euredact 0.1.0 → 0.3.0

package/dist/cjs/rules/matchers.js

@@ -5,6 +5,11 @@ const validators_js_1 = require("./validators.js");
 class MultiPatternMatcher {
     patterns = [];
     compiled = false;
+    addPattern(patternDef, countryCode) {
+        const regex = new RegExp(patternDef.pattern, "gu");
+        this.patterns.push({ regex, patternDef, countryCode });
+        this.compiled = false;
+    }
     addCountry(config) {
         for (const pdef of config.patterns) {
             // Convert Python-style \b word boundaries — JS handles them natively
@@ -17,11 +22,13 @@ class MultiPatternMatcher {
     compile() {
         this.compiled = true;
     }
-    scan(text) {
+    scan(text, countryCodes = null) {
         if (!this.compiled)
             this.compile();
         const matches = [];
         for (const { regex, patternDef, countryCode } of this.patterns) {
+            if (countryCodes !== null && !countryCodes.has(countryCode))
+                continue;
             regex.lastIndex = 0;
             let m;
             while ((m = regex.exec(text)) !== null) {

package/dist/cjs/rules/suppressors.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.shouldSuppress = shouldSuppress;
 const types_js_1 = require("../types.js");
+const bicRegistry_js_1 = require("./bicRegistry.js");
 const CONTEXT_CHARS = 150;
 function getContext(text, start, end) {
     const ctxStart = Math.max(0, start - CONTEXT_CHARS);
@@ -21,12 +22,14 @@ const REFERENCE_BEFORE = /(?:dossier|ref\.?|referentie|reference|référence|fac
 const LEGAL_BEFORE = /(?:Art(?:ikel|icle|\.)|§|Artikel|Section|Sectie|Afdeling|paragraaf|Absatz|alinéa|punt|point|Punkt|lid)\s*$/i;
 const MATH_BEFORE = /[=+\-×÷*/]\s*$/;
 const MATH_AFTER = /^\s*[=+\-×÷*/]/;
+// "A-1010", "B-2000", "L-1234", "CH-8000", "D-10115": a country prefix on a
+// postal code, not a minus sign.
+const COUNTRY_PREFIX_HYPHEN = /(?:^|[^A-Za-z0-9])[A-Z]{1,2}-\s*$/;
 const SEQUENTIAL_PATTERNS = /^(?:0{6,}|1234567890?|0123456789|9876543210?|1111111111?|000000000|123456789)$/;
-const YEAR_PATTERN = /^(?:19[4-9]\d|20[0-3]\d)$/;
-const DATE_KEYWORD_NEAR = /(?:jaar|year|année|Jahr|datum|date|Datum|in\s+\d{4}|since|sinds|depuis|seit|født|fødselsdato|fødsel|Fødselsdato|född|födelsedatum|födelsedag|syntynyt|syntymäaika|fæddur|fæðingardagur|\d{2}\.\d{2}\.|(?:januar|februar|marts|april|maj|juni|juli|august|september|oktober|november|december|januari|februari|mars|april|mei|juin|juillet|août|Tiltr[æa]delsesdato|Tiltredelsesdato))/i;
+// YEAR_PATTERN kept for reference but replaced by RECENT_YEAR in suppressYearAsPostal
 const ID_LABEL_BEFORE = /(?:BSN|RR|NN|NIR|INSZ|NISS|NIS|Steuer-?ID|TIN|NIF|NIE|SSN|rijksregisternummer|numéro\s*national|national\s*number|matricule|Ausweisnummer|Personalausweis|Versichertennummer|KVNR|KV-Nr|Steuernummer|St\.\-Nr|StNr|Finanzamt\s+ist|Ondernemingen\s+onder\s+nummer|ondernemingsnummer|numéro\s*d'entreprise|enterprise\s*number|Kruispuntbank)\s*[:.]?\s*$/i;
 const SERVICE_NUMBER = /^0800[\-\s]/;
-const DATE_PATTERN_FULL = /^\d{2}[-/.]\d{2}[-/.]\d{4}$/;
+const DATE_PATTERN_FULL = /^\d{2}[-/.]\d{2}[-/.]\d{4}$|^\d{4}[-/.]\d{2}[-/.]\d{2}$/;
 const PASSPORT_CONTEXT_BEFORE = /(?:Reisepass|passport|passeport|paspoort|Bisheriger\s+Reisepass)\s*(?:Nr\.?|Nummer|nummer|number|n[°o])?\s*[:.]?\s*$/i;
 const SE_ORG_CONTEXT_BEFORE = /(?:org\.?\s*nr\.?|organisationsnummer|organisationsnr|Bolagsverket|företag)\s*[:.]?\s*$/i;
 const NUMERIC_TYPES = new Set([types_js_1.EntityType.PHONE, types_js_1.EntityType.NATIONAL_ID, types_js_1.EntityType.SSN, types_js_1.EntityType.TAX_ID, types_js_1.EntityType.POSTAL_CODE]);
@@ -66,23 +69,40 @@ function suppressMath(text, match) {
     if (!NUMERIC_TYPES.has(match.patternDef.entityType))
         return false;
     const [before, after] = getContext(text, match.start, match.end);
+    // A country-prefixed postal code is an address, not a subtraction:
+    // "A-1010 Wien", "B-2000 Antwerpen", "D-10115 Berlin".
+    if (match.patternDef.entityType === types_js_1.EntityType.POSTAL_CODE && COUNTRY_PREFIX_HYPHEN.test(before)) {
+        return false;
+    }
     return MATH_BEFORE.test(before) || MATH_AFTER.test(after);
 }
 function suppressSequential(_text, match) {
     const clean = match.text.replace(/[\s.\-]/g, "");
     return SEQUENTIAL_PATTERNS.test(clean);
 }
+const RECENT_YEAR = /^(?:19[5-9]\d|20[0-3]\d)$/;
+const POSTAL_CONTEXT_NEAR = /(?:postcode|postal|code\s*postal|PLZ|Postleitzahl|postnummer|postinumero|póstnúmer|zip|straat|straße|strasse|rue\s|via\s|calle\s|rua\s|ulica|utca|street|avenue|laan\s|weg\s|plein|adres|adresse|address|woonplaats|wonende|woonachtig|gevestigd|domicili|demeurant|résidant|residant|bosatt|bopæl|wohnhaft|ansässig|stad\b|ville\b|city\b|Stadt|città|ciudad|cidade|miasto|město|város)/i;
+const DATE_KEYWORD_NEAR = /(?:født|fødselsdato|fødsel|Fødselsdato|född|födelsedatum|födelsedag|syntynyt|syntymäaika|fæddur|fæðingardagur|geboren|geboortedatum|Geburtsdatum|nascido|nacido|data di nascita|nato il|nata il|Tiltr[æa]delsesdato|Tiltredelsesdato|datum|date\b|Datum|jaar|year|année|Jahr|since|sinds|depuis|seit|\d{2}\.\d{2}\.|(?:januar|februar|marts|april|maj|juni|juli|august|september|oktober|november|december|januari|februari|mars|mei|juin|juillet|août))/i;
 function suppressYearAsPostal(text, match) {
     if (match.patternDef.entityType !== types_js_1.EntityType.POSTAL_CODE)
         return false;
     const clean = match.text.trim();
-    if (!YEAR_PATTERN.test(clean))
+    if (!RECENT_YEAR.test(clean))
+        return false;
+    const [before, after] = getContext(text, match.start, match.end);
+    const context = before + after;
+    // Keep as postal code if postal/address context nearby
+    if (POSTAL_CONTEXT_NEAR.test(context))
         return false;
+    // Keep if preceded by comma+space (address pattern: "Amsterdam, 2026")
     const immediateBefore = text.slice(Math.max(0, match.start - 3), match.start);
-    if (immediateBefore.endsWith(", ") || immediateBefore.endsWith(",\n"))
+    if (/,\s*$/.test(immediateBefore))
         return false;
-    const [before, after] = getContext(text, match.start, match.end);
-    return DATE_KEYWORD_NEAR.test(before + after);
+    // Suppress if date keyword nearby (birth date, employment date, etc.)
+    if (DATE_KEYWORD_NEAR.test(context))
+        return true;
+    // Suppress: recent years without postal context are almost never postal codes
+    return true;
 }
 function suppressPhoneAfterIdLabel(text, match) {
     if (match.patternDef.entityType !== types_js_1.EntityType.PHONE)
@@ -104,9 +124,13 @@ const NOT_CITY_CODES = new Set([
     "ID", "NR", "NO", "ST", "DR", "MR", "MS", "HR", "FR", "IM", "IN", "OR", "IF", "IS", "IT", "AT", "AD", "AG", "AV",
     "BE", "DE", "EU", "NL", "LU", "WS", "SS", "IP",
 ]);
+const CURRENCY_PLATE = /^(?:EUR|USD|GBP|CHF|SEK|NOK|DKK|ISK|CZK|PLN|HUF|RON|BGN|HRK)\s/i;
 function suppressPlateInCompound(text, match) {
     if (match.patternDef.entityType !== types_js_1.EntityType.LICENSE_PLATE)
         return false;
+    // Suppress currency + number misread as plate (e.g. "EUR 2")
+    if (CURRENCY_PLATE.test(match.text))
+        return true;
     if (match.start >= 3) {
         const before = text.slice(Math.max(0, match.start - 10), match.start);
         if (/[A-Za-zÄÖÜäöüß]{2,}-$/.test(before))
@@ -178,6 +202,218 @@ function suppressPostalAsHouseNumber(text, match) {
     }
     return false;
 }
+// ── BIC: banking-context cues and heading shapes ────────────────────────
+// \bSWIFT\b also covers SWIFT-Code / SWIFT-BIC / Code SWIFT, and \bBIC\b
+// covers BIC-code / BIC/SWIFT.
+const BIC_KEYWORD = /\b(?:BIC|SWIFT)\b/i;
+const BANK_BLOCK = /\b(?:IBAN|Bankverbindung|Bankgegevens|Bankrekening|Rekening(?:nummer)?|Kontonummer|Konto|Kontoinhaber|Compte|Coordonn[ée]es\s+bancaires|Banque|Account\s+(?:number|holder)|Bankleitzahl|BLZ|Betaalgegevens|Zahlungsdaten)\b/i;
+// A line that is nothing but a BIC/SWIFT label, as used in table and column
+// layouts where the code sits on the following line.
+const BIC_LABEL_LINE = /^\s*(?:BIC|SWIFT|SWIFT[-\s]?BIC|BIC\s?\/\s?SWIFT|SWIFT[-\s]?Code|BIC[-\s]?code|Code\s+SWIFT)\s*:?\s*$/i;
+// An IBAN in the same structural unit: CC + 2 check digits + 2 or more groups.
+const IBAN_SHAPE = /\b[A-Z]{2}\d{2}(?:\s?[A-Z0-9]{4}){2,}/;
+// Largest paragraph still treated as one structural unit. Beyond this the unit
+// falls back to the enclosing line, so a run-on document body cannot lend
+// banking context to a token 2,000 characters away.
+const MAX_UNIT_CHARS = 600;
+function enclosingLine(text, start, end) {
+    const lineStart = text.lastIndexOf("\n", start - 1) + 1;
+    let lineEnd = text.indexOf("\n", end);
+    if (lineEnd === -1)
+        lineEnd = text.length;
+    return [lineStart, lineEnd];
+}
+/**
+ * Return the enclosing line / record / paragraph around a match.
+ *
+ * The context window for BIC is scoped structurally, not by character count.
+ * A tight character window measured on the corpus rejects 97.3% of dictionary
+ * false positives but wrongly discards ~316 real-looking codes, because the
+ * banking cue often sits further away in the same record — e.g. a CSV row
+ * carrying the IBAN in one field and the BIC several fields later.
+ */
+function structuralUnit(text, start, end) {
+    const [lineStart, lineEnd] = enclosingLine(text, start, end);
+    let paraStart = lineStart;
+    while (paraStart > 0) {
+        const prevEnd = paraStart - 1;
+        const prevStart = text.lastIndexOf("\n", prevEnd - 1) + 1;
+        if (text.slice(prevStart, prevEnd).trim() === "")
+            break;
+        paraStart = prevStart;
+    }
+    let paraEnd = lineEnd;
+    while (paraEnd < text.length) {
+        const nextStart = paraEnd + 1;
+        let nextEnd = text.indexOf("\n", nextStart);
+        if (nextEnd === -1)
+            nextEnd = text.length;
+        if (text.slice(nextStart, nextEnd).trim() === "")
+            break;
+        paraEnd = nextEnd;
+    }
+    if (paraEnd - paraStart <= MAX_UNIT_CHARS)
+        return text.slice(paraStart, paraEnd);
+    return text.slice(lineStart, lineEnd);
+}
+function previousNonblankLine(text, lineStart) {
+    let pos = lineStart;
+    while (pos > 0) {
+        const prevEnd = pos - 1;
+        const prevStart = text.lastIndexOf("\n", prevEnd - 1) + 1;
+        const line = text.slice(prevStart, prevEnd);
+        if (line.trim() !== "")
+            return line;
+        pos = prevStart;
+    }
+    return "";
+}
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * Does `token` also occur as an ordinary lowercase word in this document?
+ *
+ * `hospital`/`HOSPITAL`, `gegevens`/`GEGEVENS` — a token that appears in
+ * ordinary case elsewhere in the same document is a word, not a bank code.
+ * Email and domain contexts are excluded, so `ing.nl` does not vouch for a
+ * heading. Measured on the corpus this alone identifies ~78% of the BIC false
+ * positives with no dictionaries and no labelled data.
+ */
+function occursAsLowercaseWord(text, token) {
+    if (!/^[A-Za-z]+$/.test(token))
+        return false;
+    const lower = token.toLowerCase();
+    const capitalised = lower[0].toUpperCase() + lower.slice(1);
+    for (const form of [lower, capitalised]) {
+        // Cheap pre-check: a plain substring test almost always answers "no".
+        if (!text.includes(form))
+            continue;
+        const re = new RegExp(`\\b${escapeRe(form)}\\b`, "g");
+        let m;
+        while ((m = re.exec(text)) !== null) {
+            const before = m.index > 0 ? text[m.index - 1] : "";
+            const after = text.slice(m.index + form.length, m.index + form.length + 8);
+            if (before === "@" || (before === "." && m.index >= 2 && /[A-Za-z0-9]/.test(text[m.index - 2])))
+                continue;
+            if (after.startsWith("@") || /^\.[a-zA-Z]{2,6}\b/.test(after))
+                continue;
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Is the candidate positioned as a section heading rather than a value?
+ * Headings and shouted words are never bank codes. Lines carrying an explicit
+ * BIC/SWIFT keyword are exempt from the all-caps rule, so a genuine
+ * `BIC: GEBABEBB` line is not mistaken for a heading.
+ */
+function isHeadingShape(text, start, end, token) {
+    const [lineStart, lineEnd] = enclosingLine(text, start, end);
+    const line = text.slice(lineStart, lineEnd);
+    // The token is the entire line — unless the line above is a bare BIC/SWIFT
+    // label, which makes this a labelled value in a table layout, not a heading.
+    if (line.trim() === token) {
+        return !BIC_LABEL_LINE.test(previousNonblankLine(text, lineStart));
+    }
+    // The token starts its line and is immediately followed by a colon
+    if (text.slice(lineStart, start).trim() === "" && text.slice(end, lineEnd).trimStart().startsWith(":")) {
+        return true;
+    }
+    // A shouted line: no lowercase, no digits, and no banking keyword
+    if (!/[a-z]/.test(line) && !/\d/.test(line) && !BIC_KEYWORD.test(line))
+        return true;
+    return false;
+}
+/**
+ * Emit a BIC only on registry membership or banking context.
+ *
+ * 0. the token also occurs as an ordinary lowercase word here -> reject;
+ * 1. registry hit (deployment-supplied, then bundled seed prefixes) -> emit;
+ * 2. heading / shouted-word shape -> reject;
+ * 3. BIC/SWIFT keyword, IBAN or bank block in the structural unit -> emit;
+ *
+ * and a bare shape match reaching the end with none of the above is never
+ * emitted. Gate 0 outranks every tier below it — no genuine BIC is also an
+ * ordinary lowercase word — so it is applied on both emitting paths. It scans
+ * the whole document, so it runs only on the paths that would otherwise emit.
+ */
+function suppressBicWithoutEvidence(text, match) {
+    if (match.patternDef.entityType !== types_js_1.EntityType.BIC)
+        return false;
+    const token = match.text.trim();
+    if ((0, bicRegistry_js_1.isRegisteredBic)(token))
+        return occursAsLowercaseWord(text, token);
+    if (isHeadingShape(text, match.start, match.end, token))
+        return true;
+    // The token itself is blanked out so it cannot vouch for itself.
+    const unit = structuralUnit(text, match.start, match.end).split(token).join(" ".repeat(token.length));
+    if (BIC_KEYWORD.test(unit) || IBAN_SHAPE.test(unit) || BANK_BLOCK.test(unit)) {
+        return occursAsLowercaseWord(text, token);
+    }
+    return true;
+}
+// ── Postal code: digits belonging to a longer identifier ────────────────
+// An identifier label immediately before the digits. A postal code is never
+// introduced this way; an SVNr, policy number or service number always is.
+const ID_CUE_BEFORE = /(?:[\w\-]*Nr|[\w\-]*N[°ºo]|[\w\-]*Nummer|[\w\-]*Numero|[\w\-]*Numéro|No|number|num|Kennzahl|Aktenzeichen|Az|e-?card|Polizze|Police|Policen)\.?\s*:?\s*$/i;
+// An international dialling prefix earlier on the same line, with nothing but
+// number punctuation in between: these digits belong to the phone detector.
+const DIALLING_PREFIX_BEFORE = /\+\d{1,3}[\d\s\-().]*$/;
+// A country prefix on a postal code — "A-1010 Wien", "B-2000", "L-1234".
+const COUNTRY_PREFIXED = /(?:^|[^A-Za-z0-9])[A-Z]{1,2}$/;
+/**
+ * Suppress bare digit runs that belong to a longer number, not an address.
+ *
+ * A bare 4- or 5-digit run is the weakest shape in the engine, and when it
+ * cuts into a longer identifier the damage is worse than a plain false
+ * positive: `SV-Nummer: [POSTAL_CODE] 040390` leaves half an Austrian social
+ * security number exposed with no way to label the remainder.
+ *
+ * Applies only to digits-only matches, so structured forms keep their own
+ * behaviour — NL `1234 AB`, PT `1234-567`, LU `L-1234`.
+ */
+function suppressPostalInLongerIdentifier(text, match) {
+    if (match.patternDef.entityType !== types_js_1.EntityType.POSTAL_CODE)
+        return false;
+    const clean = match.text.trim();
+    if (!/^\d+$/.test(clean))
+        return false;
+    const beforeChar = match.start > 0 ? text[match.start - 1] : "";
+    const afterChar = match.end < text.length ? text[match.end] : "";
+    const prevPrev = match.start >= 2 ? text[match.start - 2] : "";
+    const nextNext = match.end + 1 < text.length ? text[match.end + 1] : "";
+    // Directly glued to more digits
+    if (/\d/.test(beforeChar) || /\d/.test(afterChar))
+        return true;
+    // Joined by identifier punctuation: "0456.2398.71-02", "4471/2025".
+    // The punctuation only counts when it actually *joins two digit groups* — a
+    // trailing period is ordinary sentence punctuation, and treating it as a
+    // separator discards every postal code that ends a sentence
+    // ("Domicilio: Palma, 13867. Pagos a ...").
+    if ("._/".includes(beforeChar) && /\d/.test(prevPrev))
+        return true;
+    if ("._/".includes(afterChar) && /\d/.test(nextNext))
+        return true;
+    if (afterChar === "-" && /\d/.test(nextNext))
+        return true;
+    if (beforeChar === "-" && !COUNTRY_PREFIXED.test(text.slice(0, match.start - 1)))
+        return true;
+    // A further digit group on the same line: "1268 040390", "1234 5678 925",
+    // "+43 664 8213 907". Horizontal whitespace only — a digit on the *next*
+    // line is a separate field, not a continuation.
+    if (/^[ \t]+\d/.test(text.slice(match.end, match.end + 4)))
+        return true;
+    // An identifier label introduces the digits: "DiNr. 4471", "Policen-Nr."
+    if (ID_CUE_BEFORE.test(text.slice(Math.max(0, match.start - 40), match.start)))
+        return true;
+    // Digits after an international dialling prefix belong to PHONE
+    const [lineStart] = enclosingLine(text, match.start, match.end);
+    if (DIALLING_PREFIX_BEFORE.test(text.slice(lineStart, match.start)))
+        return true;
+    return false;
+}
 function suppressRequiresContext(text, match) {
     if (!match.patternDef.requiresContext || match.patternDef.contextKeywords.length === 0)
         return false;
@@ -190,8 +426,9 @@ const TYPE_SUPPRESSORS = {
     [types_js_1.EntityType.NATIONAL_ID]: [suppressCurrency, suppressUnits, suppressReference, suppressLegal, suppressMath, suppressNatidAsPassport, suppressSeNatidAsOrg],
     [types_js_1.EntityType.SSN]: [suppressCurrency, suppressUnits, suppressReference, suppressMath],
     [types_js_1.EntityType.TAX_ID]: [suppressCurrency, suppressUnits, suppressReference, suppressMath],
-    [types_js_1.EntityType.POSTAL_CODE]: [suppressCurrency, suppressUnits, suppressMath, suppressLegal, suppressYearAsPostal, suppressPostalInsideIban, suppressPostalAsHouseNumber],
-    [types_js_1.EntityType.IBAN]: [suppressReference],
+    [types_js_1.EntityType.POSTAL_CODE]: [suppressCurrency, suppressUnits, suppressMath, suppressLegal, suppressYearAsPostal, suppressPostalInsideIban, suppressPostalAsHouseNumber, suppressPostalInLongerIdentifier],
+    [types_js_1.EntityType.BIC]: [suppressBicWithoutEvidence],
+    [types_js_1.EntityType.BANK_ACCOUNT]: [suppressReference],
     [types_js_1.EntityType.LICENSE_PLATE]: [suppressPlateInCompound],
     [types_js_1.EntityType.CHAMBER_OF_COMMERCE]: [suppressReference],
 };

package/dist/cjs/rules/validators.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VALIDATORS = void 0;
+exports.VALIDATORS = exports.ISO_3166_ALPHA2 = exports.IBAN_LENGTHS = void 0;
 exports.validateIban = validateIban;
 exports.validateBsn = validateBsn;
 exports.validateBelgianNn = validateBelgianNn;
@@ -14,6 +14,7 @@ exports.validateGermanTaxId = validateGermanTaxId;
 exports.validateFrenchNir = validateFrenchNir;
 exports.validateVin = validateVin;
 exports.validateBic = validateBic;
+exports.validateE164 = validateE164;
 exports.validateKvk = validateKvk;
 exports.validateSwedishPnr = validateSwedishPnr;
 exports.validateNorwegianFnr = validateNorwegianFnr;
@@ -46,21 +47,45 @@ exports.validateGreekAmka = validateGreekAmka;
 function clean(candidate, chars = /[\s.\-]/g) {
     return candidate.replace(chars, "");
 }
+/**
+ * Total IBAN length per country (ISO 13616 registry). Also used to build the
+ * country-independent IBAN pattern in rules/countries, so an IBAN is detected
+ * on its own structure rather than on the caller's `countries` setting.
+ */
+exports.IBAN_LENGTHS = {
+    AL: 28, AD: 24, AT: 20, AZ: 28, BH: 22, BY: 28, BE: 16, BA: 20, BR: 29, BG: 22, CR: 22, HR: 21,
+    CY: 28, CZ: 24, DK: 18, DO: 28, TL: 23, EE: 20, FO: 18, FI: 18, FR: 27, GE: 22, DE: 22, GI: 23,
+    GR: 27, GL: 18, GT: 28, HU: 28, IS: 26, IQ: 23, IE: 22, IL: 23, IT: 27, JO: 30, KZ: 20, XK: 20,
+    KW: 30, LV: 21, LB: 28, LI: 21, LT: 20, LU: 20, MT: 31, MR: 27, MU: 30, MC: 27, MD: 24, ME: 22,
+    NL: 18, MK: 19, NO: 15, PK: 24, PS: 29, PL: 28, PT: 25, QA: 29, RO: 24, LC: 32, SM: 27, SA: 24,
+    RS: 22, SC: 31, SK: 24, SI: 19, ES: 24, SE: 24, CH: 21, TN: 24, TR: 26, UA: 29, AE: 23, GB: 22,
+    VA: 22, VG: 24,
+};
+/** ISO 3166-1 alpha-2 codes, plus XK (Kosovo, user-assigned but in banking use). */
+exports.ISO_3166_ALPHA2 = new Set([
+    "AD", "AE", "AF", "AG", "AI", "AL", "AM", "AO", "AQ", "AR", "AS", "AT", "AU", "AW", "AX", "AZ",
+    "BA", "BB", "BD", "BE", "BF", "BG", "BH", "BI", "BJ", "BL", "BM", "BN", "BO", "BQ", "BR", "BS",
+    "BT", "BV", "BW", "BY", "BZ", "CA", "CC", "CD", "CF", "CG", "CH", "CI", "CK", "CL", "CM", "CN",
+    "CO", "CR", "CU", "CV", "CW", "CX", "CY", "CZ", "DE", "DJ", "DK", "DM", "DO", "DZ", "EC", "EE",
+    "EG", "EH", "ER", "ES", "ET", "FI", "FJ", "FK", "FM", "FO", "FR", "GA", "GB", "GD", "GE", "GF",
+    "GG", "GH", "GI", "GL", "GM", "GN", "GP", "GQ", "GR", "GS", "GT", "GU", "GW", "GY", "HK", "HM",
+    "HN", "HR", "HT", "HU", "ID", "IE", "IL", "IM", "IN", "IO", "IQ", "IR", "IS", "IT", "JE", "JM",
+    "JO", "JP", "KE", "KG", "KH", "KI", "KM", "KN", "KP", "KR", "KW", "KY", "KZ", "LA", "LB", "LC",
+    "LI", "LK", "LR", "LS", "LT", "LU", "LV", "LY", "MA", "MC", "MD", "ME", "MF", "MG", "MH", "MK",
+    "ML", "MM", "MN", "MO", "MP", "MQ", "MR", "MS", "MT", "MU", "MV", "MW", "MX", "MY", "MZ", "NA",
+    "NC", "NE", "NF", "NG", "NI", "NL", "NO", "NP", "NR", "NU", "NZ", "OM", "PA", "PE", "PF", "PG",
+    "PH", "PK", "PL", "PM", "PN", "PR", "PS", "PT", "PW", "PY", "QA", "RE", "RO", "RS", "RU", "RW",
+    "SA", "SB", "SC", "SD", "SE", "SG", "SH", "SI", "SJ", "SK", "SL", "SM", "SN", "SO", "SR", "SS",
+    "ST", "SV", "SX", "SY", "SZ", "TC", "TD", "TF", "TG", "TH", "TJ", "TK", "TL", "TM", "TN", "TO",
+    "TR", "TT", "TV", "TW", "TZ", "UA", "UG", "UM", "US", "UY", "UZ", "VA", "VC", "VE", "VG", "VI",
+    "VN", "VU", "WF", "WS", "XK", "YE", "YT", "ZA", "ZM", "ZW",
+]);
 function validateIban(candidate) {
     const c = candidate.replace(/[\s\-]/g, "").toUpperCase();
     if (c.length < 5 || !/^[A-Z]{2}/.test(c) || !/^\d{2}$/.test(c.slice(2, 4)))
         return false;
-    const ibanLengths = {
-        AL: 28, AD: 24, AT: 20, AZ: 28, BH: 22, BY: 28, BE: 16, BA: 20, BR: 29, BG: 22, CR: 22, HR: 21,
-        CY: 28, CZ: 24, DK: 18, DO: 28, TL: 23, EE: 20, FO: 18, FI: 18, FR: 27, GE: 22, DE: 22, GI: 23,
-        GR: 27, GL: 18, GT: 28, HU: 28, IS: 26, IQ: 23, IE: 22, IL: 23, IT: 27, JO: 30, KZ: 20, XK: 20,
-        KW: 30, LV: 21, LB: 28, LI: 21, LT: 20, LU: 20, MT: 31, MR: 27, MU: 30, MC: 27, MD: 24, ME: 22,
-        NL: 18, MK: 19, NO: 15, PK: 24, PS: 29, PL: 28, PT: 25, QA: 29, RO: 24, LC: 32, SM: 27, SA: 24,
-        RS: 22, SC: 31, SK: 24, SI: 19, ES: 24, SE: 24, CH: 21, TN: 24, TR: 26, UA: 29, AE: 23, GB: 22,
-        VA: 22, VG: 24,
-    };
     const country = c.slice(0, 2);
-    const expected = ibanLengths[country];
+    const expected = exports.IBAN_LENGTHS[country];
     if (expected !== undefined && c.length !== expected)
         return false;
     const rearranged = c.slice(4) + c.slice(0, 4);
@@ -206,13 +231,22 @@ function validateVin(candidate) {
         return false;
     return !/[IOQ]/.test(c);
 }
+/**
+ * BIC/SWIFT structural validation (ISO 9362): BBBB CC LL (PPP).
+ *
+ * Necessary but **not sufficient** — BIC has no check digit, and characters
+ * 5-6 of ordinary uppercase words are frequently valid country codes
+ * (`DRINGEND` -> `GE`, `HOSPITAL` -> `IT`). Emission additionally requires a
+ * registry hit or banking context; see `suppressBicWithoutEvidence`.
+ */
 function validateBic(candidate) {
     const c = candidate.replace(/ /g, "").toUpperCase();
     if (c.length !== 8 && c.length !== 11)
         return false;
     if (!/^[A-Z]{4}/.test(c))
         return false;
-    if (!/^[A-Z]{2}$/.test(c.slice(4, 6)))
+    // Country code must be a real ISO 3166-1 alpha-2 code
+    if (!exports.ISO_3166_ALPHA2.has(c.slice(4, 6)))
         return false;
     if (!/^[A-Z0-9]{2}$/.test(c.slice(6, 8)))
         return false;
@@ -220,6 +254,21 @@ function validateBic(candidate) {
         return false;
     return true;
 }
+/**
+ * International phone number in E.164 form: `+` then 8-15 digits.
+ *
+ * A `+` prefix makes a phone number self-identifying, so this backs a
+ * country-independent pattern: the per-country patterns each hard-code one
+ * grouping and miss the others (`+43 664 8213 907` was invisible because the
+ * Austrian pattern expects an unbroken subscriber number).
+ */
+function validateE164(candidate) {
+    if (!candidate.trimStart().startsWith("+"))
+        return false;
+    // A trunk prefix written as "(0)" is not part of the E.164 digit count.
+    const digits = candidate.replace(/\(\s*0\s*\)/g, "").replace(/\D/g, "");
+    return digits.length >= 8 && digits.length <= 15;
+}
 function validateKvk(candidate) {
     const c = clean(candidate);
     return c.length === 8 && /^\d{8}$/.test(c);
@@ -623,6 +672,35 @@ function validateGreekAmka(candidate) {
     }
     return total % 10 === 0;
 }
+function validateHighEntropy(candidate) {
+    const clean = candidate.trim();
+    if (clean.length < 8)
+        return false;
+    // Short passwords (< 24 chars): require at least 1 letter, 1 digit, 1 special char
+    if (clean.length < 24) {
+        const hasLetter = /[a-zA-Z]/.test(clean);
+        const hasDigit = /\d/.test(clean);
+        const hasSpecial = /[^a-zA-Z0-9]/.test(clean);
+        if (hasLetter && hasDigit && hasSpecial)
+            return true;
+        // For short tokens without special chars, require entropy check
+        if (!hasSpecial && clean.length < 16)
+            return false;
+    }
+    const freq = new Map();
+    for (const ch of clean)
+        freq.set(ch, (freq.get(ch) ?? 0) + 1);
+    const len = clean.length;
+    let entropy = 0;
+    for (const c of freq.values()) {
+        const p = c / len;
+        entropy -= p * Math.log2(p);
+    }
+    // Hex-only strings have max ~4.0 bits entropy, use lower threshold
+    const isHex = /^[a-fA-F0-9]+$/.test(clean);
+    const threshold = isHex ? 3.0 : clean.length < 24 ? 3.0 : 3.5;
+    return entropy >= threshold;
+}
 exports.VALIDATORS = {
     iban: validateIban,
     bsn: validateBsn,
@@ -637,6 +715,7 @@ exports.VALIDATORS = {
     french_nir: validateFrenchNir,
     vin: validateVin,
     bic: validateBic,
+    e164: validateE164,
     kvk: validateKvk,
     swedish_pnr: validateSwedishPnr,
     norwegian_fnr: validateNorwegianFnr,
@@ -666,4 +745,5 @@ exports.VALIDATORS = {
     uk_nhs: validateUkNhs,
     greek_afm: validateGreekAfm,
     greek_amka: validateGreekAmka,
+    high_entropy: validateHighEntropy,
 };

package/dist/cjs/sdk.js

@@ -6,10 +6,10 @@ const normalizer_js_1 = require("./normalizer.js");
 const engine_js_1 = require("./rules/engine.js");
 const types_js_1 = require("./types.js");
 const DATE_TYPES = new Set([types_js_1.EntityType.DOB, types_js_1.EntityType.DATE_OF_DEATH]);
-class PseudonymMapper {
+class ReferentialMapper {
     counters = new Map();
     mapping = new Map();
-    getPseudonym(text, entityType) {
+    getLabel(text, entityType) {
         if (!this.mapping.has(text)) {
             const count = (this.counters.get(entityType) ?? 0) + 1;
             this.counters.set(entityType, count);
@@ -17,13 +17,37 @@ class PseudonymMapper {
         }
         return this.mapping.get(text);
     }
+    clear() {
+        this.counters.clear();
+        this.mapping.clear();
+    }
 }
+const DEFAULT_MAX_INPUT_LENGTH = 10_485_760; // ~10 MB of text
 class EuRedact {
     engine = new engine_js_1.RuleEngine();
     cache = new cache_js_1.ResultCache();
-    pseudonymMapper = new PseudonymMapper();
+    referentialMapper = new ReferentialMapper();
+    maxInputLength;
+    constructor(options) {
+        this.maxInputLength = options?.maxInputLength ?? DEFAULT_MAX_INPUT_LENGTH;
+    }
+    addCustomPattern(name, pattern) {
+        this.engine.addCustomPattern(name, pattern);
+        this.cache.clear();
+    }
+    /** Clear the result cache and referential integrity mappings.
+     *  Call this in long-running processes to free PII from memory. */
+    clear() {
+        this.cache.clear();
+        this.referentialMapper.clear();
+    }
     redact(text, options = {}) {
-        const { countries = null, mode = "rules", pseudonymize = false, detectDates = false, cache = true, } = options;
+        if (text.length > this.maxInputLength) {
+            throw new Error(`Input text length (${text.length.toLocaleString()} chars) exceeds the maximum ` +
+                `(${this.maxInputLength.toLocaleString()} chars). Split the input or ` +
+                `increase maxInputLength when constructing EuRedact.`);
+        }
+        const { countries = null, mode = "rules", referentialIntegrity = false, detectDates = false, cache = true, } = options;
         const [normalizedText, offsetMapping] = (0, normalizer_js_1.normalize)(text);
         const countriesTuple = countries
             ? countries.map(c => c.toUpperCase()).sort()
@@ -51,8 +75,8 @@ class EuRedact {
         let redacted = text;
         for (let i = detections.length - 1; i >= 0; i--) {
             const det = detections[i];
-            const replacement = pseudonymize
-                ? this.pseudonymMapper.getPseudonym(det.text, det.entityType)
+            const replacement = referentialIntegrity
+                ? this.referentialMapper.getLabel(det.text, det.entityType)
                 : `[${det.entityType}]`;
             redacted = redacted.slice(0, det.start) + replacement + redacted.slice(det.end);
         }

package/dist/cjs/types.js

@@ -1,11 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DetectionSource = exports.EntityType = void 0;
+exports.DetectionSource = exports.LEGACY_TYPE_ALIASES = exports.EntityType = void 0;
 var EntityType;
 (function (EntityType) {
     EntityType["NAME"] = "NAME";
     EntityType["ADDRESS"] = "ADDRESS";
-    EntityType["IBAN"] = "IBAN";
+    /**
+     * Canonical name for a bank account identifier. `IBAN` is kept below as a
+     * legacy alias with the same value, so `EntityType.IBAN === EntityType.BANK_ACCOUNT`
+     * and existing code keeps working — but the emitted value, and therefore the
+     * `[BANK_ACCOUNT]` placeholder written into redacted text, is canonical.
+     */
+    EntityType["BANK_ACCOUNT"] = "BANK_ACCOUNT";
+    /** @deprecated legacy alias of {@link EntityType.BANK_ACCOUNT} */
+    EntityType["IBAN"] = "BANK_ACCOUNT";
     EntityType["BIC"] = "BIC";
     EntityType["CREDIT_CARD"] = "CREDIT_CARD";
     EntityType["PHONE"] = "PHONE";
@@ -32,8 +40,17 @@ var EntityType;
     EntityType["GPS_COORDINATES"] = "GPS_COORDINATES";
     EntityType["UUID"] = "UUID";
     EntityType["SOCIAL_HANDLE"] = "SOCIAL_HANDLE";
+    EntityType["SECRET"] = "SECRET";
     EntityType["OTHER"] = "OTHER";
 })(EntityType || (exports.EntityType = EntityType = {}));
+/**
+ * Legacy type names accepted on input and mapped to their canonical form.
+ * Kept in sync with the pipeline canon (config/entity_types.json →
+ * legacy_aliases). The engine never *emits* these names.
+ */
+exports.LEGACY_TYPE_ALIASES = {
+    IBAN: "BANK_ACCOUNT",
+};
 var DetectionSource;
 (function (DetectionSource) {
     DetectionSource["RULES"] = "rules";

package/dist/esm/cache.js

@@ -18,10 +18,10 @@ export class ResultCache {
     key(text, countries, mode) {
         const sorted = [...countries].sort();
         const raw = `${text}|${sorted.join("|")}|${mode}`;
-        // Use multiple FNV-1a hashes on different slices for reduced collisions
+        // Include raw length to reduce collision risk alongside dual FNV-1a hashes
         const h1 = fnv1aHash(raw);
         const h2 = fnv1aHash(raw.slice(Math.floor(raw.length / 2)) + raw.slice(0, Math.floor(raw.length / 2)));
-        return h1 + h2;
+        return `${raw.length}:${h1}${h2}`;
     }
     get(key) {
         if (!this.enabled)

package/dist/esm/index.d.ts

@@ -1,9 +1,12 @@
-export { EntityType, DetectionSource } from "./types.js";
+export { EntityType, DetectionSource, LEGACY_TYPE_ALIASES } from "./types.js";
 export type { Detection, RedactResult, PatternDef, CountryConfig } from "./types.js";
 export { EuRedact, type RedactOptions } from "./sdk.js";
 export { COUNTRY_CONFIGS } from "./rules/countries/index.js";
+export { setBicRegistry, getBicRegistry, SEED_BIC6_PREFIXES, type BicRegistryProvider } from "./rules/bicRegistry.js";
 import { type RedactOptions } from "./sdk.js";
 import type { RedactResult } from "./types.js";
 export declare function availableCountries(): string[];
 export declare function redact(text: string, options?: RedactOptions): RedactResult;
+export declare function addCustomPattern(name: string, pattern: string): void;
+export declare function clear(): void;
 export declare function redactBatch(texts: string[], options?: RedactOptions): RedactResult[];