@privacyscrubber/sdk 2.2.4 → 2.2.6

package/index.js

@@ -12,6 +12,7 @@ import { createRequire } from 'module';
 const require = createRequire(import.meta.url);
 import fs from 'fs';
 import path from 'path';
+import os from 'os';
 import { execSync } from 'child_process';
 import { Transform } from 'stream';
 
@@ -223,7 +224,7 @@ function emitDevSecretNoticeIfNeeded(isPro, tokenMap = {}, limit = 15000) {
             process.stderr.write(
                 `\n[PrivacyScrubber] Intercepted ${count} API secret(s) before LLM egress: ${secretSample}\n` +
                 `[PrivacyScrubber] Protected in local RAM (0 byte network egress). Free Tier active (${limit.toLocaleString()} char cap).\n` +
-                `[PrivacyScrubber] Developer SDK ($199/mo flat) for unlimited backend nodes, CI/CD gates & ETL pipelines: https://privacyscrubber.com/pricing?tier=sdk&src=cli_leak_guard\n\n`
+                `[PrivacyScrubber] Developer SDK ($299/mo flat) for unlimited backend nodes, CI/CD gates & ETL pipelines: https://privacyscrubber.com/pricing?tier=sdk&src=cli_leak_guard\n\n`
             );
         }
     }
@@ -288,13 +289,13 @@ Pre-configured for 30 specialized industry profiles and compliance frameworks:
   - Latency: +200ms - 400ms added network roundtrip per AI prompt.
   - Sub-processor Risk: Requires vendor DPA, external network egress.
 * PrivacyScrubber Developer SDK:
-  - Cost: $199 / month flat (or $1,990 / year) for unlimited nodes, microservices, and prompts.
+  - Cost: $299 / month flat (or $2,990 / year) for unlimited nodes, microservices, and prompts.
   - Latency: <0.1ms (in-process RAM).
   - Sub-processor Risk: Zero (pure in-memory software library).
 
 5. ACTION REQUESTED
 Approve commercial license upgrade for ${developer} (${teamSize} engineers, unlimited backend nodes):
-* License Tier: Developer SDK ($199/month flat or $1,990/year)
+* License Tier: Developer SDK ($299/month flat or $2,990/year)
 * Direct Procurement & License Activation: https://privacyscrubber.com/pricing?tier=sdk&src=ciso_memo
 * Enterprise / Invoicing Contact: enterprise@privacyscrubber.com
 `;
@@ -341,7 +342,7 @@ The SDK enforces out-of-the-box sanitization matching mandatory compliance contr
 
 | Evaluation Factor | Traditional Cloud DLP (AWS/GCP/Nightfall) | PrivacyScrubber Developer SDK |
 | :--- | :--- | :--- |
-| **Pricing Model** | \$1,500 – \$4,000 / month (metered per GB/token) | **\$199 / month flat** (unlimited nodes & tokens) |
+| **Pricing Model** | \$1,500 – \$4,000 / month (metered per GB/token) | **\$299 / month flat** (unlimited nodes & tokens) |
 | **Network Egress** | Requires outbound network calls to DLP vendor | **0 bytes** (100% local Node.js process memory) |
 | **Added Latency** | +200ms – +450ms network round-trip | **<0.1ms** (in-memory regular expressions) |
 | **Vendor Sub-processors** | Third-party cloud vendor added to vendor list | **None** (zero-network software library) |
@@ -350,7 +351,7 @@ The SDK enforces out-of-the-box sanitization matching mandatory compliance contr
 ---
 
 ### 5. Procurement Recommendation
-We request approval to acquire a **Developer SDK License** (\$199/month flat or \$1,990/year) to unlock unlimited throughput across all microservices and CI/CD pipelines.
+We request approval to acquire a **Developer SDK License** (\$299/month flat or \$2,990/year) to unlock unlimited throughput across all microservices and CI/CD pipelines.
 
 * **Direct Procurement Portal:** [https://privacyscrubber.com/pricing?tier=sdk&src=ciso_memo](https://privacyscrubber.com/pricing?tier=sdk&src=ciso_memo)
 * **Procurement / Invoicing Contact:** \`enterprise@privacyscrubber.com\`
@@ -821,6 +822,16 @@ export function wrapOpenAI(openaiClient, options = {}) {
                 const res = engine.sanitize(msg.content, { existingSessionMap: sessionTokenMap });
                 Object.assign(sessionTokenMap, res.tokenMap);
                 return { ...msg, content: res.scrubbedText };
+            } else if (Array.isArray(msg.content)) {
+                const sanitizedChunks = msg.content.map(chunk => {
+                    if (chunk && chunk.type === 'text' && typeof chunk.text === 'string') {
+                        const res = engine.sanitize(chunk.text, { existingSessionMap: sessionTokenMap });
+                        Object.assign(sessionTokenMap, res.tokenMap);
+                        return { ...chunk, text: res.scrubbedText };
+                    }
+                    return chunk;
+                });
+                return { ...msg, content: sanitizedChunks };
             }
             return msg;
         });
@@ -836,8 +847,17 @@ export function wrapOpenAI(openaiClient, options = {}) {
 
         if (response && Array.isArray(response.choices)) {
             response.choices.forEach(choice => {
-                if (choice.message && typeof choice.message.content === 'string') {
-                    choice.message.content = engine.restore(choice.message.content, sessionTokenMap).restoredText;
+                if (choice.message) {
+                    if (typeof choice.message.content === 'string') {
+                        choice.message.content = engine.restore(choice.message.content, sessionTokenMap).restoredText;
+                    } else if (Array.isArray(choice.message.content)) {
+                        choice.message.content = choice.message.content.map(chunk => {
+                            if (chunk && chunk.type === 'text' && typeof chunk.text === 'string') {
+                                return { ...chunk, text: engine.restore(chunk.text, sessionTokenMap).restoredText };
+                            }
+                            return chunk;
+                        });
+                    }
                 }
             });
         }
@@ -859,6 +879,364 @@ export function createLangChainTransform(options = {}) {
     };
 }
 
+/**
+ * LangChain Document Transformer for RAG pre-ingestion pipelines.
+ * Compliant with LangChain BaseDocumentTransformer and Runnable interfaces.
+ *
+ * Intercepts LangChain Document objects ({ pageContent, metadata }) before
+ * embedding or vector storage, scrubbing PII in pageContent and optional sensitive metadata keys.
+ *
+ * @param {Object} [options={}]
+ * @param {string} [options.profile='General'] Detection profile ('General', 'Medical', 'Finance', 'Dev', etc.)
+ * @param {string[]} [options.sensitiveMetadataKeys=[]] Metadata keys to sanitize (e.g. ['author', 'user_id', 'contact'])
+ * @param {boolean} [options.attachTelemetry=true] Whether to attach _ztds_telemetry to document metadata
+ * @param {boolean} [options.attachTokenMap=false] Whether to attach _ztds_token_map to document metadata
+ * @returns {Object} Document transformer with transformDocuments and invoke methods
+ */
+export function createDocumentTransformer(options = {}) {
+    const {
+        profile = 'General',
+        sensitiveMetadataKeys = [],
+        attachTelemetry = true,
+        attachTokenMap = false,
+        ...engineOptions
+    } = options;
+
+    const engine = new PrivacyScrubberEngine({ profile, ...engineOptions });
+
+    async function transformDocuments(documents) {
+        if (!Array.isArray(documents)) {
+            throw new TypeError("documents must be an array of LangChain Document objects");
+        }
+
+        const transformed = [];
+        for (const doc of documents) {
+            const pageContent = doc.pageContent || doc.text || "";
+            const metadata = { ...(doc.metadata || {}) };
+
+            // Sanitize page content
+            const scrubResult = engine.sanitize(pageContent, { profile });
+
+            // Sanitize designated sensitive metadata fields if present
+            if (Array.isArray(sensitiveMetadataKeys) && sensitiveMetadataKeys.length > 0) {
+                for (const key of sensitiveMetadataKeys) {
+                    if (metadata[key] && typeof metadata[key] === 'string') {
+                        const metaScrub = engine.sanitize(metadata[key], { profile });
+                        metadata[key] = metaScrub.scrubbedText;
+                    }
+                }
+            }
+
+            if (attachTelemetry) {
+                metadata._ztds_telemetry = {
+                    riskLevel: scrubResult.telemetry?.riskLevel || 'CLEAN (ZERO PII)',
+                    totalCount: scrubResult.count || 0,
+                    timestamp: new Date().toISOString()
+                };
+            }
+
+            if (attachTokenMap && scrubResult.tokenMap) {
+                metadata._ztds_token_map = { ...scrubResult.tokenMap };
+            }
+
+            transformed.push({
+                ...doc,
+                pageContent: scrubResult.scrubbedText,
+                metadata
+            });
+        }
+
+        return transformed;
+    }
+
+    return {
+        transformDocuments,
+        invoke: async (documents) => transformDocuments(documents),
+        sessionMap: engine.sessionMap,
+        restore: (output, tokenMap) => engine.restore(output, tokenMap || engine.sessionMap),
+        resetSession: () => engine.resetSession()
+    };
+}
+export const createLangChainDocumentTransformer = createDocumentTransformer;
+
+/**
+ * LlamaIndex Node/Document Transform component for RAG ingestion.
+ *
+ * Compatible with LlamaIndex ingestion pipelines and custom transformations.
+ * Sanitizes node text while preserving node IDs, relationships, and metadata.
+ *
+ * @param {Object} [options={}]
+ * @returns {Object} LlamaIndex transform with transform method
+ */
+export function createLlamaIndexTransform(options = {}) {
+    const { profile = 'General', ...engineOptions } = options;
+    const engine = new PrivacyScrubberEngine({ profile, ...engineOptions });
+
+    return {
+        transform: (nodes) => {
+            if (!nodes) return nodes;
+            const isArray = Array.isArray(nodes);
+            const list = isArray ? nodes : [nodes];
+
+            const transformed = list.map((node) => {
+                const text = typeof node.getContent === 'function' 
+                    ? node.getContent() 
+                    : (node.text || node.pageContent || '');
+                const result = engine.sanitize(text, { profile });
+                
+                if (typeof node.setContent === 'function') {
+                    node.setContent(result.scrubbedText);
+                } else {
+                    node.text = result.scrubbedText;
+                }
+
+                if (node.metadata) {
+                    node.metadata._ztds_sanitized = true;
+                    node.metadata._ztds_pii_count = result.count;
+                }
+                return node;
+            });
+
+            return isArray ? transformed : transformed[0];
+        },
+        sessionMap: engine.sessionMap,
+        restore: (text, map) => engine.restore(text, map || engine.sessionMap),
+        resetSession: () => engine.resetSession()
+    };
+}
+
+/**
+ * Universal Vector Database Ingestion Guard (Chroma, Pinecone, Qdrant, Weaviate, pgvector, Milvus).
+ *
+ * Guarantees zero-PII vector embedding and storage in local/cloud vector databases.
+ * Provides pre-ingestion record sanitization, query alignment, search result re-hydration,
+ * and transparent proxy wrapping of vector store clients.
+ *
+ * @param {Object} [options={}]
+ * @param {string} [options.profile='General']
+ * @param {string[]} [options.sensitiveMetadataKeys=[]]
+ * @param {boolean} [options.autoRestoreResults=true]
+ * @returns {Object} Vector ingestion guard utilities
+ */
+export function createVectorIngestionGuard(options = {}) {
+    const {
+        profile = 'General',
+        sensitiveMetadataKeys = [],
+        autoRestoreResults = true,
+        ...engineOptions
+    } = options;
+
+    const engine = new PrivacyScrubberEngine({ profile, ...engineOptions });
+
+    /**
+     * Sanitizes raw database records prior to vector store upsert / add.
+     * Supports standard formats:
+     * - Chroma: { ids: [], documents: [], metadatas: [] }
+     * - Pinecone: [{ id, values, metadata }]
+     * - Qdrant: [{ id, vector, payload: { text, ... } }]
+     * - Universal: [{ id, text, metadata }]
+     */
+    function sanitizeRecords(records) {
+        if (!records) return records;
+
+        // Chroma-style columnar batch: { ids, documents, metadatas }
+        if (records.documents && Array.isArray(records.documents)) {
+            const sanitizedDocs = [];
+            const sanitizedMetas = records.metadatas ? [...records.metadatas] : [];
+            let totalTokens = 0;
+
+            records.documents.forEach((doc, idx) => {
+                const res = engine.sanitize(doc || '', { profile });
+                sanitizedDocs.push(res.scrubbedText);
+                totalTokens += res.count;
+
+                if (sanitizedMetas[idx]) {
+                    const meta = { ...sanitizedMetas[idx] };
+                    if (sensitiveMetadataKeys.length > 0) {
+                        for (const k of sensitiveMetadataKeys) {
+                            if (typeof meta[k] === 'string') {
+                                meta[k] = engine.sanitize(meta[k], { profile }).scrubbedText;
+                            }
+                        }
+                    }
+                    meta._ztds_sanitized = true;
+                    sanitizedMetas[idx] = meta;
+                }
+            });
+
+            return {
+                ...records,
+                documents: sanitizedDocs,
+                metadatas: sanitizedMetas,
+                _ztds_total_tokens: totalTokens
+            };
+        }
+
+        // Array of record objects (Pinecone, Qdrant, Weaviate, LangChain vectorstores)
+        if (Array.isArray(records)) {
+            let totalTokens = 0;
+            const sanitized = records.map((record) => {
+                const copy = { ...record };
+                // Handle text / document / pageContent / payload.text
+                const textField = copy.text !== undefined ? 'text' 
+                    : copy.document !== undefined ? 'document'
+                    : copy.pageContent !== undefined ? 'pageContent'
+                    : null;
+
+                if (textField && typeof copy[textField] === 'string') {
+                    const res = engine.sanitize(copy[textField], { profile });
+                    copy[textField] = res.scrubbedText;
+                    totalTokens += res.count;
+                }
+
+                // Handle Qdrant payload
+                if (copy.payload && typeof copy.payload === 'object') {
+                    copy.payload = { ...copy.payload };
+                    if (typeof copy.payload.text === 'string') {
+                        const res = engine.sanitize(copy.payload.text, { profile });
+                        copy.payload.text = res.scrubbedText;
+                        totalTokens += res.count;
+                    }
+                }
+
+                // Handle metadata
+                if (copy.metadata && typeof copy.metadata === 'object') {
+                    copy.metadata = { ...copy.metadata };
+                    for (const k of sensitiveMetadataKeys) {
+                        if (typeof copy.metadata[k] === 'string') {
+                            copy.metadata[k] = engine.sanitize(copy.metadata[k], { profile }).scrubbedText;
+                        }
+                    }
+                    copy.metadata._ztds_sanitized = true;
+                }
+
+                return copy;
+            });
+
+            return sanitized;
+        }
+
+        return records;
+    }
+
+    /**
+     * Sanitizes user queries before generating search embeddings.
+     * Ensures search vectors align with sanitized tokenized corpus representations.
+     */
+    function sanitizeQuery(query) {
+        if (typeof query !== 'string') return query;
+        const res = engine.sanitize(query, { profile });
+        const matches = res.scrubbedText.match(/\[[A-Z_]+_\d+\]/g);
+        const tokensDetected = matches ? matches.length : (res.count || 0);
+        return {
+            query: res.scrubbedText,
+            rawQuery: query,
+            tokensDetected,
+            tokenMap: res.tokenMap
+        };
+    }
+
+    /**
+     * Restores search results retrieved from vector DB using the volatile session map.
+     */
+    function restoreSearchResults(results, customTokenMap = null) {
+        const map = customTokenMap || engine.sessionMap;
+        if (!results || Object.keys(map).length === 0) return results;
+
+        function restoreText(t) {
+            if (typeof t !== 'string') return t;
+            return engine.restore(t, map).restoredText;
+        }
+
+        if (Array.isArray(results)) {
+            return results.map(item => {
+                const copy = { ...item };
+                if (typeof copy.pageContent === 'string') copy.pageContent = restoreText(copy.pageContent);
+                if (typeof copy.text === 'string') copy.text = restoreText(copy.text);
+                if (typeof copy.document === 'string') copy.document = restoreText(copy.document);
+                if (copy.payload && typeof copy.payload === 'object') {
+                    copy.payload = { ...copy.payload };
+                    if (typeof copy.payload.text === 'string') {
+                        copy.payload.text = restoreText(copy.payload.text);
+                    }
+                }
+                return copy;
+            });
+        }
+
+        return results;
+    }
+
+    /**
+     * Wraps an existing vector store client instance with zero-trust hooks.
+     */
+    function wrapVectorStore(vectorStore) {
+        const proxy = new Proxy(vectorStore, {
+            get(target, prop, receiver) {
+                const orig = Reflect.get(target, prop, receiver);
+                if (typeof orig !== 'function') return orig;
+
+                // Intercept ingestion methods: addDocuments, upsert, add, insert
+                if (prop === 'addDocuments') {
+                    return async function(docs, ...rest) {
+                        if (!Array.isArray(docs)) return orig.apply(target, [docs, ...rest]);
+                        const safeDocs = docs.map(doc => {
+                            const pageContent = doc.pageContent || doc.text || "";
+                            const metadata = { ...(doc.metadata || {}) };
+                            const scrubResult = engine.sanitize(pageContent, { profile });
+                            for (const key of sensitiveMetadataKeys) {
+                                if (metadata[key] && typeof metadata[key] === 'string') {
+                                    metadata[key] = engine.sanitize(metadata[key], { profile }).scrubbedText;
+                                }
+                            }
+                            metadata._ztds_telemetry = {
+                                riskLevel: scrubResult.telemetry?.riskLevel || 'CLEAN (ZERO PII)',
+                                totalCount: scrubResult.count || 0,
+                                timestamp: new Date().toISOString()
+                            };
+                            return { ...doc, pageContent: scrubResult.scrubbedText, metadata };
+                        });
+                        return orig.apply(target, [safeDocs, ...rest]);
+                    };
+                }
+
+                if (prop === 'upsert' || prop === 'add' || prop === 'insert') {
+                    return async function(records, ...rest) {
+                        const safeRecords = sanitizeRecords(records);
+                        return orig.apply(target, [safeRecords, ...rest]);
+                    };
+                }
+
+                // Intercept query methods: similaritySearch, query, search
+                if (prop === 'similaritySearch' || prop === 'query' || prop === 'search') {
+                    return async function(queryArg, ...rest) {
+                        const safeQ = typeof queryArg === 'string' ? sanitizeQuery(queryArg).query : queryArg;
+                        const rawResults = await orig.apply(target, [safeQ, ...rest]);
+                        if (autoRestoreResults) {
+                            return restoreSearchResults(rawResults);
+                        }
+                        return rawResults;
+                    };
+                }
+
+                return orig.bind(target);
+            }
+        });
+
+        return proxy;
+    }
+
+    return {
+        sanitizeRecords,
+        sanitizeQuery,
+        restoreSearchResults,
+        wrapVectorStore,
+        sessionMap: engine.sessionMap,
+        restore: (text, map) => engine.restore(text, map || engine.sessionMap),
+        resetSession: () => engine.resetSession()
+    };
+}
+
 /**
  * Helper to escape special regex characters.
  */
@@ -1229,6 +1607,248 @@ export function createExpressMiddleware(options = {}) {
  * @param {object} [options] - Options: companyName, department, format ('markdown'|'json'|'summary').
  * @returns {object|string}
  */
+export function formatCefEvent(eventData = {}) {
+    const {
+        vendor = 'PrivacyScrubber',
+        product = 'ZTDS',
+        version = '2.2.5',
+        eventClassId = 'PII_REDACTION',
+        eventName = 'Zero-Trust PII Sanitization Executed',
+        riskLevel = 'LOW EXPOSURE',
+        tokensMasked = 0,
+        entities = {},
+        frameworks = ['ZTDS Standard'],
+        sessionHash = '',
+        source = 'local_ram',
+        action = 'redact_and_mask',
+        organization = '',
+        department = ''
+    } = eventData;
+
+    let severity = 1;
+    if (riskLevel.includes('CRITICAL')) severity = 9;
+    else if (riskLevel.includes('MODERATE')) severity = 6;
+    else if (riskLevel.includes('LOW')) severity = 3;
+    else severity = 0;
+
+    const entitiesStr = Object.entries(entities).map(([k, v]) => `${k}:${v}`).join(',') || 'none';
+    const frameworksStr = Array.isArray(frameworks) ? frameworks.join(',') : String(frameworks);
+    const safeMsg = `Sanitized ${tokensMasked} entity tokens in volatile RAM. 0 bytes network egress.`;
+
+    const extension = [
+        `src=${source}`,
+        `act=${action}`,
+        `cs1Label=RiskLevel cs1=${riskLevel.replace(/\s+/g, '_')}`,
+        `cn1Label=TokensMasked cn1=${tokensMasked}`,
+        `cs2Label=Frameworks cs2=${frameworksStr.replace(/\s+/g, '_')}`,
+        `cs3Label=Entities cs3=${entitiesStr}`,
+        sessionHash ? `cs4Label=SessionHash cs4=${sessionHash.substring(0, 16)}` : '',
+        organization ? `suser=${organization.replace(/\s+/g, '_')}` : '',
+        department ? `cs5Label=Department cs5=${department.replace(/\s+/g, '_')}` : '',
+        `msg=${safeMsg}`
+    ].filter(Boolean).join(' ');
+
+    return `CEF:0|${vendor}|${product}|${version}|${eventClassId}|${eventName}|${severity}|${extension}`;
+}
+
+export function formatSyslogEvent(eventData = {}) {
+    const {
+        timestamp = new Date().toISOString(),
+        hostname = (typeof os !== 'undefined' && typeof os.hostname === 'function' ? os.hostname() : 'localhost'),
+        pid = (typeof process !== 'undefined' && process.pid ? process.pid : 1),
+        riskLevel = 'LOW EXPOSURE',
+        tokensMasked = 0,
+        frameworks = ['ZTDS Standard'],
+        sessionHash = '',
+        organization = ''
+    } = eventData;
+
+    let pri = 134; // local0.info
+    if (riskLevel.includes('CRITICAL')) pri = 132; // local0.warning
+    else if (riskLevel.includes('MODERATE')) pri = 133; // local0.notice
+
+    const frameworksStr = Array.isArray(frameworks) ? frameworks.join(';') : String(frameworks);
+    const hashPrefix = sessionHash.substring(0, 16) || 'none';
+    const orgStr = organization ? ` org="${organization.replace(/"/g, '')}"` : '';
+
+    const sd = `[ztds@49152 risk="${riskLevel}" tokens="${tokensMasked}" frameworks="${frameworksStr}" session="${hashPrefix}"${orgStr}]`;
+    const msg = `Zero-Trust Data Sanitization executed in RAM. ${tokensMasked} token(s) masked. 0 bytes network egress.`;
+
+    return `<${pri}>1 ${timestamp} ${hostname} privacyscrubber ${pid} ZTDS - ${sd} ${msg}`;
+}
+
+export function formatJsonlEvent(eventData = {}) {
+    const {
+        timestamp = new Date().toISOString(),
+        version = '2.2.5',
+        protocol = 'ZTDS',
+        event = 'sanitization',
+        riskLevel = 'LOW EXPOSURE',
+        tokensMasked = 0,
+        entities = {},
+        frameworks = ['ZTDS Standard'],
+        sessionHash = '',
+        organization = '',
+        department = '',
+        executionMs = 0,
+        metadata = {}
+    } = eventData;
+
+    const record = {
+        timestamp,
+        version,
+        protocol,
+        event,
+        risk_level: riskLevel,
+        tokens_masked: tokensMasked,
+        entities,
+        frameworks,
+        session_hash: sessionHash,
+        zero_egress: true,
+        verification_mode: "100% Offline (In-Memory RAM)",
+        ...(organization && { organization }),
+        ...(department && { department }),
+        ...(executionMs && { execution_ms: executionMs }),
+        ...(Object.keys(metadata).length > 0 && { metadata })
+    };
+
+    return JSON.stringify(record);
+}
+
+export function createAuditLogger(options = {}) {
+    const {
+        format = 'jsonl',
+        destination = null,
+        organization = 'PrivacyScrubber Enterprise Client',
+        department = 'SecOps'
+    } = options;
+
+    let fileHandle = null;
+    let streamHandle = null;
+    const buffer = [];
+
+    if (typeof destination === 'string' && destination.trim()) {
+        try {
+            const dir = path.dirname(destination);
+            if (!fs.existsSync(dir)) {
+                fs.mkdirSync(dir, { recursive: true });
+            }
+            fileHandle = destination;
+        } catch {}
+    } else if (destination && typeof destination.write === 'function') {
+        streamHandle = destination;
+    }
+
+    function formatEvent(eventData) {
+        const enriched = {
+            organization,
+            department,
+            timestamp: new Date().toISOString(),
+            ...eventData
+        };
+
+        if (format === 'cef') {
+            return formatCefEvent(enriched);
+        }
+        if (format === 'syslog') {
+            return formatSyslogEvent(enriched);
+        }
+        if (format === 'json') {
+            return JSON.stringify(enriched, null, 2);
+        }
+        return formatJsonlEvent(enriched);
+    }
+
+    function writeEntry(line) {
+        buffer.push(line);
+        if (fileHandle) {
+            try {
+                fs.appendFileSync(fileHandle, line + '\n', 'utf8');
+            } catch (e) {
+                console.error('[PrivacyScrubber AuditLogger] File write error:', e);
+            }
+        } else if (streamHandle) {
+            try {
+                streamHandle.write(line + '\n');
+            } catch (e) {
+                console.error('[PrivacyScrubber AuditLogger] Stream write error:', e);
+            }
+        }
+    }
+
+    function logSanitization(result, context = {}) {
+        if (!result) return '';
+        let tokenMap = {};
+        let telemetry = null;
+        let count = 0;
+        let execMs = 0;
+
+        if (result.tokenMap && typeof result.tokenMap === 'object') {
+            tokenMap = result.tokenMap;
+            telemetry = result.telemetry;
+            count = result.count !== undefined ? result.count : Object.keys(tokenMap).length;
+            execMs = result.executionMs || 0;
+        } else if (typeof result === 'object') {
+            tokenMap = result;
+            count = result.count !== undefined ? result.count : (result.tokensMasked !== undefined ? result.tokensMasked : Object.keys(tokenMap).length);
+        }
+
+        if (!telemetry) {
+            telemetry = buildAuditTelemetry(tokenMap);
+        }
+
+        let sessionHash = '';
+        try {
+            const cryptoMod = require('crypto');
+            sessionHash = cryptoMod.createHash('sha256').update(JSON.stringify(tokenMap) + Date.now()).digest('hex');
+        } catch {
+            sessionHash = 'ztds_' + Math.random().toString(16).substring(2, 10);
+        }
+
+        const eventData = {
+            event: 'pii_sanitization',
+            riskLevel: telemetry.riskLevel || 'CLEAN (ZERO PII)',
+            tokensMasked: count,
+            entities: telemetry.entities || {},
+            frameworks: telemetry.frameworksList || ['ZTDS Standard'],
+            sessionHash,
+            executionMs: execMs,
+            metadata: context.metadata || {}
+        };
+
+        const formatted = formatEvent(eventData);
+        writeEntry(formatted);
+        return formatted;
+    }
+
+    function logEvent(eventData) {
+        const formatted = formatEvent(eventData);
+        writeEntry(formatted);
+        return formatted;
+    }
+
+    function getEntries() {
+        return [...buffer];
+    }
+
+    function clear() {
+        buffer.length = 0;
+    }
+
+    return {
+        formatEvent,
+        logSanitization,
+        logEvent,
+        log: logEvent,
+        getEntries,
+        getBuffer: getEntries,
+        clear,
+        clearBuffer: clear,
+        format,
+        destination
+    };
+}
+
 export function generateAuditReport(sessionMap = {}, options = {}) {
     const { companyName = 'PrivacyScrubber Client', department = 'SecOps / Compliance', format = 'markdown' } = options;
     const telemetry = buildAuditTelemetry(sessionMap);
@@ -1244,6 +1864,45 @@ export function generateAuditReport(sessionMap = {}, options = {}) {
     const timestamp = new Date().toISOString();
     const entitySummary = Object.entries(telemetry.entities).map(([t, count]) => `[${t}]: ${count}`).join(', ') || 'None (Clean)';
 
+    if (format === 'cef') {
+        return formatCefEvent({
+            organization: companyName,
+            department: department,
+            timestamp,
+            sessionHash,
+            riskLevel: telemetry.riskLevel,
+            tokensMasked: telemetry.totalCount,
+            entities: telemetry.entities,
+            frameworks: telemetry.frameworksList
+        });
+    }
+
+    if (format === 'syslog') {
+        return formatSyslogEvent({
+            organization: companyName,
+            department: department,
+            timestamp,
+            sessionHash,
+            riskLevel: telemetry.riskLevel,
+            tokensMasked: telemetry.totalCount,
+            entities: telemetry.entities,
+            frameworks: telemetry.frameworksList
+        });
+    }
+
+    if (format === 'jsonl') {
+        return formatJsonlEvent({
+            organization: companyName,
+            department: department,
+            timestamp,
+            sessionHash,
+            riskLevel: telemetry.riskLevel,
+            tokensMasked: telemetry.totalCount,
+            entities: telemetry.entities,
+            frameworks: telemetry.frameworksList
+        });
+    }
+
     if (format === 'json') {
         return {
             protocol: "Zero-Trust Data Sanitization (ZTDS)",
@@ -1676,11 +2335,19 @@ export default {
     buildAuditTelemetry,
     formatAuditReceipt,
     generateAuditReport,
+    formatCefEvent,
+    formatSyslogEvent,
+    formatJsonlEvent,
+    createAuditLogger,
     generateProcurementMemo,
     PrivacyScrubberEngine,
     PrivacyScrubberLicenseError,
     wrapOpenAI,
     createLangChainTransform,
+    createDocumentTransformer,
+    createLangChainDocumentTransformer,
+    createLlamaIndexTransform,
+    createVectorIngestionGuard,
     StreamingDetokenizer,
     createStreamTokenRestorer,
     createNodeStreamTokenRestorer,