edfcore 0.4.431 → 0.4.433

package/dist/constants.d.ts

@@ -109,5 +109,5 @@ export declare const SIGNAL_FIELD_BLOCK_OFFSETS: {
     readonly reserved: 224;
 };
 /** Published package version. Kept in sync with package.json by a test. */
-export declare const VERSION = "0.4.431";
+export declare const VERSION = "0.4.433";
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.js

@@ -79,5 +79,5 @@ export const SIGNAL_FIELD_BLOCK_OFFSETS = {
     reserved: 224,
 };
 /** Published package version. Kept in sync with package.json by a test. */
-export const VERSION = '0.4.431';
+export const VERSION = '0.4.433';
 //# sourceMappingURL=constants.js.map

package/docs/CHANGELOG.md

@@ -6,6 +6,46 @@ alone does not tell you whether you were affected.
 edfcore is pre-1.0. Patch releases have carried behaviour changes where the old behaviour was a
 defect; those are called out below.
 
+## 0.4.433
+
+- **Added** tests for what a conformant header is allowed to say. `validateHeader` raises three
+  advisory diagnostics about how a header is written, each checked somewhere for the case where it
+  fires, and none for the case where it stays quiet — which is the direction with consequences.
+- A conformance report is only worth reading if a clean file produces a short one. `PREFILTERING_NONE`
+  holds four spellings of "no filtering" that EDF+ and real writers use interchangeably, and
+  dropping one means every file from that writer carries a warning about a field it filled in
+  correctly. Nobody debugs that; they stop reading the warnings, which are the same warnings that
+  would have told them something real.
+- The headline is the whole of it at once: a header that follows EDF+ to the letter — an
+  `EEG Fpz-Cz` label, a named transducer, `HP:` and `LP:` terms — produces no conformance
+  diagnostics at all. That sentence is the product these checks exist to make possible and it was
+  never asserted.
+- One subtlety is pinned deliberately. A bare `EEG` label is flagged, because the rule is
+  `<type> <sensor>` and a type with no sensor names a category rather than a channel. The condition
+  that gets that right reads like a redundant length check beside the set membership next to it,
+  and simplifying it away would silently accept `EEG`, `ECG` and `Temp` as channel names.
+
+## 0.4.432
+
+- **Added** a check that every version is still signed, and of the four lines that make it so.
+  `scripts/release.mjs` ends a successful run by telling whoever cut it that the version "is on npm
+  with a provenance attestation". It prints that unconditionally, nothing verified the workflow
+  still signs anything, and nothing could notice if it stopped: npm accepts an unsigned publish
+  exactly as it accepts a signed one, and the only difference is a panel missing from a web page
+  nobody reloads.
+- The attestation is not decoration here. AGENTS.md explains that the
+  `archive/pre-squash-2026-08-16` branch is load-bearing precisely because every version published
+  that day carries a signed attestation naming the commit it was built from — a whole branch is
+  kept alive so those Source Commit links keep resolving.
+- Four things hold it together and each is a line a tidy-up removes without a thought:
+  `id-token: write`, where the signing key comes from and whose removal looks like tightening
+  permissions; `--provenance` on the publish step, which looks redundant next to `publishConfig`;
+  `--provenance` *not* in `publishConfig`, the opposite tidy-up, because there it would apply to a
+  publish from a laptop that has no OIDC token to sign with; and `registry-url` on `setup-node`,
+  without which the publish is unauthenticated and never gets far enough to sign anything.
+- The reasons written beside them are checked too, since they are the only thing standing between
+  the next reader and the tidy-up.
+
 ## 0.4.431
 
 - **Added** tests that a 16-bit channel labelled `Status` is not a BioSemi Status channel.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "edfcore",
-  "version": "0.4.431",
+  "version": "0.4.433",
   "description": "Modern, typed, zero-dependency reader for EDF, EDF+, BDF and BDF+ biosignal files. Works in browsers and Node with true random access.",
   "keywords": [
     "edf",

package/src/constants.ts

@@ -93,4 +93,4 @@ export const SIGNAL_FIELD_BLOCK_OFFSETS = {
 } as const;
 
 /** Published package version. Kept in sync with package.json by a test. */
-export const VERSION = '0.4.431';
+export const VERSION = '0.4.433';