@link-foundation/sensitive-data-sanitizer 0.12.2 → 0.14.0

package/src/json-string-runs.js

@@ -40,3 +40,21 @@ export function* jsonStringRuns(text) {
     }
   }
 }
+
+// Complete JSON literals for callers whose input already has an outer bound.
+// Skip escaped characters once, including escaped quotes, with constant state.
+export function* jsonStringLiterals(text) {
+  let start = -1;
+  for (let i = 0; i < text.length; i++) {
+    if (start < 0) {
+      if (text[i] === '"') {
+        start = i;
+      }
+    } else if (text[i] === '\\') {
+      i++;
+    } else if (text[i] === '"') {
+      yield text.slice(start, i + 1);
+      start = -1;
+    }
+  }
+}

package/src/jsonl-stream.js

@@ -6,6 +6,7 @@ import { encodingFailure } from './utf8.js';
 import { workerExecArgv } from './worker-options.js';
 import { prepareStreamEngine } from './engines.js';
 import { inspect } from './sanitizer.js';
+import { hasPlaceholders } from './placeholders.js';
 
 async function* records(source, { maxRecordBytes, maxTotalBytes }) {
   const decoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
@@ -123,6 +124,10 @@ function workerSlot(options, heap, timeout) {
   };
 }
 function workerCount(options, config) {
+  // Stateful numbering must run in the coordinator, in source order.
+  if (hasPlaceholders(config.sanitizerOptions)) {
+    return 1;
+  }
   const callbacks =
     options.sanitizer ||
     config.sanitizerOptions.debug ||

package/src/keywords.js

@@ -27,10 +27,27 @@ export function keywordMatcher(words) {
       queue.push(child);
     }
   }
+  // At the root, characters that cannot start any keyword need no state
+  // transitions. A native search skips large padding runs without Map work
+  // per character. Escape UTF-16 units so metacharacters retain literal meaning.
+  const starters = new RegExp(
+    `[${[...nodes[0].next.keys()]
+      .map((char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, '0')}`)
+      .join('')}]`,
+    'g'
+  );
   return (text) => {
     const found = new Set();
     let state = 0;
     for (let i = 0; i < text.length; i++) {
+      if (!state && !nodes[0].output.length && !nodes[0].next.has(text[i])) {
+        starters.lastIndex = i + 1;
+        const next = starters.exec(text);
+        if (!next) {
+          break;
+        }
+        i = next.index;
+      }
       const char = text[i];
       while (state && !nodes[state].next.has(char)) {
         state = nodes[state].fail;

package/src/names.js

@@ -12,7 +12,7 @@ export const firstNames = {
   jaLatn: 'Yamada Sato Suzuki Takahashi Tanaka Ito Watanabe Nakamura Kobayashi',
   zhLatn:
     'Zhang Wang Li Zhao Liu Chen Yang Huang Zhou Wu Xu Sun Hu Zhu Gao Lin',
-  ru: 'Иван Пётр Петр Сергей Александр Алексей Дмитрий Михаил Николай Андрей Владимир Павел Виктор Олег Борис Евгений Василий Юрий Марина Анна Мария Елена Ольга Наталья Ирина Светлана Татьяна Екатерина Анастасия Юлия Ивану Ивана Иваном Сергея Сергею Александра Александру Анне Анну Елены',
+  ru: 'Данил Максим Алина Иван Пётр Петр Сергей Александр Алексей Дмитрий Михаил Николай Андрей Владимир Павел Виктор Олег Борис Евгений Василий Юрий Марина Анна Мария Елена Ольга Наталья Ирина Светлана Татьяна Екатерина Анастасия Юлия Ивану Ивана Иваном Сергея Сергею Александра Александру Анне Анну Елены',
   ja: '山田 佐藤 鈴木 高橋 田中 伊藤 渡辺 渡邊 中村 小林 加藤 吉田 松本 山本 井上 木村 林 清水 斎藤 斉藤',
   zh: '张 王 李 赵 刘 陈 杨 黄 周 吴 徐 孙 胡 朱 高 林 何 郭 马 罗 張 趙 劉 陳 楊 黃 吳 孫 馬 羅',
   ko: '김 이 박 최 정 강 조 윤 장 임 한 오 서 신 권 황 안 송 전 홍 유 고 문 양 손 배 백',

package/src/personal-variants.js

@@ -0,0 +1,94 @@
+import { escapePattern, failure } from './detection.js';
+
+const boundary = '[\\p{L}\\p{M}\\p{N}_]';
+export function organizationCore(value) {
+  return value
+    .replace(/^(?:ООО|АО|ПАО|ИП|ЗАО)[ \t]+/u, '')
+    .replace(/^[«“"]|[»”"]$/gu, '')
+    .trim();
+}
+// Only caller-confirmed Russian words receive finite case alternatives. A
+// minimum three-letter stem avoids turning short names into broad matches.
+function wordPattern(word) {
+  const endings = [
+    [/(?:ова|ева|ина)$/u, 1, '(?:а|ой|ою|у|е|ы)'],
+    [/(?:ая)$/u, 2, '(?:ая|ой|ою|ую)'],
+    [
+      /(?:ий|ый|ой)$/u,
+      2,
+      '(?:ий|ый|ой|ого|его|ому|ему|им|ым|ом|ем|ия|ию|ием|ии)',
+    ],
+    [/(?:ов|ев|ин)$/u, 0, '(?:а|у|ым|ом|е|ой)?'],
+    [/а$/u, 1, '(?:а|ы|и|е|у|ой|ою)'],
+    [/я$/u, 1, '(?:я|и|е|ю|ей|ею)'],
+    [/ь$/u, 1, '(?:ь|я|ю|ем|и)'],
+  ];
+  const lower = word.toLowerCase();
+  if (/^[а-яё]+$/u.test(lower)) {
+    for (const [ending, remove, suffix] of endings) {
+      if (ending.test(lower) && word.length - remove >= 3) {
+        return escapePattern(remove ? word.slice(0, -remove) : word) + suffix;
+      }
+    }
+  }
+  if (/^[а-яё]{4,}[бвгджзклмнпрстфхцчшщ]$/u.test(lower)) {
+    return `${escapePattern(word)}(?:а|у|ом|е|ы|ов|ам|ами|ах)?`;
+  }
+  return escapePattern(word);
+}
+export function personalPatterns(value, type) {
+  if (value.length > 256) {
+    // Large explicit values still support literal matching without expansion.
+    return [escapePattern(value)];
+  }
+  const values = new Set([value]);
+  if (type === 'ORGANIZATION') {
+    const core = organizationCore(value);
+    if (core.length >= 3) {
+      values.add(core);
+    }
+  }
+  const patterns = new Set();
+  for (const surface of values) {
+    const parts = surface.split(/([ \t]+)/u);
+    const pattern = parts
+      .map((part, i) => (i % 2 ? '[ \\t]+' : wordPattern(part)))
+      .join('');
+    patterns.add(pattern);
+    if (type === 'PERSON' && parts.length === 3) {
+      patterns.add(
+        [wordPattern(parts[2]), wordPattern(parts[0])].join('[ \\t]+')
+      );
+    }
+  }
+  return [...patterns];
+}
+export function personalRegex(value, type) {
+  return new RegExp(
+    `(?<!${boundary})(?:${personalPatterns(value, type).join('|')})(?!${boundary})`,
+    'giu'
+  );
+}
+export function samePersonal(value, original, type) {
+  return personalPatterns(original, type).some((pattern) =>
+    new RegExp(`^(?:${pattern})$`, 'iu').test(value)
+  );
+}
+export function detectKnownPersonal(text, entries, rule, emit, options) {
+  let count = 0;
+  for (const entry of entries ?? []) {
+    for (const match of text.matchAll(personalRegex(entry.value, entry.type))) {
+      if (++count > (options.maxFindings ?? 100000)) {
+        throw failure('ERR_LIMIT');
+      }
+      emit({
+        start: match.index,
+        end: match.index + match[0].length,
+        type: entry.type,
+        category: 'personal',
+        rule,
+        confidence: rule === 'known-personal' ? 0.85 : 0.9,
+      });
+    }
+  }
+}

package/src/personal.js

@@ -179,7 +179,12 @@ const russianFull =
   /(?<![\p{L}])(?:[А-ЯЁ][а-яё]{2,30}[ \t]+){2}[А-ЯЁ][а-яё]{2,30}(?:вич|вна|ична)|(?<![\p{L}])(?:[А-ЯЁ][а-яё]{2,30}[ \t]+){2}(?:оглы|кызы)(?![\p{L}])/gu;
 export function detectPersonal(text, emit) {
   detectDocumentNames(text, emit);
-  for (const pattern of [latinPairs, slavicPairs, russianFull]) {
+  for (const pattern of [
+    latinPairs,
+    slavicPairs,
+    russianFull,
+    /(?<![\p{L}])(?:[А-ЯЁ][а-яё]{2,30}[ \t]+)[А-ЯЁ][а-яё]{2,30}(?:вич|вна|ична)[ \t]+[А-ЯЁ][а-яё]{2,30}(?![\p{L}])/gu,
+  ]) {
     collectMatches(
       text,
       pattern,

package/src/placeholder-types.js

@@ -0,0 +1,33 @@
+import { catalogTypes } from './entities.js';
+
+// Native unlabelled types supplement the shared vendor-label catalog.
+export const reservedPlaceholderTypes = () => [
+  ...catalogTypes(),
+  'ADDRESS',
+  'AU_TFN',
+  'BRAZIL_CPF_NUMBER',
+  'CREDENTIAL',
+  'CREDIT_CARD',
+  'DATE',
+  'EDUCATION',
+  'EMAIL',
+  'ENCODED_SENSITIVE',
+  'IBAN',
+  'ID',
+  'IP_ADDRESS',
+  'KR_RRN',
+  'LOCATION',
+  'MAC_ADDRESS',
+  'ORGANIZATION',
+  'PASSPORT_MRZ',
+  'PASSPORT_NUMBER',
+  'PERSON',
+  'PHONE',
+  'PL_PESEL',
+  'RU_INN',
+  'RU_SNILS',
+  'SG_NRIC_FIN',
+  'STATE',
+  'USERNAME',
+  'US_HEALTHCARE_NPI',
+];

package/src/placeholders.js

@@ -0,0 +1,405 @@
+import { failure, REDACTED, escapePattern } from './detection.js';
+import { reservedPlaceholderTypes } from './placeholder-types.js';
+import { samePersonal } from './personal-variants.js';
+import { nameAliases } from './transliteration.js';
+import { createHash } from 'node:crypto';
+import { jsonStringLiterals } from './json-string-runs.js';
+import {
+  createRestoreMap,
+  validateRestoreMap,
+  placeholderToken,
+  documentDigest,
+  validatePlaceholderFormat,
+} from './restore-map.js';
+
+export const placeholderState = Symbol('placeholder-state');
+const placeholderNested = Symbol('placeholder-nested');
+export const nestedPlaceholderOptions = (options) => ({
+  ...options,
+  [placeholderNested]: true,
+});
+export const hasPlaceholders = (options) =>
+  [
+    options.transformation,
+    ...Object.values(options.transformations ?? {}),
+  ].some((t) => t?.mode === 'placeholder');
+export const placeholderValues = (options) =>
+  (options[placeholderState]?.map.entries ?? []).map((entry) => ({
+    value: entry.token,
+    credential: entry.type === 'CREDENTIAL',
+  }));
+const transforms = (options) =>
+  [
+    options.transformation,
+    ...Object.values(options.transformations ?? {}),
+  ].filter((t) => t?.mode === 'placeholder');
+
+export function validatePlaceholder(transform) {
+  validatePlaceholderFormat(transform.format ?? transform.map?.format);
+  if (
+    transform.credentials !== undefined &&
+    typeof transform.credentials !== 'boolean'
+  ) {
+    throw failure('ERR_CONFIG');
+  }
+  if (transform.map !== undefined && transform.map !== false) {
+    validateRestoreMap(transform.map);
+    if (
+      transform.format !== undefined &&
+      transform.format !== transform.map.format
+    ) {
+      throw failure('ERR_CONFIG');
+    }
+  }
+}
+export function initializePlaceholders(options) {
+  const selected = transforms(options);
+  if (!selected.length || options[placeholderState]) {
+    return options;
+  }
+  const first = selected[0];
+  const map =
+    first.map === false
+      ? createRestoreMap({ format: first.format })
+      : (first.map ?? createRestoreMap({ format: first.format }));
+  if (
+    selected.some(
+      (t) =>
+        (t.map !== undefined && t.map !== first.map) ||
+        (t.format !== undefined && t.format !== map.format)
+    )
+  ) {
+    throw failure('ERR_CONFIG');
+  }
+  return { ...options, [placeholderState]: { map, keep: first.map !== false } };
+}
+export function placeholderKnown(options) {
+  const map = options[placeholderState]?.map;
+  if (!map) {
+    return options;
+  }
+  return {
+    ...options,
+    confirmedPersonal: [
+      ...(options.confirmedPersonal ?? []),
+      ...map.entries
+        .filter((entry) => entry.type !== 'CREDENTIAL')
+        .flatMap((entry) =>
+          entry.values
+            .filter((value) => value.length <= 256)
+            .map((value) => ({ type: entry.type, value }))
+        ),
+    ],
+  };
+}
+const stem = (word) =>
+  word.replace(
+    /(?:овым|евым|овой|евой|ова|ева|ову|еву|ове|еве|ов|ев|ovym|evym|ovoi|evoi|ova|eva|ovu|evu|ove|eve|ov|ev)$/u,
+    (ending) => (/^(?:ов|ov)/.test(ending) ? 'ov' : 'ev')
+  );
+function aliases(value, type) {
+  if (type !== 'PERSON') {
+    return [value.normalize('NFC').toLowerCase()];
+  }
+  return [
+    ...new Set(
+      nameAliases(value).map((v) => v.replace(/[\p{L}\p{M}]+/gu, stem))
+    ),
+  ];
+}
+function related(value, entry) {
+  if (
+    (entry.values ?? []).some((original) =>
+      samePersonal(value, original, entry.type)
+    )
+  ) {
+    return true;
+  }
+  const candidates = aliases(value, entry.type);
+  if (candidates.some((alias) => entry.aliases.includes(alias))) {
+    return true;
+  }
+  if (entry.type !== 'PERSON') {
+    return false;
+  }
+  for (const candidate of candidates) {
+    const parts = candidate.match(/[\p{L}\p{M}]+/gu) ?? [];
+    for (const alias of entry.aliases) {
+      const full = alias.match(/[\p{L}\p{M}]+/gu) ?? [];
+      if (
+        parts.length === 1 &&
+        parts[0].length > 1 &&
+        full.includes(parts[0])
+      ) {
+        return true;
+      }
+      if (
+        parts.length === full.length &&
+        parts.length > 1 &&
+        parts.every(
+          (part, i) =>
+            part === full[i] || (part.length === 1 && full[i].startsWith(part))
+        )
+      ) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+export function placeholderNameFindings(text, findings, options) {
+  if (!hasPlaceholders(options) || options.knownOnly) {
+    return findings;
+  }
+  const people = [
+    ...findings
+      .filter((f) => f.type === 'PERSON')
+      .map((f) => text.slice(f.start, f.end)),
+    ...(options[placeholderState]?.map.entries ?? [])
+      .filter((e) => e.type === 'PERSON')
+      .flatMap((e) => e.values),
+  ];
+  const patterns = new Set();
+  for (const person of people) {
+    addNamePatterns(person, patterns);
+  }
+  const result = [...findings];
+  for (const pattern of patterns) {
+    for (const match of text.matchAll(
+      new RegExp(`(?<![\\p{L}\\p{M}])${pattern}(?![\\p{L}\\p{M}])`, 'giu')
+    )) {
+      result.push({
+        start: match.index,
+        end: match.index + match[0].length,
+        type: 'PERSON',
+        category: 'personal',
+        rule: 'name-variant',
+        confidence: 0.9,
+      });
+      if (result.length > (options.maxFindings ?? 100000)) {
+        throw failure('ERR_LIMIT');
+      }
+    }
+  }
+  return result;
+}
+function addNamePatterns(person, patterns) {
+  const words = person.match(/[\p{L}\p{M}]+/gu) ?? [];
+  if (words.length < 2 || words.some((word) => word.length < 2)) {
+    return;
+  }
+  for (const alias of nameAliases(person)) {
+    const parts = alias.match(/[\p{L}\p{M}]+/gu) ?? [];
+    if (parts.length !== words.length) {
+      continue;
+    }
+    patterns.add(
+      `${escapePattern(parts[0][0])}\\.[ \\t]+${parts.slice(1).map(escapePattern).join('[ \\t]+')}`
+    );
+    for (const word of parts) {
+      if (/^[а-яё]+(?:ов|ев)$/u.test(word)) {
+        patterns.add(`${escapePattern(word)}(?:ым|ой|а|у|е|ы|ых|ами)?`);
+      }
+    }
+  }
+}
+export function preparePlaceholderText(text, findings, options) {
+  const state = options[placeholderState];
+  if (!state || !hasPlaceholders(options)) {
+    return;
+  }
+  const types = new Set([
+    ...reservedPlaceholderTypes(),
+    ...findings.map((f) =>
+      f.category === 'credential' ? 'CREDENTIAL' : f.type
+    ),
+    ...(options.knownPersonal ?? []).map((e) => e.type),
+    ...state.map.entries.map((e) => e.type),
+  ]);
+  const [before, after] = state.map.format.split('{n}');
+  const tokens = [...types].map(
+    (type) =>
+      `${escapePattern(
+        placeholderToken(type, 1, before)
+      )}[1-9][0-9]*${escapePattern(placeholderToken(type, 1, after))}`
+  );
+  const pattern = new RegExp(
+    `(?<![\\p{L}\\p{M}\\p{N}_])(?:${tokens.join('|')})(?![\\p{L}\\p{M}\\p{N}_])`,
+    'u'
+  );
+  if (namespaceCollision(text, pattern)) {
+    throw failure('ERR_PLACEHOLDER_COLLISION');
+  }
+  const people = findings
+    .filter((f) => f.type === 'PERSON')
+    .map((f) => text.slice(f.start, f.end));
+  state.people = [
+    ...people,
+    ...state.map.entries
+      .filter((e) => e.type === 'PERSON')
+      .flatMap((e) => e.values),
+  ];
+}
+function namespaceCollision(text, pattern) {
+  if (pattern.test(text)) {
+    return true;
+  }
+  // JSON escape spellings must not conceal existing tokens in keys or values.
+  for (const literal of jsonStringLiterals(text)) {
+    try {
+      if (pattern.test(JSON.parse(literal))) {
+        return true;
+      }
+    } catch {
+      // Ordinary free text may include strings that are not JSON literals.
+    }
+  }
+  return false;
+}
+
+function canonicalPerson(value, people) {
+  // Resolve components only when there is a unique compatible full name.
+  const matches = people.filter((person) => {
+    const words = person.match(/\p{L}+/gu) ?? [];
+    return (
+      words.length > 1 &&
+      words.every((word) => word.length > 1) &&
+      related(value, { type: 'PERSON', aliases: aliases(person, 'PERSON') })
+    );
+  });
+  const distinct = new Map(
+    matches.map((person) => [
+      aliases(person, 'PERSON').sort().join('\0'),
+      person,
+    ])
+  );
+  return distinct.size === 1 ? [...distinct.values()][0] : value;
+}
+function canonicalKnown(value, type, options, state) {
+  const known = (options.knownPersonal ?? []).filter(
+    (e) => e.type === type && samePersonal(value, e.value, type)
+  );
+  if (known.length === 1) {
+    return known[0].value;
+  }
+  return type === 'PERSON' ? canonicalPerson(value, state.people ?? []) : value;
+}
+export function placeholderReplacement(value, finding, transform, options) {
+  if (finding.category === 'credential' && !transform.credentials) {
+    return REDACTED;
+  }
+  const state = options[placeholderState];
+  if (!state) {
+    throw failure('ERR_CONFIG');
+  }
+  const { map } = state;
+  const type =
+    finding.category === 'credential'
+      ? 'CREDENTIAL'
+      : finding.type === 'DATE_OF_BIRTH'
+        ? 'DATE'
+        : finding.type;
+  const canonical = canonicalKnown(value, type, options, state);
+  const candidates = map.entries.filter(
+    (entry) => entry.type === type && related(canonical, entry)
+  );
+  let entry = candidates.length === 1 ? candidates[0] : undefined;
+  if (!entry) {
+    if (map.entries.length >= (options.maxFindings ?? 100000)) {
+      throw failure('ERR_LIMIT');
+    }
+    const number =
+      1 +
+      map.entries.reduce(
+        (n, e) => (e.type === type ? Math.max(n, e.number) : n),
+        0
+      );
+    const token = placeholderToken(type, number, map.format);
+    if (
+      !Number.isSafeInteger(number) ||
+      map.entries.some((e) => e.token === token)
+    ) {
+      throw failure('ERR_PLACEHOLDER_COLLISION');
+    }
+    entry = {
+      type,
+      number,
+      token,
+      values: [canonical],
+      aliases: aliases(canonical, type),
+    };
+    map.entries.push(entry);
+  }
+  if (!entry.values.includes(value)) {
+    entry.values.push(value);
+  }
+  return entry.token;
+}
+export function finishPlaceholders(result, occurrences, options) {
+  const state = options[placeholderState];
+  if (!state?.keep || !hasPlaceholders(options)) {
+    return result;
+  }
+  if (options[placeholderNested]) {
+    return { ...result, map: state.map };
+  } else if (state.stream) {
+    state.stream.add(result.text, occurrences);
+  } else {
+    addDocument(state.map, documentDigest(result.text), occurrences);
+  }
+  return { ...result, map: state.map };
+}
+function addDocument(map, digest, occurrences) {
+  const existing = map.documents.find((doc) => doc.digest === digest);
+  if (existing) {
+    if (JSON.stringify(existing.occurrences) !== JSON.stringify(occurrences)) {
+      throw failure('ERR_RESTORE_AMBIGUITY');
+    }
+    return;
+  }
+  if (map.documents.length >= 100000) {
+    throw failure('ERR_LIMIT');
+  }
+  map.documents.push({ digest, occurrences });
+}
+// Hash the whole output incrementally; retain only bounded restoration spans.
+export function beginPlaceholderStream(options) {
+  const state = options[placeholderState];
+  if (!state || state.stream) {
+    return () => {};
+  }
+  const hash = createHash('sha256'),
+    occurrences = [];
+  let offset = 0;
+  state.stream = {
+    add(text, spans) {
+      hash.update(text);
+      for (const span of spans) {
+        if (occurrences.length >= (options.maxFindings ?? 100000)) {
+          throw failure('ERR_LIMIT');
+        }
+        occurrences.push({
+          ...span,
+          start: span.start + offset,
+          end: span.end + offset,
+        });
+      }
+      offset += text.length;
+    },
+  };
+  return (complete) => {
+    state.stream = undefined;
+    if (complete && state.keep) {
+      addDocument(state.map, hash.digest('hex'), occurrences);
+    }
+    discardPlaceholderState(options);
+  };
+}
+export function discardPlaceholderState(options) {
+  const state = options[placeholderState];
+  if (state && !state.keep && !state.stream) {
+    state.map.entries.length = 0;
+    state.map.documents.length = 0;
+    state.people = [];
+  }
+}

package/src/projection.js

@@ -27,8 +27,12 @@ export function projectText(input) {
     !/\x1b\[|\\u[\da-fA-F]{4}|[\u200b-\u200f\u202a-\u202e\u2060-\u206f\ufeff]/u.test(
       input
     ) &&
-    input.normalize('NFKC') === input &&
-    !/[^0-9]/.test(input.replace(/[^\p{Nd}]/gu, ''))
+    // ASCII already has normalized letters and digits. Avoid constructing a
+    // second multi-megabyte string just to check its decimal characters.
+    // eslint-disable-next-line no-control-regex -- Check the ASCII range.
+    (!/[^\x00-\x7f]/.test(input) ||
+      (input.normalize('NFKC') === input &&
+        !/[^0-9]/.test(input.replace(/[^\p{Nd}]/gu, ''))))
   ) {
     return { text: input, changed: false };
   }

package/src/propagation.js

@@ -1,5 +1,6 @@
 import { personalPattern, maxPropagationLength, failure } from './detection.js';
 import { actionable } from './confidence.js';
+import { organizationCore } from './personal-variants.js';
 import { nameAliases } from './transliteration.js';
 
 function mrzSeeds(value, finding, seeds) {
@@ -32,11 +33,13 @@ function decodedValue(value) {
 
 function eligibleSeed(finding, options) {
   return (
+    !options.knownOnly &&
     finding.category === 'personal' &&
     finding.type !== 'ENCODED_SENSITIVE' &&
     !['confirmed-personal', 'document-propagation'].includes(finding.rule) &&
     actionable(finding, options) &&
-    (finding.confidence >= 0.85 ||
+    ((options.documentEntities && finding.type === 'ORGANIZATION') ||
+      finding.confidence >= 0.85 ||
       [
         'PERSON',
         'PASSPORT_NUMBER',
@@ -47,6 +50,14 @@ function eligibleSeed(finding, options) {
       ].includes(finding.type))
   );
 }
+function organizationSeed(value, finding, seeds, options) {
+  if (options.documentEntities && finding.type === 'ORGANIZATION') {
+    const core = organizationCore(value);
+    if (core.length >= 3) {
+      seeds.set(core, finding);
+    }
+  }
+}
 // Only confirmed values seed propagation. A low-score numeric coincidence
 // must never turn every log occurrence into a high-score identity.
 export function confirmedSeeds(text, findings, options) {
@@ -71,6 +82,7 @@ export function confirmedSeeds(text, findings, options) {
       mrzSeeds(value, finding, seeds);
     } else if (value.length >= 2) {
       seeds.set(value, finding);
+      organizationSeed(value, finding, seeds, options);
       if (finding.type === 'PERSON') {
         for (const name of value.match(/\p{L}{2,}/gu) ?? []) {
           seeds.set(name, finding);