edfcore 0.4.271 → 0.4.273

package/dist/constants.d.ts

@@ -109,5 +109,5 @@ export declare const SIGNAL_FIELD_BLOCK_OFFSETS: {
     readonly reserved: 224;
 };
 /** Published package version. Kept in sync with package.json by a test. */
-export declare const VERSION = "0.4.271";
+export declare const VERSION = "0.4.273";
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.js

@@ -79,5 +79,5 @@ export const SIGNAL_FIELD_BLOCK_OFFSETS = {
     reserved: 224,
 };
 /** Published package version. Kept in sync with package.json by a test. */
-export const VERSION = '0.4.271';
+export const VERSION = '0.4.273';
 //# sourceMappingURL=constants.js.map

package/docs/CHANGELOG.md

@@ -6,6 +6,36 @@ alone does not tell you whether you were affected.
 edfcore is pre-1.0. Patch releases have carried behaviour changes where the old behaviour was a
 defect; those are called out below.
 
+## 0.4.273
+
+- **Made** the fuzz suite assert the clause it was missing. `tests/README.md` states the safety
+  property in four parts — "it never hangs, never allocates unboundedly, never returns NaN, and
+  never returns believable garbage" — and attributes all four to `property/fuzz.test.ts`, which
+  opened by saying it asserts three and listed them. The gap was "never allocates unboundedly":
+  its bounded clause was a wall-clock budget, which catches slowness, and slowness is a different
+  failure from a corrupt header talking a reader into an allocation it cannot afford.
+- Every fuzz read now runs under `maxMaterializeBytes`, and a read that succeeds must have stayed
+  inside it. Exceeding it throws `EdfBudgetError`, which clause 1 already accepted as a legitimate
+  refusal; the new half is that a decoder which allocated past the ceiling and handed the array
+  back anyway would have satisfied every other clause in the file. Verified by lowering the
+  ceiling below what the fixtures decode to and watching the violation report the byte count.
+
+## 0.4.272
+
+- **Executed** the offline claim instead of stating it. `tests/README.md` opens with
+  "`git clone && npm test` is green and offline", which is a property of the suite and was
+  enforced by nothing. `globalThis.fetch` is now replaced for the whole run, through
+  `setupFiles`, with something that refuses and says to inject a `fetch` the way the `httpSource`
+  tests do.
+- That fallback is the route a test reaches the network by accident rather than on purpose:
+  `httpSource()` uses `globalThis.fetch` when none is passed, which is right for a consumer in a
+  browser, so forgetting the option used to send a real request and pass. It fails loudly now, at
+  construction, where the length is resolved.
+- The trap rejects rather than throwing synchronously, because a real `fetch` does not throw when
+  a host is unreachable and a trap that behaved differently would send `httpSource` down an error
+  path production never takes. `offline.test.ts` calls it and asserts it bites, since a setup file
+  that failed to load would leave every test passing with nothing to show anything was guarded.
+
 ## 0.4.271
 
 - **Added** the check the whole suite rests on: nothing in `tests/support/` takes a runtime import

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "edfcore",
-  "version": "0.4.271",
+  "version": "0.4.273",
   "description": "Modern, typed, zero-dependency reader for EDF, EDF+, BDF and BDF+ biosignal files. Works in browsers and Node with true random access.",
   "keywords": [
     "edf",

package/src/constants.ts

@@ -93,4 +93,4 @@ export const SIGNAL_FIELD_BLOCK_OFFSETS = {
 } as const;
 
 /** Published package version. Kept in sync with package.json by a test. */
-export const VERSION = '0.4.271';
+export const VERSION = '0.4.273';