@privacyscrubber/sdk 2.4.1 → 2.4.3

package/examples/python-bridge/privacyscrubber/client.py

@@ -260,6 +260,9 @@ class PrivacyScrubberClient:
         detect_secrets: Optional[bool] = None,
         license_key: Optional[str] = None,
         persist_session: bool = True,
+        generate_receipt: bool = True,
+        ignore_list: Optional[List[str]] = None,
+        custom_rules: Optional[List[Dict[str, Any]]] = None,
         throw_on_limit: bool = True
     ) -> ObjectSanitizeResult:
         """
@@ -273,6 +276,9 @@ class PrivacyScrubberClient:
             detect_secrets=self.detect_secrets if detect_secrets is None else detect_secrets,
             license_key=license_key or self.license_key,
             persist_session=persist_session,
+            generate_receipt=generate_receipt,
+            ignore_list=ignore_list,
+            custom_rules=custom_rules,
             throw_on_limit=throw_on_limit
         )
         return ObjectSanitizeResult(
@@ -503,6 +509,9 @@ class AsyncPrivacyScrubberClient:
         detect_secrets: Optional[bool] = None,
         license_key: Optional[str] = None,
         persist_session: bool = True,
+        generate_receipt: bool = True,
+        ignore_list: Optional[List[str]] = None,
+        custom_rules: Optional[List[Dict[str, Any]]] = None,
         throw_on_limit: bool = True
     ) -> ObjectSanitizeResult:
         res = await self._send_request(
@@ -512,6 +521,9 @@ class AsyncPrivacyScrubberClient:
             detect_secrets=self.detect_secrets if detect_secrets is None else detect_secrets,
             license_key=license_key or self.license_key,
             persist_session=persist_session,
+            generate_receipt=generate_receipt,
+            ignore_list=ignore_list,
+            custom_rules=custom_rules,
             throw_on_limit=throw_on_limit
         )
         return ObjectSanitizeResult(

package/examples/python-bridge/privacyscrubber/langchain.py

@@ -74,6 +74,9 @@ class ZTDSCallbackHandler(BaseCallbackHandler):
                 print(f"[ZTDS Guard] Sanitized {res.count} PII tokens for run {key}")
 
         self._session_token_maps[key] = combined_token_map
+        if len(self._session_token_maps) > 512:
+            oldest_key = next(iter(self._session_token_maps))
+            self._session_token_maps.pop(oldest_key, None)
 
     def on_llm_end(
         self,
@@ -92,16 +95,37 @@ class ZTDSCallbackHandler(BaseCallbackHandler):
         if generations and isinstance(generations, list):
             for gen_list in generations:
                 for gen in gen_list:
-                    if hasattr(gen, "text") and gen.text:
-                        restored = self.scrubber.restore(gen.text, token_map=token_map)
-                        gen.text = restored.restored_text
-                    elif hasattr(gen, "message") and hasattr(gen.message, "content"):
-                        if isinstance(gen.message.content, str):
-                            restored = self.scrubber.restore(gen.message.content, token_map=token_map)
-                            gen.message.content = restored.restored_text
+                    restored_str: Optional[str] = None
+                    if hasattr(gen, "message") and hasattr(gen.message, "content"):
+                        msg_content = gen.message.content
+                        if isinstance(msg_content, str) and msg_content:
+                            restored_str = self.scrubber.restore(msg_content, token_map=token_map).restored_text
+                            gen.message.content = restored_str
+                        elif isinstance(msg_content, list):
+                            for block in msg_content:
+                                if isinstance(block, dict) and isinstance(block.get("text"), str) and block["text"]:
+                                    block["text"] = self.scrubber.restore(block["text"], token_map=token_map).restored_text
+                    if hasattr(gen, "text") and isinstance(getattr(gen, "text", None), str) and gen.text:
+                        try:
+                            gen.text = restored_str if restored_str is not None else self.scrubber.restore(gen.text, token_map=token_map).restored_text
+                        except (AttributeError, TypeError):
+                            pass
 
         return response
 
+    def on_llm_error(
+        self,
+        error: BaseException,
+        *,
+        run_id: Optional[Any] = None,
+        parent_run_id: Optional[Any] = None,
+        tags: Optional[List[str]] = None,
+        **kwargs: Any
+    ) -> Any:
+        """Cleans up ephemeral token maps if the LLM call fails."""
+        key = str(run_id) if run_id else "default"
+        self._session_token_maps.pop(key, None)
+
 
 class ZTDSDocumentTransformer:
     """

package/examples/python-bridge/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "privacyscrubber"
-version = "2.4.1"
+version = "2.4.3"
 description = "Zero-Trust Data Sanitization & In-Memory PII Shield for Python AI Pipelines (ZTDS RFC v1.0)"
 readme = "README.md"
 requires-python = ">=3.8"

package/examples/python-bridge/setup.py

@@ -13,7 +13,7 @@ with open(os.path.join(here, "README.md"), encoding="utf-8") as f:
 
 setup(
     name="privacyscrubber",
-    version="2.4.1",
+    version="2.4.3",
     description="Zero-Trust Data Sanitization & In-Memory PII Shield for Python AI Pipelines (ZTDS RFC v1.0)",
     long_description=long_description,
     long_description_content_type="text/markdown",

package/examples/python-bridge/test_python_bridge.py

@@ -312,7 +312,7 @@ class TestPrivacyScrubberBridge(unittest.TestCase):
             cwd=bridge_dir,
             env=sub_env
         )
-        self.assertIn("2.4.1", ver_out)
+        self.assertIn("2.4.3", ver_out)
 
 
 if __name__ == "__main__":

package/fastmcp.cjs

@@ -19,12 +19,12 @@ const ZTDS_PATTERNS = {
   CREDIT_CARD: /\b(?:\d{4}[-\s]?){3}\d{4}\b/g,
   EMAIL: /[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9-]{1,63}(?:\.[A-Za-z0-9-]{1,63})*\.[A-Za-z]{2,24}/g,
   IBAN: /\b[A-Z]{2}[0-9]{2}[A-Z0-9]{4}[0-9]{7}(?:[A-Z0-9]?){0,16}\b/g,
-  IPV4: /\b(?:\d{1,3}\.){3}\d{1,3}\b/g,
+  IPV4: /\b(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\b/g,
   PHONE: /(?:(?:\+?1\s*(?:[.-]\s*)?)?(?:\(\s*([2-9]1[02-9]|[2-9][02-8]1|[2-9][02-8][02-9])\s*\)|([2-9]1[02-9]|[2-9][02-8]1|[2-9][02-8][02-9]))\s*(?:[.-]\s*)?)?([2-9]1[02-9]|[2-9][02-8]1|[2-9][02-8]{2})\s*(?:[.-]\s*)?([0-9]{4})\b/g,
   SSN: /\b\d{3}-\d{2}-\d{4}\b/g,
 };
 
-const TOKEN_PATTERN = /(?:%5[Bb]|\\u005[Bb]|&(?:amp;)?#0*91;|\[|<|\{\{?|__|【|［)[*`_~\s]*([A-Z_]+)_TOKEN_([a-zA-Z0-9_-]+)[*`_~.,;:!?\s]*(?:%5[Dd]|\\u005[Dd]|&(?:amp;)?#0*93;|\]|>|\}\}?|__|】|］)/gi;
+const TOKEN_PATTERN = /(?:%5[Bb]|\\u005[Bb]|&(?:amp;)?(?:#0*91;|#[xX]0*5[Bb];|lbrack;|lsqb;)|\[|<|\{\{?|__|【|［|〔|「|『)[*`_~\s]*([A-Z0-9_]+)[*`_~]*[-_\s]+TOKEN[*`_~]*[-_\s]+([a-zA-Z0-9_-]+)[*`_~.,;:!?\s]*(?:%5[Dd]|\\u005[Dd]|&(?:amp;)?(?:#0*93;|#[xX]0*5[Dd];|rbrack;|rsqb;)|\]|>|\}\}?|__|】|］|〕|」|』)/gi;
 
 function escapeRegex(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -166,7 +166,7 @@ class StreamingDetokenizer {
     const tailLen = 160;
     const tail = this.pendingBuffer.length > tailLen ? this.pendingBuffer.slice(-tailLen) : this.pendingBuffer;
     const offset = this.pendingBuffer.length > tailLen ? this.pendingBuffer.length - tailLen : 0;
-    const m = tail.match(/(?:(?:\[|【|［|〔|「|『|<|\{\{?|__?|%5[Bb]|\\u005[Bb]|&(?:amp;)?(?:#0*91;|#[xX]0*5[Bb];|lbrack;))[A-Za-z0-9_\-А-Яа-яЁё *`~.\\]{0,128}(?:%5?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?3?|[xX]0*5?[Dd]?)?|r(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)?|%[0-9A-Fa-f]?|\\(?:u(?:0(?:0(?:5)?)?)?)?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?1?|[xX]0*5?)?|l(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)$/);
+    const m = tail.match(/(?:(?:\[|【|［|〔|「|『|<|\{\{?|__?|%5[Bb]|\\u005[Bb]|&(?:amp;)?(?:#0*91;|#[xX]0*5[Bb];|lbrack;))[A-Za-z0-9_\-\u0410-\u044F\u0401\u0451 *`~.\\]{0,128}(?:%5?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?3?|[xX]0*5?[Dd]?)?|r(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)?|%[0-9A-Fa-f]?|\\(?:u(?:0(?:0(?:5)?)?)?)?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?1?|[xX]0*5?)?|l(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)$/);
 
     if (m) {
       const candidate = m[0];
@@ -242,10 +242,11 @@ class ZTDSFastMCPGuard {
     this.maxSessionTokens = options.maxSessionTokens || 5000;
     this._sessionMaps = new Map();
     this._entityMaps = new Map();
+    this._sessionCounters = new Map();
     this._streamDetokenizers = new Map();
   }
 
-  _generateToken(entityType, tokenMap) {
+  _generateToken(entityType, tokenMap, counters) {
     if (this.useCryptoTokens) {
       for (let i = 0; i < 100; i++) {
         const hex = crypto.randomBytes(4).toString("hex");
@@ -255,13 +256,25 @@ class ZTDSFastMCPGuard {
         }
       }
     }
+    if (counters && typeof counters.get === "function") {
+      let nextIdx = (counters.get(entityType) || 0) + 1;
+      while (tokenMap.has(`[${entityType}_TOKEN_${nextIdx}]`)) {
+        nextIdx++;
+      }
+      counters.set(entityType, nextIdx);
+      return `[${entityType}_TOKEN_${nextIdx}]`;
+    }
     let count = 0;
     for (const k of tokenMap.keys()) {
       if (k.startsWith(`[${entityType}_TOKEN_`)) {
         count++;
       }
     }
-    return `[${entityType}_TOKEN_${count + 1}]`;
+    let idx = count + 1;
+    while (tokenMap.has(`[${entityType}_TOKEN_${idx}]`)) {
+      idx++;
+    }
+    return `[${entityType}_TOKEN_${idx}]`;
   }
 
   sanitizeText(text, sessionId) {
@@ -272,10 +285,12 @@ class ZTDSFastMCPGuard {
     if (!this._sessionMaps.has(sessionId)) {
       this._sessionMaps.set(sessionId, new Map());
       this._entityMaps.set(sessionId, new Map());
+      this._sessionCounters.set(sessionId, new Map());
     }
 
     const tokenMap = this._sessionMaps.get(sessionId);
     const entityMap = this._entityMaps.get(sessionId);
+    const counters = this._sessionCounters.get(sessionId);
     let sanitized = text
       .replace(/[\u200B-\u200F\u202A-\u202E\u2060-\u206F\uFEFF\u00AD]/g, "")
       .replace(/[\uFF01-\uFF5E]/g, (ch) => String.fromCharCode(ch.charCodeAt(0) - 0xFEE0));
@@ -288,11 +303,14 @@ class ZTDSFastMCPGuard {
         continue;
       }
 
-      const regex = new RegExp(`(\\[[A-Z_]+_TOKEN_[a-zA-Z0-9_-]+\\])|(?:${pattern.source})`, "g");
+      const regex = new RegExp(`(\\[[A-Z0-9_]+_TOKEN_[a-zA-Z0-9_-]+\\])|(?:${pattern.source})`, "g");
       sanitized = sanitized.replace(regex, (match, existingToken) => {
         if (existingToken) {
           return existingToken;
         }
+        if (entityType === "IPV4" && (match.startsWith("127.0.0.") || match === "0.0.0.0")) {
+          return match;
+        }
         if (entityMap.has(match)) {
           return entityMap.get(match);
         }
@@ -304,7 +322,7 @@ class ZTDSFastMCPGuard {
             entityMap.delete(oldestMatch);
           }
         }
-        const token = this._generateToken(entityType, tokenMap);
+        const token = this._generateToken(entityType, tokenMap, counters);
         tokenMap.set(token, match);
         entityMap.set(match, token);
         return token;
@@ -328,8 +346,16 @@ class ZTDSFastMCPGuard {
     }
 
     return text.replace(TOKEN_PATTERN, (match, entityType, tokenId) => {
-      const canonical = `[${entityType.toUpperCase()}_TOKEN_${tokenId}]`;
-      return tokenMap.get(canonical) || tokenMap.get(match) || match;
+      const upperType = entityType.toUpperCase();
+      const canonical = `[${upperType}_TOKEN_${tokenId}]`;
+      if (tokenMap.has(canonical)) return tokenMap.get(canonical);
+      const lowerHex = `[${upperType}_TOKEN_${tokenId.toLowerCase()}]`;
+      if (tokenMap.has(lowerHex)) return tokenMap.get(lowerHex);
+      if (/^\d+$/.test(tokenId)) {
+        const stripped = `[${upperType}_TOKEN_${parseInt(tokenId, 10)}]`;
+        if (tokenMap.has(stripped)) return tokenMap.get(stripped);
+      }
+      return tokenMap.get(match) || match;
     });
   }
 
@@ -340,6 +366,9 @@ class ZTDSFastMCPGuard {
     if (Array.isArray(val)) {
       return val.map((item) => this.sanitizeObject(item, sessionId));
     }
+    if (val instanceof Date || val instanceof RegExp || val instanceof Uint8Array || (typeof Buffer !== "undefined" && Buffer.isBuffer(val))) {
+      return val;
+    }
     if (val !== null && typeof val === "object") {
       const result = {};
       for (const [k, v] of Object.entries(val)) {
@@ -357,6 +386,9 @@ class ZTDSFastMCPGuard {
     if (Array.isArray(val)) {
       return val.map((item) => this.restoreObject(item, sessionId));
     }
+    if (val instanceof Date || val instanceof RegExp || val instanceof Uint8Array || (typeof Buffer !== "undefined" && Buffer.isBuffer(val))) {
+      return val;
+    }
     if (val !== null && typeof val === "object") {
       const result = {};
       for (const [k, v] of Object.entries(val)) {
@@ -525,6 +557,10 @@ class ZTDSFastMCPGuard {
       this._entityMaps.get(sessionId).clear();
       this._entityMaps.delete(sessionId);
     }
+    if (this._sessionCounters && this._sessionCounters.has(sessionId)) {
+      this._sessionCounters.get(sessionId).clear();
+      this._sessionCounters.delete(sessionId);
+    }
     if (this._streamDetokenizers.has(sessionId)) {
       this._streamDetokenizers.get(sessionId).reset();
       this._streamDetokenizers.delete(sessionId);

package/index.cjs

@@ -129,7 +129,7 @@ function buildAuditTelemetry(currentTokenMap = {}) {
             if (!t) continue;
             const tokenStr = typeof t === 'string' ? t : ((t && (t.token || t.mask)) ? String(t.token || t.mask) : '');
             if (!tokenStr) continue;
-            const match = tokenStr.match(/\[([A-Z_]+)_\d+\]/);
+            const match = tokenStr.match(/\[([A-Z0-9_]+)_\d+\]/);
             const baseType = match ? match[1] : (tokenStr.replace(/\[|\]/g, '').replace(/_[0-9]+$/, '') || 'CUSTOM');
             entities[baseType] = (entities[baseType] || 0) + 1;
             totalCount++;
@@ -238,7 +238,7 @@ const buildCisoAuditTelemetry = buildAuditTelemetry;
 function formatAuditReceipt(telemetry) {
     if (!telemetry || telemetry.totalCount === 0) {
         return "> 🛡️ **PrivacyScrubber Audit Receipt**: CLEAN (ZERO PII DETECTED)\n" +
-               "> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **SDK & Enterprise:** [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing)\n";
+               "> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **7-Day B2B Trial:** `npx @privacyscrubber/sdk trial` | **SDK & Enterprise:** [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing/?tier=sdk&utm_source=npm_sdk&utm_medium=audit_receipt)\n";
     }
     const entitiesList = Object.entries(telemetry.entities)
         .map(([type, count]) => `${count} ${type}`)
@@ -250,7 +250,7 @@ function formatAuditReceipt(telemetry) {
            `> * **Risk Level:** ${icon} ${telemetry.riskLevel}\n` +
            `> * **Framework References (informational):** ${telemetry.frameworksList.join(', ')}\n` +
            `> * **Tokens Masked:** ${telemetry.totalCount} (${entitiesList})\n` +
-           `> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **SDK & Enterprise:** [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing)\n`;
+           `> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **7-Day B2B Trial:** \`npx @privacyscrubber/sdk trial\` | **SDK & Enterprise:** [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing/?tier=sdk&utm_source=npm_sdk&utm_medium=audit_receipt)\n`;
 }
 
 let communityNoticeLogged = false;
@@ -259,7 +259,7 @@ function emitCommunityNoticeIfNeeded(isPro) {
     if (communityNoticeLogged || isPro) return;
     if (typeof process !== 'undefined' && process.env?.NODE_ENV === 'production') {
         communityNoticeLogged = true;
-        console.info('[@privacyscrubber/sdk] Running Community Edition (Core PII).\nTo unlock 25 Enterprise Profiles & DevOps Secrets in production: https://privacyscrubber.com/pricing/?tier=sdk');
+        console.info('[@privacyscrubber/sdk] Running Community Edition (Core PII).\nTo unlock 30 Enterprise Profiles & DevOps Secrets in production: https://privacyscrubber.com/pricing/?tier=sdk&utm_source=npm_sdk&utm_medium=prod_notice (7-Day Trial: npx @privacyscrubber/sdk trial | CISO Memo: npx @privacyscrubber/sdk memo)');
     }
 }
 
@@ -291,7 +291,8 @@ function emitDevSecretNoticeIfNeeded(isPro, tokenMap = {}, limit = 15000) {
             process.stderr.write(
                 `\n[PrivacyScrubber] Intercepted ${count} API secret(s) before LLM egress: ${secretSample}\n` +
                 `[PrivacyScrubber] Protected in local RAM (0 byte network egress). Free Tier active (${limit.toLocaleString()} char cap).\n` +
-                `[PrivacyScrubber] Developer SDK ($299/mo flat) for unlimited backend nodes, CI/CD gates & ETL pipelines: https://privacyscrubber.com/pricing?tier=sdk&src=cli_leak_guard\n\n`
+                `[PrivacyScrubber] Developer SDK ($299/mo flat) for unlimited backend nodes, CI/CD gates & ETL pipelines: https://privacyscrubber.com/pricing?tier=sdk&src=cli_leak_guard\n` +
+                `[PrivacyScrubber] Instant 7-Day Free B2B Trial: npx @privacyscrubber/sdk trial | CISO Approval Memo: npx @privacyscrubber/sdk memo\n\n`
             );
         }
     }
@@ -454,7 +455,11 @@ function sanitize(text, options = {}) {
     if (!text || typeof text !== 'string') {
         return {
             scrubbedText: '',
+            scrubbed: '',
             tokenMap: {},
+            sessionMap: {},
+            matches: [],
+            spans: [],
             count: 0,
             executionMs: 0,
             license: { isPro: false, tier: 'FREE', limit: 15000, wasTruncated: false },
@@ -465,7 +470,7 @@ function sanitize(text, options = {}) {
 
     const {
         profile = 'General',
-        licenseKey = (typeof process !== 'undefined' && process.env?.PRIVACYSCRUBBER_KEY) || '',
+        licenseKey = (typeof process !== 'undefined' && (process.env?.PRIVACYSCRUBBER_KEY || process.env?.PRIVACYSCRUBBER_LICENSE_KEY)) || '',
         customRules = [],
         tokenLabelMap = {},
         existingSessionMap = {},
@@ -478,6 +483,18 @@ function sanitize(text, options = {}) {
 
     const licenseCheck = validateLicense(licenseKey);
     const rawTier = licenseCheck.valid ? (licenseCheck.tier || 'PRO') : 'FREE';
+    const isExpiredKey = !licenseCheck.valid && typeof licenseCheck.error === 'string' && /expired/i.test(licenseCheck.error);
+    const isExpiringSoon = licenseCheck.valid && typeof licenseCheck.expires === 'number' && (licenseCheck.expires - Date.now() <= 48 * 3600 * 1000);
+
+    if (isExpiringSoon && typeof process !== 'undefined' && process.stderr && !globalThis.__psSdkPreExpiryLogged) {
+        globalThis.__psSdkPreExpiryLogged = true;
+        const hrs = Math.max(0, Math.round((licenseCheck.expires - Date.now()) / 3600000));
+        process.stderr.write(
+            `\n[@privacyscrubber/sdk] ⏳ 7-Day Evaluation Key expires in ~${hrs}h. Prevent pipeline interruption:\n` +
+            `  - Commercial SDK ($299/mo flat): https://privacyscrubber.com/pricing/?tier=sdk&utm_source=npm_sdk&utm_medium=pilot_expiring_48h\n` +
+            `  - CISO Approval Memo: npx @privacyscrubber/sdk memo\n\n`
+        );
+    }
 
     // Anti-Cannibalization Barrier (SSOT):
     // PRO ($15/mo) and TEAMS ($99/mo) licenses are strictly human-seat licenses for Web App & Chrome Extension.
@@ -511,7 +528,8 @@ function sanitize(text, options = {}) {
 
     if (!isPro && text.length > limit) {
         if (shouldThrow) {
-            const errorMsg = `[PrivacyScrubber] Free Tier character limit exceeded (${limit.toLocaleString()} chars for profile '${profile}', received ${text.length.toLocaleString()} chars). Upgrade to Developer SDK ($299/mo) for unlimited throughput: https://privacyscrubber.com/pricing?tier=sdk&src=dev_limit`;
+            const expiredPrefix = isExpiredKey ? `[PILOT/TRIAL EXPIRED: ${licenseCheck.error}] ` : '';
+            const errorMsg = `[PrivacyScrubber] ${expiredPrefix}Free Tier character limit exceeded (${limit.toLocaleString()} chars for profile '${profile}', received ${text.length.toLocaleString()} chars). Upgrade to Developer SDK ($299/mo) for unlimited throughput: https://privacyscrubber.com/pricing?tier=sdk&src=${isExpiredKey ? 'pilot_expired' : 'dev_limit'} (Run 'npx @privacyscrubber/sdk memo' for CISO approval memo)`;
             throw new PrivacyScrubberLicenseError(errorMsg, {
                 tier: 'FREE',
                 currentLength: text.length,
@@ -571,6 +589,7 @@ function sanitize(text, options = {}) {
 
     return {
         scrubbedText: finalScrubbedText,
+        scrubbed: finalScrubbedText,
         tokenMap: returnFullSessionMap ? sessionMap : (rawResult.tokenMap || {}),
         sessionMap: sessionMap,
         matches: rawResult.matches || [],
@@ -885,6 +904,9 @@ class PrivacyScrubberEngine {
      * @param {object} [options={}]
      */
     createStreamRestorer(tokenMap = null, options = {}) {
+        if (tokenMap && typeof tokenMap === 'object' && typeof tokenMap.onTokenRestored === 'function' && Object.keys(options).length === 0) {
+            return createStreamTokenRestorer(this.sessionMap, tokenMap);
+        }
         const activeMap = tokenMap || this.sessionMap;
         return createStreamTokenRestorer(activeMap, options);
     }
@@ -1635,7 +1657,7 @@ class StreamingDetokenizer {
         const tailLen = 160;
         const tail = this.pendingBuffer.length > tailLen ? this.pendingBuffer.slice(-tailLen) : this.pendingBuffer;
         const offset = this.pendingBuffer.length > tailLen ? this.pendingBuffer.length - tailLen : 0;
-        const m = tail.match(/(?:(?:\[|【|［|〔|「|『|<|\{\{?|__?|%5[Bb]|\\u005[Bb]|&(?:amp;)?(?:#0*91;|#[xX]0*5[Bb];|lbrack;))[A-Za-z0-9_\-А-Яа-яЁё *`~.\\]{0,128}(?:%5?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?3?|[xX]0*5?[Dd]?)?|r(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)?|%[0-9A-Fa-f]?|\\(?:u(?:0(?:0(?:5)?)?)?)?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?1?|[xX]0*5?)?|l(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)$/);
+        const m = tail.match(/(?:(?:\[|【|［|〔|「|『|<|\{\{?|__?|%5[Bb]|\\u005[Bb]|&(?:amp;)?(?:#0*91;|#[xX]0*5[Bb];|lbrack;))[A-Za-z0-9_\-\u0410-\u044F\u0401\u0451 *`~.\\]{0,128}(?:%5?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?3?|[xX]0*5?[Dd]?)?|r(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)?|%[0-9A-Fa-f]?|\\(?:u(?:0(?:0(?:5)?)?)?)?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?1?|[xX]0*5?)?|l(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)$/);
 
         if (m) {
             const candidate = m[0];
@@ -1724,16 +1746,20 @@ class StreamingDetokenizer {
      * @returns {AsyncGenerator<any>}
      */
     async* wrapStream(asyncIterable) {
+        let lastOpenAIChunk = null;
         for await (const chunk of asyncIterable) {
             if (chunk === null || chunk === undefined) continue;
             // Handle OpenAI chunk object
             if (chunk.choices && Array.isArray(chunk.choices) && chunk.choices[0]?.delta?.content !== undefined) {
+                lastOpenAIChunk = chunk;
                 const delta = chunk.choices[0].delta.content;
                 if (typeof delta === 'string') {
                     const restored = this.feed(delta);
                     if (restored) {
-                        chunk.choices[0].delta.content = restored;
-                        yield chunk;
+                        const clonedChoices = chunk.choices.map((c, idx) =>
+                            idx === 0 ? { ...c, delta: { ...c.delta, content: restored } } : c
+                        );
+                        yield { ...chunk, choices: clonedChoices };
                     }
                 } else {
                     yield chunk;
@@ -1759,7 +1785,16 @@ class StreamingDetokenizer {
         }
 
         const finalChunk = this.flush();
-        if (finalChunk) yield finalChunk;
+        if (finalChunk) {
+            if (lastOpenAIChunk) {
+                const clonedChoices = lastOpenAIChunk.choices.map((c, idx) =>
+                    idx === 0 ? { ...c, delta: { ...c.delta, content: finalChunk } } : c
+                );
+                yield { ...lastOpenAIChunk, choices: clonedChoices };
+            } else {
+                yield finalChunk;
+            }
+        }
     }
 }
 
@@ -1826,8 +1861,8 @@ function createNodeStreamTokenRestorer(tokenMap = {}, options = {}) {
  * @param {Record<string, string>} tokenMap - Volatile token map.
  * @returns {AsyncGenerator<any>}
  */
-async function* wrapAiStream(stream, tokenMap = {}) {
-    const detok = new StreamingDetokenizer(tokenMap);
+async function* wrapAiStream(stream, tokenMap = {}, options = {}) {
+    const detok = new StreamingDetokenizer(tokenMap, options);
     yield* detok.wrapStream(stream);
 }
 
@@ -1917,7 +1952,7 @@ function formatCefEvent(eventData = {}) {
     const {
         vendor = 'PrivacyScrubber',
         product = 'ZTDS',
-        version = '2.4.1',
+        version = '2.4.3',
         eventClassId = 'PII_REDACTION',
         eventName = 'Zero-Trust PII Sanitization Executed',
         riskLevel = 'LOW EXPOSURE',
@@ -1986,7 +2021,7 @@ function formatSyslogEvent(eventData = {}) {
 function formatJsonlEvent(eventData = {}) {
     const {
         timestamp = new Date().toISOString(),
-        version = '2.4.1',
+        version = '2.4.3',
         protocol = 'ZTDS',
         event = 'sanitization',
         riskLevel = 'LOW EXPOSURE',
@@ -2175,7 +2210,7 @@ function buildPsr2Receipt(tokenMap, timestamp = new Date().toISOString()) {
   const labels = (tokenMap && typeof tokenMap === 'object' ? Object.keys(tokenMap) : []).slice().sort();
   const counts = {};
   for (const t of labels) {
-    const m = t.match(/\[([A-Z_]+)_\d+\]/);
+    const m = String(t).trim().match(/^(?:\[|<|\{\{|__)([A-Z0-9_]+)_\d+(?:\]|>|\}\}|__)$/);
     const type = m ? m[1] : 'CUSTOM';
     counts[type] = (counts[type] || 0) + 1;
   }
@@ -2691,8 +2726,22 @@ function createGuardedTools(engineOrOptions = {}, toolConfig = {}) {
     return tools;
 }
 
-// Low-level backwards-compatible exports
-const scrubText = scrubberPkg.scrubText;
+// Low-level backwards-compatible exports (supports both positional customRules array and high-level options object)
+function scrubText(text, customRulesOrOptions = [], ...args) {
+    if (
+        customRulesOrOptions &&
+        typeof customRulesOrOptions === 'object' &&
+        !Array.isArray(customRulesOrOptions) &&
+        args.length === 0
+    ) {
+        return sanitize(text, customRulesOrOptions);
+    }
+    const res = scrubberPkg.scrubText(text, customRulesOrOptions, ...args);
+    if (res && typeof res === 'object' && typeof res.scrubbed === 'undefined') {
+        res.scrubbed = res.scrubbedText;
+    }
+    return res;
+}
 const unscrubText = scrubberPkg.unscrubText;
 
 // Vision & Multimodal exports

package/index.d.ts

@@ -3,8 +3,9 @@
  */
 
 export interface CustomRule {
-    name: string;
-    regex: RegExp;
+    name?: string;
+    pattern?: string;
+    regex?: RegExp;
     mask?: string;
     type?: string;
     label?: string;