edfcore 0.4.430 → 0.4.432

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -109,5 +109,5 @@ export declare const SIGNAL_FIELD_BLOCK_OFFSETS: {
109
109
  readonly reserved: 224;
110
110
  };
111
111
  /** Published package version. Kept in sync with package.json by a test. */
112
- export declare const VERSION = "0.4.430";
112
+ export declare const VERSION = "0.4.432";
113
113
  //# sourceMappingURL=constants.d.ts.map
package/dist/constants.js CHANGED
@@ -79,5 +79,5 @@ export const SIGNAL_FIELD_BLOCK_OFFSETS = {
79
79
  reserved: 224,
80
80
  };
81
81
  /** Published package version. Kept in sync with package.json by a test. */
82
- export const VERSION = '0.4.430';
82
+ export const VERSION = '0.4.432';
83
83
  //# sourceMappingURL=constants.js.map
package/docs/CHANGELOG.md CHANGED
@@ -6,6 +6,45 @@ alone does not tell you whether you were affected.
6
6
  edfcore is pre-1.0. Patch releases have carried behaviour changes where the old behaviour was a
7
7
  defect; those are called out below.
8
8
 
9
+ ## 0.4.432
10
+
11
+ - **Added** a check that every version is still signed, and of the four lines that make it so.
12
+ `scripts/release.mjs` ends a successful run by telling whoever cut it that the version "is on npm
13
+ with a provenance attestation". It prints that unconditionally, nothing verified the workflow
14
+ still signs anything, and nothing could notice if it stopped: npm accepts an unsigned publish
15
+ exactly as it accepts a signed one, and the only difference is a panel missing from a web page
16
+ nobody reloads.
17
+ - The attestation is not decoration here. AGENTS.md explains that the
18
+ `archive/pre-squash-2026-08-16` branch is load-bearing precisely because every version published
19
+ that day carries a signed attestation naming the commit it was built from — a whole branch is
20
+ kept alive so those Source Commit links keep resolving.
21
+ - Four things hold it together and each is a line a tidy-up removes without a thought:
22
+ `id-token: write`, where the signing key comes from and whose removal looks like tightening
23
+ permissions; `--provenance` on the publish step, which looks redundant next to `publishConfig`;
24
+ `--provenance` *not* in `publishConfig`, the opposite tidy-up, because there it would apply to a
25
+ publish from a laptop that has no OIDC token to sign with; and `registry-url` on `setup-node`,
26
+ without which the publish is unauthenticated and never gets far enough to sign anything.
27
+ - The reasons written beside them are checked too, since they are the only thing standing between
28
+ the next reader and the tidy-up.
29
+
30
+ ## 0.4.431
31
+
32
+ - **Added** tests that a 16-bit channel labelled `Status` is not a BioSemi Status channel.
33
+ `api-helpers.md` explains why `readTriggers` locates the channel itself rather than taking a
34
+ `signalIndices` — "a 24-bit EEG sample decoded as a trigger word yields plausible-looking events
35
+ out of ordinary data" — and that reasoning is about the wrong channel of the right file. The
36
+ other way in is the right channel name in the wrong kind of file.
37
+ - `Status` is not a BioSemi word. Plenty of systems label a channel that way, and a plain EDF file
38
+ carrying one is an ordinary thing to be handed. Its samples are 16 bits of a measurement; a
39
+ BioSemi Status word is 24 bits of a latched bit field with the trigger input in the low 16 and
40
+ flags at bits 16, 20 and 22. Read one as the other and the low bits become codes, bit 16 becomes
41
+ an epoch marker that flips constantly, and what comes back is a dense list of events with real
42
+ timestamps from a channel that recorded a voltage. Nothing about that output says it is wrong.
43
+ - The guard is one line, and it is what makes the documented
44
+ `getStatusSignal(header) !== undefined` check mean "this is an ActiveTwo recording" rather than
45
+ "something here is called Status". It had never been given a 16-bit file to refuse. The label
46
+ matching is deliberately forgiving about case and padding; the width is not.
47
+
9
48
  ## 0.4.430
10
49
 
11
50
  - **Added** tests for a patient's date of birth being redacted out of a message that never quotes
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "edfcore",
3
- "version": "0.4.430",
3
+ "version": "0.4.432",
4
4
  "description": "Modern, typed, zero-dependency reader for EDF, EDF+, BDF and BDF+ biosignal files. Works in browsers and Node with true random access.",
5
5
  "keywords": [
6
6
  "edf",
package/src/constants.ts CHANGED
@@ -93,4 +93,4 @@ export const SIGNAL_FIELD_BLOCK_OFFSETS = {
93
93
  } as const;
94
94
 
95
95
  /** Published package version. Kept in sync with package.json by a test. */
96
- export const VERSION = '0.4.430';
96
+ export const VERSION = '0.4.432';