IS-Net (DIS) general-use background removal

Add to the body of POST /v1/apps/{slug}/releases (or a release session). An unknown or withdrawn model is refused with a 400 naming it; the app page then shows "downloads 170 MB · runs on your device" and /models.txt carries the attribution.

{
  "models": [
    {
      "id": "isnet-general-use",
      "revision": "rembg-v0.0.0"
    }
  ]
}

Streams with progress, verifies the SHA-256 against the catalogue, keeps a durable copy in the app's Cache API and reports whether the bytes came from cache or the network.

<script src="/sdk.js"></script>  <!-- vendored from https://skillsafe.ai/apps-sdk/v1.js -->

const ss = SkillSafe.init({ slug: "your-app" });
const caps = await ss.models.capabilities();        // { webgpu, wasm, wasmSimd, storage }
const bytes = await ss.models.load("[email protected]", "isnet-general-use.onnx", {
  onProgress: (p) => (bar.style.width = Math.round(p.ratio * 100) + "%"),
});                                                   // ArrayBuffer — SHA-256 verified, cached

// Later visits: await ss.models.status("[email protected]")  → { cached: [...], missing: [] }
// Background prefetch on a landing page: ss.models.warm("[email protected]")

The runtime itself ships in your bundle as a vetted {path, sha256} reference — only the weights come from the registry. Pass the bytes in; do not re-fetch by URL.

// onnxruntime-web 1.17.0 ships in your bundle as a vetted {path, sha256} reference —
// dist/ort.wasm.bundle.min.mjs + dist/ort-wasm-simd-threaded.wasm (or the .jsep pair for WebGPU).
import * as ort from "./ort.wasm.bundle.min.mjs";
ort.env.wasm.wasmPaths = { wasm: "/ort-wasm-simd-threaded.wasm" };  // object form, never a prefix string
ort.env.wasm.numThreads = 1;                                        // app hosts have no COOP/COEP

const bytes = await ss.models.load("[email protected]", "isnet-general-use.onnx", { onProgress });
const session = await ort.InferenceSession.create(new Uint8Array(bytes), {
  executionProviders: ["webgpu", "wasm"],
});

// Feeds are named after the graph inputs (read from the file, see the signature above):
const feeds = {
  "input_image": new ort.Tensor("float32", new Float32Array(n), [1, 3, 1024, 1024]),
};
const out = await session.run(feeds);
const output_image = out["output_image"].data;  // float32 [1, 1, 1024, 1024]
const 1890 = out["1890"].data;  // float32 [1, 1, 1024, 1024]
const 1891 = out["1891"].data;  // float32 [1, 1, 1024, 1024]
const 1892 = out["1892"].data;  // float32 [1, 1, 1024, 1024]
const 1893 = out["1893"].data;  // float32 [1, 1, 1024, 1024]
const 1894 = out["1894"].data;  // float32 [1, 1, 1024, 1024]
const input_1252 = out["input.1252"].data;  // float32 [1, 64, 512, 512]
const input_1088 = out["input.1088"].data;  // float32 [1, 64, 256, 256]
const input_948 = out["input.948"].data;  // float32 [1, 128, 128, 128]
const input_832 = out["input.832"].data;  // float32 [1, 256, 64, 64]
const input_740 = out["input.740"].data;  // float32 [1, 512, 32, 32]
const input_656 = out["input.656"].data;  // float32 [1, 512, 16, 16]

Immutable, credential-free, Access-Control-Allow-Origin: *, range requests honoured. The host refuses requests carrying a foreign Origin; a plain curl is fine.

https://models.skillsafe.ai/[email protected]/isnet-general-use.onnx

curl -sSL -o isnet-general-use.onnx "https://models.skillsafe.ai/[email protected]/isnet-general-use.onnx"
shasum -a 256 isnet-general-use.onnx   # 60920e99c45464f2ba57bee2ad08c919a52bbf852739e96947fbb4358c0d964a

SkillSafe's copy on Hugging Face — the same bytes (the SHA-256 on each file page matches the hash above), plus manifest.json with the upstream commit, recipe and toolchain, the parity reference tensors and a model card. Use it directly for your own site or notebook. A SkillSafe app must load from the registry: its CSP allows models.skillsafe.ai only, and that copy is what the SDK verifies, the browser shares across apps and the app page discloses. SkillSafe keeps hosting its own copies and the API either way.

// Outside SkillSafe apps only: app hosts allow connect-src models.skillsafe.ai, not huggingface.co.
// Same bytes as the registry copy — the SHA-256 on the Hugging Face file page is 60920e99c45464f2…
const res = await fetch("https://huggingface.co/skillsafe-ai/isnet-general-use/resolve/63a3042f10276918a44e1a3f397440a7107ee398/isnet-general-use.onnx");
const bytes = new Uint8Array(await res.arrayBuffer());
const session = await ort.InferenceSession.create(bytes, { executionProviders: ["webgpu", "wasm"] });

https://huggingface.co/skillsafe-ai/isnet-general-use/resolve/63a3042f10276918a44e1a3f397440a7107ee398/isnet-general-use.onnx