euredact 0.2.0 → 0.3.1

package/dist/esm/normalizer.js

@@ -5,27 +5,25 @@ export function normalize(text) {
     return [normalized, buildOffsetMapping(text, normalized)];
 }
 function buildOffsetMapping(original, normalized) {
-    const nfdOriginal = original.normalize("NFD");
-    const nfdNormalized = normalized.normalize("NFD");
-    // Build: normalized index -> original index via NFD as intermediate
+    // Precompute cumulative NFD lengths for normalized characters
+    const normNfdCum = [0];
+    for (let i = 0; i < normalized.length; i++) {
+        normNfdCum.push(normNfdCum[i] + normalized[i].normalize("NFD").length);
+    }
+    // Precompute cumulative NFD lengths for original characters
+    const origNfdCum = [0];
+    for (let i = 0; i < original.length; i++) {
+        origNfdCum.push(origNfdCum[i] + original[i].normalize("NFD").length);
+    }
+    // Two-pointer scan: map each normalized position to its original position
     const normToOrig = [];
+    let origPtr = 0;
     for (let normIdx = 0; normIdx < normalized.length; normIdx++) {
-        const nfdOfNormChar = normalized[normIdx].normalize("NFD");
-        let nfdStart = 0;
-        for (let i = 0; i < normIdx; i++) {
-            nfdStart += normalized[i].normalize("NFD").length;
-        }
-        let targetOrig = 0;
-        let running = 0;
-        for (let oi = 0; oi < original.length; oi++) {
-            const nfdOc = original[oi].normalize("NFD");
-            if (running + nfdOc.length > nfdStart) {
-                targetOrig = oi;
-                break;
-            }
-            running += nfdOc.length;
+        const nfdStart = normNfdCum[normIdx];
+        while (origPtr + 1 < original.length && origNfdCum[origPtr + 1] <= nfdStart) {
+            origPtr++;
         }
-        normToOrig.push(targetOrig);
+        normToOrig.push(origPtr);
     }
     return normToOrig;
 }

package/dist/esm/rules/bicRegistry.d.ts

@@ -0,0 +1,50 @@
+/**
+ * BIC registry — tier-1 membership testing for ISO 9362 bank identifier codes.
+ *
+ * BIC is the only bank identifier in the supported set with **no check digit**
+ * (IBAN has mod-97, VAT has country-specific checksums). Structure alone cannot
+ * separate a genuine BIC from an ordinary 8- or 11-character uppercase word,
+ * because characters 5-6 of everyday words are frequently valid ISO 3166
+ * country codes (`DRINGEND` -> `GE`, `HOSPITAL` -> `IT`). Registry membership
+ * is therefore the strongest precision signal available.
+ *
+ * Two sources are consulted, in order:
+ *
+ * 1. A deployment-supplied registry, installed via {@link setBicRegistry}.
+ *    This is the path for anyone holding a licensed directory (SWIFTRef).
+ * 2. {@link SEED_BIC6_PREFIXES} — a small bundled set of institution+country
+ *    prefixes for major European banks, compiled from publicly published bank
+ *    data. No licensed directory is bundled.
+ *
+ * Matching is on the **BIC6 prefix** (4-letter institution + 2-letter country),
+ * so any location and branch code on a known institution is accepted. The
+ * prefix is the stable part of a BIC; branch codes churn as branches open and
+ * close.
+ *
+ * The registry is used as an *accept* signal, never as a filter: a candidate
+ * that misses it falls through to the context gate in `suppressors.ts` and is
+ * still detected when banking context is present. A stale list therefore costs
+ * a little recall on bare, contextless BICs — it never causes a leak. Annual
+ * review is sufficient.
+ */
+export declare const SEED_BIC6_PREFIXES: ReadonlySet<string>;
+/** A membership test over BIC8/BIC11 codes or bare BIC6 prefixes. */
+export type BicRegistryProvider = (bic: string) => boolean;
+/**
+ * Install a deployment-supplied BIC registry, consulted ahead of the seed list.
+ *
+ * Accepts a membership callable, any iterable of BIC strings, or `null` to
+ * remove a previously installed registry. Entries may be full BIC8/BIC11 codes
+ * or bare BIC6 prefixes; both are matched, case-insensitively and ignoring
+ * spaces.
+ */
+export declare function setBicRegistry(registry: BicRegistryProvider | Iterable<string> | null): void;
+/** Return the installed registry provider, or null if none is installed. */
+export declare function getBicRegistry(): BicRegistryProvider | null;
+/**
+ * Tier 1: is `candidate` a BIC of a known institution?
+ *
+ * Checks the deployment-supplied registry first (full code, then BIC6 prefix),
+ * then the bundled seed prefixes.
+ */
+export declare function isRegisteredBic(candidate: string): boolean;

package/dist/esm/rules/bicRegistry.js

@@ -0,0 +1,233 @@
+/**
+ * BIC registry — tier-1 membership testing for ISO 9362 bank identifier codes.
+ *
+ * BIC is the only bank identifier in the supported set with **no check digit**
+ * (IBAN has mod-97, VAT has country-specific checksums). Structure alone cannot
+ * separate a genuine BIC from an ordinary 8- or 11-character uppercase word,
+ * because characters 5-6 of everyday words are frequently valid ISO 3166
+ * country codes (`DRINGEND` -> `GE`, `HOSPITAL` -> `IT`). Registry membership
+ * is therefore the strongest precision signal available.
+ *
+ * Two sources are consulted, in order:
+ *
+ * 1. A deployment-supplied registry, installed via {@link setBicRegistry}.
+ *    This is the path for anyone holding a licensed directory (SWIFTRef).
+ * 2. {@link SEED_BIC6_PREFIXES} — a small bundled set of institution+country
+ *    prefixes for major European banks, compiled from publicly published bank
+ *    data. No licensed directory is bundled.
+ *
+ * Matching is on the **BIC6 prefix** (4-letter institution + 2-letter country),
+ * so any location and branch code on a known institution is accepted. The
+ * prefix is the stable part of a BIC; branch codes churn as branches open and
+ * close.
+ *
+ * The registry is used as an *accept* signal, never as a filter: a candidate
+ * that misses it falls through to the context gate in `suppressors.ts` and is
+ * still detected when banking context is present. A stale list therefore costs
+ * a little recall on bare, contextless BICs — it never causes a leak. Annual
+ * review is sufficient.
+ */
+// BIC6 prefixes (institution + country) of major European institutions,
+// compiled from publicly published bank data — not from a licensed directory.
+// Kept deliberately small: this covers the banks that appear bare and
+// contextless in real documents. Anything outside this list is still detected
+// via the context gate.
+export const SEED_BIC6_PREFIXES = new Set([
+    // --- Netherlands ---
+    "ABNANL", // ABN AMRO
+    "INGBNL", // ING
+    "RABONL", // Rabobank
+    "SNSBNL", // SNS Bank
+    "TRIONL", // Triodos
+    "BUNQNL", // bunq
+    "KNABNL", // Knab
+    "ASNBNL", // ASN Bank
+    "RBRBNL", // RegioBank
+    "FVLBNL", // Van Lanschot
+    "BITSNL", // BinckBank
+    "DEUTNL", // Deutsche Bank NL
+    // --- Belgium ---
+    "BBRUBE", // BNP Paribas Fortis
+    "GEBABE", // BNP Paribas Fortis (legacy)
+    "KREDBE", // KBC
+    "GKCCBE", // Belfius
+    "BPOTBE", // bpost bank
+    "ARSPBE", // Argenta
+    "AXABBE", // AXA Bank Belgium
+    "CREGBE", // Belfius (legacy)
+    "NICABE", // Crelan
+    "TRIOBE", // Triodos Belgium
+    "CTBKBE", // Banca Monte Paschi Belgio
+    "JVBABE", // Van Breda
+    // --- Germany ---
+    "DEUTDE", // Deutsche Bank
+    "COBADE", // Commerzbank
+    "PBNKDE", // Postbank
+    "GENODE", // Volksbanken / Raiffeisen
+    "MALADE", // Sparkassen
+    "HELADE", // Helaba / Sparkassen
+    "BYLADE", // BayernLB / Sparkassen
+    "SOLADE", // Sparkassen (Baden-Wurttemberg)
+    "WELADE", // Sparkassen (Westfalen)
+    "NOLADE", // Norddeutsche Landesbank
+    "SPKKDE", // Sparkasse
+    "HYVEDE", // UniCredit / HypoVereinsbank
+    "DRESDE", // Dresdner (legacy Commerzbank)
+    "INGDDE", // ING-DiBa
+    "NTSBDE", // N26
+    "SFRTDE", // Sutor / fintech BaaS
+    "TEDADE", // Telda / BaaS
+    // --- France ---
+    "BNPAFR", // BNP Paribas
+    "SOGEFR", // Societe Generale
+    "AGRIFR", // Credit Agricole
+    "CCBPFR", // Banque Populaire
+    "CEPAFR", // Caisse d'Epargne
+    "CMCIFR", // Credit Mutuel / CIC
+    "PSSTFR", // La Banque Postale
+    "BREDFR", // BRED Banque Populaire
+    "CRLYFR", // LCL
+    "HSBCFR", // HSBC France
+    "TRZOFR", // Treezor
+    "QNTOFR", // Qonto
+    // --- Austria ---
+    "GIBAAT", // Erste Bank / Sparkassen
+    "BKAUAT", // UniCredit Bank Austria
+    "RZBAAT", // Raiffeisen Bank International
+    "RLNWAT", // Raiffeisen NO-Wien
+    "OBKLAT", // Oberbank
+    "BAWAAT", // BAWAG P.S.K.
+    "VBOEAT", // Volksbank
+    "HYPTAT", // Hypo Tirol
+    "SPIHAT", // Sparkasse
+    // --- Luxembourg ---
+    "BCEELU", // Banque et Caisse d'Epargne de l'Etat
+    "BILLLU", // Banque Internationale a Luxembourg
+    "BGLLLU", // BGL BNP Paribas
+    "CCRALU", // Banque Raiffeisen
+    "BLUXLU", // Banque de Luxembourg
+    // --- Ireland / UK ---
+    "AIBKIE", // Allied Irish Banks
+    "BOFIIE", // Bank of Ireland
+    "ULSBIE", // Ulster Bank
+    "CITIIE", // Citibank Ireland
+    "BARCGB", // Barclays
+    "HBUKGB", // HSBC UK
+    "MIDLGB", // HSBC (legacy Midland)
+    "LOYDGB", // Lloyds
+    "NWBKGB", // NatWest
+    "RBOSGB", // Royal Bank of Scotland
+    "TSBSGB", // TSB
+    "REVOGB", // Revolut
+    "MONZGB", // Monzo
+    "STARGB", // Starling
+    "CHASGB", // JP Morgan Chase UK
+    // --- Nordics ---
+    "NDEADK", // Nordea Denmark
+    "DABADK", // Danske Bank
+    "JYBADK", // Jyske Bank
+    "SYBKDK", // Sydbank
+    "NDEASE", // Nordea Sweden
+    "ESSESE", // SEB
+    "HANDSE", // Handelsbanken
+    "SWEDSE", // Swedbank
+    "DNBANO", // DNB
+    "NDEANO", // Nordea Norway
+    "NDEAFI", // Nordea Finland
+    "OKOYFI", // OP Corporate Bank
+    "HELSFI", // Aktia
+    "NBIIIS", // Landsbankinn (NBIIISRE)
+    "ESJAIS", // Arion Bank (ESJAISRE)
+    "GLITIS", // Islandsbanki (GLITISRE)
+    "MPBAIS", // Kvika banki (MPBAISRE)
+    "KBNONO", // BNbank ASA (KBNONO22)
+    "PRBONO", // Boligbanken ASA (PRBONO22)
+    "AARBDE", // Aareal Bank AG (AARBDE5W)
+    // --- Southern / Central Europe ---
+    "UNCRIT", // UniCredit Italy
+    "BCITIT", // Intesa Sanpaolo
+    "PASCIT", // Monte dei Paschi
+    "BPMOIT", // Banco BPM
+    "CRPPIT", // Cassa di Risparmio
+    "BSCHES", // Banco Santander
+    "BBVAES", // BBVA
+    "CAIXES", // CaixaBank
+    "SABBES", // Banco Sabadell
+    "BKBKES", // Bankinter
+    "BCOMPT", // Millennium BCP
+    "CGDIPT", // Caixa Geral de Depositos
+    "BPIPPT", // Banco BPI
+    "NOVBPT", // Novo Banco
+    "BPKOPL", // PKO Bank Polski
+    "BREXPL", // mBank
+    "INGBPL", // ING Bank Slaski
+    "WBKPPL", // Santander Bank Polska
+    "KOMBCZ", // Komercni banka
+    "CEKOCZ", // CSOB
+    "GIBACZ", // Ceska sporitelna
+    "TATRSK", // Tatra banka
+    "SUBASK", // Vseobecna uverova banka
+    "GIBASK", // Slovenska sporitelna
+    "OTPVHU", // OTP Bank
+    "BUDAHU", // Budapest Bank
+    "MKKBHU", // MKB Bank
+    // --- Switzerland ---
+    "UBSWCH", // UBS
+    "CRESCH", // Credit Suisse
+    "POFICH", // PostFinance
+    "ZKBKCH", // Zurcher Kantonalbank
+    "RAIFCH", // Raiffeisen Switzerland
+    "MIGRCH", // Migros Bank
+]);
+let provider = null;
+/**
+ * Install a deployment-supplied BIC registry, consulted ahead of the seed list.
+ *
+ * Accepts a membership callable, any iterable of BIC strings, or `null` to
+ * remove a previously installed registry. Entries may be full BIC8/BIC11 codes
+ * or bare BIC6 prefixes; both are matched, case-insensitively and ignoring
+ * spaces.
+ */
+export function setBicRegistry(registry) {
+    if (registry === null) {
+        provider = null;
+        return;
+    }
+    if (typeof registry === "function") {
+        provider = registry;
+        return;
+    }
+    const known = new Set();
+    for (const entry of registry) {
+        const e = String(entry).trim();
+        if (e && !e.startsWith("#"))
+            known.add(e.replace(/ /g, "").toUpperCase());
+    }
+    provider = (bic) => known.has(bic);
+}
+/** Return the installed registry provider, or null if none is installed. */
+export function getBicRegistry() {
+    return provider;
+}
+/**
+ * Tier 1: is `candidate` a BIC of a known institution?
+ *
+ * Checks the deployment-supplied registry first (full code, then BIC6 prefix),
+ * then the bundled seed prefixes.
+ */
+export function isRegisteredBic(candidate) {
+    const c = candidate.replace(/ /g, "").toUpperCase();
+    if (c.length !== 8 && c.length !== 11)
+        return false;
+    const prefix = c.slice(0, 6);
+    if (provider !== null) {
+        try {
+            if (provider(c) || provider(prefix))
+                return true;
+        }
+        catch {
+            // a broken provider must not break detection
+        }
+    }
+    return SEED_BIC6_PREFIXES.has(prefix);
+}

package/dist/esm/rules/countries/index.js

@@ -1,4 +1,24 @@
 import { EntityType } from "../../types.js";
+import { IBAN_LENGTHS } from "../validators.js";
+/**
+ * Build a country-independent IBAN pattern from the ISO 13616 length table.
+ *
+ * An IBAN carries its own country code and a mod-97 checksum, so it is
+ * self-identifying and must never depend on the caller's `countries` setting —
+ * a Belgian account in an Austrian file is still an account.
+ *
+ * Each alternative pins the *exact* character count for its country, which
+ * stops the match absorbing a following word: without it, greedy matching
+ * turns `BE68 5390 0754 7034 KBC` into one over-long candidate that fails
+ * mod-97 and is lost entirely.
+ */
+function buildIbanPattern() {
+    const alternatives = Object.entries(IBAN_LENGTHS)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([code, length]) => `${code}\\d{2}(?:[ \\-]?[A-Z0-9]){${length - 4}}`);
+    return String.raw `\b(?:` + alternatives.join("|") + String.raw `)\b`;
+}
+const GENERIC_IBAN = buildIbanPattern();
 /**
  * Helper to create a PatternDef with sensible defaults.
  */
@@ -6,6 +26,45 @@ function p(entityType, pattern, validator = null, description = "", contextKeywo
     return { entityType, pattern, validator, description, contextKeywords, requiresContext };
 }
 // ---------------------------------------------------------------------------
+// Secret context keywords (consolidated, reused across SECRET patterns)
+// ---------------------------------------------------------------------------
+const SECRET_CONTEXT = [
+    // English
+    "key", "token", "secret", "password", "credential",
+    "api_key", "apikey", "api-key", "auth", "bearer",
+    "aws_secret_access_key", "access_key", "private_key",
+    "AES_KEY", "ENCRYPTION_KEY", "SIGNING_KEY",
+    "ACCOUNT_SID", "AUTH_TOKEN", "TWILIO",
+    "RAILS_SECRET", "SECRET_KEY_BASE", "DATABASE_URL",
+    "NPM_TOKEN", "DIGITALOCEAN", "GOOGLE_API",
+    "DB_PASS", "DB_PASSWORD", "DATASOURCE_PASSWORD",
+    "JWT_SIGNING", "passwd", "DISCORD_TOKEN",
+    // Dutch
+    "wachtwoord", "sleutel", "geheim",
+    // French
+    "mot de passe", "mot_de_passe", "clé", "jeton",
+    // German
+    "Passwort", "Kennwort", "Schlüssel", "Geheimnis",
+    // Italian
+    "chiave", "segreto",
+    // Spanish
+    "contraseña", "clave",
+    // Portuguese
+    "senha", "chave",
+    // Polish
+    "hasło", "klucz",
+    // Czech/Slovak
+    "heslo", "kľúč",
+    // Hungarian
+    "jelszó", "kulcs",
+    // Romanian
+    "parola",
+    // Nordic
+    "lösenord", "nøkkel", "nyckel", "avain", "lykill",
+    // Greek
+    "κωδικός",
+];
+// ---------------------------------------------------------------------------
 // DOB context keywords (reused across SHARED patterns)
 // ---------------------------------------------------------------------------
 const DOB_CONTEXT = [
@@ -33,8 +92,28 @@ const SHARED = {
     code: "SHARED",
     name: "Shared EU Patterns",
     patterns: [
-        p(EntityType.EMAIL, String.raw `\b[\w._%+\-]+@[\w.\-]+\.[a-zA-Z]{2,}\b`),
+        // JavaScript's \w and \b are ASCII-only, so the Python engine's \w (which
+        // is Unicode-aware) matched local parts like "petras_ž@..." while this one
+        // did not. \p{L}\p{N} with the `u` flag restores parity; the leading guard
+        // is a Unicode-safe word boundary.
+        p(EntityType.EMAIL, String.raw `(?<![\p{L}\p{N}._%+\-])[\p{L}\p{N}._%+\-]+@(?:[\p{L}\p{N}\-]+\.)+\p{L}{2,}\b`),
+        // IBAN (any country) — structure + mod-97 only. Country-specific IBAN
+        // patterns still exist and win on identical spans; this one guarantees an
+        // IBAN is never missed just because its country was not requested.
+        p(EntityType.BANK_ACCOUNT, GENERIC_IBAN, "iban", "IBAN — any country (ISO 13616, mod-97 validated)"),
+        // International phone (E.164, any country). Runs alongside the per-country
+        // patterns, which each hard-code a single grouping and miss the rest:
+        // "+43 664 8213 907" was invisible to the Austrian pattern, which expects
+        // an unbroken subscriber number. A leading "+" is self-identifying, so
+        // this is deliberately not country-gated.
+        p(EntityType.PHONE, String.raw `\+\d{1,3}(?:[\s\-/]?\(?\d{1,4}\)?){2,7}`, "e164", "International phone number (E.164) — any country"),
         p(EntityType.BIC, String.raw `\b[A-Z]{4}[A-Z]{2}[A-Z0-9]{2}(?:[A-Z0-9]{3})?\b`, "bic"),
+        // Space-separated form: "RZBA AT WW", "NICA BE BB". Written as a separate
+        // pattern requiring a space between *every* group, rather than making the
+        // spaces optional above — optional spaces would let "GEBABEBB KBC" match
+        // as one 11-character code and claim the following word. Only a literal
+        // space is allowed, so a match cannot span a line break.
+        p(EntityType.BIC, String.raw `\b[A-Z]{4} [A-Z]{2} [A-Z0-9]{2}(?: [A-Z0-9]{3})?\b`, "bic", "BIC/SWIFT code (space-separated groups)"),
         p(EntityType.CREDIT_CARD, String.raw `\b(?:4[0-9]{3}[\s\-]?[0-9]{4}[\s\-]?[0-9]{4}[\s\-]?[0-9]{4}|5[1-5][0-9]{2}[\s\-]?[0-9]{4}[\s\-]?[0-9]{4}[\s\-]?[0-9]{4}|3[47][0-9]{2}[\s\-]?[0-9]{6}[\s\-]?[0-9]{5})\b`, "luhn"),
         p(EntityType.VIN, String.raw `\b[A-HJ-NPR-Z0-9]{17}\b`, "vin"),
         p(EntityType.IP_ADDRESS, String.raw `\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b`),
@@ -45,7 +124,7 @@ const SHARED = {
         p(EntityType.IMEI, String.raw `\b\d{2}[\-\s]\d{6}[\-\s]\d{6}[\-\s]\d\b`, "imei", "formatted"),
         p(EntityType.GPS_COORDINATES, String.raw `-?(?:[1-8]?\d(?:\.\d{4,})|90(?:\.0{4,}))\s*[,;/]\s*-?(?:1[0-7]\d(?:\.\d{4,})|180(?:\.0{4,})|\d{1,2}(?:\.\d{4,}))`),
         p(EntityType.UUID, String.raw `\b[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}\b`),
-        p(EntityType.SOCIAL_HANDLE, String.raw `(?<!\w)@[a-zA-Z][a-zA-Z0-9_.]{1,29}\b`),
+        p(EntityType.SOCIAL_HANDLE, String.raw `(?<![\p{L}\p{N}_])@\p{L}[\p{L}\p{N}_.]{1,29}\b`),
         // --- Secret / API Key (known prefixes — always active) ---
         p(EntityType.SECRET, String.raw `\bAKIA[A-Z0-9]{16}\b`, null, "AWS Access Key ID"),
         p(EntityType.SECRET, String.raw `\bgh[poas]_[a-zA-Z0-9]{36,}\b`, null, "GitHub token"),
@@ -67,35 +146,18 @@ const SHARED = {
         p(EntityType.SECRET, String.raw `\bxapp-\d[\d\-]{20,}`, null, "Slack app numeric token"),
         p(EntityType.SECRET, String.raw `\bxapp-[a-zA-Z0-9\-]{20,}`, null, "Slack app token"),
         p(EntityType.SECRET, String.raw `\bdapi[a-f0-9]{32,}\b`, null, "Databricks PAT"),
+        // Discord bot token (3-segment base64 with numeric first segment)
+        p(EntityType.SECRET, String.raw `\b[MN][A-Za-z0-9]{23,}\.[A-Za-z0-9_\-]{6}\.[A-Za-z0-9_\-]{27,}\b`, null, "Discord bot token"),
+        // PEM private key headers
+        p(EntityType.SECRET, String.raw `-----BEGIN\s(?:RSA\s)?PRIVATE\sKEY-----[\s\S]{0,16384}?-----END\s(?:RSA\s)?PRIVATE\sKEY-----`, null, "PEM private key"),
+        // AWS Secret Access Key (40 chars, base64 with +/ after an AKIA line)
+        p(EntityType.SECRET, String.raw `(?<=aws_secret_access_key\s{0,4}[:=]\s{0,4})[A-Za-z0-9+/]{40}`, null, "AWS Secret Access Key"),
         // --- Secret / API Key (connection strings with embedded credentials) ---
-        p(EntityType.SECRET, String.raw `(?:mongodb|mysql|postgres(?:ql)?|redis|amqp|rabbitmq):\/\/[^\s:]+:[^\s@]+@[^\s]+`, null, "Connection string with credentials"),
+        p(EntityType.SECRET, String.raw `(?:mongodb|mysql|postgres(?:ql)?|redis|amqp|rabbitmq):\/\/[^\s:]{1,256}:[^\s@]{1,256}@[^\s]+`, null, "Connection string with credentials"),
         // --- Secret / API Key (assignment-based: KEY=value or KEY: value) ---
-        p(EntityType.SECRET, String.raw `(?<=[:=] )\S{8,}|(?<=[:=])\S{8,}`, "high_entropy", "Assigned secret value", [
-            "key", "token", "secret", "password", "credential",
-            "api_key", "apikey", "api-key", "auth", "bearer",
-            "aws_secret_access_key", "access_key", "private_key",
-            "wachtwoord", "mot de passe", "Passwort", "Schlüssel",
-            "clé", "sleutel", "lösenord", "hasło", "heslo",
-            "jelszó", "contraseña", "senha", "parola",
-            "AES_KEY", "ENCRYPTION_KEY", "SIGNING_KEY",
-            "ACCOUNT_SID", "AUTH_TOKEN", "TWILIO",
-            "RAILS_SECRET", "SECRET_KEY_BASE", "DATABASE_URL",
-            "NPM_TOKEN", "DIGITALOCEAN", "GOOGLE_API",
-            "kľúč", "nøkkel", "nyckel", "avain", "lykill",
-            "DB_PASS", "DB_PASSWORD", "DATASOURCE_PASSWORD",
-            "JWT_SIGNING", "SIGNING_KEY",
-            "passwd", "Kennwort",
-        ], true),
+        p(EntityType.SECRET, String.raw `(?<=[:=] )\S{8,}|(?<=[:=])\S{8,}`, "high_entropy", "Assigned secret value", SECRET_CONTEXT, true),
         // --- Secret / API Key (entropy-based fallback for longer tokens) ---
-        p(EntityType.SECRET, String.raw `\b[A-Za-z0-9_\-+/]{24,}[A-Za-z0-9_\-+/=]*\b`, "high_entropy", "High-entropy token", [
-            "key", "token", "secret", "password", "credential",
-            "api_key", "apikey", "api-key", "auth", "bearer",
-            "aws_secret_access_key", "access_key", "private_key",
-            "wachtwoord", "mot de passe", "Passwort", "Schlüssel",
-            "clé", "sleutel", "lösenord", "hasło", "heslo",
-            "jelszó", "contraseña", "senha", "parola",
-            "kľúč", "nøkkel", "nyckel", "avain", "lykill",
-        ], true),
+        p(EntityType.SECRET, String.raw `\b[A-Za-z0-9_\-+/]{24,}[A-Za-z0-9_\-+/=]*\b`, "high_entropy", "High-entropy token", SECRET_CONTEXT, true),
         p(EntityType.DOB, String.raw `\b(?:0[1-9]|[12][0-9]|3[01])[/.\-](?:0[1-9]|1[0-2])[/.\-](?:19|20)\d{2}\b`, null, "DD/MM/YYYY", DOB_CONTEXT, true),
         p(EntityType.DATE_OF_DEATH, String.raw `\b(?:0[1-9]|[12][0-9]|3[01])[/.\-](?:0[1-9]|1[0-2])[/.\-](?:19|20)\d{2}\b`, null, "", DATE_OF_DEATH_CONTEXT, true),
         p(EntityType.DOB, String.raw `\b(?:19|20)\d{2}[/.\-](?:0[1-9]|1[0-2])[/.\-](?:0[1-9]|[12][0-9]|3[01])\b`, null, "ISO YYYY-MM-DD", DOB_ISO_CONTEXT, true),
@@ -152,7 +214,13 @@ const DE = {
         p(EntityType.PHONE, String.raw `\b0[1-9]\d{1,4}[\s/\-]?\d{3,8}\b`),
         p(EntityType.PHONE, String.raw `\+49\s?\d{2,5}[\s/\-]?\d{3,8}\b`),
         p(EntityType.PASSPORT, String.raw `\b[CFGHJK][0-9A-Z]{8,9}\b`, null, "", ["Reisepass", "passport", "Passnummer", "Reisepassnummer", "Reisepass Nummer", "Reisepass-Nr", "Pass Nr"], true),
-        p(EntityType.LICENSE_PLATE, String.raw `\b[A-ZÄÖÜ]{1,3}[\s\-]?[A-Z]{1,2}[\s\-]?\d{1,4}[EH]?\b`),
+        // The separator after the city code is mandatory. When it was optional, a
+        // contiguous letter run split across both groups and the hyphen was
+        // consumed as the *second* separator, so any "LETTERS-DIGITS" token
+        // matched: ICD-10 parsed as city "IC" + letters "D" + "-" + "10", and
+        // ISO-9001, COVID-19, RFC-2822, POL-2025 likewise. A real plate always
+        // separates the city code: "B-AB 1234", "M-XY 99".
+        p(EntityType.LICENSE_PLATE, String.raw `\b[A-ZÄÖÜ]{1,3}[\s\-][A-Z]{1,2}[\s\-]?\d{1,4}[EH]?\b`),
         p(EntityType.POSTAL_CODE, String.raw `\b\d{5}\b`, null, "", ["PLZ", "Postleitzahl", "postal code", "postcode", "Anschrift", "Adresse", "Wohnort", "Ort", "Stadt", "wohnt", "wohnhaft", "Straße", "Str.", "Weg", "Platz", "Allee", "Ring"], true),
         p(EntityType.CHAMBER_OF_COMMERCE, String.raw `\bHR[AB]\s?\d{4,6}\b`),
         p(EntityType.SSN, String.raw `\b\d{2}[\s]?\d{6}[\s]?[A-Z][\s]?\d{3}\b`, null, "", ["Rentenversicherung", "RV-Nummer", "Sozialversicherung", "SV-Nummer", "Versicherungsnummer", "Rentenversicherungsnummer", "Sozialversicherungsnummer"], true),
@@ -169,6 +237,11 @@ const AT = {
         p(EntityType.IBAN, String.raw `\bAT\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
         p(EntityType.VAT, String.raw `\bATU\d{8}\b`),
         p(EntityType.PHONE, String.raw `\b0\d{3,4}[\s\-]?\d{5,8}\b`),
+        // Short area codes (Vienna is "01") split across three groups:
+        // "01 53460 2215". The pattern above requires 3-4 digits after the trunk
+        // 0, so it never matched these. Both separators are mandatory here, which
+        // keeps "01 2025" (a date fragment) out.
+        p(EntityType.PHONE, String.raw `\b0\d{1,4}[\s\-/]\d{3,7}[\s\-/]\d{2,6}\b`, null, "Austrian national phone — short area code, grouped"),
         p(EntityType.PHONE, String.raw `\+43\s?\d{3,4}[\s\-]?\d{5,8}`),
         p(EntityType.LICENSE_PLATE, String.raw `\b[A-ZÄÖÜ]{1,2}\s?\d{1,5}\s?[A-Z]{1,2}\b`, null, "", ["Kennzeichen", "Nummernschild", "Kfz-Kennzeichen"], true),
         p(EntityType.POSTAL_CODE, String.raw `\b[1-9]\d{3}\b`, null, "", ["PLZ", "Postleitzahl", "Adresse", "Anschrift", "Straße", "Str.", "Gasse", "Weg", "Platz", "Postal:", "Wohnort"], true),

package/dist/esm/rules/deDistricts.d.ts

@@ -0,0 +1,16 @@
+/**
+ * German vehicle registration district codes (Unterscheidungszeichen).
+ *
+ * The set is closed: codes are fixed by the Fahrzeug-Zulassungsverordnung and
+ * maintained by the Kraftfahrt-Bundesamt, changing only when a district is
+ * created, merged, or a historic code is reinstated. That makes membership a
+ * usable precision signal — unlike the open-ended blocklist of standards
+ * prefixes it replaces, which only ever catches acronyms someone thought of.
+ *
+ * Used as a **tier**, not a filter: code on this list -> emit; code absent but
+ * a plate cue nearby -> emit; neither -> reject. So a missing code costs
+ * recall only where there is also no cue. Some entries are also standards
+ * prefixes — DIN is Dinslaken as well as the standards body — which is why the
+ * standards guard is kept alongside this one.
+ */
+export declare const DE_DISTRICT_CODES: ReadonlySet<string>;

package/dist/esm/rules/deDistricts.js

@@ -0,0 +1,89 @@
+/**
+ * German vehicle registration district codes (Unterscheidungszeichen).
+ *
+ * The set is closed: codes are fixed by the Fahrzeug-Zulassungsverordnung and
+ * maintained by the Kraftfahrt-Bundesamt, changing only when a district is
+ * created, merged, or a historic code is reinstated. That makes membership a
+ * usable precision signal — unlike the open-ended blocklist of standards
+ * prefixes it replaces, which only ever catches acronyms someone thought of.
+ *
+ * Used as a **tier**, not a filter: code on this list -> emit; code absent but
+ * a plate cue nearby -> emit; neither -> reject. So a missing code costs
+ * recall only where there is also no cue. Some entries are also standards
+ * prefixes — DIN is Dinslaken as well as the standards body — which is why the
+ * standards guard is kept alongside this one.
+ */
+export const DE_DISTRICT_CODES = new Set([
+    "A", "AA", "AB", "ABG", "AC", "AE", "AH", "AIB", "AIC", "AK", "AL", "ALF",
+    "ALS", "ALZ", "AM", "AN", "ANA", "ANG", "ANK", "AP", "APD", "AR", "ARN",
+    "ART", "AS", "ASD", "ASL", "ASZ", "AT", "AU", "AUR", "AW", "AZ", "AZE",
+    "AÖ", "B", "BA", "BAD", "BAR", "BB", "BBG", "BBL", "BC", "BCH", "BD",
+    "BE", "BED", "BEI", "BEL", "BER", "BF", "BG", "BGD", "BGL", "BH", "BI",
+    "BID", "BIN", "BIR", "BIT", "BIW", "BK", "BKS", "BL", "BLB", "BLK", "BM",
+    "BN", "BNA", "BO", "BOG", "BOH", "BOR", "BOT", "BP", "BR", "BRA", "BRB",
+    "BRG", "BRI", "BRK", "BRL", "BRV", "BS", "BSB", "BSK", "BT", "BTF", "BU",
+    "BUL", "BUR", "BW", "BWL", "BYL", "BZ", "BZA", "BÖ", "BÜD", "BÜS", "BÜZ",
+    "C", "CA", "CAS", "CB", "CE", "CHA", "CHL", "CLP", "CLZ", "CO", "COC",
+    "COE", "CR", "CT", "CUX", "CW", "D", "DA", "DAH", "DAN", "DAU", "DB",
+    "DBR", "DD", "DE", "DEG", "DEL", "DG", "DGF", "DH", "DI", "DIL", "DIN",
+    "DIZ", "DKB", "DL", "DLG", "DM", "DN", "DO", "DON", "DS", "DT", "DU",
+    "DUD", "DW", "DZ", "DÜW", "E", "EA", "EB", "EBE", "EBN", "EBS", "ECK",
+    "ED", "EE", "EF", "EG", "EH", "EHI", "EI", "EIC", "EIH", "EIL", "EIN",
+    "EIS", "EL", "EM", "EMD", "EMS", "EN", "ER", "ERB", "ERH", "ERK", "ES",
+    "ESA", "ESB", "ESW", "EU", "EUT", "EW", "F", "FAL", "FB", "FD", "FDB",
+    "FDS", "FEU", "FF", "FFB", "FG", "FH", "FI", "FKB", "FL", "FLÖ", "FN",
+    "FO", "FOR", "FR", "FRG", "FRI", "FRW", "FS", "FT", "FTL", "FW", "FZ",
+    "FÜ", "FÜS", "G", "GA", "GAN", "GAP", "GC", "GD", "GDB", "GE", "GEL",
+    "GEM", "GEO", "GER", "GF", "GG", "GHA", "GHC", "GI", "GK", "GL", "GLA",
+    "GM", "GMN", "GN", "GNT", "GOA", "GOH", "GP", "GR", "GRA", "GRH", "GRI",
+    "GRM", "GRS", "GRZ", "GS", "GT", "GTH", "GUB", "GUN", "GV", "GVM", "GW",
+    "GZ", "GÖ", "GÜ", "H", "HA", "HAB", "HAL", "HAM", "HAS", "HB", "HBN",
+    "HBS", "HC", "HCH", "HD", "HDH", "HDL", "HE", "HEB", "HEF", "HEI", "HEL",
+    "HER", "HET", "HF", "HG", "HGN", "HGW", "HH", "HHM", "HI", "HIG", "HIP",
+    "HK", "HL", "HM", "HMU", "HN", "HO", "HOG", "HOH", "HOL", "HOM", "HOR",
+    "HOT", "HP", "HR", "HRO", "HS", "HSK", "HST", "HU", "HUS", "HV", "HVL",
+    "HW", "HWI", "HX", "HY", "HZ", "HÖS", "HÜN", "IGB", "IK", "IL", "ILL",
+    "IN", "IS", "IZ", "J", "JB", "JE", "JEV", "JL", "JÜL", "K", "KA", "KAR",
+    "KB", "KC", "KE", "KEH", "KEL", "KEM", "KF", "KG", "KH", "KI", "KIB",
+    "KK", "KL", "KLE", "KLT", "KLZ", "KM", "KN", "KO", "KOZ", "KR", "KRU",
+    "KS", "KT", "KU", "KUS", "KW", "KY", "KYF", "KÖN", "KÖT", "KÜN", "L",
+    "LA", "LAN", "LAT", "LAU", "LB", "LBS", "LBZ", "LC", "LD", "LDK", "LDS",
+    "LE", "LEO", "LER", "LEV", "LF", "LG", "LH", "LI", "LIB", "LIF", "LIN",
+    "LIP", "LK", "LL", "LM", "LN", "LOH", "LOS", "LP", "LR", "LS", "LSA",
+    "LSN", "LSZ", "LU", "LUK", "LWL", "LÖ", "LÖB", "LÜD", "LÜN", "M", "MA",
+    "MAB", "MAI", "MAK", "MAL", "MAR", "MB", "MC", "MD", "ME", "MED", "MEG",
+    "MEI", "MEK", "MEL", "MEP", "MER", "MES", "MET", "MG", "MGH", "MGN", "MH",
+    "MHL", "MI", "MIL", "MK", "MKK", "ML", "MM", "MN", "MO", "MOD", "MOL",
+    "MON", "MOS", "MQ", "MR", "MS", "MSP", "MST", "MT", "MTK", "MTL", "MVL",
+    "MW", "MY", "MYK", "MZ", "MZG", "MÜ", "MÜB", "MÜL", "MÜN", "MÜR", "N",
+    "NAB", "NAI", "NAU", "NB", "ND", "NDH", "NE", "NEA", "NEB", "NEC", "NEN",
+    "NES", "NEU", "NEW", "NF", "NH", "NI", "NIB", "NK", "NL", "NM", "NMB",
+    "NMS", "NOH", "NOL", "NOM", "NOR", "NP", "NR", "NRW", "NRÜ", "NT", "NU",
+    "NVP", "NW", "NWM", "NY", "NZ", "NÖ", "OA", "OAL", "OB", "OBB", "OBG",
+    "OC", "OCH", "OD", "OE", "OF", "OG", "OH", "OHA", "OHV", "OHZ", "OK",
+    "OL", "OLD", "OP", "OPR", "OR", "OS", "OSL", "OTT", "OTW", "OVI", "OVL",
+    "OVP", "OZ", "P", "PA", "PAF", "PAN", "PAR", "PB", "PCH", "PE", "PEG",
+    "PER", "PF", "PI", "PIR", "PK", "PL", "PLÖ", "PM", "PN", "PR", "PRÜ",
+    "PS", "PW", "PZ", "QFT", "QLB", "R", "RA", "RC", "RD", "RDG", "RE", "REG",
+    "REH", "REI", "RG", "RH", "RI", "RID", "RIE", "RL", "RM", "RN", "RO",
+    "ROD", "ROF", "ROH", "ROK", "ROL", "ROS", "ROT", "ROW", "RPL", "RS",
+    "RSL", "RT", "RU", "RV", "RW", "RWL", "RY", "RZ", "RÜD", "RÜG", "S", "SA",
+    "SAB", "SAD", "SAL", "SAN", "SAO", "SAW", "SB", "SBG", "SBK", "SC", "SCZ",
+    "SDH", "SDL", "SDT", "SE", "SEB", "SEE", "SEF", "SEL", "SF", "SFA", "SFB",
+    "SFT", "SG", "SGH", "SH", "SHA", "SHG", "SHK", "SHL", "SHS", "SI", "SIG",
+    "SIM", "SK", "SL", "SLE", "SLF", "SLG", "SLK", "SLN", "SLS", "SLZ", "SLÜ",
+    "SM", "SMÜ", "SN", "SNH", "SO", "SOB", "SOG", "SOK", "SOL", "SON", "SP",
+    "SPB", "SPN", "SPR", "SR", "SRB", "SRO", "ST", "STA", "STB", "STD", "STE",
+    "STH", "STL", "STO", "SU", "SUL", "SW", "SWA", "SWZ", "SY", "SZ", "SZB",
+    "SÄK", "SÖM", "SÜW", "TBB", "TE", "TF", "TG", "TGO", "THL", "THW", "TIR",
+    "TO", "TP", "TR", "TS", "TT", "TUT", "TÖL", "TÖN", "TÜ", "UE", "UEM",
+    "UER", "UFF", "UH", "UL", "UM", "UN", "USI", "V", "VAI", "VB", "VEC",
+    "VER", "VIB", "VIE", "VIT", "VK", "VL", "VOF", "VOH", "VR", "VS", "W",
+    "WA", "WAF", "WAK", "WAM", "WAN", "WAR", "WAT", "WB", "WBS", "WD", "WDA",
+    "WE", "WEB", "WEG", "WEI", "WEL", "WEM", "WEN", "WER", "WES", "WF", "WG",
+    "WHV", "WI", "WIL", "WIS", "WIT", "WIZ", "WK", "WL", "WLG", "WM", "WMS",
+    "WN", "WND", "WO", "WOB", "WOH", "WOL", "WOR", "WOS", "WR", "WRN", "WS",
+    "WSF", "WST", "WSW", "WT", "WTL", "WTM", "WUG", "WUM", "WUN", "WUR", "WW",
+    "WZ", "WZL", "WÜ", "X", "Y", "Z", "ZE", "ZEL", "ZI", "ZIG", "ZP", "ZR",
+    "ZS", "ZW", "ZZ", "ÖHR", "ÜB",
+]);

package/dist/esm/rules/engine.d.ts

@@ -1,4 +1,12 @@
 import { type Detection } from "../types.js";
+/**
+ * The country modules use the EU/VAT convention (UK, EL) while the public
+ * contract is ISO 3166-1 alpha-2 (GB, GR). Accept both spellings so a caller
+ * passing correct ISO codes is not punished for it.
+ */
+export declare const COUNTRY_CODE_ALIASES: Record<string, string>;
+/** Map a caller-supplied code to a registered one, or null if unknown. */
+export declare function resolveCountryCode(countryCode: string): string | null;
 export declare class RuleEngine {
     private matcher;
     private loadedCountries;