@burdenoff/microfe-buildmyiq 2026.1029.4 → 2026.1029.5

package/README.md

@@ -10,3 +10,21 @@ See `AGENTS.md` for development commands and architecture details.
 ## License
 
 Proprietary — Copyright Burdenoff Consultancy Services Pvt. Ltd.
+
+## AI proctoring assets (app shells)
+
+AI-monitored exams run a face detector in the learner's browser. Its
+WebAssembly runtime and model are served by the app shell from its own origin,
+never from a public CDN. Every shell that mounts this microfrontend must add
+the plugin below to its Vite config; it emits the files under
+`/static/vendor/mediapipe/` at build time and serves them in `vite dev`:
+
+```ts
+import { buildmyiqProctoringAssets } from '@burdenoff/microfe-buildmyiq/vite';
+
+export default defineConfig({ plugins: [buildmyiqProctoringAssets() /* , … */] });
+```
+
+`@mediapipe/tasks-vision` is pinned to 0.10.35 because 1.0.0 and later send
+usage metrics to Google with no opt-out. `proctoringAssets.test.ts` fails if an
+upgrade reintroduces a third-party endpoint.

package/assets/mediapipe/NOTICE.md

@@ -0,0 +1,17 @@
+# Third-party model: BlazeFace short-range
+
+`blaze_face_short_range.tflite` is the MediaPipe BlazeFace short-range face
+detector (float16, model version 1), published by Google under the Apache
+License 2.0.
+
+- Source: https://storage.googleapis.com/mediapipe-models/face_detector/blaze_face_short_range/float16/1/blaze_face_short_range.tflite
+- Model card: https://storage.googleapis.com/mediapipe-assets/MediaPipe%20BlazeFace%20Model%20Card%20(Short%20Range).pdf
+- Size: 229,746 bytes
+- SHA-256: `b4578f35940bf5a1a655214a1cce5cab13eba73c1297cd78e1a04c2380b0152f`
+- MD5 (matches the bucket's `x-goog-hash`): `a3dd6ec31725290770b97cec0cbf94c9`
+
+It is vendored here so that BuildMyIQ app shells can serve it from their own
+origin (BOFF-10118) through the `buildmyiqProctoringAssets()` Vite plugin in
+`vite/proctoring-assets.mjs`. To replace it, download the new model, update the
+URL path in both `vite/proctoring-assets.mjs` and
+`src/buildmyiq/pages/assessments/proctoringAssetPaths.ts`, and update this file.

package/dist/buildmyiq/pages/assessments/faceDetection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"faceDetection.d.ts","sourceRoot":"","sources":["../../../../src/buildmyiq/pages/assessments/faceDetection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAU5D,+CAA+C;AAC/C,eAAO,MAAM,cAAc,MAAM,CAAC;AAIlC,oFAAoF;AACpF,wBAAgB,gBAAgB,IAAI,OAAO,CAAC,YAAY,CAAC,CAiBxD;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,0FAA0F;AAC1F,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,YAAY,EACtB,KAAK,EAAE,gBAAgB,EACvB,WAAW,EAAE,MAAM,GAClB,eAAe,GAAG,IAAI,CAcxB"}
+{"version":3,"file":"faceDetection.d.ts","sourceRoot":"","sources":["../../../../src/buildmyiq/pages/assessments/faceDetection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAK5D,+CAA+C;AAC/C,eAAO,MAAM,cAAc,MAAM,CAAC;AAIlC,oFAAoF;AACpF,wBAAgB,gBAAgB,IAAI,OAAO,CAAC,YAAY,CAAC,CAiBxD;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,0FAA0F;AAC1F,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,YAAY,EACtB,KAAK,EAAE,gBAAgB,EACvB,WAAW,EAAE,MAAM,GAClB,eAAe,GAAG,IAAI,CAcxB"}

package/dist/buildmyiq/pages/assessments/faceDetection.js

@@ -1,12 +1,13 @@
 import { estimateYawRatio as e } from "../../hooks/aiProctoringSignals.js";
+import { FACE_MODEL_URL as t, TASKS_VISION_WASM_URL as n } from "./proctoringAssetPaths.js";
 //#region src/buildmyiq/pages/assessments/faceDetection.ts
-var t = "https://cdn.jsdelivr.net/npm/@mediapipe/tasks-vision@1.1.1/wasm", n = "https://storage.googleapis.com/mediapipe-models/face_detector/blaze_face_short_range/float16/1/blaze_face_short_range.tflite", r = .5, i = null;
+var r = .5, i = null;
 function a() {
 	return i || (i = (async () => {
-		let { FaceDetector: e, FilesetResolver: i } = await import("@mediapipe/tasks-vision"), a = await i.forVisionTasks(t);
+		let { FaceDetector: e, FilesetResolver: i } = await import("@mediapipe/tasks-vision"), a = await i.forVisionTasks(n);
 		return e.createFromOptions(a, {
 			baseOptions: {
-				modelAssetPath: n,
+				modelAssetPath: t,
 				delegate: "CPU"
 			},
 			runningMode: "VIDEO",

package/dist/buildmyiq/pages/assessments/faceDetection.js.map

@@ -1 +1 @@
-{"version":3,"file":"faceDetection.js","names":[],"sources":["../../../../src/buildmyiq/pages/assessments/faceDetection.ts"],"sourcesContent":["/**\n * In-browser face detection for AI proctoring (BOFF-9690).\n * @module buildmyiq/pages/assessments/faceDetection\n *\n * Uses MediaPipe's BlazeFace short-range detector (Apache-2.0) running in\n * WebAssembly on the learner's device. Frames never leave the browser: the\n * detector returns face boxes and six keypoints per face, from which we keep\n * only a face count, a score and a head-turn ratio.\n *\n * The JavaScript is code-split (dynamic import) so learners who never sit an\n * AI-monitored exam never download it. The WebAssembly runtime and the model\n * file are fetched once from version-pinned public CDNs and then cached by\n * the browser; only static assets are fetched, nothing is uploaded.\n */\n\nimport type { FaceDetector } from '@mediapipe/tasks-vision';\n\nimport { estimateYawRatio } from '../../hooks/aiProctoringSignals';\n\n/** Must match the `@mediapipe/tasks-vision` version in package.json. */\nconst TASKS_VISION_VERSION = '1.1.1';\nconst WASM_BASE_URL = `https://cdn.jsdelivr.net/npm/@mediapipe/tasks-vision@${TASKS_VISION_VERSION}/wasm`;\nconst FACE_MODEL_URL =\n  'https://storage.googleapis.com/mediapipe-models/face_detector/blaze_face_short_range/float16/1/blaze_face_short_range.tflite';\n\n/** Detections below this score are ignored. */\nexport const MIN_FACE_SCORE = 0.5;\n\nlet detectorPromise: Promise<FaceDetector> | null = null;\n\n/** Load (once per page) the face detector. Rejects if the browser cannot run it. */\nexport function loadFaceDetector(): Promise<FaceDetector> {\n  if (!detectorPromise) {\n    detectorPromise = (async () => {\n      const { FaceDetector: Detector, FilesetResolver } = await import('@mediapipe/tasks-vision');\n      const fileset = await FilesetResolver.forVisionTasks(WASM_BASE_URL);\n      return Detector.createFromOptions(fileset, {\n        baseOptions: { modelAssetPath: FACE_MODEL_URL, delegate: 'CPU' },\n        runningMode: 'VIDEO',\n        minDetectionConfidence: MIN_FACE_SCORE,\n      });\n    })();\n    // A failed load (offline, blocked CDN) may be retried on the next call.\n    detectorPromise.catch(() => {\n      detectorPromise = null;\n    });\n  }\n  return detectorPromise;\n}\n\nexport interface FaceObservation {\n  faceCount: number;\n  /** Highest face score (0 when no face). */\n  topScore: number;\n  /** Second-highest score, i.e. confidence that a second person is present. */\n  secondScore: number;\n  /** Head-turn ratio of the single face, null unless exactly one face. */\n  yawRatio: number | null;\n}\n\n/** Run the detector on the current video frame. Null while the video has no frame yet. */\nexport function observeFaces(\n  detector: FaceDetector,\n  video: HTMLVideoElement,\n  timestampMs: number\n): FaceObservation | null {\n  if (video.readyState < 2 || video.videoWidth === 0) return null;\n  const result = detector.detectForVideo(video, timestampMs);\n  const scored = result.detections\n    .map((d) => ({ score: d.categories[0]?.score ?? 0, keypoints: d.keypoints }))\n    .filter((d) => d.score >= MIN_FACE_SCORE)\n    .sort((a, b) => b.score - a.score);\n  const [first, second] = scored;\n  return {\n    faceCount: scored.length,\n    topScore: first?.score ?? 0,\n    secondScore: second?.score ?? 0,\n    yawRatio: scored.length === 1 && first ? estimateYawRatio(first.keypoints) : null,\n  };\n}\n"],"mappings":";;AAqBA,IAAM,IAAgB,mEAChB,IACJ,gIAGW,IAAiB,IAE1B,IAAgD;AAGpD,SAAgB,IAA0C;CAgBxD,OAfK,MACH,KAAmB,YAAY;EAC7B,IAAM,EAAE,cAAc,GAAU,uBAAoB,MAAM,OAAO,4BAC3D,IAAU,MAAM,EAAgB,eAAe,CAAa;EAClE,OAAO,EAAS,kBAAkB,GAAS;GACzC,aAAa;IAAE,gBAAgB;IAAgB,UAAU;GAAM;GAC/D,aAAa;GACb,wBAAwB;EAC1B,CAAC;CACH,GAAG,GAEH,EAAgB,YAAY;EAC1B,IAAkB;CACpB,CAAC,IAEI;AACT;AAaA,SAAgB,EACd,GACA,GACA,GACwB;CACxB,IAAI,EAAM,aAAa,KAAK,EAAM,eAAe,GAAG,OAAO;CAE3D,IAAM,IADS,EAAS,eAAe,GAAO,CAC/B,EAAO,WACnB,KAAK,OAAO;EAAE,OAAO,EAAE,WAAW,IAAI,SAAS;EAAG,WAAW,EAAE;CAAU,EAAE,EAC3E,QAAQ,MAAM,EAAE,SAAS,CAAc,EACvC,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,GAC7B,CAAC,GAAO,KAAU;CACxB,OAAO;EACL,WAAW,EAAO;EAClB,UAAU,GAAO,SAAS;EAC1B,aAAa,GAAQ,SAAS;EAC9B,UAAU,EAAO,WAAW,KAAK,IAAQ,EAAiB,EAAM,SAAS,IAAI;CAC/E;AACF"}
+{"version":3,"file":"faceDetection.js","names":[],"sources":["../../../../src/buildmyiq/pages/assessments/faceDetection.ts"],"sourcesContent":["/**\n * In-browser face detection for AI proctoring (BOFF-9690).\n * @module buildmyiq/pages/assessments/faceDetection\n *\n * Uses MediaPipe's BlazeFace short-range detector (Apache-2.0) running in\n * WebAssembly on the learner's device. Frames never leave the browser: the\n * detector returns face boxes and six keypoints per face, from which we keep\n * only a face count, a score and a head-turn ratio.\n *\n * The JavaScript is code-split (dynamic import) so learners who never sit an\n * AI-monitored exam never download it. The WebAssembly runtime and the model\n * file are served by the app shell itself, from its own origin, under\n * version-pinned paths (BOFF-10118). The learner's browser therefore contacts\n * no third party at all while the detector runs.\n *\n * tasks-vision is pinned to 0.10.35 on purpose: from 1.0.0 the library sends\n * usage metrics to Google (odml.pa.googleapis.com) with no opt-out, which\n * would break the \"nothing leaves the device\" promise made to learners. A\n * unit test fails if an upgrade reintroduces that endpoint.\n */\n\nimport type { FaceDetector } from '@mediapipe/tasks-vision';\n\nimport { estimateYawRatio } from '../../hooks/aiProctoringSignals';\nimport { FACE_MODEL_URL, TASKS_VISION_WASM_URL } from './proctoringAssetPaths';\n\n/** Detections below this score are ignored. */\nexport const MIN_FACE_SCORE = 0.5;\n\nlet detectorPromise: Promise<FaceDetector> | null = null;\n\n/** Load (once per page) the face detector. Rejects if the browser cannot run it. */\nexport function loadFaceDetector(): Promise<FaceDetector> {\n  if (!detectorPromise) {\n    detectorPromise = (async () => {\n      const { FaceDetector: Detector, FilesetResolver } = await import('@mediapipe/tasks-vision');\n      const fileset = await FilesetResolver.forVisionTasks(TASKS_VISION_WASM_URL);\n      return Detector.createFromOptions(fileset, {\n        baseOptions: { modelAssetPath: FACE_MODEL_URL, delegate: 'CPU' },\n        runningMode: 'VIDEO',\n        minDetectionConfidence: MIN_FACE_SCORE,\n      });\n    })();\n    // A failed load (offline, assets not deployed) may be retried on the next call.\n    detectorPromise.catch(() => {\n      detectorPromise = null;\n    });\n  }\n  return detectorPromise;\n}\n\nexport interface FaceObservation {\n  faceCount: number;\n  /** Highest face score (0 when no face). */\n  topScore: number;\n  /** Second-highest score, i.e. confidence that a second person is present. */\n  secondScore: number;\n  /** Head-turn ratio of the single face, null unless exactly one face. */\n  yawRatio: number | null;\n}\n\n/** Run the detector on the current video frame. Null while the video has no frame yet. */\nexport function observeFaces(\n  detector: FaceDetector,\n  video: HTMLVideoElement,\n  timestampMs: number\n): FaceObservation | null {\n  if (video.readyState < 2 || video.videoWidth === 0) return null;\n  const result = detector.detectForVideo(video, timestampMs);\n  const scored = result.detections\n    .map((d) => ({ score: d.categories[0]?.score ?? 0, keypoints: d.keypoints }))\n    .filter((d) => d.score >= MIN_FACE_SCORE)\n    .sort((a, b) => b.score - a.score);\n  const [first, second] = scored;\n  return {\n    faceCount: scored.length,\n    topScore: first?.score ?? 0,\n    secondScore: second?.score ?? 0,\n    yawRatio: scored.length === 1 && first ? estimateYawRatio(first.keypoints) : null,\n  };\n}\n"],"mappings":";;;AA2BA,IAAa,IAAiB,IAE1B,IAAgD;AAGpD,SAAgB,IAA0C;CAgBxD,OAfK,MACH,KAAmB,YAAY;EAC7B,IAAM,EAAE,cAAc,GAAU,uBAAoB,MAAM,OAAO,4BAC3D,IAAU,MAAM,EAAgB,eAAe,CAAqB;EAC1E,OAAO,EAAS,kBAAkB,GAAS;GACzC,aAAa;IAAE,gBAAgB;IAAgB,UAAU;GAAM;GAC/D,aAAa;GACb,wBAAwB;EAC1B,CAAC;CACH,GAAG,GAEH,EAAgB,YAAY;EAC1B,IAAkB;CACpB,CAAC,IAEI;AACT;AAaA,SAAgB,EACd,GACA,GACA,GACwB;CACxB,IAAI,EAAM,aAAa,KAAK,EAAM,eAAe,GAAG,OAAO;CAE3D,IAAM,IADS,EAAS,eAAe,GAAO,CAC/B,EAAO,WACnB,KAAK,OAAO;EAAE,OAAO,EAAE,WAAW,IAAI,SAAS;EAAG,WAAW,EAAE;CAAU,EAAE,EAC3E,QAAQ,MAAM,EAAE,SAAS,CAAc,EACvC,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,GAC7B,CAAC,GAAO,KAAU;CACxB,OAAO;EACL,WAAW,EAAO;EAClB,UAAU,GAAO,SAAS;EAC1B,aAAa,GAAQ,SAAS;EAC9B,UAAU,EAAO,WAAW,KAAK,IAAQ,EAAiB,EAAM,SAAS,IAAI;CAC/E;AACF"}

package/dist/buildmyiq/pages/assessments/proctoringAssetPaths.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Same-origin URLs of the AI proctoring face-detector assets (BOFF-10118).
+ * @module buildmyiq/pages/assessments/proctoringAssetPaths
+ *
+ * The app shell serves these files itself: its Vite config adds the
+ * `buildmyiqProctoringAssets()` plugin from `@burdenoff/microfe-buildmyiq/vite`
+ * (source: `vite/proctoring-assets.mjs`), which copies them into the build at
+ * exactly these paths. The plugin defines the same constants; a unit test
+ * fails if the two drift apart or if the installed package version changes.
+ */
+/** Must equal the exact `@mediapipe/tasks-vision` version pinned in package.json. */
+export declare const TASKS_VISION_VERSION = "0.10.35";
+/** URL prefix under which the app shell serves every asset. */
+export declare const PROCTORING_ASSET_BASE = "/static/vendor/mediapipe";
+/** Directory URL handed to `FilesetResolver.forVisionTasks`. */
+export declare const TASKS_VISION_WASM_URL = "/static/vendor/mediapipe/tasks-vision/0.10.35/wasm";
+/** BlazeFace short-range model (float16, model version 1). */
+export declare const FACE_MODEL_URL = "/static/vendor/mediapipe/models/blaze_face_short_range/float16/1/blaze_face_short_range.tflite";
+//# sourceMappingURL=proctoringAssetPaths.d.ts.map

package/dist/buildmyiq/pages/assessments/proctoringAssetPaths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proctoringAssetPaths.d.ts","sourceRoot":"","sources":["../../../../src/buildmyiq/pages/assessments/proctoringAssetPaths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,qFAAqF;AACrF,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAE9C,+DAA+D;AAC/D,eAAO,MAAM,qBAAqB,6BAA6B,CAAC;AAEhE,gEAAgE;AAChE,eAAO,MAAM,qBAAqB,uDAAuE,CAAC;AAE1G,8DAA8D;AAC9D,eAAO,MAAM,cAAc,mGAAmG,CAAC"}

package/dist/buildmyiq/pages/assessments/proctoringAssetPaths.js

@@ -0,0 +1,6 @@
+//#region src/buildmyiq/pages/assessments/proctoringAssetPaths.ts
+var e = "0.10.35", t = "/static/vendor/mediapipe", n = `${t}/tasks-vision/${e}/wasm`, r = `${t}/models/blaze_face_short_range/float16/1/blaze_face_short_range.tflite`;
+//#endregion
+export { r as FACE_MODEL_URL, n as TASKS_VISION_WASM_URL };
+
+//# sourceMappingURL=proctoringAssetPaths.js.map

package/dist/buildmyiq/pages/assessments/proctoringAssetPaths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proctoringAssetPaths.js","names":[],"sources":["../../../../src/buildmyiq/pages/assessments/proctoringAssetPaths.ts"],"sourcesContent":["/**\n * Same-origin URLs of the AI proctoring face-detector assets (BOFF-10118).\n * @module buildmyiq/pages/assessments/proctoringAssetPaths\n *\n * The app shell serves these files itself: its Vite config adds the\n * `buildmyiqProctoringAssets()` plugin from `@burdenoff/microfe-buildmyiq/vite`\n * (source: `vite/proctoring-assets.mjs`), which copies them into the build at\n * exactly these paths. The plugin defines the same constants; a unit test\n * fails if the two drift apart or if the installed package version changes.\n */\n\n/** Must equal the exact `@mediapipe/tasks-vision` version pinned in package.json. */\nexport const TASKS_VISION_VERSION = '0.10.35';\n\n/** URL prefix under which the app shell serves every asset. */\nexport const PROCTORING_ASSET_BASE = '/static/vendor/mediapipe';\n\n/** Directory URL handed to `FilesetResolver.forVisionTasks`. */\nexport const TASKS_VISION_WASM_URL = `${PROCTORING_ASSET_BASE}/tasks-vision/${TASKS_VISION_VERSION}/wasm`;\n\n/** BlazeFace short-range model (float16, model version 1). */\nexport const FACE_MODEL_URL = `${PROCTORING_ASSET_BASE}/models/blaze_face_short_range/float16/1/blaze_face_short_range.tflite`;\n"],"mappings":";AAYA,IAAa,IAAuB,WAGvB,IAAwB,4BAGxB,IAAwB,GAAG,EAAsB,gBAAgB,EAAqB,QAGtF,IAAiB,GAAG,EAAsB"}

package/package.json

@@ -1,10 +1,12 @@
 {
   "name": "@burdenoff/microfe-buildmyiq",
-  "version": "2026.1029.4",
+  "version": "2026.1029.5",
   "description": "Burdenoff BuildMyIQ Microfrontend — education, learning & development",
   "type": "module",
   "files": [
     "dist",
+    "vite",
+    "assets",
     "package.json",
     "README.md"
   ],
@@ -20,6 +22,10 @@
     "./services/createSandboxAssistantTransport": {
       "types": "./dist/services/createSandboxAssistantTransport.d.ts",
       "import": "./dist/services/createSandboxAssistantTransport.js"
+    },
+    "./vite": {
+      "types": "./vite/proctoring-assets.d.mts",
+      "import": "./vite/proctoring-assets.mjs"
     }
   },
   "main": "./dist/index.js",
@@ -48,7 +54,7 @@
   "dependencies": {
     "@apollo/client": "^4.0.11",
     "@burdenoff/fe-libs": "2026.1006.1",
-    "@mediapipe/tasks-vision": "1.1.1",
+    "@mediapipe/tasks-vision": "0.10.35",
     "@tanstack/react-query": "^5.90.16",
     "clsx": "^2.1.1",
     "graphql": "^16.10.0",

package/vite/proctoring-assets.d.mts

@@ -0,0 +1,20 @@
+import type { Plugin } from 'vite';
+
+export declare const TASKS_VISION_VERSION: string;
+export declare const PROCTORING_ASSET_BASE: string;
+export declare const TASKS_VISION_WASM_URL: string;
+export declare const FACE_MODEL_URL: string;
+export declare const TASKS_VISION_WASM_FILES: readonly string[];
+
+export interface ProctoringAssetsOptions {
+  /** Root of the microfe-buildmyiq package. Only tests override it. */
+  packageDir?: string;
+}
+
+/** Map from served URL path to the absolute file that backs it. */
+export declare function resolveProctoringAssets(options?: ProctoringAssetsOptions): Map<string, string>;
+
+/** Vite plugin that emits and dev-serves the AI proctoring face-detector assets. */
+export declare function buildmyiqProctoringAssets(options?: ProctoringAssetsOptions): Plugin;
+
+export default buildmyiqProctoringAssets;

package/vite/proctoring-assets.mjs

@@ -0,0 +1,154 @@
+/**
+ * Vite plugin that self-hosts the AI proctoring face-detector assets (BOFF-10118).
+ *
+ * The in-browser face detector used by AI-monitored exams needs two kinds of
+ * static files at run time: the MediaPipe tasks-vision WebAssembly runtime and
+ * the BlazeFace short-range model. Instead of fetching them from public CDNs,
+ * every app shell that mounts this microfrontend adds this plugin to its Vite
+ * config. It then:
+ *
+ *  - emits the files into the build output under `/static/vendor/mediapipe/…`
+ *    (the deploy workflow uploads `static/*` with an immutable cache header,
+ *    and every path is versioned so a later upgrade lands on a new URL), and
+ *  - serves the same paths from the Vite dev server.
+ *
+ * The WebAssembly files are copied from the installed, version-pinned
+ * `@mediapipe/tasks-vision` package; the model ships inside this package under
+ * `assets/mediapipe/`. The browser code in `faceDetection.ts` reads the same
+ * paths from `proctoringAssetPaths.ts`; a unit test keeps the two in step.
+ *
+ * Usage in an app shell's vite.config.ts:
+ *
+ *   import { buildmyiqProctoringAssets } from '@burdenoff/microfe-buildmyiq/vite';
+ *   export default defineConfig({ plugins: [buildmyiqProctoringAssets(), …] });
+ */
+
+import { createReadStream, existsSync, readFileSync, statSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+/** Must equal the exact `@mediapipe/tasks-vision` version pinned in package.json. */
+export const TASKS_VISION_VERSION = '0.10.35';
+
+/** URL prefix (same origin as the app shell) under which every asset is served. */
+export const PROCTORING_ASSET_BASE = '/static/vendor/mediapipe';
+
+/** Directory URL handed to `FilesetResolver.forVisionTasks`. */
+export const TASKS_VISION_WASM_URL = `${PROCTORING_ASSET_BASE}/tasks-vision/${TASKS_VISION_VERSION}/wasm`;
+
+/** URL of the BlazeFace short-range model (float16, model version 1). */
+export const FACE_MODEL_URL = `${PROCTORING_ASSET_BASE}/models/blaze_face_short_range/float16/1/blaze_face_short_range.tflite`;
+
+/**
+ * Runtime files `FilesetResolver.forVisionTasks` may pick: the SIMD build, and
+ * the non-SIMD fallback for browsers without WebAssembly SIMD.
+ */
+export const TASKS_VISION_WASM_FILES = Object.freeze([
+  'vision_wasm_internal.js',
+  'vision_wasm_internal.wasm',
+  'vision_wasm_nosimd_internal.js',
+  'vision_wasm_nosimd_internal.wasm',
+]);
+
+const CONTENT_TYPES = {
+  '.js': 'text/javascript; charset=utf-8',
+  '.wasm': 'application/wasm',
+  '.tflite': 'application/octet-stream',
+};
+
+const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+
+function contentTypeFor(file) {
+  const dot = file.lastIndexOf('.');
+  return CONTENT_TYPES[dot === -1 ? '' : file.slice(dot)] ?? 'application/octet-stream';
+}
+
+/**
+ * Locate every asset on disk. Returns a map from served URL path to absolute
+ * file path, and throws a descriptive error when anything is missing or when
+ * the installed tasks-vision version differs from the pinned one.
+ *
+ * @param {{ packageDir?: string }} [options]
+ * @returns {Map<string, string>}
+ */
+export function resolveProctoringAssets(options = {}) {
+  const baseDir = options.packageDir ?? packageRoot;
+  const require = createRequire(join(baseDir, 'package.json'));
+
+  /** @type {Map<string, string>} */
+  const assets = new Map();
+  let wasmDir = '';
+  for (const file of TASKS_VISION_WASM_FILES) {
+    // Each runtime file is an explicit subpath export of @mediapipe/tasks-vision.
+    const resolved = require.resolve(`@mediapipe/tasks-vision/${file}`);
+    wasmDir = dirname(resolved);
+    assets.set(`${TASKS_VISION_WASM_URL}/${file}`, resolved);
+  }
+
+  const installedManifest = join(wasmDir, '..', 'package.json');
+  const installed = JSON.parse(readFileSync(installedManifest, 'utf8')).version;
+  if (installed !== TASKS_VISION_VERSION) {
+    throw new Error(
+      `[buildmyiq:proctoring-assets] @mediapipe/tasks-vision ${installed} is installed, ` +
+        `but the face detector is pinned to ${TASKS_VISION_VERSION}. Install the pinned version.`
+    );
+  }
+
+  const model = join(baseDir, 'assets', 'mediapipe', 'blaze_face_short_range.tflite');
+  assets.set(FACE_MODEL_URL, model);
+
+  for (const [url, file] of assets) {
+    if (!existsSync(file) || statSync(file).size === 0) {
+      throw new Error(`[buildmyiq:proctoring-assets] missing asset for ${url}: ${file}`);
+    }
+  }
+  return assets;
+}
+
+/**
+ * The Vite plugin. Pass `packageDir` only in tests.
+ *
+ * @param {{ packageDir?: string }} [options]
+ * @returns {import('vite').Plugin}
+ */
+export function buildmyiqProctoringAssets(options = {}) {
+  /** @type {Map<string, string> | null} */
+  let assets = null;
+  const getAssets = () => {
+    assets ??= resolveProctoringAssets(options);
+    return assets;
+  };
+
+  return {
+    name: 'buildmyiq:proctoring-assets',
+
+    buildStart() {
+      getAssets();
+    },
+
+    configureServer(server) {
+      server.middlewares.use((req, res, next) => {
+        const path = (req.url ?? '').split('?')[0];
+        const file = path.startsWith(PROCTORING_ASSET_BASE) ? getAssets().get(path) : undefined;
+        if (!file) {
+          next();
+          return;
+        }
+        res.statusCode = 200;
+        res.setHeader('Content-Type', contentTypeFor(file));
+        res.setHeader('Content-Length', String(statSync(file).size));
+        res.setHeader('Cache-Control', 'no-cache');
+        createReadStream(file).pipe(res);
+      });
+    },
+
+    generateBundle() {
+      for (const [url, file] of getAssets()) {
+        this.emitFile({ type: 'asset', fileName: url.slice(1), source: readFileSync(file) });
+      }
+    },
+  };
+}
+
+export default buildmyiqProctoringAssets;