deepbom 1.94.6 → 1.96.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +16 -3
- package/bin/deepbom.mjs +122 -28
- package/package.json +5 -2
- package/pkg/release-manifest.json +6 -4
- package/pkg/tflite_wasm_audit_bg.wasm +0 -0
package/README.md
CHANGED
|
@@ -1,20 +1,26 @@
|
|
|
1
1
|
# DEEPBOM CLI
|
|
2
2
|
|
|
3
|
-
Local deployment-artifact analysis for TFLite, ONNX, GGUF, SafeTensors,
|
|
4
|
-
|
|
3
|
+
Local deployment-artifact analysis for TFLite, ONNX, GGUF, SafeTensors, Core ML,
|
|
4
|
+
and ExecuTorch.
|
|
5
5
|
|
|
6
6
|
```console
|
|
7
7
|
npx deepbom audit model.onnx --format cyclonedx
|
|
8
|
+
npx deepbom audit model.onnx --format sarif --output deepbom.sarif --fail-on high
|
|
9
|
+
npx deepbom capabilities --compact
|
|
8
10
|
npx deepbom gguf model.gguf --context 8192 --memory-mib 8192
|
|
9
11
|
npx deepbom audit Model.mlpackage --compact
|
|
10
12
|
npx deepbom audit safetensors-repository/ --compact
|
|
11
13
|
npx deepbom verify model.tflite --contract production-interface.json
|
|
12
14
|
npx deepbom diff baseline.tflite candidate.tflite
|
|
13
15
|
npx deepbom explore model.tflite --target-profile target-profile.json
|
|
16
|
+
npx deepbom audit model.pte --executorch-build deepbom.executorch-build.json --compact
|
|
14
17
|
```
|
|
15
18
|
|
|
16
19
|
The default output is a bounded human-readable summary. Use `--json` or
|
|
17
|
-
`--compact` for the complete analysis document
|
|
20
|
+
`--compact` for the complete analysis document, `--format envelope` for the
|
|
21
|
+
canonical cross-format contract, `--format cyclonedx` for CycloneDX 1.7, or
|
|
22
|
+
`--format sarif` for OASIS SARIF 2.1.0. `--policy-output` records a deterministic
|
|
23
|
+
finding gate when `--fail-on` is selected.
|
|
18
24
|
|
|
19
25
|
`verify` fails closed on interface contradictions, `diff` preserves the
|
|
20
26
|
canonical multi-target TFLite delta ledger, and `explore` exposes deterministic
|
|
@@ -27,11 +33,18 @@ network. TensorRT parser observations and build profiles can be imported with
|
|
|
27
33
|
|
|
28
34
|
ONNX external data next to the model is discovered only from safe serialized
|
|
29
35
|
references. Use `--external-data-dir` to bind a different explicit root.
|
|
36
|
+
ExecuTorch PTE audits use the same option for PTD data; `--executorch-build`
|
|
37
|
+
binds a duplicate-key-checked selected-build and binary inventory without
|
|
38
|
+
promoting it to observed execution.
|
|
30
39
|
Core ML packages and sharded SafeTensors repositories are hashed as canonical
|
|
31
40
|
multi-file artifact sets rather than collapsed to one unqualified file hash.
|
|
32
41
|
|
|
33
42
|
Static provider/delegate placement remains predicted or conditionally eligible
|
|
34
43
|
unless an identity-bound runtime or parser observation is imported.
|
|
35
44
|
|
|
45
|
+
For the installed version, `deepbom --help` and `deepbom capabilities --compact`
|
|
46
|
+
are authoritative. The current source inventory is maintained in the
|
|
47
|
+
[generated CLI reference](https://github.com/JunHwan-Kwon/deepbom/blob/main/docs/CLI_REFERENCE.md).
|
|
48
|
+
|
|
36
49
|
This public channel package is licensed under Apache-2.0. Protected analyzers
|
|
37
50
|
and private rulepack-generation sources are not included.
|