fix(deps): install the hl7 peer from npm, and unpin a fixed correlation bug - #64
Merged
Conversation
…on bug The vendored `vendor/cosyte-hl7-0.0.0.tgz` held @cosyte/hl7 at 0.0.0 and never moved while that package shipped ten releases. Deleted; the dev/test peer now resolves from the registry at ^0.0.10, the range every other @cosyte/* dependency already uses. WHAT THE PIN WAS HIDING, which is the reason this is not a chore: @cosyte/hl7 fixed the MSA-2 echo to be byte-verbatim across the full escape alphabet, and its changelog names THIS package's correlation as the reason for the fix. The pinned copy never picked it up, so test/ack-from-hl7/control-id-verbatim.test.ts spent ten releases asserting the DEFECT as a guarantee: an inbound MSH-10 of `ID\X` echoed back `ID\E\X`. That is a different control id on the wire, so an ACK the sender cannot correlate, so a resend, so a duplicate clinical message. The case moves out of the "cannot preserve, warns" table and is pinned inverted, as a round-trip that must match the byte-copy path and must not warn. test/phi/diagnostic-phi-leak.test.ts used the same `\X` control id to reach the NOT_VERBATIM branch. It now plants trailing whitespace, which still canonicalizes away. Worth noting it failed LOUDLY rather than passing vacuously: runAckGate asserts the code it expects actually appeared, so a plant that stops reaching its branch reds instead of proving nothing. No runtime surface changes. hl7 stays an optional peer used only from the ack-from-hl7 subpath; framing, ACK and warning codes are untouched. Docs and gates follow the code. The NUL-exclusion shape of check-no-emdash STAYS even though the only binary that forced it is gone: the property belongs to tracked binaries as a class, the OK line still reports the count (now 0, was 1), and dropping it would be deleting a trap because the specimen left the room.
NSchatz
force-pushed
the
chore/published-hl7-dep
branch
from
August 11, 2026 02:56
cfbaa5a to
296a69a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Deletes
vendor/cosyte-hl7-0.0.0.tgzand resolves the dev/test@cosyte/hl7peer from the npm registry at^0.0.10.Why this is not a chore
The tarball held
@cosyte/hl7at0.0.0and never moved while that package shipped ten releases. One of them made the MSA-2 control-id echo byte-verbatim across the full escape alphabet, and its changelog names this package's correlation as the reason for the fix.The pinned copy never picked it up, so
test/ack-from-hl7/control-id-verbatim.test.tsspent ten releases asserting the defect as a guarantee: an inboundMSH-10ofID\Xechoed back asID\E\X. A different control id on the wire is an ACK the sender cannot correlate, which is a resend, which is a duplicate clinical message.What changed
test/phi/diagnostic-phi-leak.test.tsused that same\Xid to reach theNOT_VERBATIMbranch. It now plants trailing whitespace, which still canonicalizes away. It failed loudly rather than passing vacuously, becauserunAckGateasserts the code it expects actually appeared.@cosyte/hl7stays an optional peer used only from theack-from-hl7subpath; framing, ACK and warning codes are untouched.Gates
verify.shgreen (typecheck, lint, format, phi-scan, no-emdash, no-internal-refs, coverage, build, attw), pluscheck:agent-notesrun separately since the ladder does not know it.The
check-no-emdashNUL-exclusion shape stays even though the only binary that forced it is gone: the property belongs to tracked binaries as a class, the OK line still reports the count (now 0, was 1), and dropping it would be deleting a trap because the specimen left the room.