euredact 0.5.1 → 0.6.0

package/dist/cjs/rules/countries/index.js

@@ -105,18 +105,50 @@ const SECRET_CONTEXT = [
 // ---------------------------------------------------------------------------
 // DOB context keywords (reused across SHARED patterns)
 // ---------------------------------------------------------------------------
+// Every way the documents this engine sees introduce a date of birth.
+//
+// DOB recall was 62.8% -- 33,441 unmasked birth dates -- because this covered
+// seven languages of thirty-one. Eleven countries scored exactly 100% (the
+// listed languages) while twenty sat at 42-51%, which is what proved it was
+// coverage rather than capability (rules-engine#38).
+//
+// Matching is substring, not word-boundary, so every entry was screened against
+// the 29.2-million-character corpus for occurrences inside a longer word. Two
+// were rejected: `fædd` lives inside `fæddur`, and `born` was found inside
+// `gabornagy` and `gabornemeth` -- Hungarian names as e-mail local parts -- so
+// `"born "` with the trailing space is listed instead.
+//
+// DOB_CONTEXT is gone: it was a second, shorter copy missing `nato il`,
+// `nascido`, `geburtstag` and more, so ISO dates were gated on fewer keywords
+// than DD/MM/YYYY ones for no stated reason.
 const DOB_CONTEXT = [
+    // Germanic / Romance -- the original set, kept verbatim.
     "geboren", "geboortedatum", "date de naissance", "né le", "née le",
     "né(e) le", "nee le", "nee(e) le", "date of birth", "DOB",
     "Geburtsdatum", "geboren am", "geboren op", "nascido", "nacido",
     "data di nascita", "nato il", "nata il", "geb.", "geb.datum", "geb ",
     "birth date", "birthday", "naissance", "geboorte", "geburtstag",
-];
-const DOB_ISO_CONTEXT = [
-    "geboren", "geboortedatum", "date de naissance", "né le", "née le",
-    "né(e) le", "nee le", "date of birth", "DOB", "Geburtsdatum",
-    "geboren am", "geboren op", "geb.", "birth date", "birthday",
-    "naissance", "geboorte",
+    // English and Italian forms the list was missing.
+    "born ", "d.o.b", "nato/a il",
+    // Nordic.
+    "født", "fødselsdato", "född", "födelsedatum",
+    "syntynyt", "syntymäaika", "fæddur", "fæðingardagur",
+    // Greek -- Greece and Cyprus.
+    "γεννηθείς", "γεννήθηκε", "ημερομηνία γέννησης",
+    // West Slavic.
+    "urodzony", "urodzona", "data urodzenia",
+    "narozen", "datum narození", "narodený", "dátum narodenia",
+    // Hungarian, Romanian, Bulgarian.
+    "született", "születési", "născut", "născută", "data nașterii",
+    "роден", "родена", "дата на раждане",
+    // South Slavic.
+    "rođen", "rođena", "datum rođenja", "rojen", "rojena", "datum rojstva",
+    // Baltic.
+    "sündinud", "sünniaeg", "dzimis", "dzimusi", "dzimšanas datums",
+    "gimęs", "gimusi", "gimimo data",
+    // Maltese, Irish, Turkish (Cyprus).
+    "twieled", "twieldet", "data tat-twelid",
+    "rugadh", "dáta breithe", "doğum tarihi",
 ];
 const DATE_OF_DEATH_CONTEXT = [
     "overleden", "overlijdensdatum", "date de décès", "décédé le",
@@ -223,7 +255,12 @@ const SHARED = {
         // --- Secret / API Key (connection strings with embedded credentials) ---
         p(types_js_1.EntityType.SECRET, String.raw `(?:mongodb|mysql|postgres(?:ql)?|redis|amqp|rabbitmq):\/\/[^\s:]{1,256}:[^\s@]{1,256}@[^\s]+`, null, "Connection string with credentials"),
         // --- Secret / API Key (assignment-based: KEY=value or KEY: value) ---
-        p(types_js_1.EntityType.SECRET, String.raw `(?<=[:=] )\S{8,}|(?<=[:=])\S{8,}`, "high_entropy", "Assigned secret value", SECRET_CONTEXT, true),
+        // The final character may not be sentence punctuation. `\S` does not stop
+        // at a full stop, so "Reisepass: CA1234567." was claimed as the
+        // ten-character span "CA1234567." -- a passport number plus the sentence's
+        // period, masked as a credential because a "credentials" word sat within
+        // the context window (rules-engine#35).
+        p(types_js_1.EntityType.SECRET, String.raw `(?<=[:=] )\S{7,}[^\s.,;:!?)'"]|(?<=[:=])\S{7,}[^\s.,;:!?)'"]`, "high_entropy", "Assigned secret value", SECRET_CONTEXT, true),
         // --- Secret / API Key (entropy-based fallback for longer tokens) ---
         // Only the *trailing* \b is replaced. It could not match when the token run
         // ended on "-", "+" or "/", so the engine backtracked across two
@@ -241,7 +278,7 @@ const SHARED = {
         p(types_js_1.EntityType.SECRET, String.raw `\b[A-Za-z0-9_\-+/]{24,}[A-Za-z0-9_\-+/=]*(?![A-Za-z0-9_\-+/=])`, "high_entropy", "High-entropy token", SECRET_CONTEXT, true),
         p(types_js_1.EntityType.DOB, String.raw `\b(?:0[1-9]|[12][0-9]|3[01])[/.\-](?:0[1-9]|1[0-2])[/.\-](?:19|20)\d{2}\b`, null, "DD/MM/YYYY", DOB_CONTEXT, true),
         p(types_js_1.EntityType.DATE_OF_DEATH, String.raw `\b(?:0[1-9]|[12][0-9]|3[01])[/.\-](?:0[1-9]|1[0-2])[/.\-](?:19|20)\d{2}\b`, null, "", DATE_OF_DEATH_CONTEXT, true),
-        p(types_js_1.EntityType.DOB, String.raw `\b(?:19|20)\d{2}[/.\-](?:0[1-9]|1[0-2])[/.\-](?:0[1-9]|[12][0-9]|3[01])\b`, null, "ISO YYYY-MM-DD", DOB_ISO_CONTEXT, true),
+        p(types_js_1.EntityType.DOB, String.raw `\b(?:19|20)\d{2}[/.\-](?:0[1-9]|1[0-2])[/.\-](?:0[1-9]|[12][0-9]|3[01])\b`, null, "ISO YYYY-MM-DD", DOB_CONTEXT, true),
     ],
 };
 const NL = {
@@ -251,7 +288,7 @@ const NL = {
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b[0-9]{9}\b`, "bsn"),
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b[0-9]{2,4}\.[0-9]{2,4}\.[0-9]{2,4}\b`, "bsn"),
         p(types_js_1.EntityType.IBAN, String.raw `\bNL\d{2}\s?[A-Z]{4}\s?\d{4}\s?\d{4}\s?\d{2}\b`, "iban"),
-        p(types_js_1.EntityType.VAT, String.raw `\bNL\d{9}B\d{2}\b`, "vat_nl"),
+        p(types_js_1.EntityType.VAT, String.raw `\bNL[\s.]?\d{9}B\d{2}\b`, "vat_nl"),
         p(types_js_1.EntityType.CHAMBER_OF_COMMERCE, String.raw `\b\d{8}\b`, "kvk", "", ["KvK", "Kamer van Koophandel", "kvk-nummer", "KVK-nummer", "handelsregister", "chamber of commerce"], true),
         p(types_js_1.EntityType.PHONE, String.raw `\b0[1-9]\d[\s\-]?\d{3}[\s\-]?\d{4}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b0[1-9]\d{2}[\s\-]?\d{6,7}\b`),
@@ -278,7 +315,7 @@ const BE = {
         p(types_js_1.EntityType.PASSPORT, String.raw `\b[A-Z]{2}\d{6}\b`, null, "", PASSPORT_CONTEXT, true),
         p(types_js_1.EntityType.DRIVERS_LICENSE, String.raw `\b\d{10}\b`, null, "", ["rijbewijs", "permis de conduire", "driving licence", "driving license", "rijbewijsnummer"], true),
         p(types_js_1.EntityType.LICENSE_PLATE, String.raw `\b[12][\-\s]?[A-Z]{3}[\-\s]?\d{3}\b`),
-        p(types_js_1.EntityType.POSTAL_CODE, String.raw `\b[1-9]\d{3}\b`, null, "", ["postcode", "code postal", "postnummer", "postal code", "zip", "B-", "adres", "adresse", "wonende", "woonplaats", "rue", "straat", "laan", "avenue", "boulevard", "plein", "steenweg", "chaussée", "domicilié", "gedomicilieerd", "Levering:", "siège"], true),
+        p(types_js_1.EntityType.POSTAL_CODE, String.raw `\b[1-9]\d{3}\b`, null, "", ["postcode", "code postal", "postnummer", "postal code", "zip", "B-", "adres", "adresse", "wonende", "woonplaats", "domicile", "rue", "straat", "laan", "avenue", "boulevard", "plein", "steenweg", "chaussée", "domicilié", "gedomicilieerd", "Levering:", "siège"], true),
         p(types_js_1.EntityType.POSTAL_CODE, String.raw `(?<=, )[1-9]\d{3}(?= [A-Z])`),
         p(types_js_1.EntityType.HEALTHCARE_PROVIDER, String.raw `\b\d{1}[\-.]?\d{5}[\-.]?\d{2}[\-.]?\d{3}\b`, null, "", ["RIZIV", "INAMI", "arts", "médecin", "zorgverlener", "prestataire", "dokter", "doctor"], true),
     ],
@@ -303,7 +340,7 @@ const DE = {
         // separates the city code: "B-AB 1234", "M-XY 99".
         p(types_js_1.EntityType.LICENSE_PLATE, String.raw `\b[A-ZÄÖÜ]{1,3}[\s\-][A-Z]{1,2}[\s\-]?\d{1,4}[EH]?\b`),
         p(types_js_1.EntityType.POSTAL_CODE, String.raw `\b\d{5}\b`, null, "", ["PLZ", "Postleitzahl", "postal code", "postcode", "Anschrift", "Adresse", "Wohnort", "Ort", "Stadt", "wohnt", "wohnhaft", "Straße", "Str.", "Weg", "Platz", "Allee", "Ring"], true),
-        p(types_js_1.EntityType.CHAMBER_OF_COMMERCE, String.raw `\bHR[AB]\s?\d{4,6}\b`),
+        p(types_js_1.EntityType.CHAMBER_OF_COMMERCE, String.raw `\bHR[AB]\s?\d{4,6}(?:\s[A-Z]\b)?`),
         p(types_js_1.EntityType.SSN, String.raw `\b\d{2}[\s]?\d{6}[\s]?[A-Z][\s]?\d{3}\b`, null, "", ["Rentenversicherung", "RV-Nummer", "Sozialversicherung", "SV-Nummer", "Versicherungsnummer", "Rentenversicherungsnummer", "Sozialversicherungsnummer", "SVNR", "SV-Nr", "RVNR"], true),
         p(types_js_1.EntityType.TAX_ID, String.raw `\b\d{2,3}/\d{3,4}/\d{4,5}\b`, null, "", ["Steuernummer", "St.-Nr", "StNr", "Finanzamt", "Steuer"], true),
         p(types_js_1.EntityType.TAX_ID, String.raw `\b\d{13}\b`, null, "", ["Steuernummer", "St.-Nr", "StNr", "Finanzamt", "Steuer"], true),
@@ -316,7 +353,7 @@ const AT = {
     patterns: [
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b\d{4}\s?\d{6}\b`, "austrian_svnr"),
         p(types_js_1.EntityType.IBAN, String.raw `\bAT\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
-        p(types_js_1.EntityType.VAT, String.raw `\bATU\d{8}\b`),
+        p(types_js_1.EntityType.VAT, String.raw `\bATU[\s.]?\d{8}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b0\d{3,4}[\s\-]?\d{5,8}\b`),
         // Short area codes (Vienna is "01") split across three groups:
         // "01 53460 2215". The pattern above requires 3-4 digits after the trunk
@@ -357,7 +394,7 @@ const FR = {
         p(types_js_1.EntityType.PHONE, String.raw `\+33\s?[1-9][\s.\-]?\d{2}[\s.\-]?\d{2}[\s.\-]?\d{2}[\s.\-]?\d{2}`),
         p(types_js_1.EntityType.PASSPORT, String.raw `\b\d{2}[A-Z]{2}\d{5}\b`, null, "", PASSPORT_CONTEXT, true),
         p(types_js_1.EntityType.LICENSE_PLATE, String.raw `\b[A-Z]{2}[\-\s]?\d{3}[\-\s]?[A-Z]{2}\b`),
-        p(types_js_1.EntityType.POSTAL_CODE, String.raw `\b(?:0[1-9]|[1-8]\d|9[0-5]|97[1-6])\d{3}\b`, null, "", ["code postal", "CP", "postal code", "postcode", "adresse", "domicilié", "résidant", "rue", "avenue", "boulevard", "place", "chemin", "allée", "impasse", "ville"], true),
+        p(types_js_1.EntityType.POSTAL_CODE, String.raw `\b(?:0[1-9]|[1-8]\d|9[0-5]|97[1-6])\d{3}\b`, null, "", ["code postal", "CP", "postal code", "postcode", "adresse", "domicile", "domicilié", "résidant", "rue", "avenue", "boulevard", "place", "chemin", "allée", "impasse", "ville"], true),
         p(types_js_1.EntityType.CHAMBER_OF_COMMERCE, String.raw `\b\d{3}\s?\d{3}\s?\d{3}\b`, null, "", ["SIREN", "siren", "RCS", "entreprise", "immatricul", "numéro d'entreprise", "registre du commerce"], true),
         p(types_js_1.EntityType.CHAMBER_OF_COMMERCE, String.raw `\b\d{3}\s?\d{3}\s?\d{3}\s?\d{5}\b`, null, "", ["SIRET", "siret", "établissement", "immatricul"], true),
         p(types_js_1.EntityType.TAX_ID, String.raw `\b\d{13}\b`, null, "", ["numéro fiscal", "SPI", "référence fiscale", "avis d'impôt", "impôt sur le revenu", "déclaration fiscale", "fiscal"], true),
@@ -390,9 +427,9 @@ const SE = {
         p(types_js_1.EntityType.PHONE, String.raw `\b0\d{1,3}[\-\s]?\d{2,3}[\s]?\d{2,3}[\s]?\d{2}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\+46\s?\d{1,3}[\s\-]?\d{2,3}[\s\-]?\d{2,3}[\s\-]?\d{2}`),
         p(types_js_1.EntityType.LICENSE_PLATE, String.raw `\b[A-Z]{3}\s?\d{2}[A-Z0-9]\b`),
-        p(types_js_1.EntityType.POSTAL_CODE, String.raw `\b\d{3}\s?\d{2}\b`, null, "", ["postnummer", "postort", "postkod", "adress", "bostadsadress", "gatuadress", "boende", "gatan", "vägen", "gata", "väg", "allé", "plats", "torg", "stigen", "Bostadsadress"], true),
-        p(types_js_1.EntityType.POSTAL_CODE, String.raw `\b\d{4}\s\d{2}\b`, null, "", ["postnummer", "postort", "postkod", "adress", "bostadsadress", "gatuadress", "boende", "gatan", "vägen", "gata", "väg", "allé"], true),
-        p(types_js_1.EntityType.POSTAL_CODE, String.raw `\b\d{6}\b`, null, "", ["postnummer", "postort", "postkod", "adress", "bostadsadress", "gatuadress", "boende", "gatan", "vägen", "gata", "väg", "allé"], true),
+        p(types_js_1.EntityType.POSTAL_CODE, String.raw `\b\d{3}\s?\d{2}\b`, null, "", ["postnummer", "postort", "postkod", "adress", "Postal:", "Address:", "bostadsadress", "gatuadress", "boende", "gatan", "vägen", "gata", "väg", "allé", "plats", "torg", "stigen", "Bostadsadress"], true),
+        p(types_js_1.EntityType.POSTAL_CODE, String.raw `\b\d{4}\s\d{2}\b`, null, "", ["postnummer", "postort", "postkod", "adress", "Postal:", "Address:", "bostadsadress", "gatuadress", "boende", "gatan", "vägen", "gata", "väg", "allé"], true),
+        p(types_js_1.EntityType.POSTAL_CODE, String.raw `\b\d{6}\b`, null, "", ["postnummer", "postort", "postkod", "adress", "Postal:", "Address:", "bostadsadress", "gatuadress", "boende", "gatan", "vägen", "gata", "väg", "allé"], true),
         p(types_js_1.EntityType.CHAMBER_OF_COMMERCE, String.raw `\b\d{6}-?\d{4}\b`, null, "", ["organisationsnummer", "org.nr", "org nr", "Bolagsverket", "registreringsnummer"], true),
     ],
 };
@@ -408,7 +445,7 @@ const NO = {
         p(types_js_1.EntityType.PHONE, String.raw `\b[2-9]\d\s?\d{2}\s?\d{2}\s?\d{2}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\+47\s?\d{2}\s?\d{2}\s?\d{2}\s?\d{2}`),
         p(types_js_1.EntityType.LICENSE_PLATE, String.raw `\b[A-Z]{2}\s?\d{5}\b`),
-        p(types_js_1.EntityType.POSTAL_CODE, String.raw `\b\d{4}\b`, null, "", ["postnummer", "poststed", "postnr", "adresse", "bostedsadresse", "gate", "vei", "veien", "gata", "plass", "stien", "allé"], true),
+        p(types_js_1.EntityType.POSTAL_CODE, String.raw `\b\d{4}\b`, null, "", ["postnummer", "poststed", "postnr", "adresse", "bostedsadresse", "gate", "vei", "veien", "gata", "plass", "stien", "allé", "Postal:", "Address:"], true),
     ],
 };
 const FI = {
@@ -417,7 +454,7 @@ const FI = {
     patterns: [
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b\d{6}[-+ABCDEFYXWVU]\d{3}[0-9A-FHJK-NPR-Y]\b`, "finnish_hetu"),
         p(types_js_1.EntityType.IBAN, String.raw `\bFI\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{2}\b`, "iban"),
-        p(types_js_1.EntityType.VAT, String.raw `\bFI\d{8}\b`),
+        p(types_js_1.EntityType.VAT, String.raw `\bFI[\s.]?\d{8}\b`),
         p(types_js_1.EntityType.CHAMBER_OF_COMMERCE, String.raw `\b\d{7}-\d\b`, "finnish_business_id"),
         p(types_js_1.EntityType.PHONE, String.raw `\b0\d{1,2}\s?\d{3,4}\s?\d{3,4}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\+358\s?\d{1,3}[\s\-]?\d{3,4}[\s\-]?\d{3,4}`),
@@ -435,7 +472,7 @@ const IS = {
         p(types_js_1.EntityType.PHONE, String.raw `\b[3-9]\d{6}\b`, null, "", ["sími", "símanúmer", "farsími", "gsm", "phone", "tel", "hringja", "hringdu", "ná í", "nás á", "nás", "SMS", "sent to"], true),
         p(types_js_1.EntityType.PHONE, String.raw `\+354\s?\d{3}\s?\d{4}`),
         p(types_js_1.EntityType.LICENSE_PLATE, String.raw `\b[A-Z]{2}\s?\d{3}\b`, null, "", ["skráningarnúmer", "bílnúmer", "ökutæki", "bifreið", "plata"], true),
-        p(types_js_1.EntityType.POSTAL_CODE, String.raw `\b[1-9]\d{2}\b`, null, "", ["póstnúmer", "póstfang", "staður", "heimilisfang"], true),
+        p(types_js_1.EntityType.POSTAL_CODE, String.raw `\b[1-9]\d{2}\b`, null, "", ["póstnúmer", "póstfang", "staður", "heimilisfang", "Postal:", "Address:"], true),
     ],
 };
 const IT = {
@@ -445,7 +482,7 @@ const IT = {
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b[A-Z]{6}\d{2}[ABCDEHLMPRST]\d{2}[A-Z]\d{3}[A-Z]\b`, "italian_cf"),
         p(types_js_1.EntityType.IBAN, String.raw `\bIT\d{2}\s?[A-Z]\d{3}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{3}\b`, "iban"),
         p(types_js_1.EntityType.IBAN, String.raw `\bIT\d{2}[A-Z]\d{22}\b`, "iban"),
-        p(types_js_1.EntityType.VAT, String.raw `\bIT\d{11}\b`),
+        p(types_js_1.EntityType.VAT, String.raw `\bIT[\s.]?\d{11}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b3\d{2}[\s\-]?\d{3}[\s\-]?\d{4}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b0\d{1,3}[\s\-]?\d{6,8}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b0\d{1,2}[\s\-]\d{3}[\s\-]\d{4}\b`),
@@ -461,7 +498,7 @@ const ES = {
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b\d{8}[A-Z]\b`, "spanish_dni"),
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b[XYZ]\d{7}[A-Z]\b`, "spanish_nie"),
         p(types_js_1.EntityType.IBAN, String.raw `\bES\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
-        p(types_js_1.EntityType.VAT, String.raw `\bES[A-Z0-9]\d{7}[A-Z0-9]\b`),
+        p(types_js_1.EntityType.VAT, String.raw `\bES[\s.]?[A-Z0-9]\d{7}[A-Z0-9]\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b[679]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b[679]\d{8}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b[679]\d[\s\-]?\d{3}[\s\-]?\d{2}[\s\-]?\d{2}\b`),
@@ -484,7 +521,7 @@ const PT = {
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b[1-35-9]\d{8}\b`, "portuguese_nif"),
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b[1-35-9]\d{2}[\s.]\d{3}[\s.]\d{3}\b`, "portuguese_nif"),
         p(types_js_1.EntityType.IBAN, String.raw `\bPT\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{5}\b`, "iban"),
-        p(types_js_1.EntityType.VAT, String.raw `\bPT\d{9}\b`),
+        p(types_js_1.EntityType.VAT, String.raw `\bPT[\s.]?\d{9}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b[29]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b[29]\d{8}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\+351\s?[29]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}`),
@@ -517,7 +554,7 @@ const PL = {
         p(types_js_1.EntityType.TAX_ID, String.raw `\b\d{3}-?\d{3}-?\d{2}-?\d{2}\b`, "polish_nip"),
         p(types_js_1.EntityType.IBAN, String.raw `\bPL\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
         p(types_js_1.EntityType.IBAN, String.raw `\bPL\d{26}\b`, "iban"),
-        p(types_js_1.EntityType.VAT, String.raw `\bPL\d{10}\b`),
+        p(types_js_1.EntityType.VAT, String.raw `\bPL[\s.]?\d{10}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b[5-8]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b[5-8]\d{8}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\+48\s?[5-8]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}`),
@@ -531,7 +568,7 @@ const IE = {
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b\d{7}[A-W][ABWTXZ]?\b`, "irish_pps"),
         p(types_js_1.EntityType.IBAN, String.raw `\bIE\d{2}\s?[A-Z]{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{2}\b`, "iban"),
         p(types_js_1.EntityType.IBAN, String.raw `\bIE\d{2}[A-Z]{4}\d{14}\b`, "iban"),
-        p(types_js_1.EntityType.VAT, String.raw `\bIE\d{7}[A-Z]\b`),
+        p(types_js_1.EntityType.VAT, String.raw `\bIE[\s.]?\d{7}[A-Z]\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b0[89]\d[\s\-]?\d{3}[\s\-]?\d{4}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b0[89]\d{8}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b0[1-9]\d{0,2}[\s\-]?\d{5,8}\b`),
@@ -547,7 +584,7 @@ const UK = {
         p(types_js_1.EntityType.HEALTH_INSURANCE, String.raw `\b\d{3}\s?\d{3}\s?\d{4}\b`, "uk_nhs", "", ["NHS", "NHS number", "health number", "NHS no"], true),
         p(types_js_1.EntityType.IBAN, String.raw `\bGB\d{2}\s?[A-Z]{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{2}\b`, "iban"),
         p(types_js_1.EntityType.IBAN, String.raw `\bGB\d{2}[A-Z]{4}\d{14}\b`, "iban"),
-        p(types_js_1.EntityType.VAT, String.raw `\bGB\d{9}\b`),
+        p(types_js_1.EntityType.VAT, String.raw `\bGB[\s.]?\d{3}[\s.]?\d{4}[\s.]?\d{2}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b07[4-9]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b07[4-9]\d{8}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b0[12]\d{2}[\s\-]?\d{3}[\s\-]?\d{4}\b`),
@@ -563,7 +600,7 @@ const BG = {
     patterns: [
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b\d{10}\b`, "bulgarian_egn"),
         p(types_js_1.EntityType.IBAN, String.raw `\bBG\d{2}\s?[A-Z]{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{2}\b`, "iban"),
-        p(types_js_1.EntityType.VAT, String.raw `\bBG\d{9,10}\b`),
+        p(types_js_1.EntityType.VAT, String.raw `\bBG[\s.]?\d{9,10}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b0?[89][789][\s\-]?\d{3}[\s\-]?\d{3,4}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b0?[89][789]\d{7,8}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\+359\s?[89][789][\s\-]?\d{3}[\s\-]?\d{3,4}`),
@@ -578,7 +615,7 @@ const CY = {
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b\d{8}[A-Z]\b`),
         p(types_js_1.EntityType.IBAN, String.raw `\bCY\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
         p(types_js_1.EntityType.IBAN, String.raw `\bCY\d{26}\b`, "iban"),
-        p(types_js_1.EntityType.VAT, String.raw `\bCY\d{8}[A-Z]\b`),
+        p(types_js_1.EntityType.VAT, String.raw `\bCY[\s.]?\d{8}[A-Z]\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b[29]\d{3}[\s\-]?\d{4}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b[29]\d[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b[29]\d{7}\b`),
@@ -594,7 +631,7 @@ const CZ = {
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b\d{6}/?\d{3,4}\b`, "czech_birth_number"),
         p(types_js_1.EntityType.IBAN, String.raw `\bCZ\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
         p(types_js_1.EntityType.IBAN, String.raw `\bCZ\d{22}\b`, "iban"),
-        p(types_js_1.EntityType.VAT, String.raw `\bCZ\d{8,10}\b`),
+        p(types_js_1.EntityType.VAT, String.raw `\bCZ[\s.]?\d{8,10}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b[67]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b[67]\d{8}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\+420\s?[67]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}`),
@@ -608,7 +645,7 @@ const SK = {
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b\d{6}/?\d{3,4}\b`, "czech_birth_number"),
         p(types_js_1.EntityType.IBAN, String.raw `\bSK\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
         p(types_js_1.EntityType.IBAN, String.raw `\bSK\d{22}\b`, "iban"),
-        p(types_js_1.EntityType.VAT, String.raw `\bSK\d{10}\b`),
+        p(types_js_1.EntityType.VAT, String.raw `\bSK[\s.]?\d{10}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b0?9\d{2}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\+421\s?9\d{2}[\s\-]?\d{3}[\s\-]?\d{3}`),
         p(types_js_1.EntityType.POSTAL_CODE, String.raw `\b\d{3}\s?\d{2}\b`, null, "", ["PSČ", "poštové", "adresa", "ulica", "Postal:", "Address:"], true),
@@ -621,7 +658,7 @@ const EE = {
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b[1-6]\d{10}\b`, "estonian_id"),
         p(types_js_1.EntityType.IBAN, String.raw `\bEE\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
         p(types_js_1.EntityType.IBAN, String.raw `\bEE\d{18}\b`, "iban"),
-        p(types_js_1.EntityType.VAT, String.raw `\bEE\d{9}\b`),
+        p(types_js_1.EntityType.VAT, String.raw `\bEE[\s.]?\d{9}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b5\d{3}[\s\-]?\d{4}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b5\d{7}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\+372\s?5\d{3}[\s\-]?\d{3,4}`),
@@ -635,7 +672,7 @@ const LT = {
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b[1-6]\d{10}\b`, "estonian_id"),
         p(types_js_1.EntityType.IBAN, String.raw `\bLT\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
         p(types_js_1.EntityType.IBAN, String.raw `\bLT\d{18}\b`, "iban"),
-        p(types_js_1.EntityType.VAT, String.raw `\bLT\d{9,12}\b`),
+        p(types_js_1.EntityType.VAT, String.raw `\bLT[\s.]?\d{9,12}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b6\d{2}[\s\-]?\d{2}[\s\-]?\d{3}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b6\d{7}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b8[\s\-]?6\d{2}[\s\-]?\d{2}[\s\-]?\d{3}\b`),
@@ -651,7 +688,7 @@ const LV = {
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b(?:0[1-9]|[12]\d|3[01])(?:0[1-9]|1[0-2])\d{7}\b`, null, "", ["personas kods", "PK", "identifikācijas"], true),
         p(types_js_1.EntityType.IBAN, String.raw `\bLV\d{2}\s?[A-Z]{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d\b`, "iban"),
         p(types_js_1.EntityType.IBAN, String.raw `\bLV\d{2}[A-Z]{4}\d{13}\b`, "iban"),
-        p(types_js_1.EntityType.VAT, String.raw `\bLV\d{11}\b`),
+        p(types_js_1.EntityType.VAT, String.raw `\bLV[\s.]?\d{11}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b[2]\d{3}[\s\-]?\d{4}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b[2]\d{7}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\+371\s?[2]\d{3}[\s\-]?\d{3,4}`),
@@ -666,7 +703,7 @@ const HR = {
         p(types_js_1.EntityType.IBAN, String.raw `\bHR\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{3}\b`, "iban"),
         p(types_js_1.EntityType.IBAN, String.raw `\bHR\d{2}\s\d{4}\s\d{4}\s\d{4}\s\d{5}\b`, "iban"),
         p(types_js_1.EntityType.IBAN, String.raw `\bHR\d{19}\b`, "iban"),
-        p(types_js_1.EntityType.VAT, String.raw `\bHR\d{11}\b`),
+        p(types_js_1.EntityType.VAT, String.raw `\bHR[\s.]?\d{11}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b0?9[12579][\s\-]?\d{3}[\s\-]?\d{3,4}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b0?9[12579]\d{7,8}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\+385\s?9[12579][\s\-]?\d{3}[\s\-]?\d{3,4}`),
@@ -680,7 +717,7 @@ const HU = {
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b\d{9}\b`, "hungarian_taj"),
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b\d{3}\s\d{3}\s\d{3}\b`, "hungarian_taj"),
         p(types_js_1.EntityType.TAX_ID, String.raw `\b8\d{9}\b`, null, "", ["adóazonosító", "adószám", "adóazonosító jel"], true),
-        p(types_js_1.EntityType.VAT, String.raw `\bHU\d{8,11}\b`, null, "", ["adószám", "ÁFA"]),
+        p(types_js_1.EntityType.VAT, String.raw `\bHU[\s.]?\d{8,11}\b`, null, "", ["adószám", "ÁFA"]),
         p(types_js_1.EntityType.IBAN, String.raw `\bHU\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
         p(types_js_1.EntityType.IBAN, String.raw `\bHU\d{26}\b`, "iban"),
         p(types_js_1.EntityType.PHONE, String.raw `\b06\s?\d{1,2}[\s\-]?\d{3}[\s\-]?\d{3,4}\b`),
@@ -695,7 +732,7 @@ const RO = {
     patterns: [
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b[1-8]\d{12}\b`, "romanian_cnp"),
         p(types_js_1.EntityType.IBAN, String.raw `\bRO\d{2}[A-Z]{4}\d{16}\b`, "iban"),
-        p(types_js_1.EntityType.VAT, String.raw `\bRO\d{2,10}\b`),
+        p(types_js_1.EntityType.VAT, String.raw `\bRO[\s.]?\d{2,10}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b0?7[2-9]\d{1}[\s\-]?\d{3}[\s\-]?\d{3,4}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b0?7[2-9]\d{7,8}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\+40\s?7[2-9]\d{1}[\s\-]?\d{3}[\s\-]?\d{3,4}`),
@@ -710,7 +747,7 @@ const EL = {
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b\d{11}\b`, "greek_amka"),
         p(types_js_1.EntityType.IBAN, String.raw `\bGR\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{3}\b`, "iban"),
         p(types_js_1.EntityType.IBAN, String.raw `\bGR\d{25}\b`, "iban"),
-        p(types_js_1.EntityType.VAT, String.raw `\bEL\d{9}\b`),
+        p(types_js_1.EntityType.VAT, String.raw `\bEL[\s.]?\d{9}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b69\d[\s\-]?\d{3,4}[\s\-]?\d{4}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b69\d{8}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b2\d{1,3}[\s\-]?\d{3,4}[\s\-]?\d{3,4}\b`),
@@ -725,7 +762,7 @@ const SI = {
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b\d{13}\b`, "slovenian_emso"),
         p(types_js_1.EntityType.IBAN, String.raw `\bSI\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{3}\b`, "iban"),
         p(types_js_1.EntityType.IBAN, String.raw `\bSI\d{17}\b`, "iban"),
-        p(types_js_1.EntityType.VAT, String.raw `\bSI\d{8}\b`),
+        p(types_js_1.EntityType.VAT, String.raw `\bSI[\s.]?\d{8}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b0?[34567]\d{1}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b0?[34567]\d{7}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\+386\s?[34567]\d{1}[\s\-]?\d{3}[\s\-]?\d{3}`),
@@ -740,7 +777,7 @@ const MT = {
         p(types_js_1.EntityType.NATIONAL_ID, String.raw `\b\d{5,7}[MGAPLHBZ]\b`),
         p(types_js_1.EntityType.IBAN, String.raw `\bMT\d{2}\s?[A-Z]{4}\s?\d{4}\s?\d{4}\s?[A-Z0-9]{4}\s?[A-Z0-9]{4}\s?[A-Z0-9]{4}\s?[A-Z0-9]{3}\b`, "iban"),
         p(types_js_1.EntityType.IBAN, String.raw `\bMT\d{2}[A-Z]{4}\d{5}[A-Z0-9]{18}\b`, "iban"),
-        p(types_js_1.EntityType.VAT, String.raw `\bMT\d{8}\b`),
+        p(types_js_1.EntityType.VAT, String.raw `\bMT[\s.]?\d{8}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b[79]\d{3}[\s\-]?\d{4}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b[79]\d{7}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\+356\s?[79]\d{3}[\s\-]?\d{3,4}`),

package/dist/cjs/rules/suppressors.js

@@ -313,9 +313,85 @@ function suppressSequential(_text, match) {
     const clean = match.text.replace(/[\s.\-]/g, "");
     return SEQUENTIAL_PATTERNS.test(clean);
 }
+// ── The engine's own output ───────────────────────────────────────────────
+//
+// Redaction has to be idempotent: running it over a document it already
+// produced must leave the placeholders it wrote alone. It did not.
+// `[POSTAL_CODE]` is thirteen characters of mixed case with an underscore, so
+// the entropy-based SECRET rule read it as a credential and a second pass
+// replaced it with `[SECRET]` (rules-engine#33).
+//
+// All three emitted forms are guarded, because all three come back as input in
+// a re-processing pipeline: `[TYPE]`, `TYPE_1` (referentialIntegrity) and
+// `TYPE_K7Q2` (tokenize -- where a false detection breaks restore()).
+//
+// Only real entity-type names count. Guarding any bracketed upper-case token
+// would be simpler and wrong: `[AKIAIOSFODNN7EXAMPLE]` is one, and also a live
+// AWS key. A placeholder for a *custom* pattern is therefore not covered.
+// The closing bracket is optional: another pattern's span need not agree with
+// this one about where the marker ends. The assigned-secret rule stops before
+// sentence punctuation (rules-engine#35), so it claims "[POSTAL_CODE" without
+// the "]". The opening bracket is still required.
+const PLACEHOLDER = /^(?:\[([A-Z][A-Z0-9_]*)\]?|([A-Z][A-Z0-9_]*?)_(?:\d+|[A-HJ-NP-Z2-9]{4}))$/;
+const KNOWN_TYPE_NAMES = new Set(Object.values(types_js_1.EntityType));
+function suppressRedactionPlaceholder(_text, match) {
+    const found = PLACEHOLDER.exec(match.text);
+    if (found === null)
+        return false;
+    const name = found[1] ?? found[2];
+    return KNOWN_TYPE_NAMES.has(name);
+}
 const RECENT_YEAR = /^(?:19[5-9]\d|20[0-3]\d)$/;
 const POSTAL_CONTEXT_NEAR = /(?:postcode|postal|code\s*postal|PLZ|Postleitzahl|postnummer|postinumero|póstnúmer|zip|straat|straße|strasse|rue\s|via\s|calle\s|rua\s|ulica|utca|street|avenue|laan\s|weg\s|plein|adres|adresse|address|woonplaats|wonende|woonachtig|gevestigd|domicili|demeurant|résidant|residant|bosatt|bopæl|wohnhaft|ansässig|stad\b|ville\b|city\b|Stadt|città|ciudad|cidade|miasto|město|város)/i;
 const DATE_KEYWORD_NEAR = /(?:født|fødselsdato|fødsel|Fødselsdato|född|födelsedatum|födelsedag|syntynyt|syntymäaika|fæddur|fæðingardagur|geboren|geboortedatum|Geburtsdatum|nascido|nacido|data di nascita|nato il|nata il|Tiltr[æa]delsesdato|Tiltredelsesdato|datum|date\b|Datum|jaar|year|année|Jahr|since|sinds|depuis|seit|\d{2}\.\d{2}\.|(?:januar|februar|marts|april|maj|juni|juli|august|september|oktober|november|december|januari|februari|mars|mei|juin|juillet|août))/i;
+// A sentence boundary: a full stop, question or exclamation mark followed by
+// space, or a line break. Written so it cannot fire inside "11.03.1970", where
+// the periods are not followed by whitespace -- that date is one of the false
+// positives this gate has to reject.
+const SENTENCE_BREAK = /[.!?][ \t\n]|\n/;
+const SENTENCE_BREAK_G = /[.!?][ \t\n]|\n/g;
+// The value's own sentence, bounded either side.
+function sentenceAround(text, start, end, reach = 160) {
+    let before = text.slice(Math.max(0, start - reach), start);
+    let after = text.slice(end, end + reach);
+    let lastEnd = -1;
+    SENTENCE_BREAK_G.lastIndex = 0;
+    for (let m = SENTENCE_BREAK_G.exec(before); m !== null; m = SENTENCE_BREAK_G.exec(before)) {
+        lastEnd = m.index + m[0].length;
+    }
+    if (lastEnd >= 0)
+        before = before.slice(lastEnd);
+    const found = SENTENCE_BREAK.exec(after);
+    if (found !== null)
+        after = after.slice(0, found.index);
+    return before + after;
+}
+// A postal label whose only distance from the value is punctuation:
+// "PLZ: 2011", "code postal : 2011", "Woonplaats: 1950".
+const POSTAL_LABEL_TOUCHING = new RegExp(`(?:${POSTAL_CONTEXT_NEAR.source})[\\s:.\\-]{0,4}$`, "i");
+// A capitalised place name after the code: "2000 Antwerpen". A following label
+// ("1970 Fødselsnummer:") is excluded by the colon.
+const CITY_AFTER = /^[ \t](?!\w+\s*:)[A-ZÀ-ÞŁŠŽ][\w\-']{2,}/u;
+// Every position is local to the value or inside its own sentence. Proximity to
+// an address *word* anywhere in a 300-character window is what the old rescue
+// asked, and that is a neighbourhood rather than a position (rules-engine#32).
+function yearSitsInAddressStructure(text, start, end) {
+    const before = text.slice(Math.max(0, start - 28), start);
+    // "Amsterdam, 2026" -- the comma of an address line.
+    if (/,[ \t]*$/.test(before))
+        return true;
+    // "PLZ: 2011" -- a postal label with nothing but punctuation between.
+    if (POSTAL_LABEL_TOUCHING.test(before))
+        return true;
+    // A capitalised place name immediately after.
+    if (CITY_AFTER.test(text.slice(end, end + 24)))
+        return true;
+    // An address word in the value's own sentence. "Te huur: Lange Nieuwstraat
+    // 12, rustige ligging in 2018, vlakbij openbaar vervoer." is an Antwerp
+    // postal code in prose; the false positives put the year and the address in
+    // different sentences.
+    return POSTAL_CONTEXT_NEAR.test(sentenceAround(text, start, end));
+}
 function suppressYearAsPostal(text, match) {
     if (match.patternDef.entityType !== types_js_1.EntityType.POSTAL_CODE)
         return false;
@@ -334,8 +410,10 @@ function suppressYearAsPostal(text, match) {
         return true;
     const [before, after] = getContext(text, match.start, match.end);
     const context = before + after;
-    // Keep as postal code if postal/address context nearby
-    if (POSTAL_CONTEXT_NEAR.test(context))
+    // Keep as postal code only when the value sits in address *structure* --
+    // see yearSitsInAddressStructure for why a 300-character window of address
+    // words was the defect rather than the keyword list.
+    if (yearSitsInAddressStructure(text, match.start, match.end))
         return false;
     // Keep if preceded by comma+space (address pattern: "Amsterdam, 2026")
     const immediateBefore = text.slice(Math.max(0, match.start - 3), match.start);
@@ -510,6 +588,35 @@ function suppressPostalInsideIban(text, match) {
     }
     return false;
 }
+// An IBAN-shaped run: two letters, two check digits, then grouped
+// alphanumerics. Deliberately not checksum-gated -- the point is to describe the
+// run a human wrote as one account number, including the ones that fail their
+// checksum, because those are exactly the ones no structured detector claims.
+const ACCOUNT_RUN = /\b[A-Z]{2}\d{2}(?:[ ]?[A-Z0-9]{2,4}){2,8}\b/g;
+// "Compte: FR76 3000 4008 0300 0109 5374" fails the IBAN checksum, so no
+// BANK_ACCOUNT candidate survives and the Danish eight-digit phone pattern took
+// "3000 4008" out of the middle of it, leaving the rest in the clear
+// (rules-engine#30). POSTAL_CODE has carried its own version of this guard
+// since 0.3.3, in suppressPostalInsideIban.
+function suppressPhoneInsideAccountRun(text, match) {
+    if (match.patternDef.entityType !== types_js_1.EntityType.PHONE)
+        return false;
+    const lineStart = text.lastIndexOf("\n", match.start) + 1;
+    let lineEnd = text.indexOf("\n", match.end);
+    if (lineEnd < 0)
+        lineEnd = text.length;
+    const line = text.slice(lineStart, lineEnd);
+    ACCOUNT_RUN.lastIndex = 0;
+    for (let m = ACCOUNT_RUN.exec(line); m !== null; m = ACCOUNT_RUN.exec(line)) {
+        const runStart = lineStart + m.index;
+        const runEnd = runStart + m[0].length;
+        if (runStart <= match.start && match.end <= runEnd
+            && runEnd - runStart > match.end - match.start) {
+            return true;
+        }
+    }
+    return false;
+}
 function suppressPostalAsHouseNumber(text, match) {
     if (match.patternDef.entityType !== types_js_1.EntityType.POSTAL_CODE)
         return false;
@@ -738,12 +845,19 @@ function suppressBicWithoutEvidence(text, match, scratch) {
 // Repeated per alternative, the engine retried the same unbounded prefix five
 // times per starting position — the most expensive single regex in the engine
 // at 197 ms per 1 MB document. Same language, 8x faster on the worst case.
+// An identifier cue that is really a postal label -- see the use below.
+const POSTAL_LABEL_CUE = /^post/i;
 const ID_CUE_BEFORE = /(?:[\w\-]*(?:Nr|N[°ºo]|Nummer|Numero|Numéro)|No|number|num|Kennzahl|Aktenzeichen|Az|e-?card|Polizze|Police|Policen)\.?\s*:?\s*$/i;
 // An international dialling prefix earlier on the same line, with nothing but
 // number punctuation in between: these digits belong to the phone detector.
 const DIALLING_PREFIX_BEFORE = /\+\d{1,3}[\d\s\-().]*$/;
 // A country prefix on a postal code — "A-1010 Wien", "B-2000", "L-1234".
-const COUNTRY_PREFIXED = /(?:^|[^A-Za-z0-9])[A-Z]{1,2}$/;
+// The boundary excludes a hyphen, which is what makes this a *prefix* rather
+// than a segment. It did not, so any `XX-NNNNN` tail of a hyphenated reference
+// read as a country-prefixed address: in "PV-2026-LU-09143" the `LU` is
+// preceded by `-` and the German five-digit postal pattern kept `09143`
+// (rules-engine#31).
+const COUNTRY_PREFIXED = /(?:^|[^A-Za-z0-9\-])[A-Z]{1,2}$/;
 /**
  * Suppress bare digit runs that belong to a longer number, not an address.
  *
@@ -787,7 +901,16 @@ function suppressPostalInLongerIdentifier(text, match) {
     if (/^[ \t]+\d/.test(text.slice(match.end, match.end + 4)))
         return true;
     // An identifier label introduces the digits: "DiNr. 4471", "Policen-Nr."
-    if (ID_CUE_BEFORE.test(text.slice(Math.max(0, match.start - 40), match.start)))
+    // Unless the label is a *postal* one. ID_CUE_BEFORE matches any word ending
+    // in "Nummer", "Nr", "Numero" or "Numéro" -- the wildcard is `[\w\-]*` -- so
+    // it matches `postnummer`, `postnr` and `postinumero`, the canonical postal
+    // labels of Norway, Denmark and Finland. Those countries write a bare
+    // four- or five-digit code, so the isdigit() guard above lets this run and
+    // the code was suppressed by its own label: `postnummer: 5020 Bergen`
+    // produced nothing at all (rules-engine#41).
+    const before = text.slice(Math.max(0, match.start - 40), match.start);
+    const cue = ID_CUE_BEFORE.exec(before);
+    if (cue !== null && !POSTAL_LABEL_CUE.test(cue[0].trimStart()))
         return true;
     // Digits after an international dialling prefix belong to PHONE
     const [lineStart] = enclosingLine(text, match.start, match.end);
@@ -839,7 +962,7 @@ function suppressRequiresContext(text, match) {
     return !match.patternDef.contextKeywords.some(kw => context.includes(kw.toLowerCase()));
 }
 const TYPE_SUPPRESSORS = {
-    [types_js_1.EntityType.PHONE]: [suppressCurrency, suppressUnits, suppressReference, suppressMath, suppressPhoneServiceNumber, suppressPhoneDateOverlap, suppressPhoneAsNumberRange],
+    [types_js_1.EntityType.PHONE]: [suppressCurrency, suppressUnits, suppressReference, suppressMath, suppressPhoneServiceNumber, suppressPhoneInsideAccountRun, suppressPhoneDateOverlap, suppressPhoneAsNumberRange],
     [types_js_1.EntityType.NATIONAL_ID]: [suppressCurrency, suppressUnits, suppressReference, suppressLegal, suppressMath, suppressNatidAsPassport, suppressSeNatidAsOrg],
     [types_js_1.EntityType.SSN]: [suppressCurrency, suppressUnits, suppressReference, suppressMath],
     [types_js_1.EntityType.TAX_ID]: [suppressCurrency, suppressUnits, suppressReference, suppressMath, suppressTaxidAsIpAddress],
@@ -853,6 +976,8 @@ const TYPE_SUPPRESSORS = {
 function shouldSuppress(text, match, scratch) {
     if (suppressSequential(text, match))
         return true;
+    if (suppressRedactionPlaceholder(text, match))
+        return true;
     const typeSups = TYPE_SUPPRESSORS[match.patternDef.entityType];
     if (typeSups) {
         for (const s of typeSups) {

package/dist/cjs/rules/validators.js

@@ -513,10 +513,24 @@ function validatePortugueseNif(candidate) {
     const check = remainder < 2 ? 0 : 11 - remainder;
     return parseInt(c[8]) === check;
 }
+// PESEL carries the century in the month field: +0 is the 1900s, +20 the 2000s,
+// +40 the 2100s, +60 the 2200s, +80 the 1800s. Without a date check this
+// accepted 80666603210 -- day 66 -- as NATIONAL_ID at high confidence
+// (rules-engine#43).
 function validatePolishPesel(candidate) {
     const c = candidate.replace(/[\s\-]/g, "");
     if (c.length !== 11 || !/^\d{11}$/.test(c))
         return false;
+    const rawMonth = parseInt(c.slice(2, 4), 10);
+    let month = null;
+    for (const off of [0, 20, 40, 60, 80]) {
+        if (rawMonth - off >= 1 && rawMonth - off <= 12) {
+            month = rawMonth - off;
+            break;
+        }
+    }
+    if (month === null || !isRealDay(month, parseInt(c.slice(4, 6), 10)))
+        return false;
     const d = c.split("").map(Number);
     const weights = [1, 3, 7, 9, 1, 3, 7, 9, 1, 3];
     let total = 0;
@@ -535,18 +549,53 @@ function validatePolishNip(candidate) {
         total += d[i] * weights[i];
     return total % 11 === d[9];
 }
+// Days per month for the rodné číslo date check. February is 29 because the
+// century is not recoverable from a two-digit year, so a leap year cannot be
+// ruled out -- being permissive by one day is the right direction here.
+const RC_DAYS = [31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+// The calendar month a rodné číslo month field encodes, or null. Four ranges
+// are legal: 1-12 is a man, +50 a woman, and since 2004 +20 marks a birth on a
+// day whose sequence numbers were exhausted (so +70 is a woman on such a day).
+// Whether `day` exists in `month`, February permissive at 29 because a
+// two-digit year does not reveal the century.
+function isRealDay(month, day) {
+    return month >= 1 && month <= 12 && day >= 1 && day <= RC_DAYS[month - 1];
+}
+function czechMonth(raw) {
+    for (const offset of [0, 20, 50, 70]) {
+        if (raw - offset >= 1 && raw - offset <= 12)
+            return raw - offset;
+    }
+    return null;
+}
+// The date is checked, not only the checksum. Without it the validator accepted
+// an impossible month, and a Czech mobile number is the same shape -- nine
+// digits opening 6 or 7 -- so any mobile that happened to pass mod 11 was typed
+// NATIONAL_ID at high confidence: 606666032 (MM=66), 778836400 (MM=88),
+// 728990603 (MM=89). 284 per corpus pass, the largest single false-positive
+// bucket in the evaluation (rules-engine#37).
 function validateCzechBirthNumber(candidate) {
     const c = candidate.replace(/[/\s]/g, "");
     if (!/^\d+$/.test(c) || (c.length !== 9 && c.length !== 10))
         return false;
+    const month = czechMonth(parseInt(c.slice(2, 4), 10));
+    if (month === null)
+        return false;
+    const day = parseInt(c.slice(4, 6), 10);
+    if (day < 1 || day > RC_DAYS[month - 1])
+        return false;
     if (c.length === 10)
         return parseInt(c) % 11 === 0;
     return true;
 }
+// S YY MM DD JJ NNN C -- the leading S carries the century, so the month needs
+// no offset convention here (rules-engine#43).
 function validateRomanianCnp(candidate) {
     const c = candidate.replace(/[\s\-]/g, "");
     if (c.length !== 13 || !/^\d{13}$/.test(c) || !"12345678".includes(c[0]))
         return false;
+    if (!isRealDay(parseInt(c.slice(3, 5), 10), parseInt(c.slice(5, 7), 10)))
+        return false;
     const key = "279146358279";
     let total = 0;
     for (let i = 0; i < 12; i++)
@@ -593,10 +642,14 @@ function validateCroatianOib(candidate) {
     const check = (11 - product) % 10;
     return check === parseInt(c[10]);
 }
+// DD MM YYY RR BBB K -- note EMSO opens with the *day*, where the Czech, Polish
+// and Romanian forms open with the year or a century digit (rules-engine#43).
 function validateSlovenianEmso(candidate) {
     const c = candidate.replace(/[\s\-]/g, "");
     if (c.length !== 13 || !/^\d{13}$/.test(c))
         return false;
+    if (!isRealDay(parseInt(c.slice(2, 4), 10), parseInt(c.slice(0, 2), 10)))
+        return false;
     const d = c.split("").map(Number);
     const weights = [7, 6, 5, 4, 3, 2, 7, 6, 5, 4, 3, 2];
     let total = 0;