edfcore 0.4.285 → 0.4.293

package/dist/constants.d.ts

@@ -109,5 +109,5 @@ export declare const SIGNAL_FIELD_BLOCK_OFFSETS: {
     readonly reserved: 224;
 };
 /** Published package version. Kept in sync with package.json by a test. */
-export declare const VERSION = "0.4.285";
+export declare const VERSION = "0.4.293";
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.js

@@ -79,5 +79,5 @@ export const SIGNAL_FIELD_BLOCK_OFFSETS = {
     reserved: 224,
 };
 /** Published package version. Kept in sync with package.json by a test. */
-export const VERSION = '0.4.285';
+export const VERSION = '0.4.293';
 //# sourceMappingURL=constants.js.map

package/docs/CHANGELOG.md

@@ -6,6 +6,119 @@ alone does not tell you whether you were affected.
 edfcore is pre-1.0. Patch releases have carried behaviour changes where the old behaviour was a
 defect; those are called out below.
 
+## 0.4.293
+
+- **Moved** the tarball check out of the test suite, which is the only place it could not live.
+  Packing this package runs `prepublishOnly` — `npm run check && npm run build` — so a test that
+  packs runs the suite containing itself, and `npm pack --json` printed the whole run before its
+  JSON. 0.4.292 tried to parse around that with `--ignore-scripts` and a located JSON array; the
+  publish runner's npm ran the lifecycle anyway, and the extra output then broke the parser a
+  second way. It is `npm run verify:tarball` now, in CI's `package` job beside `verify:package`,
+  where nothing recurses.
+
+  **0.4.287 through 0.4.292 were never released** — six versions, all tagged, all with green CI,
+  none reaching npm, because `publish.yml` runs its own `npm run check` after the release exists.
+  Everything they carried is in this one. The release script waits for CI on the commit, and the
+  publish is a separate workflow that starts later, so the wait added in 0.4.244 cannot see it.
+
+## 0.4.292
+
+- **Fixed** the tarball check added in 0.4.287, which broke the publish it was written to protect.
+  It ran `npm pack --dry-run --json` without `--ignore-scripts`, so `npm pack` ran the pack
+  lifecycle — and this package's `prepublishOnly` is `npm run check && npm run build`. The pack
+  performed by the test therefore ran the suite containing the test, printed all of it to stdout,
+  and left `JSON.parse` reading `npm notice run biome check` as JSON. It bites only where a
+  lifecycle actually fires, which is why it passed on this machine and failed in `publish.yml`.
+  The JSON is now located in the output rather than assumed to start at byte zero, and a missing
+  file list says so instead of throwing `Cannot read properties of undefined`.
+
+  **0.4.287 through 0.4.291 were never released.** All five were tagged, all five had green CI —
+  the failure is in `publish.yml`, which runs after — and none reached npm. Everything they
+  carried is in this release. That is five more numbers on the list with 0.2.29, 0.2.36, 0.2.59,
+  0.4.176, 0.4.231-0.4.236 and 0.4.241-0.4.242.
+
+## 0.4.291
+
+- **Extended** `verify:site` to the rendered head of every built page. `Base.astro` builds it once
+  for all of them, which is exactly why a page that misses it misses it silently — nothing renders
+  differently. Title, description, canonical and the two Open Graph tags are now required on all 27
+  pages, and every documentation page must carry the `rel="alternate"` markdown link.
+- That last one has a stated purpose rather than being SEO housekeeping. `[...slug].md.ts` records
+  what was measured: no AI crawler uses content negotiation, and the ones that found markdown found
+  it through an explicit `<link rel="alternate">` in the HTML. A docs page without it has a
+  markdown twin nothing can discover, which is the whole feature quietly not working.
+- The `/docs` redirect stub Astro generates is exempt, and correctly: it carries `robots: noindex`
+  and exists to be followed rather than read.
+
+## 0.4.290
+
+- **Added** `npm run verify:site`, which checks what the site build produced rather than that it
+  produced something. `llms.txt`, `llms-full.txt`, the markdown twin of every page, `robots.txt`
+  and `api.json` are generated from the collection and nothing looked at the output — and each
+  fails silently. A page missing from `llms.txt` is a page an agent never learns about; a `.md`
+  twin that did not render leaves a documented URL 404ing while the HTML page beside it is fine;
+  a `Sitemap:` line naming a file the build did not emit tells a crawler to fetch nothing.
+- It runs in CI's `site` job, after the build, rather than in `npm run check`. These generators
+  live under `website/`, where an import pulls in a tsconfig the root install does not have —
+  the boundary 0.4.264 guards — so the artifact is the only place the question can be asked.
+  Verified by narrowing `llms.txt`'s section list and watching three pages disappear from the map.
+
+## 0.4.289
+
+- **Tested** `header/fields.ts` directly, the last source module no test imported. It is the sole
+  owner of where each of the ten fixed fields lives and which diagnostic a field that fails its
+  grammar deserves, and every function in it ran only as a step inside `parseHeader` — covered by
+  whichever inputs some larger fixture happened to produce.
+- The offsets are the part a whole-file parse cannot check at all: a field read from the wrong
+  offset still parses, it just parses the neighbouring field's bytes. So the table is checked
+  against a header whose every field is filled with a distinct letter, which makes a misread
+  visible rather than plausible, and against the property that the ten fields tile all 256 bytes
+  with no gap and no overlap. The spec's offsets are written out from the specification rather
+  than imported from `constants.ts` — importing them would compare the table with itself, and the
+  two have to agree because both describe a format neither of them defines.
+
+## 0.4.288
+
+- **Tested** `options.ts` directly for the first time. It is 66 lines of Layer 1 whose whole job is
+  refusing bad input, and no test imported it — every path through it ran only as a side effect of
+  some larger read. Its own docblock records two misdiagnoses that reached users from a `NaN`
+  budget: an `EdfBudgetError` advising "read fewer records per call", which no record count
+  satisfies, and an `EdfRangeError` about `count: NaN` telling the caller to clamp a range the
+  function does not take. The distinction it exists for — `undefined` means "use the default",
+  `NaN` means a caller computed something and got nothing — is now pinned from both sides, along
+  with the ordering that makes the message right: `NaN >= 0` is false, so a sign check written
+  first would call `NaN` negative.
+- **Pinned** the inventory the module states: six modules resolve the budget and two hand it on.
+  That sentence is the argument the guard is worth anything — "a guard that only one of the eight
+  applies is not a guard" — and a seventh consumer reading the option raw is how it stops being
+  true.
+
+## 0.4.287
+
+- **Added** a check on what `npm publish` would actually send. `publint` runs in CI and checks the
+  manifest is well formed; it says nothing about membership, and membership is where the claims
+  are — `tests/README.md` promises "nothing under `tests/` ever ships", and the fixture policy
+  says the six committed binaries are excluded from the published package.
+- Wrong in either direction is quiet. A stray `tests/` ships 2.1 MB of other people's EDF files to
+  every consumer, with the licence questions that policy exists to avoid; a missing `dist/` ships
+  a package that installs and cannot be imported. Neither surfaces until someone downloads it, and
+  by then the version is immutable. Asked through `npm pack --dry-run`, which is the code path a
+  publish takes, rather than by reimplementing npm's ignore rules — which is the whole difficulty
+  of the question. Every exports and `bin` target is checked to be present, and `docs/` is checked
+  to contain the changelog and nothing else.
+
+## 0.4.286
+
+- **Guarded** the two `git push` calls, which were the last unguarded network steps in the release.
+  Both reach the network, so both fail for reasons unrelated to the code, and each leaves a
+  different half-done state that re-running the script cannot repair — the commit and the tag
+  already exist locally, so a second run refuses the tag rather than retrying.
+- Found by living it. Cutting 0.4.285 the tag push timed out with `Recv failure`: main was public,
+  the tag was not, nothing triggered a release, and the script exited without a word. The recovery
+  0.4.226 added covers the step after these two and never fired, so the only evidence was a version
+  on `main` with no release behind it. Each push now says which half is done and gives the exact
+  commands to finish, rather than the one that would cut the next version.
+
 ## 0.4.285
 
 - **Added** a check that every diagnostic code edfcore emits is registered, or is one of six that

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "edfcore",
-  "version": "0.4.285",
+  "version": "0.4.293",
   "description": "Modern, typed, zero-dependency reader for EDF, EDF+, BDF and BDF+ biosignal files. Works in browsers and Node with true random access.",
   "keywords": [
     "edf",
@@ -71,6 +71,8 @@
     "format": "biome check --write --linter-enabled=false .",
     "check": "npm run lint && npm run typecheck && npm run build && npm run test",
     "verify:package": "npx --yes publint@latest --strict && npx --yes @arethetypeswrong/cli@latest --pack . --profile esm-only",
+    "verify:tarball": "node scripts/check-tarball.mjs",
+    "verify:site": "node scripts/check-site-output.mjs",
     "corpus:fetch": "node scripts/fetch-corpus.mjs",
     "release": "node scripts/release.mjs",
     "prepublishOnly": "npm run check && npm run build"

package/src/constants.ts

@@ -93,4 +93,4 @@ export const SIGNAL_FIELD_BLOCK_OFFSETS = {
 } as const;
 
 /** Published package version. Kept in sync with package.json by a test. */
-export const VERSION = '0.4.285';
+export const VERSION = '0.4.293';