@privacyscrubber/sdk 2.0.2

package/index.js

@@ -0,0 +1,581 @@
+/**
+ * PrivacyScrubber Developer SDK (@privacyscrubber/sdk)
+ * Zero-Trust Data Sanitization & PII Redaction Engine.
+ * 
+ * 100% Client-Side / Server-Side in-memory execution.
+ * Zero telemetry network requests. Zero data leakage.
+ * 
+ * https://privacyscrubber.com
+ */
+
+import { createRequire } from 'module';
+const require = createRequire(import.meta.url);
+
+import './polyfill.js';
+import './ps-license-manager.js';
+
+// Access LicenseManager from global scope
+const LicenseManager = (typeof globalThis !== 'undefined' && globalThis.LicenseManager)
+    || (typeof global !== 'undefined' && global.LicenseManager)
+    || (typeof window !== 'undefined' && window.LicenseManager);
+
+// Synchronously load the production CJS core engine
+require('./scrubber-core.cjs');
+const scrubberPkg = (typeof globalThis !== 'undefined' && globalThis.PrivacyScrubberCore) 
+    || (typeof global !== 'undefined' && global.PrivacyScrubberCore)
+    || (typeof window !== 'undefined' && window.PrivacyScrubberCore);
+
+if (scrubberPkg && typeof scrubberPkg.init === 'function') {
+    scrubberPkg.init();
+}
+
+/**
+ * Built-in patterns for DevOps & Cloud Secrets detection.
+ */
+export const DEVOPS_SECRETS_DETECTOR = [
+    { name: 'AWS Credentials', regex: /\b(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA)[A-Z0-9]{16}\b/g, label: 'AWS_KEY' },
+    { name: 'JSON Web Token (JWT)', regex: /\beyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/g, label: 'JWT_TOKEN' },
+    { name: 'API Token/Key (GitHub/Slack/NPM)', regex: /\b(?:ghp|gho|ghu|ghs|ghr|glpat|npm|xox[baprs])[-_][A-Za-z0-9_]{10,}\b/g, label: 'API_TOKEN' },
+    { name: 'Stripe API Key', regex: /\b(?:[rs]k)_(?:test|live)_[a-zA-Z0-9]{24,}\b/g, label: 'STRIPE_KEY' },
+    { name: 'OpenAI Project API Key', regex: /\b(?:sk|pk)-(?:proj-)?[a-zA-Z0-9_-]{16,}\b/gi, label: 'OPENAI_KEY' },
+    { name: 'Database Connection URI', regex: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp|mssql):\/\/[^\s"']+/gi, label: 'DB_URI' },
+    { name: 'Database/API Secret', regex: /\b(DB|POSTGRES|REDIS|MYSQL|AWS|SECRET|PASSWORD|TOKEN|API|KEY)[A-Z0-9_]*\s*[:=]\s*[^ \t\r\n"']{8,}\b/gi, label: 'SECRET' }
+];
+
+/**
+ * Custom Error thrown when Free Tier limits are exceeded.
+ */
+export class PrivacyScrubberLicenseError extends Error {
+    constructor(message, { tier = 'FREE', currentLength = 0, limit = 15000, profile = 'General' } = {}) {
+        super(message);
+        this.name = 'PrivacyScrubberLicenseError';
+        this.tier = tier;
+        this.currentLength = currentLength;
+        this.limit = limit;
+        this.profile = profile;
+        this.upgradeUrl = 'https://privacyscrubber.com/pricing?utm_source=npm_sdk&utm_medium=sdk_error&utm_campaign=dev_upsell';
+    }
+}
+
+/**
+ * Validates a PrivacyScrubber license key (RS256 JWT or Cryptographic Checksum).
+ * @param {string} key - License key string.
+ * @returns {{ valid: boolean, tier: 'PRO'|'TEAMS'|null, expires: number|null, error: string|null }}
+ */
+export function validateLicense(key) {
+    if (!key || typeof key !== 'string') {
+        return { valid: false, tier: null, expires: null, error: 'No license key provided.' };
+    }
+    const cleanKey = key.trim();
+    if (!LicenseManager || typeof LicenseManager.validate !== 'function') {
+        return { valid: false, tier: null, expires: null, error: 'License manager engine unavailable.' };
+    }
+    const result = LicenseManager.validate(cleanKey);
+    return {
+        valid: !!result.valid,
+        tier: result.valid ? (result.tier || 'PRO') : null,
+        expires: result.expires || null,
+        error: result.valid ? null : (result.reason || 'Invalid license key.')
+    };
+}
+
+/**
+ * Legacy validator helper returning active tier or null.
+ * @param {string} key 
+ * @returns {'PRO'|'TEAMS'|null}
+ */
+export function validateLicenseKey(key) {
+    const res = validateLicense(key);
+    return res.valid ? res.tier : null;
+}
+
+/**
+ * Builds CISO-grade compliance audit telemetry from masked tokens.
+ * @param {Record<string, string>|string[]} currentTokenMap 
+ * @returns {object}
+ */
+export function buildAuditTelemetry(currentTokenMap = {}) {
+    const entities = {};
+    let totalCount = 0;
+
+    if (currentTokenMap && typeof currentTokenMap === 'object') {
+        const keys = Array.isArray(currentTokenMap) ? currentTokenMap : Object.keys(currentTokenMap);
+        for (const t of keys) {
+            const tokenStr = typeof t === 'string' ? t : (t.token || t.mask || '');
+            const match = tokenStr.match(/\[([A-Z_]+)_\d+\]/);
+            const baseType = match ? match[1] : (tokenStr.replace(/\[|\]/g, '').replace(/_[0-9]+$/, '') || 'CUSTOM');
+            entities[baseType] = (entities[baseType] || 0) + 1;
+            totalCount++;
+        }
+    }
+
+    const types = Object.keys(entities);
+    let riskLevel = 'LOW EXPOSURE';
+
+    if (totalCount > 0) {
+        const hasHighRisk = types.some(t => ['ID', 'SSN', 'CREDIT_CARD', 'PASSPORT', 'BANK', 'API_KEY', 'SECRET', 'PASSWORD', 'MRN', 'KEY', 'AWS_KEY', 'STRIPE_KEY', 'JWT_TOKEN', 'API_TOKEN'].includes(t));
+        if (hasHighRisk || types.length >= 3 || totalCount >= 10) {
+            riskLevel = 'CRITICAL (HIGH EXPOSURE)';
+        } else if (types.length >= 2 || totalCount >= 3) {
+            riskLevel = 'MODERATE EXPOSURE';
+        } else {
+            riskLevel = 'LOW EXPOSURE';
+        }
+    } else {
+        riskLevel = 'CLEAN (ZERO PII)';
+    }
+
+    const frameworksSet = new Set(['ZTDS Standard']);
+    if (types.includes('NAME') || types.includes('EMAIL') || types.includes('PHONE')) {
+        frameworksSet.add('GDPR (Art. 4)');
+        frameworksSet.add('CCPA/CPRA');
+    }
+    if (types.includes('ID') || types.includes('SSN') || types.includes('PASSPORT')) {
+        frameworksSet.add('SOC 2 Type II');
+        frameworksSet.add('ISO 27001 (A.8.11)');
+    }
+    if (types.some(t => ['CREDIT_CARD', 'BANK', 'IBAN', 'FINANCIAL', 'CARD', 'STRIPE_KEY'].includes(t))) {
+        frameworksSet.add('PCI DSS v4.0');
+    }
+    if (types.some(t => ['MRN', 'HEALTH', 'MEDICAL', 'PATIENT'].includes(t))) {
+        frameworksSet.add('HIPAA §164.514');
+    }
+    if (types.some(t => ['API_KEY', 'SECRET', 'PASSWORD', 'TOKEN', 'KEY', 'AWS_KEY', 'JWT_TOKEN', 'API_TOKEN'].includes(t))) {
+        frameworksSet.add('NIST SP 800-53');
+    }
+
+    return {
+        totalCount,
+        entities,
+        types,
+        riskLevel,
+        frameworksList: Array.from(frameworksSet)
+    };
+}
+
+/**
+ * Formats structured audit telemetry into a human-readable Markdown Audit Receipt.
+ * @param {object} telemetry 
+ * @returns {string}
+ */
+export function formatAuditReceipt(telemetry) {
+    if (!telemetry || telemetry.totalCount === 0) {
+        return "> 🛡️ **PrivacyScrubber Audit Receipt**: CLEAN (ZERO PII DETECTED)\n";
+    }
+    const entitiesList = Object.entries(telemetry.entities)
+        .map(([type, count]) => `${count} ${type}`)
+        .join(', ');
+
+    const icon = telemetry.riskLevel.includes('CRITICAL') ? '🔴' : (telemetry.riskLevel.includes('MODERATE') ? '🟠' : '🟢');
+
+    return `> 🛡️ **PrivacyScrubber Audit Receipt**\n` +
+           `> * **Risk Level:** ${icon} ${telemetry.riskLevel}\n` +
+           `> * **Compliance Enforced:** ${telemetry.frameworksList.join(', ')}\n` +
+           `> * **Tokens Masked:** ${telemetry.totalCount} (${entitiesList})\n`;
+}
+
+/**
+ * Primary High-Level Function: Sanitize / Scrub text of PII and secrets.
+ * 
+ * @param {string} text - Raw input text containing potential PII/secrets.
+ * @param {object} [options={}] - Configuration options.
+ * @param {string} [options.profile='General'] - PII Profile (General, Dev, Medical, Financial, Legal, HR, etc.).
+ * @param {string} [options.licenseKey] - Optional license key. Falls back to process.env.PRIVACYSCRUBBER_KEY.
+ * @param {Array} [options.customRules=[]] - Custom regex rules array.
+ * @param {Record<string, string>} [options.tokenLabelMap={}] - Custom label overrides.
+ * @param {Record<string, string>} [options.existingSessionMap={}] - Session map to maintain consistency across turns.
+ * @param {boolean} [options.generateReceipt=true] - Whether to generate Markdown audit receipt.
+ * @param {boolean} [options.throwOnLimit=true] - Throw PrivacyScrubberLicenseError when free tier limit is hit.
+ * @param {boolean} [options.detectSecrets=false] - Auto-inject DevOps & Cloud secrets detection rules.
+ * @returns {{
+ *   scrubbedText: string,
+ *   tokenMap: Record<string, string>,
+ *   count: number,
+ *   executionMs: number,
+ *   license: { isPro: boolean, tier: 'PRO'|'TEAMS'|'FREE', limit: number, upgradeUrl?: string },
+ *   telemetry: object,
+ *   auditReceipt: string
+ * }}
+ */
+export function sanitize(text, options = {}) {
+    if (!text || typeof text !== 'string') {
+        return {
+            scrubbedText: '',
+            tokenMap: {},
+            count: 0,
+            executionMs: 0,
+            license: { isPro: false, tier: 'FREE', limit: 15000 },
+            telemetry: buildAuditTelemetry({}),
+            auditReceipt: formatAuditReceipt(buildAuditTelemetry({}))
+        };
+    }
+
+    const {
+        profile = 'General',
+        licenseKey = (typeof process !== 'undefined' && process.env?.PRIVACYSCRUBBER_KEY) || '',
+        customRules = [],
+        tokenLabelMap = {},
+        existingSessionMap = {},
+        generateReceipt = true,
+        throwOnLimit = true,
+        detectSecrets = false,
+        ignoreList = null
+    } = options;
+
+    const licenseCheck = validateLicense(licenseKey);
+    const isPro = licenseCheck.valid;
+    const tier = isPro ? licenseCheck.tier : 'FREE';
+
+    const isSpecialized = profile && profile.toLowerCase() !== 'general';
+    const limit = isPro ? Infinity : (isSpecialized ? 5000 : 15000);
+
+    if (!isPro && text.length > limit) {
+        const errorMsg = `[PrivacyScrubber] Free Tier character limit exceeded (${limit.toLocaleString()} chars for profile '${profile}', received ${text.length.toLocaleString()} chars). Upgrade to PRO, TEAMS, or Developer SDK for unlimited throughput: https://privacyscrubber.com/pricing?utm_source=npm_sdk&utm_medium=sdk_error&utm_campaign=dev_upsell`;
+        if (throwOnLimit) {
+            throw new PrivacyScrubberLicenseError(errorMsg, {
+                tier: 'FREE',
+                currentLength: text.length,
+                limit: limit,
+                profile: profile
+            });
+        }
+    }
+
+    // Auto-inject DevOps Secrets rules when in Dev profile or when detectSecrets is requested
+    const activeRules = [...customRules];
+    if (profile.toLowerCase() === 'dev' || detectSecrets === true) {
+        DEVOPS_SECRETS_DETECTOR.forEach(rule => {
+            activeRules.push({
+                name: rule.name,
+                pattern: rule.regex.source,
+                regex: new RegExp(rule.regex.source, rule.regex.flags),
+                label: rule.label || 'SECRET'
+            });
+        });
+    }
+
+    const startTime = (typeof performance !== 'undefined' && typeof performance.now === 'function') 
+        ? performance.now() 
+        : Date.now();
+
+    const textToScrub = (!isPro && text.length > limit) ? text.slice(0, limit) : text;
+
+    const rawResult = scrubberPkg.scrubText(
+        textToScrub,
+        activeRules,
+        tokenLabelMap,
+        profile,
+        existingSessionMap,
+        isPro,
+        ignoreList
+    );
+
+    const endTime = (typeof performance !== 'undefined' && typeof performance.now === 'function') 
+        ? performance.now() 
+        : Date.now();
+
+    const executionMs = Math.round((endTime - startTime) * 100) / 100;
+    const telemetry = buildAuditTelemetry(rawResult.tokenMap || {});
+    const auditReceipt = generateReceipt ? formatAuditReceipt(telemetry) : '';
+
+    return {
+        scrubbedText: rawResult.scrubbedText,
+        tokenMap: rawResult.tokenMap || {},
+        count: rawResult.count || 0,
+        executionMs: executionMs,
+        license: {
+            isPro: isPro,
+            tier: tier,
+            limit: limit,
+            ...(!isPro && {
+                upgradeUrl: 'https://privacyscrubber.com/pricing?utm_source=npm_sdk&utm_medium=sdk_telemetry&utm_campaign=dev_upsell',
+                recommendation: 'Upgrade to PRO, TEAMS, or Developer SDK for unlimited text processing, custom regex rules, and specialized compliance profiles.'
+            })
+        },
+        telemetry: telemetry,
+        auditReceipt: auditReceipt
+    };
+}
+
+/**
+ * Alias for sanitize.
+ */
+export const scrub = sanitize;
+
+/**
+ * Primary High-Level Function: Restore / Unscrub AI response back to original entities in-memory.
+ * 
+ * @param {string} aiResponse - Text containing masked tokens (e.g. [EMAIL_1], [NAME_1]).
+ * @param {Record<string, string>} tokenMap - Volatile token map returned from sanitize().
+ * @returns {{ restoredText: string, restoredCount: number }}
+ */
+export function restore(aiResponse, tokenMap = {}) {
+    if (!aiResponse || typeof aiResponse !== 'string') {
+        return { restoredText: '', restoredCount: 0 };
+    }
+    const result = scrubberPkg.unscrubText(aiResponse, tokenMap);
+    return {
+        restoredText: result.restoredText,
+        restoredCount: result.restoredCount || 0
+    };
+}
+
+/**
+ * Alias for restore.
+ */
+export const unscrub = restore;
+
+/**
+ * Stateful PrivacyScrubber Engine class for backend servers & conversational pipelines.
+ */
+export class PrivacyScrubberEngine {
+    constructor(config = {}) {
+        this.licenseKey = config.licenseKey || config.apiKey || (typeof process !== 'undefined' && process.env?.PRIVACYSCRUBBER_KEY) || '';
+        this.defaultProfile = config.defaultProfile || config.profile || 'General';
+        this.customRules = config.customRules || [];
+        this.tokenLabelMap = config.tokenLabelMap || {};
+        this.generateReceipt = config.generateReceipt !== false;
+        this.sessionMap = { ...(config.initialSessionMap || {}) };
+        this.ignoreList = new Set(config.ignoreList || []);
+        
+        this.license = validateLicense(this.licenseKey);
+    }
+
+    /**
+     * Updates active license key.
+     * @param {string} key 
+     */
+    setLicenseKey(key) {
+        this.licenseKey = key;
+        this.license = validateLicense(this.licenseKey);
+        return this.license;
+    }
+
+    /**
+     * Sanitizes input text, maintaining stateful session memory if requested.
+     * @param {string} text 
+     * @param {object} [options={}] 
+     */
+    sanitize(text, options = {}) {
+        // Merge instance ignoreList with per-call ignoreList
+        const mergedIgnoreList = new Set(this.ignoreList);
+        if (options.ignoreList) {
+            (Array.isArray(options.ignoreList) ? options.ignoreList : [...options.ignoreList])
+                .forEach(v => mergedIgnoreList.add(v));
+        }
+
+        const mergedOptions = {
+            profile: options.profile || this.defaultProfile,
+            licenseKey: options.licenseKey || this.licenseKey,
+            customRules: [...this.customRules, ...(options.customRules || [])],
+            tokenLabelMap: { ...this.tokenLabelMap, ...(options.tokenLabelMap || {}) },
+            existingSessionMap: options.persistSession !== false ? this.sessionMap : (options.existingSessionMap || {}),
+            generateReceipt: options.generateReceipt !== undefined ? options.generateReceipt : this.generateReceipt,
+            throwOnLimit: options.throwOnLimit !== undefined ? options.throwOnLimit : true,
+            detectSecrets: options.detectSecrets !== undefined ? options.detectSecrets : false,
+            ignoreList: mergedIgnoreList.size > 0 ? mergedIgnoreList : null
+        };
+
+        const result = sanitize(text, mergedOptions);
+        if (options.persistSession !== false) {
+            Object.assign(this.sessionMap, result.tokenMap);
+        }
+        return result;
+    }
+
+    /**
+     * Restores AI response using the engine's internal session map or an explicit tokenMap.
+     * @param {string} aiResponse 
+     * @param {Record<string, string>} [tokenMap] 
+     */
+    restore(aiResponse, tokenMap = null) {
+        const activeMap = tokenMap || this.sessionMap;
+        return restore(aiResponse, activeMap);
+    }
+
+    /**
+     * Resets the persistent session token map.
+     */
+    resetSession() {
+        for (const key of Object.keys(this.sessionMap)) {
+            delete this.sessionMap[key];
+        }
+    }
+
+    /**
+     * Marks a token as a false positive. The original plaintext value will be
+     * excluded from all future sanitize() calls on this engine instance.
+     * @param {string} token - The token to mark (e.g., '[NAME_1]').
+     * @returns {{ success: boolean, token?: string, original?: string, ignoreListSize?: number, reason?: string }}
+     */
+    markFalsePositive(token) {
+        const original = this.sessionMap[token];
+        if (!original) {
+            return { success: false, reason: `Token '${token}' not found in session map` };
+        }
+        this.ignoreList.add(original);
+        delete this.sessionMap[token];
+        return { success: true, token, original, ignoreListSize: this.ignoreList.size };
+    }
+
+    /**
+     * Clears the false positive ignore list.
+     */
+    clearIgnoreList() {
+        this.ignoreList.clear();
+    }
+}
+
+/**
+ * Transparent Zero-Trust Wrapper for OpenAI Client.
+ * Automatically sanitizes outgoing messages before transmission to OpenAI,
+ * and restores completion tokens in the assistant response before returning!
+ * 
+ * @param {object} openaiClient - Instance of OpenAI SDK (e.g. new OpenAI()).
+ * @param {object} [options={}] - PrivacyScrubber configuration.
+ * @returns {object} Wrapped OpenAI client.
+ */
+export function wrapOpenAI(openaiClient, options = {}) {
+    if (!openaiClient || !openaiClient.chat || !openaiClient.chat.completions) {
+        throw new Error('[PrivacyScrubber] Invalid OpenAI client instance passed to wrapOpenAI.');
+    }
+
+    const engine = new PrivacyScrubberEngine(options);
+    const originalCreate = openaiClient.chat.completions.create.bind(openaiClient.chat.completions);
+
+    openaiClient.chat.completions.create = async function(params, requestOptions) {
+        if (!params || !Array.isArray(params.messages)) {
+            return originalCreate(params, requestOptions);
+        }
+
+        const sessionTokenMap = {};
+        const sanitizedMessages = params.messages.map(msg => {
+            if (typeof msg.content === 'string') {
+                const res = engine.sanitize(msg.content, { existingSessionMap: sessionTokenMap });
+                Object.assign(sessionTokenMap, res.tokenMap);
+                return { ...msg, content: res.scrubbedText };
+            }
+            return msg;
+        });
+
+        const modifiedParams = { ...params, messages: sanitizedMessages };
+        const response = await originalCreate(modifiedParams, requestOptions);
+
+        if (response && Array.isArray(response.choices)) {
+            response.choices.forEach(choice => {
+                if (choice.message && typeof choice.message.content === 'string') {
+                    choice.message.content = engine.restore(choice.message.content, sessionTokenMap).restoredText;
+                }
+            });
+        }
+
+        return response;
+    };
+
+    return openaiClient;
+}
+
+/**
+ * Framework middleware helper for LangChain / LlamaIndex pipelines.
+ */
+export function createLangChainTransform(options = {}) {
+    const engine = new PrivacyScrubberEngine(options);
+    return {
+        preprocess: (input) => engine.sanitize(input),
+        postprocess: (output, tokenMap) => engine.restore(output, tokenMap)
+    };
+}
+
+/**
+ * Generates an official Zero-Trust Compliance Audit Report.
+ * @param {Record<string, string>} sessionMap - Map of token bindings.
+ * @param {object} [options] - Options: companyName, department, format ('markdown'|'json'|'summary').
+ * @returns {object|string}
+ */
+export function generateAuditReport(sessionMap = {}, options = {}) {
+    const { companyName = 'PrivacyScrubber Client', department = 'SecOps / Compliance', format = 'markdown' } = options;
+    const telemetry = buildAuditTelemetry(sessionMap);
+    
+    let sessionHash = '';
+    try {
+        const cryptoMod = require('crypto');
+        sessionHash = cryptoMod.createHash('sha256').update(JSON.stringify(sessionMap) + Date.now().toString()).digest('hex');
+    } catch {
+        sessionHash = Array.from(crypto.getRandomValues(new Uint8Array(16))).map(b => b.toString(16).padStart(2, '0')).join('');
+    }
+
+    const timestamp = new Date().toISOString();
+    const entitySummary = Object.entries(telemetry.entities).map(([t, count]) => `[${t}]: ${count}`).join(', ') || 'None (Clean)';
+
+    if (format === 'json') {
+        return {
+            protocol: "Zero-Trust Data Sanitization (ZTDS)",
+            certificateId: `ZTDS-CERT-${sessionHash.substring(0, 16).toUpperCase()}`,
+            organization: companyName,
+            department: department,
+            timestamp: timestamp,
+            sessionHash: sessionHash,
+            verificationMode: "100% Offline (In-Memory RAM)",
+            complianceStatus: "VERIFIED PASS",
+            riskLevel: telemetry.riskLevel,
+            frameworksEnforced: telemetry.frameworksList,
+            totalMaskedTokens: telemetry.totalCount,
+            entitiesBreakdown: telemetry.entities,
+            zeroEgressVerified: true,
+            verificationUrl: `https://privacyscrubber.com/features/audit-receipt/#verify?hash=${sessionHash.substring(0, 16)}`
+        };
+    }
+
+    if (format === 'summary') {
+        return `[PrivacyScrubber Compliance Certificate] ID: ZTDS-${sessionHash.substring(0, 8).toUpperCase()} | Organization: ${companyName} | Masked Tokens: ${telemetry.totalCount} | Risk: ${telemetry.riskLevel} | Frameworks: ${telemetry.frameworksList.join(', ')} | Status: PASS (100% Air-Gapped)`;
+    }
+
+    return `# 🛡️ Zero-Trust Data Sanitization Compliance Certificate
+**Certificate ID:** \`ZTDS-CERT-${sessionHash.substring(0, 16).toUpperCase()}\`  
+**Organization:** ${companyName} (${department})  
+**Timestamp:** ${timestamp}  
+**Verification Mode:** 100% Local In-Memory Processing (Air-Gapped)  
+**Status:** **VERIFIED PASS** (Zero Network Egress)
+
+---
+
+### 📊 Sanitization Metrics & Risk Assessment
+* **Overall Risk Rating:** **${telemetry.riskLevel}**
+* **Total Sensitive Entities Masked:** \`${telemetry.totalCount}\`
+* **Entity Breakdown:** ${entitySummary}
+* **Network Data Transmitted:** \`0.00 KB (Zero-Trust Local RAM)\`
+
+### 📜 Regulatory Frameworks Enforced
+${telemetry.frameworksList.map(f => `- **${f}**`).join('\n')}
+
+### 🔒 CISO Compliance Declaration
+1. **EU AI Act (Art. 50) & GDPR (Art. 25 & 32):** Data minimization and local pseudonymization enforced prior to model interaction.
+2. **HIPAA Safe Harbor (§164.514) / SOC 2 Type II:** All direct and indirect identifiers sanitized locally without cloud processor liability.
+3. **Cryptographic Verification:** Tamper-evident session verification hash: \`${sessionHash}\`
+
+*Certified Offline by PrivacyScrubber Core SDK*  
+*Verify at: https://privacyscrubber.com/features/audit-receipt/*`;
+}
+
+// Low-level backwards-compatible exports
+export const scrubText = scrubberPkg.scrubText;
+export const unscrubText = scrubberPkg.unscrubText;
+
+export default {
+    sanitize,
+    scrub,
+    restore,
+    unscrub,
+    validateLicense,
+    validateLicenseKey,
+    buildAuditTelemetry,
+    formatAuditReceipt,
+    generateAuditReport,
+    PrivacyScrubberEngine,
+    PrivacyScrubberLicenseError,
+    wrapOpenAI,
+    createLangChainTransform,
+    scrubText,
+    unscrubText,
+    DEVOPS_SECRETS_DETECTOR
+};

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@privacyscrubber/sdk",
+  "version": "2.0.2",
+  "description": "Zero-Trust Data Sanitization & PII Redaction Engine. 100% Client-Side / Server-Side in-memory execution. Zero external dependencies.",
+  "main": "index.js",
+  "types": "index.d.ts",
+  "type": "module",
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "index.js",
+    "index.d.ts",
+    "polyfill.js",
+    "ps-license-manager.js",
+    "ps-pii-engine.cjs",
+    "ps-pii-engine.js",
+    "scrubber-core.cjs",
+    "shared-ui.js",
+    "ui-modals.js",
+    "README.md"
+  ],
+  "scripts": {
+    "test": "node test-sdk.js"
+  },
+  "keywords": [
+    "privacy",
+    "pii",
+    "redaction",
+    "sanitization",
+    "security",
+    "zero-trust",
+    "compliance",
+    "hipaa",
+    "soc2",
+    "gdpr",
+    "llm-privacy",
+    "openai",
+    "langchain"
+  ],
+  "author": "Ilya Sibiryakov (BrandMeWeb)",
+  "license": "MIT",
+  "homepage": "https://privacyscrubber.com/?utm_source=npm&utm_medium=readme&utm_campaign=sdk",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/moxno/privacyscrubber-mcp.git"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}

package/polyfill.js

@@ -0,0 +1,33 @@
+import crypto from 'crypto';
+
+if (typeof global !== 'undefined') {
+    if (typeof global.window === 'undefined') {
+        global.window = {
+            crypto: {
+                getRandomValues: (arr) => crypto.randomFillSync(arr)
+            },
+            addEventListener: () => {},
+            location: { search: '', hash: '' }
+        };
+    }
+    if (typeof global.document === 'undefined') {
+        global.document = {
+            readyState: 'complete',
+            getElementById: () => null,
+            addEventListener: () => {}
+        };
+    }
+    if (typeof global.localStorage === 'undefined') {
+        global.localStorage = {
+            getItem: () => null,
+            setItem: () => {},
+            removeItem: () => {}
+        };
+    }
+    if (typeof global.atob === 'undefined') {
+        global.atob = (str) => Buffer.from(str, 'base64').toString('binary');
+    }
+    if (typeof global.btoa === 'undefined') {
+        global.btoa = (str) => Buffer.from(str, 'binary').toString('base64');
+    }
+}