Metadata-Version: 2.4
Name: deepbom
Version: 0.1.0
Summary: Deployment-artifact inspection for on-device neural network models
Author: Jun-Hwan Kwon
License: Copyright (C) 2026 Jun-Hwan Kwon. All rights reserved.
        
        This repository and its generated software artifacts are currently provided as
        private research software. No license is granted to copy, modify, distribute,
        sublicense, reverse engineer, or create derivative works from the source code,
        WebAssembly modules, generated JavaScript bindings, or packaged executables,
        except where a separate file or component carries an explicit license.
        
        Access to the hosted service does not grant a software or implementation
        license.
        
        Future public releases may license selected contracts, conformance fixtures,
        validation data, or automation clients separately. A license applies only to
        the files and versions that explicitly carry it. Third-party dependencies and
        model artifacts remain subject to their respective licenses.
        
Project-URL: Homepage, https://deepbom.org
Keywords: gguf,safetensors,tflite,onnx,coreml,on-device,edge-ai,quantization,ml-bom,static-analysis
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Science/Research
Classifier: License :: OSI Approved :: ISC License (ISCL)
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
Classifier: Topic :: Software Development :: Quality Assurance
Classifier: Typing :: Typed
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Dynamic: license-file

# deepbom

Deployment-artifact inspection for on-device neural network models.

Identifies model artifact formats from their container signature and reads the
contracts that can be decoded without loading tensor payload values.

```console
$ pip install deepbom
$ deepbom inspect model.safetensors

model.safetensors
  sha256   a35fd03f52c12f4e78a246bec1927e9a169377fbb8905dc13165d285010e7a44
  format   safetensors   size 2.6 MB
  evidence u64 header length followed by a JSON header

tensors
  count              38
  parameters         1,377,408
  stored payload     2.6 MB
  dtypes             F16 x38

Container-level facts only. No tensor payload values were read.
```

```console
$ deepbom inspect model.gguf

model.gguf
  sha256   cb95a6e10f28b76a1dd71c15560dec5a5eee8943f591ef45d11c129786b22cff
  format   gguf   size 509.0 KB
  evidence magic "GGUF" at offset 0

container
  gguf version       3
  tensors            39
  metadata           26 / 26 (complete)
  architecture       llama
  file type          2
  quant version      2
```

## What it reads

| Format | Reported |
| --- | --- |
| **SafeTensors** | tensor inventory, dtypes, shapes, parameter count, stored payload bytes, metadata, header/file size agreement |
| **GGUF** | version, tensor count, full metadata key/value inventory, architecture, file type, quantization version |
| TFLite, ONNX, Core ML | format identification and SHA-256 only |

Format is decided from container evidence — FlatBuffer identifier, magic
bytes, header structure — never from the filename extension. ONNX and Core ML
are separated by their protobuf field layout rather than guessed.

## Usage

```console
deepbom inspect <file>
deepbom inspect <file> --json
deepbom --version
```

As a library:

```python
from deepbom import inspect

artifact = inspect("model.gguf")
print(artifact.format, artifact.sha256)
print(artifact.detail["architecture"])
print(artifact.to_dict())
```

## Scope

This package is pure Python with no dependencies. It reports **container-level
facts only**: what the header and directory structures determine. Tensor
payload values are never read, and nothing is inferred that the container does
not state.

Graph structure, quantization contracts, predicted delegate placement,
target-profile cost projections and CycloneDX ML-BOM export are **not** part of
this package. For TFLite graph analysis:

```console
npx deepbom audit model.tflite
```

ONNX, Core ML and runtime evidence are available in the browser version at
<https://deepbom.org>.

## Privacy

No network access. Model bytes, filenames and results are never uploaded.

## License

ISC — see [LICENSE](./LICENSE).
