Load the capture worklet from a blob URL too; stop probing module imports the app no longer uses

app.bundle.js

@@ -681,6 +681,37 @@ Object.assign(__M, { CtcEngine });
 const SAMPLE_RATE = 16000;
 const INT16_SCALE = 32768; // gate thresholds are in Int16 RMS units (as tuned)
 
+/**
+ * URL to hand `audioWorklet.addModule()`.
+ *
+ * addModule fetches its argument as a *module*, which is the one request type a
+ * private Space's cross-site iframe fails to authenticate — measured there, the
+ * same file returns 200 to a plain fetch and intermittently fails as a module
+ * import. That would break dictation at the moment the user presses record, well
+ * after everything else had loaded cleanly. So fetch the source (plain fetches
+ * work) and hand addModule a blob: URL, which needs no network request at all.
+ * Falls back to the direct URL, which is what works everywhere else.
+ *
+ * Resolved against this module rather than the document so it survives being
+ * served from a subdirectory; build_bundle.py rewrites `document.baseURI` to
+ * `document.baseURI` for the bundled build, where the two are the same directory.
+ */
+let cachedWorkletUrl = null;
+async function captureWorkletUrl() {
+    if (cachedWorkletUrl) return cachedWorkletUrl;
+    const direct = new URL('./ctc-capture-worklet.js', document.baseURI).href;
+    try {
+        const r = await fetch(direct);
+        if (!r.ok) throw new Error(`HTTP ${r.status}`);
+        const source = await r.text();
+        cachedWorkletUrl = URL.createObjectURL(new Blob([source], { type: 'text/javascript' }));
+    } catch (e) {
+        console.warn('could not preload the capture worklet; using its URL directly:', e);
+        cachedWorkletUrl = direct;
+    }
+    return cachedWorkletUrl;
+}
+
 /**
  * Energy speech/silence gate with an adaptive noise floor.
  *
@@ -1007,9 +1038,7 @@ class StreamingCoordinator {
             },
         });
         this.audioContext = new AudioContext({ sampleRate: SAMPLE_RATE });
-        // Resolve against this module, not the document: a bare './' would break
-        // for any page not sitting in the same directory as these scripts.
-        await this.audioContext.audioWorklet.addModule(new URL('./ctc-capture-worklet.js', document.baseURI));
+        await this.audioContext.audioWorklet.addModule(await captureWorkletUrl());
         const source = this.audioContext.createMediaStreamSource(this.mediaStream);
         const node = new AudioWorkletNode(this.audioContext, 'ctc-capture');
         node.port.onmessage = (e) => this.onSamples(e.data);

ctc-streaming.js

@@ -23,6 +23,37 @@
 const SAMPLE_RATE = 16000;
 const INT16_SCALE = 32768; // gate thresholds are in Int16 RMS units (as tuned)
 
+/**
+ * URL to hand `audioWorklet.addModule()`.
+ *
+ * addModule fetches its argument as a *module*, which is the one request type a
+ * private Space's cross-site iframe fails to authenticate — measured there, the
+ * same file returns 200 to a plain fetch and intermittently fails as a module
+ * import. That would break dictation at the moment the user presses record, well
+ * after everything else had loaded cleanly. So fetch the source (plain fetches
+ * work) and hand addModule a blob: URL, which needs no network request at all.
+ * Falls back to the direct URL, which is what works everywhere else.
+ *
+ * Resolved against this module rather than the document so it survives being
+ * served from a subdirectory; build_bundle.py rewrites `import.meta.url` to
+ * `document.baseURI` for the bundled build, where the two are the same directory.
+ */
+let cachedWorkletUrl = null;
+async function captureWorkletUrl() {
+    if (cachedWorkletUrl) return cachedWorkletUrl;
+    const direct = new URL('./ctc-capture-worklet.js', import.meta.url).href;
+    try {
+        const r = await fetch(direct);
+        if (!r.ok) throw new Error(`HTTP ${r.status}`);
+        const source = await r.text();
+        cachedWorkletUrl = URL.createObjectURL(new Blob([source], { type: 'text/javascript' }));
+    } catch (e) {
+        console.warn('could not preload the capture worklet; using its URL directly:', e);
+        cachedWorkletUrl = direct;
+    }
+    return cachedWorkletUrl;
+}
+
 /**
  * Energy speech/silence gate with an adaptive noise floor.
  *
@@ -349,9 +380,7 @@ export class StreamingCoordinator {
             },
         });
         this.audioContext = new AudioContext({ sampleRate: SAMPLE_RATE });
-        // Resolve against this module, not the document: a bare './' would break
-        // for any page not sitting in the same directory as these scripts.
-        await this.audioContext.audioWorklet.addModule(new URL('./ctc-capture-worklet.js', import.meta.url));
+        await this.audioContext.audioWorklet.addModule(await captureWorkletUrl());
         const source = this.audioContext.createMediaStreamSource(this.mediaStream);
         const node = new AudioWorkletNode(this.audioContext, 'ctc-capture');
         node.port.onmessage = (e) => this.onSamples(e.data);

index.html

@@ -117,15 +117,15 @@
          *
          * When this demo is served from a *private* Space, huggingface.co embeds it
          * in a cross-site iframe, and browsers withhold the auth cookie from
-         * CORS-mode requests in that context. ES module imports are fetched in CORS
-         * mode, so `import` of the ctc-*.js files returns 401 while the surrounding
-         * classic scripts load normally — app.js is fetched but can never execute,
-         * and the page sits on "Loading..." with the reason visible only as a 401 in
-         * devtools (and only if you know to switch to the iframe's console).
+         * CORS-mode requests there — ES module fetches. That is why the app ships as
+         * one bundled classic script (build_bundle.py) and why the ORT wasm glue and
+         * the capture worklet are loaded from blob: URLs. ES module imports are
+         * deliberately NOT probed here: nothing loads them any more, and they fail
+         * intermittently in this context, so probing them only cries wolf.
          *
-         * These probes report which request types actually carry credentials here,
-         * on the page, in the frame that matters. They stay quiet when everything
-         * works and surface themselves when something doesn't.
+         * What remains worth checking is that every asset the app really fetches is
+         * reachable, and that the app becomes usable. Silent on a healthy load;
+         * shows itself, with the status line, when something breaks.
          */
         // Capture failures from the app's own scripts. Registered synchronously,
         // before the <script> tags below, and in the capture phase so it also sees
@@ -172,28 +172,13 @@
             const results = [
                 await probe('plain fetch (small asset)', () => status('./onnx-ctc/frontend_config.json')),
                 await probe('plain fetch (worklet file)', () => status('./ctc-capture-worklet.js')),
-                await probe('ES module import', async () => {
-                    const m = await import('./ctc-tokenizer.js');
-                    return m.CtcDecoder ? 'imported' : 'imported but empty';
-                }),
                 await probe('classic script (onnxruntime)', async () => {
                     if (typeof ort === 'undefined') throw new Error('global `ort` is undefined');
                     return `ort ${ort.env?.versions?.common ?? 'loaded'}`;
                 }),
                 await probe('LFS range (model weights)', () => ranged('./onnx-ctc/ctc_conformer_q4f16.onnx.data')),
                 await probe('LFS range (punctuator)', () => ranged('./punct_cap_seg_en.onnx')),
-                // The exact two files app.js imports. The first console log from the
-                // Space showed 401s on precisely these while everything else loaded,
-                // so they are probed by name rather than by proxy.
-                await probe('import ctc-engine.js', async () => {
-                    const m = await import('./ctc-engine.js');
-                    return m.CtcEngine ? 'imported' : 'imported but empty';
-                }),
-                await probe('import ctc-streaming.js', async () => {
-                    const m = await import('./ctc-streaming.js');
-                    return m.StreamingCoordinator ? 'imported' : 'imported but empty';
-                }),
-                await probe('fetch app.js', () => status('./app.js')),
+                await probe('fetch app bundle', () => status('./app.bundle.js')),
                 await probe('WebGPU adapter', async () => {
                     if (!navigator.gpu) throw new Error('navigator.gpu is undefined');
                     const a = await navigator.gpu.requestAdapter();