euredact 0.3.7 → 0.3.9

package/dist/esm/rules/suppressors.js

@@ -40,11 +40,16 @@ const MATH_AFTER = /^\s*[=+\-×÷*/]/;
 const COUNTRY_PREFIX_HYPHEN = /(?:^|[^A-Za-z0-9])[A-Z]{1,2}-\s*$/;
 const SEQUENTIAL_PATTERNS = /^(?:0{6,}|1234567890?|0123456789|9876543210?|1111111111?|000000000|123456789)$/;
 // YEAR_PATTERN kept for reference but replaced by RECENT_YEAR in suppressYearAsPostal
-// The leading \b is load-bearing. Without it the short alternatives match the
-// *tail* of an ordinary word: "NIS" matched "tālru**nis** ", the Latvian for
-// "telephone", so every Latvian phone number was suppressed as though it sat
-// behind a Belgian national-ID label. 653 misses from a missing word boundary.
-const ID_LABEL_BEFORE = /\b(?:BSN|RR|NN|NIR|INSZ|NISS|NIS|Steuer-?ID|TIN|NIF|NIE|SSN|rijksregisternummer|numéro\s*national|national\s*number|matricule|Ausweisnummer|Personalausweis|Versichertennummer|KVNR|KV-Nr|Steuernummer|St\.\-Nr|StNr|Finanzamt\s+ist|Ondernemingen\s+onder\s+nummer|ondernemingsnummer|numéro\s*d'entreprise|enterprise\s*number|Kruispuntbank)\s*[:.]?\s*$/i;
+// `ID_LABEL_BEFORE` and `suppressPhoneAfterIdLabel` lived here. Their labels are
+// now typed entries in `cues.ts`, and a phone-shaped span behind one is
+// *relabelled* rather than dropped.
+//
+// Dropping was the wrong verb. The span is found either way, so removing the
+// claim decided only whether the value was masked — and the answer was "no":
+// "Rijksregisternummer: 85.03.19-284.73" produced no detection at all, a
+// redaction library printing in full an identifier it had recognised and
+// rejected. The 653-miss word-boundary lesson recorded here moved with the
+// labels; see the module comment in `cues.ts`.
 const SERVICE_NUMBER = /^0800[\-\s]/;
 const DATE_PATTERN_FULL = /^\d{2}[-/.]\d{2}[-/.]\d{4}$|^\d{4}[-/.]\d{2}[-/.]\d{2}$/;
 const PASSPORT_CONTEXT_BEFORE = /(?:Reisepass|passport|passeport|paspoort|Bisheriger\s+Reisepass)\s*(?:Nr\.?|Nummer|nummer|number|n[°o])?\s*[:.]?\s*$/i;
@@ -338,11 +343,52 @@ function suppressYearAsPostal(text, match) {
     // Suppress: recent years without postal context are almost never postal codes
     return true;
 }
-function suppressPhoneAfterIdLabel(text, match) {
-    if (match.patternDef.entityType !== EntityType.PHONE)
+// ── Postal code: disqualified by the word in front of it ───────────────
+//
+// The mirror image of `rules/cues.ts`. There a label promotes a type; here a
+// word refuses one. Both were reported together: a bare four-digit run becomes
+// a POSTAL_CODE as soon as *any* real postal code establishes the country,
+// which is to say in almost every real document, because POSTAL_CONTEXT_NEAR
+// above then rescues it from suppressYearAsPostal. Measured on the training
+// corpus: 55 bare years in prose ("Opgericht in 2016", "Fondée en 2017") plus
+// telephone extensions ("(toest. 3841)", "(poste interne 3318)", "(ext. 2219)").
+/**
+ * Prepositions that can only be temporal. Nothing is ever located "since 2018",
+ * so these disqualify a postal code on their own.
+ */
+const YEAR_WORD_BEFORE = /(?<![A-Za-z0-9_])(?:sinds|since|depuis|seit|siden|sedan|desde|vuonna|anno|dal)\s+$/i;
+/**
+ * "in", "en" and "im" are *both* temporal and locative, and in exactly the
+ * countries whose postal codes are year-shaped. Belgian 2000 is Antwerp and
+ * 2018 is one of its districts, so "Rustige ligging in 2018, vlakbij openbaar
+ * vervoer" is an address, not a date — an earlier version of this rule
+ * suppressed it and lost a real postal code, which is the worse error for a
+ * redaction tool. So an ambiguous preposition needs a founding or payment
+ * participle in front of it, which is what every case in the report had:
+ * "Opgericht in 2016", "Fondée en 2017", "versé en 2025".
+ */
+const YEAR_VERB_BEFORE = /(?<![A-Za-z0-9_])(?:opgericht|gesticht|opgestart|founded|established|created|fond[ée]e?|cr[ée][ée]e?|gegründet|gegruendet|errichtet|grundlagt|grundad|perustettu|fundada|fundado|fondata|costituita|vers[ée]|betaald|uitbetaald|ausgezahlt|paid|geboren|born)\s+(?:in|en|im|op|the)\s+$/i;
+/**
+ * A capitalised word immediately after keeps the candidate: "in 2000 Antwerpen"
+ * really is a postal code, and so is the "AZ" of a Dutch "1105 AZ". Without
+ * this the rule would suppress the very addresses it is meant to leave alone.
+ */
+const TOWN_AFTER = /^\s*[A-ZÀ-ÞĀ-Ž]/;
+/**
+ * A telephone extension marker. "poste interne 3318" puts one qualifier word
+ * between the marker and the number, so allow exactly one.
+ */
+const EXTENSION_BEFORE = /(?<![A-Za-z0-9_])(?:toest(?:el)?|ext|extension|poste|durchwahl|doorkiesnummer|tst|nebenstelle)\.?\s*(?:[a-zà-ÿ]{2,10}\s*)?[:.]?\s*$/i;
+/** Suppress a postal code the word in front of it rules out. */
+function suppressPostalAfterDisqualifyingWord(text, match) {
+    if (match.patternDef.entityType !== EntityType.POSTAL_CODE)
         return false;
-    const [before] = getContext(text, match.start, match.end);
-    return ID_LABEL_BEFORE.test(before);
+    const before = text.slice(Math.max(0, match.start - 24), match.start);
+    if (EXTENSION_BEFORE.test(before))
+        return true;
+    return RECENT_YEAR.test(match.text.trim())
+        && (YEAR_WORD_BEFORE.test(before) || YEAR_VERB_BEFORE.test(before))
+        && !TOWN_AFTER.test(text.slice(match.end, match.end + 3));
 }
 function suppressPhoneServiceNumber(_text, match) {
     if (match.patternDef.entityType !== EntityType.PHONE)
@@ -788,11 +834,11 @@ function suppressRequiresContext(text, match) {
     return !match.patternDef.contextKeywords.some(kw => context.includes(kw.toLowerCase()));
 }
 const TYPE_SUPPRESSORS = {
-    [EntityType.PHONE]: [suppressCurrency, suppressUnits, suppressReference, suppressMath, suppressPhoneAfterIdLabel, suppressPhoneServiceNumber, suppressPhoneDateOverlap, suppressPhoneAsNumberRange],
+    [EntityType.PHONE]: [suppressCurrency, suppressUnits, suppressReference, suppressMath, suppressPhoneServiceNumber, suppressPhoneDateOverlap, suppressPhoneAsNumberRange],
     [EntityType.NATIONAL_ID]: [suppressCurrency, suppressUnits, suppressReference, suppressLegal, suppressMath, suppressNatidAsPassport, suppressSeNatidAsOrg],
     [EntityType.SSN]: [suppressCurrency, suppressUnits, suppressReference, suppressMath],
     [EntityType.TAX_ID]: [suppressCurrency, suppressUnits, suppressReference, suppressMath, suppressTaxidAsIpAddress],
-    [EntityType.POSTAL_CODE]: [suppressCurrency, suppressUnits, suppressMath, suppressLegal, suppressYearAsPostal, suppressPostalInsideIban, suppressPostalAsHouseNumber, suppressPostalInLongerIdentifier, suppressReference],
+    [EntityType.POSTAL_CODE]: [suppressCurrency, suppressUnits, suppressMath, suppressLegal, suppressYearAsPostal, suppressPostalAfterDisqualifyingWord, suppressPostalInsideIban, suppressPostalAsHouseNumber, suppressPostalInLongerIdentifier, suppressReference],
     [EntityType.BIC]: [suppressBicWithoutEvidence],
     [EntityType.BANK_ACCOUNT]: [suppressReference],
     [EntityType.LICENSE_PLATE]: [suppressPlateInCompound, suppressDePlateUnknownDistrict, suppressPlateAsCurrencyAmount],

package/dist/esm/types.d.ts

@@ -32,6 +32,16 @@ export declare enum EntityType {
     HEALTH_INSURANCE = "HEALTH_INSURANCE",
     HEALTHCARE_PROVIDER = "HEALTHCARE_PROVIDER",
     CHAMBER_OF_COMMERCE = "CHAMBER_OF_COMMERCE",
+    /**
+     * Employee, badge or customer number tied to a person.
+     *
+     * Emitted **only** when an explicit label names it — see `rules/cues.ts`.
+     * There is no pattern for an internal identifier because there is no shape
+     * for one; without the label, a digit run is not distinguishable from any
+     * other. The type exists so that a labelled employee number is filed
+     * correctly instead of being claimed by the phone pattern.
+     */
+    INTERNAL_ID = "INTERNAL_ID",
     IMEI = "IMEI",
     GPS_COORDINATES = "GPS_COORDINATES",
     UUID = "UUID",

package/dist/esm/types.js

@@ -33,6 +33,16 @@ export var EntityType;
     EntityType["HEALTH_INSURANCE"] = "HEALTH_INSURANCE";
     EntityType["HEALTHCARE_PROVIDER"] = "HEALTHCARE_PROVIDER";
     EntityType["CHAMBER_OF_COMMERCE"] = "CHAMBER_OF_COMMERCE";
+    /**
+     * Employee, badge or customer number tied to a person.
+     *
+     * Emitted **only** when an explicit label names it — see `rules/cues.ts`.
+     * There is no pattern for an internal identifier because there is no shape
+     * for one; without the label, a digit run is not distinguishable from any
+     * other. The type exists so that a labelled employee number is filed
+     * correctly instead of being claimed by the phone pattern.
+     */
+    EntityType["INTERNAL_ID"] = "INTERNAL_ID";
     EntityType["IMEI"] = "IMEI";
     EntityType["GPS_COORDINATES"] = "GPS_COORDINATES";
     EntityType["UUID"] = "UUID";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "euredact",
-  "version": "0.3.7",
+  "version": "0.3.9",
   "description": "European PII redaction SDK -- fast, zero-dependency, rule-based detection and redaction of personal data across 31 European countries",
   "homepage": "https://euredact.dev",
   "license": "Apache-2.0",