mlbundle 0.1.0a1__py3-none-any.whl

mlbundle/_onnx/validation.py

@@ -0,0 +1,164 @@
+"""Self-contained inference graph validation before checker or runtime loading."""
+
+from math import prod
+from typing import Any
+
+import onnx
+
+from mlbundle.errors import InvalidModelError, LimitExceededError, MLBundleError
+from mlbundle.limits import MAX_FEATURES, ArchiveLimits
+
+from .protobuf import validate_wire
+
+DOMAINS = frozenset({"", "ai.onnx", "ai.onnx.ml"})
+MAX_NODES = 100_000
+MAX_RANK = 32
+BYTE_CAP = ArchiveLimits().max_member_bytes
+# Storage field, bytes per element, primitive values per element.
+TENSOR_TYPES = {
+    1: ("float_data", 4, 1),
+    2: ("int32_data", 1, 1),
+    3: ("int32_data", 1, 1),
+    4: ("int32_data", 2, 1),
+    5: ("int32_data", 2, 1),
+    6: ("int32_data", 4, 1),
+    7: ("int64_data", 8, 1),
+    8: ("string_data", 0, 1),
+    9: ("int32_data", 1, 1),
+    10: ("int32_data", 2, 1),
+    11: ("double_data", 8, 1),
+    12: ("uint64_data", 4, 1),
+    13: ("uint64_data", 8, 1),
+    14: ("float_data", 8, 2),
+    15: ("double_data", 16, 2),
+    16: ("int32_data", 2, 1),
+}
+
+
+def _dimensions(dims: Any, *, allow_zero: bool) -> int:
+    if len(dims) > MAX_RANK or any(
+        dimension < (0 if allow_zero else 1) or dimension > BYTE_CAP
+        for dimension in dims
+    ):
+        raise LimitExceededError("ONNX tensor dimensions exceed the limit.")
+    count = prod(dims)
+    if count > BYTE_CAP:
+        raise LimitExceededError("ONNX tensor element count exceeds the limit.")
+    return count
+
+
+def _tensor(tensor: Any) -> int:
+    if tensor.data_location != onnx.TensorProto.DEFAULT or tensor.external_data:
+        raise InvalidModelError("ONNX external tensor data is unsupported.")
+    if tensor.HasField("segment") or tensor.data_type not in TENSOR_TYPES:
+        raise InvalidModelError("Unsupported ONNX tensor storage.")
+    count = _dimensions(tensor.dims, allow_zero=True)
+    field, size, factor = TENSOR_TYPES[tensor.data_type]
+    if count * max(size, 1) > BYTE_CAP:
+        raise LimitExceededError("ONNX tensor storage exceeds the limit.")
+    populated = [
+        name
+        for name in {value[0] for value in TENSOR_TYPES.values()}
+        if len(getattr(tensor, name))
+    ]
+    if tensor.HasField("raw_data"):
+        valid = size > 0 and not populated and len(tensor.raw_data) == count * size
+    else:
+        valid = (
+            all(name == field for name in populated)
+            and len(getattr(tensor, field)) == count * factor
+        )
+    if not valid:
+        raise InvalidModelError("ONNX tensor dimensions and stored values disagree.")
+    return max(count * max(size, 1), len(tensor.raw_data))
+
+
+def _shape(shape: Any) -> None:
+    if len(shape.dim) > MAX_RANK:
+        raise LimitExceededError("ONNX value rank exceeds the limit.")
+    static = []
+    for dim in shape.dim:
+        if dim.HasField("dim_value"):
+            static.append(dim.dim_value)
+        elif len(dim.dim_param) > 1024:
+            raise LimitExceededError("ONNX dim_param exceeds the 1024-character limit.")
+    _dimensions(static, allow_zero=True)
+
+
+def _operator(value: Any) -> None:
+    if value.domain not in DOMAINS:
+        raise InvalidModelError("Unsupported ONNX operator domain.")
+    if value.DESCRIPTOR.name == "NodeProto" and (
+        value.overload or value.device_configurations
+    ):
+        raise InvalidModelError("Unsupported ONNX node configuration.")
+
+
+def _sparse(value: Any) -> None:
+    count = _dimensions(value.dims, allow_zero=True)
+    size = max(TENSOR_TYPES.get(value.values.data_type, (None, BYTE_CAP, 1))[1], 1)
+    if count * size > BYTE_CAP:
+        raise LimitExceededError("ONNX sparse tensor dense storage exceeds the limit.")
+
+
+def _children(value: Any) -> list[Any]:
+    children = []
+    for field, child in value.ListFields():
+        if field.type == field.TYPE_MESSAGE:
+            children.extend(child if field.is_repeated else [child])
+    return children
+
+
+def _visit(model: Any) -> None:
+    pending = [model]
+    nodes = storage = 0
+    while pending:
+        value = pending.pop()
+        name = value.DESCRIPTOR.name
+        if name == "TensorProto":
+            storage += _tensor(value)
+            if storage > BYTE_CAP:
+                raise LimitExceededError(
+                    "ONNX aggregate tensor storage exceeds the limit."
+                )
+        elif name == "SparseTensorProto":
+            _sparse(value)
+        elif name == "TensorShapeProto":
+            _shape(value)
+        elif name in ("NodeProto", "FunctionProto", "OperatorSetIdProto"):
+            _operator(value)
+            if name == "NodeProto":
+                nodes += 1
+                if nodes > MAX_NODES:
+                    raise LimitExceededError("ONNX node count exceeds the limit.")
+        pending.extend(_children(value))
+
+
+def parse_model(data: bytes) -> Any:
+    try:
+        validate_wire(data, onnx.ModelProto.DESCRIPTOR)
+        model = onnx.ModelProto()
+        model.ParseFromString(data)
+        _visit(model)
+        if model.training_info or model.functions or model.configuration:
+            raise InvalidModelError(
+                "ONNX training, local functions and device configuration are unsupported."
+            )
+        if any(item.key == "ort_config" for item in model.metadata_props):
+            raise InvalidModelError(
+                "ONNX runtime configuration metadata is unsupported."
+            )
+        if not 1 <= len(model.graph.input) <= MAX_FEATURES:
+            raise InvalidModelError("ONNX requires bounded tabular inputs.")
+        initializers = {item.name for item in model.graph.initializer} | {
+            item.values.name for item in model.graph.sparse_initializer
+        }
+        if initializers & {item.name for item in model.graph.input}:
+            raise InvalidModelError("ONNX overridable initializers are unsupported.")
+        # full_check=False avoids shape inference executing constant propagation.
+        onnx.checker.check_model(model, full_check=False)
+        return model
+    except MLBundleError:
+        raise
+    except Exception:
+        raise InvalidModelError("Invalid ONNX protobuf or graph.") from None

mlbundle/_pipeline_contract.py

@@ -0,0 +1,104 @@
+"""Core-only composite records; declarations never select Python constructors."""
+
+from __future__ import annotations
+
+from typing import Annotated, Literal
+
+from pydantic import Field, JsonValue, field_validator, model_validator
+
+from ._base import ContractModel
+from .canonical import canonical_dumps
+from .claims import FeatureNames, ModelClaims, validate_labels
+from .contract import MODEL_MEMBERS, Library, MemberName, SerializationFormat
+from .limits import HYPERPARAMETER_BYTES, MAX_FEATURES
+
+StepName = Annotated[str, Field(min_length=1, max_length=256)]
+Digest = Annotated[str, Field(pattern=r"^[0-9a-f]{64}$")]
+OPTIONS = {"steps", "memory", "verbose", "transform_input"}
+
+
+def valid_step_names(names: list[str]) -> bool:
+    return len(set(names)) == len(names) and all(
+        "__" not in name and name not in OPTIONS for name in names
+    )
+
+
+class TransformerInfo(ContractModel):
+    member: Literal["model.skops"]
+    estimator_class: Literal["Pipeline"]
+    hyperparameters: dict[str, JsonValue] = Field(max_length=4096)
+    state_sha256: Digest
+
+    @field_validator("hyperparameters")
+    @classmethod
+    def bounded_parameters(cls, value: dict[str, JsonValue]) -> dict[str, JsonValue]:
+        canonical_dumps(value, max_bytes=HYPERPARAMETER_BYTES, max_depth=16)
+        return value
+
+
+class NativeComponentInfo(ContractModel):
+    library: Literal[Library.XGBOOST, Library.CATBOOST]
+    serialization: SerializationFormat
+    member: MemberName
+    claims: ModelClaims
+
+    @model_validator(mode="after")
+    def native_pairing(self) -> NativeComponentInfo:
+        if (self.serialization, self.member) != MODEL_MEMBERS[self.library]:
+            raise ValueError("Invalid native component pairing.")
+        classes = {
+            Library.XGBOOST: {"XGBClassifier", "XGBRegressor"},
+            Library.CATBOOST: {"CatBoostClassifier", "CatBoostRegressor"},
+        }
+        if self.claims.estimator_class not in classes[self.library]:
+            raise ValueError("Invalid native component class.")
+        if self.claims.onnx is not None:
+            raise ValueError("Composite components cannot declare ONNX fields.")
+        validate_labels(self.claims, self.claims.class_labels)
+        return self
+
+
+class TransformedFeatures(ContractModel):
+    n_features: int = Field(gt=0, le=MAX_FEATURES)
+    names: FeatureNames
+    origin: Literal["transformer", "model", "input", "generated"]
+
+    @model_validator(mode="after")
+    def aligned_names(self) -> TransformedFeatures:
+        if len(self.names) != self.n_features or len(set(self.names)) != len(
+            self.names
+        ):
+            raise ValueError("Invalid transformed names.")
+        if self.origin == "generated" and self.names != [
+            f"transformed_feature_{i}" for i in range(1, self.n_features + 1)
+        ]:
+            raise ValueError("Invalid generated transformed names.")
+        return self
+
+
+class PipelineInfo(ContractModel):
+    step_names: list[StepName] = Field(min_length=1, max_length=128)
+    transformers: TransformerInfo | None
+    estimator: NativeComponentInfo
+    transformed_features: TransformedFeatures
+
+    @model_validator(mode="after")
+    def consistent_recipe(self) -> PipelineInfo:
+        if not valid_step_names(self.step_names):
+            raise ValueError("Invalid Pipeline names.")
+        if (len(self.step_names) > 1) != (self.transformers is not None):
+            raise ValueError("Transformer recipe and steps disagree.")
+        if self.transformed_features.n_features != self.estimator.claims.n_features:
+            raise ValueError("Composite boundary widths disagree.")
+        return self
+
+
+def expected_model_members(
+    library: Library, pipeline: PipelineInfo | None
+) -> set[MemberName]:
+    if pipeline is None:
+        return {MODEL_MEMBERS[library][1]}
+    members = {pipeline.estimator.member}
+    if pipeline.transformers is not None:
+        members.add(MemberName.SKOPS)
+    return members

mlbundle/_prediction_input.py

@@ -0,0 +1,63 @@
+"""Numeric input checks shared by optional sklearn and XGBoost predictors."""
+
+import math
+from typing import Any
+
+import numpy as np
+from scipy.sparse import issparse
+
+from .errors import InvalidModelError, MLBundleError, PredictionInputError
+
+
+def tabular(
+    data: Any, width: int, *, categorical: bool = False, strings: bool = False
+) -> tuple[Any, int]:
+    try:
+        shape = getattr(data, "shape", None)
+        if shape is None:
+            data = np.asarray(data)
+            shape = data.shape
+        if len(shape) != 2 or shape[1] != width:
+            raise PredictionInputError(
+                "Prediction input must have the model's feature width."
+            )
+        if issparse(data):
+            arrays = [data.data]
+        elif categorical and hasattr(data, "dtypes"):
+            arrays = [
+                np.asarray(data.iloc[:, index])
+                for index, dtype in enumerate(data.dtypes)
+                if str(dtype) != "category"
+            ]
+        else:
+            arrays = [np.asarray(data)]
+        for values in arrays:
+            _numeric(values, strings=strings)
+        return data, int(shape[0])
+    except MLBundleError:
+        raise
+    except Exception:
+        raise InvalidModelError("Invalid tabular prediction input.") from None
+
+
+def _numeric(values: np.ndarray, *, strings: bool) -> None:
+    if values.dtype.kind == "O":
+        if any(
+            not (strings and isinstance(value, str))
+            and (
+                not isinstance(
+                    value, (int, float, np.integer, np.floating, bool, np.bool_)
+                )
+                or math.isinf(value)
+            )
+            for value in values.flat
+        ):
+            raise InvalidModelError(
+                "Prediction input must contain numeric values without infinity."
+            )
+    elif strings and values.dtype.kind == "U":
+        return
+    elif values.dtype.kind not in "biuf" or np.isinf(values).any():
+        raise InvalidModelError(
+            "Prediction input must contain numeric values without infinity."
+        )

mlbundle/_schema_fields.py

@@ -0,0 +1,68 @@
+"""Closed inference-only mlschema 0.2.1 wire vocabulary; no optional imports."""
+
+from __future__ import annotations
+
+from typing import Annotated, Literal
+
+from pydantic import Field, model_validator
+
+from ._base import ContractModel, Name
+from .limits import MAX_FEATURES
+
+FieldLabel = Annotated[str, Field(min_length=1, max_length=100)]
+
+
+class FieldBase(ContractModel):
+    label: FieldLabel
+    required: bool
+    mappedTo: Name
+
+
+class SimpleField(FieldBase):
+    kind: Literal["text", "boolean", "date"]
+
+
+class NumberField(FieldBase):
+    kind: Literal["number"]
+    step: Annotated[float, Field(gt=0)]
+
+
+class CategoryField(FieldBase):
+    kind: Literal["category"]
+    options: Annotated[list[str], Field(min_length=1, max_length=MAX_FEATURES)]
+
+    @model_validator(mode="after")
+    def unique_options(self) -> CategoryField:
+        if len(set(self.options)) != len(self.options):
+            raise ValueError("Category options must be unique.")
+        return self
+
+
+ScalarField = Annotated[
+    SimpleField | NumberField | CategoryField, Field(discriminator="kind")
+]
+
+
+class SeriesField(FieldBase):
+    kind: Literal["series"]
+    field1: ScalarField
+    field2: ScalarField
+
+
+class OneHotOption(ContractModel):
+    label: Name
+    value: Name
+    mappedTo: Name
+
+
+class OneHotField(ContractModel):
+    kind: Literal["onehot-category"]
+    label: FieldLabel
+    required: bool
+    options: Annotated[list[OneHotOption], Field(min_length=2, max_length=MAX_FEATURES)]
+
+
+SchemaField = Annotated[
+    SimpleField | NumberField | CategoryField | SeriesField | OneHotField,
+    Field(discriminator="kind"),
+]

mlbundle/_sklearn/__init__.py

@@ -0,0 +1,183 @@
+"""Skops-only sklearn adapter; importing the base package never imports this module."""
+
+from typing import Any, cast
+
+import numpy as np
+from pydantic import JsonValue, ValidationError
+from sklearn.base import BaseEstimator, is_classifier, is_regressor
+from sklearn.exceptions import NotFittedError
+from sklearn.multioutput import ClassifierChain, MultiOutputRegressor, RegressorChain
+from sklearn.pipeline import Pipeline
+from sklearn.utils import get_tags
+from sklearn.utils.validation import check_is_fitted
+
+from mlbundle.canonical import canonical_value
+from mlbundle.claims import ClassLabels, FeatureNames, ModelClaims
+from mlbundle.contract import Library, MemberName, ModelKind
+from mlbundle.declarations import ExportDeclarations
+from mlbundle.errors import (
+    InvalidJSONError,
+    InvalidModelError,
+    MLBundleError,
+    UnsupportedModelError,
+)
+from mlbundle.limits import MAX_CLASSES, MAX_OUTPUTS
+
+from .parameters import parameters
+from .payload import validate_payload
+from .prediction import Predictor
+from .serialization import SkopsIO
+from .structure import extract_structure, has_structure, validate_tree_storage
+from .trusted import TRUSTED_TYPES as TRUSTED_TYPES
+
+
+def _outputs(model: Any, classifier: bool) -> tuple[int, ClassLabels | None]:
+    if classifier:
+        labels = _labels(model)
+        return len(labels), labels
+    estimator = model.steps[-1][1] if isinstance(model, Pipeline) else model
+    if hasattr(estimator, "n_outputs_"):
+        outputs = estimator.n_outputs_
+        if (
+            not isinstance(outputs, (int, np.integer))
+            or isinstance(outputs, (bool, np.bool_))
+            or not 1 <= outputs <= MAX_OUTPUTS
+        ):
+            raise InvalidModelError("Invalid regressor output count.")
+        return int(outputs), None
+    if hasattr(estimator, "coef_"):
+        coef = np.asarray(estimator.coef_)
+        if coef.ndim not in (1, 2) or coef.shape[-1] != estimator.n_features_in_:
+            raise InvalidModelError("Invalid regressor coefficient dimensions.")
+        return 1 if coef.ndim == 1 else coef.shape[0], None
+    if hasattr(estimator, "_y"):
+        target = np.asarray(estimator._y)
+        return 1 if target.ndim == 1 else target.shape[1], None
+    if isinstance(estimator, (MultiOutputRegressor, RegressorChain)):
+        return len(list(estimator.estimators_)), None
+    if not get_tags(estimator).target_tags.multi_output:
+        return 1, None
+    raise UnsupportedModelError(
+        reason="Regressor output count cannot be recovered faithfully."
+    )
+
+
+def _labels(model: Any) -> ClassLabels:
+    classes = getattr(model, "classes_", None)
+    if classes is None:
+        raise UnsupportedModelError(reason="Classifier must expose original classes_.")
+    outputs = classes if isinstance(classes, list) else [classes]
+    if not 1 <= len(outputs) <= MAX_OUTPUTS or any(
+        np.asarray(output).ndim != 1 or not 1 <= len(output) <= MAX_CLASSES
+        for output in outputs
+    ):
+        raise InvalidModelError("Invalid classifier label dimensions.")
+    return cast(ClassLabels, canonical_value(outputs))
+
+
+class Adapter:
+    library = Library.SKLEARN
+    model_member = MemberName.SKOPS
+
+    def __init__(self) -> None:
+        # Each registry call creates fresh synchronous operation state.
+        self._io = SkopsIO(self._validate, validate_payload)
+
+    def _state(self, model: object) -> str:
+        return self._io.state(model)
+
+    def recognizes(self, model: object) -> bool:
+        return (
+            isinstance(model, BaseEstimator)
+            and not type(model).__module__.startswith(("xgboost.", "catboost."))
+            and (is_classifier(model) or is_regressor(model))
+        )
+
+    def prepare_export(self, model: object, declarations: ExportDeclarations) -> object:
+        if declarations.class_labels is not None:
+            raise UnsupportedModelError(
+                reason="Sklearn already carries class labels; class_labels is unsupported."
+            )
+        return model
+
+    def _validate(self, model: Any) -> None:
+        if not self.recognizes(model):
+            raise UnsupportedModelError(
+                reason="Sklearn payload must be a classifier or regressor."
+            )
+        try:
+            check_is_fitted(model)
+        except NotFittedError:
+            raise UnsupportedModelError(
+                reason="Sklearn estimator must be fitted before export/load."
+            ) from None
+        if is_classifier(model) and not callable(getattr(model, "predict_proba", None)):
+            raise UnsupportedModelError(reason="Classifier must expose predict_proba.")
+        estimator = model.steps[-1][1] if isinstance(model, Pipeline) else model
+        binarizer = getattr(estimator, "_label_binarizer", None)
+        if (
+            isinstance(estimator, ClassifierChain)
+            or getattr(estimator, "multilabel_", False)
+            or getattr(binarizer, "y_type_", None) == "multilabel-indicator"
+        ):
+            raise UnsupportedModelError(
+                reason="Multilabel/chain probabilities cannot satisfy the output-major contract."
+            )
+        if not hasattr(model, "n_features_in_"):
+            raise UnsupportedModelError(
+                reason="Estimator must expose fitted n_features_in_."
+            )
+        validate_tree_storage(model)
+
+    def serialize(self, model: object) -> bytes:
+        return self._io.serialize(model)
+
+    def deserialize(self, data: bytes) -> object:
+        return self._io.deserialize(data)
+
+    def extract_claims(self, model: Any) -> ModelClaims:
+        try:
+            self._validate(model)
+            classifier = is_classifier(model)
+            outputs, labels = _outputs(model, classifier)
+            names = getattr(model, "feature_names_in_", None)
+            if names is not None and (
+                np.asarray(names).ndim != 1 or len(names) != model.n_features_in_
+            ):
+                raise InvalidModelError("Invalid model feature-name dimensions.")
+            return ModelClaims(
+                estimator_class=type(model).__name__,
+                kind=ModelKind.CLASSIFIER if classifier else ModelKind.REGRESSOR,
+                hyperparameters=parameters(model),
+                state_sha256=self._state(model) if not has_structure(model) else None,
+                n_features=int(model.n_features_in_),
+                n_classes=None
+                if labels is None
+                else [len(output) for output in labels],
+                n_outputs=outputs,
+                feature_names=None
+                if names is None
+                else cast(FeatureNames, canonical_value(names)),
+                feature_dtypes=None,
+                class_labels=labels,
+            )
+        except (ValidationError, InvalidJSONError):
+            raise UnsupportedModelError(
+                reason="Model claims cannot be represented faithfully."
+            ) from None
+        except MLBundleError:
+            raise
+        except Exception:
+            raise InvalidModelError("Invalid sklearn model claims.") from None
+
+    def extract_structure(self, model: object) -> dict[str, JsonValue] | None:
+        try:
+            self._validate(model)
+            return extract_structure(model, state_sha256=self._state(model))
+        except MLBundleError:
+            raise
+        except Exception:
+            raise InvalidModelError("Invalid sklearn model structure.") from None
+
+    def predictor(self, model: object) -> Predictor:
+        return Predictor(model, self.extract_claims(model))

mlbundle/_sklearn/_width_checks.py

@@ -0,0 +1,59 @@
+"""Strict fitted dimensions shared by the closed width validators."""
+
+from typing import Any
+
+import numpy as np
+
+from mlbundle.errors import InvalidModelError
+from mlbundle.limits import MAX_FEATURES
+
+
+def width(value: Any, *, zero: bool = False) -> int:
+    if (
+        isinstance(value, (bool, np.bool_))
+        or not isinstance(value, (int, np.integer))
+        or not (0 if zero else 1) <= value <= MAX_FEATURES
+    ):
+        raise InvalidModelError("Invalid transformer feature width.")
+    return int(value)
+
+
+def dimensions(condition: bool) -> None:
+    if not condition:
+        raise InvalidModelError("Transformer fitted dimensions disagree.")
+
+
+def vector(
+    model: Any, name: str, count: int, *, required: bool = True
+) -> np.ndarray | None:
+    value = getattr(model, name, None)
+    if value is None:
+        dimensions(not required)
+        return None
+    result = np.asarray(value)
+    dimensions(result.shape == (count,))
+    return result
+
+
+def input_width(model: Any, count: int) -> None:
+    native = getattr(model, "n_features_in_", None)
+    if native is not None and width(native) != count:
+        raise InvalidModelError("Transformer input widths disagree.")
+    names = getattr(model, "feature_names_in_", None)
+    if names is not None:
+        values = np.asarray(names)
+        dimensions(
+            values.shape == (count,)
+            and all(type(x) is str and 1 <= len(x) <= 1024 for x in values)
+            and len(set(values)) == count
+        )
+
+
+def indices(value: Any, count: int) -> list[int]:
+    array = np.asarray(value)
+    dimensions(array.ndim == 1 and array.dtype.kind in "iu" and len(array) <= count)
+    result = [int(item) for item in array]
+    dimensions(
+        all(0 <= item < count for item in result) and len(set(result)) == len(result)
+    )
+    return result

mlbundle/_sklearn/archive.py

@@ -0,0 +1,32 @@
+"""Bound nested ZIP directory work before ZipFile creates entry objects."""
+
+import stat
+from io import BytesIO
+from zipfile import ZipFile
+
+from mlbundle._zip_directory import CENTRAL, _directory_bounds, unpack
+from mlbundle.errors import InvalidContainerError, InvalidModelError
+
+
+def bounded_zip(data: bytes, max_files: int) -> ZipFile:
+    try:
+        offset, size, count = _directory_bounds(data)
+    except InvalidContainerError:
+        raise InvalidModelError("Invalid nested skops archive.") from None
+    if count > max_files:
+        raise InvalidModelError("Skops nested member count exceeds the limit.")
+    position = offset
+    boundary = offset + size
+    for _ in range(count):
+        record = unpack(CENTRAL, data, position)
+        if record[0] != b"PK\x01\x02" or stat.S_IFMT(record[15] >> 16) not in (
+            0,
+            stat.S_IFREG,
+        ):
+            raise InvalidModelError("Invalid skops nested ZIP directory.")
+        position += CENTRAL.size + sum(record[10:13])
+        if position > boundary:
+            raise InvalidModelError("Invalid skops nested ZIP directory.")
+    if position != boundary:
+        raise InvalidModelError("Invalid skops nested ZIP member count.")
+    return ZipFile(BytesIO(data))