document-ocr 0.0.0-stage → 3.1.3

package/hosting/deploy/cloudflare/wrangler.jsonc

@@ -0,0 +1,26 @@
+{
+  "$schema": "./node_modules/wrangler/config-schema.json",
+  "name": "document-ocr",
+  "main": "src/index.ts",
+  "compatibility_date": "2026-09-07",
+  "compatibility_flags": ["nodejs_compat"],
+  "observability": { "enabled": true },
+  "secrets": { "required": ["API_TOKEN"] },
+  "vars": {
+    "DOCUMENT_OCR_KYC_LANGS": "en",
+    "CONTAINER_INSTANCES": "2",
+    "CONTAINER_IDLE_TIMEOUT": "10m"
+  },
+  "containers": [{
+    "class_name": "OcrContainer",
+    "image": "../docker/Dockerfile",
+    "image_build_context": "../..",
+    "image_vars": { "DOCUMENT_OCR_KYC_LANGS": "en" },
+    "instance_type": "standard-2",
+    "max_instances": 2
+  }],
+  "durable_objects": {
+    "bindings": [{ "name": "OCR", "class_name": "OcrContainer" }]
+  },
+  "migrations": [{ "tag": "v1", "new_sqlite_classes": ["OcrContainer"] }]
+}

package/hosting/deploy/cloudrun/cloudbuild.yaml

@@ -0,0 +1,18 @@
+# Remote amd64 build. Deployment is owned by deploy.sh and render_service.py.
+substitutions:
+  _IMAGE_URI: 'IMAGE_URI_REQUIRED'
+  _KYC_LANGS: en
+steps:
+  - name: gcr.io/cloud-builders/docker
+    args:
+      - build
+      - --platform=linux/amd64
+      - --file=deploy/docker/Dockerfile
+      - '--build-arg=DOCUMENT_OCR_KYC_LANGS=${_KYC_LANGS}'
+      - '--tag=${_IMAGE_URI}'
+      - .
+images:
+  - '${_IMAGE_URI}'
+options:
+  machineType: E2_HIGHCPU_8
+  logging: CLOUD_LOGGING_ONLY

package/hosting/deploy/cloudrun/deploy.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
+cd "$ROOT_DIR"
+source deploy/common.sh
+if [[ $# -gt 0 ]]; then
+  [[ "$1" == production || "$1" == development ]] || { printf 'Optional argument must be production or development\n' >&2; exit 1; }
+  set -a
+  source ".env.deploy.$1"
+  set +a
+fi
+hosting_defaults
+require_command gcloud
+require_command python3
+: "${GCP_PROJECT:?Set GCP_PROJECT}"
+export GCP_REGION="${GCP_REGION:-asia-south1}"
+AR_REPO="${GCP_AR_REPO:-document-ocr}"
+export DOCUMENT_OCR_SERVICE_ACCOUNT="${DOCUMENT_OCR_SERVICE_ACCOUNT:-${DOCUMENT_OCR_NAME:0:23}-ocr-sa@${GCP_PROJECT}.iam.gserviceaccount.com}"
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+gcloud services enable run.googleapis.com artifactregistry.googleapis.com cloudbuild.googleapis.com iam.googleapis.com secretmanager.googleapis.com --project "$GCP_PROJECT" --quiet
+# List succeeds or the script fails; permission failures never mean "not found".
+ACCOUNTS="$(gcloud iam service-accounts list --project "$GCP_PROJECT" --filter="email=${DOCUMENT_OCR_SERVICE_ACCOUNT}" --format='value(email)')"
+if [[ -z "$ACCOUNTS" ]]; then
+  gcloud iam service-accounts create "${DOCUMENT_OCR_SERVICE_ACCOUNT%%@*}" --project "$GCP_PROJECT" --display-name 'Document OCR runtime' --quiet
+fi
+if [[ -n "${GCP_API_TOKEN_SECRET:-}" ]]; then
+  gcloud secrets add-iam-policy-binding "$GCP_API_TOKEN_SECRET" --project "$GCP_PROJECT" --member="serviceAccount:${DOCUMENT_OCR_SERVICE_ACCOUNT}" --role=roles/secretmanager.secretAccessor --quiet >/dev/null
+fi
+
+make_private() {
+  gcloud run services get-iam-policy "$DOCUMENT_OCR_NAME" --region "$GCP_REGION" --project "$GCP_PROJECT" --format=json > "$TMP_DIR/policy.json"
+  python3 - "$TMP_DIR/policy.json" <<'PY'
+import json, sys
+path = sys.argv[1]
+with open(path) as source:
+    policy = json.load(source)
+for binding in policy.get('bindings', []):
+    if binding.get('role') == 'roles/run.invoker':
+        binding['members'] = [member for member in binding.get('members', []) if member not in {'allUsers', 'allAuthenticatedUsers'}]
+policy['bindings'] = [binding for binding in policy.get('bindings', []) if binding.get('members')]
+with open(path, 'w') as target:
+    json.dump(policy, target)
+PY
+  gcloud run services set-iam-policy "$DOCUMENT_OCR_NAME" "$TMP_DIR/policy.json" --region "$GCP_REGION" --project "$GCP_PROJECT" --quiet >/dev/null
+}
+EXISTING="$(gcloud run services list --region "$GCP_REGION" --project "$GCP_PROJECT" --filter="metadata.name=${DOCUMENT_OCR_NAME}" --format='value(metadata.name)')"
+if [[ -n "$EXISTING" ]]; then
+  make_private
+  gcloud run services update "$DOCUMENT_OCR_NAME" --invoker-iam-check --region "$GCP_REGION" --project "$GCP_PROJECT" --quiet
+fi
+
+if [[ -z "${IMAGE_URI:-}" ]]; then
+  REPOSITORIES="$(gcloud artifacts repositories list --project "$GCP_PROJECT" --location "$GCP_REGION" --filter="name:${AR_REPO}" --format='value(name)')"
+  if [[ "$REPOSITORIES" != *"/repositories/${AR_REPO}"* ]]; then
+    gcloud artifacts repositories create "$AR_REPO" --repository-format=docker --location "$GCP_REGION" --project "$GCP_PROJECT" --quiet
+  fi
+  export IMAGE_URI="${GCP_REGION}-docker.pkg.dev/${GCP_PROJECT}/${AR_REPO}/${DOCUMENT_OCR_NAME}:$(date -u +%Y%m%d%H%M%S)"
+  gcloud builds submit . --project "$GCP_PROJECT" --region "$GCP_REGION" --config deploy/cloudrun/cloudbuild.yaml --substitutions="^|^_IMAGE_URI=${IMAGE_URI}|_KYC_LANGS=${DOCUMENT_OCR_KYC_LANGS}" --quiet
+fi
+export IMAGE_URI
+python3 deploy/cloudrun/render_service.py > "$TMP_DIR/service.json"
+gcloud run services replace "$TMP_DIR/service.json" --region "$GCP_REGION" --project "$GCP_PROJECT" --quiet
+make_private
+if [[ -n "${GCP_INVOKER_MEMBER:-}" ]]; then
+  [[ "$GCP_INVOKER_MEMBER" != allUsers && "$GCP_INVOKER_MEMBER" != allAuthenticatedUsers ]] || { printf 'A named IAM invoker is required\n' >&2; exit 1; }
+  gcloud run services add-iam-policy-binding "$DOCUMENT_OCR_NAME" --member "$GCP_INVOKER_MEMBER" --role roles/run.invoker --region "$GCP_REGION" --project "$GCP_PROJECT" --quiet >/dev/null
+fi
+URL="$(gcloud run services describe "$DOCUMENT_OCR_NAME" --region "$GCP_REGION" --project "$GCP_PROJECT" --format='value(status.url)')"
+printf 'Deployed private Cloud Run service: %s\nUse an audience-matched Google ID token; see HOSTING.md.\n' "$URL"

package/hosting/deploy/cloudrun/render_service.py

@@ -0,0 +1,47 @@
+"""Render the one Cloud Run service definition used by CLI and Cloud Build."""
+import json
+import os
+import sys
+
+
+def service(env):
+    name = env.get('DOCUMENT_OCR_NAME', 'document-ocr')
+    profile = env.get('DOCUMENT_OCR_PROFILE', 'economy')
+    if profile not in {'economy', 'warm'}:
+        raise ValueError('Profile must be economy or warm')
+    variables = [{'name': 'DOCUMENT_OCR_KYC_LANGS', 'value': env.get('DOCUMENT_OCR_KYC_LANGS', 'en')}]
+    if env.get('GCP_API_TOKEN_SECRET'):
+        variables.append({'name': 'API_TOKEN', 'valueFrom': {'secretKeyRef': {
+            'name': env['GCP_API_TOKEN_SECRET'], 'key': env.get('GCP_API_TOKEN_VERSION', 'latest')}}})
+    return {
+        'apiVersion': 'serving.knative.dev/v1', 'kind': 'Service',
+        'metadata': {'name': name, 'annotations': {
+            'run.googleapis.com/ingress': 'all',
+            'run.googleapis.com/invoker-iam-disabled': 'false',
+        }},
+        'spec': {'template': {
+            'metadata': {'annotations': {
+                'autoscaling.knative.dev/minScale': '1' if profile == 'warm' else '0',
+                'autoscaling.knative.dev/maxScale': env.get('DOCUMENT_OCR_MAX_INSTANCES', '10'),
+                'run.googleapis.com/cpu-throttling': 'true',
+                'run.googleapis.com/startup-cpu-boost': 'true',
+            }},
+            'spec': {
+                'serviceAccountName': env['DOCUMENT_OCR_SERVICE_ACCOUNT'],
+                'containerConcurrency': 1, 'timeoutSeconds': 300,
+                'containers': [{
+                    'image': env['IMAGE_URI'],
+                    'ports': [{'name': 'http1', 'containerPort': 8000}],
+                    'resources': {'limits': {'cpu': '2', 'memory': '2Gi'}},
+                    'env': variables,
+                    'startupProbe': {'httpGet': {'path': '/ready', 'port': 8000}, 'periodSeconds': 5, 'failureThreshold': 30, 'timeoutSeconds': 3},
+                    'livenessProbe': {'httpGet': {'path': '/health', 'port': 8000}, 'periodSeconds': 30, 'timeoutSeconds': 3},
+                }],
+            },
+        }},
+    }
+
+
+if __name__ == '__main__':
+    json.dump(service(os.environ), sys.stdout, indent=2)
+    print()

package/hosting/deploy/common.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Shared validation only. Sourcing this file performs no cloud operations.
+set -euo pipefail
+require_command() {
+  command -v "$1" >/dev/null 2>&1 || { printf 'Required command is missing: %s\n' "$1" >&2; exit 1; }
+}
+hosting_defaults() {
+  export DOCUMENT_OCR_NAME="${DOCUMENT_OCR_NAME:-document-ocr}"
+  export DOCUMENT_OCR_PROFILE="${DOCUMENT_OCR_PROFILE:-economy}"
+  export DOCUMENT_OCR_KYC_LANGS="${DOCUMENT_OCR_KYC_LANGS:-en}"
+  [[ "$DOCUMENT_OCR_NAME" =~ ^[a-z][a-z0-9-]{0,39}$ ]] || { printf 'Invalid DOCUMENT_OCR_NAME\n' >&2; exit 1; }
+  case "$DOCUMENT_OCR_PROFILE" in economy|warm) ;; *) printf 'Profile must be economy or warm\n' >&2; exit 1;; esac
+  [[ "$DOCUMENT_OCR_KYC_LANGS" =~ ^(en|latin|devanagari|ka|ta|te)(,(en|latin|devanagari|ka|ta|te)){0,3}$ ]] || { printf 'Invalid DOCUMENT_OCR_KYC_LANGS (up to four supported languages)\n' >&2; exit 1; }
+}

package/hosting/deploy/docker/Dockerfile

@@ -0,0 +1,16 @@
+FROM python:3.14-slim
+WORKDIR /app
+ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1
+RUN apt-get update && apt-get install -y --no-install-recommends libgl1 libglib2.0-0 libgomp1 && rm -rf /var/lib/apt/lists/*
+COPY requirements.lock ./
+RUN python -m pip install --no-cache-dir -r requirements.lock
+COPY core/ core/
+ARG DOCUMENT_OCR_KYC_LANGS=en
+ENV DOCUMENT_OCR_KYC_LANGS=${DOCUMENT_OCR_KYC_LANGS}
+RUN python -m core.model_setup
+COPY deploy/docker/server.py server.py
+RUN useradd --create-home --uid 10001 ocr && mkdir -p /var/lib/document-ocr/jobs && chown -R ocr:ocr /app /var/lib/document-ocr
+USER ocr
+EXPOSE 8000
+HEALTHCHECK --interval=30s --timeout=3s --start-period=120s CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=2)"
+CMD ["uvicorn", "server:app", "--host", "0.0.0.0", "--port", "8000", "--timeout-keep-alive", "30"]

package/hosting/deploy/docker/server.py

@@ -0,0 +1,313 @@
+"""
+FastAPI server wrapping the passport OCR pipeline.
+
+Used by the document-ocr npm package to run OCR locally.
+"""
+
+from __future__ import annotations
+
+import asyncio
+from contextlib import asynccontextmanager
+import logging
+import os
+import secrets
+import uuid
+from functools import partial
+from pathlib import Path
+
+from fastapi import FastAPI, File, Form, Header, UploadFile, HTTPException
+from fastapi.responses import JSONResponse, HTMLResponse, Response
+
+from core.kyc_ocr import KycOCRConfigError
+from core.ocr_engine import OCRModelInitError
+from core.pipeline import scan
+from core.document_bundle import scan_batch, scan_document
+from core.document_registry import list_document_profiles, validate_document_hint
+from core.barcodes import barcode_decoder_available
+from core.jobs import configured_store
+from core.redaction import redact, render_preview
+from core.preprocessor import ImageQualityError
+
+# ---------------------------------------------------------------------------
+# Config
+# ---------------------------------------------------------------------------
+
+MAX_UPLOAD_SIZE = 10 * 1024 * 1024  # 10 MB
+SCAN_TIMEOUT_SECONDS = 60.0
+logger = logging.getLogger("document-ocr")
+# uvicorn configures only its own loggers, so without a handler these per-scan
+# INFO lines (status, page type, confidence, timing; never document text) were
+# dropped. Scoped to this logger so core modules keep their default level.
+if not logger.handlers:
+    _handler = logging.StreamHandler()
+    _handler.setFormatter(logging.Formatter("%(levelname)s: %(message)s"))
+    logger.addHandler(_handler)
+    logger.setLevel(logging.INFO)
+    logger.propagate = False
+# Matches the sibling pdf-worker service so a deployment sets one variable name
+# everywhere. Unset means no auth is enforced, which is what local development wants.
+API_TOKEN = os.getenv("API_TOKEN") or None
+
+_ocr_semaphore = asyncio.Semaphore(1)
+_models_ready = False
+_model_init_error: str | None = None
+
+# ---------------------------------------------------------------------------
+# App lifecycle
+# ---------------------------------------------------------------------------
+
+@asynccontextmanager
+async def _lifespan(app: FastAPI):
+    global _models_ready, _model_init_error
+    _models_ready = False
+    _model_init_error = None
+    logger.info("Loading OCR models...")
+    loop = asyncio.get_running_loop()
+    try:
+        await loop.run_in_executor(None, _warm_up_ocr)
+    except (OCRModelInitError, KycOCRConfigError) as exc:
+        # Stay up so /ready and /scan can report a clear error instead of the
+        # process crash-looping. Liveness (/health) remains green.
+        _model_init_error = str(exc)
+        logger.error("OCR model initialisation failed: %s", exc)
+    else:
+        _models_ready = True
+        logger.info("OCR models loaded.")
+    yield
+
+
+app = FastAPI(title="Document OCR", version="3.1.2", lifespan=_lifespan)
+
+
+@app.middleware("http")
+async def _private_responses(request, call_next):
+    response = await call_next(request)
+    response.headers["Cache-Control"] = "no-store"
+    response.headers["X-Content-Type-Options"] = "nosniff"
+    return response
+
+
+def _warm_up_ocr():
+    from core.kyc_ocr import configured_kyc_languages
+    from core.ocr_engine import _get_ocr
+
+    for language in dict.fromkeys(("en", *configured_kyc_languages())):
+        _get_ocr(language)
+    _get_ocr("en", band=True)  # MRZ band re-reads; avoid loading on a live scan
+
+
+@app.get("/health")
+async def health():
+    return {"status": "ok"}
+
+
+@app.get("/ready")
+async def ready():
+    if _model_init_error is not None:
+        return JSONResponse(
+            status_code=503,
+            content={"status": "model_init_failed", "error": _model_init_error},
+        )
+    if not _models_ready:
+        return JSONResponse(status_code=503, content={"status": "loading"})
+    return {"status": "ready"}
+
+
+def _scan_finished(future: asyncio.Future) -> None:
+    _ocr_semaphore.release()
+    # Consume late exceptions after a disconnected/timed-out caller has gone.
+    if not future.cancelled():
+        future.exception()
+
+
+def _authorize(authorization):
+    if API_TOKEN is not None:
+        expected = f"Bearer {API_TOKEN}"
+        if authorization is None or not secrets.compare_digest(authorization, expected):
+            raise HTTPException(status_code=401, detail="UNAUTHORIZED", headers={"WWW-Authenticate": "Bearer"})
+
+
+async def _upload(image: UploadFile) -> bytes:
+    content_type = image.content_type or ""
+    if not content_type.startswith("image/") and content_type != "application/pdf":
+        raise HTTPException(status_code=400, detail="INVALID_CONTENT_TYPE")
+    data = await image.read(MAX_UPLOAD_SIZE + 1)
+    if len(data) > MAX_UPLOAD_SIZE:
+        raise HTTPException(status_code=400, detail="FILE_TOO_LARGE")
+    if not data:
+        raise HTTPException(status_code=400, detail="EMPTY_FILE")
+    return data
+
+
+async def _uploads(images: list[UploadFile]) -> list[bytes]:
+    if not 1 <= len(images) <= 10:
+        raise HTTPException(status_code=400, detail="INVALID_BATCH_SIZE")
+    output, size = [], 0
+    for image in images:
+        data = await _upload(image)
+        size += len(data)
+        if size > MAX_UPLOAD_SIZE:
+            raise HTTPException(status_code=400, detail="BATCH_TOO_LARGE")
+        output.append(data)
+    return output
+
+
+def _options(document_type, country, include_evidence):
+    try:
+        document_type, country = validate_document_hint(document_type, country)
+    except ValueError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+    # Omit defaults for compatibility with one-argument pipeline integrations.
+    return {key: value for key, value in {
+        'document_type': document_type, 'country': country,
+        'include_evidence': include_evidence,
+    }.items() if value}
+
+
+async def _execute(function, *args, **kwargs):
+    request_id = str(uuid.uuid4())[:8]
+    try:
+        deadline = asyncio.get_running_loop().time() + SCAN_TIMEOUT_SECONDS
+        await asyncio.wait_for(_ocr_semaphore.acquire(), timeout=SCAN_TIMEOUT_SECONDS)
+        try:
+            future = asyncio.get_running_loop().run_in_executor(None, partial(function, *args, **kwargs))
+        except BaseException:
+            _ocr_semaphore.release()
+            raise
+        future.add_done_callback(_scan_finished)
+        return await asyncio.wait_for(asyncio.shield(future), timeout=max(0, deadline - asyncio.get_running_loop().time()))
+    except asyncio.TimeoutError:
+        logger.warning("[%s] scan_timeout", request_id)
+        return JSONResponse(status_code=504, content={"error": "SCAN_TIMEOUT"})
+    except OCRModelInitError:
+        logger.error("[%s] model_init_failed", request_id)
+        return JSONResponse(status_code=503, content={"error": "MODEL_INIT_FAILED"})
+    except KycOCRConfigError:
+        logger.error("[%s] invalid_kyc_ocr_config", request_id)
+        return JSONResponse(status_code=503, content={"error": "INVALID_KYC_OCR_CONFIG"})
+    except (ImageQualityError, ValueError) as exc:
+        return JSONResponse(status_code=400, content={"error": str(exc)})
+    except Exception:
+        logger.exception("[%s] internal_error", request_id)
+        return JSONResponse(status_code=500, content={"error": "INTERNAL_ERROR"})
+
+
+@app.post("/scan")
+async def scan_passport(
+    image: UploadFile = File(...), authorization: str | None = Header(default=None),
+    document_type: str | None = Form(default=None), country: str | None = Form(default=None),
+    include_evidence: bool = Form(default=False),
+):
+    _authorize(authorization)
+    options = _options(document_type, country, include_evidence)
+    result = await _execute(scan, await _upload(image), **options)
+    if isinstance(result, Response):
+        return result
+    logger.info("status=%s page_type=%s confidence=%s processing_ms=%s", result.status,
+                result.page_type, result.confidence, result.processing_ms)
+    return JSONResponse(status_code=422 if result.status == 'failure' else 200, content=result.to_dict())
+
+
+@app.get("/documents")
+async def documents(authorization: str | None = Header(default=None)):
+    _authorize(authorization)
+    return {"schemaVersion": 1, "documents": list_document_profiles(),
+            "capabilities": {"barcode": barcode_decoder_available(), "jobs": await asyncio.to_thread(_job_store, required=False) is not None,
+                             "review": True, "multipage": True}}
+
+
+@app.post("/scan/batch")
+async def batch(
+    images: list[UploadFile] = File(...), authorization: str | None = Header(default=None),
+    document_type: str | None = Form(default=None), country: str | None = Form(default=None),
+    include_evidence: bool = Form(default=False),
+):
+    _authorize(authorization)
+    options = _options(document_type, country, include_evidence)
+    return await _execute(scan_batch, await _uploads(images), **options)
+
+
+@app.post("/scan/document")
+async def grouped_document(
+    images: list[UploadFile] = File(...), authorization: str | None = Header(default=None),
+    document_type: str | None = Form(default=None), country: str | None = Form(default=None),
+    include_evidence: bool = Form(default=False),
+):
+    _authorize(authorization)
+    options = _options(document_type, country, include_evidence)
+    return await _execute(scan_document, await _uploads(images), **options)
+
+
+@app.get("/review", response_class=HTMLResponse)
+async def review():
+    import core
+    path = Path(core.__file__).with_name('review.html')
+    return HTMLResponse(path.read_text(), headers={'Cache-Control': 'no-store',
+        'Content-Security-Policy': "default-src 'self'; img-src 'self' blob: data:; style-src 'unsafe-inline'; script-src 'unsafe-inline'; connect-src 'self'; frame-ancestors 'none'"})
+
+
+@app.post("/preview")
+async def preview(image: UploadFile = File(...), authorization: str | None = Header(default=None)):
+    _authorize(authorization)
+    result = await _execute(render_preview, await _upload(image))
+    if isinstance(result, Response):
+        return result
+    return Response(result, media_type='image/png', headers={'Cache-Control': 'no-store'})
+
+
+@app.post("/redact")
+async def redacted(image: UploadFile = File(...), boxes: str = Form(...), authorization: str | None = Header(default=None)):
+    _authorize(authorization)
+    if len(boxes) > 50000:
+        raise HTTPException(status_code=400, detail='INVALID_REDACTION_BOXES')
+    result = await _execute(redact, await _upload(image), boxes)
+    if isinstance(result, Response):
+        return result
+    return Response(result, media_type='image/png', headers={'Cache-Control': 'no-store',
+        'Content-Disposition': 'attachment; filename="redacted.png"'})
+
+
+def _job_store(*, required=True):
+    try:
+        store = configured_store()
+    except ValueError as exc:
+        raise HTTPException(status_code=503, detail='INVALID_JOB_CONFIGURATION') from exc
+    if required and store is None:
+        raise HTTPException(status_code=503, detail='JOBS_NOT_CONFIGURED')
+    return store
+
+
+@app.post('/jobs', status_code=202)
+async def enqueue_job(
+    images: list[UploadFile] = File(...), authorization: str | None = Header(default=None),
+    document_type: str | None = Form(default=None), country: str | None = Form(default=None),
+    include_evidence: bool = Form(default=False), grouped: bool = Form(default=False), notify: bool = Form(default=False),
+):
+    _authorize(authorization)
+    options = _options(document_type, country, include_evidence)
+    store = await asyncio.to_thread(_job_store)
+    data = await _uploads(images)
+    try:
+        return await asyncio.to_thread(store.enqueue, data, options, grouped=grouped, notify=notify)
+    except ValueError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+
+
+@app.get('/jobs/{identifier}')
+async def job(identifier: str, authorization: str | None = Header(default=None)):
+    _authorize(authorization)
+    store = await asyncio.to_thread(_job_store)
+    result = await asyncio.to_thread(store.get, identifier)
+    if result is None:
+        raise HTTPException(status_code=404, detail='JOB_NOT_FOUND')
+    return result
+
+
+@app.delete('/jobs/{identifier}')
+async def delete_job(identifier: str, authorization: str | None = Header(default=None)):
+    _authorize(authorization)
+    store = await asyncio.to_thread(_job_store)
+    removed = await asyncio.to_thread(store.delete, identifier)
+    if not removed:
+        raise HTTPException(status_code=404, detail='JOB_NOT_FOUND')
+    return {'deleted': True}

package/hosting/deploy/lambda/Dockerfile.lambda

@@ -0,0 +1,11 @@
+FROM public.ecr.aws/lambda/python:3.14
+RUN microdnf install -y mesa-libGL glib2 libgomp && microdnf clean all
+COPY requirements.lock ${LAMBDA_TASK_ROOT}/requirements.lock
+RUN python -m pip install --no-cache-dir -r ${LAMBDA_TASK_ROOT}/requirements.lock
+COPY core/ ${LAMBDA_TASK_ROOT}/core/
+ARG DOCUMENT_OCR_KYC_LANGS=en
+ENV DOCUMENT_OCR_KYC_LANGS=${DOCUMENT_OCR_KYC_LANGS} PYTHONDONTWRITEBYTECODE=1
+# Lambda has a read-only root filesystem: package every selected model now.
+RUN python -m core.model_setup
+COPY deploy/lambda/handler.py ${LAMBDA_TASK_ROOT}/handler.py
+CMD ["handler.handler"]

package/hosting/deploy/lambda/deploy.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
+cd "$ROOT_DIR"
+source deploy/common.sh
+hosting_defaults
+require_command sam
+require_command aws
+export AWS_REGION="${AWS_REGION:-ap-south-1}"
+STACK="${AWS_STACK_NAME:-$DOCUMENT_OCR_NAME}"
+PARAMETERS=("KycLanguages=$DOCUMENT_OCR_KYC_LANGS" "InputBucket=${DOCUMENT_OCR_S3_BUCKET:-}" "InputPrefix=${DOCUMENT_OCR_S3_PREFIX:-uploads/}")
+TEMPLATE=deploy/lambda/template.yaml
+if [[ -z "${IMAGE_URI:-}" ]]; then
+  require_command docker
+  export DOCKER_DEFAULT_PLATFORM=linux/amd64
+  sam build --template-file "$TEMPLATE" --parameter-overrides "${PARAMETERS[@]}"
+  TEMPLATE=.aws-sam/build/template.yaml
+else
+  PARAMETERS+=("ImageUri=$IMAGE_URI")
+fi
+sam deploy --template-file "$TEMPLATE" --stack-name "$STACK" --region "$AWS_REGION" --resolve-image-repos --resolve-s3 --capabilities CAPABILITY_IAM --parameter-overrides "${PARAMETERS[@]}" --no-fail-on-empty-changeset
+aws cloudformation describe-stacks --stack-name "$STACK" --region "$AWS_REGION" --query 'Stacks[0].Outputs' --output json