deepbom 2.2.0 → 2.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepbom",
-  "version": "2.2.0",
+  "version": "2.4.0",
   "mcpName": "io.github.JunHwan-Kwon/deepbom",
   "description": "Local multi-format deployment-artifact analysis for on-device AI models",
   "type": "module",

package/pkg/release-manifest.json

@@ -1,14 +1,14 @@
 {
   "schema": "deepbom.npm_release.v1",
-  "version": "2.2.0",
+  "version": "2.4.0",
   "source": {
-    "git_commit": "4e06a7707fb60f23adf6fed887e11208cdd2e308",
+    "git_commit": "91e3c39cbe024964058df8dab5277a6cadf354a3",
     "git_state": "clean",
     "distribution": "public_channel"
   },
   "runtime": {
     "node": ">=20",
-    "tflite_wasm_sha256": "003cef5e648a744aa4c819a5137d4ab1d74f09faf003ee42bd86be5b44956c3d",
+    "tflite_wasm_sha256": "d99d5d4f377bc324ff71b7e3ca8b2a090bf075528e75579fd9a783b3cca82edd",
     "self_test": {
       "file": "bin/deepbom-self-test.onnx",
       "sha256": "82a2feef00eb6ab03d82f2b30cd17f4d826e2d8307cb059eccd6a0f3120059b2"
@@ -18,7 +18,7 @@
     "spdx": "Apache-2.0",
     "file": "LICENSE"
   },
-  "public_bundle_input_count": 214,
+  "public_bundle_input_count": 236,
   "supported_inputs": [
     "tflite",
     "onnx",

package/sdk/index.d.mts

@@ -84,3 +84,18 @@ export function diff(baseline: string, candidate: string, options?: Limits & { t
 export function captureContract(artifact: string, options?: Limits): Promise<JsonDocument>;
 export function verifyContract(artifact: string, contract: string, options?: Limits): Promise<JsonDocument>;
 export function verifyBom(artifact: string, bom: string, options?: Limits & { componentRef?: string }): Promise<JsonDocument>;
+
+export interface EvidenceWorkflowRequest extends JsonDocument {
+  schema: "deepbom.evidence_workflow_request.v1";
+  operation: "snapshot" | "omop" | "protocol" | "evaluation" | "provenance" | "review" | "deployment" | "verify";
+  input: JsonDocument;
+  documents: JsonDocument[];
+}
+export interface EvidenceWorkflowResult extends JsonDocument {
+  schema: "deepbom.evidence_workflow_result.v1";
+  result_sha256: string;
+  document: JsonDocument;
+  request: EvidenceWorkflowRequest;
+  execution_status: "completed";
+}
+export function evidenceWorkflow(request: EvidenceWorkflowRequest | EvidenceWorkflowResult, options?: Limits & {files?: {sha256:string;path:string}[]}): Promise<EvidenceWorkflowResult>;

package/sdk/index.mjs

@@ -1,6 +1,6 @@
 /** Public Node SDK. All analysis and policy evaluation run in the packaged CLI. */
 import { spawn } from "node:child_process";
-import { mkdtemp, readFile, rm, stat } from "node:fs/promises";
+import { mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -195,3 +195,21 @@ async function invoke(argv, options) {
     }
   }
 }
+
+/** The request and result contracts are shared with browser workers and MCP. */
+export async function evidenceWorkflow(request, options = {}) {
+  checkOptions(options, [...limitKeys, "files"]);
+  if (!request || typeof request !== "object" || Array.isArray(request)) throw new TypeError("request must be a document");
+  const directory=await mkdtemp(path.join(tmpdir(),"deepbom-evidence-"));
+  try {
+    const filename=path.join(directory,"request.json");
+    const text=JSON.stringify(request);if(Buffer.byteLength(text)>16*1024*1024)throw new TypeError("Request exceeds 16 MiB");
+    await writeFile(filename,text,{mode:0o600});
+    const argv=["evidence-workflow",filename];
+    if(options.files!==undefined){
+      if(!Array.isArray(options.files)||options.files.length>256)throw new TypeError("files must be a bounded list");
+      for(const f of options.files){if(!f||Object.keys(f).some(k=>!["sha256","path"].includes(k))||!/^[a-f0-9]{64}$/.test(f.sha256))throw new TypeError("File needs sha256 and local path");argv.push("--file",f.sha256+":"+localPath(f.path));}
+    }
+    return await invoke(argv,options);
+  } finally { await rm(directory,{recursive:true,force:true}); }
+}