NeoCut automatic captions runtime (v54)

Self-hosted JavaScript and WebAssembly execute speech recognition on the user's
device. This folder contains no models and no recordings. The editor downloads
the runtime and public model only when the user chooses Generate captions.

Runtime:
- @huggingface/transformers 3.8.1, Apache-2.0.
  https://www.npmjs.com/package/@huggingface/transformers/v/3.8.1
- Bundled ONNX Runtime Web 1.22.0-dev.20250409-89f8206ba4, MIT.
  Its shipped mjs and wasm are byte-identical between the pinned ONNX npm archive
  and Transformers.js archive. Licenses/notices from the matching upstream commit:
  https://github.com/microsoft/onnxruntime/tree/89f8206ba4
- Bundled Hugging Face Jinja, MIT; its license is included separately.

Only sourceMappingURL comments are removed from the upstream minified JS/mjs.
No source maps are shipped. JavaScript imports and WASM requests remain on the
NeoCut origin. The worker uses one WASM thread with no proxy worker; no WebGPU or
cross-origin isolation is required. WebAssembly SIMD support is needed.

Model fetched at user request:
  onnx-community/whisper-base (multilingual, not the English-only .en model)
  revision: 1846881b6b3a3024392c1eea3ad983695bc23925
  https://huggingface.co/onnx-community/whisper-base
  Base OpenAI Whisper model/license: https://github.com/openai/whisper
  q8 encoder + merged decoder: 76,894,629 bytes
  Config/tokenizer files included in the request: 2,769,562 bytes
  Total model data: 79,664,191 bytes (~80 MB)
  This runtime/license set: 22,870,061 bytes (~23 MB)
  Combined first-use download: approximately 103 MB before transfer compression.

The model host is https://huggingface.co; both ONNX downloads currently redirect
to https://us.aws.cdn.hf.co. Regional Hugging Face CDN endpoints can vary.
Public model files may be cached in the browser's 'transformers-cache'. Audio is
passed directly as mono Float32Array samples at 16 kHz; it is never a fetch URL,
sent to an inference API or put in that cache. To cancel, terminate the worker.

Supported UI language codes are listed explicitly in captions-worker.js. Whisper
transcribes the selected spoken language; this is not subtitle translation.
Maximum source selection: five minutes. Output has phrase-level timestamps and
needs review, especially with background music, songs or unclear speech.

Verification:
  node scripts/vendor-captions.mjs --check
  node tests/captions-worker-v54.cjs
The runtime integrity manifest covers each vendor/license file. The two ONNX
hashes in provenance.json were checked against the downloaded pinned weights.
An 11-second official JFK WAV fixture was transcribed successfully with this
model/dtype/options using Transformers.js 3.8.1 + native ONNX CPU 1.21.0.
Native CPU verification does not establish browser/mobile performance or accuracy
for Romanian and Italian. End-to-end browser testing is documented in the audit.

Re-vendoring preparation (in a temporary directory, not the editor's package):
  npm pack @huggingface/transformers@3.8.1
  npm pack onnxruntime-web@1.22.0-dev.20250409-89f8206ba4
  npm pack @huggingface/jinja@0.5.3
Extract Transformers to package/, Jinja to jinja/package/. Download LICENSE and
ThirdPartyNotices.txt from the pinned ONNX commit as ORT-LICENSE.txt and
ORT-NOTICES.txt. Download OpenAI Whisper LICENSE as WHISPER-LICENSE.txt. Then run:
  node scripts/vendor-captions.mjs /absolute/path/to/temporary/directory
The matching npm archive integrity and per-file SHA-256 hashes are in provenance.json.