deepbom 2.1.0 → 2.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepbom",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "mcpName": "io.github.JunHwan-Kwon/deepbom",
   "description": "Local multi-format deployment-artifact analysis for on-device AI models",
   "type": "module",

package/pkg/release-manifest.json

@@ -1,14 +1,14 @@
 {
   "schema": "deepbom.npm_release.v1",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "source": {
-    "git_commit": "b161cd4c383e1133e97200a04c8459935f4c7d97",
+    "git_commit": "77f8caeac9381b947cd159beedb96d97ad9e1e96",
     "git_state": "clean",
     "distribution": "public_channel"
   },
   "runtime": {
     "node": ">=20",
-    "tflite_wasm_sha256": "7a562be6d5daa3df1b8f5dd4d15fd2c05eae715eb805f9c99b2287294fc352ee",
+    "tflite_wasm_sha256": "dc46e597ad916c9023b6328949de0dfeed1bb4e98f15937a0caeec2f6766bd70",
     "self_test": {
       "file": "bin/deepbom-self-test.onnx",
       "sha256": "82a2feef00eb6ab03d82f2b30cd17f4d826e2d8307cb059eccd6a0f3120059b2"
@@ -18,7 +18,7 @@
     "spdx": "Apache-2.0",
     "file": "LICENSE"
   },
-  "public_bundle_input_count": 204,
+  "public_bundle_input_count": 228,
   "supported_inputs": [
     "tflite",
     "onnx",

package/sdk/index.d.mts

@@ -11,6 +11,29 @@ export interface AuditOptions extends InspectOptions {
   output?: "analysis" | "envelope" | "cyclonedx" | "sarif";
   sections?: string[];
 }
+export interface NumericalEvidenceOptions extends Limits {
+  weights?: boolean;
+  weightBaseline?: string;
+  weightOptions?: string;
+  weightMapping?: string;
+  activationCapture?: string;
+  activationBaseline?: string;
+  expectedSha256?: string;
+}
+/** A selection of native numerical documents; no automatic model execution. */
+export interface NumericalEvidenceResult extends JsonDocument {
+  schema: "deepbom.analysis_selection.v1";
+  sections: {
+    model_ir: JsonDocument;
+    numerical_evidence_bundle: JsonDocument;
+    numerical_details: JsonDocument & { schema: "deepbom.numerical_details.v1"; numerical_details_sha256: string };
+    weight_ir?: JsonDocument;
+    weight_analysis?: JsonDocument;
+    weight_comparison?: JsonDocument;
+    activation_ir?: JsonDocument;
+    activation_baseline_ir?: JsonDocument;
+  };
+}
 export interface Finding extends JsonDocument {
   id: string; title: string; severity: string; evidence_class: string;
   source_pointers: string[]; recommendation: string | null;
@@ -53,6 +76,7 @@ export class DeepBomIdentityMismatch extends DeepBomError {}
 export class DeepBomTimeout extends DeepBomError {}
 export class DeepBomOutputTooLarge extends DeepBomError {}
 export function capabilities(options?: Limits): Promise<JsonDocument>;
+export function numericalEvidence(artifact: string, options: NumericalEvidenceOptions): Promise<NumericalEvidenceResult>;
 export function inspect(artifact: string, options?: InspectOptions): Promise<ReviewSummary>;
 export function audit(artifact: string, options?: InspectOptions & { output?: "envelope"; sections?: never }): Promise<EvidenceEnvelope>;
 export function audit(artifact: string, options: AuditOptions): Promise<JsonDocument>;
@@ -60,3 +84,18 @@ export function diff(baseline: string, candidate: string, options?: Limits & { t
 export function captureContract(artifact: string, options?: Limits): Promise<JsonDocument>;
 export function verifyContract(artifact: string, contract: string, options?: Limits): Promise<JsonDocument>;
 export function verifyBom(artifact: string, bom: string, options?: Limits & { componentRef?: string }): Promise<JsonDocument>;
+
+export interface EvidenceWorkflowRequest extends JsonDocument {
+  schema: "deepbom.evidence_workflow_request.v1";
+  operation: "snapshot" | "omop" | "protocol" | "evaluation" | "provenance" | "review" | "deployment" | "verify";
+  input: JsonDocument;
+  documents: JsonDocument[];
+}
+export interface EvidenceWorkflowResult extends JsonDocument {
+  schema: "deepbom.evidence_workflow_result.v1";
+  result_sha256: string;
+  document: JsonDocument;
+  request: EvidenceWorkflowRequest;
+  execution_status: "completed";
+}
+export function evidenceWorkflow(request: EvidenceWorkflowRequest | EvidenceWorkflowResult, options?: Limits & {files?: {sha256:string;path:string}[]}): Promise<EvidenceWorkflowResult>;

package/sdk/index.mjs

@@ -1,6 +1,6 @@
 /** Public Node SDK. All analysis and policy evaluation run in the packaged CLI. */
 import { spawn } from "node:child_process";
-import { mkdtemp, readFile, rm, stat } from "node:fs/promises";
+import { mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -68,6 +68,31 @@ export async function diff(baseline, candidate, options = {}) {
   return invoke(["diff", localPath(baseline), localPath(candidate), "--compact", ...(options.tensorsOnly ? ["--tensors"] : [])], options);
 }
 
+/** Explicit numerical inspection of stored weights and/or imported captures. */
+export async function numericalEvidence(artifact, options = {}) {
+  checkOptions(options, [...limitKeys, "weights", "weightBaseline", "weightOptions", "weightMapping", "activationCapture", "activationBaseline", "expectedSha256"]);
+  if (options.weights != null && typeof options.weights !== "boolean") throw new TypeError("weights must be boolean");
+  const weights = options.weights === true || ["weightBaseline", "weightOptions", "weightMapping"].some(key => options[key] != null);
+  if (!weights && options.activationCapture == null) throw new TypeError("Select weights or provide activationCapture");
+  if (options.activationBaseline != null && options.activationCapture == null) throw new TypeError("activationBaseline requires activationCapture");
+  if (options.weightMapping != null && options.weightBaseline == null) throw new TypeError("weightMapping requires weightBaseline");
+  const argv = ["audit", localPath(artifact), "--compact"];
+  const sections = ["model_ir", "numerical_evidence_bundle", "numerical_details"];
+  if (weights) { argv.push("--weight-analysis"); sections.push("weight_ir", "weight_analysis"); }
+  if (options.weightBaseline != null) sections.push("weight_comparison");
+  if (options.activationCapture != null) sections.push("activation_ir");
+  if (options.activationBaseline != null) sections.push("activation_baseline_ir");
+  for (const [key, flag] of Object.entries({ weightBaseline: "--weight-baseline", weightOptions: "--weight-options", weightMapping: "--weight-mapping", activationCapture: "--activation-evidence", activationBaseline: "--activation-baseline" })) {
+    if (options[key] != null) argv.push(flag, localPath(options[key]));
+  }
+  if (options.expectedSha256 != null) {
+    if (typeof options.expectedSha256 !== "string" || !/^[0-9a-f]{64}$/i.test(options.expectedSha256)) throw new TypeError("expectedSha256 must contain 64 hexadecimal characters");
+    argv.push("--expected-sha256", options.expectedSha256.toLowerCase());
+  }
+  argv.push("--section", sections.join(","));
+  return invoke(argv, options);
+}
+
 export async function captureContract(artifact, options = {}) {
   checkOptions(options, limitKeys);
   return invoke(["contract", "capture", localPath(artifact), "--compact"], options);
@@ -170,3 +195,21 @@ async function invoke(argv, options) {
     }
   }
 }
+
+/** The request and result contracts are shared with browser workers and MCP. */
+export async function evidenceWorkflow(request, options = {}) {
+  checkOptions(options, [...limitKeys, "files"]);
+  if (!request || typeof request !== "object" || Array.isArray(request)) throw new TypeError("request must be a document");
+  const directory=await mkdtemp(path.join(tmpdir(),"deepbom-evidence-"));
+  try {
+    const filename=path.join(directory,"request.json");
+    const text=JSON.stringify(request);if(Buffer.byteLength(text)>16*1024*1024)throw new TypeError("Request exceeds 16 MiB");
+    await writeFile(filename,text,{mode:0o600});
+    const argv=["evidence-workflow",filename];
+    if(options.files!==undefined){
+      if(!Array.isArray(options.files)||options.files.length>256)throw new TypeError("files must be a bounded list");
+      for(const f of options.files){if(!f||Object.keys(f).some(k=>!["sha256","path"].includes(k))||!/^[a-f0-9]{64}$/.test(f.sha256))throw new TypeError("File needs sha256 and local path");argv.push("--file",f.sha256+":"+localPath(f.path));}
+    }
+    return await invoke(argv,options);
+  } finally { await rm(directory,{recursive:true,force:true}); }
+}