@privacyscrubber/sdk 2.2.2 → 2.2.3

package/browser.js

@@ -0,0 +1,654 @@
+/**
+ * PrivacyScrubber Developer SDK — Browser & Edge Runtime Client Module
+ * (@privacyscrubber/sdk/browser)
+ * 
+ * 100% Client-Side in-memory execution.
+ * Zero Node.js dependencies (no fs, child_process, or Node stream).
+ * Safe for Vite, Next.js client components ('use client'), Webpack, Web Workers, and Edge runtimes.
+ * 
+ * https://privacyscrubber.com
+ */
+
+import './polyfill.js';
+import './ps-license-manager.js';
+import './scrubber-core.cjs';
+
+// Access LicenseManager and PrivacyScrubberCore from global scope
+const LicenseManager = (typeof globalThis !== 'undefined' && globalThis.LicenseManager)
+    || (typeof window !== 'undefined' && window.LicenseManager);
+
+const scrubberPkg = (typeof globalThis !== 'undefined' && globalThis.PrivacyScrubberCore) 
+    || (typeof window !== 'undefined' && window.PrivacyScrubberCore);
+
+if (scrubberPkg && typeof scrubberPkg.init === 'function') {
+    scrubberPkg.init();
+}
+
+/**
+ * Built-in patterns for DevOps & Cloud Secrets detection.
+ */
+export const DEVOPS_SECRETS_DETECTOR = [
+    { name: 'AWS Credentials', regex: /\b(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA)[A-Z0-9]{16}\b/g, label: 'AWS_KEY' },
+    { name: 'JSON Web Token (JWT)', regex: /\beyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/g, label: 'JWT_TOKEN' },
+    { name: 'API Token/Key (GitHub/Slack/NPM)', regex: /\b(?:ghp|gho|ghu|ghs|ghr|glpat|npm|xox[baprs])[-_][A-Za-z0-9_]{10,}\b/g, label: 'API_TOKEN' },
+    { name: 'Stripe API Key', regex: /\b(?:[rs]k)_(?:test|live)_[a-zA-Z0-9]{24,}\b/g, label: 'STRIPE_KEY' },
+    { name: 'OpenAI Project API Key', regex: /\b(?:sk|pk)-(?:proj-)?[a-zA-Z0-9_-]{16,}\b/gi, label: 'OPENAI_KEY' },
+    { name: 'Database Connection URI', regex: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp|mssql):\/\/[^\s"']+/gi, label: 'DB_URI' },
+    { name: 'Embedded Credentials URI', regex: /\b(?:https?|s?ftp):\/\/[a-zA-Z0-9_.%+-]+:[^\s/@:"']+@[a-zA-Z0-9_.-]+(?::\d+)?(?:\/[^\s"']*)?/gi, label: 'SECRET' },
+    { name: 'URL Query Parameter Secret', regex: /(?<=[?&](?:api_key|apikey|access_token|client_secret|auth_token|token|secret|password|private_key)=)[^\s"'\x26#)>]{8,}/gi, label: 'SECRET' },
+    { name: 'Bearer / Auth Header Token', regex: /(?<=\b(?:Bearer|Token)\s+)[a-zA-Z0-9_\-\.~+/=]{16,}\b/gi, label: 'SECRET' },
+    { name: 'Database/API Secret', regex: /\b(DB|POSTGRES|REDIS|MYSQL|AWS|SECRET|PASSWORD|TOKEN|API|KEY)[A-Z0-9_]*\s*[:=]\s*[^ \t\r\n"']{8,}\b/gi, label: 'SECRET' },
+    { name: 'Private Cryptographic Key (PEM Block)', regex: /-----BEGIN (?:RSA |EC |PGP |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----[\s\S]{10,8192}?-----END (?:RSA |EC |PGP |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----/g, label: 'SECRET' },
+    { name: 'Private Cryptographic Key (Header)', regex: /-----BEGIN (?:RSA |EC |PGP |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----/g, label: 'SECRET' }
+];
+
+/**
+ * Custom Error thrown when Free Tier limits are exceeded.
+ */
+export class PrivacyScrubberLicenseError extends Error {
+    constructor(message, { tier = 'FREE', currentLength = 0, limit = 15000, profile = 'General' } = {}) {
+        super(message);
+        this.name = 'PrivacyScrubberLicenseError';
+        this.tier = tier;
+        this.currentLength = currentLength;
+        this.limit = limit;
+        this.profile = profile;
+        this.upgradeUrl = 'https://privacyscrubber.com/pricing?utm_source=npm_sdk&utm_medium=sdk_error&utm_campaign=dev_upsell';
+    }
+}
+
+/**
+ * Validates a PrivacyScrubber license key.
+ * @param {string} key - License key string.
+ * @returns {{ valid: boolean, tier: 'PRO'|'TEAMS'|null, expires: number|null, error: string|null }}
+ */
+export function validateLicense(key) {
+    if (!key || typeof key !== 'string') {
+        return { valid: false, tier: null, expires: null, error: 'No license key provided.' };
+    }
+    const cleanKey = key.trim();
+    if (!LicenseManager || typeof LicenseManager.validate !== 'function') {
+        return { valid: false, tier: null, expires: null, error: 'License manager engine unavailable.' };
+    }
+    const result = LicenseManager.validate(cleanKey);
+    return {
+        valid: !!result.valid,
+        tier: result.valid ? (result.tier || 'PRO') : null,
+        expires: result.expires || null,
+        error: result.valid ? null : (result.reason || 'Invalid license key.')
+    };
+}
+
+export function validateLicenseKey(key) {
+    const res = validateLicense(key);
+    return res.valid ? res.tier : null;
+}
+
+/**
+ * Builds CISO-grade compliance audit telemetry from masked tokens.
+ */
+export function buildAuditTelemetry(currentTokenMap = {}) {
+    const entities = {};
+    let totalCount = 0;
+
+    if (currentTokenMap && typeof currentTokenMap === 'object') {
+        const keys = Array.isArray(currentTokenMap) ? currentTokenMap : Object.keys(currentTokenMap);
+        for (const t of keys) {
+            const tokenStr = typeof t === 'string' ? t : (t.token || t.mask || '');
+            const match = tokenStr.match(/\[([A-Z_]+)_\d+\]/);
+            const baseType = match ? match[1] : (tokenStr.replace(/\[|\]/g, '').replace(/_[0-9]+$/, '') || 'CUSTOM');
+            entities[baseType] = (entities[baseType] || 0) + 1;
+            totalCount++;
+        }
+    }
+
+    const types = Object.keys(entities);
+    let riskLevel = 'LOW EXPOSURE';
+
+    if (totalCount > 0) {
+        const hasHighRisk = types.some(t => ['ID', 'SSN', 'CREDIT_CARD', 'PASSPORT', 'BANK', 'API_KEY', 'SECRET', 'PASSWORD', 'MRN', 'KEY', 'AWS_KEY', 'STRIPE_KEY', 'JWT_TOKEN', 'API_TOKEN'].includes(t));
+        if (hasHighRisk || types.length >= 3 || totalCount >= 10) {
+            riskLevel = 'CRITICAL (HIGH EXPOSURE)';
+        } else if (types.length >= 2 || totalCount >= 3) {
+            riskLevel = 'MODERATE EXPOSURE';
+        } else {
+            riskLevel = 'LOW EXPOSURE';
+        }
+    } else {
+        riskLevel = 'CLEAN (ZERO PII)';
+    }
+
+    const frameworksSet = new Set(['ZTDS Standard']);
+    if (types.includes('NAME') || types.includes('EMAIL') || types.includes('PHONE')) {
+        frameworksSet.add('GDPR (Art. 4)');
+        frameworksSet.add('CCPA/CPRA');
+    }
+    if (types.includes('ID') || types.includes('SSN') || types.includes('PASSPORT')) {
+        frameworksSet.add('SOC 2 Type II');
+        frameworksSet.add('ISO 27001 (A.8.11)');
+    }
+    if (types.some(t => ['CREDIT_CARD', 'BANK', 'IBAN', 'FINANCIAL', 'CARD', 'STRIPE_KEY'].includes(t))) {
+        frameworksSet.add('PCI DSS v4.0');
+    }
+    if (types.some(t => ['MRN', 'HEALTH', 'MEDICAL', 'PATIENT'].includes(t))) {
+        frameworksSet.add('HIPAA §164.514');
+    }
+    if (types.some(t => ['API_KEY', 'SECRET', 'PASSWORD', 'TOKEN', 'KEY', 'AWS_KEY', 'JWT_TOKEN', 'API_TOKEN'].includes(t))) {
+        frameworksSet.add('NIST SP 800-53');
+    }
+
+    return {
+        totalCount,
+        entities,
+        types,
+        riskLevel,
+        frameworksList: Array.from(frameworksSet)
+    };
+}
+
+export function formatAuditReceipt(telemetry) {
+    if (!telemetry || telemetry.totalCount === 0) {
+        return "> 🛡️ **PrivacyScrubber Audit Receipt**: CLEAN (ZERO PII DETECTED)\n" +
+               "> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **SDK & Enterprise:** [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing)\n";
+    }
+    const entitiesList = Object.entries(telemetry.entities)
+        .map(([type, count]) => `${count} ${type}`)
+        .join(', ');
+
+    const icon = telemetry.riskLevel.includes('CRITICAL') ? '🔴' : (telemetry.riskLevel.includes('MODERATE') ? '🟠' : '🟢');
+
+    return `> 🛡️ **PrivacyScrubber Audit Receipt**\n` +
+           `> * **Risk Level:** ${icon} ${telemetry.riskLevel}\n` +
+           `> * **Compliance Enforced:** ${telemetry.frameworksList.join(', ')}\n` +
+           `> * **Tokens Masked:** ${telemetry.totalCount} (${entitiesList})\n` +
+           `> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **SDK & Enterprise:** [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing)\n`;
+}
+
+/**
+ * Sanitizes input text in-memory.
+ */
+export function sanitize(text, options = {}) {
+    if (!text || typeof text !== 'string') {
+        return {
+            scrubbedText: '',
+            tokenMap: {},
+            count: 0,
+            executionMs: 0,
+            license: { isPro: false, tier: 'FREE', limit: 15000, wasTruncated: false },
+            telemetry: buildAuditTelemetry({}),
+            auditReceipt: formatAuditReceipt(buildAuditTelemetry({}))
+        };
+    }
+
+    const {
+        profile = 'General',
+        licenseKey = '',
+        customRules = [],
+        tokenLabelMap = {},
+        existingSessionMap = {},
+        generateReceipt = true,
+        throwOnLimit = true,
+        onLimit = 'throw',
+        detectSecrets = false,
+        ignoreList = null
+    } = options;
+
+    const licenseCheck = validateLicense(licenseKey);
+    const isPro = licenseCheck.valid;
+    const tier = isPro ? licenseCheck.tier : 'FREE';
+
+    const isSpecialized = profile && profile.toLowerCase() !== 'general';
+    const limit = isPro ? Infinity : (isSpecialized ? 5000 : 15000);
+
+    const shouldThrow = throwOnLimit && onLimit !== 'truncate';
+    let wasTruncated = false;
+
+    if (!isPro && text.length > limit) {
+        if (shouldThrow) {
+            const errorMsg = `[PrivacyScrubber] Free Tier character limit exceeded (${limit.toLocaleString()} chars for profile '${profile}', received ${text.length.toLocaleString()} chars). Upgrade to PRO, TEAMS, or Developer SDK for unlimited throughput: https://privacyscrubber.com/pricing?utm_source=npm_sdk&utm_medium=sdk_error&utm_campaign=dev_upsell`;
+            throw new PrivacyScrubberLicenseError(errorMsg, {
+                tier: 'FREE',
+                currentLength: text.length,
+                limit: limit,
+                profile: profile
+            });
+        }
+        wasTruncated = true;
+    }
+
+    const activeRules = [...customRules];
+    if (profile.toLowerCase() === 'dev' || detectSecrets === true) {
+        DEVOPS_SECRETS_DETECTOR.forEach(rule => {
+            activeRules.push({
+                name: rule.name,
+                pattern: rule.regex.source,
+                regex: new RegExp(rule.regex.source, rule.regex.flags),
+                label: rule.label || 'SECRET'
+            });
+        });
+    }
+
+    const startTime = (typeof performance !== 'undefined' && typeof performance.now === 'function') 
+        ? performance.now() 
+        : Date.now();
+
+    const textToScrub = (!isPro && text.length > limit) ? text.slice(0, limit) : text;
+
+    const rawResult = scrubberPkg.scrubText(
+        textToScrub,
+        activeRules,
+        tokenLabelMap,
+        profile,
+        existingSessionMap,
+        isPro,
+        ignoreList
+    );
+
+    const endTime = (typeof performance !== 'undefined' && typeof performance.now === 'function') 
+        ? performance.now() 
+        : Date.now();
+
+    const executionMs = Math.round((endTime - startTime) * 100) / 100;
+    const telemetry = buildAuditTelemetry(rawResult.tokenMap || {});
+    const auditReceipt = generateReceipt ? formatAuditReceipt(telemetry) : '';
+
+    let finalScrubbedText = rawResult.scrubbedText;
+    if (wasTruncated && (onLimit === 'truncate' || throwOnLimit === false)) {
+        finalScrubbedText += `\n\n<!-- [PrivacyScrubber] Input truncated at free tier limit (${limit.toLocaleString()} chars). For unlimited throughput: https://privacyscrubber.com/pricing?tier=sdk&src=truncation -->`;
+    }
+
+    return {
+        scrubbedText: finalScrubbedText,
+        tokenMap: rawResult.tokenMap || {},
+        count: rawResult.count || 0,
+        executionMs: executionMs,
+        license: {
+            isPro: isPro,
+            tier: tier,
+            limit: limit,
+            wasTruncated: wasTruncated,
+            ...(!isPro && {
+                upgradeUrl: 'https://privacyscrubber.com/pricing?utm_source=npm_sdk&utm_medium=sdk_telemetry&utm_campaign=dev_upsell',
+                recommendation: 'Upgrade to PRO, TEAMS, or Developer SDK for unlimited text processing, custom regex rules, and specialized compliance profiles.'
+            })
+        },
+        telemetry: telemetry,
+        auditReceipt: auditReceipt
+    };
+}
+
+export const scrub = sanitize;
+
+export function clean(text, profile = 'General') {
+    if (!text || typeof text !== 'string') return '';
+    const { scrubbedText } = sanitize(text, { profile });
+    return scrubbedText;
+}
+
+/**
+ * Restores AI response back to original entities in-memory.
+ */
+export function restore(aiResponse, tokenMap = {}) {
+    if (!aiResponse || typeof aiResponse !== 'string') {
+        return { restoredText: '', restoredCount: 0 };
+    }
+    const result = scrubberPkg.unscrubText(aiResponse, tokenMap);
+    return {
+        restoredText: result.restoredText,
+        restoredCount: result.restoredCount || 0
+    };
+}
+
+export const unscrub = restore;
+
+/**
+ * Recursively sanitizes all string values within an object or array.
+ */
+export function sanitizeObject(obj, options = {}) {
+    if (obj === null || obj === undefined) {
+        return {
+            sanitized: obj,
+            tokenMap: {},
+            count: 0,
+            executionMs: 0,
+            telemetry: buildAuditTelemetry({}),
+            auditReceipt: formatAuditReceipt(buildAuditTelemetry({}))
+        };
+    }
+
+    if (typeof obj === 'string') {
+        const res = sanitize(obj, options);
+        return {
+            sanitized: res.scrubbedText,
+            tokenMap: res.tokenMap,
+            count: res.count,
+            executionMs: res.executionMs,
+            telemetry: res.telemetry,
+            auditReceipt: res.auditReceipt
+        };
+    }
+
+    if (typeof obj !== 'object') {
+        return {
+            sanitized: obj,
+            tokenMap: {},
+            count: 0,
+            executionMs: 0,
+            telemetry: buildAuditTelemetry({}),
+            auditReceipt: formatAuditReceipt(buildAuditTelemetry({}))
+        };
+    }
+
+    const startTime = (typeof performance !== 'undefined' && typeof performance.now === 'function') 
+        ? performance.now() 
+        : Date.now();
+
+    const mergedSessionMap = { ...(options.existingSessionMap || {}) };
+    let totalCount = 0;
+
+    function traverseAndSanitize(val) {
+        if (val === null || val === undefined) return val;
+        if (typeof val === 'string') {
+            if (val.trim().length === 0) return val;
+            const res = sanitize(val, {
+                ...options,
+                existingSessionMap: mergedSessionMap,
+                generateReceipt: false
+            });
+            Object.assign(mergedSessionMap, res.tokenMap);
+            totalCount += res.count;
+            return res.scrubbedText;
+        }
+        if (Array.isArray(val)) {
+            return val.map(item => traverseAndSanitize(item));
+        }
+        if (val instanceof Date || val instanceof RegExp) {
+            return val;
+        }
+        if (typeof val === 'object') {
+            const out = {};
+            for (const [k, v] of Object.entries(val)) {
+                out[k] = traverseAndSanitize(v);
+            }
+            return out;
+        }
+        return val;
+    }
+
+    const sanitizedResult = traverseAndSanitize(obj);
+
+    const endTime = (typeof performance !== 'undefined' && typeof performance.now === 'function') 
+        ? performance.now() 
+        : Date.now();
+
+    const executionMs = Math.round((endTime - startTime) * 100) / 100;
+    const telemetry = buildAuditTelemetry(mergedSessionMap);
+    const auditReceipt = options.generateReceipt !== false ? formatAuditReceipt(telemetry) : '';
+
+    return {
+        sanitized: sanitizedResult,
+        tokenMap: mergedSessionMap,
+        count: totalCount,
+        executionMs: executionMs,
+        telemetry: telemetry,
+        auditReceipt: auditReceipt
+    };
+}
+
+export function restoreObject(obj, tokenMap = {}) {
+    if (obj === null || obj === undefined) return obj;
+    if (typeof obj === 'string') {
+        const res = restore(obj, tokenMap);
+        return res.restoredText;
+    }
+    if (Array.isArray(obj)) {
+        return obj.map(item => restoreObject(item, tokenMap));
+    }
+    if (typeof obj === 'object' && !(obj instanceof Date) && !(obj instanceof RegExp)) {
+        const out = {};
+        for (const [k, v] of Object.entries(obj)) {
+            out[k] = restoreObject(v, tokenMap);
+        }
+        return out;
+    }
+    return obj;
+}
+
+/**
+ * Stateful PrivacyScrubber Engine class for browser environments.
+ */
+export class PrivacyScrubberEngine {
+    constructor(config = {}) {
+        this.licenseKey = config.licenseKey || config.apiKey || '';
+        this.defaultProfile = config.defaultProfile || config.profile || 'General';
+        this.customRules = config.customRules || [];
+        this.tokenLabelMap = config.tokenLabelMap || {};
+        this.generateReceipt = config.generateReceipt !== false;
+        this.sessionMap = { ...(config.initialSessionMap || {}) };
+        this.ignoreList = new Set(config.ignoreList || []);
+        this.license = validateLicense(this.licenseKey);
+    }
+
+    setLicenseKey(key) {
+        this.licenseKey = key;
+        this.license = validateLicense(this.licenseKey);
+        return this.license;
+    }
+
+    sanitize(text, options = {}) {
+        const mergedIgnoreList = new Set(this.ignoreList);
+        if (options.ignoreList) {
+            (Array.isArray(options.ignoreList) ? options.ignoreList : [...options.ignoreList])
+                .forEach(v => mergedIgnoreList.add(v));
+        }
+
+        const mergedOptions = {
+            profile: options.profile || this.defaultProfile,
+            licenseKey: options.licenseKey || this.licenseKey,
+            customRules: [...this.customRules, ...(options.customRules || [])],
+            tokenLabelMap: { ...this.tokenLabelMap, ...(options.tokenLabelMap || {}) },
+            existingSessionMap: options.persistSession !== false ? this.sessionMap : (options.existingSessionMap || {}),
+            generateReceipt: options.generateReceipt !== undefined ? options.generateReceipt : this.generateReceipt,
+            throwOnLimit: options.throwOnLimit !== undefined ? options.throwOnLimit : true,
+            detectSecrets: options.detectSecrets !== undefined ? options.detectSecrets : false,
+            ignoreList: mergedIgnoreList.size > 0 ? mergedIgnoreList : null
+        };
+
+        const result = sanitize(text, mergedOptions);
+        if (options.persistSession !== false) {
+            Object.assign(this.sessionMap, result.tokenMap);
+        }
+        return result;
+    }
+
+    restore(aiResponse, tokenMap = null) {
+        const activeMap = tokenMap || this.sessionMap;
+        return restore(aiResponse, activeMap);
+    }
+
+    resetSession() {
+        for (const key of Object.keys(this.sessionMap)) {
+            delete this.sessionMap[key];
+        }
+    }
+}
+
+/**
+ * Browser & Web Worker Streaming Detokenizer.
+ */
+export class StreamingDetokenizer {
+    constructor(tokenMap = {}, options = {}) {
+        this.tokenMap = { ...tokenMap };
+        this.buffer = '';
+        this.onTokenRestored = typeof options.onTokenRestored === 'function' ? options.onTokenRestored : null;
+        this.maxTokenLength = Math.max(
+            32,
+            ...Object.keys(this.tokenMap).map(k => k.length + 8)
+        );
+    }
+
+    updateTokenMap(newTokenMap) {
+        Object.assign(this.tokenMap, newTokenMap);
+        this.maxTokenLength = Math.max(
+            this.maxTokenLength,
+            ...Object.keys(this.tokenMap).map(k => k.length + 8)
+        );
+    }
+
+    process(chunk) {
+        if (!chunk) return '';
+        this.buffer += chunk;
+        let output = '';
+
+        while (true) {
+            const openIdx = this.buffer.search(/\[|\<|\{\{|\_\_/);
+            if (openIdx === -1) {
+                output += this.buffer;
+                this.buffer = '';
+                break;
+            }
+
+            output += this.buffer.slice(0, openIdx);
+            this.buffer = this.buffer.slice(openIdx);
+
+            const closeIdx = this.buffer.search(/\]|\>|\}\}|\_\_/);
+            if (closeIdx === -1) {
+                if (this.buffer.length > this.maxTokenLength) {
+                    output += this.buffer.slice(0, this.maxTokenLength);
+                    this.buffer = this.buffer.slice(this.maxTokenLength);
+                    continue;
+                }
+                break;
+            }
+
+            const candidateToken = this.buffer.slice(0, closeIdx + 1);
+            const originalValue = this.tokenMap[candidateToken];
+
+            if (originalValue !== undefined) {
+                output += originalValue;
+                if (this.onTokenRestored) {
+                    this.onTokenRestored({ token: candidateToken, originalValue });
+                }
+                this.buffer = this.buffer.slice(closeIdx + 1);
+            } else {
+                output += candidateToken[0];
+                this.buffer = this.buffer.slice(1);
+            }
+        }
+
+        return output;
+    }
+
+    flush() {
+        let output = '';
+        if (this.buffer) {
+            let flushed = this.buffer;
+            for (const [token, original] of Object.entries(this.tokenMap)) {
+                if (flushed.includes(token)) {
+                    flushed = flushed.split(token).join(original);
+                }
+            }
+            output = flushed;
+            this.buffer = '';
+        }
+        return output;
+    }
+}
+
+/**
+ * Wraps an async iterable AI stream to automatically de-tokenize chunks in real time.
+ */
+export async function* wrapAiStream(stream, tokenMap = {}, options = {}) {
+    const detokenizer = new StreamingDetokenizer(tokenMap, options);
+    for await (const chunk of stream) {
+        const text = typeof chunk === 'string' ? chunk : (chunk?.content || chunk?.text || chunk?.delta || '');
+        if (text) {
+            const detokenized = detokenizer.process(text);
+            if (detokenized) {
+                if (typeof chunk === 'string') {
+                    yield detokenized;
+                } else if (typeof chunk === 'object' && chunk !== null) {
+                    yield { ...chunk, content: detokenized, text: detokenized };
+                }
+            }
+        } else {
+            yield chunk;
+        }
+    }
+    const remaining = detokenizer.flush();
+    if (remaining) {
+        yield remaining;
+    }
+}
+
+export function createStreamTokenRestorer(tokenMap = {}, options = {}) {
+    const detok = new StreamingDetokenizer(tokenMap, options);
+    if (typeof TransformStream !== 'undefined') {
+        const ts = new TransformStream({
+            transform(chunk, controller) {
+                const str = typeof chunk === 'string' ? chunk : String(chunk);
+                const out = detok.process(str);
+                if (out) controller.enqueue(out);
+            },
+            flush(controller) {
+                const rem = detok.flush();
+                if (rem) controller.enqueue(rem);
+            }
+        });
+        ts.process = (c) => detok.process(c);
+        ts.flush = () => detok.flush();
+        ts.detokenizer = detok;
+        return ts;
+    }
+    return {
+        process: (c) => detok.process(c),
+        flush: () => detok.flush(),
+        detokenizer: detok
+    };
+}
+
+export function buildStreamReplacer(tokenMap = {}) {
+    const detok = new StreamingDetokenizer(tokenMap);
+    return (chunk) => detok.process(chunk);
+}
+
+export const scrubText = scrubberPkg ? scrubberPkg.scrubText : null;
+export const unscrubText = scrubberPkg ? scrubberPkg.unscrubText : null;
+
+// Vision & Multimodal exports
+export {
+    stripExifMetadata,
+    redactImageBoundingBoxes,
+    generateSvgRedactionOverlay
+} from './vision.js';
+import {
+    stripExifMetadata,
+    redactImageBoundingBoxes,
+    generateSvgRedactionOverlay
+} from './vision.js';
+
+export default {
+    sanitize,
+    sanitizeObject,
+    scrub,
+    clean,
+    restore,
+    restoreObject,
+    unscrub,
+    validateLicense,
+    validateLicenseKey,
+    buildAuditTelemetry,
+    formatAuditReceipt,
+    PrivacyScrubberEngine,
+    PrivacyScrubberLicenseError,
+    StreamingDetokenizer,
+    createStreamTokenRestorer,
+    buildStreamReplacer,
+    wrapAiStream,
+    scrubText,
+    unscrubText,
+    DEVOPS_SECRETS_DETECTOR,
+    stripExifMetadata,
+    redactImageBoundingBoxes,
+    generateSvgRedactionOverlay
+};

package/index.d.ts

@@ -450,7 +450,44 @@ declare const defaultExport: {
     createGuardedTools: typeof createGuardedTools;
     scrubText: typeof scrubText;
     unscrubText: typeof unscrubText;
+    stripExifMetadata: typeof stripExifMetadata;
+    redactImageBoundingBoxes: typeof redactImageBoundingBoxes;
+    generateSvgRedactionOverlay: typeof generateSvgRedactionOverlay;
 };
 
+export interface ExifStripResult {
+    cleanBuffer: Uint8Array | Buffer;
+    metadataStripped: boolean;
+    format: string;
+    removedSegments: string[];
+    bytesSaved: number;
+}
+
+export interface VisionBoundingBox {
+    x: number;
+    y: number;
+    width: number;
+    height: number;
+    label?: string;
+}
+
+export interface VisionRedactOptions {
+    fillColor?: string;
+    borderColor?: string;
+    showLabels?: boolean;
+}
+
+export function stripExifMetadata(inputBuffer: Buffer | Uint8Array): ExifStripResult;
+export function redactImageBoundingBoxes(
+    canvasOrCtx: any,
+    boxes?: VisionBoundingBox[],
+    options?: VisionRedactOptions
+): number;
+export function generateSvgRedactionOverlay(
+    dimensions?: { width: number; height: number },
+    boxes?: VisionBoundingBox[],
+    options?: VisionRedactOptions
+): string;
+
 export default defaultExport;