@privacyscrubber/sdk 2.2.0 → 2.2.2

package/README.md

@@ -6,6 +6,8 @@
 [![Air-Gapped](https://img.shields.io/badge/network_calls-0-blueviolet.svg)](https://privacyscrubber.com)
 [![TypeScript Typings](https://img.shields.io/badge/types-TypeScript-blue.svg)](https://www.npmjs.com/package/@privacyscrubber/sdk)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+[![Patent Pending](https://img.shields.io/badge/Patent-Pending%20(ILPO%20331905)-06b6d4.svg)](https://privacyscrubber.com/patents/)
+[![GitHub Stars](https://img.shields.io/github/stars/moxno/privacyscrubber-mcp?style=social)](https://github.com/moxno/privacyscrubber-mcp)
 
 > **Zero-Trust Data Sanitization (ZTDS) & PII Redaction Engine**  
 > 100% In-Memory Execution. Zero Remote Network Calls. Zero Disk Writes. Sub-millisecond Latency.
@@ -26,7 +28,7 @@ The official Node.js / TypeScript programmatic SDK for [PrivacyScrubber.com](htt
 | **DevOps Secrets Scanning** | **Built-in (AWS, JWT, DBs)** | Custom regex rules | Custom detectors | Custom classifiers |
 | **Cost Predictability** | **Free Tier / Flat $199/mo** | DevOps server maintenance | Pay-per-GB cloud fees | Pay-per-unit API fees |
 
-> 📊 **Full Technical Benchmark**: Read the in-depth latency analysis, cold-start profiles, and architecture deep-dive in [docs/benchmarks/sdk-vs-presidio.md](https://github.com/moxno/PrivacyScrubber/blob/main/docs/benchmarks/sdk-vs-presidio.md).
+> 📊 **Full Technical Benchmark**: Read the in-depth latency analysis, cold-start profiles, and architecture deep-dive in [docs/benchmarks/sdk-vs-presidio.md](https://github.com/moxno/privacyscrubber-mcp/blob/main/docs/benchmarks/sdk-vs-presidio.md).
 
 ### 💡 The Breach Math vs SDK Math
 
@@ -92,6 +94,7 @@ console.log(auditReceipt);
 // > * **Risk Level:** 🟡 MODERATE EXPOSURE
 // > * **Compliance Enforced:** ZTDS Standard, GDPR (Art. 4), CCPA/CPRA
 // > * **Tokens Masked:** 2 (1 NAME, 1 PHONE)
+// > * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **SDK & Enterprise:** [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing)
 
 // 2. Deterministically restore LLM response
 const aiResponse = "I have queued an SMS notification for [NAME_1] at [PHONE_1].";
@@ -103,7 +106,157 @@ console.log(restoredText);
 
 ---
 
-### 3. RAG & Vector Database Ingestion (Pinecone, Chroma, pgvector)
+### 3. Vercel AI SDK Integration (`generateText` & `streamText`)
+
+Drop-in sanitization for Next.js and Node.js applications built with the Vercel AI SDK (`ai`):
+
+```typescript
+import { generateText } from 'ai';
+import { openai } from '@ai-sdk/openai';
+import { sanitize, restore } from '@privacyscrubber/sdk';
+
+export async function POST(req: Request) {
+    const { prompt } = await req.json();
+
+    // 1. Sanitize user prompt in local RAM (<1ms)
+    const { scrubbedText, tokenMap } = sanitize(prompt, {
+        profile: 'General',
+        detectSecrets: true
+    });
+
+    // 2. Outbound call to LLM contains zero PII or credentials
+    const { text } = await generateText({
+        model: openai('gpt-4o'),
+        prompt: scrubbedText,
+    });
+
+    // 3. Deterministically restore authentic tokens locally
+    const { restoredText } = restore(text, tokenMap);
+
+    return Response.json({ response: restoredText });
+}
+```
+
+---
+
+### 3b. Real-Time LLM Streaming De-tokenization (`wrapAiStream`, `createStreamTokenRestorer`, `createNodeStreamTokenRestorer`)
+
+When LLMs stream responses via Server-Sent Events (SSE) or WebSockets, tokens can be split across arbitrary chunk boundaries (e.g. Chunk 1: `"Contact [EM"`, Chunk 2: `"AIL_1] at once"`). `StreamingDetokenizer` uses a zero-latency sliding window buffer to stitch and restore tokens on the fly without delaying stream output:
+
+```typescript
+import { streamText } from 'ai';
+import { openai } from '@ai-sdk/openai';
+import { sanitize, wrapAiStream } from '@privacyscrubber/sdk';
+
+export async function POST(req: Request) {
+    const { prompt } = await req.json();
+
+    // 1. Sanitize prompt in RAM
+    const { scrubbedText, tokenMap } = sanitize(prompt, { profile: 'General' });
+
+    // 2. Stream from LLM
+    const { textStream } = streamText({
+        model: openai('gpt-4o'),
+        prompt: scrubbedText,
+    });
+
+    // 3. Wrap stream — split tokens ([EM + AIL_1]) are rehydrated in real-time!
+    const restoredStream = wrapAiStream(textStream, tokenMap);
+
+    // 4. Return SSE stream to client with authentic values restored
+    return new Response(restoredStream);
+}
+```
+
+#### Transparent OpenAI Streaming (`wrapOpenAI` with `stream: true`):
+```typescript
+import OpenAI from 'openai';
+import { wrapOpenAI } from '@privacyscrubber/sdk';
+
+const client = wrapOpenAI(new OpenAI(), { profile: 'Dev' });
+
+const stream = await client.chat.completions.create({
+    model: 'gpt-4o',
+    messages: [{ role: 'user', content: 'Debug AWS_KEY=AKIAIOSFODNN7EXAMPLE for user alice@acme.com' }],
+    stream: true, // Transparent real-time chunk de-tokenization!
+});
+
+for await (const chunk of stream) {
+    process.stdout.write(chunk.choices[0]?.delta?.content || '');
+}
+```
+
+#### Node.js Pipeline Streaming (`createNodeStreamTokenRestorer`):
+```javascript
+import { pipeline } from 'node:stream/promises';
+import { createNodeStreamTokenRestorer } from '@privacyscrubber/sdk';
+
+const restorer = createNodeStreamTokenRestorer(tokenMap);
+await pipeline(readableLlmStream, restorer, clientResponseStream);
+```
+
+---
+
+### 4. LangChain (LCEL Pipelines & `createLangChainTransform`)
+
+Use the official middleware helper or compose inside LangChain Expression Language (LCEL) chains:
+
+```typescript
+import { ChatOpenAI } from '@langchain/openai';
+import { createLangChainTransform, PrivacyScrubberEngine } from '@privacyscrubber/sdk';
+
+// Option A: 1-line middleware helper
+const transform = createLangChainTransform({ defaultProfile: 'Healthcare' });
+const { scrubbedText, tokenMap } = transform.preprocess("Patient John Doe MRN-99120 prescribed Lipitor.");
+// ... invoke LLM with scrubbedText ...
+const restoredOutput = transform.postprocess(llmOutput, tokenMap);
+
+// Option B: Composable LCEL Runnable chain
+const engine = new PrivacyScrubberEngine({ defaultProfile: 'Dev' });
+const model = new ChatOpenAI({ model: 'gpt-4o', temperature: 0 });
+
+const secureChain = async (rawQuestion: string) => {
+    const { scrubbedText, tokenMap } = engine.sanitize(rawQuestion);
+    const response = await model.invoke(scrubbedText);
+    return engine.restore(response.content as string, tokenMap);
+};
+
+const result = await secureChain("Debug AWS_KEY=AKIAIOSFODNN7EXAMPLE for user alice@acme.com");
+```
+
+---
+
+### 5. LlamaIndex.TS (RAG Node Sanitizer)
+
+Prevent PII poisoning in vector stores by sanitizing documents prior to indexing:
+
+```typescript
+import { Document } from 'llamaindex';
+import { sanitize } from '@privacyscrubber/sdk';
+
+// Sanitize documents before vector index ingestion (HIPAA & GDPR safe)
+export function sanitizeDocumentsForIndex(docs: Document[]): Document[] {
+    return docs.map(doc => {
+        const { scrubbedText, telemetry } = sanitize(doc.text, {
+            profile: 'Healthcare', // Masks 18 HIPAA identifiers
+            detectSecrets: true
+        });
+        
+        return new Document({
+            text: scrubbedText,
+            metadata: {
+                ...doc.metadata,
+                psRiskLevel: telemetry.riskLevel,
+                psCompliant: telemetry.frameworksList.join(',')
+            }
+        });
+    });
+}
+```
+
+---
+
+### 6. RAG & Vector Database Ingestion (Pinecone, Chroma, pgvector)
 
 Storing raw PII inside vector embeddings is irreversible and violates GDPR Article 17 (Right to be Forgotten). Sanitize document chunks prior to vectorization:
 
@@ -127,7 +280,7 @@ function prepareVectorChunk(rawDocumentChunk) {
 
 ---
 
-### 4. Stateful Multi-Turn Agent Engine (`PrivacyScrubberEngine`)
+### 7. Stateful Multi-Turn Agent Engine (`PrivacyScrubberEngine`)
 
 Maintain token bindings across multi-step autonomous agent loops (LangChain, AutoGen, CrewAI):
 
@@ -149,7 +302,7 @@ const restored = engine.restore(agentOutputText);
 
 ---
 
-### 5. High-Throughput Stream Sanitization (`createSanitizeStream`)
+### 8. High-Throughput Stream Sanitization (`createSanitizeStream`)
 
 Sanitize massive log files, database dumps, and SSE payloads on-the-fly with <1MB heap memory. Automatically handles split chunk boundaries:
 
@@ -173,7 +326,7 @@ sanitizeStream.on('finish', () => {
 
 ---
 
-### 6. AI Agent Guard & Function Calling (`createGuardedTools`, `applyPatch`)
+### 9. AI Agent Guard & Function Calling (`createGuardedTools`, `applyPatch`)
 
 Equip autonomous agents (Cursor, Vercel AI SDK, OpenAI, LangChain) with safe tools that intercept secrets and restore authentic data on disk:
 
@@ -202,7 +355,7 @@ const patchResult = await guardApplyPatch.execute({
 
 ---
 
-### 7. Automated PR Security Verification Stamp (CI/CD)
+### 10. Automated PR Security Verification Stamp (CI/CD)
 
 Enforce zero plaintext PII and credential leaks in your CI/CD pipeline (GitHub Actions, GitLab CI, Jenkins) before pull requests are merged into production.
 
@@ -312,10 +465,29 @@ To acquire a commercial Developer SDK license:
 - 🔌 **MCP Server**: [@privacyscrubber/mcp-server](https://www.npmjs.com/package/@privacyscrubber/mcp-server)
 - 🧩 **Chrome Extension**: [Chrome Web Store](https://chromewebstore.google.com/detail/privacyscrubber-%E2%80%94-zero-tr/pimoejgefeilajmmbpghifdmhdlkgjol)
 - 📖 **Developer SDK Specs**: [https://privacyscrubber.com/features/developer-sdk/](https://privacyscrubber.com/features/developer-sdk/)
+- ⭐ **GitHub Repository**: [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) (Star us on GitHub!)
 - 🧪 **DLP Latency Benchmark**: [https://privacyscrubber.com/dlp-speed-test/](https://privacyscrubber.com/dlp-speed-test/)
 
+### 📚 Production Architecture Guides
+- 🛡️ **RAG & Vector Databases**: [Sanitizing PII Before Vector DB Ingestion (Pinecone, Chroma, Qdrant)](https://privacyscrubber.com/solutions/dev/rag-vector-database-pii-masking/)
+- 🤖 **LangChain & LlamaIndex**: [In-Memory PII Middleware for AI Agent Pipelines](https://privacyscrubber.com/solutions/agents/langchain-llamaindex-pii-anonymizer/)
+- ⚡ **AWS Comprehend Alternative**: [In-Memory Redaction Without Egress or Cloud Overhead](https://privacyscrubber.com/solutions/dev/aws-comprehend-pii-alternative/)
+
 ---
 
 ## ⚖️ License
 
 MIT License © 2026 PrivacyScrubber. Commercial production usage without quota limits requires an active Developer SDK or Enterprise license.
+
+---
+
+## 🏛️ Intellectual Property & Virtual Patent Marking
+
+The Zero-Trust Data Sanitization (ZTDS) architecture, in-memory deterministic tokenization, cryptographic session handoff, and headless execution methods implemented in this SDK are proprietary technology of Ilya Sibiryakov (BrandMeWeb) and are protected under **Patent Pending** status:
+
+- **Patent Office:** State of Israel Ministry of Justice, Patent Office (ILPO)
+- **Application Number:** `331905` (Tracking ID: `94221`)
+- **Filing / Priority Date:** September 14, 2026 (Paris Convention Art. 4 & 35 U.S.C. § 119 Priority)
+- **Official Title:** *SYSTEM AND METHOD FOR CLIENT-SIDE ZERO-TRUST DATA SANITIZATION AND CRYPTOGRAPHIC SESSION HANDOFF IN ARTIFICIAL INTELLIGENCE WORKFLOWS*
+- **Virtual Patent Marking:** [privacyscrubber.com/patents/](https://privacyscrubber.com/patents/) in accordance with 35 U.S.C. § 287(a).
+

package/cli.js

@@ -13,7 +13,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
-import { sanitize } from './index.js';
+import { sanitize, restore, generateProcurementMemo, StreamingDetokenizer } from './index.js';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -21,7 +21,7 @@ const __dirname = path.dirname(__filename);
 const args = process.argv.slice(2);
 
 if (args.includes('--version') || args.includes('-v')) {
-  let version = '2.2.0';
+  let version = '2.2.2';
   try {
     const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf8'));
     version = pkg.version || version;
@@ -30,6 +30,76 @@ if (args.includes('--version') || args.includes('-v')) {
   process.exit(0);
 }
 
+// ── Memo Command: Generate CISO / DPO Procurement Memorandum ──────
+if (args.includes('memo') || args.includes('--memo') || args.includes('--procurement-memo')) {
+  let format = 'markdown';
+  const formatIdx = args.indexOf('--format');
+  if (formatIdx !== -1 && args[formatIdx + 1]) {
+    format = args[formatIdx + 1];
+  }
+  let appName = 'Internal AI Applications & LLM Pipelines';
+  const appIdx = args.indexOf('--app');
+  if (appIdx !== -1 && args[appIdx + 1]) {
+    appName = args[appIdx + 1];
+  }
+  let developer = 'Engineering / AI Platform Team';
+  const devIdx = args.indexOf('--developer') !== -1 ? args.indexOf('--developer') : args.indexOf('--dev');
+  if (devIdx !== -1 && args[devIdx + 1]) {
+    developer = args[devIdx + 1];
+  }
+
+  const memo = generateProcurementMemo({ appName, developer, format });
+  process.stdout.write(memo.endsWith('\n') ? memo : memo + '\n');
+  process.exit(0);
+}
+
+// ── Demo Command: Live In-Memory Benchmark & Zero-Trust Inspection ──
+if (args.includes('demo') || args.includes('--demo')) {
+  const sampleInput = `DevOps Incident Report #4829
+Reporter: Sarah Connor (sarah.connor@cyberdyne.io, +1-415-555-0199, SSN 987-65-4321)
+Host: prod-api-04.us-east-1.internal (10.0.42.15)
+AWS Credentials: AKIAIOSFODNN7EXAMPLE / wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
+Stripe API Key: sk_live_51OzTestDummyStripeKey998877665544332211
+Database URI: postgresql://admin:SuperSecretPassword123@db-prod.internal:5432/production
+Status: Database connection timeout during batch export.`;
+
+  const start = process.hrtime.bigint();
+  const res = sanitize(sampleInput, { profile: 'Dev', detectSecrets: true });
+  const end = process.hrtime.bigint();
+  const durationUs = Number(end - start) / 1000;
+  const durationMs = (durationUs / 1000).toFixed(3);
+
+  const maskedCount = Object.keys(res.tokenMap || {}).length;
+  const border = '═'.repeat(66);
+  const thin = '─'.repeat(66);
+
+  console.log(`
+╔${border}╗
+║  PrivacyScrubber Developer SDK — Live In-Memory Benchmark        ║
+║  Standard: Zero-Trust Data Sanitization (ZTDS)                   ║
+╠${border}╣
+║  Input Characters : ${sampleInput.length.toString().padEnd(44)} ║
+║  Protected Tokens  : ${maskedCount.toString().padEnd(44)} ║
+║  Execution Latency : ${(durationMs + ' ms (' + durationUs.toFixed(0) + ' µs)').padEnd(44)} ║
+║  Network Egress    : 0 bytes (Pure in-memory process RAM)        ║
+║  Risk Level        : ${(res.telemetry?.riskLevel || 'CLEAN').padEnd(44)} ║
+║  Frameworks        : ${(res.telemetry?.frameworksList?.slice(0, 3).join(', ') || 'GDPR, SOC 2, NIST').padEnd(44)} ║
+╟${thin}╢
+║  RAW INPUT PREVIEW:                                              ║
+${sampleInput.split('\n').map(l => `║  ${l.slice(0, 62).padEnd(64)}║`).join('\n')}
+╟${thin}╢
+║  SANITIZED OUTPUT (Safe for LLM Egress):                         ║
+${res.scrubbedText.split('\n').map(l => `║  ${l.slice(0, 62).padEnd(64)}║`).join('\n')}
+╟${thin}╢
+║  NEXT STEPS & PROCUREMENT:                                       ║
+║  * Copy CISO Approval Memo : npx @privacyscrubber/sdk memo       ║
+║  * CI/CD PR Stamp          : cat prompt.txt | sdk --verify-ci    ║
+║  * Unlimited SDK ($199/mo) : https://privacyscrubber.com/pricing  ║
+╚${border}╝
+`);
+  process.exit(0);
+}
+
 if (args.includes('--help') || args.includes('-h') || (args.length === 0 && process.stdin.isTTY)) {
   console.log(`@privacyscrubber/sdk — Zero-Trust Data Sanitization & CI Security Verification
 
@@ -37,18 +107,37 @@ Usage:
   npx @privacyscrubber/sdk <fileOrText> [options]
   cat prompt.txt | npx @privacyscrubber/sdk [options]
   npx @privacyscrubber/sdk --verify-ci <fileOrText> [options]
+  npx @privacyscrubber/sdk memo [options]
+  npx @privacyscrubber/sdk demo
+
+Commands:
+  memo                 Generate executive CISO & DPO procurement memo
+  demo                 Run live in-memory benchmark (<0.1ms latency check)
 
 Options:
-  --verify-ci          Generate CI/CD PR verification stamp
-  --profile <name>     Specify detection profile (default: Dev)
+  --verify-ci          Generate CI/CD PR verification stamp (audit receipt)
+  --json               Output structured JSON (scrubbedText, tokenMap, telemetry)
+  --restore, --unscrub Restore masked tokens in text back to original values
+  --stream             Stream de-tokenization chunks in real-time from stdin
+  --token-map <path>   Path to JSON file or inline JSON string of token mappings
+  --profile <name>     Specify detection profile (default: Dev, 30 profiles available)
   --key <licKey>       PrivacyScrubber PRO/TEAMS/SDK license key
   -v, --version        Show SDK version
   -h, --help           Show help screen
 
 Examples:
   cat prompt.txt | npx @privacyscrubber/sdk
+  cat prompt.txt | npx @privacyscrubber/sdk --json
   cat build.log | npx @privacyscrubber/sdk --verify-ci
+  npx @privacyscrubber/sdk memo > CISO_APPROVAL_MEMO.md
+  npx @privacyscrubber/sdk demo
   npx @privacyscrubber/sdk "Contact Alice at alice@acme.com" --profile dev
+  echo "Hello [NAME_1]" | npx @privacyscrubber/sdk --restore --token-map '{"[NAME_1]":"Alice"}'
+  cat stream.txt | npx @privacyscrubber/sdk --restore --stream --token-map tokens.json
+
+Commercial Licensing:
+  Developer SDK ($199/mo flat): https://privacyscrubber.com/pricing?tier=sdk&src=cli_help
+  Teams ($99/mo flat):          https://privacyscrubber.com/pricing?tier=teams&src=cli_help
 `);
   process.exit(0);
 }
@@ -66,30 +155,60 @@ if (keyIdx !== -1 && args[keyIdx + 1]) {
 }
 
 const isVerifyCi = args.includes('--verify-ci');
+const isJson = args.includes('--json');
+const isRestore = args.includes('--restore') || args.includes('--unscrub');
+const isStream = args.includes('--stream');
+
+let tokenMap = {};
+const mapIdx = args.indexOf('--token-map');
+if (mapIdx !== -1 && args[mapIdx + 1]) {
+  const mapSource = args[mapIdx + 1];
+  try {
+    if (fs.existsSync(mapSource)) {
+      tokenMap = JSON.parse(fs.readFileSync(mapSource, 'utf8'));
+    } else {
+      tokenMap = JSON.parse(mapSource);
+    }
+  } catch (err) {
+    console.error(`[PrivacyScrubber CLI Error] Failed to parse --token-map: ${err.message}`);
+    process.exit(1);
+  }
+}
 
 // Locate input argument (first positional parameter that is not a flag or flag value)
 const skipIndices = new Set();
 if (profIdx !== -1) { skipIndices.add(profIdx); skipIndices.add(profIdx + 1); }
 if (keyIdx !== -1) { skipIndices.add(keyIdx); skipIndices.add(keyIdx + 1); }
+if (mapIdx !== -1) { skipIndices.add(mapIdx); skipIndices.add(mapIdx + 1); }
 
 let inputArg = null;
 for (let i = 0; i < args.length; i++) {
   if (skipIndices.has(i)) continue;
-  if (args[i] === '--verify-ci') continue;
+  if (args[i] === '--verify-ci' || args[i] === '--json' || args[i] === '--restore' || args[i] === '--unscrub') continue;
   if (args[i].startsWith('-')) continue;
   inputArg = args[i];
   break;
 }
 
 function handleExecution(text) {
+  if (isRestore) {
+    const { restoredText, restoredCount } = restore(text, tokenMap);
+    if (isJson) {
+      console.log(JSON.stringify({ restoredText, restoredCount }, null, 2));
+    } else {
+      process.stdout.write(restoredText.endsWith('\n') ? restoredText : restoredText + '\n');
+    }
+    process.exit(0);
+  }
+
   if (isVerifyCi) {
     if (!text || !text.trim()) {
-      console.log(`> 🛡️ **Verified by PrivacyScrubber (ZTDS Standard)**\n> * **Status:** ✅ PASSED · 0 PII / 0 Secrets detected in prompt pipeline (Empty payload)\n> * **Execution:** Local RAM (<1ms) · 0 Network Egress Bytes`);
+      console.log(`> 🛡️ **Verified by PrivacyScrubber (ZTDS Standard)**\n> * **Status:** ✅ PASSED · 0 PII / 0 Secrets detected in prompt pipeline (Empty payload)\n> * **Execution:** Local RAM (<1ms) · 0 Network Egress Bytes\n> * **Compliance Spec:** [Zero-Trust Data Sanitization (ZTDS)](https://privacyscrubber.com/solutions/engineering/zero-trust-ai-data-sanitization?src=ci_stamp) | [Developer SDK ($199/mo)](https://privacyscrubber.com/pricing?tier=sdk&src=ci_stamp)`);
       process.exit(0);
     }
 
-    const { scrubbedText, tokenMap, telemetry } = sanitize(text, { profile, detectSecrets: true });
-    const maskedCount = Object.keys(tokenMap || {}).length;
+    const { scrubbedText, tokenMap: resMap, telemetry } = sanitize(text, { profile, detectSecrets: true });
+    const maskedCount = Object.keys(resMap || {}).length;
     const hash = crypto.createHash('sha256').update(scrubbedText).digest('hex').slice(0, 16);
 
     const stamp = `
@@ -97,17 +216,31 @@ function handleExecution(text) {
 > * **Status:** ✅ PASSED · ${maskedCount} item(s) protected (${telemetry?.riskLevel || 'CLEAN'})
 > * **Execution:** Local RAM (<1ms) · 0 Network Egress Bytes
 > * **Audit Hash:** \`${hash}\` (Zero-Trust Verified)
+> * **Compliance Spec:** [Zero-Trust Data Sanitization (ZTDS)](https://privacyscrubber.com/solutions/engineering/zero-trust-ai-data-sanitization?src=ci_stamp) | [Developer SDK ($199/mo)](https://privacyscrubber.com/pricing?tier=sdk&src=ci_stamp)
 `;
     console.log(stamp.trim());
     process.exit(0);
-  } else {
-    if (!text) {
-      process.exit(0);
+  }
+
+  if (!text) {
+    if (isJson) {
+      console.log(JSON.stringify({ scrubbedText: '', tokenMap: {}, count: 0 }, null, 2));
     }
-    const { scrubbedText } = sanitize(text, { profile, detectSecrets: true });
-    process.stdout.write(scrubbedText.endsWith('\n') ? scrubbedText : scrubbedText + '\n');
     process.exit(0);
   }
+
+  const res = sanitize(text, { profile, detectSecrets: true });
+  if (isJson) {
+    console.log(JSON.stringify({
+      scrubbedText: res.scrubbedText,
+      tokenMap: res.tokenMap,
+      count: res.count,
+      telemetry: res.telemetry
+    }, null, 2));
+  } else {
+    process.stdout.write(res.scrubbedText.endsWith('\n') ? res.scrubbedText : res.scrubbedText + '\n');
+  }
+  process.exit(0);
 }
 
 if (inputArg) {
@@ -118,12 +251,26 @@ if (inputArg) {
     handleExecution(inputArg);
   }
 } else if (!process.stdin.isTTY) {
-  const chunks = [];
-  process.stdin.on('data', c => chunks.push(c));
-  process.stdin.on('end', () => {
-    const content = Buffer.concat(chunks).toString('utf8');
-    handleExecution(content);
-  });
+  if (isStream && isRestore) {
+    const detok = new StreamingDetokenizer(tokenMap);
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', chunk => {
+      const out = detok.feed(chunk);
+      if (out) process.stdout.write(out);
+    });
+    process.stdin.on('end', () => {
+      const finalOut = detok.flush();
+      if (finalOut) process.stdout.write(finalOut);
+      process.exit(0);
+    });
+  } else {
+    const chunks = [];
+    process.stdin.on('data', c => chunks.push(c));
+    process.stdin.on('end', () => {
+      const content = Buffer.concat(chunks).toString('utf8');
+      handleExecution(content);
+    });
+  }
 } else {
   console.error(`Error: No input provided. Use: npx @privacyscrubber/sdk <fileOrText> or pipe stdin.`);
   process.exit(1);