deepbom 1.109.0 → 2.1.0

package/README.md

@@ -3,14 +3,47 @@
 Local deployment-artifact analysis for TFLite, ONNX, GGUF, SafeTensors, Core ML,
 and ExecuTorch.
 
+## Programmatic integration
+
+The Node/TypeScript SDK is available from version **2.1.0**:
+
+```sh
+npm install deepbom@2.1.0
+```
+
+Follow the [integration walkthrough](https://github.com/JunHwan-Kwon/deepbom/blob/main/examples/integrations/README.md)
+for runnable exporter, MLflow and release-review examples.
+
+```js
+import { inspect, audit, DeepBomPolicyBlocked } from "deepbom";
+
+const summary = await inspect("model.onnx");
+console.log(summary.artifact.sha256, summary.coverage);
+try {
+  const evidence = await audit("model.onnx", { gate: "defects" });
+  // Store this native evidence; apply deployment policy separately.
+} catch (error) {
+  if (!(error instanceof DeepBomPolicyBlocked)) throw error;
+  console.log(error.code, error.document);
+}
+```
+
+This is an asynchronous ESM API for Node >=20 that invokes the bundled CLI
+without a shell or engine download. It reuses the common analysis engine and
+ships TypeScript declarations. Python uses the same engine in its wheel.
+See the [SDK contract](https://github.com/JunHwan-Kwon/deepbom/blob/main/docs/SDK_CONTRACT.md)
+for supported options, structured errors and independent IR versioning.
+
+## Command line
+
 For a local Codex or Claude Code project, preview and install the bundled Agent
 Skill without operating an analysis server:
 
 ```console
-npx -y deepbom@1.109.0 integrate codex
-npx -y deepbom@1.109.0 integrate codex --apply
-npx -y deepbom@1.109.0 integrate claude-code
-npx -y deepbom@1.109.0 integrate claude-code --apply
+npx -y deepbom@2.1.0 integrate codex
+npx -y deepbom@2.1.0 integrate codex --apply
+npx -y deepbom@2.1.0 integrate claude-code
+npx -y deepbom@2.1.0 integrate claude-code --apply
 ```
 
 ```console
@@ -28,10 +61,10 @@ npx deepbom explore model.tflite --target-profile target-profile.json
 npx deepbom audit model.pte --executorch-build deepbom.executorch-build.json --compact
 npx deepbom capabilities --format agent-json
 npx deepbom capabilities --format agent-text
-npx -y deepbom@1.109.0 mcp
+npx -y deepbom@2.1.0 mcp
 ```
 
-Claude Desktop can install the version-matched `deepbom-1.109.0.mcpb` asset
+Claude Desktop can install the version-matched `deepbom-2.1.0.mcpb` asset
 from the corresponding GitHub Release as a local desktop extension.
 
 ChatGPT developer-mode users can connect `https://deepbom.org/mcp` for one
@@ -90,6 +123,6 @@ and private rulepack-generation sources are not included.
 
 ## Optional metadata and OMOP connections
 
-After inspecting a model, create a model-bound input with `deepbom audit model.onnx --metadata-template omop -o metadata.json`. Fill the selected OMOP 5.4/5.5 `CDM_SOURCE` row and institution/release identifiers, then use `--metadata metadata.json --evidence-files ./evidence --section evidence_link_ir --json`. A generic template connects non-OMOP datasets, cohorts, code, runs and reports through the same IR.
+After inspecting a model, create a model-bound input with `deepbom audit model.onnx --metadata-template omop -o metadata.json`. Fill the selected OMOP 5.4/5.5 `CDM_SOURCE` row and institution/release identifiers, then use `--metadata metadata.json --evidence-files ./evidence --section provenance_ir --json`. A generic template connects non-OMOP datasets, cohorts, code, runs and reports through the same IR.
 
-The Web **Metadata** workspace provides import, record creation, an interactive relationship diagram and JSON/CycloneDX downloads. Local MCP `deepbom_audit` accepts `metadata_template`, `metadata` and `evidence_files`; ChatGPT/Claude widgets share only explicitly requested counts and digests. Connections remain declarations: file hashes and reference consistency do not authenticate lineage or clinical suitability. See the [OMOP guide](https://deepbom.org/guides/omop-metadata/) and [common IR contract](https://github.com/JunHwan-Kwon/deepbom/blob/main/docs/EVIDENCE_LINK_IR.md).
+The Web **Provenance** workspace provides import, record creation, an interactive relationship diagram and JSON/CycloneDX downloads. Local MCP `deepbom_audit` accepts `metadata_template`, `metadata` and `evidence_files`; ChatGPT/Claude widgets share only explicitly requested counts and digests. Connections remain declarations: file hashes and reference consistency do not authenticate lineage or clinical suitability. See the [OMOP guide](https://deepbom.org/guides/omop-metadata/) and [common IR contract](https://github.com/JunHwan-Kwon/deepbom/blob/main/docs/PROVENANCE_IR.md).