release: publish DeckProbe 2.3.0

Node-first JavaScript API, npm-packaged native CLI platform packages, and
WASM/report fidelity fixes.

Author: iguangfei

.github/workflows/ci.yml

@@ -29,7 +29,7 @@ jobs:
         run: cargo test --workspace
 
   js-package:
-    name: Browser SDK package
+    name: npm package (CLI and browser SDK)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -38,7 +38,8 @@ jobs:
           targets: wasm32-unknown-unknown
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          # The Vite consumer smoke test drives Vite 7, which needs >= 20.19.
+          node-version: 20.19
           cache: npm
           cache-dependency-path: packages/deckprobe-js/package-lock.json
       - name: Install JavaScript dependencies
@@ -47,10 +48,12 @@ jobs:
       - name: Build WASM and TypeScript package
         working-directory: packages/deckprobe-js
         run: npm run build
+      - name: Build the native CLI the launcher wraps
+        run: cargo build --locked --release -p deckprobe
       - name: Install Chromium
         working-directory: packages/deckprobe-js
         run: npx playwright install --with-deps chromium
-      - name: Run Browser SDK contract tests
+      - name: Run contract, bundler, and CLI parity tests
         working-directory: packages/deckprobe-js
         run: npm test
       - name: Audit JavaScript dependencies

.github/workflows/release.yml

@@ -287,12 +287,78 @@ jobs:
 
           gh release create "${{ needs.plan.outputs.tag }}" --target "$RELEASE_COMMIT" $PRERELEASE_FLAG --title "$ANNOUNCEMENT_TITLE" --notes-file "$RUNNER_TEMP/notes.txt" artifacts/*
 
-  publish-npm:
-    name: Publish Browser SDK to npm
+  publish-npm-platforms:
+    name: Publish CLI platform packages to npm
     needs:
       - host
     if: ${{ always() && needs.host.result == 'success' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+          package-manager-cache: false
+      # The same archives the release serves, so the npm CLI and the shell
+      # installers hand out byte-identical binaries.
+      - name: Fetch dist artifacts
+        uses: actions/download-artifact@v8
+        with:
+          pattern: artifacts-*
+          path: target/distrib/
+          merge-multiple: true
+      - name: Verify tag and package versions
+        working-directory: packages/deckprobe-js
+        shell: bash
+        run: |
+          package_version="$(node -p "require('./package.json').version")"
+          tag_version="${GITHUB_REF_NAME#v}"
+          if [[ "$package_version" != "$tag_version" ]]; then
+            echo "npm package version $package_version does not match tag $GITHUB_REF_NAME" >&2
+            exit 1
+          fi
+          node ./scripts/check-version.mjs
+      - name: Build platform packages
+        working-directory: packages/deckprobe-js
+        run: node ./scripts/build-platform-packages.mjs --artifacts ../../target/distrib --out npm
+      - name: Publish platform packages
+        working-directory: packages/deckprobe-js
+        shell: bash
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          package_version="$(node -p "require('./package.json').version")"
+          publish_tag=latest
+          if [[ "$package_version" == *-* ]]; then
+            publish_tag=next
+          fi
+          for directory in npm/*/; do
+            name="$(node -p "require('./${directory}package.json').name")"
+            # Publishing eight packages multiplies the failure surface, so make
+            # a rerun after a partial failure safe instead of fatal.
+            if npm view "$name@$package_version" version >/dev/null 2>&1; then
+              echo "$name@$package_version is already published; skipping"
+              continue
+            fi
+            npm publish "$directory" --access public --provenance --tag "$publish_tag"
+          done
+
+  publish-npm:
+    name: Publish CLI and Browser SDK to npm
+    needs:
+      - host
+      # The main package declares the platform packages as optional
+      # dependencies. Publishing it first would ship a version whose CLI cannot
+      # resolve a binary until the rest land.
+      - publish-npm-platforms
+    if: ${{ always() && needs.host.result == 'success' && needs.publish-npm-platforms.result == 'success' }}
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       id-token: write
@@ -314,7 +380,9 @@ jobs:
       - name: Install Chromium
         working-directory: packages/deckprobe-js
         run: npx playwright install --with-deps chromium
-      - name: Build and test Browser SDK
+      - name: Build the native CLI the launcher wraps
+        run: cargo build --locked --release -p deckprobe
+      - name: Build and test CLI and Browser SDK
         working-directory: packages/deckprobe-js
         run: |
           npm run build

CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to DeckProbe are documented here.
 
 ## [Unreleased]
 
+## [2.3.0] - 2026-08-06
+
+### Added
+
+- Node.js is a first-class target for `@deckflow/deckprobe`: the `node` export
+  condition loads WASM from disk, `probe()` initializes lazily without a custom
+  fetch, and `probeFile(path)` returns reports whose `source_kind` matches the
+  native CLI for the same file.
+- The npm package ships the native `deckprobe` CLI on PATH via per-platform
+  optional dependencies. Release CI repackages the same cargo-dist archives that
+  GitHub Releases serve, so `npx @deckflow/deckprobe` and the shell installers
+  hand out byte-identical binaries.
+
+### Fixed
+
+- Browser and native WASM paths now report identical `confidence_score` values
+  for the same probe.
+- The browser SDK exposes a stable WASM entry and guards initialization so
+  bundlers and Workers resolve the module reliably.
+- Release CI coverage for the `--artifacts` platform-package packaging path
+  (archive discovery, tar/zip extraction, and generated manifests).
+
 ## [2.2.1] - 2026-08-04
 
 ### Fixed

Cargo.toml

@@ -15,7 +15,7 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "2.2.1"
+version = "2.3.0"
 edition = "2024"
 license = "MIT"
 repository = "https://github.com/deckflow/deckprobe"

README.md

@@ -10,7 +10,7 @@ Ask for the facts you need. Get structured JSON with confidence, evidence, and m
 [![License: MIT](https://img.shields.io/badge/license-MIT-2f80ed.svg)](LICENSE)
 [![Rust 1.88+](https://img.shields.io/badge/rust-1.88%2B-orange.svg)](https://www.rust-lang.org/)
 
-[Install](docs/INSTALLATION.md) · [Quickstart](#quickstart) · [Browser SDK](#browser-js-sdk) · [Execution modes](#execution-modes) · [Examples](#common-recipes) · [Formats](#supported-formats) · [CLI reference](docs/CLI-REFERENCE.md)
+[Install](docs/INSTALLATION.md) · [Quickstart](#quickstart) · [npm package](#javascript-package) · [Execution modes](#execution-modes) · [Examples](#common-recipes) · [Formats](#supported-formats) · [CLI reference](docs/CLI-REFERENCE.md)
 
 </div>
 
@@ -171,19 +171,43 @@ printf '%s\n' \
   '{"path":"deck.pptx"}' | deckprobe --jsonl -t @summary
 ```
 
-## Browser JS SDK
+## JavaScript package
 
-The independently published `@deckflow/deckprobe` package runs the same
-target-driven Rust engine in WebAssembly. It accepts browser `File`, `Blob`,
-`ArrayBuffer`, and `Uint8Array` inputs; document bytes do not leave the
-browser.
+The independently published `@deckflow/deckprobe` package ships the `deckprobe`
+command for Node and runs the same target-driven Rust engine in WebAssembly for
+browsers and Node APIs.
 
-### Install and choose an import
+### Install from npm
 
 ```sh
 npm install @deckflow/deckprobe
 ```
 
+That installs the `deckprobe` command as well. It is the same native binary the
+standalone installers ship, delivered through a per-platform optional
+dependency, so every flag, help page, report, and exit code is identical:
+
+```sh
+npx @deckflow/deckprobe --help
+npx @deckflow/deckprobe -t slide_count deck.pptx
+```
+
+Under Node the package also exposes `probeFile()`, which reads a file and
+returns the same report the CLI writes for it. Note that it holds the whole
+file in memory, while the CLI reads only the paths a probe needs — prefer the
+command, or `--jsonl` for batches, on large inputs.
+
+```ts
+import { probeFile } from "@deckflow/deckprobe";
+
+const report = await probeFile("deck.pptx", { targets: ["@summary"] });
+```
+
+### Browser SDK
+
+In the browser it accepts `File`, `Blob`, `ArrayBuffer`, and `Uint8Array`
+inputs; document bytes do not leave the browser.
+
 | Need | Import | Use it when |
 |---|---|---|
 | Main-thread probe and discovery | `@deckflow/deckprobe` | A small, interaction-adjacent probe can use the UI thread. |
@@ -246,6 +270,27 @@ verify that the application's bundler preserves module-worker URLs. Calling
 the main entry point for discovery and integration tooling. See the
 [package guide](packages/deckprobe-js/README.md) for the complete API.
 
+### Bundler setup
+
+The package resolves its WebAssembly binary relative to its own JavaScript
+wrapper, so a bundler that relocates the wrapper without the binary breaks
+initialization. **Vite's dev server does this in every version** and reports
+either `HTTP status code is not ok` or `expected magic word 00 61 73 6d`,
+while `vite build` works — exclude the package from dependency
+pre-bundling:
+
+```ts
+// vite.config.ts
+export default defineConfig({
+  optimizeDeps: { exclude: ["@deckflow/deckprobe"] },
+});
+```
+
+Main-thread-only applications can instead pass the binary URL to
+`initDeckProbe()` via the `@deckflow/deckprobe/wasm` export. See the package
+guide's [bundler notes](packages/deckprobe-js/README.md#bundlers) for both
+fixes, the per-version error messages, and the CDN, sub-path, and CSP cases.
+
 ## Execution modes
 
 DeckProbe deliberately exposes different execution modes instead of treating

crates/deckprobe-core/src/model.rs

@@ -45,7 +45,11 @@ impl Confidence {
         }
     }
 
-    pub fn score(self) -> f32 {
+    /// Reported as `confidence_score`. This is `f64` rather than `f32` so the
+    /// JSON is identical everywhere: serde_json prints the shortest round-trip
+    /// form of an `f32` ("0.95"), but the WASM boundary widens `f32` to a JS
+    /// number and would emit 0.949999988079071 for the same value.
+    pub fn score(self) -> f64 {
         match self {
             Self::None => 0.0,
             Self::Low => 0.4,
@@ -281,7 +285,7 @@ pub struct Evidence {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub value: Option<Value>,
     pub confidence: Confidence,
-    pub confidence_score: f32,
+    pub confidence_score: f64,
     pub path: String,
     pub source: String,
 }

crates/deckprobe-wasm/src/lib.rs

@@ -19,17 +19,26 @@ fn options_from_js(options: JsValue) -> Result<ProbeOptions, JsValue> {
     })
 }
 
-/// Probe browser-owned bytes. Engine failures are returned as schema-v2 error
+/// Probe host-owned bytes. Engine failures are returned as schema-v2 error
 /// reports; only an invalid JS options object throws.
+///
+/// `source_kind` labels where the bytes came from in the report. It defaults to
+/// `browser_bytes`; a Node caller that read a file from disk passes
+/// `local_file` so the report matches what the native CLI would have written.
 #[wasm_bindgen(js_name = probe)]
 pub fn probe_js(
     display_name: String,
     bytes: Uint8Array,
     options: JsValue,
+    source_kind: Option<String>,
 ) -> Result<JsValue, JsValue> {
     let options = options_from_js(options)?;
     let bytes = bytes.to_vec();
-    let source = MemorySource::with_kind(display_name, "browser_bytes", bytes);
+    let source = MemorySource::with_kind(
+        display_name,
+        source_kind.as_deref().unwrap_or("browser_bytes"),
+        bytes,
+    );
     match deckprobe_engine::probe_source(source, options) {
         Ok(report) => to_js_value(&report),
         Err(error) => to_js_value(&deckprobe_engine::error_report(&error)),

packages/deckprobe-js/.npmignore

@@ -3,6 +3,8 @@
 # so the WASM artifacts listed in "files" are actually packed.
 node_modules/
 benchmark/
+# Generated platform packages are published separately, never nested here.
+npm/
 scripts/serve-benchmark.mjs
 *.tsbuildinfo
 .DS_Store