euredact 0.1.0 → 0.2.0

package/README.md

@@ -1,8 +1,13 @@
 # euredact
 
-Fast, zero-dependency European PII detection and redaction for Node.js.
+**European PII detection and redaction for Node.js / TypeScript**
 
-Detects and redacts personal data across **31 European countries** using rule-based pattern matching with checksum validation and context-aware false-positive suppression.
+---
+
+Fast, zero-dependency European PII detection and redaction SDK. Detects and
+redacts personal data across **31 European countries** using rule-based pattern
+matching with checksum validation, context-aware false-positive suppression,
+and priority-based deduplication.
 
 ## Install
 
@@ -26,64 +31,304 @@ console.log(result.detections);
 // [{ entityType: "NATIONAL_ID", text: "123456782", start: 12, end: 21, ... }, ...]
 ```
 
-## API
+## Features
+
+- **31 European countries** with country-specific patterns
+- **25+ PII entity types:** national IDs, IBANs, phone numbers, email, VAT
+  numbers, license plates, credit cards, BIC/SWIFT, VIN, IMEI, GPS coordinates,
+  UUIDs, social handles, IP/IPv6, MAC addresses, secrets/API keys, and more
+- **Secret/API key detection:** known-prefix patterns for AWS, GitHub, Stripe,
+  OpenAI, Slack, JWT, SendGrid, plus Shannon entropy-based detection for generic
+  high-entropy tokens near context keywords
+- **Custom patterns:** register your own regex patterns for domain-specific PII
+- **Checksum validation:** IBAN mod-97, Luhn (credit cards/IMEI), and 30+
+  country-specific validators
+- **Priority-aware deduplication:** validated (checksum) > custom > regex-only
+- **Context-aware:** keyword proximity checks and structural detection (JSON field
+  names, CSV headers) for ambiguous patterns
+- **Zero runtime dependencies**
+- **ESM and CommonJS** dual-published
+
+### Supported Countries
 
-### `redact(text, options?)`
+| Region | Countries |
+|---|---|
+| Western Europe | AT, BE, CH, DE, FR, LU, NL |
+| Southern Europe | CY, EL, ES, IT, MT, PT |
+| Northern Europe | DK, EE, FI, IS, LT, LV, NO, SE |
+| Eastern Europe | BG, CZ, HR, HU, PL, RO, SI, SK |
+| British Isles | IE, UK |
 
-Returns a `RedactResult` with the redacted text and a list of detections.
+## API Reference
+
+### Module-Level Functions
+
+#### `redact(text, options?)`
+
+```ts
+function redact(text: string, options?: RedactOptions): RedactResult;
+```
+
+Main entry point. Detects and redacts PII in the given text.
 
 ```ts
 interface RedactOptions {
-  countries?: string[];    // Country codes (e.g. ["NL", "BE"]) — recommended for best precision
-  pseudonymize?: boolean;  // Replace with consistent pseudonyms (EMAIL_1, EMAIL_2, ...)
-  detectDates?: boolean;   // Include DOB/date-of-death detections (off by default)
-  cache?: boolean;         // Enable result caching (default: true)
+  countries?: string[] | null; // Country codes (e.g. ["NL", "BE"]) — null loads all
+  referentialIntegrity?: boolean;      // Replace with consistent labels (default: false)
+  detectDates?: boolean;       // Include DOB/date-of-death detections (default: false)
+  cache?: boolean;             // Enable result caching (default: true)
 }
 ```
 
-### `redactBatch(texts, options?)`
+| Parameter | Default | Description |
+|---|---|---|
+| `countries` | `null` | ISO 3166-1 alpha-2 codes to restrict detection. `null` loads all 31 countries. |
+| `referentialIntegrity` | `false` | Replace PII with consistent labels instead of entity-type labels. |
+| `detectDates` | `false` | Include date-of-birth and date-of-death detections. Off by default. |
+| `cache` | `true` | Cache results for identical inputs. |
+
+#### `redactBatch(texts, options?)`
+
+```ts
+function redactBatch(texts: string[], options?: RedactOptions): RedactResult[];
+```
+
+Process multiple texts efficiently. Loads country configs once. Returns results
+in the same order as the input.
 
-Process multiple texts efficiently. Loads country configs once.
+#### `addCustomPattern(name, pattern)`
 
-### `availableCountries()`
+```ts
+function addCustomPattern(name: string, pattern: string): void;
+```
 
-Returns the list of supported country codes.
+Register a custom regex pattern. Matches are reported with `name` as the entity
+type. See [Custom Patterns](#custom-patterns) below.
 
-## Supported Countries
+#### `availableCountries()`
 
-AT, BE, BG, CH, CY, CZ, DE, DK, EE, EL, ES, FI, FR, HR, HU, IE, IS, IT, LT, LU, LV, MT, NL, NO, PL, PT, RO, SE, SI, SK, UK
+```ts
+function availableCountries(): string[];
+```
 
-## Detected PII Types
+Returns a sorted list of supported ISO country codes.
 
-| Category | Examples |
-|----------|---------|
-| `NATIONAL_ID` | BSN, Personalausweis, NIR, CPR, personnummer, ... |
-| `IBAN` | Country-specific IBAN with ISO 13616 checksum |
-| `PHONE` | National and international formats per country |
-| `EMAIL` | RFC 5322 simplified |
-| `POSTAL_CODE` | Country-specific formats with context validation |
-| `TAX_ID` | Steuer-ID, NIF, NIP, ... with checksums |
-| `CREDIT_CARD` | Visa, Mastercard, Amex with Luhn check |
-| `LICENSE_PLATE` | Country-specific formats |
-| `PASSPORT` | Context-required per country |
-| `VAT` | EU VAT numbers |
-| `BIC` | SWIFT/BIC codes |
-| `VIN` | ISO 3779 vehicle identification |
-| `IP_ADDRESS` | IPv4 and IPv6 |
-| `MAC_ADDRESS` | Colon, dash, and Cisco dot notation |
-| `UUID` | RFC 4122 versions 1-5 |
-| `IMEI` | 15-digit with Luhn check |
-| `GPS_COORDINATES` | Decimal degrees with 4+ decimal places |
-| `SOCIAL_HANDLE` | @username format |
-| `DOB` | Date of birth (context-required, opt-in) |
+### Instance-Based API (`EuRedact` Class)
 
-## Performance
+For applications that need isolated instances with separate caches and custom
+pattern registrations:
 
-- **0.02ms** per redaction (typical text)
-- **Zero runtime dependencies**
-- **86KB** total package size
-- Checksum validators eliminate false positives at the pattern level
-- Context-aware suppressors filter currency amounts, units, references, and legal citations
+```ts
+import { EuRedact } from "euredact";
+
+const instance = new EuRedact();
+instance.addCustomPattern("CASE_REF", "CASE-\\d{8}");
+
+const result = instance.redact("See CASE-20260401 for details", {
+  countries: ["NL", "BE"],
+});
+console.log(result.redactedText);
+// "See [CASE_REF] for details"
+```
+
+The `EuRedact` class exposes: `redact()`, `redactBatch()`, and
+`addCustomPattern()`.
+
+### Return Types
+
+#### `RedactResult`
+
+```ts
+interface RedactResult {
+  redactedText: string;       // The input text with PII replaced
+  detections: Detection[];    // All PII spans found
+  source: string;             // Detection backend ("rules")
+  degraded: boolean;          // True if the engine fell back to a simpler mode
+}
+```
+
+#### `Detection`
+
+```ts
+interface Detection {
+  entityType: EntityType | string; // PII category (enum or custom name)
+  start: number;                   // Start offset in the original text
+  end: number;                     // End offset (exclusive)
+  text: string;                    // The matched substring
+  source: DetectionSource;         // "rules" or "cloud"
+  country: string | null;          // ISO code or null for shared/custom patterns
+  confidence: string;              // Confidence level
+}
+```
+
+#### `EntityType`
+
+String enum with all supported PII categories:
+
+```
+NAME              ADDRESS           IBAN              BIC
+CREDIT_CARD       PHONE             EMAIL             DOB
+DATE_OF_DEATH     NATIONAL_ID       SSN               TAX_ID
+PASSPORT          DRIVERS_LICENSE   RESIDENCE_PERMIT  LICENSE_PLATE
+VIN               VAT               POSTAL_CODE       IP_ADDRESS
+IPV6_ADDRESS      MAC_ADDRESS       HEALTH_INSURANCE  HEALTHCARE_PROVIDER
+CHAMBER_OF_COMMERCE  IMEI          GPS_COORDINATES   UUID
+SOCIAL_HANDLE     SECRET            OTHER
+```
+
+For custom patterns, `entityType` is a plain string (e.g. `"EMPLOYEE_ID"`).
+
+## Custom Patterns
+
+Register domain-specific PII patterns at runtime:
+
+```ts
+import { addCustomPattern, redact } from "euredact";
+
+// Register patterns
+addCustomPattern("EMPLOYEE_ID", "EMP-\\d{6}");
+addCustomPattern("CASE_REF", "CASE-\\d{8}");
+
+// They are detected alongside built-in PII
+const result = redact(
+  "Employee EMP-123456, email jan@example.com, ref CASE-20260401"
+);
+console.log(result.redactedText);
+// "Employee [EMPLOYEE_ID], email [EMAIL], ref [CASE_REF]"
+```
+
+### How Custom Patterns Work
+
+- `name` becomes the entity type in detections and replacement tags
+- `pattern` is a JavaScript regular expression (same syntax as `RegExp`)
+- Custom patterns are always active regardless of the `countries` option
+- In overlap resolution, custom patterns have higher priority than built-in
+  regex-only patterns but lower priority than built-in patterns with a passing
+  checksum validator
+
+### Instance Isolation
+
+Custom patterns registered on the module-level function apply to the shared
+singleton. For isolated registrations, use separate `EuRedact` instances:
+
+```ts
+import { EuRedact } from "euredact";
+
+const a = new EuRedact();
+a.addCustomPattern("EMPLOYEE_ID", "EMP-\\d{6}");
+
+const b = new EuRedact();
+b.addCustomPattern("CASE_REF", "CASE-\\d{8}");
+```
+
+## Secret and API Key Detection
+
+Built-in detection for API keys, tokens, and passwords. Always active -- no
+configuration required.
+
+### Known-Prefix Patterns
+
+| Pattern | Description |
+|---|---|
+| `AKIA...` | AWS Access Key ID |
+| `ghp_`, `gho_`, `ghs_`, `github_pat_` | GitHub tokens (PAT, OAuth, app, server) |
+| `sk_live_`, `pk_live_`, `sk_test_`, `pk_test_` | Stripe secret and publishable keys |
+| `sk-`, `sk-ant-` | OpenAI and Anthropic API keys |
+| `xoxb-`, `xoxp-`, `xoxa-`, `xoxs-` | Slack tokens |
+| `eyJ...` (3-part base64url) | JWT tokens |
+| `SG.` | SendGrid API keys |
+
+```ts
+const result = redact("My API key is sk-proj-abc123def456ghi789jkl0");
+console.log(result.redactedText);
+// "My API key is [SECRET]"
+```
+
+### Entropy-Based Detection
+
+High-entropy strings (32+ alphanumeric characters) near context keywords like
+`key`, `token`, `secret`, `password`, `credential`, `auth`, or `bearer`
+(including 12 European language translations) are flagged via Shannon entropy
+analysis:
+
+```ts
+redact("The api_key is xK9mPqR7vLnW2bFjY8cGhT4sDfAeU6iO").redactedText;
+// "The api_key is [SECRET]"
+
+// Without a context keyword -- not flagged:
+redact("identifier: xK9mPqR7vLnW2bFjY8cGhT4sDfAeU6iO").redactedText;
+// "identifier: xK9mPqR7vLnW2bFjY8cGhT4sDfAeU6iO"
+```
+
+## Country Hints
+
+When you know which countries appear in your data, pass them explicitly:
+
+```ts
+const result = redact(text, { countries: ["NL", "BE"] });
+```
+
+This restricts pattern matching to Dutch and Belgian rules (plus shared patterns
+and custom patterns). Benefits:
+
+- **Fewer false positives.** A 9-digit number that passes the Dutch BSN checksum
+  won't also be tested against unrelated country patterns.
+- **Faster.** Fewer patterns to compile and scan.
+
+## Referential Integrity
+
+When `referentialIntegrity: true`, each unique PII value is mapped to a consistent
+label:
+
+```ts
+const result = redact(
+  "BSN 123456782 en later weer 123456782",
+  { countries: ["NL"], referentialIntegrity: true }
+);
+console.log(result.redactedText);
+// "BSN NATIONAL_ID_1 en later weer NATIONAL_ID_1"
+```
+
+## Architecture
+
+```
+Input text
+    |
+    v
+[Normalizer] -- Unicode normalization, whitespace cleanup
+    |
+    v
+[Pass 1: Pattern Matching] -- All country + shared + custom regexes
+    |
+    v
+[Pass 2a: Validation] -- Checksum validators (mod-97, Luhn, entropy, ...)
+    |                     Failed-validation spans become suppression zones
+    v
+[Pass 2b: Suppression] -- Remove false positives (currency amounts, units,
+    |                      references, overlapping matches in suppression zones)
+    v
+[Deduplication] -- Priority-aware: validated > custom > regex-only
+    |               Within same tier, longer span wins
+    v
+[Replacement] -- Right-to-left substitution with [ENTITY_TYPE] labels
+    |              or labels
+    v
+RedactResult
+```
+
+### Suppression Zones
+
+When a regex matches a pattern that has a checksum validator but the checksum
+fails, the matched span becomes a "suppression zone." Any purely regex-based
+detection fully contained within that zone is suppressed as a false positive.
+
+### Deduplication Priority
+
+1. **Validated patterns** (checksum passes) -- highest priority
+2. **Custom patterns** (registered via `addCustomPattern()`)
+3. **Regex-only patterns** (no validator) -- lowest priority
+
+Within the same tier, the longer span wins.
 
 ## CommonJS
 
@@ -91,6 +336,14 @@ AT, BE, BG, CH, CY, CZ, DE, DK, EE, EL, ES, FI, FR, HR, HU, IE, IS, IT, LT, LU,
 const { redact } = require("euredact");
 ```
 
+## Performance
+
+| Metric | Value |
+|---|---|
+| Latency per redaction | ~0.02 ms |
+| Package size | ~86 KB |
+| Runtime dependencies | 0 |
+
 ## License
 
 Apache-2.0

package/dist/cjs/index.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.COUNTRY_CONFIGS = exports.EuRedact = exports.DetectionSource = exports.EntityType = void 0;
 exports.availableCountries = availableCountries;
 exports.redact = redact;
+exports.addCustomPattern = addCustomPattern;
 exports.redactBatch = redactBatch;
 var types_js_1 = require("./types.js");
 Object.defineProperty(exports, "EntityType", { enumerable: true, get: function () { return types_js_1.EntityType; } });
@@ -25,6 +26,9 @@ function availableCountries() {
 function redact(text, options) {
     return getInstance().redact(text, options);
 }
+function addCustomPattern(name, pattern) {
+    getInstance().addCustomPattern(name, pattern);
+}
 function redactBatch(texts, options) {
     return getInstance().redactBatch(texts, options);
 }

package/dist/cjs/rules/countries/index.js

@@ -49,6 +49,56 @@ const SHARED = {
         p(types_js_1.EntityType.GPS_COORDINATES, String.raw `-?(?:[1-8]?\d(?:\.\d{4,})|90(?:\.0{4,}))\s*[,;/]\s*-?(?:1[0-7]\d(?:\.\d{4,})|180(?:\.0{4,})|\d{1,2}(?:\.\d{4,}))`),
         p(types_js_1.EntityType.UUID, String.raw `\b[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}\b`),
         p(types_js_1.EntityType.SOCIAL_HANDLE, String.raw `(?<!\w)@[a-zA-Z][a-zA-Z0-9_.]{1,29}\b`),
+        // --- Secret / API Key (known prefixes — always active) ---
+        p(types_js_1.EntityType.SECRET, String.raw `\bAKIA[A-Z0-9]{16}\b`, null, "AWS Access Key ID"),
+        p(types_js_1.EntityType.SECRET, String.raw `\bgh[poas]_[a-zA-Z0-9]{36,}\b`, null, "GitHub token"),
+        p(types_js_1.EntityType.SECRET, String.raw `\bgithub_pat_[a-zA-Z0-9_]{22,}\b`, null, "GitHub fine-grained PAT"),
+        p(types_js_1.EntityType.SECRET, String.raw `\bgl[a-z]t-[a-zA-Z0-9_\-]{20,}\b`, null, "GitLab token"),
+        p(types_js_1.EntityType.SECRET, String.raw `\bglpat-[a-zA-Z0-9_\-]{20,}\b`, null, "GitLab PAT"),
+        p(types_js_1.EntityType.SECRET, String.raw `\b[sp]k_(?:live|test)_[a-zA-Z0-9]{24,}\b`, null, "Stripe key"),
+        p(types_js_1.EntityType.SECRET, String.raw `\bsk-(?:ant-)?[a-zA-Z0-9\-_]{20,}\b`, null, "OpenAI/Anthropic key"),
+        p(types_js_1.EntityType.SECRET, String.raw `\bxox[bpas]-\d[\d\-]{10,}`, null, "Slack numeric token"),
+        p(types_js_1.EntityType.SECRET, String.raw `\bxox[bpas]-[a-zA-Z0-9\-]{10,}`, null, "Slack token"),
+        p(types_js_1.EntityType.SECRET, String.raw `\beyJ[a-zA-Z0-9_\-]+\.[a-zA-Z0-9_\-]+\.[a-zA-Z0-9_\-]+\b`, null, "JWT token"),
+        p(types_js_1.EntityType.SECRET, String.raw `\bSG\.[a-zA-Z0-9_\-]{22}\.[a-zA-Z0-9_\-]{43}\b`, null, "SendGrid key"),
+        p(types_js_1.EntityType.SECRET, String.raw `\bhvs\.[a-zA-Z0-9_\-]{20,}\b`, null, "Vault token"),
+        p(types_js_1.EntityType.SECRET, String.raw `\bkey-[a-f0-9]{20,}\b`, null, "Mailgun key"),
+        p(types_js_1.EntityType.SECRET, String.raw `\bnpm_[a-zA-Z0-9]{36,}\b`, null, "npm token"),
+        p(types_js_1.EntityType.SECRET, String.raw `\bAIza[a-zA-Z0-9_\-]{35}\b`, null, "Google API key"),
+        p(types_js_1.EntityType.SECRET, String.raw `\bdop_v1_[a-f0-9]{64}\b`, null, "DigitalOcean token"),
+        p(types_js_1.EntityType.SECRET, String.raw `\bAC[a-f0-9]{32}\b`, null, "Twilio Account SID"),
+        p(types_js_1.EntityType.SECRET, String.raw `\bxapp-\d[\d\-]{20,}`, null, "Slack app numeric token"),
+        p(types_js_1.EntityType.SECRET, String.raw `\bxapp-[a-zA-Z0-9\-]{20,}`, null, "Slack app token"),
+        p(types_js_1.EntityType.SECRET, String.raw `\bdapi[a-f0-9]{32,}\b`, null, "Databricks PAT"),
+        // --- Secret / API Key (connection strings with embedded credentials) ---
+        p(types_js_1.EntityType.SECRET, String.raw `(?:mongodb|mysql|postgres(?:ql)?|redis|amqp|rabbitmq):\/\/[^\s:]+:[^\s@]+@[^\s]+`, null, "Connection string with credentials"),
+        // --- Secret / API Key (assignment-based: KEY=value or KEY: value) ---
+        p(types_js_1.EntityType.SECRET, String.raw `(?<=[:=] )\S{8,}|(?<=[:=])\S{8,}`, "high_entropy", "Assigned secret value", [
+            "key", "token", "secret", "password", "credential",
+            "api_key", "apikey", "api-key", "auth", "bearer",
+            "aws_secret_access_key", "access_key", "private_key",
+            "wachtwoord", "mot de passe", "Passwort", "Schlüssel",
+            "clé", "sleutel", "lösenord", "hasło", "heslo",
+            "jelszó", "contraseña", "senha", "parola",
+            "AES_KEY", "ENCRYPTION_KEY", "SIGNING_KEY",
+            "ACCOUNT_SID", "AUTH_TOKEN", "TWILIO",
+            "RAILS_SECRET", "SECRET_KEY_BASE", "DATABASE_URL",
+            "NPM_TOKEN", "DIGITALOCEAN", "GOOGLE_API",
+            "kľúč", "nøkkel", "nyckel", "avain", "lykill",
+            "DB_PASS", "DB_PASSWORD", "DATASOURCE_PASSWORD",
+            "JWT_SIGNING", "SIGNING_KEY",
+            "passwd", "Kennwort",
+        ], true),
+        // --- Secret / API Key (entropy-based fallback for longer tokens) ---
+        p(types_js_1.EntityType.SECRET, String.raw `\b[A-Za-z0-9_\-+/]{24,}[A-Za-z0-9_\-+/=]*\b`, "high_entropy", "High-entropy token", [
+            "key", "token", "secret", "password", "credential",
+            "api_key", "apikey", "api-key", "auth", "bearer",
+            "aws_secret_access_key", "access_key", "private_key",
+            "wachtwoord", "mot de passe", "Passwort", "Schlüssel",
+            "clé", "sleutel", "lösenord", "hasło", "heslo",
+            "jelszó", "contraseña", "senha", "parola",
+            "kľúč", "nøkkel", "nyckel", "avain", "lykill",
+        ], true),
         p(types_js_1.EntityType.DOB, String.raw `\b(?:0[1-9]|[12][0-9]|3[01])[/.\-](?:0[1-9]|1[0-2])[/.\-](?:19|20)\d{2}\b`, null, "DD/MM/YYYY", DOB_CONTEXT, true),
         p(types_js_1.EntityType.DATE_OF_DEATH, String.raw `\b(?:0[1-9]|[12][0-9]|3[01])[/.\-](?:0[1-9]|1[0-2])[/.\-](?:19|20)\d{2}\b`, null, "", DATE_OF_DEATH_CONTEXT, true),
         p(types_js_1.EntityType.DOB, String.raw `\b(?:19|20)\d{2}[/.\-](?:0[1-9]|1[0-2])[/.\-](?:0[1-9]|[12][0-9]|3[01])\b`, null, "ISO YYYY-MM-DD", DOB_ISO_CONTEXT, true),

package/dist/cjs/rules/engine.js

@@ -9,6 +9,14 @@ const index_js_1 = require("./countries/index.js");
 class RuleEngine {
     matcher = new matchers_js_1.MultiPatternMatcher();
     loadedCountries = new Set();
+    addCustomPattern(name, pattern) {
+        const pdef = {
+            entityType: name, pattern, validator: null,
+            description: "", contextKeywords: [], requiresContext: false,
+        };
+        this.matcher.addPattern(pdef, "CUSTOM");
+        this.matcher.compile();
+    }
     loadCountries(countryCodes) {
         let configs;
         if (countryCodes === null) {
@@ -21,7 +29,6 @@ class RuleEngine {
                 const config = index_js_1.COUNTRY_CONFIGS[code];
                 if (config)
                     configs.push(config);
-                // Silently skip unknown country codes (e.g. "INTL")
             }
             const shared = index_js_1.COUNTRY_CONFIGS["SHARED"];
             if (shared)
@@ -43,32 +50,66 @@ class RuleEngine {
         let rawMatches = this.matcher.scan(text);
         if (countryCodes !== null) {
             const codesUpper = new Set(countryCodes.map(c => c.toUpperCase()));
-            rawMatches = rawMatches.filter(m => codesUpper.has(m.countryCode) || m.countryCode === "SHARED");
+            rawMatches = rawMatches.filter(m => codesUpper.has(m.countryCode) || m.countryCode === "SHARED" || m.countryCode === "CUSTOM");
+        }
+        // Matches that have a validator but fail it create suppression zones:
+        // the span is recognisably a specific entity (e.g. IBAN-shaped) so
+        // overlapping regex-only matches (license plate, phone) are false
+        // positives and must be suppressed.
+        const validated = [];
+        const suppressionZones = [];
+        for (const m of rawMatches) {
+            if (this.matcher.validate(m)) {
+                validated.push(m);
+            }
+            else if (m.patternDef.validator !== null && !m.patternDef.requiresContext) {
+                suppressionZones.push([m.start, m.end]);
+            }
         }
-        const validated = rawMatches.filter(m => this.matcher.validate(m));
-        const detections = [];
+        // Build candidates with priority: validated (3) > custom (2) > regex-only (1)
+        const candidates = [];
         for (const match of validated) {
             if ((0, suppressors_js_1.shouldSuppress)(text, match))
                 continue;
-            detections.push({
-                entityType: match.patternDef.entityType,
-                start: match.start,
-                end: match.end,
-                text: match.text,
-                source: types_js_1.DetectionSource.RULES,
-                country: match.countryCode !== "SHARED" ? match.countryCode : null,
-                confidence: "high",
+            if (match.patternDef.validator === null && suppressionZones.length > 0) {
+                if (suppressionZones.some(([zStart, zEnd]) => match.start >= zStart && match.end <= zEnd)) {
+                    continue;
+                }
+            }
+            const hasValidator = match.patternDef.validator !== null;
+            const isValid = this.matcher.validate(match);
+            const priority = (hasValidator && isValid) ? 3 : match.countryCode === "CUSTOM" ? 2 : 1;
+            const spanLength = match.end - match.start;
+            const score = priority * 1_000_000 + spanLength;
+            candidates.push({
+                det: {
+                    entityType: match.patternDef.entityType,
+                    start: match.start,
+                    end: match.end,
+                    text: match.text,
+                    source: types_js_1.DetectionSource.RULES,
+                    country: (match.countryCode !== "SHARED" && match.countryCode !== "CUSTOM") ? match.countryCode : null,
+                    confidence: "high",
+                },
+                score,
             });
         }
-        detections.push(...(0, structural_js_1.detectStructuralDob)(text));
-        return this.deduplicate(detections);
+        for (const d of (0, structural_js_1.detectStructuralDob)(text)) {
+            candidates.push({ det: d, score: 1_000_000 + (d.end - d.start) });
+        }
+        return this.deduplicate(candidates);
     }
-    deduplicate(detections) {
-        if (detections.length === 0)
-            return detections;
-        const sorted = [...detections].sort((a, b) => a.start - b.start || (b.end - b.start) - (a.end - a.start));
+    /**
+     * Remove overlapping detections with priority-aware resolution.
+     * Priority: validated (3) > custom (2) > regex-only (1).
+     * Within the same tier, longer span wins.
+     */
+    deduplicate(candidates) {
+        if (candidates.length === 0)
+            return [];
+        const sorted = [...candidates].sort((a, b) => b.score - a.score);
         const result = [];
-        for (const det of sorted) {
+        for (const { det } of sorted) {
             let overlaps = false;
             for (const kept of result) {
                 if (det.start < kept.end && det.end > kept.start) {

package/dist/cjs/rules/matchers.js

@@ -5,6 +5,11 @@ const validators_js_1 = require("./validators.js");
 class MultiPatternMatcher {
     patterns = [];
     compiled = false;
+    addPattern(patternDef, countryCode) {
+        const regex = new RegExp(patternDef.pattern, "gu");
+        this.patterns.push({ regex, patternDef, countryCode });
+        this.compiled = false;
+    }
     addCountry(config) {
         for (const pdef of config.patterns) {
             // Convert Python-style \b word boundaries — JS handles them natively

package/dist/cjs/rules/validators.js

@@ -623,6 +623,35 @@ function validateGreekAmka(candidate) {
     }
     return total % 10 === 0;
 }
+function validateHighEntropy(candidate) {
+    const clean = candidate.trim();
+    if (clean.length < 8)
+        return false;
+    // Short passwords (< 24 chars): require at least 1 letter, 1 digit, 1 special char
+    if (clean.length < 24) {
+        const hasLetter = /[a-zA-Z]/.test(clean);
+        const hasDigit = /\d/.test(clean);
+        const hasSpecial = /[^a-zA-Z0-9]/.test(clean);
+        if (hasLetter && hasDigit && hasSpecial)
+            return true;
+        // For short tokens without special chars, require entropy check
+        if (!hasSpecial && clean.length < 16)
+            return false;
+    }
+    const freq = new Map();
+    for (const ch of clean)
+        freq.set(ch, (freq.get(ch) ?? 0) + 1);
+    const len = clean.length;
+    let entropy = 0;
+    for (const c of freq.values()) {
+        const p = c / len;
+        entropy -= p * Math.log2(p);
+    }
+    // Hex-only strings have max ~4.0 bits entropy, use lower threshold
+    const isHex = /^[a-fA-F0-9]+$/.test(clean);
+    const threshold = isHex ? 3.0 : clean.length < 24 ? 3.0 : 3.5;
+    return entropy >= threshold;
+}
 exports.VALIDATORS = {
     iban: validateIban,
     bsn: validateBsn,
@@ -666,4 +695,5 @@ exports.VALIDATORS = {
     uk_nhs: validateUkNhs,
     greek_afm: validateGreekAfm,
     greek_amka: validateGreekAmka,
+    high_entropy: validateHighEntropy,
 };

package/dist/cjs/sdk.js

@@ -6,10 +6,10 @@ const normalizer_js_1 = require("./normalizer.js");
 const engine_js_1 = require("./rules/engine.js");
 const types_js_1 = require("./types.js");
 const DATE_TYPES = new Set([types_js_1.EntityType.DOB, types_js_1.EntityType.DATE_OF_DEATH]);
-class PseudonymMapper {
+class ReferentialMapper {
     counters = new Map();
     mapping = new Map();
-    getPseudonym(text, entityType) {
+    getLabel(text, entityType) {
         if (!this.mapping.has(text)) {
             const count = (this.counters.get(entityType) ?? 0) + 1;
             this.counters.set(entityType, count);
@@ -21,9 +21,13 @@ class PseudonymMapper {
 class EuRedact {
     engine = new engine_js_1.RuleEngine();
     cache = new cache_js_1.ResultCache();
-    pseudonymMapper = new PseudonymMapper();
+    referentialMapper = new ReferentialMapper();
+    addCustomPattern(name, pattern) {
+        this.engine.addCustomPattern(name, pattern);
+        this.cache.clear();
+    }
     redact(text, options = {}) {
-        const { countries = null, mode = "rules", pseudonymize = false, detectDates = false, cache = true, } = options;
+        const { countries = null, mode = "rules", referentialIntegrity = false, detectDates = false, cache = true, } = options;
         const [normalizedText, offsetMapping] = (0, normalizer_js_1.normalize)(text);
         const countriesTuple = countries
             ? countries.map(c => c.toUpperCase()).sort()
@@ -51,8 +55,8 @@ class EuRedact {
         let redacted = text;
         for (let i = detections.length - 1; i >= 0; i--) {
             const det = detections[i];
-            const replacement = pseudonymize
-                ? this.pseudonymMapper.getPseudonym(det.text, det.entityType)
+            const replacement = referentialIntegrity
+                ? this.referentialMapper.getLabel(det.text, det.entityType)
                 : `[${det.entityType}]`;
             redacted = redacted.slice(0, det.start) + replacement + redacted.slice(det.end);
         }

package/dist/cjs/types.js

@@ -32,6 +32,7 @@ var EntityType;
     EntityType["GPS_COORDINATES"] = "GPS_COORDINATES";
     EntityType["UUID"] = "UUID";
     EntityType["SOCIAL_HANDLE"] = "SOCIAL_HANDLE";
+    EntityType["SECRET"] = "SECRET";
     EntityType["OTHER"] = "OTHER";
 })(EntityType || (exports.EntityType = EntityType = {}));
 var DetectionSource;

package/dist/esm/index.d.ts

@@ -6,4 +6,5 @@ import { type RedactOptions } from "./sdk.js";
 import type { RedactResult } from "./types.js";
 export declare function availableCountries(): string[];
 export declare function redact(text: string, options?: RedactOptions): RedactResult;
+export declare function addCustomPattern(name: string, pattern: string): void;
 export declare function redactBatch(texts: string[], options?: RedactOptions): RedactResult[];

package/dist/esm/index.js

@@ -15,6 +15,9 @@ export function availableCountries() {
 export function redact(text, options) {
     return getInstance().redact(text, options);
 }
+export function addCustomPattern(name, pattern) {
+    getInstance().addCustomPattern(name, pattern);
+}
 export function redactBatch(texts, options) {
     return getInstance().redactBatch(texts, options);
 }

package/dist/esm/rules/countries/index.js

@@ -46,6 +46,56 @@ const SHARED = {
         p(EntityType.GPS_COORDINATES, String.raw `-?(?:[1-8]?\d(?:\.\d{4,})|90(?:\.0{4,}))\s*[,;/]\s*-?(?:1[0-7]\d(?:\.\d{4,})|180(?:\.0{4,})|\d{1,2}(?:\.\d{4,}))`),
         p(EntityType.UUID, String.raw `\b[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}\b`),
         p(EntityType.SOCIAL_HANDLE, String.raw `(?<!\w)@[a-zA-Z][a-zA-Z0-9_.]{1,29}\b`),
+        // --- Secret / API Key (known prefixes — always active) ---
+        p(EntityType.SECRET, String.raw `\bAKIA[A-Z0-9]{16}\b`, null, "AWS Access Key ID"),
+        p(EntityType.SECRET, String.raw `\bgh[poas]_[a-zA-Z0-9]{36,}\b`, null, "GitHub token"),
+        p(EntityType.SECRET, String.raw `\bgithub_pat_[a-zA-Z0-9_]{22,}\b`, null, "GitHub fine-grained PAT"),
+        p(EntityType.SECRET, String.raw `\bgl[a-z]t-[a-zA-Z0-9_\-]{20,}\b`, null, "GitLab token"),
+        p(EntityType.SECRET, String.raw `\bglpat-[a-zA-Z0-9_\-]{20,}\b`, null, "GitLab PAT"),
+        p(EntityType.SECRET, String.raw `\b[sp]k_(?:live|test)_[a-zA-Z0-9]{24,}\b`, null, "Stripe key"),
+        p(EntityType.SECRET, String.raw `\bsk-(?:ant-)?[a-zA-Z0-9\-_]{20,}\b`, null, "OpenAI/Anthropic key"),
+        p(EntityType.SECRET, String.raw `\bxox[bpas]-\d[\d\-]{10,}`, null, "Slack numeric token"),
+        p(EntityType.SECRET, String.raw `\bxox[bpas]-[a-zA-Z0-9\-]{10,}`, null, "Slack token"),
+        p(EntityType.SECRET, String.raw `\beyJ[a-zA-Z0-9_\-]+\.[a-zA-Z0-9_\-]+\.[a-zA-Z0-9_\-]+\b`, null, "JWT token"),
+        p(EntityType.SECRET, String.raw `\bSG\.[a-zA-Z0-9_\-]{22}\.[a-zA-Z0-9_\-]{43}\b`, null, "SendGrid key"),
+        p(EntityType.SECRET, String.raw `\bhvs\.[a-zA-Z0-9_\-]{20,}\b`, null, "Vault token"),
+        p(EntityType.SECRET, String.raw `\bkey-[a-f0-9]{20,}\b`, null, "Mailgun key"),
+        p(EntityType.SECRET, String.raw `\bnpm_[a-zA-Z0-9]{36,}\b`, null, "npm token"),
+        p(EntityType.SECRET, String.raw `\bAIza[a-zA-Z0-9_\-]{35}\b`, null, "Google API key"),
+        p(EntityType.SECRET, String.raw `\bdop_v1_[a-f0-9]{64}\b`, null, "DigitalOcean token"),
+        p(EntityType.SECRET, String.raw `\bAC[a-f0-9]{32}\b`, null, "Twilio Account SID"),
+        p(EntityType.SECRET, String.raw `\bxapp-\d[\d\-]{20,}`, null, "Slack app numeric token"),
+        p(EntityType.SECRET, String.raw `\bxapp-[a-zA-Z0-9\-]{20,}`, null, "Slack app token"),
+        p(EntityType.SECRET, String.raw `\bdapi[a-f0-9]{32,}\b`, null, "Databricks PAT"),
+        // --- Secret / API Key (connection strings with embedded credentials) ---
+        p(EntityType.SECRET, String.raw `(?:mongodb|mysql|postgres(?:ql)?|redis|amqp|rabbitmq):\/\/[^\s:]+:[^\s@]+@[^\s]+`, null, "Connection string with credentials"),
+        // --- Secret / API Key (assignment-based: KEY=value or KEY: value) ---
+        p(EntityType.SECRET, String.raw `(?<=[:=] )\S{8,}|(?<=[:=])\S{8,}`, "high_entropy", "Assigned secret value", [
+            "key", "token", "secret", "password", "credential",
+            "api_key", "apikey", "api-key", "auth", "bearer",
+            "aws_secret_access_key", "access_key", "private_key",
+            "wachtwoord", "mot de passe", "Passwort", "Schlüssel",
+            "clé", "sleutel", "lösenord", "hasło", "heslo",
+            "jelszó", "contraseña", "senha", "parola",
+            "AES_KEY", "ENCRYPTION_KEY", "SIGNING_KEY",
+            "ACCOUNT_SID", "AUTH_TOKEN", "TWILIO",
+            "RAILS_SECRET", "SECRET_KEY_BASE", "DATABASE_URL",
+            "NPM_TOKEN", "DIGITALOCEAN", "GOOGLE_API",
+            "kľúč", "nøkkel", "nyckel", "avain", "lykill",
+            "DB_PASS", "DB_PASSWORD", "DATASOURCE_PASSWORD",
+            "JWT_SIGNING", "SIGNING_KEY",
+            "passwd", "Kennwort",
+        ], true),
+        // --- Secret / API Key (entropy-based fallback for longer tokens) ---
+        p(EntityType.SECRET, String.raw `\b[A-Za-z0-9_\-+/]{24,}[A-Za-z0-9_\-+/=]*\b`, "high_entropy", "High-entropy token", [
+            "key", "token", "secret", "password", "credential",
+            "api_key", "apikey", "api-key", "auth", "bearer",
+            "aws_secret_access_key", "access_key", "private_key",
+            "wachtwoord", "mot de passe", "Passwort", "Schlüssel",
+            "clé", "sleutel", "lösenord", "hasło", "heslo",
+            "jelszó", "contraseña", "senha", "parola",
+            "kľúč", "nøkkel", "nyckel", "avain", "lykill",
+        ], true),
         p(EntityType.DOB, String.raw `\b(?:0[1-9]|[12][0-9]|3[01])[/.\-](?:0[1-9]|1[0-2])[/.\-](?:19|20)\d{2}\b`, null, "DD/MM/YYYY", DOB_CONTEXT, true),
         p(EntityType.DATE_OF_DEATH, String.raw `\b(?:0[1-9]|[12][0-9]|3[01])[/.\-](?:0[1-9]|1[0-2])[/.\-](?:19|20)\d{2}\b`, null, "", DATE_OF_DEATH_CONTEXT, true),
         p(EntityType.DOB, String.raw `\b(?:19|20)\d{2}[/.\-](?:0[1-9]|1[0-2])[/.\-](?:0[1-9]|[12][0-9]|3[01])\b`, null, "ISO YYYY-MM-DD", DOB_ISO_CONTEXT, true),

package/dist/esm/rules/engine.d.ts

@@ -2,8 +2,14 @@ import { type Detection } from "../types.js";
 export declare class RuleEngine {
     private matcher;
     private loadedCountries;
+    addCustomPattern(name: string, pattern: string): void;
     loadCountries(countryCodes: string[] | null): void;
     detect(text: string, countryCodes: string[] | null): Detection[];
+    /**
+     * Remove overlapping detections with priority-aware resolution.
+     * Priority: validated (3) > custom (2) > regex-only (1).
+     * Within the same tier, longer span wins.
+     */
     private deduplicate;
     getLoadedCountries(): Set<string>;
 }

package/dist/esm/rules/engine.js

@@ -6,6 +6,14 @@ import { COUNTRY_CONFIGS } from "./countries/index.js";
 export class RuleEngine {
     matcher = new MultiPatternMatcher();
     loadedCountries = new Set();
+    addCustomPattern(name, pattern) {
+        const pdef = {
+            entityType: name, pattern, validator: null,
+            description: "", contextKeywords: [], requiresContext: false,
+        };
+        this.matcher.addPattern(pdef, "CUSTOM");
+        this.matcher.compile();
+    }
     loadCountries(countryCodes) {
         let configs;
         if (countryCodes === null) {
@@ -18,7 +26,6 @@ export class RuleEngine {
                 const config = COUNTRY_CONFIGS[code];
                 if (config)
                     configs.push(config);
-                // Silently skip unknown country codes (e.g. "INTL")
             }
             const shared = COUNTRY_CONFIGS["SHARED"];
             if (shared)
@@ -40,32 +47,66 @@ export class RuleEngine {
         let rawMatches = this.matcher.scan(text);
         if (countryCodes !== null) {
             const codesUpper = new Set(countryCodes.map(c => c.toUpperCase()));
-            rawMatches = rawMatches.filter(m => codesUpper.has(m.countryCode) || m.countryCode === "SHARED");
+            rawMatches = rawMatches.filter(m => codesUpper.has(m.countryCode) || m.countryCode === "SHARED" || m.countryCode === "CUSTOM");
+        }
+        // Matches that have a validator but fail it create suppression zones:
+        // the span is recognisably a specific entity (e.g. IBAN-shaped) so
+        // overlapping regex-only matches (license plate, phone) are false
+        // positives and must be suppressed.
+        const validated = [];
+        const suppressionZones = [];
+        for (const m of rawMatches) {
+            if (this.matcher.validate(m)) {
+                validated.push(m);
+            }
+            else if (m.patternDef.validator !== null && !m.patternDef.requiresContext) {
+                suppressionZones.push([m.start, m.end]);
+            }
         }
-        const validated = rawMatches.filter(m => this.matcher.validate(m));
-        const detections = [];
+        // Build candidates with priority: validated (3) > custom (2) > regex-only (1)
+        const candidates = [];
         for (const match of validated) {
             if (shouldSuppress(text, match))
                 continue;
-            detections.push({
-                entityType: match.patternDef.entityType,
-                start: match.start,
-                end: match.end,
-                text: match.text,
-                source: DetectionSource.RULES,
-                country: match.countryCode !== "SHARED" ? match.countryCode : null,
-                confidence: "high",
+            if (match.patternDef.validator === null && suppressionZones.length > 0) {
+                if (suppressionZones.some(([zStart, zEnd]) => match.start >= zStart && match.end <= zEnd)) {
+                    continue;
+                }
+            }
+            const hasValidator = match.patternDef.validator !== null;
+            const isValid = this.matcher.validate(match);
+            const priority = (hasValidator && isValid) ? 3 : match.countryCode === "CUSTOM" ? 2 : 1;
+            const spanLength = match.end - match.start;
+            const score = priority * 1_000_000 + spanLength;
+            candidates.push({
+                det: {
+                    entityType: match.patternDef.entityType,
+                    start: match.start,
+                    end: match.end,
+                    text: match.text,
+                    source: DetectionSource.RULES,
+                    country: (match.countryCode !== "SHARED" && match.countryCode !== "CUSTOM") ? match.countryCode : null,
+                    confidence: "high",
+                },
+                score,
             });
         }
-        detections.push(...detectStructuralDob(text));
-        return this.deduplicate(detections);
+        for (const d of detectStructuralDob(text)) {
+            candidates.push({ det: d, score: 1_000_000 + (d.end - d.start) });
+        }
+        return this.deduplicate(candidates);
     }
-    deduplicate(detections) {
-        if (detections.length === 0)
-            return detections;
-        const sorted = [...detections].sort((a, b) => a.start - b.start || (b.end - b.start) - (a.end - a.start));
+    /**
+     * Remove overlapping detections with priority-aware resolution.
+     * Priority: validated (3) > custom (2) > regex-only (1).
+     * Within the same tier, longer span wins.
+     */
+    deduplicate(candidates) {
+        if (candidates.length === 0)
+            return [];
+        const sorted = [...candidates].sort((a, b) => b.score - a.score);
         const result = [];
-        for (const det of sorted) {
+        for (const { det } of sorted) {
             let overlaps = false;
             for (const kept of result) {
                 if (det.start < kept.end && det.end > kept.start) {

package/dist/esm/rules/matchers.d.ts

@@ -1,9 +1,10 @@
-import type { CountryConfig } from "../types.js";
+import type { CountryConfig, PatternDef } from "../types.js";
 import type { RawMatch } from "./suppressors.js";
 export type { RawMatch };
 export declare class MultiPatternMatcher {
     private patterns;
     private compiled;
+    addPattern(patternDef: PatternDef, countryCode: string): void;
     addCountry(config: CountryConfig): void;
     compile(): void;
     scan(text: string): RawMatch[];

package/dist/esm/rules/matchers.js

@@ -2,6 +2,11 @@ import { VALIDATORS } from "./validators.js";
 export class MultiPatternMatcher {
     patterns = [];
     compiled = false;
+    addPattern(patternDef, countryCode) {
+        const regex = new RegExp(patternDef.pattern, "gu");
+        this.patterns.push({ regex, patternDef, countryCode });
+        this.compiled = false;
+    }
     addCountry(config) {
         for (const pdef of config.patterns) {
             // Convert Python-style \b word boundaries — JS handles them natively

package/dist/esm/rules/validators.js

@@ -578,6 +578,35 @@ export function validateGreekAmka(candidate) {
     }
     return total % 10 === 0;
 }
+function validateHighEntropy(candidate) {
+    const clean = candidate.trim();
+    if (clean.length < 8)
+        return false;
+    // Short passwords (< 24 chars): require at least 1 letter, 1 digit, 1 special char
+    if (clean.length < 24) {
+        const hasLetter = /[a-zA-Z]/.test(clean);
+        const hasDigit = /\d/.test(clean);
+        const hasSpecial = /[^a-zA-Z0-9]/.test(clean);
+        if (hasLetter && hasDigit && hasSpecial)
+            return true;
+        // For short tokens without special chars, require entropy check
+        if (!hasSpecial && clean.length < 16)
+            return false;
+    }
+    const freq = new Map();
+    for (const ch of clean)
+        freq.set(ch, (freq.get(ch) ?? 0) + 1);
+    const len = clean.length;
+    let entropy = 0;
+    for (const c of freq.values()) {
+        const p = c / len;
+        entropy -= p * Math.log2(p);
+    }
+    // Hex-only strings have max ~4.0 bits entropy, use lower threshold
+    const isHex = /^[a-fA-F0-9]+$/.test(clean);
+    const threshold = isHex ? 3.0 : clean.length < 24 ? 3.0 : 3.5;
+    return entropy >= threshold;
+}
 export const VALIDATORS = {
     iban: validateIban,
     bsn: validateBsn,
@@ -621,4 +650,5 @@ export const VALIDATORS = {
     uk_nhs: validateUkNhs,
     greek_afm: validateGreekAfm,
     greek_amka: validateGreekAmka,
+    high_entropy: validateHighEntropy,
 };

package/dist/esm/sdk.d.ts

@@ -2,14 +2,15 @@ import { type RedactResult } from "./types.js";
 export interface RedactOptions {
     countries?: string[] | null;
     mode?: string;
-    pseudonymize?: boolean;
+    referentialIntegrity?: boolean;
     detectDates?: boolean;
     cache?: boolean;
 }
 export declare class EuRedact {
     private engine;
     private cache;
-    private pseudonymMapper;
+    private referentialMapper;
+    addCustomPattern(name: string, pattern: string): void;
     redact(text: string, options?: RedactOptions): RedactResult;
     redactBatch(texts: string[], options?: RedactOptions): RedactResult[];
 }

package/dist/esm/sdk.js

@@ -3,10 +3,10 @@ import { normalize, mapOffsetToOriginal } from "./normalizer.js";
 import { RuleEngine } from "./rules/engine.js";
 import { EntityType } from "./types.js";
 const DATE_TYPES = new Set([EntityType.DOB, EntityType.DATE_OF_DEATH]);
-class PseudonymMapper {
+class ReferentialMapper {
     counters = new Map();
     mapping = new Map();
-    getPseudonym(text, entityType) {
+    getLabel(text, entityType) {
         if (!this.mapping.has(text)) {
             const count = (this.counters.get(entityType) ?? 0) + 1;
             this.counters.set(entityType, count);
@@ -18,9 +18,13 @@ class PseudonymMapper {
 export class EuRedact {
     engine = new RuleEngine();
     cache = new ResultCache();
-    pseudonymMapper = new PseudonymMapper();
+    referentialMapper = new ReferentialMapper();
+    addCustomPattern(name, pattern) {
+        this.engine.addCustomPattern(name, pattern);
+        this.cache.clear();
+    }
     redact(text, options = {}) {
-        const { countries = null, mode = "rules", pseudonymize = false, detectDates = false, cache = true, } = options;
+        const { countries = null, mode = "rules", referentialIntegrity = false, detectDates = false, cache = true, } = options;
         const [normalizedText, offsetMapping] = normalize(text);
         const countriesTuple = countries
             ? countries.map(c => c.toUpperCase()).sort()
@@ -48,8 +52,8 @@ export class EuRedact {
         let redacted = text;
         for (let i = detections.length - 1; i >= 0; i--) {
             const det = detections[i];
-            const replacement = pseudonymize
-                ? this.pseudonymMapper.getPseudonym(det.text, det.entityType)
+            const replacement = referentialIntegrity
+                ? this.referentialMapper.getLabel(det.text, det.entityType)
                 : `[${det.entityType}]`;
             redacted = redacted.slice(0, det.start) + replacement + redacted.slice(det.end);
         }

package/dist/esm/types.d.ts

@@ -28,6 +28,7 @@ export declare enum EntityType {
     GPS_COORDINATES = "GPS_COORDINATES",
     UUID = "UUID",
     SOCIAL_HANDLE = "SOCIAL_HANDLE",
+    SECRET = "SECRET",
     OTHER = "OTHER"
 }
 export declare enum DetectionSource {
@@ -35,7 +36,7 @@ export declare enum DetectionSource {
     CLOUD = "cloud"
 }
 export interface Detection {
-    entityType: EntityType;
+    entityType: EntityType | string;
     start: number;
     end: number;
     text: string;
@@ -50,7 +51,7 @@ export interface RedactResult {
     degraded: boolean;
 }
 export interface PatternDef {
-    entityType: EntityType;
+    entityType: EntityType | string;
     pattern: string;
     validator: string | null;
     description: string;

package/dist/esm/types.js

@@ -29,6 +29,7 @@ export var EntityType;
     EntityType["GPS_COORDINATES"] = "GPS_COORDINATES";
     EntityType["UUID"] = "UUID";
     EntityType["SOCIAL_HANDLE"] = "SOCIAL_HANDLE";
+    EntityType["SECRET"] = "SECRET";
     EntityType["OTHER"] = "OTHER";
 })(EntityType || (EntityType = {}));
 export var DetectionSource;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "euredact",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "European PII redaction SDK -- fast, zero-dependency, rule-based detection and redaction of personal data across 31 European countries",
   "license": "Apache-2.0",
   "type": "module",
@@ -46,7 +46,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "https://github.com/jnjs/euredact"
+    "url": "https://github.com/euredact/euredact"
   },
   "scripts": {
     "build:esm": "tsc",