faceliveness-web 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,176 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS

package/README.md

@@ -1,3 +1,54 @@
-# Temporary Holding Version
+# faceliveness-web
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+On-device face liveness checks in the browser: the Face Liveness Rust engine compiled to
+WebAssembly. The user performs random actions (blink, turn left, turn right, open mouth) in
+front of the camera; face detection, landmarks and passive anti-spoofing run locally, and the
+session's best face is kept as an aligned face record for matching.
+
+```bash
+npm install faceliveness-web
+```
+
+For servers use [`faceliveness`](https://www.npmjs.com/package/faceliveness) (Node.js, native)
+or [`faceliveness`](https://pypi.org/project/faceliveness/) (Python).
+
+## Usage
+
+Run the engine in a Web Worker: a frame takes tens of milliseconds.
+
+```js
+// worker.js
+import init, { Engine } from 'faceliveness-web'
+
+await init() // loads liveness_wasm_bg.wasm (~24 MB, ~8 MB compressed)
+const engine = Engine.random(3) // e.g. ['turn_left', 'blink', 'open_mouth']
+
+self.onmessage = ({ data }) => {
+  // data.pixels: ctx.getImageData(0, 0, w, h).data from a canvas showing the camera
+  const result = engine.process(data.pixels, { width: data.width, height: data.height, timestampMs: data.ts })
+  self.postMessage({ result, capture: result.done ? engine.capture() : null })
+}
+```
+
+`result.currentChallenge` is what to ask for next; `result.done` and `result.status`
+(`'passed'` / `'failed'`) end the attempt. `engine.capture()` returns the face record:
+a 112x112 aligned face as PNG bytes plus its quality.
+
+The frame layout defaults to `'rgba'` (canvas `ImageData`); pass `format`, `rotation` and
+`mirrored` for other sources. Full types ship in `liveness_wasm.d.ts`.
+
+## Trust
+
+A result computed in the browser can be changed by the user, so it is **not tamper-proof**. Use
+it for instant feedback, and let your server make the decision: stream frames to a server
+running `faceliveness` (`Engine.fromTicket`), which signs a receipt; `verifyReceipt` and
+`verifyFaceRecord` are also available here to check one.
+
+Working example (browser + server): the
+[demo](https://github.com/wiseman-umanah/Face-Liveness/tree/master/demo).
+Threat model: [docs/threat-model.md](https://github.com/wiseman-umanah/Face-Liveness/blob/master/docs/threat-model.md).
+
+## License
+
+Apache-2.0. Bundles MediaPipe face models and minivision MiniFASNet anti-spoofing models
+(both Apache-2.0).

package/liveness_wasm.d.ts

@@ -0,0 +1,190 @@
+/* tslint:disable */
+/* eslint-disable */
+
+export type Challenge = 'blink' | 'turn_left' | 'turn_right' | 'open_mouth'
+export type PixelFormat = 'rgb' | 'bgr' | 'rgba' | 'bgra' | 'nv21'
+export type LivenessStatus = 'in_progress' | 'passed' | 'failed'
+export type FailReason = 'timeout' | 'step_timeout' | 'face_lost' | 'multiple_faces' | 'spoof_suspected'
+
+export interface SessionOptions {
+    /** Fail if the whole check takes longer than this (default 30000). */
+    totalTimeoutMs?: number
+    /** Fail if one challenge takes longer than this (default 10000). */
+    stepTimeoutMs?: number
+    /** Fail if the face is out of view longer than this (default 1000). */
+    faceLostMs?: number
+    /** Fail a completed session whose mean realScore is below this (off by default). */
+    minRealScore?: number
+    /** Side of the face record crop, engine.capture() (default 112; 32-512). */
+    captureSize?: number
+}
+
+export interface FrameOptions {
+    width: number
+    height: number
+    /** Capture time in milliseconds; drives every timeout. */
+    timestampMs: number
+    /** Default 'rgba', the layout of canvas ImageData. */
+    format?: PixelFormat
+    /** Bytes per row; defaults to width x bytes per pixel. */
+    stride?: number
+    /** Clockwise degrees (0, 90, 180, 270) that turn the frame upright. */
+    rotation?: number
+    /** True for selfie-style mirrored frames. */
+    mirrored?: boolean
+}
+
+export interface Signals { ear: number; mouth: number; yaw: number }
+export interface FaceBox { x: number; y: number; width: number; height: number; score: number }
+
+export interface FrameResult {
+    status: LivenessStatus
+    /** True once passed or failed; later frames won't change the outcome. */
+    done: boolean
+    currentChallenge?: Challenge
+    remaining: number
+    failReason?: FailReason
+    /** Actions recognised in this frame. */
+    actions: Challenge[]
+    faceCount: number
+    signals?: Signals
+    faces: FaceBox[]
+    /** 478 face-mesh landmarks [x, y] of the primary face, in upright pixels. */
+    landmarks?: Array<[number, number]>
+    /** Passive anti-spoofing score (0-1), on every 3rd frame with a face. Uncalibrated. */
+    realScore?: number
+}
+
+export interface Ticket { nonce: string; challenges: Challenge[]; issuedAt: number; expiresAt: number }
+/** The best face of a session, aligned for face matching. */
+export interface FaceCapture {
+    /** The aligned face as PNG: store and send these exact bytes. */
+    png: Uint8Array
+    /** The same image as raw RGB bytes (size * size * 3). */
+    rgb: Uint8Array
+    size: number
+    /** 0-1 suitability for matching (frontal, eyes open, mouth closed, sharp, well lit). */
+    quality: number
+    timestampMs: number
+    /** Hex SHA-256 of png, as recorded in the receipt. */
+    sha256: string
+}
+
+export interface Receipt {
+    nonce: string
+    challenges: Challenge[]
+    passed: boolean
+    failReason?: FailReason
+    frames: number
+    framesSha256: string
+    realScore?: number
+    faceSha256?: string
+    faceQuality?: number
+    issuedAt: number
+    expiresAt: number
+}
+
+
+
+/**
+ * Frames in, liveness verdict out. One engine is one attempt; create a new one per attempt.
+ * Model loading takes a moment, so create it before showing the camera.
+ */
+export class Engine {
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * The best face of the session so far, aligned for face matching, or null.
+     * On-device results are not tamper-proof: a server should produce the face record it trusts.
+     */
+    capture(): FaceCapture | null;
+    constructor(challenges: Challenge[], options: SessionOptions | undefined);
+    /**
+     * Processes one frame, e.g. `ctx.getImageData(...).data` with format 'rgba' (the default).
+     */
+    process(pixels: Uint8Array, options: FrameOptions): FrameResult;
+    /**
+     * `count` challenges in an order drawn from the browser's crypto randomness.
+     */
+    static random(count: number, options: SessionOptions | undefined): Engine;
+    readonly challenges: Challenge[];
+}
+
+/**
+ * The challenge flow from measurements you compute yourself (no image processing).
+ */
+export class Session {
+    free(): void;
+    [Symbol.dispose](): void;
+    constructor(challenges: Challenge[], options: SessionOptions | undefined);
+    /**
+     * One frame: faces in view and the main face's measurements, if known.
+     */
+    update(timestamp_ms: number, observation: { faceCount?: number; ear?: number; mouth?: number; yaw?: number } | undefined): FrameResult;
+    readonly challenges: Challenge[];
+}
+
+/**
+ * For the face-matching service: checks the receipt, that the session passed, and that
+ * `facePng` is exactly the face record it vouches for; throws otherwise.
+ */
+export function verifyFaceRecord(token: string, public_key: Uint8Array, face_png: Uint8Array, now?: number | null): Receipt;
+
+/**
+ * Checks a receipt (signature and expiry); throws if invalid.
+ */
+export function verifyReceipt(token: string, public_key: Uint8Array, now?: number | null): Receipt;
+
+/**
+ * Checks a ticket from your server (signature and expiry); throws if invalid.
+ */
+export function verifyTicket(token: string, public_key: Uint8Array, now?: number | null): Ticket;
+
+export function version(): string;
+
+export type InitInput = RequestInfo | URL | Response | BufferSource | WebAssembly.Module;
+
+export interface InitOutput {
+    readonly memory: WebAssembly.Memory;
+    readonly __wbg_engine_free: (a: number, b: number) => void;
+    readonly __wbg_session_free: (a: number, b: number) => void;
+    readonly engine_capture: (a: number) => number;
+    readonly engine_challenges: (a: number) => number;
+    readonly engine_new: (a: number, b: number, c: number, d: number) => void;
+    readonly engine_process: (a: number, b: number, c: number, d: number, e: number) => void;
+    readonly engine_random: (a: number, b: number, c: number) => void;
+    readonly session_challenges: (a: number) => number;
+    readonly session_new: (a: number, b: number, c: number, d: number) => void;
+    readonly session_update: (a: number, b: number, c: number, d: number) => void;
+    readonly verifyFaceRecord: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number, i: number) => void;
+    readonly verifyReceipt: (a: number, b: number, c: number, d: number, e: number, f: number, g: number) => void;
+    readonly verifyTicket: (a: number, b: number, c: number, d: number, e: number, f: number, g: number) => void;
+    readonly version: (a: number) => void;
+    readonly __wbindgen_export: (a: number, b: number) => number;
+    readonly __wbindgen_export2: (a: number, b: number, c: number, d: number) => number;
+    readonly __wbindgen_export3: (a: number) => void;
+    readonly __wbindgen_add_to_stack_pointer: (a: number) => number;
+    readonly __wbindgen_export4: (a: number, b: number, c: number) => void;
+}
+
+export type SyncInitInput = BufferSource | WebAssembly.Module;
+
+/**
+ * Instantiates the given `module`, which can either be bytes or
+ * a precompiled `WebAssembly.Module`.
+ *
+ * @param {{ module: SyncInitInput }} module - Passing `SyncInitInput` directly is deprecated.
+ *
+ * @returns {InitOutput}
+ */
+export function initSync(module: { module: SyncInitInput } | SyncInitInput): InitOutput;
+
+/**
+ * If `module_or_path` is {RequestInfo} or {URL}, makes a request and
+ * for everything else, calls `WebAssembly.instantiate` directly.
+ *
+ * @param {{ module_or_path: InitInput | Promise<InitInput> }} module_or_path - Passing `InitInput` directly is deprecated.
+ *
+ * @returns {Promise<InitOutput>}
+ */
+export default function __wbg_init (module_or_path?: { module_or_path: InitInput | Promise<InitInput> } | InitInput | Promise<InitInput>): Promise<InitOutput>;

package/liveness_wasm.js

@@ -0,0 +1,699 @@
+/* @ts-self-types="./liveness_wasm.d.ts" */
+
+/**
+ * Frames in, liveness verdict out. One engine is one attempt; create a new one per attempt.
+ * Model loading takes a moment, so create it before showing the camera.
+ */
+export class Engine {
+    static __wrap(ptr) {
+        const obj = Object.create(Engine.prototype);
+        obj.__wbg_ptr = ptr;
+        EngineFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        EngineFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_engine_free(ptr, 0);
+    }
+    /**
+     * The best face of the session so far, aligned for face matching, or null.
+     * On-device results are not tamper-proof: a server should produce the face record it trusts.
+     * @returns {FaceCapture | null}
+     */
+    capture() {
+        const ret = wasm.engine_capture(this.__wbg_ptr);
+        return takeObject(ret);
+    }
+    /**
+     * @returns {Challenge[]}
+     */
+    get challenges() {
+        const ret = wasm.engine_challenges(this.__wbg_ptr);
+        return takeObject(ret);
+    }
+    /**
+     * @param {Challenge[]} challenges
+     * @param {SessionOptions | undefined} options
+     */
+    constructor(challenges, options) {
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            const ptr0 = passArrayJsValueToWasm0(challenges, wasm.__wbindgen_export);
+            const len0 = WASM_VECTOR_LEN;
+            wasm.engine_new(retptr, ptr0, len0, addHeapObject(options));
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+            if (r2) {
+                throw takeObject(r1);
+            }
+            this.__wbg_ptr = r0;
+            EngineFinalization.register(this, this.__wbg_ptr, this);
+            return this;
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+    }
+    /**
+     * Processes one frame, e.g. `ctx.getImageData(...).data` with format 'rgba' (the default).
+     * @param {Uint8Array} pixels
+     * @param {FrameOptions} options
+     * @returns {FrameResult}
+     */
+    process(pixels, options) {
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            const ptr0 = passArray8ToWasm0(pixels, wasm.__wbindgen_export);
+            const len0 = WASM_VECTOR_LEN;
+            wasm.engine_process(retptr, this.__wbg_ptr, ptr0, len0, addHeapObject(options));
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+            if (r2) {
+                throw takeObject(r1);
+            }
+            return takeObject(r0);
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+    }
+    /**
+     * `count` challenges in an order drawn from the browser's crypto randomness.
+     * @param {number} count
+     * @param {SessionOptions | undefined} options
+     * @returns {Engine}
+     */
+    static random(count, options) {
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.engine_random(retptr, count, addHeapObject(options));
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+            if (r2) {
+                throw takeObject(r1);
+            }
+            return Engine.__wrap(r0);
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+    }
+}
+if (Symbol.dispose) Engine.prototype[Symbol.dispose] = Engine.prototype.free;
+
+/**
+ * The challenge flow from measurements you compute yourself (no image processing).
+ */
+export class Session {
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        SessionFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_session_free(ptr, 0);
+    }
+    /**
+     * @returns {Challenge[]}
+     */
+    get challenges() {
+        const ret = wasm.session_challenges(this.__wbg_ptr);
+        return takeObject(ret);
+    }
+    /**
+     * @param {Challenge[]} challenges
+     * @param {SessionOptions | undefined} options
+     */
+    constructor(challenges, options) {
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            const ptr0 = passArrayJsValueToWasm0(challenges, wasm.__wbindgen_export);
+            const len0 = WASM_VECTOR_LEN;
+            wasm.session_new(retptr, ptr0, len0, addHeapObject(options));
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+            if (r2) {
+                throw takeObject(r1);
+            }
+            this.__wbg_ptr = r0;
+            SessionFinalization.register(this, this.__wbg_ptr, this);
+            return this;
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+    }
+    /**
+     * One frame: faces in view and the main face's measurements, if known.
+     * @param {number} timestamp_ms
+     * @param {{ faceCount?: number; ear?: number; mouth?: number; yaw?: number } | undefined} observation
+     * @returns {FrameResult}
+     */
+    update(timestamp_ms, observation) {
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.session_update(retptr, this.__wbg_ptr, timestamp_ms, addHeapObject(observation));
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+            if (r2) {
+                throw takeObject(r1);
+            }
+            return takeObject(r0);
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+    }
+}
+if (Symbol.dispose) Session.prototype[Symbol.dispose] = Session.prototype.free;
+
+/**
+ * For the face-matching service: checks the receipt, that the session passed, and that
+ * `facePng` is exactly the face record it vouches for; throws otherwise.
+ * @param {string} token
+ * @param {Uint8Array} public_key
+ * @param {Uint8Array} face_png
+ * @param {number | null} [now]
+ * @returns {Receipt}
+ */
+export function verifyFaceRecord(token, public_key, face_png, now) {
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(token, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passArray8ToWasm0(public_key, wasm.__wbindgen_export);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passArray8ToWasm0(face_png, wasm.__wbindgen_export);
+        const len2 = WASM_VECTOR_LEN;
+        wasm.verifyFaceRecord(retptr, ptr0, len0, ptr1, len1, ptr2, len2, !isLikeNone(now), isLikeNone(now) ? 0 : now);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return takeObject(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+}
+
+/**
+ * Checks a receipt (signature and expiry); throws if invalid.
+ * @param {string} token
+ * @param {Uint8Array} public_key
+ * @param {number | null} [now]
+ * @returns {Receipt}
+ */
+export function verifyReceipt(token, public_key, now) {
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(token, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passArray8ToWasm0(public_key, wasm.__wbindgen_export);
+        const len1 = WASM_VECTOR_LEN;
+        wasm.verifyReceipt(retptr, ptr0, len0, ptr1, len1, !isLikeNone(now), isLikeNone(now) ? 0 : now);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return takeObject(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+}
+
+/**
+ * Checks a ticket from your server (signature and expiry); throws if invalid.
+ * @param {string} token
+ * @param {Uint8Array} public_key
+ * @param {number | null} [now]
+ * @returns {Ticket}
+ */
+export function verifyTicket(token, public_key, now) {
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(token, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passArray8ToWasm0(public_key, wasm.__wbindgen_export);
+        const len1 = WASM_VECTOR_LEN;
+        wasm.verifyTicket(retptr, ptr0, len0, ptr1, len1, !isLikeNone(now), isLikeNone(now) ? 0 : now);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return takeObject(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+}
+
+/**
+ * @returns {string}
+ */
+export function version() {
+    let deferred1_0;
+    let deferred1_1;
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        wasm.version(retptr);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        deferred1_0 = r0;
+        deferred1_1 = r1;
+        return getStringFromWasm0(r0, r1);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+        wasm.__wbindgen_export4(deferred1_0, deferred1_1, 1);
+    }
+}
+function __wbg_get_imports() {
+    const import0 = {
+        __proto__: null,
+        __wbg_Error_30c8987f7c2ed4e2: function(arg0, arg1) {
+            const ret = Error(getStringFromWasm0(arg0, arg1));
+            return addHeapObject(ret);
+        },
+        __wbg___wbindgen_boolean_get_5b446f51afd21013: function(arg0) {
+            const v = getObject(arg0);
+            const ret = typeof(v) === 'boolean' ? v : undefined;
+            return isLikeNone(ret) ? 0xFFFFFF : ret ? 1 : 0;
+        },
+        __wbg___wbindgen_debug_string_4687d8d8c2017d52: function(arg0, arg1) {
+            const ret = debugString(getObject(arg1));
+            const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+            const len1 = WASM_VECTOR_LEN;
+            getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
+            getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
+        },
+        __wbg___wbindgen_is_null_e343b7d08827ba72: function(arg0) {
+            const ret = getObject(arg0) === null;
+            return ret;
+        },
+        __wbg___wbindgen_is_undefined_8865fb403f8fe9d8: function(arg0) {
+            const ret = getObject(arg0) === undefined;
+            return ret;
+        },
+        __wbg___wbindgen_number_get_2e0e7dee9f701a71: function(arg0, arg1) {
+            const obj = getObject(arg1);
+            const ret = typeof(obj) === 'number' ? obj : undefined;
+            getDataViewMemory0().setFloat64(arg0 + 8 * 1, isLikeNone(ret) ? 0 : ret, true);
+            getDataViewMemory0().setInt32(arg0 + 4 * 0, !isLikeNone(ret), true);
+        },
+        __wbg___wbindgen_string_get_0380ccaa2f57f0d9: function(arg0, arg1) {
+            const obj = getObject(arg1);
+            const ret = typeof(obj) === 'string' ? obj : undefined;
+            var ptr1 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+            var len1 = WASM_VECTOR_LEN;
+            getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
+            getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
+        },
+        __wbg___wbindgen_throw_41e9ee4f547fc59a: function(arg0, arg1) {
+            throw new Error(getStringFromWasm0(arg0, arg1));
+        },
+        __wbg_getRandomValues_436a51d0629d84e1: function() { return handleError(function (arg0, arg1) {
+            globalThis.crypto.getRandomValues(getArrayU8FromWasm0(arg0, arg1));
+        }, arguments); },
+        __wbg_getRandomValues_a608c4436c19407a: function() { return handleError(function (arg0, arg1) {
+            globalThis.crypto.getRandomValues(getArrayU8FromWasm0(arg0, arg1));
+        }, arguments); },
+        __wbg_get_31af05bd4842a84f: function() { return handleError(function (arg0, arg1) {
+            const ret = Reflect.get(getObject(arg0), getObject(arg1));
+            return addHeapObject(ret);
+        }, arguments); },
+        __wbg_new_617a8cdb8bb1130e: function() {
+            const ret = new Object();
+            return addHeapObject(ret);
+        },
+        __wbg_new_ee2291f50781bf1d: function() {
+            const ret = new Array();
+            return addHeapObject(ret);
+        },
+        __wbg_new_from_slice_9a868026ffa4208a: function(arg0, arg1) {
+            const ret = new Uint8Array(getArrayU8FromWasm0(arg0, arg1));
+            return addHeapObject(ret);
+        },
+        __wbg_now_aa4ccb83129e9e55: function() {
+            const ret = Date.now();
+            return ret;
+        },
+        __wbg_of_20798cb14708764f: function(arg0, arg1) {
+            const ret = Array.of(getObject(arg0), getObject(arg1));
+            return addHeapObject(ret);
+        },
+        __wbg_push_2baf45db356cf468: function(arg0, arg1) {
+            const ret = getObject(arg0).push(getObject(arg1));
+            return ret;
+        },
+        __wbg_set_145a351398b48c65: function() { return handleError(function (arg0, arg1, arg2) {
+            const ret = Reflect.set(getObject(arg0), getObject(arg1), getObject(arg2));
+            return ret;
+        }, arguments); },
+        __wbindgen_generic_0000000000000001: function(arg0) {
+            // Cast intrinsic for `F64 -> Externref`.
+            const ret = arg0;
+            return addHeapObject(ret);
+        },
+        __wbindgen_generic_0000000000000002: function(arg0, arg1) {
+            // Cast intrinsic for `Ref(String) -> Externref`.
+            const ret = getStringFromWasm0(arg0, arg1);
+            return addHeapObject(ret);
+        },
+        __wbindgen_object_drop_ref: function(arg0) {
+            takeObject(arg0);
+        },
+    };
+    return {
+        __proto__: null,
+        "./liveness_wasm_bg.js": import0,
+    };
+}
+
+const EngineFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_engine_free(ptr, 1));
+const SessionFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_session_free(ptr, 1));
+
+function addHeapObject(obj) {
+    if (heap_next === heap.length) heap.push(heap.length + 1);
+    const idx = heap_next;
+    heap_next = heap[idx];
+
+    heap[idx] = obj;
+    return idx;
+}
+
+function debugString(val) {
+    // primitive types
+    const type = typeof val;
+    if (type == 'number' || type == 'boolean' || val == null) {
+        return  `${val}`;
+    }
+    if (type == 'string') {
+        return `"${val}"`;
+    }
+    if (type == 'symbol') {
+        const description = val.description;
+        if (description == null) {
+            return 'Symbol';
+        } else {
+            return `Symbol(${description})`;
+        }
+    }
+    if (type == 'function') {
+        const name = val.name;
+        if (typeof name == 'string' && name.length > 0) {
+            return `Function(${name})`;
+        } else {
+            return 'Function';
+        }
+    }
+    // objects
+    if (Array.isArray(val)) {
+        const length = val.length;
+        let debug = '[';
+        if (length > 0) {
+            debug += debugString(val[0]);
+        }
+        for(let i = 1; i < length; i++) {
+            debug += ', ' + debugString(val[i]);
+        }
+        debug += ']';
+        return debug;
+    }
+    // Test for built-in
+    const builtInMatches = /\[object ([^\]]+)\]/.exec(toString.call(val));
+    let className;
+    if (builtInMatches && builtInMatches.length > 1) {
+        className = builtInMatches[1];
+    } else {
+        // Failed to match the standard '[object ClassName]'
+        return toString.call(val);
+    }
+    if (className == 'Object') {
+        // we're a user defined class or Object
+        // JSON.stringify avoids problems with cycles, and is generally much
+        // easier than looping through ownProperties of `val`.
+        try {
+            return 'Object(' + JSON.stringify(val) + ')';
+        } catch (_) {
+            return 'Object';
+        }
+    }
+    // errors
+    if (val instanceof Error) {
+        return `${val.name}: ${val.message}\n${val.stack}`;
+    }
+    // TODO we could test for more things here, like `Set`s and `Map`s.
+    return className;
+}
+
+function dropObject(idx) {
+    if (idx < 1028) return;
+    heap[idx] = heap_next;
+    heap_next = idx;
+}
+
+function getArrayU8FromWasm0(ptr, len) {
+    ptr = ptr >>> 0;
+    return getUint8ArrayMemory0().subarray(ptr / 1, ptr / 1 + len);
+}
+
+let cachedDataViewMemory0 = null;
+function getDataViewMemory0() {
+    if (cachedDataViewMemory0 === null || cachedDataViewMemory0.buffer.detached === true || (cachedDataViewMemory0.buffer.detached === undefined && cachedDataViewMemory0.buffer !== wasm.memory.buffer)) {
+        cachedDataViewMemory0 = new DataView(wasm.memory.buffer);
+    }
+    return cachedDataViewMemory0;
+}
+
+function getStringFromWasm0(ptr, len) {
+    return decodeText(ptr >>> 0, len);
+}
+
+let cachedUint8ArrayMemory0 = null;
+function getUint8ArrayMemory0() {
+    if (cachedUint8ArrayMemory0 === null || cachedUint8ArrayMemory0.byteLength === 0) {
+        cachedUint8ArrayMemory0 = new Uint8Array(wasm.memory.buffer);
+    }
+    return cachedUint8ArrayMemory0;
+}
+
+function getObject(idx) { return heap[idx]; }
+
+function handleError(f, args) {
+    try {
+        return f.apply(this, args);
+    } catch (e) {
+        wasm.__wbindgen_export3(addHeapObject(e));
+    }
+}
+
+let heap = new Array(1024).fill(undefined);
+heap.push(undefined, null, true, false);
+
+let heap_next = heap.length;
+
+function isLikeNone(x) {
+    return x === undefined || x === null;
+}
+
+function passArray8ToWasm0(arg, malloc) {
+    const ptr = malloc(arg.length * 1, 1) >>> 0;
+    getUint8ArrayMemory0().set(arg, ptr / 1);
+    WASM_VECTOR_LEN = arg.length;
+    return ptr;
+}
+
+function passArrayJsValueToWasm0(array, malloc) {
+    const ptr = malloc(array.length * 4, 4) >>> 0;
+    const mem = getDataViewMemory0();
+    for (let i = 0; i < array.length; i++) {
+        mem.setUint32(ptr + 4 * i, addHeapObject(array[i]), true);
+    }
+    WASM_VECTOR_LEN = array.length;
+    return ptr;
+}
+
+function passStringToWasm0(arg, malloc, realloc) {
+    if (realloc === undefined) {
+        const buf = cachedTextEncoder.encode(arg);
+        const ptr = malloc(buf.length, 1) >>> 0;
+        getUint8ArrayMemory0().subarray(ptr, ptr + buf.length).set(buf);
+        WASM_VECTOR_LEN = buf.length;
+        return ptr;
+    }
+
+    let len = arg.length;
+    let ptr = malloc(len, 1) >>> 0;
+
+    const mem = getUint8ArrayMemory0();
+
+    let offset = 0;
+
+    for (; offset < len; offset++) {
+        const code = arg.charCodeAt(offset);
+        if (code > 0x7F) break;
+        mem[ptr + offset] = code;
+    }
+    if (offset !== len) {
+        if (offset !== 0) {
+            arg = arg.slice(offset);
+        }
+        ptr = realloc(ptr, len, len = offset + arg.length * 3, 1) >>> 0;
+        const view = getUint8ArrayMemory0().subarray(ptr + offset, ptr + len);
+        const ret = cachedTextEncoder.encodeInto(arg, view);
+
+        offset += ret.written;
+        ptr = realloc(ptr, len, offset, 1) >>> 0;
+    }
+
+    WASM_VECTOR_LEN = offset;
+    return ptr;
+}
+
+function takeObject(idx) {
+    const ret = getObject(idx);
+    dropObject(idx);
+    return ret;
+}
+
+let cachedTextDecoder = new TextDecoder('utf-8', { ignoreBOM: true, fatal: true });
+cachedTextDecoder.decode();
+const MAX_SAFARI_DECODE_BYTES = 2146435072;
+let numBytesDecoded = 0;
+function decodeText(ptr, len) {
+    numBytesDecoded += len;
+    if (numBytesDecoded >= MAX_SAFARI_DECODE_BYTES) {
+        cachedTextDecoder = new TextDecoder('utf-8', { ignoreBOM: true, fatal: true });
+        cachedTextDecoder.decode();
+        numBytesDecoded = len;
+    }
+    return cachedTextDecoder.decode(getUint8ArrayMemory0().subarray(ptr, ptr + len));
+}
+
+const cachedTextEncoder = new TextEncoder();
+
+if (!('encodeInto' in cachedTextEncoder)) {
+    cachedTextEncoder.encodeInto = function (arg, view) {
+        const buf = cachedTextEncoder.encode(arg);
+        view.set(buf);
+        return {
+            read: arg.length,
+            written: buf.length
+        };
+    };
+}
+
+let WASM_VECTOR_LEN = 0;
+
+let wasmModule, wasmInstance, wasm;
+function __wbg_finalize_init(instance, module) {
+    wasmInstance = instance;
+    wasm = instance.exports;
+    wasmModule = module;
+    cachedDataViewMemory0 = null;
+    cachedUint8ArrayMemory0 = null;
+    return wasm;
+}
+
+async function __wbg_load(module, imports) {
+    if (typeof Response === 'function' && module instanceof Response) {
+        if (!module.ok) {
+            throw new Error(`failed to fetch Wasm: ${module.status} ${module.statusText} fetching '${module.url}'`);
+        }
+
+        if (typeof WebAssembly.instantiateStreaming === 'function') {
+            try {
+                return await WebAssembly.instantiateStreaming(module, imports);
+            } catch (e) {
+                const validResponse = expectedResponseType(module.type);
+
+                if (validResponse && module.headers.get('Content-Type') !== 'application/wasm') {
+                    console.warn("`WebAssembly.instantiateStreaming` failed because your server does not serve Wasm with `application/wasm` MIME type. Falling back to `WebAssembly.instantiate` which is slower. Original error:\n", e);
+
+                } else { throw e; }
+            }
+        }
+
+        const bytes = await module.arrayBuffer();
+        return await WebAssembly.instantiate(bytes, imports);
+    } else {
+        const instance = await WebAssembly.instantiate(module, imports);
+
+        if (instance instanceof WebAssembly.Instance) {
+            return { instance, module };
+        } else {
+            return instance;
+        }
+    }
+
+    function expectedResponseType(type) {
+        switch (type) {
+            case 'basic': case 'cors': case 'default': return true;
+        }
+        return false;
+    }
+}
+
+function initSync(module) {
+    if (wasm !== undefined) return wasm;
+
+
+    if (module !== undefined) {
+        if (Object.getPrototypeOf(module) === Object.prototype) {
+            ({module} = module)
+        } else {
+            console.warn('using deprecated parameters for `initSync()`; pass a single object instead')
+        }
+    }
+
+    const imports = __wbg_get_imports();
+    if (!(module instanceof WebAssembly.Module)) {
+        module = new WebAssembly.Module(module);
+    }
+    const instance = new WebAssembly.Instance(module, imports);
+    return __wbg_finalize_init(instance, module);
+}
+
+async function __wbg_init(module_or_path) {
+    if (wasm !== undefined) return wasm;
+
+
+    if (module_or_path !== undefined) {
+        if (Object.getPrototypeOf(module_or_path) === Object.prototype) {
+            ({module_or_path} = module_or_path)
+        } else {
+            console.warn('using deprecated parameters for the initialization function; pass a single object instead')
+        }
+    }
+
+    if (module_or_path === undefined) {
+        module_or_path = new URL('liveness_wasm_bg.wasm', import.meta.url);
+    }
+    const imports = __wbg_get_imports();
+
+    if (typeof module_or_path === 'string' || (typeof Request === 'function' && module_or_path instanceof Request) || (typeof URL === 'function' && module_or_path instanceof URL)) {
+        module_or_path = fetch(module_or_path);
+    }
+
+    const { instance, module } = await __wbg_load(await module_or_path, imports);
+
+    return __wbg_finalize_init(instance, module);
+}
+
+export { initSync, __wbg_init as default };

package/liveness_wasm_bg.wasm.d.ts

@@ -0,0 +1,22 @@
+/* tslint:disable */
+/* eslint-disable */
+export const memory: WebAssembly.Memory;
+export const __wbg_engine_free: (a: number, b: number) => void;
+export const __wbg_session_free: (a: number, b: number) => void;
+export const engine_capture: (a: number) => number;
+export const engine_challenges: (a: number) => number;
+export const engine_new: (a: number, b: number, c: number, d: number) => void;
+export const engine_process: (a: number, b: number, c: number, d: number, e: number) => void;
+export const engine_random: (a: number, b: number, c: number) => void;
+export const session_challenges: (a: number) => number;
+export const session_new: (a: number, b: number, c: number, d: number) => void;
+export const session_update: (a: number, b: number, c: number, d: number) => void;
+export const verifyFaceRecord: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number, i: number) => void;
+export const verifyReceipt: (a: number, b: number, c: number, d: number, e: number, f: number, g: number) => void;
+export const verifyTicket: (a: number, b: number, c: number, d: number, e: number, f: number, g: number) => void;
+export const version: (a: number) => void;
+export const __wbindgen_export: (a: number, b: number) => number;
+export const __wbindgen_export2: (a: number, b: number, c: number, d: number) => number;
+export const __wbindgen_export3: (a: number) => void;
+export const __wbindgen_add_to_stack_pointer: (a: number) => number;
+export const __wbindgen_export4: (a: number, b: number, c: number) => void;

package/package.json

@@ -1,6 +1,27 @@
 {
   "name": "faceliveness-web",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "On-device face liveness checks in the browser (WebAssembly): blink, head turn, mouth open, face record for matching",
+  "type": "module",
+  "main": "liveness_wasm.js",
+  "module": "liveness_wasm.js",
+  "types": "liveness_wasm.d.ts",
+  "files": [
+    "liveness_wasm.js",
+    "liveness_wasm.d.ts",
+    "liveness_wasm_bg.wasm",
+    "liveness_wasm_bg.wasm.d.ts",
+    "README.md",
+    "LICENSE"
+  ],
+  "keywords": ["face", "liveness", "anti-spoofing", "biometrics", "kyc", "webassembly", "wasm"],
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/wiseman-umanah/Face-Liveness.git",
+    "directory": "crates/liveness-wasm"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}