deepbom 1.94.5 → 1.95.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +21 -2
- package/bin/deepbom.mjs +55 -19
- package/package.json +8 -2
- package/pkg/release-manifest.json +6 -4
- package/pkg/tflite_wasm_audit_bg.wasm +0 -0
package/README.md
CHANGED
|
@@ -1,15 +1,31 @@
|
|
|
1
1
|
# DEEPBOM CLI
|
|
2
2
|
|
|
3
|
-
Local deployment-artifact analysis for TFLite, ONNX, GGUF, SafeTensors,
|
|
4
|
-
|
|
3
|
+
Local deployment-artifact analysis for TFLite, ONNX, GGUF, SafeTensors, Core ML,
|
|
4
|
+
and ExecuTorch.
|
|
5
5
|
|
|
6
6
|
```console
|
|
7
7
|
npx deepbom audit model.onnx --format cyclonedx
|
|
8
|
+
npx deepbom audit model.onnx --format sarif --output deepbom.sarif --fail-on high
|
|
9
|
+
npx deepbom capabilities --compact
|
|
8
10
|
npx deepbom gguf model.gguf --context 8192 --memory-mib 8192
|
|
9
11
|
npx deepbom audit Model.mlpackage --compact
|
|
10
12
|
npx deepbom audit safetensors-repository/ --compact
|
|
13
|
+
npx deepbom verify model.tflite --contract production-interface.json
|
|
14
|
+
npx deepbom diff baseline.tflite candidate.tflite
|
|
15
|
+
npx deepbom explore model.tflite --target-profile target-profile.json
|
|
16
|
+
npx deepbom audit model.pte --executorch-build deepbom.executorch-build.json --compact
|
|
11
17
|
```
|
|
12
18
|
|
|
19
|
+
The default output is a bounded human-readable summary. Use `--json` or
|
|
20
|
+
`--compact` for the complete analysis document, `--format envelope` for the
|
|
21
|
+
canonical cross-format contract, `--format cyclonedx` for CycloneDX 1.7, or
|
|
22
|
+
`--format sarif` for OASIS SARIF 2.1.0. `--policy-output` records a deterministic
|
|
23
|
+
finding gate when `--fail-on` is selected.
|
|
24
|
+
|
|
25
|
+
`verify` fails closed on interface contradictions, `diff` preserves the
|
|
26
|
+
canonical multi-target TFLite delta ledger, and `explore` exposes deterministic
|
|
27
|
+
WASM Pareto candidates. These commands do not add a second analysis engine.
|
|
28
|
+
|
|
13
29
|
The package contains one generated JavaScript analysis bundle and the canonical
|
|
14
30
|
TFLite WebAssembly module. It does not send model bytes or results over the
|
|
15
31
|
network. TensorRT parser observations and build profiles can be imported with
|
|
@@ -17,6 +33,9 @@ network. TensorRT parser observations and build profiles can be imported with
|
|
|
17
33
|
|
|
18
34
|
ONNX external data next to the model is discovered only from safe serialized
|
|
19
35
|
references. Use `--external-data-dir` to bind a different explicit root.
|
|
36
|
+
ExecuTorch PTE audits use the same option for PTD data; `--executorch-build`
|
|
37
|
+
binds a duplicate-key-checked selected-build and binary inventory without
|
|
38
|
+
promoting it to observed execution.
|
|
20
39
|
Core ML packages and sharded SafeTensors repositories are hashed as canonical
|
|
21
40
|
multi-file artifact sets rather than collapsed to one unqualified file hash.
|
|
22
41
|
|