dicom-curate 0.40.1 → 0.40.3

package/dist/esm/applyMappingsWorker.js

@@ -86462,6 +86462,9 @@ var md5 = /* @__PURE__ */ createHasher(() => new _MD5());
 // src/hash.ts
 var import_js_crc = __toESM(require_crc(), 1);
 var DEFAULT_HASH_PART_SIZE = 5 * 1024 * 1024;
+function phiSafeToken(input) {
+  return bytesToHex(sha256(new TextEncoder().encode(input))).slice(0, 16);
+}
 async function hashStream(stream, hashMethod, hashPartSize) {
   switch (hashMethod) {
     case "sha256":
@@ -86824,11 +86827,13 @@ async function curateOne({
         error3
       );
       const mapResults = {
-        anomalies: [`Could not parse ${fileInfo.name} as DICOM data`],
-        errors: [
-          `File ${fileInfo.name} is not a valid DICOM file or is corrupted`
-        ],
-        sourceInstanceUID: `invalid_${fileInfo.name.replace(/[^a-zA-Z0-9]/g, "_")}`,
+        // PHI-safe strings: the raw filename is intentionally omitted because
+        // anomalies/errors are shared between the private (input) log and the
+        // server-bound (output) log. The raw name/path is carried only in
+        // fileInfo, keeping it in the private log. See #283.
+        anomalies: [`Could not parse file as DICOM data`],
+        errors: [`File is not a valid DICOM file or is corrupted`],
+        sourceInstanceUID: `invalid_${phiSafeToken(`${fileInfo.path}/${fileInfo.name}`)}`,
         fileInfo: {
           name: fileInfo.name,
           size: fileInfo.size,

package/dist/esm/curateOne.js

@@ -80171,6 +80171,9 @@ var md5 = /* @__PURE__ */ createHasher(() => new _MD5());
 // src/hash.ts
 var import_js_crc = __toESM(require_crc(), 1);
 var DEFAULT_HASH_PART_SIZE = 5 * 1024 * 1024;
+function phiSafeToken(input) {
+  return bytesToHex(sha256(new TextEncoder().encode(input))).slice(0, 16);
+}
 async function hashStream(stream, hashMethod, hashPartSize) {
   switch (hashMethod) {
     case "sha256":
@@ -80533,11 +80536,13 @@ async function curateOne({
         error3
       );
       const mapResults = {
-        anomalies: [`Could not parse ${fileInfo.name} as DICOM data`],
-        errors: [
-          `File ${fileInfo.name} is not a valid DICOM file or is corrupted`
-        ],
-        sourceInstanceUID: `invalid_${fileInfo.name.replace(/[^a-zA-Z0-9]/g, "_")}`,
+        // PHI-safe strings: the raw filename is intentionally omitted because
+        // anomalies/errors are shared between the private (input) log and the
+        // server-bound (output) log. The raw name/path is carried only in
+        // fileInfo, keeping it in the private log. See #283.
+        anomalies: [`Could not parse file as DICOM data`],
+        errors: [`File is not a valid DICOM file or is corrupted`],
+        sourceInstanceUID: `invalid_${phiSafeToken(`${fileInfo.path}/${fileInfo.name}`)}`,
         fileInfo: {
           name: fileInfo.name,
           size: fileInfo.size,

package/dist/esm/hash.js

@@ -800,6 +800,9 @@ var sha256 = /* @__PURE__ */ createHasher(
 // src/hash.ts
 var import_js_crc = __toESM(require_crc(), 1);
 var DEFAULT_HASH_PART_SIZE = 5 * 1024 * 1024;
+function phiSafeToken(input) {
+  return bytesToHex(sha256(new TextEncoder().encode(input))).slice(0, 16);
+}
 async function hash(buffer, hashMethod, hashPartSize) {
   switch (hashMethod) {
     case "sha256":
@@ -975,7 +978,8 @@ function crc64Hex(input) {
 }
 export {
   hash,
-  hashStream
+  hashStream,
+  phiSafeToken
 };
 /*! Bundled license information:
 

package/dist/esm/index.js

@@ -88025,6 +88025,9 @@ var md5 = /* @__PURE__ */ createHasher(() => new _MD5());
 // src/hash.ts
 var import_js_crc = __toESM(require_crc(), 1);
 var DEFAULT_HASH_PART_SIZE = 5 * 1024 * 1024;
+function phiSafeToken(input) {
+  return bytesToHex(sha256(new TextEncoder().encode(input))).slice(0, 16);
+}
 async function hash(buffer, hashMethod, hashPartSize) {
   switch (hashMethod) {
     case "sha256":
@@ -88427,11 +88430,13 @@ async function curateOne({
         error3
       );
       const mapResults = {
-        anomalies: [`Could not parse ${fileInfo.name} as DICOM data`],
-        errors: [
-          `File ${fileInfo.name} is not a valid DICOM file or is corrupted`
-        ],
-        sourceInstanceUID: `invalid_${fileInfo.name.replace(/[^a-zA-Z0-9]/g, "_")}`,
+        // PHI-safe strings: the raw filename is intentionally omitted because
+        // anomalies/errors are shared between the private (input) log and the
+        // server-bound (output) log. The raw name/path is carried only in
+        // fileInfo, keeping it in the private log. See #283.
+        anomalies: [`Could not parse file as DICOM data`],
+        errors: [`File is not a valid DICOM file or is corrupted`],
+        sourceInstanceUID: `invalid_${phiSafeToken(`${fileInfo.path}/${fileInfo.name}`)}`,
         fileInfo: {
           name: fileInfo.name,
           size: fileInfo.size,
@@ -94704,8 +94709,26 @@ async function dispatchMappingJobs() {
     console.log("job is finished");
     if (!mapResultsList)
       mapResultsList = [];
-    if (!mappingWorkerOptions.skipWrite) {
-      scanAnomalies.forEach(({ fileInfo, anomalies }) => {
+    scanAnomalies.forEach(({ fileInfo, anomalies, errors }) => {
+      const hasReadErrors = !!errors && errors.length > 0;
+      if (hasReadErrors) {
+        const scanErrorResult = {
+          // phiSafeToken rather than the sanitised name: this result reaches
+          // the server-bound log, so the UID must not encode the filename.
+          sourceInstanceUID: `scan_${phiSafeToken(`${fileInfo.path}/${fileInfo.name}`)}`,
+          // Intentionally no outputFilePath: an unread file has no
+          // de-identified output path, and we must not place the raw input
+          // path in the server-bound channel.
+          mappings: {},
+          anomalies: anomalies ?? [],
+          errors,
+          quarantine: {},
+          fileInfo
+        };
+        mapResultsList.push(scanErrorResult);
+        return;
+      }
+      if (!mappingWorkerOptions.skipWrite && anomalies.length > 0) {
         const scanAnomalyResult = {
           sourceInstanceUID: `scan_${fileInfo.name.replace(/[^a-zA-Z0-9]/g, "_")}`,
           outputFilePath: `${fileInfo.path}/${fileInfo.name}`,
@@ -94717,8 +94740,8 @@ async function dispatchMappingJobs() {
           quarantine: {}
         };
         mapResultsList.push(scanAnomalyResult);
-      });
-    }
+      }
+    });
     progressCallback({
       response: "done",
       mapResultsList,
@@ -94945,8 +94968,8 @@ async function initializeFileListWorker(rejectCallback) {
           break;
         }
         case "scanAnomalies": {
-          const { fileInfo: anomalyFileInfo, anomalies } = event.data;
-          scanAnomalies.push({ fileInfo: anomalyFileInfo, anomalies });
+          const { fileInfo: anomalyFileInfo, anomalies, errors } = event.data;
+          scanAnomalies.push({ fileInfo: anomalyFileInfo, anomalies, errors });
           break;
         }
         case "count": {

package/dist/esm/mappingWorkerPool.js

@@ -86462,6 +86462,9 @@ var md5 = /* @__PURE__ */ createHasher(() => new _MD5());
 // src/hash.ts
 var import_js_crc = __toESM(require_crc(), 1);
 var DEFAULT_HASH_PART_SIZE = 5 * 1024 * 1024;
+function phiSafeToken(input) {
+  return bytesToHex(sha256(new TextEncoder().encode(input))).slice(0, 16);
+}
 async function hashStream(stream, hashMethod, hashPartSize) {
   switch (hashMethod) {
     case "sha256":
@@ -86824,11 +86827,13 @@ async function curateOne({
         error3
       );
       const mapResults = {
-        anomalies: [`Could not parse ${fileInfo.name} as DICOM data`],
-        errors: [
-          `File ${fileInfo.name} is not a valid DICOM file or is corrupted`
-        ],
-        sourceInstanceUID: `invalid_${fileInfo.name.replace(/[^a-zA-Z0-9]/g, "_")}`,
+        // PHI-safe strings: the raw filename is intentionally omitted because
+        // anomalies/errors are shared between the private (input) log and the
+        // server-bound (output) log. The raw name/path is carried only in
+        // fileInfo, keeping it in the private log. See #283.
+        anomalies: [`Could not parse file as DICOM data`],
+        errors: [`File is not a valid DICOM file or is corrupted`],
+        sourceInstanceUID: `invalid_${phiSafeToken(`${fileInfo.path}/${fileInfo.name}`)}`,
         fileInfo: {
           name: fileInfo.name,
           size: fileInfo.size,
@@ -93104,8 +93109,26 @@ async function dispatchMappingJobs() {
     console.log("job is finished");
     if (!mapResultsList)
       mapResultsList = [];
-    if (!mappingWorkerOptions.skipWrite) {
-      scanAnomalies.forEach(({ fileInfo, anomalies }) => {
+    scanAnomalies.forEach(({ fileInfo, anomalies, errors }) => {
+      const hasReadErrors = !!errors && errors.length > 0;
+      if (hasReadErrors) {
+        const scanErrorResult = {
+          // phiSafeToken rather than the sanitised name: this result reaches
+          // the server-bound log, so the UID must not encode the filename.
+          sourceInstanceUID: `scan_${phiSafeToken(`${fileInfo.path}/${fileInfo.name}`)}`,
+          // Intentionally no outputFilePath: an unread file has no
+          // de-identified output path, and we must not place the raw input
+          // path in the server-bound channel.
+          mappings: {},
+          anomalies: anomalies ?? [],
+          errors,
+          quarantine: {},
+          fileInfo
+        };
+        mapResultsList.push(scanErrorResult);
+        return;
+      }
+      if (!mappingWorkerOptions.skipWrite && anomalies.length > 0) {
         const scanAnomalyResult = {
           sourceInstanceUID: `scan_${fileInfo.name.replace(/[^a-zA-Z0-9]/g, "_")}`,
           outputFilePath: `${fileInfo.path}/${fileInfo.name}`,
@@ -93117,8 +93140,8 @@ async function dispatchMappingJobs() {
           quarantine: {}
         };
         mapResultsList.push(scanAnomalyResult);
-      });
-    }
+      }
+    });
     progressCallback({
       response: "done",
       mapResultsList,

package/dist/esm/scanDirectoryWorker.js

@@ -37136,6 +37136,18 @@ var DEFAULT_EXCLUDED_FILETYPES = [
   "thumbs.db",
   ".ds_store"
 ];
+function safeReadErrorMessage(error2) {
+  let detail = "unknown error";
+  if (error2 && typeof error2 === "object") {
+    const { code, name } = error2;
+    if (typeof code === "string" && code) {
+      detail = code;
+    } else if (typeof name === "string" && name) {
+      detail = name;
+    }
+  }
+  return `Unable to read file (filesystem error): ${detail}`;
+}
 var keepScanning = true;
 var pauseResolve = null;
 var pausePromise = null;
@@ -37445,9 +37457,36 @@ async function scanDirectory(dir) {
       if (!keepScanning)
         return;
       if (entry.kind === "file") {
-        const file = await entry.getFile();
         const key = `${prefix}/${entry.name}`;
         const prev = previousIndex ? previousIndex[key] : void 0;
+        let file;
+        try {
+          file = await entry.getFile();
+        } catch (readError) {
+          if (cheapFilterNameOnly(entry.name, key)) {
+            totalDiscovered--;
+            globalThis.postMessage({
+              response: "count",
+              totalDiscovered
+            });
+          }
+          globalThis.postMessage({
+            response: "scanAnomalies",
+            fileInfo: {
+              path: prefix,
+              name: entry.name,
+              size: 0,
+              kind: "handle",
+              fileHandle: entry
+            },
+            anomalies: [],
+            errors: [safeReadErrorMessage(readError)],
+            previousFileInfo: prev
+          });
+          if (!await waitIfPaused())
+            return;
+          continue;
+        }
         const fileAnomalies = [];
         if (await shouldProcessFile(file, fileAnomalies, key)) {
           globalThis.postMessage({
@@ -37545,9 +37584,36 @@ async function scanDirectoryNode(dirPath) {
           return;
         if (entry.isFile()) {
           const filePath = path.join(currentPath, entry.name);
-          const stats = await fs.stat(filePath);
           const key = `${prefix}/${entry.name}`;
           const prev = previousIndex ? previousIndex[key] : void 0;
+          let stats;
+          try {
+            stats = await fs.stat(filePath);
+          } catch (readError) {
+            if (cheapFilterNameOnly(entry.name, key)) {
+              totalDiscovered--;
+              globalThis.postMessage({
+                response: "count",
+                totalDiscovered
+              });
+            }
+            globalThis.postMessage({
+              response: "scanAnomalies",
+              fileInfo: {
+                path: prefix,
+                name: entry.name,
+                size: 0,
+                kind: "path",
+                fullPath: filePath
+              },
+              anomalies: [],
+              errors: [safeReadErrorMessage(readError)],
+              previousFileInfo: prev
+            });
+            if (!await waitIfPaused())
+              return;
+            continue;
+          }
           const fileAnomalies = [];
           if (await shouldProcessFileNode(
             filePath,

package/dist/types/hash.d.ts

@@ -1,4 +1,12 @@
 import type { THashMethod } from './types';
+/**
+ * Derive a short, stable, PHI-safe token from a string (e.g. a file path).
+ * Used to build synthetic sourceInstanceUIDs for files that failed to read or
+ * parse, where embedding the (sanitised) filename would leak PHI into the
+ * server-bound log. Same input always yields the same token, so results stay
+ * correlatable across passes and runs.
+ */
+export declare function phiSafeToken(input: string): string;
 export declare function hash(buffer: ArrayBuffer, hashMethod: THashMethod, hashPartSize?: number): Promise<string>;
 /**
  * Computes a hash over a stream of data chunks without materializing the full

package/dist/types/mappingWorkerPool.d.ts

@@ -27,6 +27,7 @@ export declare function setDirectoryScanFinished(value: boolean): void;
 export declare let scanAnomalies: {
     fileInfo: TFileInfo;
     anomalies: string[];
+    errors?: string[];
 }[];
 export declare function setMappingWorkerOptions(opts: TMappingWorkerOptions): void;
 export declare function setCustomUploader(uploader: TCustomUploader | undefined): void;

package/dist/types/scanDirectoryWorker.d.ts

@@ -11,6 +11,15 @@ export type FileScanMsg = {
     response: 'scanAnomalies';
     fileInfo: TFileInfo;
     anomalies: string[];
+    /**
+     * Hard errors discovered during scanning (e.g. a file that cannot be
+     * read at all via the FileSystem API / fs.stat). Unlike `anomalies`
+     * (benign findings such as non-DICOM or too-small files), these are
+     * surfaced as errors so they are visible regardless of pass. The string
+     * MUST NOT contain the raw filename/path — that is carried only in
+     * `fileInfo` so it stays in the private (input) log.
+     */
+    errors?: string[];
     previousFileInfo?: {
         size?: number;
         mtime?: string;

package/dist/umd/dicom-curate.umd.js

@@ -54699,6 +54699,16 @@
       var crcExports = requireCrc();
 
       const DEFAULT_HASH_PART_SIZE = 5 * 1024 * 1024; // 5 MB — matches @aws-sdk/lib-storage default
+      /**
+       * Derive a short, stable, PHI-safe token from a string (e.g. a file path).
+       * Used to build synthetic sourceInstanceUIDs for files that failed to read or
+       * parse, where embedding the (sanitised) filename would leak PHI into the
+       * server-bound log. Same input always yields the same token, so results stay
+       * correlatable across passes and runs.
+       */
+      function phiSafeToken(input) {
+          return bytesToHex(sha256(new TextEncoder().encode(input))).slice(0, 16);
+      }
       /**
        * Computes a hash over a stream of data chunks without materializing the full
        * data into memory at once.
@@ -55131,11 +55141,13 @@
               catch (error) {
                   console.warn(`[dicom-curate] Could not parse ${fileInfo.name} as DICOM data:`, error);
                   const mapResults = {
-                      anomalies: [`Could not parse ${fileInfo.name} as DICOM data`],
-                      errors: [
-                          `File ${fileInfo.name} is not a valid DICOM file or is corrupted`,
-                      ],
-                      sourceInstanceUID: `invalid_${fileInfo.name.replace(/[^a-zA-Z0-9]/g, '_')}`,
+                      // PHI-safe strings: the raw filename is intentionally omitted because
+                      // anomalies/errors are shared between the private (input) log and the
+                      // server-bound (output) log. The raw name/path is carried only in
+                      // fileInfo, keeping it in the private log. See #283.
+                      anomalies: [`Could not parse file as DICOM data`],
+                      errors: [`File is not a valid DICOM file or is corrupted`],
+                      sourceInstanceUID: `invalid_${phiSafeToken(`${fileInfo.path}/${fileInfo.name}`)}`,
                       fileInfo: {
                           name: fileInfo.name,
                           size: fileInfo.size,
@@ -68860,6 +68872,28 @@
             'thumbs.db',
             '.ds_store',
         ];
+        /**
+         * Build a PHI-safe error message for a file that could not be read during
+         * scanning. Only the error code/name is included — never `error.message`,
+         * because node fs errors embed the full raw path in the message (e.g.
+         * "ENOENT: no such file or directory, stat '/path/to/file.dcm'") and this
+         * string goes into `errors`, which is shared between the private and
+         * server-bound logs. The raw path/name is carried separately in `fileInfo`
+         * so it appears only in the private (input) log.
+         */
+        function safeReadErrorMessage(error) {
+            let detail = 'unknown error';
+            if (error && typeof error === 'object') {
+                const { code, name } = error;
+                if (typeof code === 'string' && code) {
+                    detail = code;
+                }
+                else if (typeof name === 'string' && name) {
+                    detail = name;
+                }
+            }
+            return `Unable to read file (filesystem error): ${detail}`;
+        }
         let keepScanning = true;
         // Backpressure gate: when the main thread signals 'stop', the feeder
         // awaits this promise before emitting the next file. 'resume' resolves it.
@@ -69242,9 +69276,42 @@
                     if (!keepScanning)
                         return;
                     if (entry.kind === 'file') {
-                        const file = await entry.getFile();
                         const key = `${prefix}/${entry.name}`;
                         const prev = previousIndex ? previousIndex[key] : undefined;
+                        let file;
+                        try {
+                            file = await entry.getFile();
+                        }
+                        catch (readError) {
+                            // A single file we cannot read (corrupted, locked, permission
+                            // revoked via the Chromium FileSystem API) must NOT abort the whole
+                            // scan. Report it as a hard error and continue. The error string is
+                            // PHI-safe (no filename); the raw path/name lives only in fileInfo,
+                            // which keeps it in the private (input) log.
+                            if (cheapFilterNameOnly(entry.name, key)) {
+                                totalDiscovered--;
+                                globalThis.postMessage({
+                                    response: 'count',
+                                    totalDiscovered,
+                                });
+                            }
+                            globalThis.postMessage({
+                                response: 'scanAnomalies',
+                                fileInfo: {
+                                    path: prefix,
+                                    name: entry.name,
+                                    size: 0,
+                                    kind: 'handle',
+                                    fileHandle: entry,
+                                },
+                                anomalies: [],
+                                errors: [safeReadErrorMessage(readError)],
+                                previousFileInfo: prev,
+                            });
+                            if (!(await waitIfPaused()))
+                                return;
+                            continue;
+                        }
                         const fileAnomalies = [];
                         if (await shouldProcessFile(file, fileAnomalies, key)) {
                             globalThis.postMessage({
@@ -69362,9 +69429,41 @@
                             return;
                         if (entry.isFile()) {
                             const filePath = path.join(currentPath, entry.name);
-                            const stats = await fs.stat(filePath);
                             const key = `${prefix}/${entry.name}`;
                             const prev = previousIndex ? previousIndex[key] : undefined;
+                            let stats;
+                            try {
+                                stats = await fs.stat(filePath);
+                            }
+                            catch (readError) {
+                                // A single file we cannot stat (vanished, permission denied) must
+                                // NOT abort the whole scan. Report it as a hard error and continue.
+                                // The error string is PHI-safe (no path); the raw path lives only
+                                // in fileInfo, keeping it in the private (input) log.
+                                if (cheapFilterNameOnly(entry.name, key)) {
+                                    totalDiscovered--;
+                                    globalThis.postMessage({
+                                        response: 'count',
+                                        totalDiscovered,
+                                    });
+                                }
+                                globalThis.postMessage({
+                                    response: 'scanAnomalies',
+                                    fileInfo: {
+                                        path: prefix,
+                                        name: entry.name,
+                                        size: 0,
+                                        kind: 'path',
+                                        fullPath: filePath,
+                                    },
+                                    anomalies: [],
+                                    errors: [safeReadErrorMessage(readError)],
+                                    previousFileInfo: prev,
+                                });
+                                if (!(await waitIfPaused()))
+                                    return;
+                                continue;
+                            }
                             const fileAnomalies = [];
                             if (await shouldProcessFileNode(filePath, entry.name, stats.size, fileAnomalies, key)) {
                                 globalThis.postMessage({
@@ -126280,6 +126379,16 @@
     var crcExports = requireCrc();
 
     const DEFAULT_HASH_PART_SIZE = 5 * 1024 * 1024; // 5 MB — matches @aws-sdk/lib-storage default
+    /**
+     * Derive a short, stable, PHI-safe token from a string (e.g. a file path).
+     * Used to build synthetic sourceInstanceUIDs for files that failed to read or
+     * parse, where embedding the (sanitised) filename would leak PHI into the
+     * server-bound log. Same input always yields the same token, so results stay
+     * correlatable across passes and runs.
+     */
+    function phiSafeToken(input) {
+        return bytesToHex(sha256(new TextEncoder().encode(input))).slice(0, 16);
+    }
     async function hash(buffer, hashMethod, hashPartSize) {
         switch (hashMethod) {
             case 'sha256':
@@ -126773,11 +126882,13 @@
             catch (error) {
                 console.warn(`[dicom-curate] Could not parse ${fileInfo.name} as DICOM data:`, error);
                 const mapResults = {
-                    anomalies: [`Could not parse ${fileInfo.name} as DICOM data`],
-                    errors: [
-                        `File ${fileInfo.name} is not a valid DICOM file or is corrupted`,
-                    ],
-                    sourceInstanceUID: `invalid_${fileInfo.name.replace(/[^a-zA-Z0-9]/g, '_')}`,
+                    // PHI-safe strings: the raw filename is intentionally omitted because
+                    // anomalies/errors are shared between the private (input) log and the
+                    // server-bound (output) log. The raw name/path is carried only in
+                    // fileInfo, keeping it in the private log. See #283.
+                    anomalies: [`Could not parse file as DICOM data`],
+                    errors: [`File is not a valid DICOM file or is corrupted`],
+                    sourceInstanceUID: `invalid_${phiSafeToken(`${fileInfo.path}/${fileInfo.name}`)}`,
                     fileInfo: {
                         name: fileInfo.name,
                         size: fileInfo.size,
@@ -140785,10 +140896,41 @@
             console.log('job is finished');
             if (!mapResultsList)
                 mapResultsList = [];
-            // Create individual mapResults entries for each scan anomaly
-            // Only do this during actual processing (not first pass)
-            if (!mappingWorkerOptions.skipWrite) {
-                scanAnomalies.forEach(({ fileInfo, anomalies }) => {
+            // Create individual mapResults entries for each scan finding.
+            //
+            // Two kinds of scan findings are surfaced differently:
+            //
+            //  - Benign anomalies (non-DICOM, too-small, excluded filetypes): noise
+            //    during the first pass (form generation), so only emitted on the
+            //    write pass (!skipWrite), and they carry the input path in
+            //    `outputFilePath` as before.
+            //
+            //  - Hard read errors (file could not be read at all): always surfaced,
+            //    in both passes, via `errors`. We deliberately OMIT `outputFilePath`
+            //    so the raw input path is not leaked into the server-bound log; the
+            //    raw path is retained in `fileInfo` for the private (input) log, and a
+            //    path-less trace is rendered in the server-bound log by the consumer.
+            scanAnomalies.forEach(({ fileInfo, anomalies, errors }) => {
+                const hasReadErrors = !!errors && errors.length > 0;
+                if (hasReadErrors) {
+                    const scanErrorResult = {
+                        // phiSafeToken rather than the sanitised name: this result reaches
+                        // the server-bound log, so the UID must not encode the filename.
+                        sourceInstanceUID: `scan_${phiSafeToken(`${fileInfo.path}/${fileInfo.name}`)}`,
+                        // Intentionally no outputFilePath: an unread file has no
+                        // de-identified output path, and we must not place the raw input
+                        // path in the server-bound channel.
+                        mappings: {},
+                        anomalies: anomalies ?? [],
+                        errors,
+                        quarantine: {},
+                        fileInfo,
+                    };
+                    mapResultsList.push(scanErrorResult);
+                    return;
+                }
+                // Benign anomalies: only on the write pass.
+                if (!mappingWorkerOptions.skipWrite && anomalies.length > 0) {
                     const scanAnomalyResult = {
                         sourceInstanceUID: `scan_${fileInfo.name.replace(/[^a-zA-Z0-9]/g, '_')}`,
                         outputFilePath: `${fileInfo.path}/${fileInfo.name}`, // Use the actual file path
@@ -140797,10 +140939,9 @@
                         errors: [],
                         quarantine: {},
                     };
-                    // Add each scan anomaly result to the final results
                     mapResultsList.push(scanAnomalyResult);
-                });
-            }
+                }
+            });
             progressCallback({
                 response: 'done',
                 mapResultsList: mapResultsList,
@@ -141086,8 +141227,8 @@
                 }
                 case 'scanAnomalies': {
                     // Handle scan anomalies separately - they don't go to processing
-                    const { fileInfo: anomalyFileInfo, anomalies } = event.data;
-                    scanAnomalies.push({ fileInfo: anomalyFileInfo, anomalies });
+                    const { fileInfo: anomalyFileInfo, anomalies, errors } = event.data;
+                    scanAnomalies.push({ fileInfo: anomalyFileInfo, anomalies, errors });
                     break;
                 }
                 case 'count': {