aeat.adapters.inbound.sanitizer._determinism module¶

Byte-stable save flags for adapters.inbound.sanitizer.

The default pikepdf.Pdf.save() invocation is non-deterministic: the trailer /ID array is timestamp-seeded, recompress_flate re-runs zlib at the system default level, and object_stream_mode= generate shuffles object insertion order. This module wraps Pdf.save with a named flag set so the same input bytes round-trip to the same output bytes across runs and processes.

The flags live as a DeterminismFlags instance returned by save_with_deterministic_flags() and embedded in every SanitizationResult so callers can audit which save shape produced a given fixture.

deterministic_save_flags()[source]¶

Return the canonical flag set used by save_with_deterministic_flags().

Exposed as a module-level helper so tests and audit reports can assert the exact flags without re-instantiating DeterminismFlags from a literal — drift between the record and the actual save call would defeat the determinism contract.

Return type:: DeterminismFlags
Returns:: The single DeterminismFlags instance applied during save_with_deterministic_flags().

save_with_deterministic_flags(pdf)[source]¶

Serialise pdf to bytes with the deterministic save flag set.

Parameters:: pdf (Pdf) – An open pikepdf.Pdf instance ready to be saved. The caller retains ownership; this function does not close pdf.
Return type:: tuple[bytes, DeterminismFlags]
Returns:: A 2-tuple of (output_bytes, flags_applied). The bytes are byte-stable across repeated invocations on equivalent inputs; the DeterminismFlags record matches the canonical set.