMAS = Object.freeze([
     }
   },
   {
-    // Appointment: status (1..1 code) and participant (1..* BackboneElement) are both required — an
+    // Appointment: status (1..1 code) and participant (1..* BackboneElement) are both required, so an
     // Appointment whose SCH-25 status could not be grounded via HL70278, or that has no resolvable Patient
     // participant, is withheld rather than emitted with a guessed status or no participant.
     type: "Appointment",
@@ -1631,7 +1631,7 @@ var EMIT_SCHEMAS = Object.freeze([
     }
   },
   {
-    // DocumentReference: status (1..1 code) and content (1..* BackboneElement) are both required — a
+    // DocumentReference: status (1..1 code) and content (1..* BackboneElement) are both required, so a
     // reference whose TXA-19 is not "AV" (no groundable status), or that carries no document body from its
     // OBX segments, is withheld rather than emitted with a guessed status or referencing nothing.
     type: "DocumentReference",
@@ -2647,7 +2647,7 @@ function toFhir(msg, opts = {}) {
 }
 
 // src/index.ts
-var VERSION = "0.0.7";
+var VERSION = "0.0.9";
 
 exports.ADDRESS_TYPE_MAP = ADDRESS_TYPE_MAP;
 exports.ADDRESS_USE_MAP = ADDRESS_USE_MAP;