deepbom 0.1.0 → 1.94.4

package/package.json

@@ -1,33 +1,39 @@
 {
   "name": "deepbom",
-  "version": "0.1.0",
-  "description": "Deployment-artifact analysis for on-device neural network models — local static audit of TFLite graphs, quantization contracts and predicted XNNPACK delegate placement",
+  "version": "1.94.4",
+  "description": "Local multi-format deployment-artifact analysis for on-device AI models",
   "type": "module",
   "bin": {
-    "deepbom": "bin/deepbom.js"
+    "deepbom": "bin/deepbom.mjs"
   },
   "files": [
     "bin/",
-    "vendor/",
+    "pkg/",
     "README.md",
     "LICENSE"
   ],
-  "license": "ISC",
   "engines": {
     "node": ">=20"
   },
+  "license": "Apache-2.0",
+  "homepage": "https://deepbom.org",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/JunHwan-Kwon/deepbom.git"
+  },
+  "author": "Jun-Hwan Kwon",
+  "publishConfig": {
+    "access": "public"
+  },
   "keywords": [
     "tflite",
-    "litert",
     "onnx",
+    "gguf",
+    "safetensors",
+    "coreml",
+    "tensorrt",
     "quantization",
     "on-device",
-    "edge-ai",
-    "xnnpack",
-    "ml-bom",
-    "cyclonedx",
-    "static-analysis"
-  ],
-  "homepage": "https://deepbom.org",
-  "author": "Jun-Hwan Kwon"
+    "ml-bom"
+  ]
 }

package/pkg/release-manifest.json

@@ -0,0 +1,30 @@
+{
+  "schema": "deepbom.npm_release.v1",
+  "version": "1.94.4",
+  "source": {
+    "git_commit": "ec751d7a3eb34395f4df0efd1d3fe5a95d2cba4d",
+    "git_state": "clean",
+    "distribution": "public_channel"
+  },
+  "runtime": {
+    "node": ">=20",
+    "tflite_wasm_sha256": "502b847240063853bc473daa36b0d8c15ac3a4071c7ee0d64f2d743342a15bb8"
+  },
+  "license": {
+    "spdx": "Apache-2.0",
+    "file": "LICENSE"
+  },
+  "public_bundle_input_count": 97,
+  "supported_inputs": [
+    "tflite",
+    "onnx",
+    "onnx_external_data",
+    "gguf",
+    "safetensors",
+    "safetensors_sharded_repository",
+    "coreml_mlmodel",
+    "coreml_mlpackage",
+    "tensorrt_evidence",
+    "tensorrt_llm_contract"
+  ]
+}

package/bin/deepbom.js

@@ -1,188 +0,0 @@
-#!/usr/bin/env node
-// deepbom — deployment-artifact analysis for on-device neural network models.
-//
-// Runs the browser analyzer's WebAssembly module locally. Model bytes never
-// leave the machine; this command performs no network access.
-
-import { readFile } from "node:fs/promises";
-import { fileURLToPath } from "node:url";
-import { dirname, join, basename } from "node:path";
-import { createHash } from "node:crypto";
-
-const HERE = dirname(fileURLToPath(import.meta.url));
-const ROOT = join(HERE, "..");
-const pkg = JSON.parse(await readFile(join(ROOT, "package.json"), "utf8"));
-
-const argv = process.argv.slice(2);
-
-function parseArgs(list) {
-  const opts = { _: [] };
-  for (let i = 0; i < list.length; i += 1) {
-    const a = list[i];
-    if (a === "--json") opts.json = true;
-    else if (a === "--quiet" || a === "-q") opts.quiet = true;
-    else if (a === "--target" || a === "-t") opts.target = list[++i];
-    else if (a === "--help" || a === "-h") opts.help = true;
-    else if (a === "--version" || a === "-v") opts.version = true;
-    else if (a.startsWith("--target=")) opts.target = a.slice(9);
-    else if (a.startsWith("-")) { fail(`unknown option: ${a}`); }
-    else opts._.push(a);
-  }
-  return opts;
-}
-
-function fail(message, code = 2) {
-  process.stderr.write(`deepbom: ${message}\n`);
-  process.exit(code);
-}
-
-const USAGE = `deepbom ${pkg.version} — deployment-artifact analysis for on-device models
-
-USAGE
-  deepbom audit <file> [--target <id>] [--json]
-  deepbom targets
-  deepbom --version
-
-COMMANDS
-  audit     Analyse a model artifact and print a summary
-  targets   List available target profiles
-
-OPTIONS
-  -t, --target <id>   Target profile (default: android_mid_a55)
-      --json          Emit the full analysis ledger as JSON
-  -q, --quiet         Suppress the summary header
-  -h, --help          Show this help
-
-FORMATS
-  TFLite (.tflite) is supported in this release. ONNX, GGUF, SafeTensors and
-  Core ML are available in the browser version at https://deepbom.org
-
-PRIVACY
-  Analysis runs locally. No model bytes, filenames or results are uploaded.
-`;
-
-async function loadEngine() {
-  const mod = await import(new URL("../vendor/tflite_wasm_audit.js", import.meta.url));
-  const wasm = await readFile(new URL("../vendor/tflite_wasm_audit_bg.wasm", import.meta.url));
-  mod.initSync({ module: wasm });
-  return mod;
-}
-
-const fmtInt = (n) => Number(n ?? 0).toLocaleString("en-US");
-function fmtBytes(n) {
-  const v = Number(n ?? 0);
-  if (!Number.isFinite(v) || v <= 0) return "0 B";
-  const units = ["B", "KB", "MB", "GB"];
-  const i = Math.min(units.length - 1, Math.floor(Math.log(v) / Math.log(1024)));
-  return `${(v / 1024 ** i).toFixed(i === 0 ? 0 : 1)} ${units[i]}`;
-}
-const pct = (n, d) => (d > 0 ? `${((n / d) * 100).toFixed(0)}%` : "n/a");
-
-async function cmdTargets() {
-  const engine = await loadEngine();
-  const profiles = engine.target_profiles() || [];
-  for (const p of profiles) {
-    const id = p?.id ?? p;
-    const label = p?.label ? ` — ${p.label}` : "";
-    process.stdout.write(`${id}${label}\n`);
-  }
-}
-
-async function cmdAudit(opts) {
-  const file = opts._[0];
-  if (!file) fail("audit requires a file path\n\n" + USAGE);
-
-  let bytes;
-  try {
-    bytes = new Uint8Array(await readFile(file));
-  } catch (error) {
-    fail(`cannot read ${file}: ${error.code ?? error.message}`);
-  }
-  if (bytes.length === 0) fail(`${file} is empty`);
-
-  const engine = await loadEngine();
-  const target = opts.target || "android_mid_a55";
-  const known = (engine.target_profiles() || []).map((p) => p?.id ?? p);
-  if (known.length && !known.includes(target)) {
-    fail(`unknown target "${target}". Run: deepbom targets`);
-  }
-
-  let analysis;
-  try {
-    analysis = engine.analyze_tflite_for_target(bytes, basename(file), target);
-  } catch (error) {
-    fail(`analysis failed: ${error?.message ?? error}\n` +
-         `This release supports TFLite FlatBuffer artifacts. ` +
-         `For ONNX, GGUF, SafeTensors and Core ML see https://deepbom.org`, 1);
-  }
-
-  if (opts.json) {
-    process.stdout.write(`${JSON.stringify(analysis, null, 2)}\n`);
-    return;
-  }
-
-  const sha = analysis.model_sha256 || createHash("sha256").update(bytes).digest("hex");
-  const ops = Array.isArray(analysis.ops) ? analysis.ops : [];
-  const delegated = ops.filter((o) => o?.xnnpack_supported === true).length;
-  const findings = Array.isArray(analysis.findings) ? analysis.findings : [];
-  const out = [];
-
-  if (!opts.quiet) {
-    out.push(`${analysis.filename || basename(file)}`);
-    out.push(`  sha256   ${sha}`);
-    out.push(`  format   ${analysis.format ?? "unknown"}   size ${fmtBytes(analysis.file_size ?? bytes.length)}`);
-    out.push(`  target   ${target}`);
-    out.push("");
-  }
-
-  out.push("graph");
-  out.push(`  operators          ${fmtInt(analysis.operator_count)}`);
-  out.push(`  tensors            ${fmtInt(analysis.tensor_count)}`);
-  if (analysis.total_macs != null) out.push(`  total MACs         ${fmtInt(analysis.total_macs)}`);
-  out.push("");
-
-  out.push("quantization");
-  out.push(`  quantized tensors  ${fmtInt(analysis.quantized_tensors)} / ${fmtInt(analysis.tensor_count)}  (${pct(analysis.quantized_tensors, analysis.tensor_count)})`);
-  out.push(`  per-axis tensors   ${fmtInt(analysis.per_channel_tensors)}`);
-  out.push("");
-
-  if (ops.length) {
-    out.push("XNNPACK delegate (predicted)");
-    out.push(`  delegated ops      ${fmtInt(delegated)} / ${fmtInt(ops.length)}  (${pct(delegated, ops.length)})`);
-    if (analysis.xnnpack_effective_chain_breaks != null) {
-      out.push(`  chain breaks       ${fmtInt(analysis.xnnpack_effective_chain_breaks)} effective / ${fmtInt(analysis.xnnpack_chain_breaks)} total`);
-    }
-    if (analysis.fallback_estimated_bytes) {
-      out.push(`  fallback traffic   ${fmtBytes(analysis.fallback_estimated_bytes)}`);
-    }
-    out.push("");
-  }
-
-  if (findings.length) {
-    out.push(`findings (${findings.length})`);
-    for (const f of findings.slice(0, 10)) {
-      const sev = String(f?.severity ?? f?.priority ?? "info").toUpperCase().padEnd(6);
-      const title = f?.title ?? f?.message ?? f?.id ?? "";
-      out.push(`  ${sev} ${title}`);
-    }
-    if (findings.length > 10) out.push(`  ... ${findings.length - 10} more (use --json)`);
-    out.push("");
-  }
-
-  out.push("Predicted delegate placement is a static projection, not observed runtime behaviour.");
-  out.push("Full ledger: deepbom audit <file> --json");
-  process.stdout.write(`${out.join("\n")}\n`);
-}
-
-const opts = parseArgs(argv);
-if (opts.version) { process.stdout.write(`${pkg.version}\n`); process.exit(0); }
-if (opts.help || argv.length === 0) { process.stdout.write(USAGE); process.exit(argv.length === 0 ? 1 : 0); }
-
-const command = opts._.shift();
-try {
-  if (command === "audit") await cmdAudit(opts);
-  else if (command === "targets") await cmdTargets();
-  else fail(`unknown command "${command}"\n\n${USAGE}`);
-} catch (error) {
-  fail(error?.stack ?? String(error), 1);
-}