SlimSAM-77 uniform segment anything (int8)

Add to the body of POST /v1/apps/{slug}/releases (or a release session). An unknown or withdrawn model is refused with a 400 naming it; the app page then shows "downloads 13.1 MB · runs on your device" and /models.txt carries the attribution.

{
  "models": [
    {
      "id": "slimsam-77-uniform-int8",
      "revision": "5850ab45"
    }
  ]
}

Streams with progress, verifies the SHA-256 against the catalogue, keeps a durable copy in the app's Cache API and reports whether the bytes came from cache or the network.

<script src="/sdk.js"></script>  <!-- vendored from https://skillsafe.ai/apps-sdk/v1.js -->

const ss = SkillSafe.init({ slug: "your-app" });
const caps = await ss.models.capabilities();        // { webgpu, wasm, wasmSimd, storage }
const files = await ss.models.loadAll("slimsam-77-uniform-int8@5850ab45", {
  onProgress: (p) => (bar.style.width = Math.round(p.ratio * 100) + "%"),
});                                                   // { path: ArrayBuffer } — SHA-256 verified, cached
const vision_encoder_quantized = files["onnx/vision_encoder_quantized.onnx"];
const prompt_encoder_mask_decoder_quantized = files["onnx/prompt_encoder_mask_decoder_quantized.onnx"];

// Later visits: await ss.models.status("slimsam-77-uniform-int8@5850ab45")  → { cached: [...], missing: [] }
// Background prefetch on a landing page: ss.models.warm("slimsam-77-uniform-int8@5850ab45")

The runtime itself ships in your bundle as a vetted {path, sha256} reference — only the weights come from the registry. Pass the bytes in; do not re-fetch by URL.

// onnxruntime-web 1.17.0 ships in your bundle as a vetted {path, sha256} reference —
// dist/ort.wasm.bundle.min.mjs + dist/ort-wasm-simd-threaded.wasm.
import * as ort from "./ort.wasm.bundle.min.mjs";
ort.env.wasm.wasmPaths = { wasm: "/ort-wasm-simd-threaded.wasm" };  // object form, never a prefix string
ort.env.wasm.numThreads = 1;                                        // app hosts have no COOP/COEP

const bytes = await ss.models.load("slimsam-77-uniform-int8@5850ab45", "onnx/vision_encoder_quantized.onnx", { onProgress });
const session = await ort.InferenceSession.create(new Uint8Array(bytes), {
  executionProviders: ["wasm"],
});

// Feeds are named after the graph inputs (read from the file, see the signature above):
const feeds = {
  "pixel_values": new ort.Tensor("float32", new Float32Array(n), [/* batch_size */ 1, 3, 1024, 1024]),
};
const out = await session.run(feeds);
const image_embeddings = out["image_embeddings"].data;  // float32 [batch_size, 256, 64, 64]
const image_positional_embeddings = out["image_positional_embeddings"].data;  // float32 [batch_size, 256, 64, 64]

Immutable, credential-free, Access-Control-Allow-Origin: *, range requests honoured. The host refuses requests carrying a foreign Origin; a plain curl is fine.

https://models.skillsafe.ai/slimsam-77-uniform-int8@5850ab45/onnx/vision_encoder_quantized.onnx
https://models.skillsafe.ai/slimsam-77-uniform-int8@5850ab45/onnx/prompt_encoder_mask_decoder_quantized.onnx

curl -sSL -o vision_encoder_quantized.onnx "https://models.skillsafe.ai/slimsam-77-uniform-int8@5850ab45/onnx/vision_encoder_quantized.onnx"
shasum -a 256 vision_encoder_quantized.onnx   # cce23c7b2e5d4f330932738fb67ba518e04b0d99ccdd1cccd22a7da4e01f2971