Native desktop screen capture (xcap) yielding a SensitiveFrame: raw RGBA pixels wrapped as !Clone/!Debug/!Serialize + zeroize-on-drop. Generic capability (usable by NVR/conferencing/DLP); the DLP screen sensor treats the frame with full raw-input discipline (R5).
| Tier | infrastructure |
| Role | unclassified (baselined) |
| Path | crates/infrastructure/screen-capture |
| Edition | 2021 |
| Targets | infrastructure_screen_capture |
| Public items | 10 across 0 modules |
| Tests | 3 |
What it is for
infrastructure-screen-capture — native desktop screen capture.
Captures a monitor to a SensitiveFrame: raw RGBA pixels wrapped so they are !Clone/!Debug/!Serialize and zeroized on drop. A generic capability (NVR / conferencing / diagnostics / DLP); it holds no DLP or OCR types.
Why SensitiveFrame and not a bare RgbaImage
A screenshot is everything visible on screen — the highest-sensitivity raw a sensor can hold, and it warrants the strictest handling in the codebase. Exposing a plain, Clone/Debug image buffer invites copies into logs, traces, and clones that never get wiped. SensitiveFrame makes the pixels hard to leak by accident: no Debug (can't be logged), no Clone (no silent copies), no Serialize (can't be persisted/sent), and the backing buffer is zeroized when dropped.
Residual limit (documented, not solved): application-level zeroization cannot reach pixels cached by the OS window manager / compositor / GPU (X11, Wayland, DWM) or written to swap. This crate wipes the buffers it owns; it cannot wipe the kernel/GPU.
Capabilities
crate root
infrastructure-screen-capture — native desktop screen capture.
| Item |
|---|
pub const DEFAULT_MAX_PIXELS: u64 |
fn capture_primary() -> Result <SensitiveFrame, CaptureError> |
fn capture_all() -> Result <Vec <SensitiveFrame>, CaptureError> |
CaptureError
infrastructure-screen-capture — native desktop screen capture.
| Item |
|---|
pub enum CaptureError |
SensitiveFrame
infrastructure-screen-capture — native desktop screen capture.
| Item |
|---|
pub struct SensitiveFrame |
SensitiveFrame :: fn from_rgba(pixels : Vec <u8>, width : u32, height : u32) -> Option <Self> |
SensitiveFrame :: fn width(& self) -> u32 |
SensitiveFrame :: fn height(& self) -> u32 |
SensitiveFrame :: fn rgba(& self) -> & u8 |
SensitiveFrame :: fn encode_png(& self) -> Result <Zeroizing <Vec <u8>>, CaptureError> |
How to use it
No examples/ target and no doctest in this crate's rustdoc. The tests listed under Verification are the closest executable usage.
Module structure
No public modules: the crate root is its whole surface.
Public surface
`crate root`
| Item | What it is |
|---|---|
pub struct SensitiveFrame | A captured frame: RGBA8 pixels + dimensions, wiped on drop |
SensitiveFrame :: fn from_rgba(pixels : Vec <u8>, width : u32, height : u32) -> Option <Self> | Wrap raw RGBA8 pixels |
SensitiveFrame :: fn width(& self) -> u32 | Pixel width. |
SensitiveFrame :: fn height(& self) -> u32 | Pixel height. |
SensitiveFrame :: fn rgba(& self) -> & u8 | Borrow the raw RGBA8 pixels. |
SensitiveFrame :: fn encode_png(& self) -> Result <Zeroizing <Vec <u8>>, CaptureError> | Encode the frame to PNG in memory |
pub enum CaptureError | Screen-capture failure. |
pub const DEFAULT_MAX_PIXELS: u64 | Default cap on a single captured frame (100 megapixels) — a guard, not a real limit. |
fn capture_primary() -> Result <SensitiveFrame, CaptureError> | Capture the primary monitor. |
fn capture_all() -> Result <Vec <SensitiveFrame>, CaptureError> | Capture every monitor, one SensitiveFrame each. |
No pub use re-exports: every item above is declared in this crate.
Boundary
Depends on no other workspace tier.
Shares tier infrastructure with 82 other crates: infrastructure-acquire, infrastructure-adapters-google-calendar, infrastructure-adapters-google-gmail, infrastructure-adapters-google-places, infrastructure-adapters-google-trends, infrastructure-adapters-shodan, infrastructure-adapters-yelp, infrastructure-agent, … (82 total).
_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._
Where it sits
| Tier (ontology) | infrastructure |
| Architectural role (taxonomy) | unclassified (baselined) |
| Location | crates/infrastructure/screen-capture |
| Vocabulary in force (lexicon) | current |
Dependencies
Runtime, from outside the workspace.
| Crate | Requirement | Features | Optional | Only on |
|---|---|---|---|---|
image | ^0.25 | png | no | always |
thiserror | ^2 | — | no | always |
xcap | ^0.9 | — | no | always |
zeroize | ^1 | — | no | always |
Development. None.
Build. None.
Depended on by. 3 workspace crates.
Signal flow — what reaches this crate, and what it reaches.
flowchart LR n_infrastructure_acquire["infrastructure-acquire"] -->|uses| SELF n_operations_dlp_sensor["operations-dlp-sensor"] -->|uses| SELF n_tools_gui_harness["tools-gui-harness"] -->|uses| SELF SELF["infrastructure-screen-capture"] classDef self fill:#1f883d,stroke:#1f883d,color:#fff; class SELF self;
Feature flags
No Cargo features are defined: every capability is unconditional, so no consumer can receive a half-wired crate.
Targets
| Kind | Name | Source |
|---|---|---|
| lib | infrastructure_screen_capture | `src/lib.rs` |
Error model
| Error type | Named by |
|---|---|
CaptureError | capture_all, capture_primary |
Operational characteristics
| Property | Evidence |
|---|---|
| async public surface | none detected |
| async runtime | none detected |
| database access | none detected |
| network I/O | none detected |
| unsafe code | none detected |
| environment variables | none detected |
No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.
Configuration
No environment variable is read with a literal name anywhere in this crate. A variable whose key is computed at run time cannot be listed here, and is not claimed to be absent.
Related capabilities
3 workspace crates depend on this one: infrastructure-acquire, operations-dlp-sensor, tools-gui-harness.
Verification
| Kind | Count |
|---|---|
| Unit tests | 3 |
| Integration tests | 0 |
| Examples | 0 |
| Doctests | 0 |
Evidence by module. How often each public module is named by something executable.
| Module | Tests | Examples | Consumers |
|---|---|---|---|
crate root | 5 | 0 | 7 |
What the tests establish, by name:
capture_primary_is_graceful_headless_or_real—src/lib.rsencode_png_roundtrips_dimensions—src/lib.rsfrom_rgba_validates_length—src/lib.rs
Documentation coverage
| Measure | Documented | Total |
|---|---|---|
| Public items with rustdoc | 10 | 10 |
Public modules with a //! block | 0 | 0 |
pie showData
title Public items with rustdoc
"Documented" : 10
"No rustdoc detected" : 0
Metrics
| Metric | Value |
|---|---|
| Rust source files | 1 |
| Source lines | 186 |
| Code lines | 125 |
| Public API items | 10 |
| Public modules | 0 |
| Tests | 3 |
| Examples | 0 |
| Cargo features | 0 |
| Direct runtime dependencies | 4 |
| Workspace reverse dependencies | 3 |
pie showData
title Public API by kind
"constant" : 1
"enum" : 1
"function" : 2
"method" : 5
"struct" : 1
pie showData
title Rust source composition
"Code" : 125
"Blank or comment" : 61
Generation
Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.