The whole drop-in is thirty lines.

Install

Zero runtime dependencies. The published artifact ships dual ESM/CJS builds plus full TypeScript types. Minimum Node 20.

npm install kinetic-gain-embedded

Package: npmjs.com/package/kinetic-gain-embedded · provenance-stamped, Apache-2.0.

Load the buyer's Decision Card

The Decision Card is the buyer-issued JSON document that describes which fields are PII / PHI / SPI, which fields are tokenizable, and which AI tools are allowed to see what. Your customer signs it. You enforce it.

import { parseDecisionCard } from "kinetic-gain-embedded";

const card = parseDecisionCard(JSON.parse(decisionCardJson));

Wire the audit stream

Sinks ship: NDJSON file (production-default), HTTP, in-memory (tests), and a write-your-own interface for routing to your SIEM / data warehouse / S3 / wherever.

import { AuditStream, NdjsonFileSink } from "kinetic-gain-embedded";

const audit = new AuditStream({
  source: "my-saas-prod",
  decisionCardRef: card.canonical_url,
  sink: new NdjsonFileSink("/var/log/audit.ndjson")
});

On every customer-data touch: tokenize then emit

This is the actual runtime hot path. Two lines: the vault contract rewrites the record before any AI tool sees it; the audit emit records what was redacted, on which session, against which Decision Card revision.

import { applyVaultContract } from "kinetic-gain-embedded";

const { payload, redactionApplied } = applyVaultContract(customerRecord, card);
// payload is tokenized — hand IT to the AI tool, not the raw record

await audit.emit({
  kind: "ai.chat.completion",
  redaction_applied: redactionApplied,
  session_id: req.sessionId
});