@privacyscrubber/sdk 2.4.2 → 2.4.4

package/vercel-ai.cjs

@@ -33,6 +33,30 @@ const tokenMapsWeakMap = new WeakMap();
  * @param {Record<string, string>} sessionTokenMap - Volatile map populated with detected tokens.
  * @returns {any} Sanitized prompt with tokens replacing authentic PII.
  */
+function sanitizeDeepValue(val, engine, sessionTokenMap) {
+  if (val === null || val === undefined) return val;
+  if (typeof val === 'string') {
+    if (!val.trim()) return val;
+    const res = engine.sanitize(val, { existingSessionMap: sessionTokenMap });
+    Object.assign(sessionTokenMap, res.tokenMap);
+    return res.scrubbedText;
+  }
+  if (Array.isArray(val)) {
+    return val.map(item => sanitizeDeepValue(item, engine, sessionTokenMap));
+  }
+  if (val instanceof Date || val instanceof RegExp || val instanceof Uint8Array || (typeof Buffer !== 'undefined' && Buffer.isBuffer(val))) {
+    return val;
+  }
+  if (typeof val === 'object') {
+    const out = {};
+    for (const [k, v] of Object.entries(val)) {
+      out[k] = sanitizeDeepValue(v, engine, sessionTokenMap);
+    }
+    return out;
+  }
+  return val;
+}
+
 function sanitizePromptParts(prompt, engine, sessionTokenMap) {
   if (!prompt) return prompt;
 
@@ -57,15 +81,23 @@ function sanitizePromptParts(prompt, engine, sessionTokenMap) {
     // Multipart content: { role: 'user', content: [{ type: 'text', text: '...' }] }
     if (Array.isArray(msg.content)) {
       const newContent = msg.content.map(part => {
-        if (part && part.type === 'text' && typeof part.text === 'string') {
+        if (part && (part.type === 'text' || part.type === 'reasoning') && typeof part.text === 'string') {
           const res = engine.sanitize(part.text, { existingSessionMap: sessionTokenMap });
           Object.assign(sessionTokenMap, res.tokenMap);
           return { ...part, text: res.scrubbedText };
         }
-        if (part && part.type === 'tool-result' && typeof part.result === 'string') {
-          const res = engine.sanitize(part.result, { existingSessionMap: sessionTokenMap });
-          Object.assign(sessionTokenMap, res.tokenMap);
-          return { ...part, result: res.scrubbedText };
+        if (part && part.type === 'tool-result') {
+          if (typeof part.result === 'string') {
+            const res = engine.sanitize(part.result, { existingSessionMap: sessionTokenMap });
+            Object.assign(sessionTokenMap, res.tokenMap);
+            return { ...part, result: res.scrubbedText };
+          }
+          if (part.result && typeof part.result === 'object') {
+            return { ...part, result: sanitizeDeepValue(part.result, engine, sessionTokenMap) };
+          }
+          if (part.output !== undefined) {
+            return { ...part, output: sanitizeDeepValue(part.output, engine, sessionTokenMap) };
+          }
         }
         return part;
       });
@@ -145,6 +177,14 @@ function createPrivacyMiddleware(options = {}) {
         if (typeof result.reasoning === 'string') {
           result.reasoning = detokenizeText(result.reasoning, tokenMap);
         }
+        if (Array.isArray(result.toolCalls)) {
+          result.toolCalls = result.toolCalls.map(tc => {
+            if (tc && typeof tc.args === 'string') {
+              return { ...tc, args: detokenizeText(tc.args, tokenMap) };
+            }
+            return tc;
+          });
+        }
       }
 
       return result;
@@ -335,11 +375,13 @@ function createDetokenizerTransformStream(tokenMap = {}, options = {}) {
  */
 async function* detokenizeStream(stream, tokenMap = {}, options = {}) {
   const detok = new StreamingDetokenizer(tokenMap, options);
+  let isObjectStream = false;
   for await (const chunk of stream) {
     if (typeof chunk === 'string') {
       const out = detok.feed(chunk);
       if (out) yield out;
     } else if (chunk && typeof chunk === 'object' && typeof chunk.textDelta === 'string') {
+      isObjectStream = true;
       const out = detok.feed(chunk.textDelta);
       if (out) yield { ...chunk, textDelta: out };
     } else {
@@ -348,7 +390,11 @@ async function* detokenizeStream(stream, tokenMap = {}, options = {}) {
   }
   const rem = detok.flush();
   if (rem) {
-    yield rem;
+    if (isObjectStream) {
+      yield { type: 'text-delta', textDelta: rem };
+    } else {
+      yield rem;
+    }
   }
 }
 

package/vision.cjs

@@ -64,7 +64,7 @@ function stripExifMetadata(inputBuffer) {
 
       const length = (u8[offset + 2] << 8) | u8[offset + 3];
       const segmentEnd = offset + 2 + length;
-      if (segmentEnd > u8.length) {
+      if (length < 2 || segmentEnd > u8.length) {
         chunks.push(u8.subarray(offset));
         break;
       }
@@ -140,11 +140,11 @@ function stripExifMetadata(inputBuffer) {
     const ANCILLARY_TYPES = new Set(['eXIf', 'tEXt', 'zTXt', 'iTXt', 'tIME', 'pHYs', 'iCCP']);
 
     while (offset + 8 <= u8.length) {
-      const length = (u8[offset] << 24) | (u8[offset + 1] << 16) | (u8[offset + 2] << 8) | u8[offset + 3];
+      const length = ((u8[offset] << 24) | (u8[offset + 1] << 16) | (u8[offset + 2] << 8) | u8[offset + 3]) >>> 0;
       const type = String.fromCharCode(u8[offset + 4], u8[offset + 5], u8[offset + 6], u8[offset + 7]);
       const chunkTotalLen = 12 + length; // 4 len + 4 type + data + 4 crc
 
-      if (offset + chunkTotalLen > u8.length) {
+      if (length > u8.length || offset + chunkTotalLen > u8.length) {
         chunks.push(u8.subarray(offset));
         break;
       }
@@ -198,11 +198,11 @@ function stripExifMetadata(inputBuffer) {
 
     while (offset + 8 <= u8.length) {
       const fourCC = String.fromCharCode(u8[offset], u8[offset + 1], u8[offset + 2], u8[offset + 3]);
-      const chunkSize = u8[offset + 4] | (u8[offset + 5] << 8) | (u8[offset + 6] << 16) | (u8[offset + 7] << 24);
+      const chunkSize = (u8[offset + 4] | (u8[offset + 5] << 8) | (u8[offset + 6] << 16) | (u8[offset + 7] << 24)) >>> 0;
       const paddedSize = chunkSize + (chunkSize % 2); // WebP chunks are 2-byte aligned
       const totalChunkSize = 8 + paddedSize;
 
-      if (offset + totalChunkSize > u8.length) {
+      if (chunkSize > u8.length || offset + totalChunkSize > u8.length) {
         chunks.push(u8.subarray(offset));
         break;
       }
@@ -338,16 +338,20 @@ function redactImageBoundingBoxes(canvasOrCtx, boxes = [], options = {}) {
  * @returns {string} Standalone SVG markup
  */
 function generateSvgRedactionOverlay(dimensions = { width: 800, height: 600 }, boxes = [], options = {}) {
-  const width = dimensions.width || 800;
-  const height = dimensions.height || 600;
-  const fillColor = options.fillColor || '#000000';
-  const strokeColor = options.borderColor || '#00f0ff';
+  const width = Number(dimensions?.width) || 800;
+  const height = Number(dimensions?.height) || 600;
+  const fillColor = escapeXml(options.fillColor || '#000000');
+  const strokeColor = escapeXml(options.borderColor || '#00f0ff');
 
   const rects = (boxes || []).map((b, idx) => {
-    const label = b.label ? `<text x="${b.x + 5}" y="${b.y + 14}" font-family="monospace" font-size="11" font-weight="bold" fill="#00f0ff">${escapeXml(b.label)}</text>` : '';
+    const bx = Number(b.x) || 0;
+    const by = Number(b.y) || 0;
+    const bw = Number(b.width) || 0;
+    const bh = Number(b.height) || 0;
+    const label = b.label ? `<text x="${bx + 5}" y="${by + 14}" font-family="monospace" font-size="11" font-weight="bold" fill="#00f0ff">${escapeXml(b.label)}</text>` : '';
     return `
     <g class="ps-vision-mask" id="mask-${idx}">
-      <rect x="${b.x}" y="${b.y}" width="${b.width}" height="${b.height}" fill="${fillColor}" stroke="${strokeColor}" stroke-width="1.5" />
+      <rect x="${bx}" y="${by}" width="${bw}" height="${bh}" fill="${fillColor}" stroke="${strokeColor}" stroke-width="1.5" />
       ${label}
     </g>`;
   }).join('');

package/vision.js

@@ -64,7 +64,7 @@ export function stripExifMetadata(inputBuffer) {
 
       const length = (u8[offset + 2] << 8) | u8[offset + 3];
       const segmentEnd = offset + 2 + length;
-      if (segmentEnd > u8.length) {
+      if (length < 2 || segmentEnd > u8.length) {
         chunks.push(u8.subarray(offset));
         break;
       }
@@ -140,11 +140,11 @@ export function stripExifMetadata(inputBuffer) {
     const ANCILLARY_TYPES = new Set(['eXIf', 'tEXt', 'zTXt', 'iTXt', 'tIME', 'pHYs', 'iCCP']);
 
     while (offset + 8 <= u8.length) {
-      const length = (u8[offset] << 24) | (u8[offset + 1] << 16) | (u8[offset + 2] << 8) | u8[offset + 3];
+      const length = ((u8[offset] << 24) | (u8[offset + 1] << 16) | (u8[offset + 2] << 8) | u8[offset + 3]) >>> 0;
       const type = String.fromCharCode(u8[offset + 4], u8[offset + 5], u8[offset + 6], u8[offset + 7]);
       const chunkTotalLen = 12 + length; // 4 len + 4 type + data + 4 crc
 
-      if (offset + chunkTotalLen > u8.length) {
+      if (length > u8.length || offset + chunkTotalLen > u8.length) {
         chunks.push(u8.subarray(offset));
         break;
       }
@@ -198,11 +198,11 @@ export function stripExifMetadata(inputBuffer) {
 
     while (offset + 8 <= u8.length) {
       const fourCC = String.fromCharCode(u8[offset], u8[offset + 1], u8[offset + 2], u8[offset + 3]);
-      const chunkSize = u8[offset + 4] | (u8[offset + 5] << 8) | (u8[offset + 6] << 16) | (u8[offset + 7] << 24);
+      const chunkSize = (u8[offset + 4] | (u8[offset + 5] << 8) | (u8[offset + 6] << 16) | (u8[offset + 7] << 24)) >>> 0;
       const paddedSize = chunkSize + (chunkSize % 2); // WebP chunks are 2-byte aligned
       const totalChunkSize = 8 + paddedSize;
 
-      if (offset + totalChunkSize > u8.length) {
+      if (chunkSize > u8.length || offset + totalChunkSize > u8.length) {
         chunks.push(u8.subarray(offset));
         break;
       }
@@ -338,16 +338,20 @@ export function redactImageBoundingBoxes(canvasOrCtx, boxes = [], options = {})
  * @returns {string} Standalone SVG markup
  */
 export function generateSvgRedactionOverlay(dimensions = { width: 800, height: 600 }, boxes = [], options = {}) {
-  const width = dimensions.width || 800;
-  const height = dimensions.height || 600;
-  const fillColor = options.fillColor || '#000000';
-  const strokeColor = options.borderColor || '#00f0ff';
+  const width = Number(dimensions?.width) || 800;
+  const height = Number(dimensions?.height) || 600;
+  const fillColor = escapeXml(options.fillColor || '#000000');
+  const strokeColor = escapeXml(options.borderColor || '#00f0ff');
 
   const rects = (boxes || []).map((b, idx) => {
-    const label = b.label ? `<text x="${b.x + 5}" y="${b.y + 14}" font-family="monospace" font-size="11" font-weight="bold" fill="#00f0ff">${escapeXml(b.label)}</text>` : '';
+    const bx = Number(b.x) || 0;
+    const by = Number(b.y) || 0;
+    const bw = Number(b.width) || 0;
+    const bh = Number(b.height) || 0;
+    const label = b.label ? `<text x="${bx + 5}" y="${by + 14}" font-family="monospace" font-size="11" font-weight="bold" fill="#00f0ff">${escapeXml(b.label)}</text>` : '';
     return `
     <g class="ps-vision-mask" id="mask-${idx}">
-      <rect x="${b.x}" y="${b.y}" width="${b.width}" height="${b.height}" fill="${fillColor}" stroke="${strokeColor}" stroke-width="1.5" />
+      <rect x="${bx}" y="${by}" width="${bw}" height="${bh}" fill="${fillColor}" stroke="${strokeColor}" stroke-width="1.5" />
       ${label}
     </g>`;
   }).join('');