@link-foundation/sensitive-data-sanitizer 0.19.3 → 0.21.0

package/src/pattern-detector.js

@@ -0,0 +1,219 @@
+import { failure, escapePattern } from './detection.js';
+
+// Declarative recognizers in the style of Presidio's PatternRecognizer
+// (patterns with scores, deny lists, context words, validate_result) and
+// Google custom infoTypes (regex/dictionary plus hotword likelihood rules).
+// The result is an ordinary Detector, so it composes with every other port.
+const typePattern = /^[A-Z][A-Z0-9_]{0,63}$/;
+const rulePattern = /^[a-z0-9@/._-]{1,120}$/;
+const maxPatterns = 64,
+  maxWords = 10000;
+
+const score = (value) =>
+  typeof value === 'number' &&
+  Number.isFinite(value) &&
+  value >= 0 &&
+  value <= 1;
+const optional = (value, test) => value === undefined || test(value);
+const words = (list) =>
+  Array.isArray(list) &&
+  list.length <= maxWords &&
+  list.every((word) => typeof word === 'string' && word.trim().length > 0);
+
+const validEntry = (raw) =>
+  Boolean(raw) &&
+  (raw.regex instanceof RegExp ||
+    (typeof raw.regex === 'string' && raw.regex.length > 0)) &&
+  optional(raw.confidence, score) &&
+  optional(raw.group, (group) => Number.isSafeInteger(group) && group >= 0);
+
+function globalRegex(regex) {
+  try {
+    return regex instanceof RegExp
+      ? new RegExp(
+          regex.source,
+          regex.flags.includes('g') ? regex.flags : `${regex.flags}g`
+        )
+      : new RegExp(regex, 'gu');
+  } catch {
+    throw failure('ERR_CONFIG');
+  }
+}
+
+function compile(entry) {
+  const raw =
+    entry instanceof RegExp || typeof entry === 'string'
+      ? { regex: entry }
+      : entry;
+  if (!validEntry(raw)) {
+    throw failure('ERR_CONFIG');
+  }
+  return {
+    regex: globalRegex(raw.regex),
+    confidence: raw.confidence,
+    group: raw.group ?? 0,
+  };
+}
+
+function window(value) {
+  if (value === undefined) {
+    return { before: 64, after: 16 };
+  }
+  const shape = typeof value === 'number' ? { before: value, after: 0 } : value;
+  if (
+    !shape ||
+    ![shape.before ?? 0, shape.after ?? 0].every(
+      (n) => Number.isSafeInteger(n) && n >= 0 && n <= 4096
+    )
+  ) {
+    throw failure('ERR_CONFIG');
+  }
+  return { before: shape.before ?? 0, after: shape.after ?? 0 };
+}
+
+const specChecks = [
+  (spec) => typePattern.test(spec.type ?? ''),
+  (spec) =>
+    optional(spec.category, (c) => ['personal', 'credential'].includes(c)),
+  (spec) => optional(spec.rule, (rule) => rulePattern.test(rule)),
+  (spec) => optional(spec.confidence, score),
+  (spec) => optional(spec.denyListConfidence, score),
+  (spec) =>
+    optional(
+      spec.patterns,
+      (list) => Array.isArray(list) && list.length <= maxPatterns
+    ),
+  (spec) => optional(spec.denyList, words),
+  (spec) => optional(spec.context, words),
+  (spec) =>
+    optional(
+      spec.contextBoost,
+      (boost) => typeof boost === 'number' && Math.abs(boost) <= 1
+    ),
+  (spec) => optional(spec.validate, (fn) => typeof fn === 'function'),
+  (spec) => Boolean(spec.patterns?.length || spec.denyList?.length),
+];
+
+function compileSpec(spec) {
+  if (
+    !spec ||
+    typeof spec !== 'object' ||
+    !specChecks.every((check) => check(spec))
+  ) {
+    throw failure('ERR_CONFIG');
+  }
+  const patterns = (spec.patterns ?? []).map(compile);
+  if (spec.denyList?.length) {
+    patterns.push({
+      regex: new RegExp(
+        `(?<![\\p{L}\\p{N}_])(?:${[...spec.denyList]
+          .sort((a, b) => b.length - a.length)
+          .map(escapePattern)
+          .join('|')})(?![\\p{L}\\p{N}_])`,
+        spec.caseSensitive ? 'gu' : 'giu'
+      ),
+      confidence: spec.denyListConfidence ?? 1,
+      group: 0,
+    });
+  }
+  const context = spec.context?.length
+    ? new RegExp(
+        `(?<![\\p{L}\\p{N}])(?:${spec.context.map(escapePattern).join('|')})(?![\\p{L}\\p{N}])`,
+        'iu'
+      )
+    : undefined;
+  return Object.freeze({
+    type: spec.type,
+    category: spec.category ?? 'personal',
+    rule: spec.rule ?? 'custom-pattern',
+    confidence: spec.confidence ?? 0.6,
+    patterns,
+    context,
+    window: window(spec.contextWindow),
+    boost: spec.contextBoost ?? 0.35,
+    validate: spec.validate,
+  });
+}
+
+function scored(spec, base, text, start, end, value) {
+  let confidence = base;
+  if (
+    spec.context?.test(
+      `${text.slice(Math.max(0, start - spec.window.before), start)}\n${text.slice(end, end + spec.window.after)}`
+    )
+  ) {
+    // Presidio raises a context-supported score by 0.35 with a 0.4 floor;
+    // a negative boost models Google's "decrease likelihood" hotwords.
+    confidence =
+      spec.boost >= 0
+        ? Math.max(0.4, confidence + spec.boost)
+        : confidence + spec.boost;
+  }
+  if (spec.validate) {
+    const verdict = spec.validate(value);
+    if (verdict === false) {
+      return undefined;
+    }
+    if (typeof verdict === 'number' && score(verdict)) {
+      confidence = verdict;
+    }
+  }
+  return Math.min(1, Math.max(0, confidence));
+}
+
+function* matches(spec, text) {
+  for (const pattern of spec.patterns) {
+    pattern.regex.lastIndex = 0;
+    for (const match of text.matchAll(pattern.regex)) {
+      const value = match[pattern.group];
+      if (!value) {
+        continue;
+      }
+      const start = match.index + (pattern.group ? match[0].indexOf(value) : 0);
+      yield {
+        start,
+        end: start + value.length,
+        value,
+        base: pattern.confidence ?? spec.confidence,
+      };
+    }
+  }
+}
+
+/**
+ * Builds a synchronous Detector from declarative specs. Each spec matches
+ * `patterns` (RegExp, string sources or `{regex, confidence, group}`) and/or
+ * a whole-word `denyList`, raises or lowers confidence when a `context` word
+ * occurs within `contextWindow`, and lets `validate(value)` reject a match
+ * (false) or set its confidence (0–1). Patterns are trusted configuration:
+ * avoid catastrophic backtracking in caller-supplied expressions.
+ */
+export function createPatternDetector(specs, { id = 'pattern-rules' } = {}) {
+  const list = Array.isArray(specs) ? specs : [specs];
+  if (!list.length || list.length > maxPatterns) {
+    throw failure('ERR_CONFIG');
+  }
+  const compiled = list.map(compileSpec);
+  return {
+    id,
+    detect(text) {
+      const findings = [];
+      for (const spec of compiled) {
+        for (const { start, end, value, base } of matches(spec, text)) {
+          const confidence = scored(spec, base, text, start, end, value);
+          if (confidence !== undefined) {
+            findings.push({
+              start,
+              end,
+              type: spec.type,
+              category: spec.category,
+              rule: spec.rule,
+              confidence,
+            });
+          }
+        }
+      }
+      return findings;
+    },
+  };
+}

package/src/personal-context.js

@@ -6,8 +6,9 @@ export const months =
   'January February March April May June July August September October November December Jan Feb Mar Apr Jun Jul Aug Sep Sept Oct Nov Dec января февраля марта апреля мая июня июля августа сентября октября ноября декабря январь февраль март апрель май июнь июль август сентябрь октябрь ноябрь декабрь'
     .split(' ')
     .join('|');
+const ordinal = '(?:st|nd|rd|th)?';
 const dates = new RegExp(
-  `(?<![\\p{L}\\p{N}_])(?:\\d{4}-\\d{1,2}-\\d{1,2}|\\d{1,2}[/.]\\d{1,2}[/.]\\d{4}|\\d{1,2}[ \\t]+(?:${months})[ \\t]+\\d{4}|(?:${months})[ \\t]+\\d{1,2},?[ \\t]+\\d{4})(?![\\p{L}\\p{N}_])`,
+  `(?<![\\p{L}\\p{N}_])(?:\\d{4}-\\d{1,2}-\\d{1,2}|\\d{1,2}[/.-]\\d{1,2}[/.-]\\d{4}|\\d{1,2}${ordinal}[ \\t]+(?:of[ \\t]+)?(?:${months})\\.?,?[ \\t]+\\d{4}|(?:${months})\\.?[ \\t]+\\d{1,2}${ordinal},?[ \\t]+\\d{4})(?![\\p{L}\\p{N}_])`,
   'giu'
 );
 const phoneContext =
@@ -30,7 +31,7 @@ export function detectPersonalContext(text, emit) {
   );
   collectMatches(
     text,
-    /(?<![\p{L}\p{N}_])(?:phone|fax|ĐT|điện thoại)(?:[ \t]*[:：][ \t]*|[ \t]+)(\+?\(?\d[\d() .-]{5,38}\d)(?![\p{L}\p{N}_])/giu,
+    /(?<![\p{L}\p{N}_])(?:(?:phone|fax|ĐT|điện thoại)(?:[ \t]*[:：][ \t]*|[ \t]+)|(?:telephone|tel|mobile|mob|cell|desk|ph)\.?[ \t]*[:：][ \t]*)(\+?\(?\d[\d() .-]{5,38}\d)(?![\p{L}\p{N}_])/giu,
     emit,
     phone,
     1,

package/src/personal-evidence.js

@@ -0,0 +1,233 @@
+import { collectMatches } from './detection.js';
+import { credentialPlaceholder } from './credentials.js';
+
+// Phrase-level evidence collected from competitor test suites (#128):
+// self-introductions, letter salutations and sign-offs, mail display names,
+// spelled-out e-mail addresses, post-office boxes, labelled messenger
+// handles, username/password pairs and labelled card numbers.
+const personal = (type, rule, confidence = 0.85) => ({
+  type,
+  rule,
+  category: 'personal',
+  confidence,
+});
+const word = "\\p{Lu}[\\p{Ll}\\p{M}'’]+(?:\\p{Lu}[\\p{Ll}\\p{M}]+)?";
+const nameWords = `${word}(?:-${word})?(?:[ \\t]+(?:${word}(?:-${word})?|\\p{Lu}\\.)){0,2}`;
+// Addressees and senders that are roles, not people.
+const roleWord =
+  /^(?:Sir|Madam|Madame|Sirs|All|Everyone|Everybody|Team|Folks|Friends?|Colleagues?|Customer|Client|User|Users|Members?|Support|Admin|Team[ \t].*|Hiring[ \t]+Manager|Recruiter|There|Guys|Again|You|Me|Us|Them|God|Mom|Dad|Sorry|Thanks|Yes|No|Not|Here|Also|Just|Back|Done|OK|Okay|The|Our|Your|My|This|World)$/iu;
+const person = (value) =>
+  !roleWord.test(value) && !roleWord.test(value.split(/[ \t]+/)[0]);
+
+const dash = '(?:-{1,2}|—|–|\\.{2,3}|~)';
+function detectNames(text, emit) {
+  // "My name is Bond", "I'm called Jane Doe"
+  collectMatches(
+    text,
+    new RegExp(
+      `(?<![\\p{L}\\p{N}_])(?:[Mm]y[ \\t]+name[ \\t]+is|[Nn]ame's|I[ \\t]+am[ \\t]+called|[Cc]all[ \\t]+me)[ \\t]+(${nameWords})(?![\\p{L}\\p{M}])`,
+      'gu'
+    ),
+    emit,
+    personal('PERSON', 'self-introduction', 0.9),
+    1,
+    person
+  );
+  // "Dear Clifford," and "Hi Jane Doe," at the start of a line.
+  collectMatches(
+    text,
+    new RegExp(
+      `(?:^|(?<=[\\r\\n]))[ \\t]*(?:Dear|Hi|Hello|Hey|Greetings)[ \\t]+(${nameWords})[ \\t]*[,!:]`,
+      'gmu'
+    ),
+    emit,
+    personal('PERSON', 'salutation', 0.85),
+    1,
+    person
+  );
+  // "Thanks -Jon", "All the best,\n\n--Meg C.", "Thank you ..Risemamy McCrubben"
+  collectMatches(
+    text,
+    new RegExp(
+      `(?<![\\p{L}\\p{N}_])(?:Thanks|Thank[ \\t]+you|Many[ \\t]+thanks|Regards|Best[ \\t]+regards|Kind[ \\t]+regards|Warm[ \\t]+regards|Best[ \\t]+wishes|All[ \\t]+the[ \\t]+best|Cheers|Sincerely|Yours[ \\t]+(?:truly|sincerely)|Best)(?:[ \\t]*[,!.]?[ \\t]*(?:\\r?\\n[ \\t]*){1,3}${dash}?|[ \\t]*[,!.][ \\t]*${dash}?|[ \\t]*${dash})[ \\t]*(${nameWords})[ \\t]*\\.?[ \\t]*(?=\\r?\\n|$)`,
+      'gu'
+    ),
+    emit,
+    personal('PERSON', 'sign-off', 0.85),
+    1,
+    person
+  );
+  // Mail display names: `Bob Stone <bob.stone@example.com>`.
+  collectMatches(
+    text,
+    new RegExp(
+      `(?<![\\p{L}\\p{N}_])"?(${word}(?:[ \\t]+(?:${word}|\\p{Lu}\\.)){1,3})"?[ \\t]*<[^\\s<>@]+@[^\\s<>@]+>`,
+      'gu'
+    ),
+    emit,
+    personal('PERSON', 'mail-display-name', 0.9),
+    1,
+    person
+  );
+}
+
+const freemail =
+  'gmail|googlemail|yahoo|ymail|hotmail|outlook|live|msn|icloud|me|mac|aol|proton|protonmail|pm|gmx|mail|yandex|zoho|fastmail|hey|tutanota|qq|163|126|naver|web';
+const at =
+  '(?:[ \\t]*[[({<][ \\t]*at[ \\t]*[\\])}>][ \\t]*|[ \\t]+at[ \\t]+|@)';
+const dot =
+  '(?:[ \\t]*[[({<][ \\t]*dot[ \\t]*[\\])}>][ \\t]*|[ \\t]+dot[ \\t]+|\\.)';
+const obfuscatedEmail = new RegExp(
+  `(?<![\\p{L}\\p{N}_.+-])[\\p{L}\\p{N}_+-]+(?:${dot}[\\p{L}\\p{N}_+-]+)*${at}[\\p{L}\\p{N}-]+(?:${dot}[\\p{L}\\p{N}-]+)*${dot}\\p{L}{2,24}(?![\\p{L}\\p{N}_-])`,
+  'giu'
+);
+// Spelled-out separators are evidence; a plain " at " needs a well-known
+// mailbox provider so that "meet at example.com" stays prose.
+function spelledEmail(value) {
+  const bracketed = /[[({<][ \t]*(?:at|dot)[ \t]*[\])}>]/i.test(value);
+  const spelled = /[ \t]dot[ \t]/i.test(value);
+  const plainAt = new RegExp(
+    `[ \\t]at[ \\t]+(?:${freemail})\\.[a-z]{2,6}(?:\\.[a-z]{2})?$`,
+    'i'
+  ).test(value);
+  return (
+    !/^[^@]+@[^@\s[({<]+$/.test(value) && (bracketed || spelled || plainAt)
+  );
+}
+
+function detectContactForms(text, emit) {
+  collectMatches(
+    text,
+    obfuscatedEmail,
+    emit,
+    personal('EMAIL', 'obfuscated-email', 0.85),
+    0,
+    spelledEmail
+  );
+  collectMatches(
+    text,
+    /(?<![\p{L}\p{N}_])(?:P\.?[ \t]?O\.?[ \t]?Box|Post[ \t]+Office[ \t]+Box|Postfach|Apartado(?:[ \t]+de[ \t]+correos)?|Caixa[ \t]+Postal|Boîte[ \t]+postale|а\/я|абонентский[ \t]+ящик)[ \t]*(?:#[ \t]*)?\d{1,10}(?!\p{N})/giu,
+    emit,
+    personal('ADDRESS', 'po-box')
+  );
+  // `skype: dean.malmgren`, `contact me on skype (dean.malmgren)`.
+  collectMatches(
+    text,
+    /(?<![\p{L}\p{N}_])(?:skype|discord|telegram|signal|wechat|whatsapp|keybase|matrix|mastodon|twitter|github|gitlab|instagram|tiktok)(?:[ \t]+(?:id|name|handle|username|user))?[ \t]*(?:[:=][ \t]*|\([ \t]*)(@?[\p{L}\p{N}_][\p{L}\p{N}_.:-]{1,63}[\p{L}\p{N}_])(?=[ \t]*\)|[\s,;!?]|\.(?:\s|$)|$)/giu,
+    emit,
+    personal('USERNAME', 'messenger-label', 0.85),
+    1
+  );
+}
+
+// "login snoop pw biggreenhat", "u: snoop\np: biggreenhat",
+// "user: thislibrary\npass: …": a username label followed by a password
+// label marks both values; a lone `user:` is a chat role, not an account.
+// Labels with a colon may be short (`u:`/`p:`); bare labels must be the
+// unambiguous `login`/`username` and `pw`/`pwd`/`password` words.
+const pairSeparator = '[ \\t]*[,;]?[ \\t]*(?:\\r?\\n[ \\t]*)?';
+const credentialPair = new RegExp(
+  [
+    `(?:login|user(?:name)?|u)[ \\t]*[:=][ \\t]*([^\\s:=,;]{2,64})${pairSeparator}(?:pass(?:word)?|passwd|pwd|pw|p)[ \\t]*[:=][ \\t]*(\\S{4,128})`,
+    `(?:login|username)[ \\t]+([^\\s:=,;]{2,64})${pairSeparator}(?:password|passwd|pwd|pw)[ \\t]+(\\S{4,128})`,
+  ]
+    .map((form) => `(?<![\\p{L}\\p{N}_])${form}`)
+    .join('|'),
+  'giu'
+);
+const placeholder = /^\[[\p{L}\p{N}_ -]+\]$/u;
+function detectCredentialPairs(text, emit) {
+  for (const match of text.matchAll(credentialPair)) {
+    const user = match[1] ?? match[3];
+    const secret = match[2] ?? match[4];
+    if (
+      placeholder.test(user) ||
+      placeholder.test(secret) ||
+      credentialPlaceholder(secret)
+    ) {
+      continue;
+    }
+    const userStart = match.index + match[0].indexOf(user);
+    const secretStart = match.index + match[0].lastIndexOf(secret);
+    emit({
+      start: userStart,
+      end: userStart + user.length,
+      ...personal('USERNAME', 'credential-pair', 0.9),
+    });
+    emit({
+      start: secretStart,
+      end: secretStart + secret.length,
+      type: 'SECRET',
+      category: 'credential',
+      rule: 'credential-pair',
+      confidence: 0.9,
+    });
+  }
+}
+
+// "my AMEX card: 1234 567890 12345": a labelled card keeps its label even when
+// the number is a documentation placeholder that fails Luhn.
+function detectLabelledCards(text, emit) {
+  collectMatches(
+    text,
+    /(?<![\p{L}\p{N}_])(?:card|visa|mastercard|amex|discover|diners|jcb|unionpay|maestro|карта)(?:[ \t]+(?:no\.?|number|num|#))?[ \t]*(?:[:#][ \t]*)?((?:\d[ -]?){12,18}\d)(?![\p{N}]|[ -]\d)/giu,
+    emit,
+    personal('CREDIT_CARD', 'card-context', 0.9),
+    1
+  );
+}
+
+// "SSN 030 72 7381", "social security number: 003 06-8815": the label
+// carries spaced and mixed separators that the bare dashed form omits.
+function detectLabelledSsn(text, emit) {
+  collectMatches(
+    text,
+    /(?<![\p{L}\p{N}_])(?:SSN|SS#|social[ \t]+security(?:[ \t]+(?:number|no\.?|#))?)[ \t]*(?:(?:[:#]|is)[ \t]*)?(\d{3}[ .-]?\d{2}[ .-]?\d{4})(?![\p{N}]|[ .-]\d)/giu,
+    emit,
+    personal('SSN', 'ssn-label', 0.9),
+    1,
+    (value) => !/^(?:000|666|9\d\d)|^\d{3}\D?00|0000$/.test(value)
+  );
+}
+
+const states =
+  'AL|AK|AZ|AR|CA|CO|CT|DE|DC|FL|GA|HI|ID|IL|IN|IA|KS|KY|LA|ME|MD|MA|MI|MN|MS|MO|MT|NE|NV|NH|NJ|NM|NY|NC|ND|OH|OK|OR|PA|RI|SC|SD|TN|TX|UT|VT|VA|WA|WV|WI|WY|PR';
+function detectPostalCodes(text, emit) {
+  // "ZIP 94105", "ZIPs 10001 and 30301", "zip code: 94105-1234".
+  for (const label of text.matchAll(
+    /(?<![\p{L}\p{N}_])(?:ZIP(?:[ \t]?codes?)?s?|postal[ \t]+codes?|PLZ|CEP)[ \t]*(?:[:#][ \t]*)?/giu
+  )) {
+    const start = label.index + label[0].length;
+    const list =
+      /^\d{5}(?:-\d{4})?(?:(?:[ \t]*,[ \t]*|[ \t]+(?:and|or|&)[ \t]+)\d{5}(?:-\d{4})?)*(?![\p{L}\p{N}_-])/u.exec(
+        text.slice(start, start + 200)
+      );
+    for (const code of list?.[0].matchAll(/\d{5}(?:-\d{4})?/g) ?? []) {
+      emit({
+        start: start + code.index,
+        end: start + code.index + code[0].length,
+        ...personal('POSTAL_CODE', 'postal-label', 0.9),
+      });
+    }
+  }
+  // "New York City, NY 10002": a state abbreviation anchors the ZIP code.
+  collectMatches(
+    text,
+    new RegExp(
+      `(?<=[\\p{L}.],)[ \\t]*(?:${states})[ \\t]+(\\d{5}(?:-\\d{4})?)(?![\\p{L}\\p{N}_-])`,
+      'gu'
+    ),
+    emit,
+    personal('POSTAL_CODE', 'state-zip', 0.85),
+    1
+  );
+}
+
+export function detectPersonalEvidence(text, emit) {
+  detectNames(text, emit);
+  detectContactForms(text, emit);
+  detectCredentialPairs(text, emit);
+  detectLabelledCards(text, emit);
+  detectLabelledSsn(text, emit);
+  detectPostalCodes(text, emit);
+}

package/src/personal-features.js

@@ -0,0 +1,39 @@
+// Registers the personal-data detectors and fake generators. The main entry
+// imports this module for its side effect; the `./credentials` entry does not,
+// which keeps faker, libphonenumber and these detectors out of its start-up.
+import { registerFeatures } from './features.js';
+import { detectPersonal } from './personal.js';
+import { detectCatalog } from './entities.js';
+import { detectIdentity, fakeIdentityValue } from './identity.js';
+import { detectNational } from './national.js';
+import { detectPersonalContext } from './personal-context.js';
+import { detectPersonalEvidence } from './personal-evidence.js';
+import { detectDocumentEntities } from './document-entities.js';
+import {
+  detectProseAndDocuments,
+  validateProperNames,
+} from './proper-names.js';
+import { detectStrict } from './strict.js';
+import { realisticFake } from './fake.js';
+import { prepareFakeText } from './fake-entities.js';
+import { fakeDocumentSpans } from './specimens.js';
+
+function detectPersonalData(text, emit, options) {
+  detectPersonal(text, emit);
+  detectProseAndDocuments(text, emit, options, detectDocumentEntities);
+  detectCatalog(text, emit);
+  detectIdentity(text, emit);
+  detectNational(text, emit);
+  detectPersonalContext(text, emit);
+  detectPersonalEvidence(text, emit);
+  detectStrict(text, emit, options);
+}
+
+registerFeatures({
+  detectPersonalData,
+  validateProperNames,
+  realisticFake,
+  prepareFakeText,
+  fakeDocumentSpans,
+  fakeIdentityValue,
+});

package/src/personal.js

@@ -3,6 +3,7 @@ import { firstNames } from './names.js';
 import { labels } from './rules.js';
 import { transliteratedGivenNames } from './transliteration.js';
 import { serviceAccounts } from './public.js';
+import { isCommonProseWord } from './prose-words.js';
 const labelWords = new Set(Object.values(labels).flat());
 
 const details = (type, rule, confidence = 0.85) => ({
@@ -11,6 +12,12 @@ const details = (type, rule, confidence = 0.85) => ({
   category: 'personal',
   confidence,
 });
+// "John C Smith", "John A. Smith": a Latin-script middle initial. A bare "I"
+// is the pronoun ("Will I Go"), so it needs its period.
+const initial = (language) =>
+  ['ar', 'he', 'hi', 'th', 'ja', 'zh', 'ko'].includes(language)
+    ? ''
+    : '(?:[ \\t]+(?:\\p{Lu}\\.|(?!I[ \\t])\\p{Lu}(?=[ \\t])))?';
 const names = Object.entries(firstNames).map(([language, list]) => {
   const words = list.split(' ').map(escapePattern).join('|');
   const surname = ['ar', 'he', 'hi', 'th'].includes(language)
@@ -18,7 +25,7 @@ const names = Object.entries(firstNames).map(([language, list]) => {
     : "[\\p{Lu}][\\p{L}\\p{M}’'-]{1,32}";
   const pattern = ['ja', 'zh', 'ko'].includes(language)
     ? `(?:${words})[\\p{Script=Han}\\p{Script=Hiragana}\\p{Script=Katakana}\\p{Script=Hangul}]{1,4}`
-    : `(?:${words})[ \\t]+${surname}${language === 'vi' ? `(?:[ \\t]+${surname})?` : ''}`;
+    : `(?:${words})${initial(language)}[ \\t]+${surname}${language === 'vi' ? `(?:[ \\t]+${surname})?` : ''}`;
   return new RegExp(`(?<![\\p{L}\\p{M}])${pattern}(?![\\p{L}\\p{M}])`, 'gu');
 });
 
@@ -33,7 +40,7 @@ const ibanLengths = Object.fromEntries(
 const mentionedEmail =
   /^\/[\p{L}\p{N}_.!#$%&'*+?^`{|}~-]+@[\p{L}\p{N}][\p{L}\p{N}.-]{0,252}\.\p{L}{2,63}(?![\p{L}\p{N}_-])/u;
 export function iban(value) {
-  const compact = value.replace(/\s/g, '').toUpperCase();
+  const compact = value.replace(/[\s-]/g, '').toUpperCase();
   if (
     !/^[A-Z]{2}\d{2}[A-Z0-9]+$/.test(compact) ||
     compact.length !== ibanLengths[compact.slice(0, 2)]
@@ -53,7 +60,7 @@ export function iban(value) {
 
 function detectIban(text, emit) {
   for (const match of text.matchAll(
-    /(?<![A-Z0-9])[A-Z]{2}\d{2}(?:[ ]?[A-Z0-9]){8,40}/g
+    /(?<![A-Z0-9])[A-Z]{2} ?\d{2}(?:[ -]?[A-Z0-9]){8,40}/g
   )) {
     const needed = ibanLengths[match[0].slice(0, 2)];
     if (!needed) {
@@ -62,7 +69,7 @@ function detectIban(text, emit) {
     let end = 0,
       count = 0;
     while (end < match[0].length && count < needed) {
-      if (match[0][end] !== ' ') {
+      if (!/[ -]/.test(match[0][end])) {
         count++;
       }
       end++;
@@ -180,11 +187,46 @@ function detectDocumentNames(text, emit) {
 }
 const russianFull =
   /(?<![\p{L}])(?:[А-ЯЁ][а-яё]{2,30}[ \t]+){2}[А-ЯЁ][а-яё]{2,30}(?:вич|вна|ична)|(?<![\p{L}])(?:[А-ЯЁ][а-яё]{2,30}[ \t]+){2}(?:оглы|кызы)(?![\p{L}])/gu;
+// "My ITIN", "Our BIN": a possessive word or a short all-capital acronym
+// matches the Slavic surname shape but carries no name evidence.
+const possessiveWord =
+  /^(?:my|our|your|his|her|their|its|the|this|that|мой|моя|наш|наша|ваш|ваша)$/iu;
+function slavicPairEvidence(value) {
+  const words = value.split(/[ \t]+/);
+  return !words.some(
+    (word) =>
+      possessiveWord.test(word) ||
+      /^\p{Lu}{2,4}$/u.test(word) ||
+      isCommonProseWord(word)
+  );
+}
+// A rejected pair is retried from its second word, so `Кандидат Петров Иван`
+// still finds `Петров Иван` after the cue word.
+function detectSlavicPairs(text, emit) {
+  const pattern = new RegExp(slavicPairs.source, 'gu');
+  let match;
+  while ((match = pattern.exec(text))) {
+    const value = match[0];
+    if (
+      value !== 'REDACTED' &&
+      !placeWord.test(value.split(/[ \t]+/).at(-1)) &&
+      slavicPairEvidence(value)
+    ) {
+      emit({
+        start: match.index,
+        end: match.index + value.length,
+        ...details('PERSON', 'name-identity', 0.9),
+      });
+    } else {
+      pattern.lastIndex = match.index + value.search(/[ \t]/u) + 1;
+    }
+  }
+}
 export function detectPersonal(text, emit) {
   detectDocumentNames(text, emit);
+  detectSlavicPairs(text, emit);
   for (const pattern of [
     latinPairs,
-    slavicPairs,
     russianFull,
     /(?<![\p{L}])(?:[А-ЯЁ][а-яё]{2,30}[ \t]+)[А-ЯЁ][а-яё]{2,30}(?:вич|вна|ична)[ \t]+[А-ЯЁ][а-яё]{2,30}(?![\p{L}])/gu,
   ]) {
@@ -218,21 +260,35 @@ export function detectPersonal(text, emit) {
   );
   collectMatches(
     text,
-    /(?<![\d(])(?:[78][ -]?)?\(\d{3}\)[ -]?\d{3}[ -]\d{2}[ -]?\d{2}(?!\d)|(?<!\d)(?:\d{3}[.-]){2}\d{4}(?!\d)/g,
+    /(?<![\d(])(?:[78][ -]?)?\(\d{3}\)[ -]?\d{3}[ -]\d{2}[ -]?\d{2}(?!\d)|(?<![\d-])(?:(?<![\p{L}_.])1[.-])?(?:\d{3}[.-]){2}\d{4}(?!\d|-[\p{L}\p{N}])/gu,
     emit,
     details('PHONE', 'national-phone')
   );
   collectMatches(
     text,
-    /(?<![\p{L}\p{N}])\d{1,6}[A-Za-z]?[ \t]+(?:[\p{Lu}][\p{L}.'-]*[ \t]+){1,5}(?:Street|St|Road|Rd|Avenue|Ave|Lane|Ln|Drive|Dr|Boulevard|Blvd|Way|Straße|Strasse|Rue|Calle|Rua)\b(?:,[ \t]+(?:(?:[^ \t\r\n<>][^\r\n<>]{0,79}?[ \t]+)?(?:[A-Z]{1,2}\d[A-Z\d]?[ \t]+\d[A-Z]{2}|\d{5}(?:-\d{4})?)\b|(?:[\p{Lu}][\p{Ll}.'-]+[ \t]*){1,4}))?/gu,
+    /(?<![\p{L}\p{N}])\d{1,6}[A-Za-z]?[ \t]+(?:[\p{Lu}][\p{L}.'-]*[ \t]+){1,5}(?:Street|St|Road|Rd|Avenue|Ave|Lane|Ln|Drive|Dr|Boulevard|Blvd|Way|Terrace|Court|Ct|Place|Pl|Parkway|Pkwy|Circle|Highway|Hwy|Square|Crescent|Close|Straße|Strasse|Rue|Calle|Rua)\b(?:,?[ \t]+(?:Apt|Apartment|Suite|Ste|Unit|Floor|Fl|Room|Rm)\.?[ \t]*#?[A-Za-z0-9-]{1,6}\b|[ \t]+#[A-Za-z0-9-]{1,6}\b)?(?:,[ \t]+(?:(?:[^ \t\r\n<>][^\r\n<>]{0,79}?[ \t]+)?(?:[A-Z]{1,2}\d[A-Z\d]?[ \t]+\d[A-Z]{2}|\d{5}(?:-\d{4})?)\b|(?:[\p{Lu}][\p{Ll}.'-]+[ \t]*){1,4}))?/gu,
     emit,
     details('ADDRESS', 'postal-address')
   );
+  // "Mr. O'Brien", "Dr Jane Smith": a courtesy title is name evidence;
+  // after a number, "30 Ms Retry" is a millisecond unit.
+  collectMatches(
+    text,
+    /(?<![\p{L}\p{N}_])(?:Mr|Mrs|Ms|Mx|Miss|Dr|Prof)(?<!\p{N}[ \t]*\p{L}+)\.?[ \t]+(\p{Lu}(?:['’]\p{Lu})?[\p{Ll}\p{M}]+(?:-\p{Lu}[\p{Ll}\p{M}]+)?(?:[ \t]+\p{Lu}(?:['’]\p{Lu})?[\p{Ll}\p{M}]+(?:-\p{Lu}[\p{Ll}\p{M}]+)?)?)(?![\p{L}\p{M}])/gu,
+    emit,
+    details('PERSON', 'honorific-name'),
+    1,
+    (value) => !placeWord.test(value.split(/[ \t]+/).at(-1))
+  );
   collectMatches(
     text,
-    /(?<![\da-fA-F:.-])(?:[\da-fA-F]{2}[:-]){5}[\da-fA-F]{2}(?![\da-fA-F:.-])/g,
+    // Colon, dash or Cisco dotted notation with one separator; the broadcast
+    // and all-zero addresses identify no device.
+    /(?<![\da-fA-F:.-])(?:[\da-fA-F]{2}([:-])(?:[\da-fA-F]{2}\1){4}[\da-fA-F]{2}|[\da-fA-F]{4}\.[\da-fA-F]{4}\.[\da-fA-F]{4})(?![\da-fA-F:-]|\.[\da-fA-F])/g,
     emit,
-    details('MAC_ADDRESS', 'mac')
+    details('MAC_ADDRESS', 'mac'),
+    0,
+    (value) => !/^(?:[fF]{2}[:.-]?|0{2}[:.-]?)+$/.test(value.replace(/\./g, ''))
   );
   collectMatches(
     text,
@@ -249,7 +305,7 @@ export function detectPersonal(text, emit) {
   );
   collectMatches(
     text,
-    /(?:\/Users\/|\/home\/|[A-Za-z]:\\Users\\)([^/\\\s"'<>[\]]+)/g,
+    /(?:\/Users\/|\/home\/|[A-Za-z]:\\(?:Users|Documents and Settings|(?:Windows|WINNT)\\Profiles)\\)([^/\\\s"'<>[\]]+)/g,
     emit,
     details('USERNAME', 'home-path', 0.95),
     1,