@privacyscrubber/sdk 2.2.5 → 2.2.7

package/LICENSE.md

@@ -7,7 +7,7 @@ Subject to the terms and conditions of this Agreement, BrandMeWeb grants you a p
 
 ### 2. Commercial & Enterprise Production Deployment
 Deploying this SDK in production servers, cloud microservices, customer-facing applications, RAG pipelines, or autonomous AI agent clusters beyond Free Tier quotas requires a valid commercial license:
-- **Developer Pro**: Up to 5 backend microservice nodes ($199/mo or $1,990/yr).
+- **Developer Pro**: Unlimited internal backend microservice nodes ($299/mo or $2,990/yr).
 - **Enterprise Air-Gapped**: Up to 5 production nodes, AWS Nitro Enclaves / SCIF offline deployment, full 30 Specialized Industry Profiles, SOC 2 Evidence Binder ($12,000/yr).
 
 Licensing and key activation: https://privacyscrubber.com/pricing

package/README.md

@@ -13,6 +13,8 @@
 > **In-Process Consumer Privacy Defense & Pre-Emptive Interception Engine**  
 > 100% In-Memory Execution. Zero Third-Party Subprocessors. Zero Data Loss. Sub-Millisecond Latency.
 
+> ⭐ **Support Zero-Trust Open Source:** If `@privacyscrubber/sdk` protects your pipeline from data leaks, please **[Star this repository](https://github.com/moxno/privacyscrubber-mcp)** or run `gh repo star moxno/privacyscrubber-mcp` in your terminal!
+
 The official Node.js / TypeScript programmatic SDK for [PrivacyScrubber.com](https://privacyscrubber.com). Acting as an autonomous in-process consumer data fiduciary, `@privacyscrubber/sdk` intercepts and neutralizes consumer PII and infrastructure secrets at your application boundary before transmission to external AI models or persistent storage—enforcing GDPR, CCPA/CPRA, and HIPAA Safe Harbor compliance without introducing third-party subprocessors or sacrificing LLM reasoning fidelity.
 
 ---
@@ -37,7 +39,7 @@ The official Node.js / TypeScript programmatic SDK for [PrivacyScrubber.com](htt
 | **Runtime Footprint** | **~150KB (0 dependencies)** | ~500MB (Python + spaCy) | Cloud SDK | Cloud SDK |
 | **OpenAI 1-Line Drop-in** | **Yes (`wrapOpenAI`)** | Custom wrapper required | Custom pipeline | Custom pipeline |
 | **DevOps Secrets Scanning** | **Built-in (AWS, JWT, DBs)** | Custom regex rules | Custom detectors | Custom classifiers |
-| **Cost Predictability** | **Free Tier / Flat $199/mo** | DevOps server maintenance | Pay-per-GB cloud fees | Pay-per-unit API fees |
+| **Cost Predictability** | **Free Tier / Flat $299/mo** | DevOps server maintenance | Pay-per-GB cloud fees | Pay-per-unit API fees |
 
 > 📊 **Full Technical Benchmark**: Read the in-depth latency analysis, cold-start profiles, and architecture deep-dive in [docs/benchmarks/sdk-vs-presidio.md](https://github.com/moxno/privacyscrubber-mcp/blob/main/docs/benchmarks/sdk-vs-presidio.md).
 
@@ -45,7 +47,7 @@ The official Node.js / TypeScript programmatic SDK for [PrivacyScrubber.com](htt
 
 | The Risk You Eliminate | Real-World Incident Cost | The @privacyscrubber/sdk Solution |
 | :--- | :--- | :--- |
-| **1 Leaked AWS Key in Cloud LLM Logs** | **$18,400+** (Emergency key rotation, forensic audit, incident response) | **$0 / $199 flat**: Masked to `[AWS_KEY_1]` in local RAM before leaving your node |
+| **1 Leaked AWS Key in Cloud LLM Logs** | **$18,400+** (Emergency key rotation, forensic audit, incident response) | **$0 / $299 flat**: Masked to `[AWS_KEY_1]` in local RAM before leaving your node |
 | **50k Customer Records in Vector DB** | **$4.45M** (Average data breach cost, IBM Security Report) | **<1ms latency**: Sanitize streams on-the-fly before embedding vectors |
 | **Cloud DLP Egress Fees & Latency** | **$1,500–$4,000/mo** + 350ms added prompt delay | **0 egress bytes**: Pure in-memory execution, 0 network dependencies |
 | **Third-Party Subprocessor Vendor Audit** | **$25,000+** per enterprise vendor review (SOC 2, DPA, Legal) | **0 Subprocessors**: No third party touches data; zero security review backlog |
@@ -64,7 +66,7 @@ Backend engineering and InfoSec review boards consistently ask four core archite
    Generate signed SHA-256 session integrity receipts for enterprise SIEM ingestion (Splunk, Datadog, Elastic) directly within your backend microservice, proving regulatory compliance (GDPR Art. 25/32, HIPAA § 164.514, SOC 2 CC6.6) with zero telemetry leaving your VPC.
 
 > 📚 **Academic & Standards Track SSOT**:
-> - **IETF Specification**: [draft-sibiryakov-ztds-protocol-00](https://datatracker.ietf.org/doc/draft-sibiryakov-ztds-protocol/)
+> - **IETF Specification**: [draft-sibiryakov-ztds-protocol-01](https://datatracker.ietf.org/doc/draft-sibiryakov-ztds-protocol/) — Revision 01 · 2026-09-23 · 13 pages
 > - **CERN / Zenodo Foundation**: [DOI 10.5281/zenodo.22058770](https://doi.org/10.5281/zenodo.22058770)
 > - **Center for Open Science (OSF) Benchmark**: [DOI 10.17605/OSF.IO/5BYJF](https://doi.org/10.17605/OSF.IO/5BYJF)
 > - **Law Archive Treatise**: [osf.io/preprints/lawarchive/4wc86/](https://osf.io/preprints/lawarchive/4wc86/)
@@ -229,10 +231,41 @@ await pipeline(readableLlmStream, restorer, clientResponseStream);
 
 ---
 
-### 4. LangChain (LCEL Pipelines & `createLangChainTransform`)
+### 4. LangChain (LCEL Chains & `createDocumentTransformer`)
+
+PrivacyScrubber provides dedicated higher-order components for both LCEL generation chains and RAG pre-ingestion document transformation:
 
-Use the official middleware helper or compose inside LangChain Expression Language (LCEL) chains:
+#### 4a. RAG Document Ingestion Transformer (`createDocumentTransformer` / `createLangChainDocumentTransformer`)
+Sanitizes `pageContent` and sensitive metadata keys across LangChain `Document` arrays prior to vector embedding. Automatically tracks session token mappings for downstream answer re-hydration. Zero network egress (<1ms per document):
 
+```typescript
+import { createDocumentTransformer } from '@privacyscrubber/sdk';
+
+const transformer = createDocumentTransformer({
+    profile: 'General',
+    sensitiveMetadataKeys: ['account_owner', 'submitter_email'],
+    attachTelemetry: true,
+    attachTokenMap: false // Avoid persisting token maps into vector storage
+});
+
+// Compatible with LangChain document pipelines
+const rawDocs = [
+    {
+        pageContent: "Account Executive John Doe (john.doe@enterprise.com) closed deal for Acme Corp.",
+        metadata: { docId: 'doc_101', account_owner: 'john.doe@enterprise.com' }
+    }
+];
+
+// Transform documents before vector store ingestion
+const sanitizedDocs = await transformer.transformDocuments(rawDocs);
+// or: const sanitizedDocs = await transformer.invoke(rawDocs);
+
+// After LLM generates an answer from retrieved sanitized documents, re-hydrate in memory:
+const { restoredText } = transformer.restore(rawLlmAnswer);
+```
+> Complete runnable recipe: [`npm-sdk/examples/langchain-rag.js`](./examples/langchain-rag.js).
+
+#### 4b. Composable LCEL Generation Chains & Middleware
 ```typescript
 import { ChatOpenAI } from '@langchain/openai';
 import { createLangChainTransform, PrivacyScrubberEngine } from '@privacyscrubber/sdk';
@@ -258,15 +291,39 @@ const result = await secureChain("Debug AWS_KEY=AKIAIOSFODNN7EXAMPLE for user al
 
 ---
 
-### 5. LlamaIndex.TS (RAG Node Sanitizer)
+### 5. LlamaIndex.TS (RAG Node Transform & `createLlamaIndexTransform`)
+
+Prevent irreversible PII poisoning in vector stores and comply with GDPR Article 17 (Right to be Forgotten) by transforming documents and nodes prior to indexing:
 
-Prevent PII poisoning in vector stores by sanitizing documents prior to indexing:
+#### 5a. Native Node Transform (`createLlamaIndexTransform`)
+Transforms `TextNode` and `Document` objects with seamless support for `.text`, getter/setter patterns (`getContent()` / `setContent()`), and metadata tagging:
 
+```typescript
+import { createLlamaIndexTransform } from '@privacyscrubber/sdk';
+
+const transform = createLlamaIndexTransform({
+    profile: 'General',
+    attachTelemetry: true
+});
+
+// Transform single node or array of nodes/documents
+const sanitizedNodes = transform.transform([
+    {
+        text: "Patient Alice Brown (555-839-2001, alice.brown@health-secure.org) visited Cardiology.",
+        metadata: { doc_id: 'ehr_84920' }
+    }
+]);
+
+// After LlamaIndex synthesizer returns an answer, re-hydrate in memory:
+const { restoredText } = transform.restore(synthesizedAnswer);
+```
+> Complete runnable recipe: [`npm-sdk/examples/llamaindex-rag.js`](./examples/llamaindex-rag.js).
+
+#### 5b. Functional Document Pre-Ingestion Mapping
 ```typescript
 import { Document } from 'llamaindex';
 import { sanitize } from '@privacyscrubber/sdk';
 
-// Sanitize documents before vector index ingestion (HIPAA & GDPR safe)
 export function sanitizeDocumentsForIndex(docs: Document[]): Document[] {
     return docs.map(doc => {
         const { scrubbedText, telemetry } = sanitize(doc.text, {
@@ -288,27 +345,59 @@ export function sanitizeDocumentsForIndex(docs: Document[]): Document[] {
 
 ---
 
-### 6. RAG & Vector Database Ingestion (Pinecone, Chroma, pgvector)
+### 6. Universal Vector Database Ingestion Guard (`createVectorIngestionGuard`)
 
-Storing raw PII inside vector embeddings is irreversible and violates GDPR Article 17 (Right to be Forgotten). Sanitize document chunks prior to vectorization:
+Storing raw PII inside vector embeddings (Chroma, Pinecone, Qdrant, Weaviate, Milvus, pgvector) is irreversible and creates severe compliance liability. `createVectorIngestionGuard` provides columnar batch sanitization, query token alignment, and transparent vector store proxy wrapping:
 
-```javascript
-import { sanitize } from '@privacyscrubber/sdk';
+```typescript
+import { createVectorIngestionGuard } from '@privacyscrubber/sdk';
 
-function prepareVectorChunk(rawDocumentChunk) {
-    const { scrubbedText, tokenMap, telemetry } = sanitize(rawDocumentChunk, {
-        profile: 'Healthcare', // Masks 18 HIPAA identifiers
-        detectSecrets: true    // Masks API tokens, JWTs, DB credentials
-    });
-    
-    // Embed only the sanitized text into your vector store
-    return {
-        anonymizedChunk: scrubbedText,
-        riskLevel: telemetry.riskLevel,
-        frameworks: telemetry.frameworksList
-    };
-}
+const guard = createVectorIngestionGuard({
+    profile: 'General',
+    sensitiveMetadataKeys: ['contractor_email', 'billing_contact'],
+    attachTelemetry: true
+});
+
+// 1. Chroma Columnar Ingestion ({ ids, documents, metadatas })
+const cleanChromaBatch = guard.sanitizeRecords({
+    ids: ['doc-1', 'doc-2'],
+    documents: [
+        "Audit for Michael Scott (mscott@dundermifflin.com), SSN 000-44-5555.",
+        "Branch notes for Jim Halpert (jhalpert@dundermifflin.com)."
+    ],
+    metadatas: [
+        { branch: "Scranton", contractor_email: "temp@auditor.com" },
+        { branch: "Scranton" }
+    ]
+});
+
+// 2. Pinecone / Qdrant Record Array Ingestion
+const cleanRecords = guard.sanitizeRecords([
+    {
+        id: 'vec-1',
+        text: "Employee Pam Beesly: pamb@office.com, phone 555-432-1098",
+        metadata: { role: "Office Admin" }
+    },
+    {
+        id: 'vec-2',
+        payload: {
+            text: "Escalation for Dwight Schrute (dschrute@schrutefarms.com)",
+            region: "PA"
+        }
+    }
+]);
+
+// 3. Search Query Token Alignment
+// Aligns user search query terms to identical ZTDS tokens in the vector space
+const { query: alignedQuery } = guard.sanitizeQuery("Find agreements for mscott@dundermifflin.com");
+
+// 4. Transparent Vector Store Proxy Wrapping
+// Intercepts addDocuments/upsert and similaritySearch/query automatically
+const guardedStore = guard.wrapVectorStore(nativeVectorStore);
+await guardedStore.addDocuments(rawDocs); // writes sanitized tokens only
+const results = await guardedStore.similaritySearch("mscott@dundermifflin.com"); // re-hydrates in RAM
 ```
+> Complete runnable recipe: [`npm-sdk/examples/vector-guard-rag.js`](./examples/vector-guard-rag.js).
 
 ---
 
@@ -423,6 +512,46 @@ test('pipeline prompt does not leak PII to third-party LLM', () => {
     assert.ok(!scrubbedText.includes(mockUserData.email));
     assert.ok(!scrubbedText.includes(mockUserData.apiKey));
 });
+```
+
+---
+
+### 10. Python, CrewAI & AutoGen Interop (Zero-Dependency HTTP Sidecar)
+
+Running a Python agent fleet (CrewAI, LangGraph, AutoGen)? You can run `@privacyscrubber/sdk` as an air-gapped local sidecar daemon with sub-millisecond in-memory execution and zero cloud hops:
+
+```bash
+# Start local sidecar daemon (in local RAM, zero external network egress):
+npx @privacyscrubber/sdk sidecar --port 3100
+```
+
+```python
+# In your Python CrewAI / LangGraph Agent tool:
+import requests
+
+class PrivacyScrubberTool:
+    def sanitize(self, raw_prompt: str) -> tuple[str, dict]:
+        res = requests.post("http://127.0.0.1:3100/sanitize", json={
+            "text": raw_prompt,
+            "profile": "Dev"
+        }).json()
+        return res["scrubbedText"], res["tokenMap"]
+
+    def restore(self, agent_response: str, token_map: dict) -> str:
+        res = requests.post("http://127.0.0.1:3100/restore", json={
+            "text": agent_response,
+            "tokenMap": token_map
+        }).json()
+        return res["restoredText"]
+```
+
+> 🏢 **Enterprise & Production Licensing:**  
+> - **Self-Serve Developer SDK ($299/mo flat or $2,990/yr):** Unlimited internal backend nodes, microservices, and RAG pipelines. [Get SDK License](https://privacyscrubber.com/pricing?tier=sdk&utm_source=sdk_readme)  
+> - **PrivacyScrubber TEAMS ($99/mo flat):** Unlimited team seats, centralized policy enforcement, encrypted session handoff. [Deploy TEAMS](https://privacyscrubber.com/teams?utm_source=sdk_readme)  
+> - **Enterprise Air-Gapped License:** On-premise source code distribution, zero-network custom models. [Contact Enterprise](https://privacyscrubber.com/enterprise?utm_source=sdk_readme)
+
+---
+
 ### 11. Client-Side Website Form Interceptor (`@privacyscrubber/sdk/browser`)
 
 Intercept customer support forms, loan applications, and lead generation inputs inside the browser DOM before network transmission. Dispatches safe surrogate tokens to public CRMs (Zendesk, HubSpot) or LLMs while isolating the encrypted `tokenMap` in your private database:
@@ -476,7 +605,7 @@ console.log(result.scrubbedText);
 
 PrivacyScrubber works free out-of-the-box with standard developer limits:
 - **Free Tier ($0)**: Up to 15,000 characters per request for General profile; 5,000 characters free quota for specialized industry profiles. Built-in quota for local dev and CI testing without credit card or sign-up.
-- **Developer SDK License ($199/mo or $1,990/yr)**: Unlimited character throughput across all 30 specialized compliance profiles, unrestricted RAG & microservice batch pipelines, zero quota limits.
+- **Developer SDK License ($299/mo or $2,990/yr)**: Unlimited character throughput across all 30 specialized compliance profiles, unrestricted RAG & microservice batch pipelines, zero quota limits.
 
 ### Activating Your Commercial License
 
@@ -500,7 +629,7 @@ const result = sanitize(largeTextPayload, {
 ```
 
 To acquire a commercial Developer SDK license:  
-👉 **[PrivacyScrubber Developer Licensing](https://privacyscrubber.com/pricing/?utm_source=npm_sdk&utm_medium=readme&utm_campaign=dev_upsell)**
+[PrivacyScrubber Developer Licensing](https://privacyscrubber.com/pricing/?utm_source=npm_sdk&utm_medium=readme&utm_campaign=dev_upsell)
 
 ---
 
@@ -519,14 +648,48 @@ To acquire a commercial Developer SDK license:
 - 🌐 **Web App**: [https://privacyscrubber.com](https://privacyscrubber.com)
 - 🔌 **MCP Server**: [@privacyscrubber/mcp-server](https://www.npmjs.com/package/@privacyscrubber/mcp-server)
 - 🧩 **Chrome Extension**: [Chrome Web Store](https://chromewebstore.google.com/detail/privacyscrubber-%E2%80%94-zero-tr/pimoejgefeilajmmbpghifdmhdlkgjol)
-- 📖 **Developer SDK Specs**: [https://privacyscrubber.com/features/developer-sdk/](https://privacyscrubber.com/features/developer-sdk/)
+- 📖 **Developer SDK Specs**: [https://privacyscrubber.com/sdk/](https://privacyscrubber.com/sdk/)
 - ⭐ **GitHub Repository**: [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) (Star us on GitHub!)
 - 🧪 **DLP Latency Benchmark**: [https://privacyscrubber.com/dlp-speed-test/](https://privacyscrubber.com/dlp-speed-test/)
 
-### 📚 Production Architecture Guides
-- 🛡️ **RAG & Vector Databases**: [Sanitizing PII Before Vector DB Ingestion (Pinecone, Chroma, Qdrant)](https://privacyscrubber.com/solutions/dev/rag-vector-database-pii-masking/)
-- 🤖 **LangChain & LlamaIndex**: [In-Memory PII Middleware for AI Agent Pipelines](https://privacyscrubber.com/solutions/agents/langchain-llamaindex-pii-anonymizer/)
-- ⚡ **AWS Comprehend Alternative**: [In-Memory Redaction Without Egress or Cloud Overhead](https://privacyscrubber.com/solutions/dev/aws-comprehend-pii-alternative/)
+### Cookbooks & Integration Recipes (27 Frameworks & Architecture Guides)
+
+Explore production-ready integration guides with complete copy-pasteable TypeScript/Node.js snippets, empirical latency benchmarks, and compliance evidence:
+
+#### AI Frameworks & RAG Ingestion
+- [LangChain.js PII Redaction: In-Memory Zero-Trust Sanitization (<1ms)](https://privacyscrubber.com/solutions/dev/langchain-pii-masking-nodejs/)
+- [LlamaIndex TS Zero-Egress Sanitization: Pre-Prompt In-Memory Masking](https://privacyscrubber.com/solutions/dev/llamaindex-zero-egress-sanitization/)
+- [Vercel AI SDK Stream Sanitizer: Zero-Egress In-Memory Masking](https://privacyscrubber.com/solutions/dev/vercel-ai-sdk-stream-sanitizer/)
+- [Pinecone Vector Upsert PII Redaction: In-Memory Metadata Masking](https://privacyscrubber.com/solutions/dev/pinecone-vector-upsert-pii-redaction/)
+- [OpenAI Node.js SDK PII Wrapper: 1-Line In-Memory Interceptor](https://privacyscrubber.com/solutions/dev/openai-node-wrapper-pii-masking/)
+- [Anthropic Claude Node.js SDK Sanitizer: Sub-Millisecond PII Masking](https://privacyscrubber.com/solutions/dev/anthropic-claude-node-sdk-sanitizer/)
+- [ChromaDB Local PII Sanitizer: In-Memory Pre-Embedding Redaction](https://privacyscrubber.com/solutions/dev/chromadb-local-pii-sanitizer/)
+- [Qdrant Vector Metadata Scrubber: Zero-Cloud-Egress Ingestion](https://privacyscrubber.com/solutions/dev/qdrant-vector-metadata-scrubber/)
+- [AI Agent Tool Calling Sanitizer: Prevent Terminal & Secrets Leakage](https://privacyscrubber.com/solutions/dev/crewai-autogen-agent-tool-sanitizer/)
+- [Reverse Unscrubbing: Restoring Deterministic PII Tokens in RAM](https://privacyscrubber.com/solutions/dev/reverse-unscrub-llm-response-tokens/)
+
+#### Backend Web Frameworks & Microservices
+- [Fastify PII Redaction Middleware: High-Throughput In-Memory Sanitization](https://privacyscrubber.com/solutions/dev/fastify-pii-redaction-middleware/)
+- [Express.js In-Memory PII Masking: Zero-Latency Middleware](https://privacyscrubber.com/solutions/dev/express-in-memory-pii-masking/)
+- [NestJS PII Sanitization Interceptor: Clean Architecture DLP](https://privacyscrubber.com/solutions/dev/nestjs-pii-sanitization-guard/)
+- [Pino & Winston Logger PII Scrubber: In-Memory Log Anonymization](https://privacyscrubber.com/solutions/dev/pino-winston-logger-pii-scrubber/)
+- [Kafka Stream PII Sanitization Worker: High-Throughput Node.js Microservice](https://privacyscrubber.com/solutions/dev/kafka-stream-pii-sanitization-worker/)
+- [ETL & Data Warehouse PII Sanitizer: In-Memory Node.js Ingestion Guard](https://privacyscrubber.com/solutions/dev/dbt-snowflake-etl-pii-sanitizer/)
+
+#### Cloud DLP & Presidio Displacement
+- [Microsoft Presidio Alternative for Node.js: 0.8ms In-Memory vs 40ms Docker](https://privacyscrubber.com/solutions/dev/microsoft-presidio-alternative-nodejs/)
+- [Google Cloud DLP Alternative for Node.js: Local In-Memory Sanitization](https://privacyscrubber.com/solutions/dev/google-cloud-dlp-local-in-memory-alternative/)
+- [AWS Comprehend PII Alternative: In-Memory Latency Reduction (<1ms)](https://privacyscrubber.com/solutions/dev/aws-comprehend-pii-latency-reduction/)
+- [Microsoft Presidio Docker vs In-Memory ZTDS: Technical Latency Benchmark](https://privacyscrubber.com/solutions/dev/presidio-docker-vs-ztds-wasm-benchmark/)
+
+#### RegTech, FinTech & Healthcare Compliance
+- [HIPAA Safe Harbor Prompt Masking for Node.js: 18 Identifiers Redacted in RAM](https://privacyscrubber.com/solutions/dev/hipaa-safe-harbor-prompt-masking-nodejs/)
+- [ISO 20022 XML Payment Sanitizer: In-Memory SWIFT & IBAN Redaction](https://privacyscrubber.com/solutions/dev/iso-20022-xml-payment-sanitizer-nodejs/)
+- [HL7 FHIR JSON PII Redaction for Node.js: Clinical AI Data Guard](https://privacyscrubber.com/solutions/dev/hl7-fhir-json-pii-redaction-nodejs/)
+- [AWS & JWT Secrets Sanitizer for Backend Logs: Stop Cloud Credential Leaks](https://privacyscrubber.com/solutions/dev/aws-jwt-secrets-sanitizer-backend-logs/)
+- [GDPR Article 25 Data Minimization in RAG: Engineering Compliance Guide](https://privacyscrubber.com/solutions/dev/gdpr-article-25-rag-data-minimization/)
+- [Stripe & PCI DSS 4.0 Credit Card PAN Scrubber in Node.js (<1ms)](https://privacyscrubber.com/solutions/dev/stripe-credit-card-pan-scrubber-nodejs/)
+- [SOC 2 Type II LLM Data Masking SDK: Automated Evidence Generation](https://privacyscrubber.com/solutions/dev/soc2-type-2-llm-data-masking-sdk/)
 
 ---
 
@@ -551,5 +714,5 @@ The Zero-Trust Data Sanitization (ZTDS) architecture, in-memory deterministic to
 - **Specification Title:** *The Zero-Trust Data Sanitization (ZTDS) Protocol for Frontier Artificial Intelligence Ingestion*
 - **Standards Track:** IETF Internet Standard Track
 - **IETF Datatracker:** [https://datatracker.ietf.org/doc/draft-sibiryakov-ztds-protocol/](https://datatracker.ietf.org/doc/draft-sibiryakov-ztds-protocol/)
-- **Archive Plaintext:** [https://www.ietf.org/archive/id/draft-sibiryakov-ztds-protocol-00.txt](https://www.ietf.org/archive/id/draft-sibiryakov-ztds-protocol-00.txt)
+- **Archive Plaintext:** [https://www.ietf.org/archive/id/draft-sibiryakov-ztds-protocol-01.txt](https://www.ietf.org/archive/id/draft-sibiryakov-ztds-protocol-01.txt)
 

package/browser.js

@@ -94,7 +94,9 @@ export function buildAuditTelemetry(currentTokenMap = {}) {
     if (currentTokenMap && typeof currentTokenMap === 'object') {
         const keys = Array.isArray(currentTokenMap) ? currentTokenMap : Object.keys(currentTokenMap);
         for (const t of keys) {
-            const tokenStr = typeof t === 'string' ? t : (t.token || t.mask || '');
+            if (!t) continue;
+            const tokenStr = typeof t === 'string' ? t : ((t && (t.token || t.mask)) ? String(t.token || t.mask) : '');
+            if (!tokenStr) continue;
             const match = tokenStr.match(/\[([A-Z_]+)_\d+\]/);
             const baseType = match ? match[1] : (tokenStr.replace(/\[|\]/g, '').replace(/_[0-9]+$/, '') || 'CUSTOM');
             entities[baseType] = (entities[baseType] || 0) + 1;
@@ -149,7 +151,7 @@ export function buildAuditTelemetry(currentTokenMap = {}) {
 export function formatAuditReceipt(telemetry) {
     if (!telemetry || telemetry.totalCount === 0) {
         return "> 🛡️ **PrivacyScrubber Audit Receipt**: CLEAN (ZERO PII DETECTED)\n" +
-               "> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **SDK & Enterprise:** [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing)\n";
+               "> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **SDK & Enterprise:** [privacyscrubber.com/sdk](https://privacyscrubber.com/sdk/)\n";
     }
     const entitiesList = Object.entries(telemetry.entities)
         .map(([type, count]) => `${count} ${type}`)
@@ -161,7 +163,7 @@ export function formatAuditReceipt(telemetry) {
            `> * **Risk Level:** ${icon} ${telemetry.riskLevel}\n` +
            `> * **Compliance Enforced:** ${telemetry.frameworksList.join(', ')}\n` +
            `> * **Tokens Masked:** ${telemetry.totalCount} (${entitiesList})\n` +
-           `> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **SDK & Enterprise:** [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing)\n`;
+           `> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **SDK & Enterprise:** [privacyscrubber.com/sdk](https://privacyscrubber.com/sdk/)\n`;
 }
 
 /**

package/cli.js

@@ -12,6 +12,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
+import http from 'node:http';
 import { fileURLToPath } from 'node:url';
 import { sanitize, restore, generateProcurementMemo, StreamingDetokenizer } from './index.js';
 
@@ -53,6 +54,116 @@ if (args.includes('memo') || args.includes('--memo') || args.includes('--procure
   process.exit(0);
 }
 
+// ── Sidecar / Server Mode: Lightweight Local HTTP & Unix Socket Daemon ──
+if (args.includes('sidecar') || args.includes('--sidecar') || args.includes('serve') || args.includes('--serve')) {
+  let port = 3100;
+  const portIdx = args.indexOf('--port') !== -1 ? args.indexOf('--port') : args.indexOf('-p');
+  if (portIdx !== -1 && args[portIdx + 1]) {
+    port = parseInt(args[portIdx + 1], 10);
+  }
+  let socketPath = null;
+  const sockIdx = args.indexOf('--socket');
+  if (sockIdx !== -1 && args[sockIdx + 1]) {
+    socketPath = args[sockIdx + 1];
+  }
+
+  const server = http.createServer((req, res) => {
+    // CORS headers for local loopback
+    res.setHeader('Access-Control-Allow-Origin', '*');
+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+
+    if (req.method === 'OPTIONS') {
+      res.writeHead(204);
+      res.end();
+      return;
+    }
+
+    if (req.method === 'GET' && (req.url === '/' || req.url === '/health')) {
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ status: 'ok', engine: 'ZTDS', tier: 'Developer SDK', version: '2.2.6' }));
+      return;
+    }
+
+    if (req.method === 'POST') {
+      let bodyStr = '';
+      req.on('data', chunk => {
+        bodyStr += chunk;
+        if (bodyStr.length > 50 * 1024 * 1024) {
+          res.writeHead(413, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'Payload Too Large' }));
+          req.destroy();
+        }
+      });
+
+      req.on('end', () => {
+        try {
+          const payload = bodyStr ? JSON.parse(bodyStr) : {};
+          if (req.url === '/scrub' || req.url === '/sanitize') {
+            const text = payload.text || '';
+            const opts = payload.options || { profile: payload.profile || 'General', detectSecrets: true };
+            const start = process.hrtime.bigint();
+            const result = sanitize(text, opts);
+            const end = process.hrtime.bigint();
+            const durationUs = Number(end - start) / 1000;
+
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+              sanitizedText: result.scrubbedText,
+              tokenMap: result.tokenMap,
+              telemetry: {
+                ...result.telemetry,
+                latencyUs: durationUs,
+                latencyMs: (durationUs / 1000).toFixed(3)
+              }
+            }));
+            return;
+          }
+
+          if (req.url === '/unscrub' || req.url === '/restore') {
+            const text = payload.text || '';
+            const tokenMap = payload.tokenMap || {};
+            const { restoredText, restoredCount } = restore(text, tokenMap);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ restoredText, restoredCount }));
+            return;
+          }
+
+          res.writeHead(404, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'Endpoint Not Found. Supported: /scrub, /unscrub, /health' }));
+        } catch (err) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'Invalid JSON payload', message: err.message }));
+        }
+      });
+      return;
+    }
+
+    res.writeHead(405, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Method Not Allowed' }));
+  });
+
+  if (socketPath) {
+    if (fs.existsSync(socketPath)) {
+      try { fs.unlinkSync(socketPath); } catch (_) {}
+    }
+    server.listen(socketPath, () => {
+      console.log(`[ZTDS Sidecar] Listening on Unix socket: ${socketPath}`);
+      console.log(`[ZTDS Sidecar] Ready for Python/Go local IPC with <1ms in-memory execution.`);
+    });
+  } else {
+    server.listen(port, '127.0.0.1', () => {
+      console.log(`[ZTDS Sidecar] HTTP Daemon listening on http://127.0.0.1:${port}`);
+      console.log(`[ZTDS Sidecar] Endpoints: POST /scrub | POST /unscrub | GET /health`);
+      console.log(`[ZTDS Sidecar] Latency: <1.2ms (Zero network hops, local loopback)`);
+    });
+  }
+} else {
+  runCli();
+}
+
+function runCli() {
+
 // ── Demo Command: Live In-Memory Benchmark & Zero-Trust Inspection ──
 if (args.includes('demo') || args.includes('--demo')) {
   const sampleInput = `DevOps Incident Report #4829
@@ -94,7 +205,8 @@ ${res.scrubbedText.split('\n').map(l => `║  ${l.slice(0, 62).padEnd(64)}║`).
 ║  NEXT STEPS & PROCUREMENT:                                       ║
 ║  * Copy CISO Approval Memo : npx @privacyscrubber/sdk memo       ║
 ║  * CI/CD PR Stamp          : cat prompt.txt | sdk --verify-ci    ║
-║  * Unlimited SDK ($199/mo) : https://privacyscrubber.com/pricing  ║
+║  * Star on GitHub          : github.com/moxno/privacyscrubber-mcp║
+║  * Unlimited SDK ($299/mo) : https://privacyscrubber.com/sdk/      ║
 ╚${border}╝
 `);
   process.exit(0);
@@ -109,10 +221,12 @@ Usage:
   npx @privacyscrubber/sdk --verify-ci <fileOrText> [options]
   npx @privacyscrubber/sdk memo [options]
   npx @privacyscrubber/sdk demo
+  npx @privacyscrubber/sdk sidecar [--port 3100] [--socket /path/to.sock]
 
 Commands:
   memo                 Generate executive CISO & DPO procurement memo
   demo                 Run live in-memory benchmark (<0.1ms latency check)
+  sidecar, serve       Run zero-dependency local HTTP/Unix daemon (<1ms in-memory)
 
 Options:
   --verify-ci          Generate CI/CD PR verification stamp (audit receipt)
@@ -136,7 +250,7 @@ Examples:
   cat stream.txt | npx @privacyscrubber/sdk --restore --stream --token-map tokens.json
 
 Commercial Licensing:
-  Developer SDK ($199/mo flat): https://privacyscrubber.com/pricing?tier=sdk&src=cli_help
+  Developer SDK ($299/mo flat): https://privacyscrubber.com/pricing?tier=sdk&src=cli_help
   Teams ($99/mo flat):          https://privacyscrubber.com/pricing?tier=teams&src=cli_help
 `);
   process.exit(0);
@@ -203,7 +317,7 @@ function handleExecution(text) {
 
   if (isVerifyCi) {
     if (!text || !text.trim()) {
-      console.log(`> **Verified by PrivacyScrubber (ZTDS Standard)**\n> * **Status:** PASSED · 0 PII / 0 Secrets detected in prompt pipeline (Empty payload)\n> * **Execution:** Local RAM (<1ms) · 0 Network Egress Bytes\n> * **Compliance Spec:** [Zero-Trust Data Sanitization (ZTDS)](https://privacyscrubber.com/solutions/engineering/zero-trust-ai-data-sanitization?src=ci_stamp) | [Developer SDK ($199/mo)](https://privacyscrubber.com/pricing?tier=sdk&src=ci_stamp)`);
+      console.log(`> **Verified by PrivacyScrubber (ZTDS Standard)**\n> * **Status:** PASSED · 0 PII / 0 Secrets detected in prompt pipeline (Empty payload)\n> * **Execution:** Local RAM (<1ms) · 0 Network Egress Bytes\n> * **Compliance Spec:** [Zero-Trust Data Sanitization (ZTDS)](https://privacyscrubber.com/solutions/engineering/zero-trust-ai-data-sanitization?src=ci_stamp) | ⭐ [Star on GitHub](https://github.com/moxno/privacyscrubber-mcp) | [Developer SDK ($299/mo)](https://privacyscrubber.com/sdk/?src=ci_stamp)`);
       process.exit(0);
     }
 
@@ -216,7 +330,7 @@ function handleExecution(text) {
 > * **Status:** PASSED · ${maskedCount} item(s) protected (${telemetry?.riskLevel || 'CLEAN'})
 > * **Execution:** Local RAM (<1ms) · 0 Network Egress Bytes
 > * **Audit Hash:** \`${hash}\` (Zero-Trust Verified)
-> * **Compliance Spec:** [Zero-Trust Data Sanitization (ZTDS)](https://privacyscrubber.com/solutions/engineering/zero-trust-ai-data-sanitization?src=ci_stamp) | [Developer SDK ($199/mo)](https://privacyscrubber.com/pricing?tier=sdk&src=ci_stamp)
+> * **Compliance Spec:** [Zero-Trust Data Sanitization (ZTDS)](https://privacyscrubber.com/solutions/engineering/zero-trust-ai-data-sanitization?src=ci_stamp) | ⭐ [Star on GitHub](https://github.com/moxno/privacyscrubber-mcp) | [Developer SDK ($299/mo)](https://privacyscrubber.com/sdk/?src=ci_stamp)
 `;
     console.log(stamp.trim());
     process.exit(0);
@@ -275,3 +389,5 @@ if (inputArg) {
   console.error(`Error: No input provided. Use: npx @privacyscrubber/sdk <fileOrText> or pipe stdin.`);
   process.exit(1);
 }
+}
+

package/examples/langchain-rag.js

@@ -0,0 +1,81 @@
+/**
+ * @privacyscrubber/sdk - LangChain RAG Ingestion & Synthesis Recipe
+ *
+ * Demonstrates:
+ * 1. Pre-ingestion document transformation with createDocumentTransformer.
+ * 2. Neutralizing PII in pageContent and sensitive metadata keys (e.g. author, user_id).
+ * 3. Preserving vector embedding semantic fidelity with deterministic tokens.
+ * 4. In-memory re-hydration of synthesized LLM answers with zero data leakage.
+ *
+ * Usage:
+ *   node npm-sdk/examples/langchain-rag.js
+ */
+
+import { createDocumentTransformer } from '../index.js';
+
+async function main() {
+    console.log('=== PrivacyScrubber SDK: LangChain RAG Recipe ===\n');
+
+    // 1. Initialize the LangChain Document Transformer
+    // Zero network egress: operates 100% in local process memory (<1ms per document)
+    const transformer = createDocumentTransformer({
+        profile: 'General',
+        sensitiveMetadataKeys: ['account_owner', 'submitter_email'],
+        attachTelemetry: true,
+        attachTokenMap: false // Do not leak token mappings into the vector database
+    });
+
+    // 2. Sample raw documents loaded from CRM / internal ticket logs
+    const rawDocs = [
+        {
+            pageContent: 'Account Executive John Doe (john.doe@enterprise.com) finalized deal for client Acme Corp under SSN 000-12-3456.',
+            metadata: {
+                docId: 'doc_101',
+                department: 'Enterprise Sales',
+                account_owner: 'john.doe@enterprise.com',
+                source: 'Salesforce'
+            }
+        },
+        {
+            pageContent: 'Technical escalation for customer Jane Smith. Direct contact phone is +1-555-019-2834, email janes@corp.org.',
+            metadata: {
+                docId: 'doc_102',
+                department: 'Customer Success',
+                submitter_email: 'janes@corp.org',
+                source: 'Zendesk'
+            }
+        }
+    ];
+
+    console.log('--- 1. Raw Documents Before Sanitization ---');
+    console.log(JSON.stringify(rawDocs, null, 2));
+
+    // 3. Transform documents before vector embedding / storage
+    const sanitizedDocs = await transformer.transformDocuments(rawDocs);
+
+    console.log('\n--- 2. Sanitized Documents (Safe for Vector DB Ingestion) ---');
+    console.log(JSON.stringify(sanitizedDocs, null, 2));
+
+    // 4. Verify zero cleartext PII exists in the documents to be embedded
+    const containsRawEmail = sanitizedDocs.some(d => d.pageContent.includes('john.doe@enterprise.com'));
+    const containsRawSsn = sanitizedDocs.some(d => d.pageContent.includes('000-12-3456'));
+    console.log(`\nZero Cleartext Email Verified: ${!containsRawEmail}`);
+    console.log(`Zero Cleartext SSN Verified:   ${!containsRawSsn}`);
+
+    // 5. Simulate an LLM synthesizing an answer over retrieved tokenized chunks
+    // The LLM operates on the tokens without knowing the customer's true identity:
+    const mockLlmResponse = 'Based on document [doc_101], [NAME_1] ([EMAIL_1]) successfully closed the deal for Acme Corp. Contract verified under tax ID [ID_1].';
+    console.log('\n--- 3. LLM Answer Synthesized over Vector Space ---');
+    console.log(`Raw LLM Output: "${mockLlmResponse}"`);
+
+    // 6. Restore the answer in local memory for the authorized end user
+    const { restoredText } = transformer.restore(mockLlmResponse);
+    console.log('\n--- 4. Re-hydrated Answer (Local RAM Only) ---');
+    console.log(`Final Response: "${restoredText}"`);
+
+    // 7. Reset session when switching security context / tenant
+    transformer.resetSession();
+    console.log('\nSession token map purged. Memory footprint clean.');
+}
+
+main().catch(console.error);