edfcore 0.4.397 → 0.4.399

package/dist/constants.d.ts

@@ -109,5 +109,5 @@ export declare const SIGNAL_FIELD_BLOCK_OFFSETS: {
     readonly reserved: 224;
 };
 /** Published package version. Kept in sync with package.json by a test. */
-export declare const VERSION = "0.4.397";
+export declare const VERSION = "0.4.399";
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.js

@@ -79,5 +79,5 @@ export const SIGNAL_FIELD_BLOCK_OFFSETS = {
     reserved: 224,
 };
 /** Published package version. Kept in sync with package.json by a test. */
-export const VERSION = '0.4.397';
+export const VERSION = '0.4.399';
 //# sourceMappingURL=constants.js.map

package/docs/CHANGELOG.md

@@ -6,6 +6,33 @@ alone does not tell you whether you were affected.
 edfcore is pre-1.0. Patch releases have carried behaviour changes where the old behaviour was a
 defect; those are called out below.
 
+## 0.4.399
+
+- **Added** to `verify:tarball` the three files npm packs by convention rather than because `files`
+  asks for it: `package.json`, `README.md` and `LICENSE`. `files` is an allow-list and none of the
+  three is on it, so all three ship on a rule this repository does not state and cannot see.
+- A package that arrives without `LICENSE` is an MIT package whose terms are not in it, which is
+  the half of 0.4.398 a text comparison cannot reach. Without `README.md` the npm page is blank —
+  the first thing anyone sees of the project, and the last thing anyone would think to check.
+- `.npmignore` is what makes this reachable rather than theoretical: it overrides `files` outright,
+  so adding one for an unrelated reason can take all three out at once.
+
+## 0.4.398
+
+- **Added** a check that the licence is one licence. `package.json` declares `"license": "MIT"` —
+  the string npm indexes, GitHub's sidebar reads and every corporate approval process greps for —
+  and `LICENSE` is the only one of the five copies that actually grants anything. The other four
+  describe it.
+- The failure this guards is not someone changing the licence. It is someone changing one copy: a
+  relicensing that updates `LICENSE` and leaves the manifest saying MIT ships a package whose two
+  statements of its own terms disagree, which is worse than either being wrong alone. The holder is
+  the same shape — three hand-typed copies of one name, in the manifest, the file and the README.
+- The body is checked as well as the heading, because a truncated `LICENSE` is still a `LICENSE`.
+  The grant and the warranty disclaimer are what make it MIT rather than a title over an empty
+  file, and one that lost its disclaimer is a licence someone could argue carries a warranty.
+- The copyright year is deliberately not checked. There is no `Date` in this repository, and a year
+  assertion is a test that fails on the first of January for no reason anyone would want.
+
 ## 0.4.397
 
 - **Fixed** `website/design/og.svg`, which had been missing its final newline since it was drawn.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "edfcore",
-  "version": "0.4.397",
+  "version": "0.4.399",
   "description": "Modern, typed, zero-dependency reader for EDF, EDF+, BDF and BDF+ biosignal files. Works in browsers and Node with true random access.",
   "keywords": [
     "edf",

package/src/constants.ts

@@ -93,4 +93,4 @@ export const SIGNAL_FIELD_BLOCK_OFFSETS = {
 } as const;
 
 /** Published package version. Kept in sync with package.json by a test. */
-export const VERSION = '0.4.397';
+export const VERSION = '0.4.399';