@privacyscrubber/sdk 2.2.6 → 2.2.8

package/README.md

@@ -648,7 +648,7 @@ To acquire a commercial Developer SDK license:
 - 🌐 **Web App**: [https://privacyscrubber.com](https://privacyscrubber.com)
 - 🔌 **MCP Server**: [@privacyscrubber/mcp-server](https://www.npmjs.com/package/@privacyscrubber/mcp-server)
 - 🧩 **Chrome Extension**: [Chrome Web Store](https://chromewebstore.google.com/detail/privacyscrubber-%E2%80%94-zero-tr/pimoejgefeilajmmbpghifdmhdlkgjol)
-- 📖 **Developer SDK Specs**: [https://privacyscrubber.com/features/developer-sdk/](https://privacyscrubber.com/features/developer-sdk/)
+- 📖 **Developer SDK Specs**: [https://privacyscrubber.com/sdk/](https://privacyscrubber.com/sdk/)
 - ⭐ **GitHub Repository**: [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) (Star us on GitHub!)
 - 🧪 **DLP Latency Benchmark**: [https://privacyscrubber.com/dlp-speed-test/](https://privacyscrubber.com/dlp-speed-test/)
 

package/browser.js

@@ -94,7 +94,9 @@ export function buildAuditTelemetry(currentTokenMap = {}) {
     if (currentTokenMap && typeof currentTokenMap === 'object') {
         const keys = Array.isArray(currentTokenMap) ? currentTokenMap : Object.keys(currentTokenMap);
         for (const t of keys) {
-            const tokenStr = typeof t === 'string' ? t : (t.token || t.mask || '');
+            if (!t) continue;
+            const tokenStr = typeof t === 'string' ? t : ((t && (t.token || t.mask)) ? String(t.token || t.mask) : '');
+            if (!tokenStr) continue;
             const match = tokenStr.match(/\[([A-Z_]+)_\d+\]/);
             const baseType = match ? match[1] : (tokenStr.replace(/\[|\]/g, '').replace(/_[0-9]+$/, '') || 'CUSTOM');
             entities[baseType] = (entities[baseType] || 0) + 1;
@@ -149,7 +151,7 @@ export function buildAuditTelemetry(currentTokenMap = {}) {
 export function formatAuditReceipt(telemetry) {
     if (!telemetry || telemetry.totalCount === 0) {
         return "> 🛡️ **PrivacyScrubber Audit Receipt**: CLEAN (ZERO PII DETECTED)\n" +
-               "> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **SDK & Enterprise:** [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing)\n";
+               "> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **SDK & Enterprise:** [privacyscrubber.com/sdk](https://privacyscrubber.com/sdk/)\n";
     }
     const entitiesList = Object.entries(telemetry.entities)
         .map(([type, count]) => `${count} ${type}`)
@@ -161,7 +163,7 @@ export function formatAuditReceipt(telemetry) {
            `> * **Risk Level:** ${icon} ${telemetry.riskLevel}\n` +
            `> * **Compliance Enforced:** ${telemetry.frameworksList.join(', ')}\n` +
            `> * **Tokens Masked:** ${telemetry.totalCount} (${entitiesList})\n` +
-           `> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **SDK & Enterprise:** [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing)\n`;
+           `> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **SDK & Enterprise:** [privacyscrubber.com/sdk](https://privacyscrubber.com/sdk/)\n`;
 }
 
 /**

package/cli.js

@@ -206,7 +206,7 @@ ${res.scrubbedText.split('\n').map(l => `║  ${l.slice(0, 62).padEnd(64)}║`).
 ║  * Copy CISO Approval Memo : npx @privacyscrubber/sdk memo       ║
 ║  * CI/CD PR Stamp          : cat prompt.txt | sdk --verify-ci    ║
 ║  * Star on GitHub          : github.com/moxno/privacyscrubber-mcp║
-║  * Unlimited SDK ($299/mo) : https://privacyscrubber.com/pricing  ║
+║  * Unlimited SDK ($299/mo) : https://privacyscrubber.com/sdk/      ║
 ╚${border}╝
 `);
   process.exit(0);
@@ -317,7 +317,7 @@ function handleExecution(text) {
 
   if (isVerifyCi) {
     if (!text || !text.trim()) {
-      console.log(`> **Verified by PrivacyScrubber (ZTDS Standard)**\n> * **Status:** PASSED · 0 PII / 0 Secrets detected in prompt pipeline (Empty payload)\n> * **Execution:** Local RAM (<1ms) · 0 Network Egress Bytes\n> * **Compliance Spec:** [Zero-Trust Data Sanitization (ZTDS)](https://privacyscrubber.com/solutions/engineering/zero-trust-ai-data-sanitization?src=ci_stamp) | ⭐ [Star on GitHub](https://github.com/moxno/privacyscrubber-mcp) | [Developer SDK ($299/mo)](https://privacyscrubber.com/pricing?tier=sdk&src=ci_stamp)`);
+      console.log(`> **Verified by PrivacyScrubber (ZTDS Standard)**\n> * **Status:** PASSED · 0 PII / 0 Secrets detected in prompt pipeline (Empty payload)\n> * **Execution:** Local RAM (<1ms) · 0 Network Egress Bytes\n> * **Compliance Spec:** [Zero-Trust Data Sanitization (ZTDS)](https://privacyscrubber.com/solutions/engineering/zero-trust-ai-data-sanitization?src=ci_stamp) | ⭐ [Star on GitHub](https://github.com/moxno/privacyscrubber-mcp) | [Developer SDK ($299/mo)](https://privacyscrubber.com/sdk/?src=ci_stamp)`);
       process.exit(0);
     }
 
@@ -330,7 +330,7 @@ function handleExecution(text) {
 > * **Status:** PASSED · ${maskedCount} item(s) protected (${telemetry?.riskLevel || 'CLEAN'})
 > * **Execution:** Local RAM (<1ms) · 0 Network Egress Bytes
 > * **Audit Hash:** \`${hash}\` (Zero-Trust Verified)
-> * **Compliance Spec:** [Zero-Trust Data Sanitization (ZTDS)](https://privacyscrubber.com/solutions/engineering/zero-trust-ai-data-sanitization?src=ci_stamp) | ⭐ [Star on GitHub](https://github.com/moxno/privacyscrubber-mcp) | [Developer SDK ($299/mo)](https://privacyscrubber.com/pricing?tier=sdk&src=ci_stamp)
+> * **Compliance Spec:** [Zero-Trust Data Sanitization (ZTDS)](https://privacyscrubber.com/solutions/engineering/zero-trust-ai-data-sanitization?src=ci_stamp) | ⭐ [Star on GitHub](https://github.com/moxno/privacyscrubber-mcp) | [Developer SDK ($299/mo)](https://privacyscrubber.com/sdk/?src=ci_stamp)
 `;
     console.log(stamp.trim());
     process.exit(0);

package/fastmcp.cjs

@@ -0,0 +1,273 @@
+/**
+ * @privacyscrubber/fastmcp-guard
+ * Zero-Trust Data Sanitization (ZTDS) In-Memory Middleware for FastMCP
+ * Conforms to IETF Standards Track: draft-sibiryakov-ztds-protocol-02
+ *
+ * Core Protocol Invariants:
+ * 1. Zero External Egress Prior to Sanitization
+ * 2. Deterministic Reversible Tokenization
+ * 3. In-Memory Reference Purge (Zeroization)
+ * 4. ReDoS-Resistant Pattern Scanning
+ * 5. Single-Pass O(N) Restoration (Zero Token Cascading)
+ */
+
+const crypto = require("node:crypto");
+
+const ZTDS_PATTERNS = {
+  API_SECRET: /\b(?:sk-(?:proj-)?[A-Za-z0-9_-]{20,}|(?:ghp|gho|ghu|ghs|ghr|github_pat_)[A-Za-z0-9_]{20,}|eyJ[a-zA-Z0-9_-]{20,}\.[a-zA-Z0-9_-]{20,}\.[a-zA-Z0-9_-]{20,})\b/g,
+  AWS_KEY: /\b(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA)[A-Z0-9]{16}\b/g,
+  CREDIT_CARD: /\b(?:\d{4}[-\s]?){3}\d{4}\b/g,
+  EMAIL: /[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9-]{1,63}(?:\.[A-Za-z0-9-]{1,63})*\.[A-Za-z]{2,24}/g,
+  IBAN: /\b[A-Z]{2}[0-9]{2}[A-Z0-9]{4}[0-9]{7}(?:[A-Z0-9]?){0,16}\b/g,
+  IPV4: /\b(?:\d{1,3}\.){3}\d{1,3}\b/g,
+  PHONE: /(?:(?:\+?1\s*(?:[.-]\s*)?)?(?:\(\s*([2-9]1[02-9]|[2-9][02-8]1|[2-9][02-8][02-9])\s*\)|([2-9]1[02-9]|[2-9][02-8]1|[2-9][02-8][02-9]))\s*(?:[.-]\s*)?)?([2-9]1[02-9]|[2-9][02-8]1|[2-9][02-8]{2})\s*(?:[.-]\s*)?([0-9]{4})\b/g,
+  SSN: /\b\d{3}-\d{2}-\d{4}\b/g,
+};
+
+const TOKEN_PATTERN = /\[([A-Z_]+)_TOKEN_([a-zA-Z0-9_-]+)\]/g;
+
+class ZTDSFastMCPGuard {
+  constructor(options = {}) {
+    this.enabledEntities = options.enabledEntities || Object.keys(ZTDS_PATTERNS);
+    this.sanitizeInputs = options.sanitizeInputs !== false;
+    this.sanitizeOutputs = options.sanitizeOutputs !== false;
+    this.useCryptoTokens = options.useCryptoTokens !== false;
+    this.autoZeroize = options.autoZeroize !== false;
+    this._sessionMaps = new Map();
+    this._entityMaps = new Map();
+  }
+
+  _generateToken(entityType, tokenMap) {
+    if (this.useCryptoTokens) {
+      for (let i = 0; i < 100; i++) {
+        const hex = crypto.randomBytes(4).toString("hex");
+        const candidate = `[${entityType}_TOKEN_${hex}]`;
+        if (!tokenMap.has(candidate)) {
+          return candidate;
+        }
+      }
+    }
+    let count = 0;
+    for (const k of tokenMap.keys()) {
+      if (k.startsWith(`[${entityType}_TOKEN_`)) {
+        count++;
+      }
+    }
+    return `[${entityType}_TOKEN_${count + 1}]`;
+  }
+
+  sanitizeText(text, sessionId) {
+    if (typeof text !== "string") {
+      return { sanitized: text, tokenMap: {} };
+    }
+
+    if (!this._sessionMaps.has(sessionId)) {
+      this._sessionMaps.set(sessionId, new Map());
+      this._entityMaps.set(sessionId, new Map());
+    }
+
+    const tokenMap = this._sessionMaps.get(sessionId);
+    const entityMap = this._entityMaps.get(sessionId);
+    let sanitized = text;
+
+    for (const entityType of this.enabledEntities) {
+      const pattern = ZTDS_PATTERNS[entityType];
+      if (!pattern) continue;
+
+      if (entityType === "EMAIL" && !sanitized.includes("@")) {
+        continue;
+      }
+
+      const regex = new RegExp(`(\\[[A-Z_]+_TOKEN_[a-zA-Z0-9_-]+\\])|(?:${pattern.source})`, "g");
+      sanitized = sanitized.replace(regex, (match, existingToken) => {
+        if (existingToken) {
+          return existingToken;
+        }
+        if (entityMap.has(match)) {
+          return entityMap.get(match);
+        }
+        const token = this._generateToken(entityType, tokenMap);
+        tokenMap.set(token, match);
+        entityMap.set(match, token);
+        return token;
+      });
+    }
+
+    const exportedMap = {};
+    for (const [k, v] of tokenMap.entries()) {
+      exportedMap[k] = v;
+    }
+    return { sanitized, tokenMap: exportedMap };
+  }
+
+  restoreText(text, sessionId) {
+    if (typeof text !== "string") {
+      return text;
+    }
+    const tokenMap = this._sessionMaps.get(sessionId);
+    if (!tokenMap || tokenMap.size === 0) {
+      return text;
+    }
+
+    return text.replace(TOKEN_PATTERN, (match) => {
+      return tokenMap.get(match) || match;
+    });
+  }
+
+  sanitizeObject(val, sessionId) {
+    if (typeof val === "string") {
+      return this.sanitizeText(val, sessionId).sanitized;
+    }
+    if (Array.isArray(val)) {
+      return val.map((item) => this.sanitizeObject(item, sessionId));
+    }
+    if (val !== null && typeof val === "object") {
+      const result = {};
+      for (const [k, v] of Object.entries(val)) {
+        result[k] = this.sanitizeObject(v, sessionId);
+      }
+      return result;
+    }
+    return val;
+  }
+
+  restoreObject(val, sessionId) {
+    if (typeof val === "string") {
+      return this.restoreText(val, sessionId);
+    }
+    if (Array.isArray(val)) {
+      return val.map((item) => this.restoreObject(item, sessionId));
+    }
+    if (val !== null && typeof val === "object") {
+      const result = {};
+      for (const [k, v] of Object.entries(val)) {
+        result[k] = this.restoreObject(v, sessionId);
+      }
+      return result;
+    }
+    return val;
+  }
+
+  wrapTool(toolName, handler) {
+    return async (args, context = {}) => {
+      const sessionId =
+        context.sessionId ||
+        `mcp-${Date.now()}-${crypto.randomBytes(4).toString("hex")}`;
+
+      const enrichedContext = {
+        ...context,
+        sessionId,
+        unmask: (val) => this.restoreObject(val, sessionId),
+      };
+
+      try {
+        let processedArgs = args;
+        if (this.sanitizeInputs && args !== undefined && args !== null) {
+          processedArgs = this.sanitizeObject(args, sessionId);
+        }
+
+        const rawResult = await handler(processedArgs, enrichedContext);
+
+        let finalResult = rawResult;
+        if (this.sanitizeOutputs && rawResult !== undefined && rawResult !== null) {
+          if (typeof rawResult === "string") {
+            finalResult = this.sanitizeText(rawResult, sessionId).sanitized;
+          } else if (typeof rawResult === "object" && Array.isArray(rawResult.content)) {
+            finalResult = {
+              ...rawResult,
+              content: rawResult.content.map((block) => {
+                if (block && block.type === "text" && typeof block.text === "string") {
+                  return {
+                    ...block,
+                    text: this.sanitizeText(block.text, sessionId).sanitized,
+                  };
+                }
+                return block;
+              }),
+            };
+          } else {
+            finalResult = this.sanitizeObject(rawResult, sessionId);
+          }
+        }
+
+        const ztdsMeta = {
+          sessionId,
+          standard: "IETF draft-sibiryakov-ztds-protocol-02",
+          zeroEgress: true,
+        };
+
+        if (typeof finalResult === "string") {
+          return {
+            content: [{ type: "text", text: finalResult }],
+            _ztds: ztdsMeta,
+          };
+        }
+
+        if (finalResult !== null && typeof finalResult === "object" && !Array.isArray(finalResult)) {
+          return {
+            ...finalResult,
+            _ztds: ztdsMeta,
+          };
+        }
+
+        return {
+          result: finalResult,
+          _ztds: ztdsMeta,
+        };
+      } finally {
+        if (this.autoZeroize) {
+          this.zeroizeSession(sessionId);
+        }
+      }
+    };
+  }
+
+  zeroizeSession(sessionId) {
+    if (this._sessionMaps.has(sessionId)) {
+      this._sessionMaps.get(sessionId).clear();
+      this._sessionMaps.delete(sessionId);
+    }
+    if (this._entityMaps.has(sessionId)) {
+      this._entityMaps.get(sessionId).clear();
+      this._entityMaps.delete(sessionId);
+    }
+  }
+}
+
+function createZTDSGuard(options) {
+  return new ZTDSFastMCPGuard(options);
+}
+
+function ztdsGuardTool(handler, options) {
+  const guard = new ZTDSFastMCPGuard(options);
+  return guard.wrapTool("tool", handler);
+}
+
+function wrapExecute(handler, options) {
+  return ztdsGuardTool(handler, options);
+}
+
+function withZTDS(server, options = {}) {
+  const guard = new ZTDSFastMCPGuard(options);
+  if (server && typeof server.addTool === "function") {
+    const origAddTool = server.addTool.bind(server);
+    server.addTool = function(toolDef) {
+      if (toolDef && typeof toolDef.execute === "function") {
+        const origExecute = toolDef.execute;
+        toolDef.execute = guard.wrapTool(toolDef.name || "tool", origExecute);
+      }
+      return origAddTool(toolDef);
+    };
+  }
+  return server;
+}
+
+module.exports = {
+  ZTDSFastMCPGuard,
+  ZTDS_PATTERNS,
+  TOKEN_PATTERN,
+  createZTDSGuard,
+  ztdsGuardTool,
+  wrapExecute,
+  withZTDS,
+};

package/fastmcp.d.ts

@@ -0,0 +1,65 @@
+/**
+ * @privacyscrubber/fastmcp-guard
+ * TypeScript Definitions
+ */
+
+export interface ZTDSMetadata {
+  sessionId: string;
+  standard: string;
+  zeroEgress: boolean;
+}
+
+export interface ZTDSGuardOptions {
+  enabledEntities?: string[];
+  sanitizeInputs?: boolean;
+  sanitizeOutputs?: boolean;
+  useCryptoTokens?: boolean;
+  autoZeroize?: boolean;
+}
+
+export interface ZTDSContext {
+  sessionId: string;
+  unmask: (val: unknown) => unknown;
+  [key: string]: unknown;
+}
+
+export declare const ZTDS_PATTERNS: Record<string, RegExp>;
+export declare const TOKEN_PATTERN: RegExp;
+
+export declare class ZTDSFastMCPGuard {
+  constructor(options?: ZTDSGuardOptions);
+  enabledEntities: string[];
+  sanitizeInputs: boolean;
+  sanitizeOutputs: boolean;
+  useCryptoTokens: boolean;
+  autoZeroize: boolean;
+
+  sanitizeText(text: string, sessionId: string): { sanitized: string; tokenMap: Record<string, string> };
+  restoreText(text: string, sessionId: string): string;
+  sanitizeObject(val: unknown, sessionId: string): unknown;
+  restoreObject(val: unknown, sessionId: string): unknown;
+
+  wrapTool<TArgs = unknown, TResult = unknown>(
+    toolName: string,
+    handler: (args: TArgs, context: ZTDSContext) => Promise<TResult>
+  ): (args: TArgs, context?: Partial<ZTDSContext>) => Promise<TResult & { _ztds: ZTDSMetadata }>;
+
+  zeroizeSession(sessionId: string): void;
+}
+
+export declare function createZTDSGuard(options?: ZTDSGuardOptions): ZTDSFastMCPGuard;
+
+export declare function ztdsGuardTool<TArgs = unknown, TResult = unknown>(
+  handler: (args: TArgs, context: ZTDSContext) => Promise<TResult>,
+  options?: ZTDSGuardOptions
+): (args: TArgs, context?: Partial<ZTDSContext>) => Promise<TResult & { _ztds: ZTDSMetadata }>;
+
+export declare function wrapExecute<TArgs = unknown, TResult = unknown>(
+  handler: (args: TArgs, context: ZTDSContext) => Promise<TResult>,
+  options?: ZTDSGuardOptions
+): (args: TArgs, context?: Partial<ZTDSContext>) => Promise<TResult & { _ztds: ZTDSMetadata }>;
+
+export declare function withZTDS<TServer extends object = object>(
+  server: TServer,
+  options?: ZTDSGuardOptions
+): TServer;

package/fastmcp.js

@@ -0,0 +1,27 @@
+/**
+ * @privacyscrubber/sdk/fastmcp
+ * Zero-Trust Data Sanitization (ZTDS) In-Memory Middleware for FastMCP
+ */
+
+import { createRequire } from 'module';
+const require = createRequire(import.meta.url);
+
+const fastmcpGuard = require('./fastmcp.cjs');
+
+export const ZTDSFastMCPGuard = fastmcpGuard.ZTDSFastMCPGuard;
+export const ZTDS_PATTERNS = fastmcpGuard.ZTDS_PATTERNS;
+export const TOKEN_PATTERN = fastmcpGuard.TOKEN_PATTERN;
+export const createZTDSGuard = fastmcpGuard.createZTDSGuard;
+export const ztdsGuardTool = fastmcpGuard.ztdsGuardTool;
+export const wrapExecute = fastmcpGuard.wrapExecute;
+export const withZTDS = fastmcpGuard.withZTDS;
+
+export default {
+  ZTDSFastMCPGuard,
+  ZTDS_PATTERNS,
+  TOKEN_PATTERN,
+  createZTDSGuard,
+  ztdsGuardTool,
+  wrapExecute,
+  withZTDS,
+};

package/index.d.ts

@@ -7,6 +7,7 @@ export interface CustomRule {
     regex: RegExp;
     mask?: string;
     type?: string;
+    label?: string;
 }
 
 export type PiiProfile = 
@@ -66,6 +67,10 @@ export interface SanitizeOptions {
     tokenLabelMap?: Record<string, string>;
     /** Pre-existing token session map for stateful conversation tracking. */
     existingSessionMap?: Record<string, string>;
+    /** Whether tokenMap should return the full cumulative session map when existingSessionMap is provided (Default: false). */
+    returnFullSessionMap?: boolean;
+    /** Set or array of strings or exact terms to preserve unmasked in cleartext. */
+    ignoreList?: string[] | Set<string>;
     /** Whether to generate a CISO Markdown audit receipt (Default: true). */
     generateReceipt?: boolean;
     /** Throw PrivacyScrubberLicenseError when free tier limits are reached (Default: true). */
@@ -74,6 +79,21 @@ export interface SanitizeOptions {
     onLimit?: 'throw' | 'truncate';
 }
 
+export interface DetectedSpan {
+    /** 0-based character start index in original text. */
+    start: number;
+    /** 0-based character end index in original text. */
+    end: number;
+    /** Raw matched value before sanitization. */
+    value: string;
+    /** Detected entity type (NAME, EMAIL, PHONE, ID, FINANCIAL, etc.). */
+    type: string;
+    /** Deterministic masking token assigned (e.g. [NAME_1]). */
+    token?: string;
+    /** True if anchored by context keyword, honorific, or statutory checksum. */
+    isHighConfidence?: boolean;
+}
+
 export interface LicenseMetadata {
     isPro: boolean;
     tier: 'PRO' | 'TEAMS' | 'SDK' | 'ENTERPRISE' | 'OEM' | 'FREE';
@@ -96,6 +116,12 @@ export interface SanitizeResult {
     scrubbedText: string;
     /** The volatile in-memory token map needed to restore data. */
     tokenMap: Record<string, string>;
+    /** Full cumulative session map when existingSessionMap was provided. */
+    sessionMap?: Record<string, string>;
+    /** Detailed array of detected entity spans and positions. */
+    spans: DetectedSpan[];
+    /** Alias for spans. */
+    matches: DetectedSpan[];
     /** Total number of tokens masked. */
     count: number;
     /** Execution duration in milliseconds. */

package/index.js

@@ -111,7 +111,9 @@ export function buildAuditTelemetry(currentTokenMap = {}) {
     if (currentTokenMap && typeof currentTokenMap === 'object') {
         const keys = Array.isArray(currentTokenMap) ? currentTokenMap : Object.keys(currentTokenMap);
         for (const t of keys) {
-            const tokenStr = typeof t === 'string' ? t : (t.token || t.mask || '');
+            if (!t) continue;
+            const tokenStr = typeof t === 'string' ? t : ((t && (t.token || t.mask)) ? String(t.token || t.mask) : '');
+            if (!tokenStr) continue;
             const match = tokenStr.match(/\[([A-Z_]+)_\d+\]/);
             const baseType = match ? match[1] : (tokenStr.replace(/\[|\]/g, '').replace(/_[0-9]+$/, '') || 'CUSTOM');
             entities[baseType] = (entities[baseType] || 0) + 1;
@@ -478,9 +480,15 @@ export function sanitize(text, options = {}) {
         finalScrubbedText += `\n\n<!-- [PrivacyScrubber] Input truncated at free tier limit (${limit.toLocaleString()} chars). For unlimited throughput: https://privacyscrubber.com/pricing?tier=sdk&src=truncation -->`;
     }
 
+    const returnFullSessionMap = options.returnFullSessionMap === true;
+    const sessionMap = { ...(existingSessionMap || {}), ...(rawResult.tokenMap || {}) };
+
     return {
         scrubbedText: finalScrubbedText,
-        tokenMap: rawResult.tokenMap || {},
+        tokenMap: returnFullSessionMap ? sessionMap : (rawResult.tokenMap || {}),
+        sessionMap: sessionMap,
+        matches: rawResult.matches || [],
+        spans: rawResult.matches || [],
         count: rawResult.count || 0,
         executionMs: executionMs,
         license: {
@@ -1258,7 +1266,8 @@ export function buildStreamReplacer(tokenMap = {}) {
         return (text) => text || '';
     }
 
-    const rules = [];
+    const lookup = new Map();
+    const patterns = [];
     const sortedKeys = Object.keys(tokenMap).sort((a, b) => b.length - a.length);
 
     for (const k of sortedKeys) {
@@ -1269,34 +1278,47 @@ export function buildStreamReplacer(tokenMap = {}) {
         if (match) {
             const label = escapeRegex(match[1]);
             const idx = match[2];
-            const patternStr = '(?:\\[\\s*' + label + '[-_\\s]*0*' + idx + '\\s*\\]|<\\s*' + label + '[-_\\s]*0*' + idx + '\\s*>|\\{\\{\\s*' + label + '[-_\\s]*0*' + idx + '\\s*\\}\\}|__\\s*' + label + '[-_\\s]*0*' + idx + '\\s*__|\\b' + label + '[-_\\s]+0*' + idx + '\\b)(?:\'s|’s|s)?';
-            rules.push({
-                regex: new RegExp(patternStr, 'gi'),
-                val,
-                k
-            });
+            const patternStr = '(?:\\[\\s*' + label + '[-_\\s]*0*' + idx + '\\s*\\]|<\\s*' + label + '[-_\\s]*0*' + idx + '\\s*>|\\{\\{\\s*' + label + '[-_\\s]*0*' + idx + '\\s*\\}\\}|__\\s*' + label + '[-_\\s]*0*' + idx + '\\s*__|\\b' + label + '[-_\\s]+0*' + idx + '\\b)';
+            patterns.push(patternStr);
+            const normKey = (match[1] + '_' + parseInt(idx, 10)).toUpperCase();
+            lookup.set(normKey, val);
+            lookup.set(k, val);
+            lookup.set(k.toUpperCase(), val);
         } else {
             const safe = escapeRegex(k);
-            rules.push({
-                regex: new RegExp(safe + '(?:\'s|’s|s)?', 'gi'),
-                val,
-                k
-            });
+            patterns.push(safe);
+            lookup.set(k, val);
+            lookup.set(k.toUpperCase(), val);
         }
     }
 
+    const unifiedRegex = new RegExp('(?:' + patterns.join('|') + ')(\'s|’s|s)?', 'gi');
+
     return function replaceTokens(text) {
         if (!text) return '';
-        let result = text;
-        for (let i = 0; i < rules.length; i++) {
-            const rule = rules[i];
-            rule.regex.lastIndex = 0;
-            result = result.replace(rule.regex, (m) => {
-                const isPossessive = /('s|’s)$/i.test(m);
-                return rule.val + (isPossessive ? "'s" : '');
-            });
-        }
-        return result;
+        unifiedRegex.lastIndex = 0;
+        return text.replace(unifiedRegex, (match, suffix) => {
+            const isPossessive = suffix && /('s|’s)$/i.test(suffix);
+            const coreMatch = suffix ? match.slice(0, match.length - suffix.length) : match;
+
+            if (lookup.has(coreMatch)) {
+                return lookup.get(coreMatch) + (isPossessive ? "'s" : '');
+            }
+            if (lookup.has(coreMatch.toUpperCase())) {
+                return lookup.get(coreMatch.toUpperCase()) + (isPossessive ? "'s" : '');
+            }
+
+            const inner = coreMatch.replace(/^\[|<|\{\{|__|\]|>|\}\}|__/g, '').trim();
+            const m = inner.match(/^([A-Za-z_0-9]+?)[-_ ]?(\d+)$/);
+            if (m) {
+                const normKey = (m[1] + '_' + parseInt(m[2], 10)).toUpperCase();
+                if (lookup.has(normKey)) {
+                    return lookup.get(normKey) + (isPossessive ? "'s" : '');
+                }
+            }
+
+            return lookup.has(match) ? lookup.get(match) : match;
+        });
     };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@privacyscrubber/sdk",
-  "version": "2.2.6",
+  "version": "2.2.8",
   "description": "In-process consumer privacy defense and pre-emptive PII interception SDK for Node.js, Next.js, and AI pipelines. Zero data loss, zero third parties, sub-millisecond in-memory execution.",
   "main": "index.js",
   "browser": "browser.js",
@@ -16,6 +16,11 @@
       "types": "./vision.d.ts",
       "import": "./vision.js",
       "default": "./vision.js"
+    },
+    "./fastmcp": {
+      "types": "./fastmcp.d.ts",
+      "import": "./fastmcp.js",
+      "default": "./fastmcp.js"
     }
   },
   "publishConfig": {
@@ -26,6 +31,9 @@
     "browser.js",
     "vision.js",
     "vision.d.ts",
+    "fastmcp.js",
+    "fastmcp.cjs",
+    "fastmcp.d.ts",
     "index.d.ts",
     "cli.js",
     "polyfill.js",
@@ -68,7 +76,7 @@
   ],
   "author": "Ilya Sibiryakov (BrandMeWeb)",
   "license": "SEE LICENSE IN LICENSE.md",
-  "homepage": "https://privacyscrubber.com/?utm_source=npm&utm_medium=readme&utm_campaign=sdk",
+  "homepage": "https://privacyscrubber.com/sdk/?utm_source=npm&utm_medium=readme&utm_campaign=sdk",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/moxno/privacyscrubber-mcp.git"