@privacyscrubber/sdk 2.4.0 → 2.4.2

package/examples/python-bridge/privacyscrubber/client.py

@@ -89,14 +89,16 @@ class PrivacyScrubberClient:
                 self.daemon_path,
                 "--profile", self.default_profile
             ]
+            proc_env = os.environ.copy()
             if self.license_key:
-                cmd.extend(["--license-key", self.license_key])
+                proc_env["PRIVACYSCRUBBER_LICENSE_KEY"] = self.license_key
 
             self._process = subprocess.Popen(
                 cmd,
                 stdin=subprocess.PIPE,
                 stdout=subprocess.PIPE,
                 stderr=subprocess.PIPE,
+                env=proc_env,
                 text=True,
                 bufsize=1
             )
@@ -341,14 +343,16 @@ class AsyncPrivacyScrubberClient:
                 self.daemon_path,
                 "--profile", self.default_profile
             ]
+            proc_env = os.environ.copy()
             if self.license_key:
-                cmd.extend(["--license-key", self.license_key])
+                proc_env["PRIVACYSCRUBBER_LICENSE_KEY"] = self.license_key
 
             self._process = await asyncio.create_subprocess_exec(
                 *cmd,
                 stdin=asyncio.subprocess.PIPE,
                 stdout=asyncio.subprocess.PIPE,
-                stderr=asyncio.subprocess.PIPE
+                stderr=asyncio.subprocess.PIPE,
+                env=proc_env
             )
 
     async def close(self) -> None:
@@ -387,13 +391,15 @@ class AsyncPrivacyScrubberClient:
                     self.daemon_path,
                     "--profile", self.default_profile
                 ]
+                proc_env = os.environ.copy()
                 if self.license_key:
-                    cmd.extend(["--license-key", self.license_key])
+                    proc_env["PRIVACYSCRUBBER_LICENSE_KEY"] = self.license_key
                 self._process = await asyncio.create_subprocess_exec(
                     *cmd,
                     stdin=asyncio.subprocess.PIPE,
                     stdout=asyncio.subprocess.PIPE,
-                    stderr=asyncio.subprocess.PIPE
+                    stderr=asyncio.subprocess.PIPE,
+                    env=proc_env
                 )
 
             self._req_id += 1

package/examples/python-bridge/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "privacyscrubber"
-version = "2.4.0"
+version = "2.4.2"
 description = "Zero-Trust Data Sanitization & In-Memory PII Shield for Python AI Pipelines (ZTDS RFC v1.0)"
 readme = "README.md"
 requires-python = ">=3.8"

package/examples/python-bridge/setup.py

@@ -13,7 +13,7 @@ with open(os.path.join(here, "README.md"), encoding="utf-8") as f:
 
 setup(
     name="privacyscrubber",
-    version="2.4.0",
+    version="2.4.2",
     description="Zero-Trust Data Sanitization & In-Memory PII Shield for Python AI Pipelines (ZTDS RFC v1.0)",
     long_description=long_description,
     long_description_content_type="text/markdown",

package/examples/python-bridge/test_python_bridge.py

@@ -312,7 +312,7 @@ class TestPrivacyScrubberBridge(unittest.TestCase):
             cwd=bridge_dir,
             env=sub_env
         )
-        self.assertIn("2.4.0", ver_out)
+        self.assertIn("2.4.2", ver_out)
 
 
 if __name__ == "__main__":

package/fastmcp.cjs

@@ -1,7 +1,7 @@
 /**
  * @privacyscrubber/fastmcp-guard
  * Zero-Trust Data Sanitization (ZTDS) In-Memory Middleware for FastMCP
- * Conforms to IETF Standards Track: draft-sibiryakov-ztds-protocol-02
+ * Conforms to IETF Standards Track: draft-sibiryakov-ztds-protocol-01
  *
  * Core Protocol Invariants:
  * 1. Zero External Egress Prior to Sanitization
@@ -14,7 +14,7 @@
 const crypto = require("node:crypto");
 
 const ZTDS_PATTERNS = {
-  API_SECRET: /\b(?:sk-(?:proj-)?[A-Za-z0-9_-]{20,}|(?:ghp|gho|ghu|ghs|ghr|github_pat_)[A-Za-z0-9_]{20,}|eyJ[a-zA-Z0-9_-]{20,}\.[a-zA-Z0-9_-]{20,}\.[a-zA-Z0-9_-]{20,})\b/g,
+  API_SECRET: /\b(?:sk-ant-(?:api\d{2}|admin\d{2}|sid\d{2})-[a-zA-Z0-9_-]{16,128}|sk-(?:proj-)?[A-Za-z0-9_-]{20,}|AIza[0-9A-Za-z_-]{35}|(?:ghp|gho|ghu|ghs|ghr|github_pat_|glpat-|xox[baprs]-)[A-Za-z0-9_-]{16,}|(?:[rs]k)_(?:test|live)_[a-zA-Z0-9]{10,}|eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,})\b/g,
   AWS_KEY: /\b(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA)[A-Z0-9]{16}\b/g,
   CREDIT_CARD: /\b(?:\d{4}[-\s]?){3}\d{4}\b/g,
   EMAIL: /[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9-]{1,63}(?:\.[A-Za-z0-9-]{1,63})*\.[A-Za-z]{2,24}/g,
@@ -24,7 +24,7 @@ const ZTDS_PATTERNS = {
   SSN: /\b\d{3}-\d{2}-\d{4}\b/g,
 };
 
-const TOKEN_PATTERN = /\[([A-Z_]+)_TOKEN_([a-zA-Z0-9_-]+)\]/g;
+const TOKEN_PATTERN = /(?:%5[Bb]|\\u005[Bb]|&(?:amp;)?#0*91;|\[|<|\{\{?|__|【|［)[*`_~\s]*([A-Z_]+)_TOKEN_([a-zA-Z0-9_-]+)[*`_~.,;:!?\s]*(?:%5[Dd]|\\u005[Dd]|&(?:amp;)?#0*93;|\]|>|\}\}?|__|】|］)/gi;
 
 function escapeRegex(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -41,15 +41,18 @@ function buildStreamReplacer(tokenMap = {}, options = {}) {
 
   for (const k of sortedKeys) {
     const val = tokenMap[k];
-    const inner = k.replace(/^\[|<|\{\{|__|\]|>|\}\}|__/g, '');
-    const match = inner.match(/^([A-Za-z_0-9]+?)[-_ ]?(\d+)$/);
+    const inner = k.replace(/^(?:\[|<|\{\{?|__|【|［|〔|「|『)|(?:\]|>|\}\}?|__|】|］|〕|」|』)$/g, '');
+    const match = inner.match(/^([A-Za-z_0-9]+?)[-_ ]([a-zA-Z0-9]+)$/);
 
     if (match) {
       const label = escapeRegex(match[1]);
-      const idx = match[2];
-      const patternStr = '(?:\\[\\s*' + label + '[-_\\s]*0*' + idx + '\\s*\\]|<\\s*' + label + '[-_\\s]*0*' + idx + '\\s*>|\\{\\{\\s*' + label + '[-_\\s]*0*' + idx + '\\s*\\}\\}|__\\s*' + label + '[-_\\s]*0*' + idx + '\\s*__|\\b' + label + '[-_\\s]+0*' + idx + '\\b)';
+      const idx = escapeRegex(match[2]);
+      const idxPat = /^\d+$/.test(match[2]) ? '0*' + idx : idx;
+      const corePat = '[*`_~\\s]*' + label + '[*`_~]*[-_\\s]*' + idxPat + '[*`_~.,;:!?\\s]*';
+      const patternStr = '(?:\\[' + corePat + '\\]|<' + corePat + '>|\\{\\{' + corePat + '\\}\\}|\\{' + corePat + '\\}|__' + corePat + '__|[【［〔「『]' + corePat + '[】］〕」』]|%5B' + corePat + '%5D|&#(?:91|091|x5[bB]);' + corePat + '&#(?:93|093|x5[dD]);|&(?:lbrack|lsqb);' + corePat + '&(?:rbrack|rsqb);|\\\\u005[bB]' + corePat + '\\\\u005[dD]|\\b' + label + '[-_\\s]+' + idxPat + '\\b)';
       patterns.push(patternStr);
-      const normKey = (match[1] + '_' + parseInt(idx, 10)).toUpperCase();
+      const normSuffix = /^\d+$/.test(match[2]) ? String(parseInt(match[2], 10)) : match[2].toUpperCase();
+      const normKey = (match[1] + '_' + normSuffix).toUpperCase();
       lookup.set(normKey, val);
       lookup.set(k, val);
       lookup.set(k.toUpperCase(), val);
@@ -76,10 +79,15 @@ function buildStreamReplacer(tokenMap = {}, options = {}) {
       } else if (lookup.has(coreMatch.toUpperCase())) {
         restored = lookup.get(coreMatch.toUpperCase());
       } else {
-        const inner = coreMatch.replace(/^\[|<|\{\{|__|\]|>|\}\}|__/g, '').trim();
-        const m = inner.match(/^([A-Za-z_0-9]+?)[-_ ]?(\d+)$/);
+        const inner = coreMatch
+          .replace(/^(?:%5B|&#(?:91|091|x5[bB]);|&(?:lbrack|lsqb);|\\u005[bB]|\[|<|\{\{?|__|【|［|〔|「|『)/i, '')
+          .replace(/(?:%5D|&#(?:93|093|x5[dD]);|&(?:rbrack|rsqb);|\\u005[dD]|\]|>|\}\}?|__|】|］|〕|」|』)$/i, '')
+          .replace(/[*`_~.,;:!?\s]+/g, ' ')
+          .trim();
+        const m = inner.match(/^([A-Za-z_0-9]+?)[-_ ]([a-zA-Z0-9]+)$/);
         if (m) {
-          const normKey = (m[1] + '_' + parseInt(m[2], 10)).toUpperCase();
+          const normSuffix = /^\d+$/.test(m[2]) ? String(parseInt(m[2], 10)) : m[2].toUpperCase();
+          const normKey = (m[1] + '_' + normSuffix).toUpperCase();
           if (lookup.has(normKey)) {
             restored = lookup.get(normKey);
           }
@@ -158,12 +166,12 @@ class StreamingDetokenizer {
     const tailLen = 160;
     const tail = this.pendingBuffer.length > tailLen ? this.pendingBuffer.slice(-tailLen) : this.pendingBuffer;
     const offset = this.pendingBuffer.length > tailLen ? this.pendingBuffer.length - tailLen : 0;
-    const m = tail.match(/(?:\[|<|\{\{?|__?)[A-Za-z0-9_\-А-Яа-яЁё ]{0,128}$/);
+    const m = tail.match(/(?:(?:\[|【|［|〔|「|『|<|\{\{?|__?|%5[Bb]|\\u005[Bb]|&(?:amp;)?(?:#0*91;|#[xX]0*5[Bb];|lbrack;))[A-Za-z0-9_\-А-Яа-яЁё *`~.\\]{0,128}(?:%5?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?3?|[xX]0*5?[Dd]?)?|r(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)?|%[0-9A-Fa-f]?|\\(?:u(?:0(?:0(?:5)?)?)?)?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?1?|[xX]0*5?)?|l(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)$/);
 
     if (m) {
       const candidate = m[0];
-      const isClosedUnderscoreToken = candidate.length >= 4 && candidate.startsWith('__') && candidate.endsWith('__');
-      if (isClosedUnderscoreToken && this.replacer(candidate) !== candidate) {
+      const isClosedUnderscoreOrUnicode = (candidate.length >= 4 && candidate.startsWith('__') && candidate.endsWith('__')) || /\\u005[Dd]/.test(candidate);
+      if (isClosedUnderscoreOrUnicode && this.replacer(candidate) !== candidate) {
         const toEmit = this.pendingBuffer;
         this.pendingBuffer = '';
         return this.replacer(toEmit);
@@ -268,7 +276,9 @@ class ZTDSFastMCPGuard {
 
     const tokenMap = this._sessionMaps.get(sessionId);
     const entityMap = this._entityMaps.get(sessionId);
-    let sanitized = text;
+    let sanitized = text
+      .replace(/[\u200B-\u200F\u202A-\u202E\u2060-\u206F\uFEFF\u00AD]/g, "")
+      .replace(/[\uFF01-\uFF5E]/g, (ch) => String.fromCharCode(ch.charCodeAt(0) - 0xFEE0));
 
     for (const entityType of this.enabledEntities) {
       const pattern = ZTDS_PATTERNS[entityType];
@@ -317,8 +327,9 @@ class ZTDSFastMCPGuard {
       return text;
     }
 
-    return text.replace(TOKEN_PATTERN, (match) => {
-      return tokenMap.get(match) || match;
+    return text.replace(TOKEN_PATTERN, (match, entityType, tokenId) => {
+      const canonical = `[${entityType.toUpperCase()}_TOKEN_${tokenId}]`;
+      return tokenMap.get(canonical) || tokenMap.get(match) || match;
     });
   }
 
@@ -475,7 +486,7 @@ class ZTDSFastMCPGuard {
 
         const ztdsMeta = {
           sessionId,
-          standard: "IETF draft-sibiryakov-ztds-protocol-02",
+          standard: "IETF draft-sibiryakov-ztds-protocol-01",
           zeroEgress: true,
         };
 

package/index.cjs

@@ -179,7 +179,7 @@ function buildAuditTelemetry(currentTokenMap = {}) {
     }
 
     const ipHoldings = {
-        standard: 'IETF draft-sibiryakov-ztds-protocol-00',
+        standard: 'IETF draft-sibiryakov-ztds-protocol-01',
         standardUrl: 'https://datatracker.ietf.org/doc/draft-sibiryakov-ztds-protocol/',
         patent: "U.S. & Int'l Patents Pending (Paris Convention Priority)",
         trademark: 'ZTDS™ Reg. #182655957 (ILPO Cl 9 & 42)'
@@ -189,27 +189,27 @@ function buildAuditTelemetry(currentTokenMap = {}) {
         {
             statute: 'EU AI Act (Art. 50)',
             scope: 'AI Transparency & Data Minimization',
-            rule: '0-byte external network transmission; prevents unauthorized ingestion into frontier models.'
+            rule: 'Sanitization runs locally by design; reduces the content sent to external AI models. Informational mapping, not a compliance determination.'
         },
         {
             statute: 'GDPR (Art. 4, 25, 28, 32)',
             scope: 'Pseudonymization & Processor Liability',
-            rule: 'Volatile client-side tokenization eliminates GDPR Article 28 data processor liability.'
+            rule: 'Client-side pseudonymization is a technical measure supporting Art. 25 and 32. It does not by itself remove controller or processor obligations.'
         },
         {
             statute: 'HIPAA 45 CFR § 164.514(b)',
             scope: 'Safe Harbor De-Identification',
-            rule: 'Deterministic removal of all 18 PHI identifiers prior to AI analysis.'
+            rule: 'Pattern-based masking of direct identifiers supports Safe Harbor de-identification workflows. Review output for residual identifiers before sharing.'
         },
         {
             statute: 'IRC § 7216 & IRS Pub. 1075',
             scope: 'Tax Return Information Confidentiality',
-            rule: 'Strict criminal penalty safeguard against unauthorized disclosure of tax records to cloud LLMs.'
+            rule: 'Masking identifiers before AI use can reduce exposure of tax return information. Informational mapping, not legal advice.'
         },
         {
             statute: 'FRE 502',
             scope: 'Attorney-Client Privilege Preservation',
-            rule: 'Automated in-memory redaction prevents inadvertent waiver of legal privilege in AI workflows.'
+            rule: 'In-memory redaction can reduce disclosure of privileged details in AI workflows. Privilege determinations remain a legal judgment.'
         }
     ];
 
@@ -238,7 +238,7 @@ const buildCisoAuditTelemetry = buildAuditTelemetry;
 function formatAuditReceipt(telemetry) {
     if (!telemetry || telemetry.totalCount === 0) {
         return "> 🛡️ **PrivacyScrubber Audit Receipt**: CLEAN (ZERO PII DETECTED)\n" +
-               "> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **SDK & Enterprise:** [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing)\n";
+               "> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **7-Day B2B Trial:** `npx @privacyscrubber/sdk trial` | **SDK & Enterprise:** [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing/?tier=sdk&utm_source=npm_sdk&utm_medium=audit_receipt)\n";
     }
     const entitiesList = Object.entries(telemetry.entities)
         .map(([type, count]) => `${count} ${type}`)
@@ -250,7 +250,7 @@ function formatAuditReceipt(telemetry) {
            `> * **Risk Level:** ${icon} ${telemetry.riskLevel}\n` +
            `> * **Framework References (informational):** ${telemetry.frameworksList.join(', ')}\n` +
            `> * **Tokens Masked:** ${telemetry.totalCount} (${entitiesList})\n` +
-           `> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **SDK & Enterprise:** [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing)\n`;
+           `> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **7-Day B2B Trial:** \`npx @privacyscrubber/sdk trial\` | **SDK & Enterprise:** [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing/?tier=sdk&utm_source=npm_sdk&utm_medium=audit_receipt)\n`;
 }
 
 let communityNoticeLogged = false;
@@ -259,7 +259,7 @@ function emitCommunityNoticeIfNeeded(isPro) {
     if (communityNoticeLogged || isPro) return;
     if (typeof process !== 'undefined' && process.env?.NODE_ENV === 'production') {
         communityNoticeLogged = true;
-        console.info('[@privacyscrubber/sdk] Running Community Edition (Core PII).\nTo unlock 25 Enterprise Profiles & DevOps Secrets in production: https://privacyscrubber.com/pricing/?tier=sdk');
+        console.info('[@privacyscrubber/sdk] Running Community Edition (Core PII).\nTo unlock 30 Enterprise Profiles & DevOps Secrets in production: https://privacyscrubber.com/pricing/?tier=sdk&utm_source=npm_sdk&utm_medium=prod_notice (7-Day Trial: npx @privacyscrubber/sdk trial | CISO Memo: npx @privacyscrubber/sdk memo)');
     }
 }
 
@@ -291,7 +291,8 @@ function emitDevSecretNoticeIfNeeded(isPro, tokenMap = {}, limit = 15000) {
             process.stderr.write(
                 `\n[PrivacyScrubber] Intercepted ${count} API secret(s) before LLM egress: ${secretSample}\n` +
                 `[PrivacyScrubber] Protected in local RAM (0 byte network egress). Free Tier active (${limit.toLocaleString()} char cap).\n` +
-                `[PrivacyScrubber] Developer SDK ($299/mo flat) for unlimited backend nodes, CI/CD gates & ETL pipelines: https://privacyscrubber.com/pricing?tier=sdk&src=cli_leak_guard\n\n`
+                `[PrivacyScrubber] Developer SDK ($299/mo flat) for unlimited backend nodes, CI/CD gates & ETL pipelines: https://privacyscrubber.com/pricing?tier=sdk&src=cli_leak_guard\n` +
+                `[PrivacyScrubber] Instant 7-Day Free B2B Trial: npx @privacyscrubber/sdk trial | CISO Approval Memo: npx @privacyscrubber/sdk memo\n\n`
             );
         }
     }
@@ -478,6 +479,18 @@ function sanitize(text, options = {}) {
 
     const licenseCheck = validateLicense(licenseKey);
     const rawTier = licenseCheck.valid ? (licenseCheck.tier || 'PRO') : 'FREE';
+    const isExpiredKey = !licenseCheck.valid && typeof licenseCheck.error === 'string' && /expired/i.test(licenseCheck.error);
+    const isExpiringSoon = licenseCheck.valid && typeof licenseCheck.expires === 'number' && (licenseCheck.expires - Date.now() <= 48 * 3600 * 1000);
+
+    if (isExpiringSoon && typeof process !== 'undefined' && process.stderr && !globalThis.__psSdkPreExpiryLogged) {
+        globalThis.__psSdkPreExpiryLogged = true;
+        const hrs = Math.max(0, Math.round((licenseCheck.expires - Date.now()) / 3600000));
+        process.stderr.write(
+            `\n[@privacyscrubber/sdk] ⏳ 7-Day Evaluation Key expires in ~${hrs}h. Prevent pipeline interruption:\n` +
+            `  - Commercial SDK ($299/mo flat): https://privacyscrubber.com/pricing/?tier=sdk&utm_source=npm_sdk&utm_medium=pilot_expiring_48h\n` +
+            `  - CISO Approval Memo: npx @privacyscrubber/sdk memo\n\n`
+        );
+    }
 
     // Anti-Cannibalization Barrier (SSOT):
     // PRO ($15/mo) and TEAMS ($99/mo) licenses are strictly human-seat licenses for Web App & Chrome Extension.
@@ -511,7 +524,8 @@ function sanitize(text, options = {}) {
 
     if (!isPro && text.length > limit) {
         if (shouldThrow) {
-            const errorMsg = `[PrivacyScrubber] Free Tier character limit exceeded (${limit.toLocaleString()} chars for profile '${profile}', received ${text.length.toLocaleString()} chars). Upgrade to Developer SDK ($299/mo) for unlimited throughput: https://privacyscrubber.com/pricing?tier=sdk&src=dev_limit`;
+            const expiredPrefix = isExpiredKey ? `[PILOT/TRIAL EXPIRED: ${licenseCheck.error}] ` : '';
+            const errorMsg = `[PrivacyScrubber] ${expiredPrefix}Free Tier character limit exceeded (${limit.toLocaleString()} chars for profile '${profile}', received ${text.length.toLocaleString()} chars). Upgrade to Developer SDK ($299/mo) for unlimited throughput: https://privacyscrubber.com/pricing?tier=sdk&src=${isExpiredKey ? 'pilot_expired' : 'dev_limit'} (Run 'npx @privacyscrubber/sdk memo' for CISO approval memo)`;
             throw new PrivacyScrubberLicenseError(errorMsg, {
                 tier: 'FREE',
                 currentLength: text.length,
@@ -1917,7 +1931,7 @@ function formatCefEvent(eventData = {}) {
     const {
         vendor = 'PrivacyScrubber',
         product = 'ZTDS',
-        version = '2.4.0',
+        version = '2.4.2',
         eventClassId = 'PII_REDACTION',
         eventName = 'Zero-Trust PII Sanitization Executed',
         riskLevel = 'LOW EXPOSURE',
@@ -1986,7 +2000,7 @@ function formatSyslogEvent(eventData = {}) {
 function formatJsonlEvent(eventData = {}) {
     const {
         timestamp = new Date().toISOString(),
-        version = '2.4.0',
+        version = '2.4.2',
         protocol = 'ZTDS',
         event = 'sanitization',
         riskLevel = 'LOW EXPOSURE',
@@ -2717,6 +2731,10 @@ const _defaultExport = {
     buildCisoAuditTelemetry,
     formatAuditReceipt,
     generateAuditReport,
+    PSR2_VERSION,
+    PSR2_STATEMENTS,
+    buildPsr2Receipt,
+    psr2Lines,
     formatCefEvent,
     formatSyslogEvent,
     formatJsonlEvent,

package/index.js

@@ -181,7 +181,7 @@ export function buildAuditTelemetry(currentTokenMap = {}) {
     }
 
     const ipHoldings = {
-        standard: 'IETF draft-sibiryakov-ztds-protocol-00',
+        standard: 'IETF draft-sibiryakov-ztds-protocol-01',
         standardUrl: 'https://datatracker.ietf.org/doc/draft-sibiryakov-ztds-protocol/',
         patent: "U.S. & Int'l Patents Pending (Paris Convention Priority)",
         trademark: 'ZTDS™ Reg. #182655957 (ILPO Cl 9 & 42)'
@@ -191,27 +191,27 @@ export function buildAuditTelemetry(currentTokenMap = {}) {
         {
             statute: 'EU AI Act (Art. 50)',
             scope: 'AI Transparency & Data Minimization',
-            rule: '0-byte external network transmission; prevents unauthorized ingestion into frontier models.'
+            rule: 'Sanitization runs locally by design; reduces the content sent to external AI models. Informational mapping, not a compliance determination.'
         },
         {
             statute: 'GDPR (Art. 4, 25, 28, 32)',
             scope: 'Pseudonymization & Processor Liability',
-            rule: 'Volatile client-side tokenization eliminates GDPR Article 28 data processor liability.'
+            rule: 'Client-side pseudonymization is a technical measure supporting Art. 25 and 32. It does not by itself remove controller or processor obligations.'
         },
         {
             statute: 'HIPAA 45 CFR § 164.514(b)',
             scope: 'Safe Harbor De-Identification',
-            rule: 'Deterministic removal of all 18 PHI identifiers prior to AI analysis.'
+            rule: 'Pattern-based masking of direct identifiers supports Safe Harbor de-identification workflows. Review output for residual identifiers before sharing.'
         },
         {
             statute: 'IRC § 7216 & IRS Pub. 1075',
             scope: 'Tax Return Information Confidentiality',
-            rule: 'Strict criminal penalty safeguard against unauthorized disclosure of tax records to cloud LLMs.'
+            rule: 'Masking identifiers before AI use can reduce exposure of tax return information. Informational mapping, not legal advice.'
         },
         {
             statute: 'FRE 502',
             scope: 'Attorney-Client Privilege Preservation',
-            rule: 'Automated in-memory redaction prevents inadvertent waiver of legal privilege in AI workflows.'
+            rule: 'In-memory redaction can reduce disclosure of privileged details in AI workflows. Privilege determinations remain a legal judgment.'
         }
     ];
 
@@ -240,7 +240,7 @@ export const buildCisoAuditTelemetry = buildAuditTelemetry;
 export function formatAuditReceipt(telemetry) {
     if (!telemetry || telemetry.totalCount === 0) {
         return "> 🛡️ **PrivacyScrubber Audit Receipt**: CLEAN (ZERO PII DETECTED)\n" +
-               "> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **SDK & Enterprise:** [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing)\n";
+               "> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **7-Day B2B Trial:** `npx @privacyscrubber/sdk trial` | **SDK & Enterprise:** [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing/?tier=sdk&utm_source=npm_sdk&utm_medium=audit_receipt)\n";
     }
     const entitiesList = Object.entries(telemetry.entities)
         .map(([type, count]) => `${count} ${type}`)
@@ -252,7 +252,7 @@ export function formatAuditReceipt(telemetry) {
            `> * **Risk Level:** ${icon} ${telemetry.riskLevel}\n` +
            `> * **Framework References (informational):** ${telemetry.frameworksList.join(', ')}\n` +
            `> * **Tokens Masked:** ${telemetry.totalCount} (${entitiesList})\n` +
-           `> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **SDK & Enterprise:** [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing)\n`;
+           `> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) | **7-Day B2B Trial:** \`npx @privacyscrubber/sdk trial\` | **SDK & Enterprise:** [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing/?tier=sdk&utm_source=npm_sdk&utm_medium=audit_receipt)\n`;
 }
 
 let communityNoticeLogged = false;
@@ -261,7 +261,7 @@ function emitCommunityNoticeIfNeeded(isPro) {
     if (communityNoticeLogged || isPro) return;
     if (typeof process !== 'undefined' && process.env?.NODE_ENV === 'production') {
         communityNoticeLogged = true;
-        console.info('[@privacyscrubber/sdk] Running Community Edition (Core PII).\nTo unlock 25 Enterprise Profiles & DevOps Secrets in production: https://privacyscrubber.com/pricing/?tier=sdk');
+        console.info('[@privacyscrubber/sdk] Running Community Edition (Core PII).\nTo unlock 30 Enterprise Profiles & DevOps Secrets in production: https://privacyscrubber.com/pricing/?tier=sdk&utm_source=npm_sdk&utm_medium=prod_notice (7-Day Trial: npx @privacyscrubber/sdk trial | CISO Memo: npx @privacyscrubber/sdk memo)');
     }
 }
 
@@ -293,7 +293,8 @@ function emitDevSecretNoticeIfNeeded(isPro, tokenMap = {}, limit = 15000) {
             process.stderr.write(
                 `\n[PrivacyScrubber] Intercepted ${count} API secret(s) before LLM egress: ${secretSample}\n` +
                 `[PrivacyScrubber] Protected in local RAM (0 byte network egress). Free Tier active (${limit.toLocaleString()} char cap).\n` +
-                `[PrivacyScrubber] Developer SDK ($299/mo flat) for unlimited backend nodes, CI/CD gates & ETL pipelines: https://privacyscrubber.com/pricing?tier=sdk&src=cli_leak_guard\n\n`
+                `[PrivacyScrubber] Developer SDK ($299/mo flat) for unlimited backend nodes, CI/CD gates & ETL pipelines: https://privacyscrubber.com/pricing?tier=sdk&src=cli_leak_guard\n` +
+                `[PrivacyScrubber] Instant 7-Day Free B2B Trial: npx @privacyscrubber/sdk trial | CISO Approval Memo: npx @privacyscrubber/sdk memo\n\n`
             );
         }
     }
@@ -480,6 +481,18 @@ export function sanitize(text, options = {}) {
 
     const licenseCheck = validateLicense(licenseKey);
     const rawTier = licenseCheck.valid ? (licenseCheck.tier || 'PRO') : 'FREE';
+    const isExpiredKey = !licenseCheck.valid && typeof licenseCheck.error === 'string' && /expired/i.test(licenseCheck.error);
+    const isExpiringSoon = licenseCheck.valid && typeof licenseCheck.expires === 'number' && (licenseCheck.expires - Date.now() <= 48 * 3600 * 1000);
+
+    if (isExpiringSoon && typeof process !== 'undefined' && process.stderr && !globalThis.__psSdkPreExpiryLogged) {
+        globalThis.__psSdkPreExpiryLogged = true;
+        const hrs = Math.max(0, Math.round((licenseCheck.expires - Date.now()) / 3600000));
+        process.stderr.write(
+            `\n[@privacyscrubber/sdk] ⏳ 7-Day Evaluation Key expires in ~${hrs}h. Prevent pipeline interruption:\n` +
+            `  - Commercial SDK ($299/mo flat): https://privacyscrubber.com/pricing/?tier=sdk&utm_source=npm_sdk&utm_medium=pilot_expiring_48h\n` +
+            `  - CISO Approval Memo: npx @privacyscrubber/sdk memo\n\n`
+        );
+    }
 
     // Anti-Cannibalization Barrier (SSOT):
     // PRO ($15/mo) and TEAMS ($99/mo) licenses are strictly human-seat licenses for Web App & Chrome Extension.
@@ -513,7 +526,8 @@ export function sanitize(text, options = {}) {
 
     if (!isPro && text.length > limit) {
         if (shouldThrow) {
-            const errorMsg = `[PrivacyScrubber] Free Tier character limit exceeded (${limit.toLocaleString()} chars for profile '${profile}', received ${text.length.toLocaleString()} chars). Upgrade to Developer SDK ($299/mo) for unlimited throughput: https://privacyscrubber.com/pricing?tier=sdk&src=dev_limit`;
+            const expiredPrefix = isExpiredKey ? `[PILOT/TRIAL EXPIRED: ${licenseCheck.error}] ` : '';
+            const errorMsg = `[PrivacyScrubber] ${expiredPrefix}Free Tier character limit exceeded (${limit.toLocaleString()} chars for profile '${profile}', received ${text.length.toLocaleString()} chars). Upgrade to Developer SDK ($299/mo) for unlimited throughput: https://privacyscrubber.com/pricing?tier=sdk&src=${isExpiredKey ? 'pilot_expired' : 'dev_limit'} (Run 'npx @privacyscrubber/sdk memo' for CISO approval memo)`;
             throw new PrivacyScrubberLicenseError(errorMsg, {
                 tier: 'FREE',
                 currentLength: text.length,
@@ -1919,7 +1933,7 @@ export function formatCefEvent(eventData = {}) {
     const {
         vendor = 'PrivacyScrubber',
         product = 'ZTDS',
-        version = '2.4.0',
+        version = '2.4.2',
         eventClassId = 'PII_REDACTION',
         eventName = 'Zero-Trust PII Sanitization Executed',
         riskLevel = 'LOW EXPOSURE',
@@ -1988,7 +2002,7 @@ export function formatSyslogEvent(eventData = {}) {
 export function formatJsonlEvent(eventData = {}) {
     const {
         timestamp = new Date().toISOString(),
-        version = '2.4.0',
+        version = '2.4.2',
         protocol = 'ZTDS',
         event = 'sanitization',
         riskLevel = 'LOW EXPOSURE',
@@ -2152,8 +2166,8 @@ export function createAuditLogger(options = {}) {
 }
 
 // ── PSR-2 Receipt Integrity (real SHA-256; parity with src/modules/receipt-integrity.js) ──
-const PSR2_VERSION = 'PSR-2';
-const PSR2_STATEMENTS = {
+export const PSR2_VERSION = 'PSR-2';
+export const PSR2_STATEMENTS = {
   measured: [
     'Token Manifest SHA-256: digest of the sorted token labels held in this session (original values are never hashed or exported).',
     'Entity counts per type.',
@@ -2173,7 +2187,7 @@ const PSR2_STATEMENTS = {
 function psr2Sha256(input) {
   return require('crypto').createHash('sha256').update(String(input == null ? '' : input), 'utf8').digest('hex');
 }
-function buildPsr2Receipt(tokenMap, timestamp = new Date().toISOString()) {
+export function buildPsr2Receipt(tokenMap, timestamp = new Date().toISOString()) {
   const labels = (tokenMap && typeof tokenMap === 'object' ? Object.keys(tokenMap) : []).slice().sort();
   const counts = {};
   for (const t of labels) {
@@ -2186,7 +2200,7 @@ function buildPsr2Receipt(tokenMap, timestamp = new Date().toISOString()) {
   const canonical = [PSR2_VERSION, timestamp, 'none', manifestSha256, entityCounts, 'na'].join('|');
   return { version: PSR2_VERSION, timestamp, outputSha256: null, manifestSha256, entityCounts, tokensTotal: labels.length, tokensPresentInOutput: null, canonical, receiptSha256: psr2Sha256(canonical) };
 }
-function psr2Lines(r) {
+export function psr2Lines(r) {
   return [
     `Receipt Version: ${r.version}`,
     `Timestamp (UTC): ${r.timestamp}`,
@@ -2724,6 +2738,10 @@ export default {
     buildCisoAuditTelemetry,
     formatAuditReceipt,
     generateAuditReport,
+    PSR2_VERSION,
+    PSR2_STATEMENTS,
+    buildPsr2Receipt,
+    psr2Lines,
     formatCefEvent,
     formatSyslogEvent,
     formatJsonlEvent,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@privacyscrubber/sdk",
-  "version": "2.4.0",
+  "version": "2.4.2",
   "description": "In-process consumer privacy defense and pre-emptive PII interception SDK for Node.js, Next.js, and AI pipelines. Zero data loss, zero third parties, sub-millisecond in-memory execution.",
   "main": "index.cjs",
   "module": "index.js",
@@ -101,6 +101,10 @@
     "type": "git",
     "url": "git+https://github.com/moxno/privacyscrubber-mcp.git"
   },
+  "funding": {
+    "type": "github",
+    "url": "https://github.com/moxno/privacyscrubber-mcp"
+  },
   "engines": {
     "node": ">=18.0.0"
   }