@link-foundation/sensitive-data-sanitizer 0.19.3 → 0.21.0

package/src/placeholder-types.js

@@ -1,34 +1,184 @@
 import { catalogTypes } from './entities.js';
+import { escapePattern, failure } from './detection.js';
+import { jsonStringLiterals } from './json-string-runs.js';
+import { placeholderToken, validatePlaceholderFormat } from './restore-map.js';
 
-// Native unlabelled types supplement the shared vendor-label catalog.
-export const reservedPlaceholderTypes = () => [
-  ...catalogTypes(),
+// Native types that the shared vendor-label catalog does not already list. The
+// national identifier types are spelled out here so that this module does not
+// load the national rules.
+const nativeTypes = [
+  'ABA_ROUTING_NUMBER',
   'ADDRESS',
+  'AE_EMIRATES_ID',
+  'AGE',
+  'AU_ABN',
+  'AU_ACN',
+  'AU_MEDICARE',
   'AU_TFN',
   'BRAZIL_CPF_NUMBER',
+  'CA_SIN',
   'CREDENTIAL',
   'CREDIT_CARD',
   'DATE',
+  'DE_TAX_ID',
   'EDUCATION',
   'EMAIL',
   'ENCODED_SENSITIVE',
+  'ES_NIE',
+  'EU_VAT_NUMBER',
+  'FI_PERSONAL_IDENTITY_CODE',
+  'GENDER',
   'IBAN',
   'ID',
+  'IL_ID_NUMBER',
+  'IMEI',
+  'IN_AADHAAR',
+  'IN_GSTIN',
+  'IN_PASSPORT',
+  'IN_VOTER',
   'IP_ADDRESS',
+  'IT_FISCAL_CODE',
+  'IT_VAT_CODE',
   'KR_RRN',
   'LOCATION',
   'MAC_ADDRESS',
+  'MEDICAL_LICENSE',
   'ORGANIZATION',
   'PASSPORT_MRZ',
   'PASSPORT_NUMBER',
   'PERSON',
-  'PROPER_NAME',
+  'PERSONAL_ATTRIBUTE',
   'PHONE',
   'PL_PESEL',
+  'POSTAL_CODE',
+  'PROPER_NAME',
   'RU_INN',
   'RU_SNILS',
+  'SA_NATIONAL_ID',
+  'SENSITIVE',
+  'SE_PERSONNUMMER',
   'SG_NRIC_FIN',
+  'SG_UEN',
   'STATE',
+  'STEAM_ID',
+  'SWIFT_CODE',
+  'TH_TNIN',
+  'TRACKING_NUMBER',
+  'UK_DRIVING_LICENCE',
+  'UK_NATIONAL_INSURANCE_NUMBER',
+  'UK_NHS',
+  'UK_POSTCODE',
+  'URL',
   'USERNAME',
+  'US_BANK_NUMBER',
+  'US_DRIVER_LICENSE',
   'US_HEALTHCARE_NPI',
+  'US_ITIN',
+  'VIN',
+  'ZA_ID_NUMBER',
 ];
+let reserved;
+// Every type that a built-in rule can turn into a `Type-n` token.
+export function reservedPlaceholderTypes() {
+  reserved ??= Object.freeze(
+    [...new Set([...catalogTypes(), ...nativeTypes])].sort()
+  );
+  return reserved;
+}
+
+const defaultFormat = '{Type}-{n}';
+const patterns = new Map();
+const patternCacheSize = 64;
+// The namespace pattern depends only on the format and on the types beyond the
+// reserved list, so it is compiled once per format and cached.
+export function namespacePattern(format = defaultFormat, extraTypes = []) {
+  const base = new Set(reservedPlaceholderTypes());
+  const extra = [...new Set(extraTypes)].filter((type) => !base.has(type));
+  const key = `${format}\0${extra.sort().join('\0')}`;
+  const cached = patterns.get(key);
+  if (cached) {
+    return cached;
+  }
+  const [before, after] = format.split('{n}');
+  const typed = before.match(/\{(?:Type|TYPE|type)\}/) ? before : after;
+  const types = new Map();
+  for (const type of [...base, ...extra]) {
+    const part = placeholderToken(type, 1, typed);
+    types.set(part, [...(types.get(part) ?? []), type]);
+  }
+  const alternation = [...types.keys()]
+    .sort((a, b) => b.length - a.length || a.localeCompare(b))
+    .map(escapePattern)
+    .join('|');
+  const number = '([1-9][0-9]*)';
+  const source =
+    typed === before
+      ? `(${alternation})${number}${escapePattern(after)}`
+      : `${escapePattern(before)}${number}(${alternation})`;
+  const pattern = {
+    source: `(?<![\\p{L}\\p{M}\\p{N}_])(?:${source})(?![\\p{L}\\p{M}\\p{N}_])`,
+    typedFirst: typed === before,
+    types,
+  };
+  if (patterns.size >= patternCacheSize) {
+    patterns.delete(patterns.keys().next().value);
+  }
+  patterns.set(key, pattern);
+  return pattern;
+}
+// Tokens of the namespace with the types each spelling can stand for.
+export function placeholderTokens(text, pattern) {
+  const tokens = [];
+  for (const match of text.matchAll(new RegExp(pattern.source, 'gu'))) {
+    const [part, number] = pattern.typedFirst
+      ? [match[1], match[2]]
+      : [match[2], match[1]];
+    tokens.push({
+      start: match.index,
+      end: match.index + match[0].length,
+      number: Number(number),
+      types: pattern.types.get(part),
+    });
+  }
+  return tokens;
+}
+export function containsPlaceholder(text, pattern) {
+  return new RegExp(pattern.source, 'u').test(text);
+}
+// Tokens spelled with JSON escapes inside string literals, such as
+// `Person-1`, decoded so that they cannot hide from the namespace check.
+export function escapedPlaceholderTokens(text, pattern) {
+  const tokens = [];
+  for (const literal of jsonStringLiterals(text)) {
+    try {
+      tokens.push(...placeholderTokens(JSON.parse(literal), pattern));
+    } catch {
+      // Ordinary free text may include strings that are not JSON literals.
+    }
+  }
+  return tokens;
+}
+
+// Public check for a whole `Type-n` token of the library namespace.
+export function isPlaceholderToken(text, options = {}) {
+  if (
+    options === null ||
+    typeof options !== 'object' ||
+    (options.types !== undefined &&
+      (!Array.isArray(options.types) ||
+        options.types.some(
+          (type) =>
+            typeof type !== 'string' || !/^[A-Z][A-Z0-9_]{0,63}$/.test(type)
+        )))
+  ) {
+    throw failure('ERR_CONFIG');
+  }
+  if (typeof text !== 'string') {
+    return false;
+  }
+  const pattern = namespacePattern(
+    validatePlaceholderFormat(options.format ?? defaultFormat),
+    options.types ?? []
+  );
+  return new RegExp(`^(?:${pattern.source})$`, 'u').test(text);
+}

package/src/placeholders.js

@@ -1,10 +1,14 @@
 import { failure, REDACTED, escapePattern } from './detection.js';
-import { reservedPlaceholderTypes } from './placeholder-types.js';
+import {
+  namespacePattern,
+  placeholderTokens,
+  containsPlaceholder,
+  escapedPlaceholderTokens,
+} from './placeholder-types.js';
 import { samePersonal } from './personal-variants.js';
 import { isNameForm } from './russian-names.js';
 import { nameAliases } from './transliteration.js';
 import { createHash } from 'node:crypto';
-import { jsonStringLiterals } from './json-string-runs.js';
 import {
   createRestoreMap,
   validateRestoreMap,
@@ -35,8 +39,15 @@ const transforms = (options) =>
     ...Object.values(options.transformations ?? {}),
   ].filter((t) => t?.mode === 'placeholder');
 
+const existingModes = new Set(['error', 'keep']);
 export function validatePlaceholder(transform) {
   validatePlaceholderFormat(transform.format ?? transform.map?.format);
+  if (
+    transform.existing !== undefined &&
+    !existingModes.has(transform.existing)
+  ) {
+    throw failure('ERR_CONFIG');
+  }
   if (
     transform.credentials !== undefined &&
     typeof transform.credentials !== 'boolean'
@@ -67,12 +78,21 @@ export function initializePlaceholders(options) {
     selected.some(
       (t) =>
         (t.map !== undefined && t.map !== first.map) ||
-        (t.format !== undefined && t.format !== map.format)
+        (t.format !== undefined && t.format !== map.format) ||
+        (t.existing ?? 'error') !== (first.existing ?? 'error')
     )
   ) {
     throw failure('ERR_CONFIG');
   }
-  return { ...options, [placeholderState]: { map, keep: first.map !== false } };
+  return {
+    ...options,
+    [placeholderState]: {
+      map,
+      keep: first.map !== false,
+      existing: first.existing ?? 'error',
+      floors: new Map(),
+    },
+  };
 }
 export function placeholderKnown(options) {
   const map = options[placeholderState]?.map;
@@ -305,31 +325,95 @@ function addNamePatterns(person, patterns, bareForms) {
     }
   }
 }
+const placeholderType = (finding) => {
+  if (finding.category === 'credential') {
+    return 'CREDENTIAL';
+  }
+  const type =
+    finding.type === 'JSON_VALUE'
+      ? (finding.valueType ?? 'SENSITIVE')
+      : finding.type;
+  return type === 'DATE_OF_BIRTH' ? 'DATE' : type;
+};
+// Types beyond the reserved list that this call can turn into tokens.
+function callPattern(findings, options) {
+  const transform = transforms(options)[0];
+  const map = options[placeholderState]?.map;
+  return namespacePattern(
+    map?.format ?? transform?.format ?? transform?.map?.format,
+    [
+      ...findings.map(placeholderType),
+      ...(options.knownPersonal ?? []).map((e) => e.type),
+      ...(map?.entries ?? []).map((e) => e.type),
+    ]
+  );
+}
+const keepsExisting = (options) => transforms(options)[0]?.existing === 'keep';
+// With `existing: 'keep'` the tokens of an earlier pass stay as they are, so
+// findings made only of those tokens are not replaced again.
+export function keptPlaceholderSpans(text, findings, options) {
+  if (!keepsExisting(options)) {
+    return [];
+  }
+  return placeholderTokens(text, callPattern(findings, options));
+}
+const significant = /[\p{L}\p{N}]/u;
+// A finding made only of kept tokens is kept, and one that starts or ends
+// inside a kept token is trimmed to the text beside it.
+function trimmedToLoose(finding, inside, loose) {
+  let { start, end } = finding;
+  if (inside(start)) {
+    while (start < end && !loose(start)) {
+      start = inside(start)?.end ?? start + 1;
+    }
+  }
+  if (inside(end - 1)) {
+    while (end > start && !loose(end - 1)) {
+      end = inside(end - 1)?.start ?? end - 1;
+    }
+  }
+  return start === finding.start && end === finding.end
+    ? finding
+    : { ...finding, start, end };
+}
+export function keptPlaceholderFinding(text, finding, tokens) {
+  const overlapping = tokens.filter(
+    (token) => token.start < finding.end && token.end > finding.start
+  );
+  if (finding.category !== 'personal' || !overlapping.length) {
+    return finding;
+  }
+  const inside = (i) =>
+    overlapping.find((token) => token.start <= i && token.end > i);
+  const loose = (i) => !inside(i) && significant.test(text[i]);
+  const { start, end } = finding;
+  if (!Array.from({ length: end - start }, (_, i) => start + i).some(loose)) {
+    return { ...finding, kept: 'fake' };
+  }
+  return finding.type === 'JSON_VALUE'
+    ? finding
+    : trimmedToLoose(finding, inside, loose);
+}
 export function preparePlaceholderText(text, findings, options) {
   const state = options[placeholderState];
   if (!state || !hasPlaceholders(options)) {
     return;
   }
-  const types = new Set([
-    ...reservedPlaceholderTypes(),
-    ...findings.map((f) =>
-      f.category === 'credential' ? 'CREDENTIAL' : f.type
-    ),
-    ...(options.knownPersonal ?? []).map((e) => e.type),
-    ...state.map.entries.map((e) => e.type),
-  ]);
-  const [before, after] = state.map.format.split('{n}');
-  const tokens = [...types].map(
-    (type) =>
-      `${escapePattern(
-        placeholderToken(type, 1, before)
-      )}[1-9][0-9]*${escapePattern(placeholderToken(type, 1, after))}`
-  );
-  const pattern = new RegExp(
-    `(?<![\\p{L}\\p{M}\\p{N}_])(?:${tokens.join('|')})(?![\\p{L}\\p{M}\\p{N}_])`,
-    'u'
-  );
-  if (namespaceCollision(text, pattern)) {
+  const pattern = callPattern(findings, options);
+  if (state.existing === 'keep') {
+    // New values are numbered after the highest kept number of their type.
+    for (const token of [
+      ...placeholderTokens(text, pattern),
+      ...escapedPlaceholderTokens(text, pattern),
+    ]) {
+      for (const type of token.types) {
+        state.floors.set(
+          type,
+          Math.max(state.floors.get(type) ?? 0, token.number)
+        );
+      }
+    }
+  } else if (namespaceCollision(text, pattern)) {
     throw failure('ERR_PLACEHOLDER_COLLISION');
   }
   state.people = [
@@ -345,20 +429,11 @@ export function preparePlaceholderText(text, findings, options) {
   ];
 }
 function namespaceCollision(text, pattern) {
-  if (pattern.test(text)) {
-    return true;
-  }
   // JSON escape spellings must not conceal existing tokens in keys or values.
-  for (const literal of jsonStringLiterals(text)) {
-    try {
-      if (pattern.test(JSON.parse(literal))) {
-        return true;
-      }
-    } catch {
-      // Ordinary free text may include strings that are not JSON literals.
-    }
-  }
-  return false;
+  return (
+    containsPlaceholder(text, pattern) ||
+    escapedPlaceholderTokens(text, pattern).length > 0
+  );
 }
 
 export function canonicalPerson(value, people) {
@@ -381,7 +456,18 @@ export function canonicalPerson(value, people) {
       person,
     ])
   );
-  return distinct.size === 1 ? [...distinct.values()][0] : value;
+  if (distinct.size === 1) {
+    return [...distinct.values()][0];
+  }
+  // `Иванов Иван` and `Иванов Иван Петрович` are one mention in two lengths:
+  // the unique name that holds the words of every other match is the person.
+  const words = (person) =>
+    new Set((person.match(/\p{L}+/gu) ?? []).map((w) => w.toLowerCase()));
+  const fullest = [...distinct.values()].filter((person) => {
+    const own = words(person);
+    return matches.every((other) => [...words(other)].every((w) => own.has(w)));
+  });
+  return fullest.length === 1 ? fullest[0] : value;
 }
 function canonicalKnown(value, type, options, state) {
   const known = (options.knownPersonal ?? []).filter(
@@ -427,12 +513,7 @@ export function placeholderReplacement(value, finding, transform, options) {
     throw failure('ERR_CONFIG');
   }
   const { map } = state;
-  const type =
-    finding.category === 'credential'
-      ? 'CREDENTIAL'
-      : finding.type === 'DATE_OF_BIRTH'
-        ? 'DATE'
-        : finding.type;
+  const type = placeholderType(finding);
   const canonical = canonicalKnown(value, type, options, state);
   const candidates = map.entries.filter(
     (entry) => entry.type === type && related(canonical, entry)
@@ -451,7 +532,7 @@ export function placeholderReplacement(value, finding, transform, options) {
       1 +
       map.entries.reduce(
         (n, e) => (e.type === type ? Math.max(n, e.number) : n),
-        0
+        state.floors?.get(type) ?? 0
       );
     const token = placeholderToken(type, number, map.format);
     if (
@@ -543,5 +624,6 @@ export function discardPlaceholderState(options) {
     state.map.entries.length = 0;
     state.map.documents.length = 0;
     state.people = [];
+    state.floors?.clear();
   }
 }

package/src/projection.js

@@ -1,6 +1,7 @@
 // Map a detection view back to the original UTF-16 offsets. Normalization
 // never writes to the original text, and offsets remain valid after emoji.
 import { failure } from './detection.js';
+import { htmlTag, inlineTags } from './html-tags.js';
 
 // Unicode Nd zero codepoints. NFKC already maps mathematical/fullwidth digits;
 // other numeral systems need explicit conversion with original-source spans.
@@ -21,12 +22,83 @@ function asciiDigits(value) {
   });
 }
 
+// Invisible format characters and NUL (UTF-16 text read as bytes) never
+// carry meaning inside a token, so they are removed from the detection view.
+const invisible =
+  /^[\0\u00ad\u061c\u180e\u200b-\u200f\u202a-\u202e\u2060-\u206f\ufeff]$/u;
+const inlineTag = new RegExp(String.raw`^<\/?(?:${inlineTags})[\s/>]`);
+// TruffleHog-style escape runs: `U+0074 U+006F ...` and CSS `\74 \6f ...`.
+// Runs need four or more units so prose such as "U+200B" stays untouched.
+// The space after the last unit stays in the view as a word boundary.
+const codeRun = String.raw`(?:U\+[\da-fA-F]{4,6} ?){3,}U\+[\da-fA-F]{4,6}`;
+const cssRun = String.raw`(?:\\[\da-fA-F]{1,6} ){3,}\\[\da-fA-F]{1,6}`;
+const projectionTrigger = new RegExp(
+  String.raw`\x1b\[|\0|\\u[\da-fA-F{]|\\x\{[\da-fA-F]|\\U[\da-fA-F]{8}|%u[\da-fA-F]{4}|U\+[\da-fA-F]{4}|\\[\da-fA-F]{1,6} \\|[\u00ad\u061c\u180e\u200b-\u200f\u202a-\u202e\u2060-\u206f\ufeff]|${htmlTag}`,
+  'u'
+);
+const projectionUnits = new RegExp(
+  String.raw`\x1b\[[0-?]*[ -/]*[@-~]|\\u[\da-fA-F]{4}|\\[ux]\{[\da-fA-F]{1,6}\}|\\U[\da-fA-F]{8}|%u[\da-fA-F]{4}|${codeRun}|${cssRun}|${htmlTag}|[\s\S]\p{M}*`,
+  'gu'
+);
+
+function decodeEscape(raw) {
+  const escape = /^(?:\\[ux]\{?|\\U|%u)([\da-fA-F]+)\}?$/.exec(raw);
+  if (!escape) {
+    return raw;
+  }
+  const code = parseInt(escape[1], 16);
+  // `\uXXXX` keeps UTF-16 surrogate halves; wider forms are code points.
+  return raw.length === 6 && raw[0] === '\\'
+    ? String.fromCharCode(code)
+    : code <= 0x10ffff
+      ? String.fromCodePoint(code)
+      : raw;
+}
+
+// Every character decoded from an escape run maps to the whole run. Redacting
+// only some units would leave a short run, such as a lone closing quote, that
+// the next view no longer decodes, so a finding inside a run covers all of it.
+function appendRun(writer, raw, offset) {
+  const unit = raw.startsWith('U+')
+    ? /U\+([\da-fA-F]{4,6}) ?/g
+    : /\\([\da-fA-F]{1,6}) ?/g;
+  const end = offset + raw.length;
+  for (const match of raw.matchAll(unit)) {
+    const code = parseInt(match[1], 16);
+    const value = code <= 0x10ffff ? String.fromCodePoint(code) : match[0];
+    if (!invisible.test(value)) {
+      writer.append(value, offset, end);
+    }
+  }
+}
+
+function projectUnit(writer, raw, offset) {
+  const end = offset + raw.length;
+  if (raw.startsWith('\x1b[') || invisible.test(raw)) {
+    return true;
+  }
+  if (raw[0] === '<' && raw.length > 2 && raw.endsWith('>')) {
+    if (!inlineTag.test(raw)) {
+      writer.append('\n', offset, end);
+    }
+    return true;
+  }
+  if (raw.length > 8 && /^(?:U\+|\\[\da-fA-F])/.test(raw)) {
+    appendRun(writer, raw, offset);
+    return true;
+  }
+  const decoded = decodeEscape(raw);
+  if (invisible.test(decoded)) {
+    return true;
+  }
+  const value = asciiDigits(decoded.normalize('NFKC'));
+  writer.append(value, offset, end);
+  return value !== raw;
+}
+
 export function projectText(input) {
   if (
-    // eslint-disable-next-line no-control-regex -- ANSI escape sequences are removed from the detection view.
-    !/\x1b\[|\\u[\da-fA-F]{4}|[\u200b-\u200f\u202a-\u202e\u2060-\u206f\ufeff]/u.test(
-      input
-    ) &&
+    !projectionTrigger.test(input) &&
     // ASCII already has normalized letters and digits. Avoid constructing a
     // second multi-megabyte string just to check its decimal characters.
     // eslint-disable-next-line no-control-regex -- Check the ASCII range.
@@ -37,29 +109,9 @@ export function projectText(input) {
     return { text: input, changed: false };
   }
   const writer = projectionWriter(input.length);
-  // eslint-disable-next-line no-control-regex -- Tokenize ANSI sequences with their original offsets.
-  const units = /\x1b\[[0-?]*[ -/]*[@-~]|\\u[\da-fA-F]{4}|[\s\S]\p{M}*/gu;
   let changed = false;
-  for (const match of input.matchAll(units)) {
-    const raw = match[0];
-    let value = raw;
-    if (
-      raw.startsWith('\x1b[') ||
-      /^[\u200b-\u200f\u202a-\u202e\u2060-\u206f\ufeff]$/u.test(raw)
-    ) {
-      changed = true;
-      continue;
-    }
-    if (/^\\u[\da-fA-F]{4}$/.test(raw)) {
-      value = String.fromCharCode(parseInt(raw.slice(2), 16));
-    }
-    if (/^[\u200b-\u200f\u202a-\u202e\u2060-\u206f\ufeff]$/u.test(value)) {
-      changed = true;
-      continue;
-    }
-    value = asciiDigits(value.normalize('NFKC'));
-    changed ||= value !== raw;
-    writer.append(value, match.index, match.index + raw.length);
+  for (const match of input.matchAll(projectionUnits)) {
+    changed = projectUnit(writer, match[0], match.index) || changed;
   }
   return { ...writer.finish(), changed };
 }

package/src/proper-names.js

@@ -1,5 +1,6 @@
 import { failure } from './detection.js';
 import { documentDateRange } from './document-dates.js';
+import { keepsProseWord } from './prose-words.js';
 
 const scriptPatterns = new Map();
 const dateRange = new RegExp(`\\(${documentDateRange}\\)`, 'u');
@@ -113,6 +114,21 @@ function quotedSpans(text, emit) {
 function pathToken(value) {
   return value.includes('/') || value.includes('\\');
 }
+// Compact typed document findings, such as `ООО «Ромашка»` after `работал в`
+// or `Казани` after `живу в`, name what the prose tokens inside them are.
+const typedDocumentTypes = new Set([
+  'ORGANIZATION',
+  'LOCATION',
+  'EDUCATION',
+  'PERSON',
+]);
+function compactTyped(text, finding) {
+  return (
+    typedDocumentTypes.has(finding.type) &&
+    finding.end - finding.start <= 160 &&
+    !/[\t\r\n]/u.test(text.slice(finding.start, finding.end))
+  );
+}
 // Keep existing document coverage outside the new replacements. Two naturally
 // ordered runs (quotes, then tokens) provide an interval index without sorting.
 // Overlapping broad document spans must not merge separate prose replacements.
@@ -131,28 +147,48 @@ export function detectProseAndDocuments(text, emit, options, detectDocuments) {
         runs.push([]);
       }
       runs.at(-1).push(finding);
-      emit(finding);
     },
     options
   );
+  const covered = new Set();
   detectDocuments(
     text,
     (finding) => {
+      const overlapping = runs.flatMap((run) => overlapsRun(run, finding));
       if (completeTypes.has(finding.type)) {
         // Contacts and identifiers are indivisible: a domain or series alone
         // cannot safely replace the complete value detected by document rules.
         emit(finding);
         complete++;
-      } else if (!runs.some((run) => overlapsRun(run, finding))) {
+      } else if (!overlapping.length) {
         emit(finding);
+      } else if (
+        compactTyped(text, finding) &&
+        overlapping.every(
+          (prose) => prose.start >= finding.start && prose.end <= finding.end
+        )
+      ) {
+        emit(finding);
+        overlapping.forEach((prose) => covered.add(prose));
       } else {
         suppressed++;
       }
     },
     options
   );
-  options.debug?.({ event: 'document-prose-overlap', complete, suppressed });
+  for (const finding of runs.flat()) {
+    if (!covered.has(finding)) {
+      emit(finding);
+    }
+  }
+  options.debug?.({
+    event: 'document-prose-overlap',
+    complete,
+    suppressed,
+    typed: covered.size,
+  });
 }
+// The prose findings of one ordered run that overlap a document finding.
 function overlapsRun(run, finding) {
   let low = 0,
     high = run.length;
@@ -164,7 +200,11 @@ function overlapsRun(run, finding) {
       high = mid;
     }
   }
-  return low < run.length && run[low].start < finding.end;
+  const overlapping = [];
+  for (let i = low; i < run.length && run[i].start < finding.end; i++) {
+    overlapping.push(run[i]);
+  }
+  return overlapping;
 }
 export function detectProperNames(text, emit, options) {
   if (options.properNames !== 'capitalized' || !proseData(text, options)) {
@@ -199,7 +239,10 @@ export function detectProperNames(text, emit, options) {
     while (range && range.index + range[0].length <= start) {
       range = ranges.next().value;
     }
-    if (preserveToken(text, raw, value, start, end, range)) {
+    if (
+      preserveToken(text, raw, value, start, end, range) ||
+      keepsProseWord(text, value, start, end, options)
+    ) {
       continue;
     }
     const type = tokenType(value);