deepbom 2.1.0 → 2.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepbom",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "mcpName": "io.github.JunHwan-Kwon/deepbom",
   "description": "Local multi-format deployment-artifact analysis for on-device AI models",
   "type": "module",

package/pkg/release-manifest.json

@@ -1,14 +1,14 @@
 {
   "schema": "deepbom.npm_release.v1",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "source": {
-    "git_commit": "b161cd4c383e1133e97200a04c8459935f4c7d97",
+    "git_commit": "4e06a7707fb60f23adf6fed887e11208cdd2e308",
     "git_state": "clean",
     "distribution": "public_channel"
   },
   "runtime": {
     "node": ">=20",
-    "tflite_wasm_sha256": "7a562be6d5daa3df1b8f5dd4d15fd2c05eae715eb805f9c99b2287294fc352ee",
+    "tflite_wasm_sha256": "003cef5e648a744aa4c819a5137d4ab1d74f09faf003ee42bd86be5b44956c3d",
     "self_test": {
       "file": "bin/deepbom-self-test.onnx",
       "sha256": "82a2feef00eb6ab03d82f2b30cd17f4d826e2d8307cb059eccd6a0f3120059b2"
@@ -18,7 +18,7 @@
     "spdx": "Apache-2.0",
     "file": "LICENSE"
   },
-  "public_bundle_input_count": 204,
+  "public_bundle_input_count": 214,
   "supported_inputs": [
     "tflite",
     "onnx",

package/sdk/index.d.mts

@@ -11,6 +11,29 @@ export interface AuditOptions extends InspectOptions {
   output?: "analysis" | "envelope" | "cyclonedx" | "sarif";
   sections?: string[];
 }
+export interface NumericalEvidenceOptions extends Limits {
+  weights?: boolean;
+  weightBaseline?: string;
+  weightOptions?: string;
+  weightMapping?: string;
+  activationCapture?: string;
+  activationBaseline?: string;
+  expectedSha256?: string;
+}
+/** A selection of native numerical documents; no automatic model execution. */
+export interface NumericalEvidenceResult extends JsonDocument {
+  schema: "deepbom.analysis_selection.v1";
+  sections: {
+    model_ir: JsonDocument;
+    numerical_evidence_bundle: JsonDocument;
+    numerical_details: JsonDocument & { schema: "deepbom.numerical_details.v1"; numerical_details_sha256: string };
+    weight_ir?: JsonDocument;
+    weight_analysis?: JsonDocument;
+    weight_comparison?: JsonDocument;
+    activation_ir?: JsonDocument;
+    activation_baseline_ir?: JsonDocument;
+  };
+}
 export interface Finding extends JsonDocument {
   id: string; title: string; severity: string; evidence_class: string;
   source_pointers: string[]; recommendation: string | null;
@@ -53,6 +76,7 @@ export class DeepBomIdentityMismatch extends DeepBomError {}
 export class DeepBomTimeout extends DeepBomError {}
 export class DeepBomOutputTooLarge extends DeepBomError {}
 export function capabilities(options?: Limits): Promise<JsonDocument>;
+export function numericalEvidence(artifact: string, options: NumericalEvidenceOptions): Promise<NumericalEvidenceResult>;
 export function inspect(artifact: string, options?: InspectOptions): Promise<ReviewSummary>;
 export function audit(artifact: string, options?: InspectOptions & { output?: "envelope"; sections?: never }): Promise<EvidenceEnvelope>;
 export function audit(artifact: string, options: AuditOptions): Promise<JsonDocument>;

package/sdk/index.mjs

@@ -68,6 +68,31 @@ export async function diff(baseline, candidate, options = {}) {
   return invoke(["diff", localPath(baseline), localPath(candidate), "--compact", ...(options.tensorsOnly ? ["--tensors"] : [])], options);
 }
 
+/** Explicit numerical inspection of stored weights and/or imported captures. */
+export async function numericalEvidence(artifact, options = {}) {
+  checkOptions(options, [...limitKeys, "weights", "weightBaseline", "weightOptions", "weightMapping", "activationCapture", "activationBaseline", "expectedSha256"]);
+  if (options.weights != null && typeof options.weights !== "boolean") throw new TypeError("weights must be boolean");
+  const weights = options.weights === true || ["weightBaseline", "weightOptions", "weightMapping"].some(key => options[key] != null);
+  if (!weights && options.activationCapture == null) throw new TypeError("Select weights or provide activationCapture");
+  if (options.activationBaseline != null && options.activationCapture == null) throw new TypeError("activationBaseline requires activationCapture");
+  if (options.weightMapping != null && options.weightBaseline == null) throw new TypeError("weightMapping requires weightBaseline");
+  const argv = ["audit", localPath(artifact), "--compact"];
+  const sections = ["model_ir", "numerical_evidence_bundle", "numerical_details"];
+  if (weights) { argv.push("--weight-analysis"); sections.push("weight_ir", "weight_analysis"); }
+  if (options.weightBaseline != null) sections.push("weight_comparison");
+  if (options.activationCapture != null) sections.push("activation_ir");
+  if (options.activationBaseline != null) sections.push("activation_baseline_ir");
+  for (const [key, flag] of Object.entries({ weightBaseline: "--weight-baseline", weightOptions: "--weight-options", weightMapping: "--weight-mapping", activationCapture: "--activation-evidence", activationBaseline: "--activation-baseline" })) {
+    if (options[key] != null) argv.push(flag, localPath(options[key]));
+  }
+  if (options.expectedSha256 != null) {
+    if (typeof options.expectedSha256 !== "string" || !/^[0-9a-f]{64}$/i.test(options.expectedSha256)) throw new TypeError("expectedSha256 must contain 64 hexadecimal characters");
+    argv.push("--expected-sha256", options.expectedSha256.toLowerCase());
+  }
+  argv.push("--section", sections.join(","));
+  return invoke(argv, options);
+}
+
 export async function captureContract(artifact, options = {}) {
   checkOptions(options, limitKeys);
   return invoke(["contract", "capture", localPath(artifact), "--compact"], options);