Metadata-Version: 2.4
Name: deepbom
Version: 1.97.3
Summary: Local deployment-artifact analysis for on-device AI models
Author: Jun-Hwan Kwon
License-Expression: Apache-2.0
Project-URL: Homepage, https://deepbom.org
Project-URL: Repository, https://github.com/JunHwan-Kwon/deepbom
Project-URL: Issues, https://github.com/JunHwan-Kwon/deepbom/issues
Project-URL: DOI, https://doi.org/10.5281/zenodo.21834508
Keywords: tflite,onnx,gguf,safetensors,coreml,executorch,tensorrt,quantization,on-device,ml-bom,cyclonedx,sarif,mcp,model-context-protocol,chatgpt
Classifier: Development Status :: 5 - Production/Stable
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Topic :: Software Development :: Quality Assurance
Classifier: Topic :: Software Development :: Testing
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Dynamic: license-file

# DEEPBOM Python launcher

This package is a zero-analysis-logic launcher for the same platform-specific
DEEPBOM engine used by the npm CLI release. Each wheel binds its operating
system, architecture, engine SHA-256, and canonical TFLite WASM SHA-256 in an
installed manifest. No parser or numerical rule is reimplemented in Python.

An experimental typed facade invokes that same verified engine and converts its
JSON and exit-code contracts into Python values and exceptions:

```python
from deepbom import (
    DeepBomPolicyBlocked, audit, capabilities, capture_contract, diff,
    tensor_inventory, tensors, verify_bom, verify_contract,
)

caps = capabilities()
envelope = audit("model.gguf")
selected = audit("model.gguf", sections=["summary", "findings"])
try:
    gated = audit("model.safetensors", gate="defects")
except DeepBomPolicyBlocked as blocked:
    gated = blocked.document
rows = tensors("model.gguf")
inventory = tensor_inventory("model.gguf")
comparison = diff("baseline.gguf", "candidate.gguf", tensors=True)
baseline = capture_contract("model.onnx")
contract_result = verify_contract("candidate.onnx", "baseline.interface-contract.json")
bom_result = verify_bom("model.onnx", "supplied.cdx.json")
```

`audit()` defaults to the canonical envelope, or to analysis selection when
`sections` are supplied without an explicit `output`. It accepts the CLI-equivalent
`gate="defects"` and `policy="engineering"|"regulatory"` controls plus explicit
timeout and maximum-output-byte bounds. `gate` and `policy` are mutually exclusive.
Exit 1 raises `DeepBomInvocationError`, exit 2
raises `DeepBomPolicyBlocked`, and exit 3 raises
`DeepBomIncompleteBinding`; exit 4 raises `DeepBomIdentityMismatch`. Policy
exceptions retain any completed JSON result
as `.document`. `tensors()` converts exact counts to Python `int` and decimal
ratios to `decimal.Decimal`; `tensor_inventory()` preserves the raw JSON document.
The facade is experimental in 1.96.x, and the CLI schemas remain
the compatibility contract.

```console
deepbom audit model.tflite --compact
deepbom audit model.onnx --format cyclonedx
deepbom audit model.onnx --format sarif --output deepbom.sarif --fail-on high
deepbom capabilities --compact
deepbom audit Model.mlpackage --compact
deepbom audit safetensors-repository/ --compact
deepbom audit model.pte --executorch-build deepbom.executorch-build.json --compact
deepbom verify model.onnx --bom supplied.cdx.json --render markdown
deepbom contract capture model.onnx -o baseline.interface-contract.json
deepbom capabilities --format agent-text
```

ONNX external data next to the model is discovered only from safe serialized
references. Use `--external-data-dir` to bind a different explicit root.
ExecuTorch PTE audits can additionally bind a selected source/build and binary
inventory with `--executorch-build`; backend execution remains unobserved.

Set `DEEPBOM_ENGINE` only for a deliberately supplied engine build and bind it
with `DEEPBOM_ENGINE_SHA256`. TensorRT options import configuration or observed
parser evidence; NVIDIA runtime libraries are not bundled.

For the installed version, `deepbom --help` and `deepbom capabilities --compact`
are authoritative. The current source inventory is maintained in the
[generated CLI reference](https://github.com/JunHwan-Kwon/deepbom/blob/main/docs/CLI_REFERENCE.md).

This public channel package is licensed under Apache-2.0. Protected analyzers
and private rulepack-generation sources are not included.
