Module convert 

The converter boundary and the plain text passthrough.

Every converter returns the same outcome shape. The registry in rules/converters.toml maps format ids to converters. A format no converter claims is unsupported, with a declared reason or the no-converter floor. A converter error or invalid output is a failure with a machine-readable reason and no text artifact. There is no silent skip and no silently empty file. A non-empty source that converts to empty text fails with reason empty_output in every converter.

In-process conversion runs under a panic boundary and explicit ceilings that apply before allocation in this crate’s own code: the source size before read, the decompressed size of every archive part and compound stream, the cell extent of every sheet before the workbook parser runs, and the rendered output size. A caught panic or an exceeded ceiling becomes one failed record and the run continues. The panic boundary requires the default panic = "unwind" profile. A downstream panic = "abort" build turns any converter panic into process death, so keep unwinding enabled wherever this crate converts untrusted bytes.

Re-exports

pub use container::CONTAINER_ZIP_ID;

pub use container::CONTAINER_ZIP_VERSION;

pub use container::ContainerLimits;

pub use container::Inflated;

pub use container::ZipContainer;

pub use container::preflight_entry_count;

pub use eml::EmlExpansion;

pub use eml::EmlMime;

pub use eml::expand_eml;

pub use html::HtmlStrip;

pub use subprocess::PdfSubprocess;

pub use subprocess::RecordsSubprocess;

Modules

container

Zip container expansion.

eml

MIME message to text conversion for eml.

html

Strip-to-text conversion for html.

image_metadata

The image-metadata derived-child leg: the textual metadata a raster carries, lifted out behind the subprocess jail and rendered as a hidden child beside the pixel-OCR artifact.

pdf

The PDF text-layer conversion, shared by the sandbox worker.

provider

The deployment-owned provider configuration: the opt-in surface that wires an external rasterizer into the svg leg.

subprocess

Subprocess adapters: converters that run behind the sandboxed runner instead of in this process.

Structs

AnydocDocument

The document adapter. See the module documentation.

AsrProfile

The speech-transcription jail limit profile and pinned runtime hashes, held as rules data beside the image-OCR profile so a deployment changes them only in a visible versioned bump. Every number is a containment ceiling measured for the pinned engine on the pinned machine class. The registry reads this into the audio converter, which maps it into the runner limits its jailed worker enforces and sends the decoded-duration ceiling into the jail.

ConvertError

A conversion failure with a machine-readable reason.

DiffMetrics

The two comparison metrics.

ImageMetadataLimits

The image-metadata parser ceilings, held as rules data beside the records ceilings so a deployment raises them in a visible versioned bump. The parent reads them from the registry and passes them into the jailed worker, which enforces them and fails a source over any ceiling with a stable image-metadata-* reason. The metadata worker runs behind the shared platform-default jail, so these are the parser-surface ceilings only, not the wall-clock and address-space envelope the runner already imposes.

ImageOcrLimits

The image-OCR jail limit profile, held as rules data beside the records ceilings so a deployment raises it in a visible versioned bump. The default runner limits are tuned for the pure-Rust document worker; the pinned vision runtime maps a far larger working set, so the image-OCR converter carries its own envelope. The registry reads this into the converter, which maps it into the runner limits its jailed worker enforces.

IndexRange

An inclusive range of 0-based row or column indexes.

Outcome

What every converter returns on success.

PlainTextPassthrough

Passthrough for text-native formats.

RecordsLimits

Ceilings for the records worker, held as rules data beside the container limits so a deployment raises them in a visible versioned bump. The parent reads them from the registry and passes them into the jailed worker, which enforces them and fails a source over any ceiling with reason record-limit-exceeded.

Registry

The converter registry from rules/converters.toml.

RuntimeInventory

Deployment-side mapping from a pinned runtime role label to the file that fills it. Paths are deployment data and never enter the versioned rules: the expected hashes live in the rules, and the jailed worker re-hashes every supplied file against them immediately before use, so a swap after parent-side validation still fails closed. Roles are validated against the known label set, so a typo fails loudly instead of silently leaving a role unfilled.

SheetVisibility

Hidden rows and columns of one sheet, as index ranges.

WorkbookIr

The workbook converter. See the module documentation.

WorkbookVisibility

Hidden rows and columns per resolved sheet name.

Enums

DiffVerdict

The comparison verdict.

DifferentialOutcome

What a full differential check concluded.

Constants

AUDIO_ASR_NOT_BUILT_REASON

The reason audio formats record on a build without the audio-asr feature. The converter exists and the rules route to it, but this binary has no in-jail decode-plus-transcribe path, so the formats are a deliberate capability gap rather than a converter error. The checkpoint key includes rules_version, so a later feature-carrying build reconverts every such record.

ENGINE_UNPINNED_REASON

The reason a media format records when its adapter’s engine has no pinned identity for the running platform. Declared entries in the rules use the same string; the registry also applies it at construction to the audio formats on any platform outside the pinned machine class, because an engine pin is per machine class and a second class needs its own measured pin before the route opens there.

IMAGE_OCR_DECODE_ALLOC

Decode-time allocation guard: one layer of a layered containment, not a single invariant. Three independent limits bound this path. The parent’s source-bytes ceiling bounds the bytes that stage into the jail; this guard bounds the decoder’s working pixel buffers; and the area cap bounds the encoder input. This guard’s job is only the middle layer: it caps the decoder against a decompression bomb whose declared dimensions the area preflight has not yet seen. The largest in-scope raster is the area cap at 4 bytes per pixel, about 9 MiB, so this value leaves room for the decoded buffer plus codec scratch while refusing a bomb demanding hundreds of megabytes. It is not the jail’s address-space limit and not the area cap; each of the three fails closed on its own.

IMAGE_OCR_MAX_AREA_PX

The ruled encoder-input area cap: 1536 * 1536 = 2.36 MP, the validated-safe ceiling. Applied uniformly to every image fed to the engine, because the hazard is encoder-side and degenerates on oversized area, not on any single dimension.

IMAGE_OCR_NOT_BUILT_REASON

The reason raster-image formats record on a build without the image-ocr feature, or on a platform with no jail backend. The converter exists and the rules route to it, but this binary has no in-jail decode-plus-recognize path, so the format is a deliberate capability gap rather than a converter error. The checkpoint key includes rules_version, so a later feature-carrying build reconverts every such record.

IMAGE_OCR_VALIDATED_LONG_EDGE

The largest single edge the engine was validated against. An input under the area cap but with a longer edge is legal by area and must not fail; it logs one note for validation and proceeds.

MAX_OUTPUT_BYTES

Ceiling on rendered artifact text bytes.

MAX_PART_BYTES

Ceiling on the decompressed bytes of one archive part or one compound file stream.

MAX_SHEET_CELLS

Ceiling on the row-column product of one sheet, checked from the source’s own references before the workbook parser allocates.

MAX_SHEET_COLUMNS

Ceiling on 0-based column indexes in one sheet.

MAX_SHEET_ROWS

Ceiling on 0-based row indexes in one sheet.

MAX_SOURCE_BYTES

Ceiling on source bytes read for conversion, checked before read.

NO_CONVERTER_REASON

The floor reason for an unsupported record whose detected format has no converter entry and no declared reason, including true unknowns.

PASSTHROUGH_ID

Registry id of the passthrough converter.

PASSTHROUGH_VERSION

Version of the passthrough converter.

RECORDS_NOT_BUILT_REASON

The reason a records format records on a build without the records-worker feature. The converter exists and the rules route to it, but this binary’s worker has no records mode, so the format is a deliberate capability gap rather than a converter error.

SVG_PROVIDER_NOT_BUILT

The warning an svg record carries when a deployment configured the external provider but this binary was built without the svg-provider feature. The configuration is valid and the operator asked for the leg, so the record says the leg did not run rather than looking like a provider-free run. A later build that carries the feature is not allowed to skip such a record as unchanged, so the child is minted on the first build that can produce it.

Traits

Converter

A converter takes one source’s bytes and returns text or a reason.

Functions

compare_texts

Compares two already-normalized texts and returns the metrics and the verdict per the thresholds.

markdown_to_plain

Renders Markdown to plain text through a real parser.

normalize_for_diff

Normalizes text for comparison: NFC, every whitespace run collapsed to one space, trimmed. No case folding.

normalize_text

Normalizes text to the output contract.

read_visibility

Reads row and column visibility for a workbook format.