SlimSAM-77 uniform segment anything (fp16)

Add to the body of POST /v1/apps/{slug}/releases (or a release session). An unknown or withdrawn model is refused with a 400 naming it; the app page then shows "downloads 19.8 MB · runs on your device" and /models.txt carries the attribution.

{
  "models": [
    {
      "id": "slimsam-77-uniform-fp16",
      "revision": "5850ab45"
    }
  ]
}

Streams with progress, verifies the SHA-256 against the catalogue, keeps a durable copy in the app's Cache API and reports whether the bytes came from cache or the network.

<script src="/sdk.js"></script>  <!-- vendored from https://skillsafe.ai/apps-sdk/v1.js -->

const ss = SkillSafe.init({ slug: "your-app" });
const caps = await ss.models.capabilities();        // { webgpu, wasm, wasmSimd, storage }
const files = await ss.models.loadAll("slimsam-77-uniform-fp16@5850ab45", {
  onProgress: (p) => (bar.style.width = Math.round(p.ratio * 100) + "%"),
});                                                   // { path: ArrayBuffer } — SHA-256 verified, cached
const vision_encoder_fp16 = files["onnx/vision_encoder_fp16.onnx"];
const prompt_encoder_mask_decoder_fp16 = files["onnx/prompt_encoder_mask_decoder_fp16.onnx"];

// Later visits: await ss.models.status("slimsam-77-uniform-fp16@5850ab45")  → { cached: [...], missing: [] }
// Background prefetch on a landing page: ss.models.warm("slimsam-77-uniform-fp16@5850ab45")

The runtime itself ships in your bundle as a vetted {path, sha256} reference — only the weights come from the registry. Pass the bytes in; do not re-fetch by URL.

// onnxruntime-web 1.17.0 ships in your bundle as a vetted {path, sha256} reference —
// dist/ort.wasm.bundle.min.mjs + dist/ort-wasm-simd-threaded.wasm (or the .jsep pair for WebGPU).
import * as ort from "./ort.wasm.bundle.min.mjs";
ort.env.wasm.wasmPaths = { wasm: "/ort-wasm-simd-threaded.wasm" };  // object form, never a prefix string
ort.env.wasm.numThreads = 1;                                        // app hosts have no COOP/COEP

const bytes = await ss.models.load("slimsam-77-uniform-fp16@5850ab45", "onnx/vision_encoder_fp16.onnx", { onProgress });
const session = await ort.InferenceSession.create(new Uint8Array(bytes), {
  executionProviders: ["webgpu", "wasm"],
});

// Feeds are named after the graph inputs (read from the file, see the signature above):
const feeds = {
  "pixel_values": new ort.Tensor("float32", new Float32Array(n), [/* batch_size */ 1, 3, 1024, 1024]),
};
const out = await session.run(feeds);
const image_embeddings = out["image_embeddings"].data;  // float32 [batch_size, 256, 64, 64]
const image_positional_embeddings = out["image_positional_embeddings"].data;  // float32 [batch_size, 256, 64, 64]

Immutable, credential-free, Access-Control-Allow-Origin: *, range requests honoured. The host refuses requests carrying a foreign Origin; a plain curl is fine.

https://models.skillsafe.ai/slimsam-77-uniform-fp16@5850ab45/onnx/vision_encoder_fp16.onnx
https://models.skillsafe.ai/slimsam-77-uniform-fp16@5850ab45/onnx/prompt_encoder_mask_decoder_fp16.onnx

curl -sSL -o vision_encoder_fp16.onnx "https://models.skillsafe.ai/slimsam-77-uniform-fp16@5850ab45/onnx/vision_encoder_fp16.onnx"
shasum -a 256 vision_encoder_fp16.onnx   # 11aaeb49c75e7b3f4cbf8a32c2c819406520c6b3affb4068ff474b2240c8aa38