@cosyte/x12 0.0.6 → 0.0.8

package/CHANGELOG.md

@@ -42,8 +42,87 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   a warning `message` is a frozen-registry lookup with positional metadata only, but an orphan is
   document content, verbatim, exactly like `tx.rawSegments`. Log `context` and `segmentIndex`.
 
+### Security
+
+- **The PHI scanner refuses an in-scope entry that is not a regular file, on both of its enumerating
+  routes.** A symbolic link under a scan root pointing at a PHI-bearing file used to scan CLEAN on
+  both, so the pre-commit gate and CI both reported "no hits" over a capture the scan never read.
+  Measured on `5779542`, against a throwaway repository laid out like this one, using a synthetic
+  `.edi` payload whose NM1 person name, DMG date of birth, PER phone and `REF*SY` SSN are all hits at
+  exit 1 when the same bytes sit at a regular file:
+  - the all-mode walk enumerates `Dirent.isFile()`, which is an lstat answer, so a link is neither a
+    file nor a directory and fell out of the loop silently. A link under `test/fixtures`, a link
+    under `src/`, and a linked DIRECTORY (which takes a whole subtree with it) each reported
+    `OK - no hits` at exit 0;
+  - `--staged` reads content with `git show :<path>`, and git stores a link as its TARGET PATH under
+    mode `120000`, so that route was handed the path text and never the target's bytes. A staged
+    link reported `OK - no hits` at exit 0.
+
+  Both routes now refuse the scan (exit 2, the existing "could not complete" code) and name every
+  offender, not just the first. Neither route is made to FOLLOW an ENTRY it enumerated: following
+  would read bytes the enumeration does not control, and git does not carry those bytes anyway, so a
+  hit on them would be a claim about something no commit contains. That is a statement about an
+  entry, not about a scan ROOT: a walk root that is itself a link is still followed, because
+  `existsSync` and `readdirSync` both follow. Measured identically before and after this change, that
+  direction produces a superset scan rather than a blind one (the target's files are enumerated under
+  their in-root names and hit, exit 1), so it is deliberately left alone.
+
+  **A refusal names the entry's own repo-relative path and a scanner-owned token for its kind. It
+  never reports the link target**, which is working-tree text that can itself carry PHI: a target
+  path of the shape `<surname>-<given>-<dob>.edi` is the whole reason. That shape is written out
+  rather than shown, because a diagnostic about a PHI leak is itself a PHI surface. The concern was
+  not hypothetical here: measured at base, a staged link whose target name was a dashed-SSN shape
+  exited 1 and printed that shape, because `git show` handed the path text straight to the
+  cross-cutting shape pass.
+
+  **The `--staged` filter is now `AMT`, and `T` is the one-letter difference that made the mode check
+  reachable.** Replacing a TRACKED regular file with a link is neither an add nor a modify: measured
+  on this tree, `git diff --cached --raw --diff-filter=AM` returned zero rows for that change while
+  the unfiltered `--raw` showed `:100644 120000 <sha> <sha> T`. Without `T` the record died before
+  any mode could be read and the hook passed a mode-`120000` blob green. Admitting `T` also covers
+  the reverse typechange, a link replaced by a real file bearing PHI. The route reads
+  `git diff --cached --raw -z` rather than `--name-only` because the destination mode is the only
+  thing that distinguishes a staged regular file from a staged link or gitlink, and
+  `git show :<path>` answers all three without complaint. A record that does not parse refuses rather
+  than being skipped.
+
+  **Each route keeps its own existing boundary**: the walk still excludes a gitignored entry (the same
+  rule that already excludes a gitignored file), and `--staged` still looks only at
+  `test/fixtures/**` and `src/**.ts`. This narrows what those scopes admit; it does not widen them.
+  A gitlink under a scanned prefix already exited 2 before this change, but by `git show` failing and
+  echoing git's own text; it is now refused at enumeration and named by kind.
+
+  **`paths` mode is deliberately unchanged, because it was never blind**: it reads with
+  `readFileSync`, which follows a link, so an explicitly named path that is a link to a PHI-bearing
+  file is scanned and hits (measured, exit 1).
+
+  **Not closed here, and stated rather than implied**: `R` (rename) and `C` (copy) are still not
+  enumerated by `--staged` at all, which is pre-existing and needs the two-path `--raw` record shape
+  handled. Measured, so the cost is not left to inference: renaming a fixture while substituting a
+  real name stages as `:100644 100644 <sha> <sha> R080 <old> <new>`, which both `AM` and `AMT` return
+  zero rows for, and `--staged` exits 0 over a payload that is a hit as an ordinary add; `git mv` of
+  an already-committed link into `test/fixtures/` is `R100` and is likewise not refused. The all-mode
+  sweep is the backstop for both (exit 1 and exit 2 respectively), so the gap is at pre-commit, not
+  in CI. Also unclosed: a scan that observed nothing is still reported clean rather than refused; and
+  the
+  enumerate-then-read window in all mode is untouched, because tolerating a failed read pulls the
+  opposite way from narrowing what the enumeration admits and belongs in its own change. No library
+  code changed and no published type changed.
+
 ### Fixed
 
+- **The `attw` publish gate no longer passes a tarball that carries no type declarations.** The
+  `attw` script was the bare CLI, and `@arethetypeswrong/cli` returns 0 whenever its analysis found
+  no types at all, before it reads the problem list. For a package that ships types, "This package
+  does not contain types." means the declarations were missing from the tarball, which is a broken
+  publish that the gate reported as a pass. Reproduced against this package with no concurrency
+  involved: with `dist/` removed, and with only `dist/index.d.ts` and `dist/index.d.cts` removed,
+  the CLI printed that sentence and exited 0 in both cases. The second is a state every build passes
+  through, because `tsup` writes the JS before the declarations (measured at 1.92 seconds apart on
+  one clean build here). `pnpm attw` now runs `scripts/attw.mjs`, which checks that every relative
+  path `package.json` promises exists and is non-empty before invoking the CLI, and fails afterwards
+  if the CLI still reports an untyped package. No change to the library or to any published type.
+
 - **A `defineProfile()` refusal message no longer grows with the value you passed in.** Twelve
   refusal sites in `src/profiles/validate.ts` hold twenty-three caller-value holes between them, and
   every one now routes through `renderCallerValue` or `renderCallerJson`. Re-derived on this tree
@@ -286,6 +365,56 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Tests
 
+- **The PHI-scanner suite stopped paying 30 of its 32 `tsx` start-ups, and the global `testTimeout`
+  now says what it does and does not cover.** No library code, no public surface and no timeout value
+  changed; `scripts/phi-scan.ts` and `scripts/attw.mjs` are untouched.
+
+  Nearly every case in `test/scripts/phi-scan.test.ts` spawns the scanner. Counted at runtime on
+  both trees with a `spawnSync` shim: **32 spawns across 32 cases, all under `tsx`**, becoming
+  **36 spawns across 33 cases, 34 under `node` and 2 under `tsx`**. So 30 `tsx` start-ups were
+  removed and 2 were kept deliberately, in the equivalence case below. The scanner is type-annotated
+  Node that needs erasing and nothing more, and Node 22.18 or newer strips types itself, so the
+  spawns now use `process.execPath`. Measured on a 12-CPU cgroup quota with
+  `availableParallelism()` 12 and other workers running (load average 8.9 to 11.3, a realistic
+  condition rather than a quiet one): one scanner start is a 441 ms median under `tsx` against
+  149 ms under `node`, seven runs each. Interleaved BASE/HEAD under `pnpm test:coverage`, two rounds
+  each so the arms share a load condition, that file went 17.2 s / 17.5 s to 8.6 s / 8.6 s, and
+  15.7 s to 6.6 s run on its own. Total CPU across all workers went 58.9 s / 58.4 s to
+  50.5 s / 49.5 s. Those medians predict 8.2 s off this file (32 starts converted, less the 2 `node`
+  and 2 `tsx` starts the new case adds) against 9.1 s measured, so the model is the right shape and
+  about 11% light, not a match.
+
+  **The substitution is pinned as an equivalence rather than assumed.** The gate consumers actually
+  run (`pnpm phi-scan`, the pre-commit hook, CI) still invokes `tsx`, so one new case drives both
+  runners over the same violator and the same clean file and requires the same exit code, stdout and
+  stderr. It is the only place `tsx` is still spawned, and a simulated divergence reds it. **Scope it
+  honestly:** that case drives `paths` mode on one hit and one clean file, so it pins the exit-0 and
+  exit-1 verdicts and not the exit-2 refusals, nor all-mode, nor `--staged`. It is aimed at the only
+  divergence these two runners plausibly have, which is at module load, and a load-time divergence
+  cannot be confined to the routes it does not drive.
+
+  **What this did not buy, stated because the two figures diverge:** it removed about 8.6 s of CPU
+  but barely moved the suite's critical path (17.2 s / 17.5 s to 16.3 s / 16.7 s), which is now
+  `test/scripts/attw-gate.test.ts`. That file is deliberately left alone: measured, one `attw --pack`
+  on a trivial two-file package is 1,596 ms median, of which the real `npm pack` is 462 ms and the
+  rest is attw's own analysis. There is no runner to substitute there, pinning the real binary is the
+  point of that gate, and each of its cases already carries its own 60 s ceiling.
+
+  **`vitest.config.ts` now documents the scope of `testTimeout: 10_000`, which is narrower than it
+  looks in both directions.** It is a floor for ordinary tests, not where slow work gets its room:
+  the three slowest suites already take per-test ceilings, and the 10 MB+ 834 stream measured
+  8.9 s / 10.0 s / 9.3 s / 9.1 s across the four interleaved runs, so it sits AT the 10 s global on a
+  merely-loaded box (a 10.0 s reading is not evidence of which side of the bar it fell), and measured
+  24.1 s under heavier load on the same box. It is green only on its own 120 s ceiling. Raising the
+  global to
+  fit it would hand the same leash to all 1,100-odd tests and turn a genuinely hung test from broken
+  into merely slow. It is also **not a liveness net**: measured on this tree with vitest 4.1.4, an
+  async overrun reds at the ceiling, a finite synchronous overrun reds only after the work returns,
+  and an infinite synchronous loop produces no verdict at all, wedging the worker until it is killed
+  from outside (45 s, exit 143, no pass/fail line). That is the failure mode
+  `X12-CALLER-VALUE-RESIDUALS` hit for real, and the defence against it is the source scan in
+  `test/builder-array-bounds.test.ts`, not any timeout value.
+
 - **The default emit mode's guarantees are locked against the whole committed corpus, not just the 13
   goldens.** The goldens are already in the serializer's image, so they could only ever demonstrate
   the easy half of the round trip. `test/serialize.test.ts` now discovers every `.edi` fixture from

package/dist/index.cjs

@@ -9892,7 +9892,7 @@ var profiles = Object.freeze({
 });
 
 // src/index.ts
-var VERSION = "0.0.6";
+var VERSION = "0.0.8";
 
 exports.ACK_BUILD_ERROR_CODES = ACK_BUILD_ERROR_CODES;
 exports.ALL_WARNING_MESSAGES = ALL_WARNING_MESSAGES;