document-ocr 0.0.0-stage → 3.1.3

package/hosting/deploy/lambda/handler.py

@@ -0,0 +1,132 @@
+"""AWS direct invoke/API Gateway handler with bounded inline or allowlisted S3 input."""
+from __future__ import annotations
+
+import base64
+import binascii
+import json
+import logging
+import os
+
+from core.kyc_ocr import KycOCRConfigError
+from core.ocr_engine import OCRModelInitError
+from core.pipeline import scan
+from core.preprocessor import ImageQualityError
+from core.document_registry import validate_document_hint
+
+logger = logging.getLogger('document-ocr.lambda')
+MAX_DECODED_SIZE = 10 * 1024 * 1024
+MAX_ENCODED_SIZE = ((MAX_DECODED_SIZE + 2) // 3) * 4
+
+
+def _response(status: int, payload: dict):
+    return {'statusCode': status, 'headers': {'Content-Type': 'application/json', 'Cache-Control': 'no-store'},
+            'body': json.dumps(payload)}
+
+
+def _error(status_code: int, code: str):
+    return _response(status_code, {'error': code})
+
+
+def _event_payload(event):
+    if not isinstance(event, dict):
+        raise ValueError('MISSING_IMAGE')
+    if 'body' not in event:
+        return event, False
+    body = event['body']
+    if not isinstance(body, str):
+        raise ValueError('INVALID_REQUEST_BODY')
+    if len(body) > MAX_ENCODED_SIZE + 65536:
+        raise ValueError('FILE_TOO_LARGE')
+    try:
+        if event.get('isBase64Encoded'):
+            body = base64.b64decode(body, validate=True).decode('utf-8')
+        parsed = json.loads(body)
+    except (ValueError, UnicodeDecodeError) as exc:
+        raise ValueError('INVALID_REQUEST_BODY') from exc
+    if not isinstance(parsed, dict):
+        raise ValueError('INVALID_REQUEST_BODY')
+    return parsed, True
+
+
+def _read_s3(reference):
+    if not isinstance(reference, dict):
+        raise ValueError('INVALID_S3_REFERENCE')
+    bucket, key = reference.get('bucket'), reference.get('key')
+    version = reference.get('version_id')
+    allowed_bucket, prefix = os.getenv('DOCUMENT_OCR_S3_BUCKET'), os.getenv('DOCUMENT_OCR_S3_PREFIX', '')
+    if not allowed_bucket:
+        raise ValueError('S3_NOT_CONFIGURED')
+    if bucket != allowed_bucket or not isinstance(key, str) or not key or not key.startswith(prefix):
+        raise ValueError('S3_OBJECT_NOT_ALLOWED')
+    if version is not None and (not isinstance(version, str) or not version):
+        raise ValueError('INVALID_S3_REFERENCE')
+    # The execution role grants GetObject/GetObjectVersion only for this prefix.
+    # S3 keys are opaque: no decoding, filesystem traversal or remote URL fetch.
+    import boto3
+    args = {'Bucket': bucket, 'Key': key}
+    if version is not None:
+        args['VersionId'] = version
+    response = boto3.client('s3').get_object(**args)
+    body = response['Body']
+    try:
+        if response.get('ContentLength', 0) > MAX_DECODED_SIZE:
+            raise ValueError('FILE_TOO_LARGE')
+        data = body.read(MAX_DECODED_SIZE + 1)
+        if len(data) > MAX_DECODED_SIZE:
+            raise ValueError('FILE_TOO_LARGE')
+        return data
+    finally:
+        body.close()
+
+
+def _read_image(payload):
+    if 's3' in payload and 'image_base64' in payload:
+        raise ValueError('AMBIGUOUS_IMAGE_SOURCE')
+    if 's3' in payload:
+        return _read_s3(payload['s3'])
+    image = payload.get('image_base64')
+    if not isinstance(image, str) or not image:
+        raise ValueError('MISSING_IMAGE')
+    if len(image) > MAX_ENCODED_SIZE:
+        raise ValueError('FILE_TOO_LARGE')
+    try:
+        return base64.b64decode(image, validate=True)
+    except (binascii.Error, ValueError) as exc:
+        raise ValueError('INVALID_BASE64') from exc
+
+
+def handler(event, context=None):
+    try:
+        payload, gateway = _event_payload(event)
+        document_type, country = validate_document_hint(payload.get('document_type'), payload.get('country'))
+        evidence = payload.get('include_evidence', False)
+        if not isinstance(evidence, bool):
+            raise ValueError('INVALID_INCLUDE_EVIDENCE')
+        data = _read_image(payload)
+        if not data:
+            raise ValueError('EMPTY_FILE')
+        if len(data) > MAX_DECODED_SIZE:
+            raise ValueError('FILE_TOO_LARGE')
+        options = {k:v for k,v in {'document_type':document_type, 'country':country, 'include_evidence':evidence}.items() if v}
+    except ValueError as exc:
+        return _error(400, str(exc))
+    except Exception:
+        logger.error('input_read_failed')
+        return _error(500, 'INPUT_READ_FAILED')
+    try:
+        result = scan(data, **options)
+    except ImageQualityError as exc:
+        return _error(400, str(exc))
+    except OCRModelInitError:
+        logger.error('model_init_failed')
+        return _error(503, 'MODEL_INIT_FAILED')
+    except KycOCRConfigError:
+        return _error(503, 'INVALID_KYC_OCR_CONFIG')
+    except Exception:
+        # Cloud SDK errors may contain bucket/key details; do not log payloads.
+        logger.error('scan_failed')
+        return _error(500, 'INTERNAL_ERROR')
+    output = result.to_dict()
+    logger.info('status=%s page_type=%s confidence=%s processing_ms=%s',
+                output.get('status'), output.get('pageType'), output.get('confidence'), output.get('processingMs'))
+    return _response(422 if output.get('status') == 'failure' else 200, output) if gateway else output

package/hosting/deploy/lambda/template.yaml

@@ -0,0 +1,59 @@
+AWSTemplateFormatVersion: '2010-09-09'
+Transform: AWS::Serverless-2016-10-31
+Description: Document OCR image Lambda with IAM invocation and optional S3 input
+Parameters:
+  KycLanguages:
+    Type: String
+    Default: en
+  ImageUri:
+    Type: String
+    Default: ''
+  InputBucket:
+    Type: String
+    Default: ''
+  InputPrefix:
+    Type: String
+    Default: uploads/
+    AllowedPattern: '[A-Za-z0-9._/-]+'
+  ReservedConcurrency:
+    Type: Number
+    Default: 10
+    MinValue: 1
+Conditions:
+  HasInputBucket: !Not [!Equals [!Ref InputBucket, '']]
+  HasImage: !Not [!Equals [!Ref ImageUri, '']]
+Resources:
+  DocumentOcrFunction:
+    Type: AWS::Serverless::Function
+    Metadata:
+      Dockerfile: deploy/lambda/Dockerfile.lambda
+      DockerContext: ../..
+      DockerTag: document-ocr-lambda
+      DockerBuildArgs:
+        DOCUMENT_OCR_KYC_LANGS: !Ref KycLanguages
+    Properties:
+      PackageType: Image
+      ImageUri: !If [HasImage, !Ref ImageUri, !Ref 'AWS::NoValue']
+      Architectures: [x86_64]
+      MemorySize: 2048
+      Timeout: 120
+      ReservedConcurrentExecutions: !Ref ReservedConcurrency
+      Environment:
+        Variables:
+          DOCUMENT_OCR_KYC_LANGS: !Ref KycLanguages
+          DOCUMENT_OCR_S3_BUCKET: !Ref InputBucket
+          DOCUMENT_OCR_S3_PREFIX: !Ref InputPrefix
+      Policies:
+        - AWSLambdaBasicExecutionRole
+        - !If
+          - HasInputBucket
+          - Statement:
+              - Effect: Allow
+                Action: s3:GetObject
+                Resource: !Sub 'arn:${AWS::Partition}:s3:::${InputBucket}/${InputPrefix}*'
+          - !Ref 'AWS::NoValue'
+Outputs:
+  FunctionName:
+    Value: !Ref DocumentOcrFunction
+  FunctionArn:
+    Value: !GetAtt DocumentOcrFunction.Arn

package/hosting/deploy/local/dev.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
+
+cd "$ROOT_DIR"
+
+echo "Starting document-ocr dev server on http://localhost:8000"
+echo "Docs: http://localhost:8000/docs"
+echo ""
+
+PYTHONPATH="$ROOT_DIR" uv run uvicorn deploy.docker.server:app \
+  --host 0.0.0.0 \
+  --port 8000 \
+  --reload \
+  --reload-dir core \
+  --reload-dir deploy/docker

package/hosting/deploy/server/Caddyfile

@@ -0,0 +1,5 @@
+{$DOMAIN} {
+    # Caddy obtains and renews HTTPS certificates automatically.
+    reverse_proxy ocr:8000
+    header Cache-Control "no-store"
+}

package/hosting/deploy/server/compose.jobs.yaml

@@ -0,0 +1,36 @@
+# Opt-in only: use with compose.yaml and --profile jobs.
+services:
+  ocr:
+    environment:
+      DOCUMENT_OCR_JOBS_DIR: /var/lib/document-ocr/jobs
+      DOCUMENT_OCR_JOB_KEY: ${DOCUMENT_OCR_JOB_KEY:?Set DOCUMENT_OCR_JOB_KEY}
+      DOCUMENT_OCR_JOB_RETENTION_SECONDS: ${DOCUMENT_OCR_JOB_RETENTION_SECONDS:-86400}
+      DOCUMENT_OCR_WEBHOOK_URL: ${DOCUMENT_OCR_WEBHOOK_URL:-}
+      DOCUMENT_OCR_WEBHOOK_SECRET: ${DOCUMENT_OCR_WEBHOOK_SECRET:-}
+    volumes:
+      - ocr_jobs:/var/lib/document-ocr/jobs
+  worker:
+    profiles: [jobs]
+    image: ${IMAGE_URI:-document-ocr:local}
+    pull_policy: never
+    command: [python, -m, core.jobs, worker]
+    environment:
+      DOCUMENT_OCR_KYC_LANGS: ${DOCUMENT_OCR_KYC_LANGS:-en}
+      DOCUMENT_OCR_JOBS_DIR: /var/lib/document-ocr/jobs
+      DOCUMENT_OCR_JOB_KEY: ${DOCUMENT_OCR_JOB_KEY:?Set DOCUMENT_OCR_JOB_KEY}
+      DOCUMENT_OCR_JOB_RETENTION_SECONDS: ${DOCUMENT_OCR_JOB_RETENTION_SECONDS:-86400}
+      DOCUMENT_OCR_WEBHOOK_URL: ${DOCUMENT_OCR_WEBHOOK_URL:-}
+      DOCUMENT_OCR_WEBHOOK_SECRET: ${DOCUMENT_OCR_WEBHOOK_SECRET:-}
+    volumes:
+      - ocr_jobs:/var/lib/document-ocr/jobs
+    healthcheck:
+      disable: true
+    depends_on:
+      ocr:
+        condition: service_healthy
+    restart: unless-stopped
+    init: true
+    cpus: 2.0
+    mem_limit: 2g
+volumes:
+  ocr_jobs:

package/hosting/deploy/server/compose.yaml

@@ -0,0 +1,38 @@
+services:
+  ocr:
+    image: ${IMAGE_URI:-document-ocr:local}
+    build:
+      context: ../..
+      dockerfile: deploy/docker/Dockerfile
+      args:
+        DOCUMENT_OCR_KYC_LANGS: ${DOCUMENT_OCR_KYC_LANGS:-en}
+    environment:
+      DOCUMENT_OCR_KYC_LANGS: ${DOCUMENT_OCR_KYC_LANGS:-en}
+      API_TOKEN: ${API_TOKEN:?Set a strong API_TOKEN before starting the server}
+    expose: ['8000']
+    restart: unless-stopped
+    init: true
+    cpus: 2.0
+    mem_limit: 2g
+    healthcheck:
+      test: [CMD, python, -c, "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/ready', timeout=2)"]
+      interval: 10s
+      timeout: 3s
+      retries: 15
+      start_period: 120s
+  caddy:
+    image: caddy:2-alpine
+    environment:
+      DOMAIN: ${DOMAIN:?Set DOMAIN to the DNS name pointing to this server}
+    ports: ['80:80', '443:443', '443:443/udp']
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy_data:/data
+      - caddy_config:/config
+    depends_on:
+      ocr:
+        condition: service_healthy
+    restart: unless-stopped
+volumes:
+  caddy_data:
+  caddy_config:

package/hosting/deploy/server/deploy.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Run on the target server (or use Docker's existing remote context).
+set -euo pipefail
+ROOT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
+cd "$ROOT_DIR"
+source deploy/common.sh
+hosting_defaults
+require_command docker
+: "${DOMAIN:?Set DOMAIN to a DNS name pointing to this server}"
+: "${API_TOKEN:?Set API_TOKEN}"
+COMPOSE=(docker compose -p "$DOCUMENT_OCR_NAME" -f deploy/server/compose.yaml)
+if [[ "${DOCUMENT_OCR_JOBS_ENABLED:-false}" == true ]]; then
+  : "${DOCUMENT_OCR_JOB_KEY:?Set DOCUMENT_OCR_JOB_KEY for encrypted persistent jobs}"
+  COMPOSE+=(-f deploy/server/compose.jobs.yaml --profile jobs)
+fi
+"${COMPOSE[@]}" config --quiet
+if [[ -n "${IMAGE_URI:-}" ]]; then
+  "${COMPOSE[@]}" pull ocr
+  "${COMPOSE[@]}" up --detach --wait --no-build
+else
+  "${COMPOSE[@]}" up --detach --wait --build
+fi
+printf 'Document OCR is available at https://%s (Bearer authentication required).\n' "$DOMAIN"

package/hosting/infra/cloudrun/main.tf

@@ -0,0 +1,104 @@
+terraform {
+  required_version = ">= 1.5.0"
+  required_providers {
+    google = { source = "hashicorp/google", version = "~> 7.0" }
+  }
+}
+provider "google" { project = var.project_id }
+locals {
+  services = toset(["run.googleapis.com", "artifactregistry.googleapis.com", "iam.googleapis.com", "secretmanager.googleapis.com"])
+}
+resource "google_project_service" "apis" {
+  for_each           = local.services
+  project            = var.project_id
+  service            = each.value
+  disable_on_destroy = false
+}
+resource "google_artifact_registry_repository" "images" {
+  location      = var.region
+  repository_id = var.name
+  format        = "DOCKER"
+  depends_on    = [google_project_service.apis]
+}
+resource "google_service_account" "runtime" {
+  account_id   = "${substr(var.name, 0, 23)}-ocr-sa"
+  display_name = "Document OCR runtime"
+  depends_on   = [google_project_service.apis]
+}
+resource "google_secret_manager_secret_iam_member" "token" {
+  count     = var.api_token_secret == null ? 0 : 1
+  project   = var.project_id
+  secret_id = var.api_token_secret
+  role      = "roles/secretmanager.secretAccessor"
+  member    = "serviceAccount:${google_service_account.runtime.email}"
+}
+resource "google_cloud_run_v2_service" "ocr" {
+  name                 = var.name
+  location             = var.region
+  deletion_protection  = var.deletion_protection
+  ingress              = "INGRESS_TRAFFIC_ALL"
+  invoker_iam_disabled = false
+  template {
+    service_account                  = google_service_account.runtime.email
+    max_instance_request_concurrency = 1
+    timeout                          = "300s"
+    scaling {
+      min_instance_count = var.profile == "warm" ? 1 : 0
+      max_instance_count = var.max_instances
+    }
+    containers {
+      image = var.image_uri
+      ports { container_port = 8000 }
+      resources {
+        limits            = { cpu = "2", memory = "2Gi" }
+        cpu_idle          = true
+        startup_cpu_boost = true
+      }
+      env {
+        name  = "DOCUMENT_OCR_KYC_LANGS"
+        value = var.languages
+      }
+      dynamic "env" {
+        for_each = var.api_token_secret == null ? [] : [var.api_token_secret]
+        content {
+          name = "API_TOKEN"
+          value_source {
+            secret_key_ref {
+              secret  = env.value
+              version = var.api_token_version
+            }
+          }
+        }
+      }
+      startup_probe {
+        period_seconds    = 5
+        failure_threshold = 30
+        timeout_seconds   = 3
+        http_get {
+          path = "/ready"
+          port = 8000
+        }
+      }
+      liveness_probe {
+        period_seconds  = 30
+        timeout_seconds = 3
+        http_get {
+          path = "/health"
+          port = 8000
+        }
+      }
+    }
+  }
+  depends_on = [google_project_service.apis, google_secret_manager_secret_iam_member.token]
+}
+# Authoritative only for run.invoker: explicitly excludes public invocation.
+resource "google_cloud_run_v2_service_iam_binding" "invokers" {
+  project  = var.project_id
+  location = var.region
+  name     = google_cloud_run_v2_service.ocr.name
+  role     = "roles/run.invoker"
+  members  = var.invoker_members
+}
+output "url" { value = google_cloud_run_v2_service.ocr.uri }
+output "runtime_service_account" { value = google_service_account.runtime.email }
+output "repository" { value = "${var.region}-docker.pkg.dev/${var.project_id}/${google_artifact_registry_repository.images.repository_id}" }

package/hosting/infra/cloudrun/terraform.tfvars.example

@@ -0,0 +1,7 @@
+project_id = "your-project"
+region = "asia-south1"
+image_uri = "asia-south1-docker.pkg.dev/your-project/your-existing-repo/document-ocr@sha256:REPLACE"
+invoker_members = ["serviceAccount:caller@your-project.iam.gserviceaccount.com"]
+# api_token_secret = "document-ocr-api-token"
+languages = "en"
+profile = "economy"

package/hosting/infra/cloudrun/variables.tf

@@ -0,0 +1,55 @@
+variable "project_id" { type = string }
+variable "region" {
+  type    = string
+  default = "asia-south1"
+}
+variable "name" {
+  type    = string
+  default = "document-ocr"
+}
+variable "image_uri" {
+  type        = string
+  description = "Prebuilt OCR image URI, preferably pinned with @sha256. Build outside Terraform."
+}
+variable "languages" {
+  type    = string
+  default = "en"
+}
+variable "profile" {
+  type    = string
+  default = "economy"
+  validation {
+    condition     = contains(["economy", "warm"], var.profile)
+    error_message = "profile must be economy or warm."
+  }
+}
+variable "max_instances" {
+  type    = number
+  default = 10
+  validation {
+    condition     = var.max_instances >= 1 && floor(var.max_instances) == var.max_instances
+    error_message = "max_instances must be a positive integer."
+  }
+}
+variable "invoker_members" {
+  type        = set(string)
+  description = "Named IAM principals such as serviceAccount:caller@project.iam.gserviceaccount.com."
+  default     = []
+  validation {
+    condition     = alltrue([for member in var.invoker_members : !contains(["allUsers", "allAuthenticatedUsers"], member)])
+    error_message = "Public IAM principals are not supported."
+  }
+}
+variable "api_token_secret" {
+  type        = string
+  default     = null
+  description = "Existing Secret Manager secret ID; secret contents never enter Terraform state."
+}
+variable "api_token_version" {
+  type    = string
+  default = "latest"
+}
+variable "deletion_protection" {
+  type    = bool
+  default = true
+}

package/hosting/infra/lambda/main.tf

@@ -0,0 +1,63 @@
+terraform {
+  required_version = ">= 1.5.0"
+  required_providers {
+    aws = { source = "hashicorp/aws", version = "~> 6.0" }
+  }
+}
+provider "aws" { region = var.region }
+data "aws_partition" "current" {}
+resource "aws_ecr_repository" "images" {
+  name                 = var.name
+  image_tag_mutability = "IMMUTABLE"
+  image_scanning_configuration { scan_on_push = true }
+}
+resource "aws_iam_role" "runtime" {
+  name = "${var.name}-runtime"
+  assume_role_policy = jsonencode({
+    Version   = "2012-10-17"
+    Statement = [{ Effect = "Allow", Principal = { Service = "lambda.amazonaws.com" }, Action = "sts:AssumeRole" }]
+  })
+}
+resource "aws_iam_role_policy_attachment" "logs" {
+  role       = aws_iam_role.runtime.name
+  policy_arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+}
+resource "aws_iam_role_policy" "input" {
+  count = var.input_bucket == null ? 0 : 1
+  name  = "read-ocr-input-prefix"
+  role  = aws_iam_role.runtime.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect   = "Allow"
+      Action   = ["s3:GetObject"]
+      Resource = "arn:${data.aws_partition.current.partition}:s3:::${var.input_bucket}/${var.input_prefix}*"
+    }]
+  })
+}
+resource "aws_cloudwatch_log_group" "ocr" {
+  name              = "/aws/lambda/${var.name}"
+  retention_in_days = 14
+}
+resource "aws_lambda_function" "ocr" {
+  function_name                  = var.name
+  role                           = aws_iam_role.runtime.arn
+  package_type                   = "Image"
+  image_uri                      = var.image_uri
+  architectures                  = ["x86_64"]
+  memory_size                    = 2048
+  timeout                        = 120
+  reserved_concurrent_executions = var.max_concurrency
+  environment {
+    variables = {
+      DOCUMENT_OCR_KYC_LANGS = var.languages
+      DOCUMENT_OCR_S3_BUCKET = var.input_bucket == null ? "" : var.input_bucket
+      DOCUMENT_OCR_S3_PREFIX = var.input_prefix
+    }
+  }
+  depends_on = [aws_cloudwatch_log_group.ocr, aws_iam_role_policy_attachment.logs, aws_iam_role_policy.input]
+}
+# No function URL/API Gateway is created; callers use IAM-authorized InvokeFunction.
+output "function_name" { value = aws_lambda_function.ocr.function_name }
+output "function_arn" { value = aws_lambda_function.ocr.arn }
+output "repository_url" { value = aws_ecr_repository.images.repository_url }

package/hosting/infra/lambda/terraform.tfvars.example

@@ -0,0 +1,6 @@
+region = "ap-south-1"
+image_uri = "123456789012.dkr.ecr.ap-south-1.amazonaws.com/existing-repo@sha256:REPLACE"
+languages = "en"
+# input_bucket = "your-private-documents"
+input_prefix = "uploads/"
+max_concurrency = 10

package/hosting/infra/lambda/variables.tf

@@ -0,0 +1,37 @@
+variable "name" {
+  type    = string
+  default = "document-ocr"
+}
+variable "region" {
+  type    = string
+  default = "ap-south-1"
+}
+variable "image_uri" {
+  type        = string
+  description = "Prebuilt Lambda-compatible image in ECR in this region, preferably pinned by digest."
+}
+variable "languages" {
+  type    = string
+  default = "en"
+}
+variable "input_bucket" {
+  type        = string
+  default     = null
+  description = "Existing input bucket. Only GetObject on input_prefix is granted; no uploads/deletes/listing."
+}
+variable "input_prefix" {
+  type    = string
+  default = "uploads/"
+  validation {
+    condition     = can(regex("^[A-Za-z0-9._/-]+/$", var.input_prefix)) && !strcontains(var.input_prefix, "..")
+    error_message = "Use a nonempty relative prefix ending in / without wildcards or .. segments."
+  }
+}
+variable "max_concurrency" {
+  type    = number
+  default = 10
+  validation {
+    condition     = var.max_concurrency >= 1 && floor(var.max_concurrency) == var.max_concurrency
+    error_message = "max_concurrency must be a positive integer."
+  }
+}

package/hosting/pyproject.toml

@@ -0,0 +1,65 @@
+[project]
+name = "india-document-ocr"
+version = "3.1.2"
+description = "Local OCR for passports, Indian KYC and US documents, with evidence, review tools, and portable workers"
+requires-python = ">=3.14"
+license = { file = "LICENSE" }
+readme = "README.md"
+authors = [
+    { name = "Piyush Gambhir" },
+]
+keywords = ["ocr", "passport", "aadhaar", "pan", "kyc", "nrega", "npr", "rapidocr"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.14",
+    "Topic :: Scientific/Engineering :: Image Processing",
+]
+dependencies = [
+    "rapidocr>=3.0.0",
+    "onnxruntime>=1.17,<2",
+    "opencv-python>=4.8,<5",
+    "pillow>=12.3,<13",
+    "numpy>=1.24,<3",
+    "rapidfuzz>=3.0,<4",
+    "fastapi>=0.135.1,<1",
+    "starlette>=1.3.1,<2",
+    "uvicorn[standard]>=0.27,<1",
+    "click>=8.3.3,<9",
+    "python-multipart>=0.0.31,<1",
+    "requests>=2.33,<3",
+    "idna>=3.15,<4",
+    "urllib3>=2.7,<3",
+    "pypdfium2>=5.0,<6",
+    "pillow-heif>=1.3,<2",
+    "zxing-cpp>=3.1.1,<4",
+    "pycountry>=26.2.16,<27",
+    "cryptography>=50.0.1,<51",
+]
+
+[project.urls]
+Homepage = "https://github.com/piyush-gambhir/document-ocr"
+Repository = "https://github.com/piyush-gambhir/document-ocr"
+Issues = "https://github.com/piyush-gambhir/document-ocr/issues"
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=9.0.3,<10",
+    "pytest-asyncio>=1.0,<2",
+    "pytest-cov>=7.0,<8",
+    "pygments>=2.20,<3",
+    "httpx>=0.27,<1",
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["core"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests/python"]
+pythonpath = ["."]
+asyncio_mode = "auto"