infrastructure-ocr-tesseract

Local Tesseract OCR engine for infrastructure-ocr-engine: a subprocess adapter that pipes the image via stdin->stdout (NO temp file, no C linking), with an allowlisted binary, timeout, and input cap. Implements LocalOcrEngine (on-host, no egress) — usable on the DLP path.

What it is for

infrastructure-ocr-tesseract — a local Tesseract OCR engine for infrastructure_ocr_engine.

It shells out to the system tesseract binary as a subprocess, piping the image in via stdin and reading text back from stdout (tesseract stdin stdout). Consequences that matter for DLP:

• No temp file — the image never touches disk (stdin pipe only).
• No C linking — pure-Rust build; only the runtime needs the binary (like curl).
• Crash isolation — a Tesseract crash cannot take down the host process.

The binary is invoked as a strict argument vector (never a shell), from an allowlisted/configurable path, under a timeout and an input-size cap (PROCESS §17). It implements LocalOcrEngine — it runs entirely on-host and never transmits the image off the machine — so it is usable on the DLP screen path.

Capabilities

crate root

infrastructure-ocr-tesseract — a local Tesseract

TesseractEngine

infrastructure-ocr-tesseract — a local Tesseract

How to use it

From `examples/ocr_file.rs`:

use infrastructure_ocr_engine::{MediaType, OcrEngine, OcrInput};
use infrastructure_ocr_tesseract::TesseractEngine;

#[tokio::main]
async fn main() {
    let path = std::env::args()
        .nth(1)
        .expect("usage: ocr_file <image-path>");
    let bytes = std::fs::read(&path).expect("read image");
    let media = std::path::Path::new(&path)
        .extension()
        .and_then(|e| e.to_str())
        .and_then(MediaType::from_extension)
        .unwrap_or(MediaType::Png);

    let engine = TesseractEngine::new();
    assert!(engine.is_available(), "tesseract binary not found");

Module structure

No public modules: the crate root is its whole surface.

Public surface

`crate root`

No pub use re-exports: every item above is declared in this crate.

Boundary

Depends on no other workspace tier.

Shares tier infrastructure with 82 other crates: infrastructure-acquire, infrastructure-adapters-google-calendar, infrastructure-adapters-google-gmail, infrastructure-adapters-google-places, infrastructure-adapters-google-trends, infrastructure-adapters-shodan, infrastructure-adapters-yelp, infrastructure-agent, … (82 total).

_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._

Where it sits

Dependencies

Runtime, in this workspace.

Runtime, from outside the workspace.

Development, in this workspace.

Development, from outside the workspace.

Build. None.

Depended on by. 6 workspace crates.

Signal flow — what reaches this crate, and what it reaches.

flowchart LR
  n_infrastructure_acquire["infrastructure-acquire"] -->|uses| SELF
  n_infrastructure_ocr_provider["infrastructure-ocr-provider"] -->|uses| SELF
  n_operations_dlp_agent["operations-dlp-agent"] -->|uses| SELF
  n_operations_dlp_sensor["operations-dlp-sensor"] -->|uses| SELF
  n_tools_gui_harness["tools-gui-harness"] -->|uses| SELF
  n_tools_imp["tools-imp"] -->|uses| SELF
  SELF["infrastructure-ocr-tesseract"]
  SELF -->|development| n_infrastructure_dlp_detect["infrastructure-dlp-detect"]
  SELF -->|runtime| n_infrastructure_ocr_engine["infrastructure-ocr-engine"]
  classDef self fill:#1f883d,stroke:#1f883d,color:#fff;
  class SELF self;

Feature flags

No Cargo features are defined: every capability is unconditional, so no consumer can receive a half-wired crate.

Targets

Error model

No public error type was detected: no public item declares a type named *Error, and no public signature returns one.

Operational characteristics

No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.

Configuration

No environment variable is read with a literal name anywhere in this crate. A variable whose key is computed at run time cannot be listed here, and is not claimed to be absent.

Related capabilities

6 workspace crates depend on this one: infrastructure-acquire, infrastructure-ocr-provider, operations-dlp-agent, operations-dlp-sensor, tools-gui-harness, tools-imp.

Verification

Evidence by module. How often each public module is named by something executable.

What the tests establish, by name:

• input_too_large_is_rejected_without_spawning — src/lib.rs
• is_local_engine_and_has_provider_id — src/lib.rs
• recognizes_fixture_and_detector_masks_it — src/lib.rs
• unknown_binary_is_unavailable — src/lib.rs

Documentation coverage

pie showData
    title Public items with rustdoc
    "Documented" : 10
    "No rustdoc detected" : 3

Metrics

pie showData
    title Public API by kind
    "constant" : 2
    "method" : 10
    "struct" : 1

pie showData
    title Rust source composition
    "Code" : 176
    "Blank or comment" : 66

Generation

Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.