aeat.adapters.inbound.sanitizer._streams module

Content-stream rewrite for adapters.inbound.sanitizer.

Walks every text-show operator on every page of a PDF and rewrites the operand text in place against a TokenMap. Pikepdf’s pikepdf.parse_content_stream() abstracts the literal-vs-hex distinction at parse time — both forms surface as pikepdf.String instances whose bytes() and str() yield the decoded payload. pikepdf.unparse_content_stream() emits literal form on round-trip; that is acceptable for the sanitiser because layout cues (Tm, Td, fonts, colours) are preserved by-reference and only the string content is rewritten.

Five text-show operators are handled (PDF 32000-2 §9.4.3):

  • Tj — show one string.

  • TJ — show an array of strings + kerning numbers.

  • ' — move to next line and show a string.

  • " — set spacing then show a string.

Each replacement is recorded as one Replacement row in the result tuple so the audit log identifies every edit by surface, page index, instruction index, and SHA-256 of the cleartext.

This module only rewrites exact cleartext tokens supplied by the operator. It does not discover missing PII; adversarial fixture tests and review of the TokenMap remain the leak-detection boundary.

apply_token_map_to_pdf(pdf, mapping)[source]

Rewrites every text-show operand in pdf against mapping.

Parameters:

  • pdf (Pdf) – An open pikepdf.Pdf whose content streams should be rewritten in place.

  • mapping (TokenMap) – The declarative cleartext-to-synthetic mapping.

Return type:

tuple[Replacement, ...]

Returns:

A tuple of Replacement rows recording every edit applied. Empty when the mapping was empty or no operand contained any cleartext value; callers should use fixture verification gates to decide whether an empty result is acceptable.