Magika standard_v3_3

Add to the body of POST /v1/apps/{slug}/releases (or a release session). An unknown or withdrawn model is refused with a 400 naming it; the app page then shows "downloads 3.0 MB · runs on your device" and /models.txt carries the attribution.

{
  "models": [
    {
      "id": "magika-standard-v3-3",
      "revision": "3f2cb853"
    }
  ]
}

Streams with progress, verifies the SHA-256 against the catalogue, keeps a durable copy in the app's Cache API and reports whether the bytes came from cache or the network.

<script src="/sdk.js"></script>  <!-- vendored from https://skillsafe.ai/apps-sdk/v1.js -->

const ss = SkillSafe.init({ slug: "your-app" });
const caps = await ss.models.capabilities();        // { webgpu, wasm, wasmSimd, storage }
const bytes = await ss.models.load("magika-standard-v3-3@3f2cb853", "model.onnx", {
  onProgress: (p) => (bar.style.width = Math.round(p.ratio * 100) + "%"),
});                                                   // ArrayBuffer — SHA-256 verified, cached

// Later visits: await ss.models.status("magika-standard-v3-3@3f2cb853")  → { cached: [...], missing: [] }
// Background prefetch on a landing page: ss.models.warm("magika-standard-v3-3@3f2cb853")

The runtime itself ships in your bundle as a vetted {path, sha256} reference — only the weights come from the registry. Pass the bytes in; do not re-fetch by URL.

// onnxruntime-web 1.19.0 ships in your bundle as a vetted {path, sha256} reference —
// dist/ort.wasm.bundle.min.mjs + dist/ort-wasm-simd-threaded.wasm.
import * as ort from "./ort.wasm.bundle.min.mjs";
ort.env.wasm.wasmPaths = { wasm: "/ort-wasm-simd-threaded.wasm" };  // object form, never a prefix string
ort.env.wasm.numThreads = 1;                                        // app hosts have no COOP/COEP

const bytes = await ss.models.load("magika-standard-v3-3@3f2cb853", "model.onnx", { onProgress });
const session = await ort.InferenceSession.create(new Uint8Array(bytes), {
  executionProviders: ["wasm"],
});

// Feeds are named after the graph inputs (read from the file, see the signature above):
const feeds = {
  "bytes": new ort.Tensor("int32", new Int32Array(n), [/* unk__214 */ 1, 2048]),
};
const out = await session.run(feeds);
const target_label = out["target_label"].data;  // float32 [unk__215, 214]

Immutable, credential-free, Access-Control-Allow-Origin: *, range requests honoured. The host refuses requests carrying a foreign Origin; a plain curl is fine.

https://models.skillsafe.ai/magika-standard-v3-3@3f2cb853/model.onnx

curl -sSL -o model.onnx "https://models.skillsafe.ai/magika-standard-v3-3@3f2cb853/model.onnx"
shasum -a 256 model.onnx   # fe2d2eb49c5f88a9e0a6c048e15d6ffdf86235519c2afc535044de433169ec8c