@privacyscrubber/sdk 2.4.2 → 2.4.3

package/examples/python-bridge/privacyscrubber/langchain.py

@@ -74,6 +74,9 @@ class ZTDSCallbackHandler(BaseCallbackHandler):
                 print(f"[ZTDS Guard] Sanitized {res.count} PII tokens for run {key}")
 
         self._session_token_maps[key] = combined_token_map
+        if len(self._session_token_maps) > 512:
+            oldest_key = next(iter(self._session_token_maps))
+            self._session_token_maps.pop(oldest_key, None)
 
     def on_llm_end(
         self,
@@ -92,16 +95,37 @@ class ZTDSCallbackHandler(BaseCallbackHandler):
         if generations and isinstance(generations, list):
             for gen_list in generations:
                 for gen in gen_list:
-                    if hasattr(gen, "text") and gen.text:
-                        restored = self.scrubber.restore(gen.text, token_map=token_map)
-                        gen.text = restored.restored_text
-                    elif hasattr(gen, "message") and hasattr(gen.message, "content"):
-                        if isinstance(gen.message.content, str):
-                            restored = self.scrubber.restore(gen.message.content, token_map=token_map)
-                            gen.message.content = restored.restored_text
+                    restored_str: Optional[str] = None
+                    if hasattr(gen, "message") and hasattr(gen.message, "content"):
+                        msg_content = gen.message.content
+                        if isinstance(msg_content, str) and msg_content:
+                            restored_str = self.scrubber.restore(msg_content, token_map=token_map).restored_text
+                            gen.message.content = restored_str
+                        elif isinstance(msg_content, list):
+                            for block in msg_content:
+                                if isinstance(block, dict) and isinstance(block.get("text"), str) and block["text"]:
+                                    block["text"] = self.scrubber.restore(block["text"], token_map=token_map).restored_text
+                    if hasattr(gen, "text") and isinstance(getattr(gen, "text", None), str) and gen.text:
+                        try:
+                            gen.text = restored_str if restored_str is not None else self.scrubber.restore(gen.text, token_map=token_map).restored_text
+                        except (AttributeError, TypeError):
+                            pass
 
         return response
 
+    def on_llm_error(
+        self,
+        error: BaseException,
+        *,
+        run_id: Optional[Any] = None,
+        parent_run_id: Optional[Any] = None,
+        tags: Optional[List[str]] = None,
+        **kwargs: Any
+    ) -> Any:
+        """Cleans up ephemeral token maps if the LLM call fails."""
+        key = str(run_id) if run_id else "default"
+        self._session_token_maps.pop(key, None)
+
 
 class ZTDSDocumentTransformer:
     """

package/examples/python-bridge/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "privacyscrubber"
-version = "2.4.2"
+version = "2.4.3"
 description = "Zero-Trust Data Sanitization & In-Memory PII Shield for Python AI Pipelines (ZTDS RFC v1.0)"
 readme = "README.md"
 requires-python = ">=3.8"

package/examples/python-bridge/setup.py

@@ -13,7 +13,7 @@ with open(os.path.join(here, "README.md"), encoding="utf-8") as f:
 
 setup(
     name="privacyscrubber",
-    version="2.4.2",
+    version="2.4.3",
     description="Zero-Trust Data Sanitization & In-Memory PII Shield for Python AI Pipelines (ZTDS RFC v1.0)",
     long_description=long_description,
     long_description_content_type="text/markdown",

package/examples/python-bridge/test_python_bridge.py

@@ -312,7 +312,7 @@ class TestPrivacyScrubberBridge(unittest.TestCase):
             cwd=bridge_dir,
             env=sub_env
         )
-        self.assertIn("2.4.2", ver_out)
+        self.assertIn("2.4.3", ver_out)
 
 
 if __name__ == "__main__":

package/fastmcp.cjs

@@ -19,12 +19,12 @@ const ZTDS_PATTERNS = {
   CREDIT_CARD: /\b(?:\d{4}[-\s]?){3}\d{4}\b/g,
   EMAIL: /[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9-]{1,63}(?:\.[A-Za-z0-9-]{1,63})*\.[A-Za-z]{2,24}/g,
   IBAN: /\b[A-Z]{2}[0-9]{2}[A-Z0-9]{4}[0-9]{7}(?:[A-Z0-9]?){0,16}\b/g,
-  IPV4: /\b(?:\d{1,3}\.){3}\d{1,3}\b/g,
+  IPV4: /\b(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\b/g,
   PHONE: /(?:(?:\+?1\s*(?:[.-]\s*)?)?(?:\(\s*([2-9]1[02-9]|[2-9][02-8]1|[2-9][02-8][02-9])\s*\)|([2-9]1[02-9]|[2-9][02-8]1|[2-9][02-8][02-9]))\s*(?:[.-]\s*)?)?([2-9]1[02-9]|[2-9][02-8]1|[2-9][02-8]{2})\s*(?:[.-]\s*)?([0-9]{4})\b/g,
   SSN: /\b\d{3}-\d{2}-\d{4}\b/g,
 };
 
-const TOKEN_PATTERN = /(?:%5[Bb]|\\u005[Bb]|&(?:amp;)?#0*91;|\[|<|\{\{?|__|【|［)[*`_~\s]*([A-Z_]+)_TOKEN_([a-zA-Z0-9_-]+)[*`_~.,;:!?\s]*(?:%5[Dd]|\\u005[Dd]|&(?:amp;)?#0*93;|\]|>|\}\}?|__|】|］)/gi;
+const TOKEN_PATTERN = /(?:%5[Bb]|\\u005[Bb]|&(?:amp;)?(?:#0*91;|#[xX]0*5[Bb];|lbrack;|lsqb;)|\[|<|\{\{?|__|【|［|〔|「|『)[*`_~\s]*([A-Z0-9_]+)[*`_~]*[-_\s]+TOKEN[*`_~]*[-_\s]+([a-zA-Z0-9_-]+)[*`_~.,;:!?\s]*(?:%5[Dd]|\\u005[Dd]|&(?:amp;)?(?:#0*93;|#[xX]0*5[Dd];|rbrack;|rsqb;)|\]|>|\}\}?|__|】|］|〕|」|』)/gi;
 
 function escapeRegex(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -166,7 +166,7 @@ class StreamingDetokenizer {
     const tailLen = 160;
     const tail = this.pendingBuffer.length > tailLen ? this.pendingBuffer.slice(-tailLen) : this.pendingBuffer;
     const offset = this.pendingBuffer.length > tailLen ? this.pendingBuffer.length - tailLen : 0;
-    const m = tail.match(/(?:(?:\[|【|［|〔|「|『|<|\{\{?|__?|%5[Bb]|\\u005[Bb]|&(?:amp;)?(?:#0*91;|#[xX]0*5[Bb];|lbrack;))[A-Za-z0-9_\-А-Яа-яЁё *`~.\\]{0,128}(?:%5?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?3?|[xX]0*5?[Dd]?)?|r(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)?|%[0-9A-Fa-f]?|\\(?:u(?:0(?:0(?:5)?)?)?)?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?1?|[xX]0*5?)?|l(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)$/);
+    const m = tail.match(/(?:(?:\[|【|［|〔|「|『|<|\{\{?|__?|%5[Bb]|\\u005[Bb]|&(?:amp;)?(?:#0*91;|#[xX]0*5[Bb];|lbrack;))[A-Za-z0-9_\-\u0410-\u044F\u0401\u0451 *`~.\\]{0,128}(?:%5?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?3?|[xX]0*5?[Dd]?)?|r(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)?|%[0-9A-Fa-f]?|\\(?:u(?:0(?:0(?:5)?)?)?)?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?1?|[xX]0*5?)?|l(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)$/);
 
     if (m) {
       const candidate = m[0];
@@ -242,10 +242,11 @@ class ZTDSFastMCPGuard {
     this.maxSessionTokens = options.maxSessionTokens || 5000;
     this._sessionMaps = new Map();
     this._entityMaps = new Map();
+    this._sessionCounters = new Map();
     this._streamDetokenizers = new Map();
   }
 
-  _generateToken(entityType, tokenMap) {
+  _generateToken(entityType, tokenMap, counters) {
     if (this.useCryptoTokens) {
       for (let i = 0; i < 100; i++) {
         const hex = crypto.randomBytes(4).toString("hex");
@@ -255,13 +256,25 @@ class ZTDSFastMCPGuard {
         }
       }
     }
+    if (counters && typeof counters.get === "function") {
+      let nextIdx = (counters.get(entityType) || 0) + 1;
+      while (tokenMap.has(`[${entityType}_TOKEN_${nextIdx}]`)) {
+        nextIdx++;
+      }
+      counters.set(entityType, nextIdx);
+      return `[${entityType}_TOKEN_${nextIdx}]`;
+    }
     let count = 0;
     for (const k of tokenMap.keys()) {
       if (k.startsWith(`[${entityType}_TOKEN_`)) {
         count++;
       }
     }
-    return `[${entityType}_TOKEN_${count + 1}]`;
+    let idx = count + 1;
+    while (tokenMap.has(`[${entityType}_TOKEN_${idx}]`)) {
+      idx++;
+    }
+    return `[${entityType}_TOKEN_${idx}]`;
   }
 
   sanitizeText(text, sessionId) {
@@ -272,10 +285,12 @@ class ZTDSFastMCPGuard {
     if (!this._sessionMaps.has(sessionId)) {
       this._sessionMaps.set(sessionId, new Map());
       this._entityMaps.set(sessionId, new Map());
+      this._sessionCounters.set(sessionId, new Map());
     }
 
     const tokenMap = this._sessionMaps.get(sessionId);
     const entityMap = this._entityMaps.get(sessionId);
+    const counters = this._sessionCounters.get(sessionId);
     let sanitized = text
       .replace(/[\u200B-\u200F\u202A-\u202E\u2060-\u206F\uFEFF\u00AD]/g, "")
       .replace(/[\uFF01-\uFF5E]/g, (ch) => String.fromCharCode(ch.charCodeAt(0) - 0xFEE0));
@@ -288,11 +303,14 @@ class ZTDSFastMCPGuard {
         continue;
       }
 
-      const regex = new RegExp(`(\\[[A-Z_]+_TOKEN_[a-zA-Z0-9_-]+\\])|(?:${pattern.source})`, "g");
+      const regex = new RegExp(`(\\[[A-Z0-9_]+_TOKEN_[a-zA-Z0-9_-]+\\])|(?:${pattern.source})`, "g");
       sanitized = sanitized.replace(regex, (match, existingToken) => {
         if (existingToken) {
           return existingToken;
         }
+        if (entityType === "IPV4" && (match.startsWith("127.0.0.") || match === "0.0.0.0")) {
+          return match;
+        }
         if (entityMap.has(match)) {
           return entityMap.get(match);
         }
@@ -304,7 +322,7 @@ class ZTDSFastMCPGuard {
             entityMap.delete(oldestMatch);
           }
         }
-        const token = this._generateToken(entityType, tokenMap);
+        const token = this._generateToken(entityType, tokenMap, counters);
         tokenMap.set(token, match);
         entityMap.set(match, token);
         return token;
@@ -328,8 +346,16 @@ class ZTDSFastMCPGuard {
     }
 
     return text.replace(TOKEN_PATTERN, (match, entityType, tokenId) => {
-      const canonical = `[${entityType.toUpperCase()}_TOKEN_${tokenId}]`;
-      return tokenMap.get(canonical) || tokenMap.get(match) || match;
+      const upperType = entityType.toUpperCase();
+      const canonical = `[${upperType}_TOKEN_${tokenId}]`;
+      if (tokenMap.has(canonical)) return tokenMap.get(canonical);
+      const lowerHex = `[${upperType}_TOKEN_${tokenId.toLowerCase()}]`;
+      if (tokenMap.has(lowerHex)) return tokenMap.get(lowerHex);
+      if (/^\d+$/.test(tokenId)) {
+        const stripped = `[${upperType}_TOKEN_${parseInt(tokenId, 10)}]`;
+        if (tokenMap.has(stripped)) return tokenMap.get(stripped);
+      }
+      return tokenMap.get(match) || match;
     });
   }
 
@@ -340,6 +366,9 @@ class ZTDSFastMCPGuard {
     if (Array.isArray(val)) {
       return val.map((item) => this.sanitizeObject(item, sessionId));
     }
+    if (val instanceof Date || val instanceof RegExp || val instanceof Uint8Array || (typeof Buffer !== "undefined" && Buffer.isBuffer(val))) {
+      return val;
+    }
     if (val !== null && typeof val === "object") {
       const result = {};
       for (const [k, v] of Object.entries(val)) {
@@ -357,6 +386,9 @@ class ZTDSFastMCPGuard {
     if (Array.isArray(val)) {
       return val.map((item) => this.restoreObject(item, sessionId));
     }
+    if (val instanceof Date || val instanceof RegExp || val instanceof Uint8Array || (typeof Buffer !== "undefined" && Buffer.isBuffer(val))) {
+      return val;
+    }
     if (val !== null && typeof val === "object") {
       const result = {};
       for (const [k, v] of Object.entries(val)) {
@@ -525,6 +557,10 @@ class ZTDSFastMCPGuard {
       this._entityMaps.get(sessionId).clear();
       this._entityMaps.delete(sessionId);
     }
+    if (this._sessionCounters && this._sessionCounters.has(sessionId)) {
+      this._sessionCounters.get(sessionId).clear();
+      this._sessionCounters.delete(sessionId);
+    }
     if (this._streamDetokenizers.has(sessionId)) {
       this._streamDetokenizers.get(sessionId).reset();
       this._streamDetokenizers.delete(sessionId);

package/index.cjs

@@ -129,7 +129,7 @@ function buildAuditTelemetry(currentTokenMap = {}) {
             if (!t) continue;
             const tokenStr = typeof t === 'string' ? t : ((t && (t.token || t.mask)) ? String(t.token || t.mask) : '');
             if (!tokenStr) continue;
-            const match = tokenStr.match(/\[([A-Z_]+)_\d+\]/);
+            const match = tokenStr.match(/\[([A-Z0-9_]+)_\d+\]/);
             const baseType = match ? match[1] : (tokenStr.replace(/\[|\]/g, '').replace(/_[0-9]+$/, '') || 'CUSTOM');
             entities[baseType] = (entities[baseType] || 0) + 1;
             totalCount++;
@@ -455,7 +455,11 @@ function sanitize(text, options = {}) {
     if (!text || typeof text !== 'string') {
         return {
             scrubbedText: '',
+            scrubbed: '',
             tokenMap: {},
+            sessionMap: {},
+            matches: [],
+            spans: [],
             count: 0,
             executionMs: 0,
             license: { isPro: false, tier: 'FREE', limit: 15000, wasTruncated: false },
@@ -466,7 +470,7 @@ function sanitize(text, options = {}) {
 
     const {
         profile = 'General',
-        licenseKey = (typeof process !== 'undefined' && process.env?.PRIVACYSCRUBBER_KEY) || '',
+        licenseKey = (typeof process !== 'undefined' && (process.env?.PRIVACYSCRUBBER_KEY || process.env?.PRIVACYSCRUBBER_LICENSE_KEY)) || '',
         customRules = [],
         tokenLabelMap = {},
         existingSessionMap = {},
@@ -585,6 +589,7 @@ function sanitize(text, options = {}) {
 
     return {
         scrubbedText: finalScrubbedText,
+        scrubbed: finalScrubbedText,
         tokenMap: returnFullSessionMap ? sessionMap : (rawResult.tokenMap || {}),
         sessionMap: sessionMap,
         matches: rawResult.matches || [],
@@ -899,6 +904,9 @@ class PrivacyScrubberEngine {
      * @param {object} [options={}]
      */
     createStreamRestorer(tokenMap = null, options = {}) {
+        if (tokenMap && typeof tokenMap === 'object' && typeof tokenMap.onTokenRestored === 'function' && Object.keys(options).length === 0) {
+            return createStreamTokenRestorer(this.sessionMap, tokenMap);
+        }
         const activeMap = tokenMap || this.sessionMap;
         return createStreamTokenRestorer(activeMap, options);
     }
@@ -1649,7 +1657,7 @@ class StreamingDetokenizer {
         const tailLen = 160;
         const tail = this.pendingBuffer.length > tailLen ? this.pendingBuffer.slice(-tailLen) : this.pendingBuffer;
         const offset = this.pendingBuffer.length > tailLen ? this.pendingBuffer.length - tailLen : 0;
-        const m = tail.match(/(?:(?:\[|【|［|〔|「|『|<|\{\{?|__?|%5[Bb]|\\u005[Bb]|&(?:amp;)?(?:#0*91;|#[xX]0*5[Bb];|lbrack;))[A-Za-z0-9_\-А-Яа-яЁё *`~.\\]{0,128}(?:%5?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?3?|[xX]0*5?[Dd]?)?|r(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)?|%[0-9A-Fa-f]?|\\(?:u(?:0(?:0(?:5)?)?)?)?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?1?|[xX]0*5?)?|l(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)$/);
+        const m = tail.match(/(?:(?:\[|【|［|〔|「|『|<|\{\{?|__?|%5[Bb]|\\u005[Bb]|&(?:amp;)?(?:#0*91;|#[xX]0*5[Bb];|lbrack;))[A-Za-z0-9_\-\u0410-\u044F\u0401\u0451 *`~.\\]{0,128}(?:%5?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?3?|[xX]0*5?[Dd]?)?|r(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)?|%[0-9A-Fa-f]?|\\(?:u(?:0(?:0(?:5)?)?)?)?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?1?|[xX]0*5?)?|l(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)$/);
 
         if (m) {
             const candidate = m[0];
@@ -1738,16 +1746,20 @@ class StreamingDetokenizer {
      * @returns {AsyncGenerator<any>}
      */
     async* wrapStream(asyncIterable) {
+        let lastOpenAIChunk = null;
         for await (const chunk of asyncIterable) {
             if (chunk === null || chunk === undefined) continue;
             // Handle OpenAI chunk object
             if (chunk.choices && Array.isArray(chunk.choices) && chunk.choices[0]?.delta?.content !== undefined) {
+                lastOpenAIChunk = chunk;
                 const delta = chunk.choices[0].delta.content;
                 if (typeof delta === 'string') {
                     const restored = this.feed(delta);
                     if (restored) {
-                        chunk.choices[0].delta.content = restored;
-                        yield chunk;
+                        const clonedChoices = chunk.choices.map((c, idx) =>
+                            idx === 0 ? { ...c, delta: { ...c.delta, content: restored } } : c
+                        );
+                        yield { ...chunk, choices: clonedChoices };
                     }
                 } else {
                     yield chunk;
@@ -1773,7 +1785,16 @@ class StreamingDetokenizer {
         }
 
         const finalChunk = this.flush();
-        if (finalChunk) yield finalChunk;
+        if (finalChunk) {
+            if (lastOpenAIChunk) {
+                const clonedChoices = lastOpenAIChunk.choices.map((c, idx) =>
+                    idx === 0 ? { ...c, delta: { ...c.delta, content: finalChunk } } : c
+                );
+                yield { ...lastOpenAIChunk, choices: clonedChoices };
+            } else {
+                yield finalChunk;
+            }
+        }
     }
 }
 
@@ -1840,8 +1861,8 @@ function createNodeStreamTokenRestorer(tokenMap = {}, options = {}) {
  * @param {Record<string, string>} tokenMap - Volatile token map.
  * @returns {AsyncGenerator<any>}
  */
-async function* wrapAiStream(stream, tokenMap = {}) {
-    const detok = new StreamingDetokenizer(tokenMap);
+async function* wrapAiStream(stream, tokenMap = {}, options = {}) {
+    const detok = new StreamingDetokenizer(tokenMap, options);
     yield* detok.wrapStream(stream);
 }
 
@@ -1931,7 +1952,7 @@ function formatCefEvent(eventData = {}) {
     const {
         vendor = 'PrivacyScrubber',
         product = 'ZTDS',
-        version = '2.4.2',
+        version = '2.4.3',
         eventClassId = 'PII_REDACTION',
         eventName = 'Zero-Trust PII Sanitization Executed',
         riskLevel = 'LOW EXPOSURE',
@@ -2000,7 +2021,7 @@ function formatSyslogEvent(eventData = {}) {
 function formatJsonlEvent(eventData = {}) {
     const {
         timestamp = new Date().toISOString(),
-        version = '2.4.2',
+        version = '2.4.3',
         protocol = 'ZTDS',
         event = 'sanitization',
         riskLevel = 'LOW EXPOSURE',
@@ -2189,7 +2210,7 @@ function buildPsr2Receipt(tokenMap, timestamp = new Date().toISOString()) {
   const labels = (tokenMap && typeof tokenMap === 'object' ? Object.keys(tokenMap) : []).slice().sort();
   const counts = {};
   for (const t of labels) {
-    const m = t.match(/\[([A-Z_]+)_\d+\]/);
+    const m = String(t).trim().match(/^(?:\[|<|\{\{|__)([A-Z0-9_]+)_\d+(?:\]|>|\}\}|__)$/);
     const type = m ? m[1] : 'CUSTOM';
     counts[type] = (counts[type] || 0) + 1;
   }
@@ -2705,8 +2726,22 @@ function createGuardedTools(engineOrOptions = {}, toolConfig = {}) {
     return tools;
 }
 
-// Low-level backwards-compatible exports
-const scrubText = scrubberPkg.scrubText;
+// Low-level backwards-compatible exports (supports both positional customRules array and high-level options object)
+function scrubText(text, customRulesOrOptions = [], ...args) {
+    if (
+        customRulesOrOptions &&
+        typeof customRulesOrOptions === 'object' &&
+        !Array.isArray(customRulesOrOptions) &&
+        args.length === 0
+    ) {
+        return sanitize(text, customRulesOrOptions);
+    }
+    const res = scrubberPkg.scrubText(text, customRulesOrOptions, ...args);
+    if (res && typeof res === 'object' && typeof res.scrubbed === 'undefined') {
+        res.scrubbed = res.scrubbedText;
+    }
+    return res;
+}
 const unscrubText = scrubberPkg.unscrubText;
 
 // Vision & Multimodal exports

package/index.d.ts

@@ -3,8 +3,9 @@
  */
 
 export interface CustomRule {
-    name: string;
-    regex: RegExp;
+    name?: string;
+    pattern?: string;
+    regex?: RegExp;
     mask?: string;
     type?: string;
     label?: string;

package/index.js

@@ -131,7 +131,7 @@ export function buildAuditTelemetry(currentTokenMap = {}) {
             if (!t) continue;
             const tokenStr = typeof t === 'string' ? t : ((t && (t.token || t.mask)) ? String(t.token || t.mask) : '');
             if (!tokenStr) continue;
-            const match = tokenStr.match(/\[([A-Z_]+)_\d+\]/);
+            const match = tokenStr.match(/\[([A-Z0-9_]+)_\d+\]/);
             const baseType = match ? match[1] : (tokenStr.replace(/\[|\]/g, '').replace(/_[0-9]+$/, '') || 'CUSTOM');
             entities[baseType] = (entities[baseType] || 0) + 1;
             totalCount++;
@@ -457,7 +457,11 @@ export function sanitize(text, options = {}) {
     if (!text || typeof text !== 'string') {
         return {
             scrubbedText: '',
+            scrubbed: '',
             tokenMap: {},
+            sessionMap: {},
+            matches: [],
+            spans: [],
             count: 0,
             executionMs: 0,
             license: { isPro: false, tier: 'FREE', limit: 15000, wasTruncated: false },
@@ -468,7 +472,7 @@ export function sanitize(text, options = {}) {
 
     const {
         profile = 'General',
-        licenseKey = (typeof process !== 'undefined' && process.env?.PRIVACYSCRUBBER_KEY) || '',
+        licenseKey = (typeof process !== 'undefined' && (process.env?.PRIVACYSCRUBBER_KEY || process.env?.PRIVACYSCRUBBER_LICENSE_KEY)) || '',
         customRules = [],
         tokenLabelMap = {},
         existingSessionMap = {},
@@ -587,6 +591,7 @@ export function sanitize(text, options = {}) {
 
     return {
         scrubbedText: finalScrubbedText,
+        scrubbed: finalScrubbedText,
         tokenMap: returnFullSessionMap ? sessionMap : (rawResult.tokenMap || {}),
         sessionMap: sessionMap,
         matches: rawResult.matches || [],
@@ -901,6 +906,9 @@ export class PrivacyScrubberEngine {
      * @param {object} [options={}]
      */
     createStreamRestorer(tokenMap = null, options = {}) {
+        if (tokenMap && typeof tokenMap === 'object' && typeof tokenMap.onTokenRestored === 'function' && Object.keys(options).length === 0) {
+            return createStreamTokenRestorer(this.sessionMap, tokenMap);
+        }
         const activeMap = tokenMap || this.sessionMap;
         return createStreamTokenRestorer(activeMap, options);
     }
@@ -1651,7 +1659,7 @@ export class StreamingDetokenizer {
         const tailLen = 160;
         const tail = this.pendingBuffer.length > tailLen ? this.pendingBuffer.slice(-tailLen) : this.pendingBuffer;
         const offset = this.pendingBuffer.length > tailLen ? this.pendingBuffer.length - tailLen : 0;
-        const m = tail.match(/(?:(?:\[|【|［|〔|「|『|<|\{\{?|__?|%5[Bb]|\\u005[Bb]|&(?:amp;)?(?:#0*91;|#[xX]0*5[Bb];|lbrack;))[A-Za-z0-9_\-А-Яа-яЁё *`~.\\]{0,128}(?:%5?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?3?|[xX]0*5?[Dd]?)?|r(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)?|%[0-9A-Fa-f]?|\\(?:u(?:0(?:0(?:5)?)?)?)?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?1?|[xX]0*5?)?|l(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)$/);
+        const m = tail.match(/(?:(?:\[|【|［|〔|「|『|<|\{\{?|__?|%5[Bb]|\\u005[Bb]|&(?:amp;)?(?:#0*91;|#[xX]0*5[Bb];|lbrack;))[A-Za-z0-9_\-\u0410-\u044F\u0401\u0451 *`~.\\]{0,128}(?:%5?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?3?|[xX]0*5?[Dd]?)?|r(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)?|%[0-9A-Fa-f]?|\\(?:u(?:0(?:0(?:5)?)?)?)?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?1?|[xX]0*5?)?|l(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)$/);
 
         if (m) {
             const candidate = m[0];
@@ -1740,16 +1748,20 @@ export class StreamingDetokenizer {
      * @returns {AsyncGenerator<any>}
      */
     async* wrapStream(asyncIterable) {
+        let lastOpenAIChunk = null;
         for await (const chunk of asyncIterable) {
             if (chunk === null || chunk === undefined) continue;
             // Handle OpenAI chunk object
             if (chunk.choices && Array.isArray(chunk.choices) && chunk.choices[0]?.delta?.content !== undefined) {
+                lastOpenAIChunk = chunk;
                 const delta = chunk.choices[0].delta.content;
                 if (typeof delta === 'string') {
                     const restored = this.feed(delta);
                     if (restored) {
-                        chunk.choices[0].delta.content = restored;
-                        yield chunk;
+                        const clonedChoices = chunk.choices.map((c, idx) =>
+                            idx === 0 ? { ...c, delta: { ...c.delta, content: restored } } : c
+                        );
+                        yield { ...chunk, choices: clonedChoices };
                     }
                 } else {
                     yield chunk;
@@ -1775,7 +1787,16 @@ export class StreamingDetokenizer {
         }
 
         const finalChunk = this.flush();
-        if (finalChunk) yield finalChunk;
+        if (finalChunk) {
+            if (lastOpenAIChunk) {
+                const clonedChoices = lastOpenAIChunk.choices.map((c, idx) =>
+                    idx === 0 ? { ...c, delta: { ...c.delta, content: finalChunk } } : c
+                );
+                yield { ...lastOpenAIChunk, choices: clonedChoices };
+            } else {
+                yield finalChunk;
+            }
+        }
     }
 }
 
@@ -1842,8 +1863,8 @@ export function createNodeStreamTokenRestorer(tokenMap = {}, options = {}) {
  * @param {Record<string, string>} tokenMap - Volatile token map.
  * @returns {AsyncGenerator<any>}
  */
-export async function* wrapAiStream(stream, tokenMap = {}) {
-    const detok = new StreamingDetokenizer(tokenMap);
+export async function* wrapAiStream(stream, tokenMap = {}, options = {}) {
+    const detok = new StreamingDetokenizer(tokenMap, options);
     yield* detok.wrapStream(stream);
 }
 
@@ -1933,7 +1954,7 @@ export function formatCefEvent(eventData = {}) {
     const {
         vendor = 'PrivacyScrubber',
         product = 'ZTDS',
-        version = '2.4.2',
+        version = '2.4.3',
         eventClassId = 'PII_REDACTION',
         eventName = 'Zero-Trust PII Sanitization Executed',
         riskLevel = 'LOW EXPOSURE',
@@ -2002,7 +2023,7 @@ export function formatSyslogEvent(eventData = {}) {
 export function formatJsonlEvent(eventData = {}) {
     const {
         timestamp = new Date().toISOString(),
-        version = '2.4.2',
+        version = '2.4.3',
         protocol = 'ZTDS',
         event = 'sanitization',
         riskLevel = 'LOW EXPOSURE',
@@ -2191,7 +2212,7 @@ export function buildPsr2Receipt(tokenMap, timestamp = new Date().toISOString())
   const labels = (tokenMap && typeof tokenMap === 'object' ? Object.keys(tokenMap) : []).slice().sort();
   const counts = {};
   for (const t of labels) {
-    const m = t.match(/\[([A-Z_]+)_\d+\]/);
+    const m = String(t).trim().match(/^(?:\[|<|\{\{|__)([A-Z0-9_]+)_\d+(?:\]|>|\}\}|__)$/);
     const type = m ? m[1] : 'CUSTOM';
     counts[type] = (counts[type] || 0) + 1;
   }
@@ -2707,8 +2728,22 @@ export function createGuardedTools(engineOrOptions = {}, toolConfig = {}) {
     return tools;
 }
 
-// Low-level backwards-compatible exports
-export const scrubText = scrubberPkg.scrubText;
+// Low-level backwards-compatible exports (supports both positional customRules array and high-level options object)
+export function scrubText(text, customRulesOrOptions = [], ...args) {
+    if (
+        customRulesOrOptions &&
+        typeof customRulesOrOptions === 'object' &&
+        !Array.isArray(customRulesOrOptions) &&
+        args.length === 0
+    ) {
+        return sanitize(text, customRulesOrOptions);
+    }
+    const res = scrubberPkg.scrubText(text, customRulesOrOptions, ...args);
+    if (res && typeof res === 'object' && typeof res.scrubbed === 'undefined') {
+        res.scrubbed = res.scrubbedText;
+    }
+    return res;
+}
 export const unscrubText = scrubberPkg.unscrubText;
 
 // Vision & Multimodal exports

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@privacyscrubber/sdk",
-  "version": "2.4.2",
+  "version": "2.4.3",
   "description": "In-process consumer privacy defense and pre-emptive PII interception SDK for Node.js, Next.js, and AI pipelines. Zero data loss, zero third parties, sub-millisecond in-memory execution.",
   "main": "index.cjs",
   "module": "index.js",
@@ -31,6 +31,11 @@
       "import": "./vercel-ai.js",
       "require": "./vercel-ai.cjs",
       "default": "./vercel-ai.js"
+    },
+    "./sarif": {
+      "import": "./sarif.js",
+      "require": "./sarif.cjs",
+      "default": "./sarif.js"
     }
   },
   "publishConfig": {
@@ -49,6 +54,8 @@
     "vercel-ai.js",
     "vercel-ai.cjs",
     "vercel-ai.d.ts",
+    "sarif.js",
+    "sarif.cjs",
     "index.d.ts",
     "cli.js",
     "benchmark.js",

package/polyfill.js

@@ -1,33 +1,51 @@
-import crypto from 'crypto';
+const _root = typeof globalThis !== 'undefined'
+    ? globalThis
+    : (typeof global !== 'undefined' ? global : (typeof self !== 'undefined' ? self : null));
 
-if (typeof global !== 'undefined') {
-    if (typeof global.window === 'undefined') {
-        global.window = {
+if (_root) {
+    if (typeof _root.window === 'undefined') {
+        _root.window = {
             crypto: {
-                getRandomValues: (arr) => crypto.randomFillSync(arr)
+                getRandomValues: (arr) => {
+                    if (typeof _root.crypto !== 'undefined' && typeof _root.crypto.getRandomValues === 'function') {
+                        return _root.crypto.getRandomValues(arr);
+                    }
+                    try {
+                        if (typeof require === 'function') {
+                            const nodeCrypto = require('crypto');
+                            if (nodeCrypto && typeof nodeCrypto.randomFillSync === 'function') {
+                                return nodeCrypto.randomFillSync(arr);
+                            }
+                        }
+                    } catch (_) {}
+                    for (let i = 0; i < arr.length; i++) {
+                        arr[i] = Math.floor(Math.random() * 256);
+                    }
+                    return arr;
+                }
             },
             addEventListener: () => {},
             location: { search: '', hash: '' }
         };
     }
-    if (typeof global.document === 'undefined') {
-        global.document = {
+    if (typeof _root.document === 'undefined') {
+        _root.document = {
             readyState: 'complete',
             getElementById: () => null,
             addEventListener: () => {}
         };
     }
-    if (typeof global.localStorage === 'undefined') {
-        global.localStorage = {
+    if (typeof _root.localStorage === 'undefined') {
+        _root.localStorage = {
             getItem: () => null,
             setItem: () => {},
             removeItem: () => {}
         };
     }
-    if (typeof global.atob === 'undefined') {
-        global.atob = (str) => Buffer.from(str, 'base64').toString('binary');
+    if (typeof _root.atob === 'undefined' && typeof Buffer !== 'undefined') {
+        _root.atob = (str) => Buffer.from(str, 'base64').toString('binary');
     }
-    if (typeof global.btoa === 'undefined') {
-        global.btoa = (str) => Buffer.from(str, 'binary').toString('base64');
+    if (typeof _root.btoa === 'undefined' && typeof Buffer !== 'undefined') {
+        _root.btoa = (str) => Buffer.from(str, 'binary').toString('base64');
     }
 }