@link-foundation/sensitive-data-sanitizer 0.19.0 → 0.19.2

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.19.2
+
+### Patch Changes
+
+- 4afc88d: Read `Mr`, `Ms` and `Dr` as person cues only when capitalized, so lowercase `ms` (milliseconds) and `dr` before a capitalized log word stay. Treat compound JSON keys ending in a personal field, such as `recruiterDisplayName`, `authorFullName` and `resumePdfOriginalFileName`, as person fields.
+
+## 0.19.1
+
+### Patch Changes
+
+- Redact complete obfuscated email addresses and military IDs with capitalized
+  proper-name detection, recognize lowercase employers after employment cues and
+  unknown Cyrillic names before colons, and preserve work and skill durations in
+  strict mode while keeping ages sensitive.
+
+  Detect bare Yandex Cloud credentials, Latin names and filenames in explicit personal JSON fields, numeric ages and birth years, and single Latin names after English person cues while preserving workflow headings.
+
 ## 0.19.0
 
 ### Minor Changes

package/docs/API.md

@@ -544,9 +544,11 @@ are case-sensitive runtime Unicode property aliases, not language codes.
 Inside activated values, the rule replaces words containing an uppercase letter
 anywhere (`iPhone`, `A.B`, `Санкт-Петербург`), typographic quoted spans (including
 lowercase `«ромашка лютик»`), links including `example.org/path`, and bare domestic
-mobile shapes. Labels immediately before a colon (also `Label :`), lowercase
-words, numbers, date ranges and path tokens stay. A path can still match existing
-personal-path or credential rules. Numeric primitives and JSON keys stay; string
+mobile shapes. Known Cyrillic labels before a colon (`Опыт:`, `Стаж:`,
+`Навыки:`) and non-Cyrillic labels (also `Label :`) stay. Unknown capitalized
+Cyrillic words such as `Ромашка: менеджер` are replaced before the colon.
+Lowercase words, numbers, date ranges and path tokens stay. A path can still match
+existing personal-path or credential rules. Numeric primitives and JSON keys stay; string
 escapes and surrounding source formatting are retained. JSON/JSONL activation
 also applies independently within serialized JSON strings, to the existing
 bounded decoding depth. Findings do not seed document-wide name propagation.
@@ -555,8 +557,10 @@ produces stable tokens and exact restoration; the existing placeholder-namespace
 collision checks still reject input that already contains typed placeholders.
 
 This is a structural heuristic, so capitalized ordinary words also disappear.
-Lowercase organizations and `Ромашка: менеджер` stay. English prose without a
-trigger (`Worked at Romashka for three years.`), isolated neutral-key values
+Lowercase organizations without employment context stay; the document rules
+replace a lowercase employer after `работал в` / `работала в`. Complete contact
+and identifier findings take priority over overlapping proper-name fragments.
+English prose without a trigger (`Worked at Romashka for three years.`), isolated neutral-key values
 `{"note":"Romashka"}` / `{"note":"1991-03-12"}`, and a personal website root
 without a trigger stay under this rule. The existing detectors and explicit
 known/sensitive-field policies still run: an unactivated value is byte-for-byte
@@ -567,7 +571,8 @@ The new scanner uses a fixed number of forward passes over maximal tokens,
 including long tokens without spaces. This does not impose a linear-time bound
 on optional external engines or every preexisting detection rule. Debugging is
 off by default; `debug` receives value-free `proper-name-prose` and
-`document-experience` hit counts when those scans run.
+`document-experience` hit counts when those scans run. `document-prose-overlap`
+reports complete-contact/identifier and suppressed broad-span counts.
 
 CLI equivalents: `--proper-names capitalized --scripts Cyrillic,Greek`.
 Configuration files accept the same `properNames` and `scripts` API options;

package/docs/COVERAGE.md

@@ -218,7 +218,9 @@ The `documents` profile additionally recognizes:
 - Russian mobile numbers with dashed, dotted, spaced or parenthesized forms,
   including ten-digit `9xx` forms and domestic `8` prefixes; `тел.`, `моб.` and
   WhatsApp labels; `wa.me` contact links.
-- Obfuscated email separators `(at)`, `[at]`, `собака`, and English `dot`/`at`.
+- Obfuscated email separators `(at)`, `[at]`, `собака`, and English `dot`/`at`,
+  including `[dot]`, `(dot)`, `(точка)` and `[точка]` with optional spaces.
+  Complete addresses remain protected alongside capitalized proper-name matches.
   This is a finite spelling grammar, not arbitrary email deobfuscation.
 - Personal paths on LinkedIn (`/in/`), GitHub, VK, Instagram and Telegram,
   including scheme-less links; Telegram/телеграм/tg/skype/ник labels without `@`.
@@ -361,17 +363,24 @@ alone cannot establish that the site belongs to a person.
 
 Structured document field aliases remove `_`/`-` and ignore case before matching
 this explicit vocabulary: `firstName`, `lastName`, `middleName`, `patronymic`,
-`birthday`, `birthDate`, `sex`, `citizenship`, `nationality`, `company`,
+`candidateName`, `displayName`, `fullName`, `originalFileName`,
+`age`, `birthYear`, `birthday`, `birthDate`, `sex`, `citizenship`, `nationality`, `company`,
 `companyName`, `employer`, `university`, `school`, `contact`, `resumeUrl`,
 `alternateUrl`, `profileUrl`, `companyUrl`. Their nonempty string values are
 sensitive in full, including ISO birth timestamps. Thus `first_name` and
 `firstName`, or `birth_date` and `birthDate`, follow the same policy. These are
 schema assumptions: `contact` or `company` can hold operational data too.
+Person fields also match as a word-boundary suffix of a compound key, so
+`recruiterDisplayName`, `author_full_name` and `resumePdfOriginalFileName` are
+person fields. The same suffix rule applies to `vocabulary.personalFields`.
+Other types match only the whole key (`maxAge` and `fileName` stay), and a
+bare `name` is not in the list.
 Existing native labels still apply. Unlisted URL-named fields have ordinary
 content detection; arbitrary names do not imply sensitivity. Declare them with
 [`sensitiveFields`](API.md#caller-declared-sensitive-fields) to replace complete
-values, including non-string values. Generic numeric primitives otherwise keep
-the existing type-preservation policy.
+values, including non-string values. Numeric `age` and `birthYear` values are replaced by the JSON string
+`"[REDACTED]"`; unrelated numeric primitives retain their types. Bare `name`,
+`jobName` and `productName` remain ambiguous and use content detection.
 
 Employer labels consume multi-word values to a comma or line/quote boundary.
 Dated CV entries additionally support compound titles, title parentheses/slashes,
@@ -438,9 +447,11 @@ now use the same case/underscore/hyphen normalization as built-in document names
 For no-cue prose, enable [`properNames: 'capitalized'`](API.md#structural-prose-redaction).
 It activates per value, defaults to Cyrillic script letters or structural data
 triggers, and supports configurable Unicode scripts. It intentionally loses
-capitalized ordinary words. Labels, lowercase words, dates, paths, JSON keys and
-untriggered values are outside this additional rule. English untriggered prose,
-lowercase names and a name immediately before a colon remain documented limits.
+capitalized ordinary words. Known Cyrillic labels, non-Cyrillic labels, lowercase
+words, dates, paths, JSON keys and untriggered values are outside this additional
+rule. Unknown capitalized Cyrillic words before colons are protected. English
+untriggered prose and lowercase names without context remain documented limits;
+an explicit `работал в` / `работала в` cue also protects lowercase employers.
 The API describes the interaction with existing detectors and placeholder modes.
 
 The date-anchor scan visits each preceding entry once; the optional prose scanner
@@ -465,7 +476,14 @@ proper-name mode. Romashka Inc keeps its existing legal-form treatment.
 `strict: true` independently opts into personal attributes (gender, family,
 ethnicity, religion, health, criminal/political status) and bare dates, ages,
 passport/mobile/postal shapes. It is intended for stored personal prose and can
-remove ordinary uses of these words. It preserves ISO timestamps, work durations,
+remove ordinary uses of these words. It preserves ISO timestamps, work durations
+(including `Стаж: 5 лет`, `работал там 5 лет`, and duration cues from issue 87),
+and parenthesized durations after known technologies such as `Kubernetes (5 лет)`
+and `Power BI (5 лет)`.
+Explicit ages (`кандидату 34 года`, `мне 34 года`, `возраст 41`) and bare strict
+ages remain sensitive. Work and skill duration context is retained through
+redaction, placeholders and generated fake values for stable verification.
+It also preserves
 unit-bearing request timings and `Дети: нет`. In JSON/JSONL, numeric primitives
 stay numeric, and `structuralFields` suppresses strict findings in declared
 string metadata. Credentials/known values still take priority. Strict is off by
@@ -524,3 +542,24 @@ Reproduce with `node --max-old-space-size=384 experiments/issue-118/measure.mjs`
 The [raw results](case-studies/issue-118/measurements.json) include environment,
 exact-span counts and measurement method. This fixed experiment uses no large
 corpus, unbounded input, parallel builds or external analysis service.
+
+## Single Latin names and Yandex Cloud credentials
+
+Document rules recognize a capitalized Latin name after `candidate`, `recruiter`,
+`applicant`, `Dear`, `Hi`, `Mr`/`Mr.`, `Ms`/`Ms.`, `Dr`/`Dr.`, or `message from`.
+Honorifics count only when capitalized: lowercase `ms` (milliseconds), `mr` and
+`dr` are not cues, and `Ms` right after a number is read as a unit, so
+`took 30 ms Retry scheduled` and `see dr Drive mount` stay unchanged.
+Only the name is replaced; punctuation and the cue remain. These rules work
+without enabling Latin script matching. Finite generic heading nouns such as
+`Stage` and `Status` are preserved: `Candidate Stage changed` and
+`Request Failed: POST /api` stay unchanged. This is contextual recognition,
+not universal English NER; unknown cue-free single names can remain.
+Use `rules: { 'document-person-cue': false }` to disable this recognizer.
+
+Native credential detection recognizes bare Yandex Cloud API keys (`AQVN`),
+IAM tokens (`t1.` including optional base64 padding), static access key IDs
+(`YCAJE`) and static secrets (`YC`). These provider rules apply in every profile
+and do not require an assignment label. See the official
+[token grammar](https://yandex.cloud/en/docs/iam/concepts/authorization/iam-token)
+and [credential formats](https://yandex.cloud/en/docs/security/standard/authentication).

package/docs/RULES.md

@@ -47,6 +47,7 @@ Regenerate with `node experiments/issue-118/generate-rule-catalog.mjs`.
 - `document-mobile-context`
 - `document-msu`
 - `document-patronymic`
+- `document-person-cue`
 - `document-personal-path`
 - `document-phone`
 - `document-phone-label`
@@ -401,3 +402,4 @@ Regenerate with `node experiments/issue-118/generate-rule-catalog.mjs`.
 - `vocabulary-role`
 - `webhook`
 - `wordpress`
+- `yandex`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-foundation/sensitive-data-sanitizer",
-  "version": "0.19.0",
+  "version": "0.19.2",
   "description": "Offline sensitive-text sanitization with credential, multilingual personal-data and scanner union detection",
   "type": "module",
   "main": "src/index.js",

package/src/document-entities.js

@@ -7,6 +7,7 @@ import { detectDocumentExtras } from './document-extras.js';
 import { detectDocumentPatterns } from './document-patterns.js';
 import { isDocumentTechnology } from './document-experience.js';
 import { detectVocabulary } from './vocabulary.js';
+import { detectDocumentPersonCues } from './document-person-cues.js';
 import { detectDocumentCatalog } from './document-catalog.js';
 
 const words = (column) =>
@@ -82,6 +83,7 @@ export function detectDocumentEntities(text, emit, options) {
     return;
   }
   detectVocabulary(text, emit, options);
+  detectDocumentPersonCues(text, emit);
   detectDocumentCatalog(text, emit);
   detectDocumentPatterns(text, emit);
   detectDocumentExtras(text, emit, range, options.debug, options);

package/src/document-fields.js

@@ -1,7 +1,17 @@
 // One explicit field vocabulary; camelCase, snake_case and kebab-case normalize alike.
 const groups = {
-  PERSON: ['firstname', 'lastname', 'middlename', 'patronymic'],
-  DATE_OF_BIRTH: ['birthday', 'birthdate'],
+  PERSON: [
+    'firstname',
+    'lastname',
+    'middlename',
+    'patronymic',
+    'candidatename',
+    'displayname',
+    'fullname',
+    'originalfilename',
+  ],
+  AGE: ['age'],
+  DATE_OF_BIRTH: ['birthday', 'birthdate', 'birthyear'],
   GENDER: ['sex'],
   PERSONAL_ATTRIBUTE: ['citizenship', 'nationality'],
   ORGANIZATION: ['company', 'companyname', 'employer'],
@@ -15,7 +25,24 @@ const types = new Map(
   )
 );
 export function documentFieldType(field) {
-  return types.get(normalizeFieldName(field));
+  const type = types.get(normalizeFieldName(field));
+  if (type) {
+    return type;
+  }
+  // Compound person keys (`recruiterDisplayName`, `author_full_name`) end in
+  // a listed person field. Only PERSON entries extend this way, so generic
+  // suffixes such as `maxAge` or `homeSchool` keep their exact-match meaning,
+  // and a bare `name` is never listed.
+  return fieldSuffixes(field).some((suffix) => types.get(suffix) === 'PERSON')
+    ? 'PERSON'
+    : undefined;
+}
+// Word-boundary suffixes of a key, normalized; the whole key comes first.
+export function fieldSuffixes(field) {
+  const words = field
+    .split(/[\s_.-]+|(?<=[\p{Ll}\p{N}])(?=\p{Lu})|(?<=\p{Lu})(?=\p{Lu}\p{Ll})/u)
+    .filter(Boolean);
+  return words.map((_, i) => words.slice(i).join('').toLowerCase());
 }
 export const normalizeFieldName = (field) =>
   field.replace(/[_-]/g, '').toLowerCase();

package/src/document-patterns.js

@@ -1,8 +1,13 @@
 import { firstNames } from './names.js';
 import { isNameForm } from './russian-names.js';
+import { isDocumentTechnology } from './document-experience.js';
 
 const boundary = '[\\p{L}\\p{N}_]';
 const word = '[А-ЯЁ][а-яё-]{1,47}';
+const emailDot =
+  '(?:\\.|[ \\t]{0,8}(?:\\((?:dot|точка)\\)|\\[(?:dot|точка)\\])[ \\t]{0,8}|[ \\t]{1,8}(?:dot|точка)[ \\t]{1,8})';
+const emailAt =
+  '(?:[ \\t]{0,8}(?:\\((?:at|собака)\\)|\\[(?:at|собака)\\])[ \\t]{0,8}|[ \\t]{1,8}(?:at|собака)[ \\t]{1,8})';
 const surname =
   '[А-ЯЁа-яё][А-ЯЁа-яё-]{1,28}(?:ов|ев|ин|ын|ск|цк)(?:а|ой|ою|у|ым|ом|е|ы|и|их|ий|ая|ого|ому|ую|ие)?';
 const initials = '(?:[А-ЯЁA-Z]\\.[ \\t]*){1,2}';
@@ -36,7 +41,10 @@ const rules = [
   [
     'EMAIL',
     'obfuscated-email',
-    /(?<![\p{L}\p{N}_.+\\-])[\p{L}\p{N}_+-]{1,64}(?:(?:\.|[ \t]{1,8}dot[ \t]{1,8})[\p{L}\p{N}_+-]{1,64}){0,4}(?:[ \t]{0,8}\((?:at|собака)\)[ \t]{0,8}|[ \t]{0,8}\[at\][ \t]{0,8}|[ \t]{1,8}(?:at|собака)[ \t]{1,8})[\p{L}\p{N}-]{1,63}(?:(?:\.|[ \t]{1,8}dot[ \t]{1,8})[\p{L}\p{N}-]{1,63}){1,8}(?![\p{L}\p{N}_])/giu,
+    new RegExp(
+      `(?<![\\p{L}\\p{N}_.+\\\\-])[\\p{L}\\p{N}_+-]{1,64}(?:${emailDot}[\\p{L}\\p{N}_+-]{1,64}){0,4}${emailAt}[\\p{L}\\p{N}-]{1,63}(?:${emailDot}[\\p{L}\\p{N}-]{1,63}){1,8}(?![\\p{L}\\p{N}_])`,
+      'giu'
+    ),
     0,
   ],
   [
@@ -142,6 +150,12 @@ const rules = [
     ),
     1,
   ],
+  [
+    'ORGANIZATION',
+    'employer-prose',
+    /(?<![\p{L}\p{N}_])[Рр]аботал[аи]?[ \t]+в[ \t]+([\p{Ll}][\p{Ll}-]{1,47})(?![\p{L}\p{N}_])/gu,
+    1,
+  ],
   [
     'ORGANIZATION',
     'employer-years',
@@ -237,6 +251,12 @@ function documentValueAllowed(rule, value) {
       rule === 'profile-attribute' &&
       /^(?:не указан[оаы]?|not specified|unknown|n\/a)$/iu.test(value)
     ) &&
-    !(rule === 'messenger-label' && /^(?:недоступен|unavailable)$/i.test(value))
+    !(
+      rule === 'messenger-label' && /^(?:недоступен|unavailable)$/i.test(value)
+    ) &&
+    !(
+      rule === 'employer-prose' &&
+      (value === 'компании' || isDocumentTechnology(value))
+    )
   );
 }

package/src/document-person-cues.js

@@ -0,0 +1,38 @@
+import { collectMatches } from './detection.js';
+
+// A cue supplies evidence for a single Latin name without activating broad
+// capitalized-word matching for the rest of an English log or document.
+const boundary = '[\\p{L}\\p{M}\\p{N}_]';
+const name = "[A-Z][a-z]{1,47}(?:['’-][A-Z]?[a-z]{1,47})?";
+// Honorifics count only when capitalized: lowercase `ms` is the millisecond
+// unit in logs and lowercase `dr` is usually a word or path fragment. A
+// capitalized `Ms` right after a number is still a unit (`took 30 Ms Retry`).
+const cue =
+  '(?:[Cc]andidate|[Rr]ecruiter|[Aa]pplicant|[Dd]ear|[Hh]i|Mr\\.?|(?<!\\d[ \\t]*)Ms\\.?|Dr\\.?|[Mm]essage[ \\t]+from)';
+const pattern = new RegExp(
+  `(?<!${boundary})${cue}[ \\t]+(${name})(?!${boundary})`,
+  'gu'
+);
+// Workflow headings use the same person-role cues. Do not treat these finite
+// generic nouns as names merely because a heading is in title case.
+const labels = new Set(
+  'stage status name profile details information summary experience application tracking interview selection pipeline request failed'.split(
+    ' '
+  )
+);
+
+export function detectDocumentPersonCues(text, emit) {
+  collectMatches(
+    text,
+    pattern,
+    emit,
+    {
+      type: 'PERSON',
+      rule: 'document-person-cue',
+      category: 'personal',
+      confidence: 0.85,
+    },
+    1,
+    (value) => !labels.has(value.toLowerCase())
+  );
+}

package/src/policy.js

@@ -31,7 +31,7 @@ const vocabularyRules = {
     'education-type',
     'education-russian',
   ],
-  personalLabels: ['document-role'],
+  personalLabels: ['document-role', 'document-person-cue'],
 };
 export function validatePolicyControls(options) {
   for (const key of ['allowCredentialDisable', 'strict', 'exactFields']) {

package/src/propagation.js

@@ -35,7 +35,8 @@ function eligibleSeed(finding, options) {
   return (
     !options.knownOnly &&
     finding.category === 'personal' &&
-    finding.type !== 'ENCODED_SENSITIVE' &&
+    // Whole JSON values include syntax; they cannot seed string-content spans.
+    !['ENCODED_SENSITIVE', 'JSON_VALUE'].includes(finding.type) &&
     ![
       'confirmed-personal',
       'document-propagation',

package/src/proper-names.js

@@ -7,6 +7,19 @@ const commaMobile = /,[ \t]*[78]9\d{9}(?![\p{L}\p{N}_])/u;
 const mobile = /^[78]9\d{9}$/u;
 const tokenPattern = /[\p{L}\p{M}\p{N}_./:\\?&#%=@+'’~+-]+/gu;
 const upper = /[\p{Lu}\p{Lt}]/u;
+// Only known labels are exempt before colons in activated Cyrillic prose.
+const proseLabels = new Set(
+  'опыт стаж навыки образование компания работодатель должность обязанности достижения проекты контакты телефон почта адрес возраст пол гражданство дети национальность вероисповедание инвалидность судимость резюме имя фамилия отчество город статус дата время уровень языки интересы о себе место работы семейное положение'.split(
+    ' '
+  )
+);
+const completeTypes = new Set([
+  'EMAIL',
+  'PHONE',
+  'ID',
+  'VIN',
+  'PASSPORT_NUMBER',
+]);
 const quotePairs = new Map([
   ['«', '»'],
   ['“', '”'],
@@ -109,6 +122,8 @@ export function detectProseAndDocuments(text, emit, options, detectDocuments) {
     return;
   }
   const runs = [[]];
+  let complete = 0,
+    suppressed = 0;
   detectProperNames(
     text,
     (finding) => {
@@ -123,12 +138,20 @@ export function detectProseAndDocuments(text, emit, options, detectDocuments) {
   detectDocuments(
     text,
     (finding) => {
-      if (!runs.some((run) => overlapsRun(run, finding))) {
+      if (completeTypes.has(finding.type)) {
+        // Contacts and identifiers are indivisible: a domain or series alone
+        // cannot safely replace the complete value detected by document rules.
+        emit(finding);
+        complete++;
+      } else if (!runs.some((run) => overlapsRun(run, finding))) {
         emit(finding);
+      } else {
+        suppressed++;
       }
     },
     options
   );
+  options.debug?.({ event: 'document-prose-overlap', complete, suppressed });
 }
 function overlapsRun(run, finding) {
   let low = 0,
@@ -197,8 +220,8 @@ function preserveToken(text, raw, value, start, end, range) {
     !value ||
     (range && start >= range.index && end <= range.index + range[0].length) ||
     (value === 'REDACTED' && text[start - 1] === '[' && text[end] === ']') ||
-    raw.endsWith(':') ||
-    text[next] === ':'
+    ((raw.endsWith(':') || text[next] === ':') &&
+      (!/^[А-ЯЁа-яё-]+$/u.test(value) || proseLabels.has(value.toLowerCase())))
   );
 }
 function tokenType(value) {

package/src/rule-catalog.js

@@ -39,6 +39,7 @@ export const builtInRules = Object.freeze([
   'document-mobile-context',
   'document-msu',
   'document-patronymic',
+  'document-person-cue',
   'document-personal-path',
   'document-phone',
   'document-phone-label',
@@ -393,6 +394,7 @@ export const builtInRules = Object.freeze([
   'vocabulary-role',
   'webhook',
   'wordpress',
+  'yandex',
 ]);
 export const credentialRules = new Set([
   'anthropic',
@@ -666,4 +668,5 @@ export const credentialRules = new Set([
   'vercel',
   'webhook',
   'wordpress',
+  'yandex',
 ]);

package/src/rules.js

@@ -22,6 +22,11 @@ export const serviceRules = [
     'anthropic',
     /(?<![A-Za-z0-9_])sk-ant-(?:api\d{2}-)?[A-Za-z0-9_-]{16}[A-Za-z0-9_-]*/g,
   ],
+  // Yandex Cloud provider prefixes work without an assignment or auth label.
+  [
+    'yandex',
+    /(?<![A-Za-z0-9_-])(?:AQVN[A-Za-z0-9_-]{35,38}|YCAJE[A-Za-z0-9_-]{20}|YC[A-Za-z0-9_-]{38}|t1\.[A-Za-z0-9_-]+={0,2}\.[A-Za-z0-9_-]{86}={0,2})(?![A-Za-z0-9_=-])/g,
+  ],
   ['aws', /(?:AKIA|ASIA|A3T[A-Z0-9])[A-Z0-9]{16}/g],
   [
     'google',

package/src/strict.js

@@ -1,5 +1,8 @@
 import { collectMatches } from './detection.js';
 import { months } from './personal-context.js';
+import { isDocumentTechnology } from './document-experience.js';
+import { placeholderValues } from './placeholders.js';
+import { generatedValues } from './fake.js';
 
 const boundary = '[\\p{L}\\p{N}_]';
 const attributes =
@@ -7,6 +10,49 @@ const attributes =
 const additionalAttributes =
   /(?<![\p{L}\p{N}_])(?:диабет(?:ом|а|у|е)?|ВИЧ(?:-положительн(?:ый|ая|ого|ой))?|болен|больна|больны|католик(?:ом|а|и)?|католичк(?:а|ой|и)|буддист(?:ка|кой|ом|а|ы)?|атеист(?:ка|кой|ом|а|ы)?|украин(?:ец|ка|цы|цем|кой)|белорус(?:ка|кой|ом|а|ы)?|несудим(?:а|ы)?|судим(?:а|ы)?|член[ \t]+политической[ \t]+партии|холост(?:а|ы)?|развед[её]н(?:а|ы)?|в[ \t]+разводе|diabetes|diabetic|HIV(?:[ \t-]+positive)?|cancer|buddhist|catholic|atheist|ukrainian|belarusian|previous[ \t]+conviction|member[ \t]+of[ \t]+(?:a[ \t]+)?(?:political[ \t]+)?party|single|unmarried|widowed)(?![\p{L}\p{N}_])/giu;
 
+function isDuration(text, match, replacements) {
+  // Keep cues on the same clause; an age on the next line is independent.
+  let prefix = text.slice(Math.max(0, match.index - 128), match.index);
+  // Verification scans transformed text too. Keep its duration cues equivalent
+  // to the default redaction view, including custom placeholder spellings.
+  for (const { value } of replacements) {
+    prefix = prefix.replaceAll(value, '[REDACTED]');
+  }
+  prefix = prefix.split(/[\r\n;|]/u).at(-1);
+  const suffix = text.slice(match.index + match[0].length);
+  if (
+    /(?<![\p{L}\p{N}_])(?:мне|ему|ей|кандидату|кандидатке|исполнилось|возраст)[ \t]*:?[ \t]*$/iu.test(
+      prefix
+    )
+  ) {
+    return false;
+  }
+  if (
+    /(?<![\p{L}\p{N}_])(?:опыт(?:[ \t]+работы)?|стаж|experience|duration)[ \t]*:?[ \t]*$/iu.test(
+      prefix
+    ) ||
+    /(?<![\p{L}\p{N}_])(?:за(?:[ \t]+последние)?|через|спустя|более|на|длился|длилась)[ \t]+$/iu.test(
+      prefix
+    ) ||
+    /(?<![\p{L}\p{N}_])(?:работал[аи]?|проработал[аи]?|\[REDACTED\](?=[ \t]+(?:там|в)(?![\p{L}\p{N}_])))(?:[ \t]+(?:[\p{L}-]{1,48}|\[REDACTED\])){0,3}[ \t]+$/iu.test(
+      prefix
+    ) ||
+    /^[ \t]+(?:опыта|стажа|работы)(?![\p{L}\p{N}_])/iu.test(suffix)
+  ) {
+    return true;
+  }
+  const skill =
+    /([\p{L}\p{N}+#.-]+(?:[ \t]+[\p{L}\p{N}+#.-]+)?)[ \t]+\([ \t]*$/u
+      .exec(prefix)?.[1]
+      ?.replace(/[ \t]+/gu, ' ') ?? '';
+  return (
+    /^[ \t]*\)/u.test(suffix) &&
+    (isDocumentTechnology(skill) ||
+      isDocumentTechnology(skill.split(' ').at(-1)) ||
+      /\[REDACTED\][ \t]+\([ \t]*$/u.test(prefix))
+  );
+}
+
 export function detectStrict(text, emit, options) {
   if (!options.strict) {
     return;
@@ -29,16 +75,17 @@ export function detectStrict(text, emit, options) {
     category: 'personal',
     confidence: 0.9,
   });
+  const replacements = [
+    ...placeholderValues(options),
+    ...generatedValues(options),
+  ].filter((entry) => !entry.credential);
   collectMatches(
     text,
     /(?<![\p{L}\p{N}_])\d{1,3}[ \t]+(?:год|года|лет|years?[ \t]+old)(?![\p{L}\p{N}_])/giu,
     emit,
     { type: 'AGE', rule: 'strict-age', category: 'personal', confidence: 0.9 },
     0,
-    (_value, match) =>
-      !/(?:опыт(?:[ \t]+работы)?|стаж|experience|duration|за|через|спустя)[ \t]*$/iu.test(
-        text.slice(Math.max(0, match.index - 64), match.index)
-      )
+    (_value, match) => !isDuration(text, match, replacements)
   );
   for (const [type, pattern] of [
     [

package/src/structured.js

@@ -459,7 +459,7 @@ function stringOffsets(raw) {
 // A caller-declared property replaces its entire JSON value, including containers
 // and primitives. Source token offsets preserve the surrounding record.
 export function declaredFieldFindings(text, options) {
-  if (!options.sensitiveFields?.length) {
+  if (!options.sensitiveFields?.length && !options.documentEntities) {
     return [];
   }
   const findings = [];
@@ -467,39 +467,60 @@ export function declaredFieldFindings(text, options) {
   let offset = 0;
   for (const record of records) {
     for (const token of tokens(record, offset)) {
-      if (
-        token.start < (findings.at(-1)?.end ?? 0) ||
-        !token.key ||
-        !fieldMatches(
-          options.sensitiveFields,
-          token.property,
-          [...token.path.slice(0, -1), token.property],
-          options.exactFields
-        )
-      ) {
+      if (token.start < (findings.at(-1)?.end ?? 0) || !token.key) {
         continue;
       }
-      let start = token.start + token.raw.length;
-      while (/[\s:]/.test(text[start] ?? '') && start < text.length) {
-        start++;
+      const finding = declaredValueFinding(text, token, options);
+      if (finding) {
+        findings.push(finding);
       }
-      const end = jsonValueEnd(text, start);
-      if (text.slice(start, end) === '"[REDACTED]"') {
-        continue;
-      }
-      findings.push({
-        start,
-        end,
-        type: 'JSON_VALUE',
-        category: 'personal',
-        rule: 'known-personal',
-        confidence: 1,
-      });
     }
     offset += record.length + 1;
   }
   return findings;
 }
+function declaredValueFinding(text, token, options) {
+  const declared = fieldMatches(
+    options.sensitiveFields,
+    token.property,
+    [...token.path.slice(0, -1), token.property],
+    options.exactFields
+  );
+  const type = configuredFieldType(token.property, options);
+  if (!declared && !['AGE', 'DATE_OF_BIRTH'].includes(type)) {
+    return undefined;
+  }
+  let start = token.start + token.raw.length;
+  while (/[\s:]/.test(text[start] ?? '') && start < text.length) {
+    start++;
+  }
+  const end = jsonValueEnd(text, start);
+  // Strings use structuredFieldFindings. Numeric personal attributes need
+  // a whole-value replacement so the resulting JSON stays valid.
+  if (
+    !declared &&
+    !(
+      /^-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?$/.test(text.slice(start, end)) &&
+      builtInEnabled(
+        { type, rule: 'known-personal', category: 'personal' },
+        options
+      )
+    )
+  ) {
+    return undefined;
+  }
+  if (text.slice(start, end) === '"[REDACTED]"') {
+    return undefined;
+  }
+  return {
+    start,
+    end,
+    type: 'JSON_VALUE',
+    category: 'personal',
+    rule: 'known-personal',
+    confidence: 1,
+  };
+}
 function jsonValueEnd(text, start) {
   let depth = 0,
     quoted = false;

package/src/vocabulary.js

@@ -1,6 +1,6 @@
 import { failure, collectMatches } from './detection.js';
 import { wordPattern } from './personal-variants.js';
-import { normalizeFieldName } from './document-fields.js';
+import { fieldSuffixes, normalizeFieldName } from './document-fields.js';
 
 export const defaultVocabulary = Object.freeze(
   Object.fromEntries(
@@ -40,7 +40,16 @@ export const defaultVocabulary = Object.freeze(
         'graduated from',
       ],
       personalLabels: ['соискатель', 'сотрудник', 'кандидат'],
-      personalFields: ['firstname', 'lastname', 'middlename', 'patronymic'],
+      personalFields: [
+        'firstname',
+        'lastname',
+        'middlename',
+        'patronymic',
+        'candidatename',
+        'displayname',
+        'fullname',
+        'originalfilename',
+      ],
     }).map(([key, values]) => [key, Object.freeze(values)])
   )
 );
@@ -161,7 +170,8 @@ export function vocabularyField(field, options) {
   if (!vocabulary) {
     return undefined;
   }
-  return vocabulary.fields.has(normalizeFieldName(field))
+  return vocabulary.fields.has(normalizeFieldName(field)) ||
+    fieldSuffixes(field).some((suffix) => vocabulary.fields.has(suffix))
     ? true
     : options.vocabulary.personalFields?.replace
       ? false