@privacyscrubber/sdk 2.4.6 → 2.4.8

package/browser.js

@@ -70,7 +70,10 @@ export class PrivacyScrubberLicenseError extends Error {
         this.currentLength = currentLength;
         this.limit = limit;
         this.profile = profile;
-        this.upgradeUrl = 'https://privacyscrubber.com/pricing?utm_source=npm_sdk&utm_medium=sdk_error&utm_campaign=dev_upsell';
+        const safeProf = encodeURIComponent(String(profile || 'General'));
+        this.upgradeUrl = `https://privacyscrubber.com/pricing?tier=sdk&profile=${safeProf}&utm_source=npm_sdk&utm_medium=sdk_error&utm_campaign=dev_upsell`;
+        this.trialUrl = `https://privacyscrubber.com/pricing?tier=sdk&trial=true&profile=${safeProf}&utm_source=npm_sdk&utm_medium=sdk_error&utm_campaign=dev_upsell`;
+        this.trialCommand = 'npx @privacyscrubber/sdk trial';
     }
 }
 
@@ -170,11 +173,27 @@ export function buildAuditTelemetry(currentTokenMap = {}) {
         trademark: 'ZTDS™ Reg. #182655957 (ILPO Cl 9 & 42)'
     };
 
+    const agenticProtocol = {
+        protocolsSupported: ['MCP-1.0 (stdio/SSE)', 'A2A-1.0 (Agent2Agent)', 'ZTDS-RFC-v1.0'],
+        agentCardUrl: 'https://privacyscrubber.com/.well-known/agent-card.json',
+        ztdsStandardCardUrl: 'https://ztds.ai/.well-known/agent-card.json',
+        regulatorySafeHarbor: [
+            'GDPR-Art-4(5)-Pseudonymization',
+            'GDPR-Art-25-Privacy-by-Design',
+            'GDPR-Art-32-TOMs',
+            'EU-AI-Act-Art-50',
+            'EU-AI-Act-Art-17-EN-18286-QMS',
+            'CNIL-ICO-Agentic-Memory-Compartmentalization',
+            'IL-PPL-Amendment-13-Sec-17'
+        ],
+        zeroCleartextEgress: true
+    };
+
     const statutoryCitations = [
         {
-            statute: 'EU AI Act (Art. 50)',
-            scope: 'AI Transparency & Data Minimization',
-            rule: 'Sanitization runs locally by design; reduces the content sent to external AI models. Informational mapping, not a compliance determination.'
+            statute: 'EU AI Act (Art. 50 & Art. 17 / EN 18286:2026 QMS)',
+            scope: 'AI Transparency, Data Minimization & Harmonized QMS Governance',
+            rule: 'Sanitization runs locally by design; reduces the content sent to external AI models and supports Article 17 Quality Management System (EN 18286:2026) data governance controls. Informational mapping, not a compliance determination.'
         },
         {
             statute: 'GDPR (Art. 4, 25, 28, 32)',
@@ -206,6 +225,7 @@ export function buildAuditTelemetry(currentTokenMap = {}) {
         frameworksList: Array.from(frameworksSet),
         statutoryCitations,
         ipHoldings,
+        agenticProtocol,
         multimodalEgress: '0.00 Bytes (Solid Blackout & Burn-in Verified)'
     };
 }
@@ -296,7 +316,8 @@ export function sanitize(text, options = {}) {
 
     if (!isPro && text.length > limit) {
         if (shouldThrow) {
-            const errorMsg = `[PrivacyScrubber] Free Tier character limit exceeded (${limit.toLocaleString()} chars for profile '${profile}', received ${text.length.toLocaleString()} chars). Upgrade to Developer SDK ($299/mo) for unlimited throughput: https://privacyscrubber.com/pricing?tier=sdk&src=dev_limit`;
+            const safeProf = encodeURIComponent(String(profile || 'General'));
+            const errorMsg = `[PrivacyScrubber] Free Tier character limit exceeded (${limit.toLocaleString()} chars for profile '${profile}', received ${text.length.toLocaleString()} chars). Upgrade to Developer SDK ($299/mo) for unlimited throughput: https://privacyscrubber.com/pricing?tier=sdk&profile=${safeProf}&src=dev_limit (Start 7-day B2B trial: 'npx @privacyscrubber/sdk trial')`;
             throw new PrivacyScrubberLicenseError(errorMsg, {
                 tier: 'FREE',
                 currentLength: text.length,
@@ -373,11 +394,15 @@ export function sanitize(text, options = {}) {
             limit: limit,
             wasTruncated: wasTruncated,
             ...(isSeatTier && {
-                upgradeUrl: 'https://privacyscrubber.com/pricing?tier=sdk&src=seat_tier_mismatch',
+                upgradeUrl: `https://privacyscrubber.com/pricing?tier=sdk&profile=${encodeURIComponent(String(profile || 'General'))}&src=seat_tier_mismatch`,
+                trialUrl: `https://privacyscrubber.com/pricing?tier=sdk&trial=true&profile=${encodeURIComponent(String(profile || 'General'))}&src=seat_tier_mismatch`,
+                trialCommand: 'npx @privacyscrubber/sdk trial',
                 recommendation: `Your ${rawTier} license is valid for interactive browser seats only. Upgrade to Developer SDK ($299/mo) for unlimited programmatic SDK throughput: https://privacyscrubber.com/pricing?tier=sdk`
             }),
             ...(!isPro && !isSeatTier && {
-                upgradeUrl: 'https://privacyscrubber.com/pricing?tier=sdk&src=dev_upsell',
+                upgradeUrl: `https://privacyscrubber.com/pricing?tier=sdk&profile=${encodeURIComponent(String(profile || 'General'))}&src=dev_upsell`,
+                trialUrl: `https://privacyscrubber.com/pricing?tier=sdk&trial=true&profile=${encodeURIComponent(String(profile || 'General'))}&src=dev_upsell`,
+                trialCommand: 'npx @privacyscrubber/sdk trial',
                 recommendation: 'Upgrade to Developer SDK ($299/mo) for unlimited text processing, custom regex rules, and specialized compliance profiles.'
             })
         },

package/cli.js

@@ -32,7 +32,7 @@ for (const a of rawArgs) {
   }
 }
 
-let sdkVersion = '2.4.6';
+let sdkVersion = '2.4.8';
 try {
   const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf8'));
   sdkVersion = pkg.version || sdkVersion;

package/examples/python-bridge/fastapi_example.py

@@ -59,7 +59,7 @@ if FASTAPI_AVAILABLE:
     app = FastAPI(
         title="PrivacyScrubber ZTDS Sidecar Proxy",
         description="Zero-Trust Data Sanitization & In-Memory PII Shield for LLM Pipelines",
-        version="2.4.6"
+        version="2.4.8"
     )
 
     @app.on_event("startup")

package/examples/python-bridge/privacyscrubber/__init__.py

@@ -24,7 +24,7 @@ from privacyscrubber.exceptions import (
     PrivacyScrubberLicenseError,
 )
 
-__version__ = "2.4.6"
+__version__ = "2.4.8"
 __author__ = "Ilya Sibiryakov (BrandMeWeb)"
 __license__ = "Proprietary"
 

package/examples/python-bridge/privacyscrubber/bridge_daemon.cjs

@@ -115,7 +115,7 @@ rl.on('line', (line) => {
                 sendResponse(id, {
                     pong: true,
                     engine: 'PrivacyScrubber ZTDS',
-                    version: sdk.SDK_VERSION || '2.4.6',
+                    version: sdk.SDK_VERSION || '2.4.8',
                     uptime: process.uptime()
                 });
                 break;

package/examples/python-bridge/privacyscrubber/cli.py

@@ -50,7 +50,7 @@ def main() -> None:
     args = parser.parse_args()
 
     if args.version:
-        print("PrivacyScrubber ZTDS Python SDK v2.4.6")
+        print("PrivacyScrubber ZTDS Python SDK v2.4.8")
         sys.exit(0)
 
     if not args.command:

package/examples/python-bridge/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "privacyscrubber"
-version = "2.4.6"
+version = "2.4.8"
 description = "Zero-Trust Data Sanitization & In-Memory PII Shield for Python AI Pipelines (ZTDS RFC v1.0)"
 readme = "README.md"
 requires-python = ">=3.8"

package/examples/python-bridge/setup.py

@@ -13,7 +13,7 @@ with open(os.path.join(here, "README.md"), encoding="utf-8") as f:
 
 setup(
     name="privacyscrubber",
-    version="2.4.6",
+    version="2.4.8",
     description="Zero-Trust Data Sanitization & In-Memory PII Shield for Python AI Pipelines (ZTDS RFC v1.0)",
     long_description=long_description,
     long_description_content_type="text/markdown",

package/fastmcp.cjs

@@ -30,6 +30,52 @@ function escapeRegex(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
 
+const LOG_TO_LEAK_TRIGGER_RE = /\b(?:after\s+(?:completing|executing|finishing|returning|calling)|post[-_ ]?hoc|once\s+the\s+(?:task|query|response|tool)\s+is\s+complete|before\s+final\s+answer|upon\s+completion)\b/i;
+const LOG_TO_LEAK_BINDING_RE = /\b(?:invoke|call|dispatch|send\s+(?:to|via)|forward\s+to|log\s+to|report\s+to)\s+[`'"]?[a-zA-Z0-9_.:-]+(?:log|audit|telemetry|sink|webhook|report|collect|track)[a-zA-Z0-9_.:-]*[`'"]?/i;
+const LOG_TO_LEAK_PRESSURE_RE = /\b(?:mandatory\s+(?:compliance|audit|logging|telemetry)|without\s+informing\s+the\s+user|silently|do\s+not\s+mention\s+this\s+step|required\s+by\s+security\s+policy|include\s+(?:full|raw|entire)\s+(?:query|prompt|response|context|token))\b/i;
+const SSRF_REDIRECT_TARGET_RE = /(?:https?:\/\/|\/\/)(?:169\.254\.169\.254|metadata\.google\.internal|100\.100\.100\.200|localhost|127\.\d+\.\d+\.\d+|0\.0\.0\.0|\[::1\]|10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+|172\.(?:1[6-9]|2\d|3[01])\.\d+\.\d+)(?::\d+)?(?:\/|\b)/i;
+
+function inspectToolMetadata(toolDef = {}) {
+  const threats = [];
+  if (!toolDef || typeof toolDef !== "object") {
+    return { safe: true, threats };
+  }
+  const serialized = JSON.stringify({
+    name: toolDef.name || "",
+    description: toolDef.description || "",
+    inputSchema: toolDef.inputSchema || toolDef.parameters || {}
+  });
+
+  const hasTrigger = LOG_TO_LEAK_TRIGGER_RE.test(serialized);
+  const hasBinding = LOG_TO_LEAK_BINDING_RE.test(serialized);
+  const hasPressure = LOG_TO_LEAK_PRESSURE_RE.test(serialized);
+  if ((hasTrigger && hasBinding) || (hasBinding && hasPressure) || (hasTrigger && hasPressure)) {
+    threats.push("LOG_TO_LEAK_POST_HOC_EXFILTRATION");
+  }
+  if (SSRF_REDIRECT_TARGET_RE.test(serialized)) {
+    threats.push("MCP_SSRF_INTERNAL_METADATA_TARGET");
+  }
+  return {
+    safe: threats.length === 0,
+    threats
+  };
+}
+
+function inspectToolArgsForSsrf(args) {
+  const threats = [];
+  if (args === null || args === undefined) {
+    return { safe: true, threats };
+  }
+  const text = typeof args === "string" ? args : JSON.stringify(args);
+  if (SSRF_REDIRECT_TARGET_RE.test(text)) {
+    threats.push("MCP_SSRF_INTERNAL_METADATA_TARGET");
+  }
+  return {
+    safe: threats.length === 0,
+    threats
+  };
+}
+
 function buildStreamReplacer(tokenMap = {}, options = {}) {
   if (!tokenMap || typeof tokenMap !== 'object' || Object.keys(tokenMap).length === 0) {
     return (text) => text || '';
@@ -566,6 +612,14 @@ class ZTDSFastMCPGuard {
       this._streamDetokenizers.delete(sessionId);
     }
   }
+
+  inspectToolMetadata(toolDef) {
+    return inspectToolMetadata(toolDef);
+  }
+
+  inspectToolArgsForSsrf(args) {
+    return inspectToolArgsForSsrf(args);
+  }
 }
 
 function createZTDSGuard(options) {
@@ -606,4 +660,6 @@ module.exports = {
   ztdsGuardTool,
   wrapExecute,
   withZTDS,
+  inspectToolMetadata,
+  inspectToolArgsForSsrf,
 };

package/fastmcp.d.ts

@@ -63,8 +63,13 @@ export declare class ZTDSFastMCPGuard {
   ): (args: TArgs, context?: Partial<ZTDSContext>) => Promise<TResult & { _ztds: ZTDSMetadata }>;
 
   zeroizeSession(sessionId: string): void;
+  inspectToolMetadata(toolDef: Record<string, unknown>): { safe: boolean; threats: string[] };
+  inspectToolArgsForSsrf(args: unknown): { safe: boolean; threats: string[] };
 }
 
+export declare function inspectToolMetadata(toolDef: Record<string, unknown>): { safe: boolean; threats: string[] };
+export declare function inspectToolArgsForSsrf(args: unknown): { safe: boolean; threats: string[] };
+
 export declare function createZTDSGuard(options?: ZTDSGuardOptions): ZTDSFastMCPGuard;
 
 export declare function ztdsGuardTool<TArgs = unknown, TResult = unknown>(

package/index.cjs

@@ -39,7 +39,7 @@ const SDK_VERSION = (() => {
             return pkgJson.version;
         }
     } catch (_) {}
-    return '2.4.6';
+    return '2.4.8';
 })();
 
 /**
@@ -88,7 +88,10 @@ class PrivacyScrubberLicenseError extends Error {
         this.currentLength = currentLength;
         this.limit = limit;
         this.profile = profile;
-        this.upgradeUrl = 'https://privacyscrubber.com/pricing?utm_source=npm_sdk&utm_medium=sdk_error&utm_campaign=dev_upsell';
+        const safeProf = encodeURIComponent(String(profile || 'General').toLowerCase());
+        this.upgradeUrl = `https://privacyscrubber.com/pricing?tier=sdk&profile=${safeProf}&utm_source=npm_sdk&utm_medium=sdk_error&utm_campaign=dev_upsell`;
+        this.trialUrl = `https://privacyscrubber.com/pricing?tier=sdk&trial=true&profile=${safeProf}&utm_source=npm_sdk&utm_medium=sdk_error&utm_campaign=dev_upsell`;
+        this.trialCommand = 'npx @privacyscrubber/sdk trial';
     }
 }
 
@@ -129,7 +132,7 @@ function validateLicenseKey(key) {
  * @param {Record<string, string>|string[]} currentTokenMap 
  * @returns {object}
  */
-function buildAuditTelemetry(currentTokenMap = {}) {
+function buildAuditTelemetry(currentTokenMap = {}, extraStats = {}) {
     const entities = {};
     let totalCount = 0;
 
@@ -195,11 +198,27 @@ function buildAuditTelemetry(currentTokenMap = {}) {
         trademark: 'ZTDS™ Reg. #182655957 (ILPO Cl 9 & 42)'
     };
 
+    const agenticProtocol = {
+        protocolsSupported: ['MCP-1.0 (stdio/SSE)', 'A2A-1.0 (Agent2Agent)', 'ZTDS-RFC-v1.0'],
+        agentCardUrl: 'https://privacyscrubber.com/.well-known/agent-card.json',
+        ztdsStandardCardUrl: 'https://ztds.ai/.well-known/agent-card.json',
+        regulatorySafeHarbor: [
+            'GDPR-Art-4(5)-Pseudonymization',
+            'GDPR-Art-25-Privacy-by-Design',
+            'GDPR-Art-32-TOMs',
+            'EU-AI-Act-Art-50',
+            'EU-AI-Act-Art-17-EN-18286-QMS',
+            'CNIL-ICO-Agentic-Memory-Compartmentalization',
+            'IL-PPL-Amendment-13-Sec-17'
+        ],
+        zeroCleartextEgress: true
+    };
+
     const statutoryCitations = [
         {
-            statute: 'EU AI Act (Art. 50)',
-            scope: 'AI Transparency & Data Minimization',
-            rule: 'Sanitization runs locally by design; reduces the content sent to external AI models. Informational mapping, not a compliance determination.'
+            statute: 'EU AI Act (Art. 50 & Art. 17 / EN 18286:2026 QMS)',
+            scope: 'AI Transparency, Data Minimization & Harmonized QMS Governance',
+            rule: 'Sanitization runs locally by design; reduces the content sent to external AI models and supports Article 17 Quality Management System (EN 18286:2026) data governance controls. Informational mapping, not a compliance determination.'
         },
         {
             statute: 'GDPR (Art. 4, 25, 28, 32)',
@@ -223,14 +242,34 @@ function buildAuditTelemetry(currentTokenMap = {}) {
         }
     ];
 
+    const rawLicenseTier = String(extraStats?.licenseTier || '').trim().toUpperCase();
+    const isOrganizationalScope = ['TEAMS', 'SDK', 'OEM', 'ENTERPRISE', 'ENTERPRISE_AIRGAP'].includes(rawLicenseTier);
+    const auditScope = isOrganizationalScope ? {
+        tier: rawLicenseTier,
+        isOrganizational: true,
+        badge: 'ORGANIZATIONAL MULTI-SEAT COMPLIANCE SCOPE',
+        coverage: 'Covers department, clinic, or firm personnel under unified ZTDS policy governance.',
+        upgradeRecommended: false,
+        upgradeUrl: null
+    } : {
+        tier: rawLicenseTier || 'SINGLE_OPERATOR',
+        isOrganizational: false,
+        badge: 'SINGLE-OPERATOR PERSONAL SCOPE',
+        coverage: 'Valid for individual workstation only. Multi-employee clinics, CPA firms, and departments require TEAMS ($99/mo flat, unlimited seats) for organizational audit coverage.',
+        upgradeRecommended: true,
+        upgradeUrl: 'https://privacyscrubber.com/pricing/?tier=teams&utm_source=audit_receipt&utm_medium=scope_upsell'
+    };
+
     return {
         totalCount,
         entities,
         types,
         riskLevel,
         frameworksList: Array.from(frameworksSet),
+        auditScope,
         statutoryCitations,
         ipHoldings,
+        agenticProtocol,
         multimodalEgress: '0.00 Bytes (Solid Blackout & Burn-in Verified)'
     };
 }
@@ -281,6 +320,19 @@ function _resetCommunityNoticeForTesting() {
     communityNoticeLogged = false;
 }
 
+const FREE_PROD_SPECIALIZED_CALL_LIMIT = 250;
+let _freeProdSpecializedCalls = 0;
+let _prodProfileFallbackNoticeLogged = false;
+
+/**
+ * Resets the production specialized call quota state for testing purposes.
+ * @private
+ */
+function _resetProdQuotaForTesting() {
+    _freeProdSpecializedCalls = 0;
+    _prodProfileFallbackNoticeLogged = false;
+}
+
 let devSecretNoticeLogged = false;
 
 function emitDevSecretNoticeIfNeeded(isPro, tokenMap = {}, limit = 15000) {
@@ -461,6 +513,82 @@ We request approval to acquire a **Developer SDK License** (\$299/month flat or
  *   auditReceipt: string
  * }}
  */
+const SDK_VERTICAL_DETECTORS = [
+    { profile: 'medical', label: 'Medical PHI (HIPAA)', regex: /\b(?:Patient\s*(?:Name|ID|DOB|Record)|MRN\b|Medical\s+Record|Attending\s+Physician|Chief\s+Complaint|Diagnosis\s*:|ICD-10|HIPAA|Clinical\s+Intake|Discharge\s+Summary|MedPod|NPI\s*(?:#|No|:)?\s*\d{10}|Medicare\s*(?:ID|Beneficiary|Claim)|Medicaid\s*ID|Prescription|Rx\s*#|Blood\s+Type|Vital\s+Signs|Radiology|Lab\s+Results|EHR\b|EMR\b)\b/gi },
+    { profile: 'accounting', label: 'Tax & Accounting', regex: /\b(?:Form\s*1040|Form\s*W-2|Form\s*1099|Adjusted\s+Gross\s+Income|Employer\s+Identification\s+Number|Schedule\s+C\b|Steuer-ID|USt-IdNr|Tax\s+Return|General\s+Ledger|Withholding\s+Allowance|Total\s+Tax\s+Liability)\b/gi },
+    { profile: 'wealthmgmt', label: 'Wealth Management', regex: /\b(?:Revocable\s+Living\s+Trust|Irrevocable\s+(?:Generation-Skipping\s+)?Trust|Grantor\s*:|Settlor\s*:|Trustee\s*:|Beneficiary\s+Designation|Roth\s+IRA|Asset\s+Allocation|FBO\b|CUSIP\s*:|Grantor\s+Retained\s+Annuity\s+Trust|AUM\s*:)\b/gi },
+    { profile: 'legal', label: 'Legal & Contracts', regex: /\b(?:Non-Disclosure\s+Agreement|Attorney-Client\s+Privilege|Docket\s+No|Hereinafter\s+referred|Indemnification\s+Clause|Governing\s+Law\s+and\s+Jurisdiction|Plaintiff\b|Defendant\b|Subpoena\b|Deposition\b|State\s+Bar\s*#)\b/gi },
+    { profile: 'finance', label: 'Finance & Banking', regex: /\b(?:Wire\s+Transfer\s+Authorization|SWIFT\s*\/?\s*BIC\s*:|IBAN\s*:\s*[A-Z]{2}\d{2}|ABA\s+Routing|ACH\s+Transfer|PCI-DSS|Primary\s+Account\s+Number)\b/gi },
+    { profile: 'hr', label: 'HR & Resumes', regex: /\b(?:Employee\s*ID|Performance\s+Improvement\s+Plan|Payroll\s+Register|Gross\s+Pay\b|Net\s+Pay\b|Candidate\s+Evaluation|Compensation\s+Band|Sozialversicherungsnummer|Personalnummer|EEID\s*:)\b/gi },
+    { profile: 'realestate', label: 'Real Estate', regex: /\b(?:Assessor\s+Parcel\s+Number|APN\s*:|MLS\s*#|Closing\s+Disclosure|Escrow\s+(?:Account|Number|Officer)|Property\s+Deed|Title\s+Insurance|Lease\s+Application)\b/gi },
+    { profile: 'dev', label: 'API & Dev Logs', regex: /\b(?:BEGIN\s+(?:RSA|OPENSSH|EC|PRIVATE)\s+PRIVATE\s+KEY|AWS_SECRET_ACCESS_KEY|DATABASE_URL\s*=|GITHUB_TOKEN\s*=|Bearer\s+eyJ[A-Za-z0-9_-]+)\b/g },
+    { profile: 'sales', label: 'Sales & CRM', regex: /\b(?:CRM\s+(?:Opportunity|Export)|HubSpot\b|Salesforce\b|MEDDPICC\b|Primary\s+Buyer\s*:|MSA\s+Redlines|Deal\s+Stage|Pipeline\s+Forecast|Opportunity\s+ID|Account\s+Executive)\b/gi },
+    { profile: 'engineering', label: 'DevOps & Infra', regex: /\b(?:Incident\s+Postmortem|Kubeconfig|Kubernetes\s+Cluster|Helm\s+Chart|Terraform\s+State|DMAIC\b|Bill\s+of\s+Materials|BOM\s+Spec|CNC\s+Machining|Shop\s+Floor\s+Batch)\b/gi },
+    { profile: 'insurance', label: 'Insurance & Claims', regex: /\b(?:Claim\s+Settlement|Policyholder\s*:|Policy\s*#?POL-|Claim\s+Number|Adjuster\s*:|Loss\s+Location|Loss\s+Run|Subrogation\b|FNOL\b|Deductible\s*:)\b/gi },
+    { profile: 'pharma', label: 'Pharma & Trials', regex: /\b(?:Clinical\s+Trial(?:\s+Protocol)?|NCT\d{8}\b|IRB\s+Protocol|FDA\s+1572|Adverse\s+Event|Pharmacovigilance|Principal\s+Investigator|Cohort\s+[A-Z]\b|Blinded\s+Study|CDISC\b|IND\s*(?:#|Protocol))\b/gi },
+    { profile: 'underwriting', label: 'Loan Underwriting & Income', regex: /\b(?:Loan\s+Underwriting|Mortgage\s+Appraisal|Loan\s+Application\s+#?LOS|FICO\s*:\s*\d{3}|Appraised\s+Value\s*:|80%\s+LTV|Monthly\s+Qualifying\s*:|YTD\s+Earnings|Borrower\s*:)\b/gi },
+    { profile: 'security', label: 'Security & SIEM', regex: /\b(?:SIEM\s+Alert|CVE-\d{4}-\d{4,7}\b|Threat\s*:\s*CRITICAL|Unauthorized\s+S3\s+bucket|SOC\s+Incident|Firewall\s+Rule\s+Violation|Intrusion\s+Detection)\b/gi },
+    { profile: 'support', label: 'Support & Tickets', regex: /\b(?:Support\s+Ticket|Ticket\s*#INC-|Zendesk\b|Intercom\b|Billing\s+Discrepancy|SLA\s+Escalation|CSAT\s+Score|Customer\s+Support\s+Escalation)\b/gi },
+    { profile: 'compliance', label: 'Compliance Audit', regex: /\b(?:Suspicious\s+Activity\s+Report|FinCEN\s+SAR|BSA\s+Officer|31\s+CFR\b|ROPA\s+Register|Data\s+Protection\s+Impact\s+Assessment|SOC\s*2\s+Type\s+II|ISO\s*27001\s+Audit|CMMC\s+Level|ITAR\s+Controlled)\b/gi },
+    { profile: 'ccpa', label: 'CCPA / CPRA Privacy', regex: /\b(?:CCPA\s*\/?\s*CPRA|1798\.105|Right\s+to\s+Delete|Opt-out\s+of\s+Sale|Ticket\s*#?DSAR-)\b/gi },
+    { profile: 'bizops', label: 'Biz Ops & M&A', regex: /\b(?:Vendor\s+Master\s+Agreement|Bill\s+of\s+Lading|Customs\s+Declaration|Purchase\s+Order\s*#?PO-|Supply\s+Chain\s+Manifest)\b/gi },
+    { profile: 'biotech', label: 'Biotech & Genomics', regex: /\b(?:Sequencing\s+Platform|Illumina\s+NovaSeq|Flowcell\s*:|FastQ\s+Sample|ClinVar\b|HGVS\s+Variant|Genomic\s+Sequencing|Bioinformatics\s+Intake|BRCA[12]\s+c\.)\b/gi },
+    { profile: 'automotive', label: 'Automotive & EV', regex: /\b(?:Connected\s+Vehicle\s+Telematics|ECU\s+Serial|Telematics\s+Device|ASIL-D\b|DTC\s+P\d{4}\b|CAN-Bus\s+Log)\b/gi },
+    { profile: 'energy', label: 'Energy & Smart Grid', regex: /\b(?:Critical\s+Infrastructure\s+SCADA|Substation\s+ID|Feeder\s+ID|Smart\s+Meter\s*:|ESI\s+ID\s*:|NERC\s+CIP|BES\s+Cyber\s+Asset)\b/gi },
+    { profile: 'hospitality', label: 'Hospitality & Travel', regex: /\b(?:Airline\s+Passenger\s+Dossier|PNR\s*:\s*[A-Z0-9]{6}|e-Ticket\s*:|Boarding\s+Pass\s*:|Known\s+Traveler\s+KTN|Guest\s+Folio|Marriott\s+Bonvoy|SkyMiles)\b/gi },
+    { profile: 'telecom', label: 'Telecom & Call Center', regex: /\b(?:Telecom\s+Subscriber\s+CDR|MSISDN\s*:|IMSI\s*:\s*\d{14,15}|IMEI\s*:\s*\d{14,16}|Cell\s+Tower\s+ID|SIP\s+Signaling)\b/gi },
+    { profile: 'academic', label: 'Academic & Research', regex: /\b(?:FERPA\s+Student\s+Record|Student\s+ID\s*:\s*#?STU-|Disciplinary\s+Record|IEP\s+Evaluation|IRB\s+Approval)\b/gi },
+    { profile: 'agents', label: 'AI Agents & Prompts', regex: /\b(?:Autonomous\s+Financial\s+Procurement\s+Agent|AgentID\s*:\s*agt_|Encrypted\s+Tool\s+Token|Agent\s+Memory\s*>)\b/gi }
+];
+
+/**
+ * Automatically detects the most relevant industry compliance profile from text content.
+ * Executes in <0.05ms in local RAM with zero network egress.
+ *
+ * @param {string} text - Input document or prompt text.
+ * @returns {{
+ *   detectedProfile: string,
+ *   label: string,
+ *   confidence: 'high'|'medium'|'low',
+ *   score: number,
+ *   alternatives: Array<{ profile: string, label: string, score: number }>
+ * }}
+ */
+function detectProfile(text) {
+    if (!text || typeof text !== 'string') {
+        return { detectedProfile: 'general', label: 'General PII', confidence: 'low', score: 0, alternatives: [] };
+    }
+    const sampleSlice = text.length > 16384 ? text.slice(0, 16384) : text;
+    const matches = [];
+    for (let i = 0; i < SDK_VERTICAL_DETECTORS.length; i++) {
+        const c = SDK_VERTICAL_DETECTORS[i];
+        c.regex.lastIndex = 0;
+        const found = sampleSlice.match(c.regex);
+        if (found && found.length > 0) {
+            matches.push({
+                profile: c.profile,
+                label: c.label,
+                score: found.length,
+                priority: i
+            });
+        }
+    }
+    if (matches.length === 0) {
+        return { detectedProfile: 'general', label: 'General PII', confidence: 'low', score: 0, alternatives: [] };
+    }
+    matches.sort((a, b) => (b.score !== a.score) ? (b.score - a.score) : (a.priority - b.priority));
+    const primary = matches[0];
+    const alternatives = matches.slice(1, 4).map(({ profile, label, score }) => ({ profile, label, score }));
+    const confidence = primary.score >= 3 ? 'high' : (primary.score >= 2 ? 'medium' : 'low');
+    return {
+        detectedProfile: primary.profile,
+        label: primary.label,
+        confidence,
+        score: primary.score,
+        alternatives
+    };
+}
+
 function sanitize(text, options = {}) {
     if (!text || typeof text !== 'string') {
         return {
@@ -479,7 +607,7 @@ function sanitize(text, options = {}) {
     }
 
     const {
-        profile = 'General',
+        profile: rawProfileOption = 'General',
         licenseKey = (typeof process !== 'undefined' && (process.env?.PRIVACYSCRUBBER_KEY || process.env?.PRIVACYSCRUBBER_LICENSE_KEY)) || '',
         customRules = [],
         tokenLabelMap = {},
@@ -491,6 +619,12 @@ function sanitize(text, options = {}) {
         ignoreList = null
     } = options;
 
+    const isAutoProfile = Boolean(
+        (typeof rawProfileOption === 'string' && rawProfileOption.trim().toLowerCase() === 'auto') ||
+        options.autoDetectProfile === true
+    );
+    const autoDetected = isAutoProfile ? detectProfile(text) : null;
+
     const licenseCheck = validateLicense(licenseKey);
     const rawTier = licenseCheck.valid ? (licenseCheck.tier || 'PRO') : 'FREE';
     const isExpiredKey = !licenseCheck.valid && typeof licenseCheck.error === 'string' && /expired/i.test(licenseCheck.error);
@@ -512,6 +646,21 @@ function sanitize(text, options = {}) {
     const isSdkTier = licenseCheck.valid && ['SDK', 'OEM', 'ENTERPRISE'].includes(rawTier);
     const isSeatTier = licenseCheck.valid && ['PRO', 'TEAMS'].includes(rawTier);
 
+    const isPro = isSdkTier;
+    const tier = isPro ? rawTier : (isSeatTier ? rawTier : 'FREE');
+
+    let autoSuggestedOnly = false;
+    let profile = rawProfileOption;
+    if (isAutoProfile && autoDetected) {
+        if (!isPro && text.length > 5000 && text.length <= 15000 && autoDetected.detectedProfile !== 'general') {
+            // Non-blocking PLG fallback: keep General for Free 5k-15k texts so auto-mode never breaks free calls
+            profile = 'General';
+            autoSuggestedOnly = true;
+        } else {
+            profile = autoDetected.detectedProfile;
+        }
+    }
+
     if (isSeatTier) {
         const keyPreview = licenseKey ? `${licenseKey.slice(0, 12)}...` : '';
         const errorMsg = `[PrivacyScrubber] License tier mismatch: ${rawTier} license (${keyPreview}) is licensed strictly for human seats (Web App & Chrome Extension). Backend automation, microservices, and CRM pipelines require a Developer SDK license ($299/mo). Upgrade: https://privacyscrubber.com/pricing?tier=sdk&src=seat_tier_mismatch`;
@@ -525,9 +674,6 @@ function sanitize(text, options = {}) {
         }
     }
 
-    const isPro = isSdkTier;
-    const tier = isPro ? rawTier : (isSeatTier ? rawTier : 'FREE');
-
     emitCommunityNoticeIfNeeded(isPro);
 
     const isSpecialized = profile && profile.toLowerCase() !== 'general';
@@ -539,7 +685,8 @@ function sanitize(text, options = {}) {
     if (!isPro && text.length > limit) {
         if (shouldThrow) {
             const expiredPrefix = isExpiredKey ? `[PILOT/TRIAL EXPIRED: ${licenseCheck.error}] ` : '';
-            const errorMsg = `[PrivacyScrubber] ${expiredPrefix}Free Tier character limit exceeded (${limit.toLocaleString()} chars for profile '${profile}', received ${text.length.toLocaleString()} chars). Upgrade to Developer SDK ($299/mo) for unlimited throughput: https://privacyscrubber.com/pricing?tier=sdk&src=${isExpiredKey ? 'pilot_expired' : 'dev_limit'} (Run 'npx @privacyscrubber/sdk memo' for CISO approval memo)`;
+            const safeProf = encodeURIComponent(String(profile || 'General').toLowerCase());
+            const errorMsg = `[PrivacyScrubber] ${expiredPrefix}Free Tier character limit exceeded (${limit.toLocaleString()} chars for profile '${profile}', received ${text.length.toLocaleString()} chars). Upgrade to Developer SDK ($299/mo) for unlimited throughput: https://privacyscrubber.com/pricing?tier=sdk&profile=${safeProf}&src=${isExpiredKey ? 'pilot_expired' : 'dev_limit'} (Start 7-day B2B trial: 'npx @privacyscrubber/sdk trial' or 'npx @privacyscrubber/sdk memo' for CISO memo)`;
             throw new PrivacyScrubberLicenseError(errorMsg, {
                 tier: 'FREE',
                 currentLength: text.length,
@@ -560,8 +707,33 @@ function sanitize(text, options = {}) {
     });
 
     // Auto-inject DevOps Secrets rules when in Dev profile or when detectSecrets is requested
-    const activeRules = [...safeCustomRules];
-    if (profile.toLowerCase() === 'dev' || detectSecrets === true) {
+    const isProdEnv = typeof process !== 'undefined' && process.env?.NODE_ENV === 'production';
+    const hasCustomEnterpriseConfig = isSpecialized || safeCustomRules.length > 0 || (Array.isArray(ignoreList) && ignoreList.length > 0);
+    let profileFallback = false;
+    let effectiveProfile = profile;
+    let effectiveCustomRules = safeCustomRules;
+    let effectiveIgnoreList = ignoreList;
+
+    if (!isPro && isProdEnv && hasCustomEnterpriseConfig) {
+        _freeProdSpecializedCalls++;
+        if (_freeProdSpecializedCalls > FREE_PROD_SPECIALIZED_CALL_LIMIT) {
+            profileFallback = true;
+            effectiveProfile = 'General';
+            effectiveCustomRules = [];
+            effectiveIgnoreList = null;
+            if (!_prodProfileFallbackNoticeLogged && typeof process !== 'undefined' && process.stderr && typeof process.stderr.write === 'function') {
+                _prodProfileFallbackNoticeLogged = true;
+                process.stderr.write(
+                    `\n[@privacyscrubber/sdk] Free Production Quota (${FREE_PROD_SPECIALIZED_CALL_LIMIT} specialized calls) reached for profile '${profile}'.\n` +
+                    `[@privacyscrubber/sdk] Gracefully falling back to 'General' profile (Core PII remains protected, 0 downtime).\n` +
+                    `[@privacyscrubber/sdk] Unlock unlimited specialized profiles, custom rules & ignoreLists in production ($299/mo): https://privacyscrubber.com/pricing?tier=sdk&src=prod_profile_fallback (7-Day Trial: npx @privacyscrubber/sdk trial)\n\n`
+                );
+            }
+        }
+    }
+
+    const activeRules = [...effectiveCustomRules];
+    if (effectiveProfile.toLowerCase() === 'dev' || detectSecrets === true) {
         DEVOPS_SECRETS_DETECTOR.forEach(rule => {
             activeRules.push({
                 name: rule.name,
@@ -582,10 +754,10 @@ function sanitize(text, options = {}) {
         textToScrub,
         activeRules,
         tokenLabelMap,
-        profile,
+        effectiveProfile,
         existingSessionMap,
         isPro,
-        ignoreList
+        effectiveIgnoreList
     );
 
     const endTime = (typeof performance !== 'undefined' && typeof performance.now === 'function') 
@@ -593,7 +765,7 @@ function sanitize(text, options = {}) {
         : Date.now();
 
     const executionMs = Math.round((endTime - startTime) * 100) / 100;
-    const telemetry = buildAuditTelemetry(rawResult.tokenMap || {});
+    const telemetry = buildAuditTelemetry(rawResult.tokenMap || {}, { licenseTier: tier });
     const auditReceipt = generateReceipt ? formatAuditReceipt(telemetry) : '';
 
     emitDevSecretNoticeIfNeeded(isPro, rawResult.tokenMap, limit);
@@ -620,15 +792,32 @@ function sanitize(text, options = {}) {
             tier: tier,
             limit: limit,
             wasTruncated: wasTruncated,
+            truncated: wasTruncated,
+            profileFallback: profileFallback,
+            effectiveProfile: effectiveProfile,
+            specializedCallsUsed: _freeProdSpecializedCalls,
+            specializedCallsLimit: isPro ? Infinity : FREE_PROD_SPECIALIZED_CALL_LIMIT,
             ...(isSeatTier && {
-                upgradeUrl: 'https://privacyscrubber.com/pricing?tier=sdk&src=seat_tier_mismatch',
+                upgradeUrl: `https://privacyscrubber.com/pricing?tier=sdk&profile=${encodeURIComponent(String(profile || 'General').toLowerCase())}&src=seat_tier_mismatch`,
+                trialUrl: `https://privacyscrubber.com/pricing?tier=sdk&trial=true&profile=${encodeURIComponent(String(profile || 'General').toLowerCase())}&src=seat_tier_mismatch`,
+                trialCommand: 'npx @privacyscrubber/sdk trial',
                 recommendation: `Your ${rawTier} license is valid for interactive browser seats only. Upgrade to Developer SDK ($299/mo) for unlimited backend server throughput: https://privacyscrubber.com/pricing?tier=sdk`
             }),
             ...(!isPro && !isSeatTier && {
-                upgradeUrl: 'https://privacyscrubber.com/pricing?tier=sdk&src=dev_upsell',
+                upgradeUrl: `https://privacyscrubber.com/pricing?tier=sdk&profile=${encodeURIComponent(String(profile || 'General').toLowerCase())}&src=${profileFallback ? 'prod_profile_fallback' : 'dev_upsell'}`,
+                trialUrl: `https://privacyscrubber.com/pricing?tier=sdk&trial=true&profile=${encodeURIComponent(String(profile || 'General').toLowerCase())}&src=${profileFallback ? 'prod_profile_fallback' : 'dev_upsell'}`,
+                trialCommand: 'npx @privacyscrubber/sdk trial',
                 recommendation: 'Upgrade to Developer SDK ($299/mo) for unlimited backend text processing, custom regex rules, and specialized compliance profiles.'
             })
         },
+        profileDetection: {
+            autoDetected: isAutoProfile,
+            detectedProfile: autoDetected ? autoDetected.detectedProfile : String(effectiveProfile || 'General').toLowerCase(),
+            label: autoDetected ? autoDetected.label : effectiveProfile,
+            confidence: autoDetected ? autoDetected.confidence : 'high',
+            suggestedOnly: autoSuggestedOnly,
+            alternatives: autoDetected ? autoDetected.alternatives : []
+        },
         telemetry: telemetry,
         auditReceipt: auditReceipt
     };
@@ -3855,6 +4044,7 @@ const {
 
 const _defaultExport = {
     SDK_VERSION,
+    detectProfile,
     sanitize,
     sanitizeObject,
     scrub,
@@ -3907,6 +4097,8 @@ const _defaultExport = {
     scrubText,
     unscrubText,
     DEVOPS_SECRETS_DETECTOR,
+    FREE_PROD_SPECIALIZED_CALL_LIMIT,
+    _resetProdQuotaForTesting,
     stripExifMetadata,
     redactImageBoundingBoxes,
     generateSvgRedactionOverlay

package/index.d.ts

@@ -120,6 +120,14 @@ export interface IpHoldings {
     trademark: string;
 }
 
+export interface AgenticProtocolMetadata {
+    protocolsSupported: string[];
+    agentCardUrl: string;
+    ztdsStandardCardUrl: string;
+    regulatorySafeHarbor: string[];
+    zeroCleartextEgress: boolean;
+}
+
 export interface AuditTelemetry {
     totalCount: number;
     entities: Record<string, number>;
@@ -128,6 +136,7 @@ export interface AuditTelemetry {
     frameworksList: string[];
     statutoryCitations?: StatutoryCitation[];
     ipHoldings?: IpHoldings;
+    agenticProtocol?: AgenticProtocolMetadata;
 }
 
 export interface SanitizeResult {