edfcore 0.4.280 → 0.4.282

package/dist/constants.d.ts

@@ -109,5 +109,5 @@ export declare const SIGNAL_FIELD_BLOCK_OFFSETS: {
     readonly reserved: 224;
 };
 /** Published package version. Kept in sync with package.json by a test. */
-export declare const VERSION = "0.4.280";
+export declare const VERSION = "0.4.282";
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.js

@@ -79,5 +79,5 @@ export const SIGNAL_FIELD_BLOCK_OFFSETS = {
     reserved: 224,
 };
 /** Published package version. Kept in sync with package.json by a test. */
-export const VERSION = '0.4.280';
+export const VERSION = '0.4.282';
 //# sourceMappingURL=constants.js.map

package/docs/CHANGELOG.md

@@ -6,6 +6,36 @@ alone does not tell you whether you were affected.
 edfcore is pre-1.0. Patch releases have carried behaviour changes where the old behaviour was a
 defect; those are called out below.
 
+## 0.4.282
+
+- **Fixed** the corpus manifest calling one field two names. Five of the seven entries recorded
+  what a file is for under `exercises` and two under `purpose`, and `tests/README.md` names only
+  the second: the manifest "records the URL, byte size, SHA-256, licence and purpose of each
+  file". Nothing read either — that field exists to be read by a person deciding whether a 48 MB
+  download is worth it — so the split had no symptom until something asked all seven entries the
+  same question.
+- **Added** the check that asked. The manifest is the provenance record on which this repository
+  is willing to pull 59 MB of other people's recordings onto a contributor's machine: the hash is
+  what makes the download reproducible, the licence is where permission is written down, and three
+  of these entries record "no licence stated" together with why that is acceptable. Every field the
+  README names is now required, digests are checked for shape — 64 lowercase hex — because
+  checking the value needs the file, which is the thing this suite refuses to require, and a URL
+  has to be one the fetcher could resolve.
+
+## 0.4.281
+
+- **Checked** that `sideEffects: false` is honest, rather than merely present. 0.4.230 read the
+  flag out of the manifest; this imports the three entry points in a fresh child realm and watches
+  what happens. A bundler reads that flag and feels free to drop any import whose bindings go
+  unused, so a module that did something at load — patched a global, started a timer, registered a
+  handler — would have licensed the bundler to delete behaviour a consumer depends on, with
+  nothing about the failure pointing back here.
+- A child process because the question is about a fresh realm: by the time any test runs, the
+  parent has imported `src/` a hundred times over. Three things are watched — a new property on
+  `globalThis`, a timer, a `process` listener — which is not exhaustive and is what a load-time
+  side effect looks like in practice, each of them silent from the outside. Verified by adding one
+  of each to the barrel and watching both fail.
+
 ## 0.4.280
 
 - **Added** a check that the exit-code table on the CLI page is the code the CLI returns.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "edfcore",
-  "version": "0.4.280",
+  "version": "0.4.282",
   "description": "Modern, typed, zero-dependency reader for EDF, EDF+, BDF and BDF+ biosignal files. Works in browsers and Node with true random access.",
   "keywords": [
     "edf",

package/src/constants.ts

@@ -93,4 +93,4 @@ export const SIGNAL_FIELD_BLOCK_OFFSETS = {
 } as const;
 
 /** Published package version. Kept in sync with package.json by a test. */
-export const VERSION = '0.4.280';
+export const VERSION = '0.4.282';