[NSchatz]

Draft: not green, and the remaining reds need decisions on tests that guard src/. Everything that can be done without touching those is here.

What this does

• package.json: the six file:vendor/...tgz devDependencies (@cosyte/ccda, dicom, fhir, hl7, ncpdp, x12) move to the registry ^0.1.0. Optional peer ranges (>=0.0.0) are unchanged.
• pnpm-lock.yaml: regenerated with the pinned pnpm 10.0.0. Only the six @cosyte entries change; every integrity hash matches npm view @cosyte/<pkg>@0.1.0 dist.integrity; the transitive @xmldom/xmldom 0.9.10 and fast-xml-parser 5.10.1 pins are unchanged.
• vendor/*.tgz (six tarballs) deleted.
• scripts/check-no-emdash.sh: the gate refuses an exclusion whose prefix matches no tracked file and names the remedy ("Remove the rule deliberately"), so the vendor/ rule is removed and a file under vendor/ is scanned like any other. Test 6 now pins that; test 7 proves the stale-exclusion refusal with test/fixtures/.
• scripts/phi-scan.ts: INDEX_EXCLUDED_PREFIXES is empty, so the index route reads a file committed under vendor/. The test that pinned the exclusion now pins the read: red on the main scanner (exit 0), green here (exit 1).
• CLAUDE.md, documentation/agent-notes.md, .github/dependabot.yml, scripts/check-agent-notes.ts and the gate docblocks stop describing vendored parsers.

Against 0.1.0 of all six (local, pinned pnpm 10.0.0)

Green: install --frozen-lockfile, the shared manifest check, lint, format:check, phi-scan (all and --staged), build, attw, smoke, examples, check:test-selection, check:agent-notes, check:no-emdash, check:no-internal-refs.

The ccda, fhir, hl7 (ORU and ADT), ncpdp and x12 transformed-document digests are byte-identical under 0.1.0, and the leak corpus is green.

Red: typecheck, and 5 of 1231 tests.

DICOM (4 tests): @cosyte/dicom 0.1.0 changed the Annex E pass that @cosyte/deid/dicom delegates to

For buildPhiDataset() the pass now adds (0028,0303) Longitudinal Temporal Information Modified = REMOVED, and writes its own File Meta identity: (0002,0012) 2.25.200853462534740285303254730069375064698 and (0002,0013) COSYTE_DICOM. (0012,0062), (0012,0063) and this package's (0012,0064) are all still written, the manifest is unchanged, and no sentinel reaches the wire. For the File Meta extras case it now drops (0002,0016) Source Application Entity Title (the sender AE title no longer reaches the output) and the unmodeled (0002,0100).

• test/corpus/cross-format-unchanged.test.ts "the six adapters' transformed documents are unchanged": dicom digest c5b02868abb92c9221aa105af00ac5cd is now 99a98829ee94575f76b3a48e89740d5b.
• same file, "and the DICOM document is unchanged once the added declaration is taken back out": 8f9e91a91cc7b3a4461af53838c8843e is now 3033a8688dbeac85eec96ba1495df9a8.
• test/dicom/unexamined-residual.test.ts "the File Meta positions really reach the returned dataset (non-vacuity)": fileMeta.sourceApplicationEntityTitle is now undefined after the pass.
• same file, "lists the modeled, the non-modeled and the transfer-syntax positions": (0002,0016) and (0002,0100) are no longer handed through, so they are not listed. The inventory gains (0002,0012), (0002,0013) (constants the pass composes, now reported as handed-through positions, which over-reports) and (0028,0303).

NCPDP (1 test, plus typecheck)

test/ncpdp/unexamined-residual.test.ts "a response with no response header is emitted from the request header, so THAT is enumerated" hand-builds a TelecomTransaction without ncpdp 0.1.0's new required transactions and decodedTransactionCount: tsc reports TS2739 at line 174, and at run time serializeTelecom reads transaction.transactions.length and throws a TypeError.

A src/ question the same change exposes. src/ncpdp/apply.ts hands serializeTelecom the model { ...original, header, segments }. In ncpdp 0.1.0, parseTelecom puts only the first transaction in segments and every transaction in transactions, and serializeTelecom refuses a model with more than one. Repro with the committed B1 fixture turned into a two-transaction transmission (header count 2, then a GS-delimited second AM07 group): on ncpdp 0.0.1 deidentifyTelecomString returned the first transaction only, with the second silently dropped and the header still saying 2; on 0.1.0 it throws NcpdpTelecomBuildError NCPDP_TELECOM_BUILD_MULTI_TRANSACTION_EMIT, which is outside this package's sanctioned fatal set. The ncpdp peer range already admits 0.1.0, so a consumer gets this behaviour today. The spread also carries the original, un-de-identified transactions into that model; nothing emits them today only because 0.1.0 serializes from segments and refuses multiple transactions.

Nothing in src/ and none of these five tests was changed here.

https://claude.ai/code/session_01U24bnHKNxQWMxmfN7ny7w9