euredact 0.6.0 → 0.7.1

package/dist/cjs/rules/suppressors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SuppressionScratch = void 0;
+exports.SuppressionScratch = exports.MONTH_NAMES = void 0;
 exports.shouldSuppress = shouldSuppress;
 const types_js_1 = require("../types.js");
 const bicRegistry_js_1 = require("./bicRegistry.js");
@@ -25,10 +25,11 @@ const CURRENCY_WORD = "EUR|USD|GBP|CHF|ISK|SEK|NOK|DKK|PLN|CZK|HUF|RON|BGN|HRK|"
 const CURRENCY_AFTER = new RegExp(`^\\s*(?:(?:${CURRENCY_SYMBOL})|(?:${CURRENCY_WORD})${_UWB})`, "i");
 const CURRENCY_COMMA_AFTER = new RegExp(`^[.,]\\d{1,2}\\s*(?:(?:${CURRENCY_SYMBOL})|(?:${CURRENCY_WORD})${_UWB})`, "i");
 const CURRENCY_BEFORE = new RegExp(`(?:(?:${CURRENCY_SYMBOL})|\\b(?:${CURRENCY_WORD}))\\s*$`, "i");
-const AMOUNT_LABEL_BEFORE = /\b(?:Montant|Beløb|Summa|Summe|Bedrag|Amount|Total|TTC|inkl|Upphæð|Importe|Importo|Valore|Wartość|Kwota|Částka|Összeg|Sum|Beloop|Prix|Preis|Price|Loyer|Miete|Huur|Rent|Betrag)\s*(?:\w+\s*)?:?\s*$/i;
+const AMOUNT_LABEL_BEFORE = /\b(?:Montant|Beløb|Summa|Summe|Bedrag|Amount|Total|TTC|inkl|Upphæð|Importe|Importo|Valore|Wartość|Kwota|Částka|Összeg|Sum|Beloop|Prix|Preis|Price|Loyer|Miete|Huur|Rent|Betrag)(?:\s+\w+)?\s*:?\s*$/i; // second word separate: not "Rent"+"enversicherungsnummer" (rules-engine#111)
 // Use Unicode-aware word boundary via \p{L} negative lookahead instead of \b
 // because JS \b is ASCII-only and fails on Unicode letters (e.g. "München" → \bm\b matches M before ü)
-const UNIT_AFTER = /^\s*(?:kg|km|cm|mm|m[²³]|ml|mg|GB|MB|KB|TB|%|jaar|maanden|weken|dagen|uur|minuten|seconden|stuks|pcs|pieces|ans|mois|semaines|jours|heures|Jahre|Monate|Wochen|Tage|Stunden)(?![a-zA-Z\u00C0-\u024F\u0400-\u04FF])/i;
+// Horizontal space only: a unit is on the number's own line (rules-engine#51).
+const UNIT_AFTER = /^[ \t]*(?:kg|km|cm|mm|m[²³]|ml|mg|GB|MB|KB|TB|%|jaar|maanden|weken|dagen|uur|minuten|seconden|stuks|pcs|pieces|ans|mois|semaines|jours|heures|Jahre|Monate|Wochen|Tage|Stunden)(?![a-zA-Z\u00C0-\u024F\u0400-\u04FF])/i;
 // Same missing-boundary flaw: "ref" matched the tail of "kortref".
 const REFERENCE_BEFORE = /\b(?:dossier|ref\.?|referentie|reference|référence|factuurnummer|invoice\s*(?:nr|number|no)?|bestelnummer|order\s*(?:nr|number|no)?|kenmerk|ordernummer|Aktenzeichen|numéro\s*de\s*(?:dossier|facture|commande)|bestellnummer|Rechnungsnummer|artikelnr|article\s*no|contract\s*(?:nr|number|no)?|pagina|page|Seite|blz\.?|Facture\s*n[°o]?|Faktura\s*n[°or]\.?|Lasku\s*n[°or]o?\.?|Rechnung\s*(?:Nr|n[°o])?|faktura\s*(?:nr|n[°o])?|bestilling\s*(?:nr|n[°o])?|bestelling\s*n[°or]\.?|Reikningur\s*nr|ticket|incident\s*(?:report|nr|no)?|case\s*(?:nr|no|id)?|zaaknummer|meldingsnummer|Vorgangsnummer|Vorgang|Störungsmeldung|saksnummer|ärendenummer|sagsnummer|asianumero|Factuur\s*n[ro]?\.?|Nota\s*n[ro]?\.?)\s*[:.#]?\s*$/i;
 // "#" before a number marks a reference in every language in scope — a ticket,
@@ -36,9 +37,19 @@ const REFERENCE_BEFORE = /\b(?:dossier|ref\.?|referentie|reference|référence|f
 const HASH_BEFORE = /#\s*$/;
 // A short uppercase tag hyphenated to the number: "IR-43433", "INC-2024".
 const REF_PREFIX_BEFORE = /(?:^|[\s([])[A-Z]{2,5}-$/;
+// The cross-border address form, "CH-8004 Zürich": a country code hyphenated to
+// a postal code, told apart from a reference tag by position -- it opens an
+// address line and a place name follows (rules-engine#58).
+const COUNTRY_PREFIX_OPENS_LINE = /(?:^|\n|,)[ \t]*([A-Z]{2})-$/;
+const POSTAL_PREFIX_COUNTRIES = new Set([
+    "AT", "BE", "BG", "CH", "CY", "CZ", "DE", "DK", "EE", "EL", "ES", "FI",
+    "FR", "GB", "GR", "HR", "HU", "IE", "IS", "IT", "LI", "LT", "LU", "LV",
+    "MT", "NL", "NO", "PL", "PT", "RO", "SE", "SI", "SK", "UK",
+]);
 const LEGAL_BEFORE = /(?:Art(?:ikel|icle|\.)|§|Artikel|Section|Sectie|Afdeling|paragraaf|Absatz|alinéa|punt|point|Punkt|lid)\s*$/i;
-const MATH_BEFORE = /[=+\-×÷*/]\s*$/;
-const MATH_AFTER = /^\s*[=+\-×÷*/]/;
+// An operator on the same line only: a bullet or "---" on the next line is not a minus sign (rules-engine#91).
+const MATH_BEFORE = /[=+\-×÷*/][^\S\r\n]*$/;
+const MATH_AFTER = /^[^\S\r\n]*[=+\-×÷*/]/;
 // "A-1010", "B-2000", "L-1234", "CH-8000", "D-10115": a country prefix on a
 // postal code, not a minus sign.
 const COUNTRY_PREFIX_HYPHEN = /(?:^|[^A-Za-z0-9])[A-Z]{1,2}-\s*$/;
@@ -64,10 +75,11 @@ const NUMERIC_TYPES = new Set([types_js_1.EntityType.PHONE, types_js_1.EntityTyp
 // Month names in the languages this engine covers. Long, but it is data: the
 // alternative is a proximity heuristic, and proximity is what caused the defect
 // this guards against. Kept in sync with the Python SDK's suppressors.py.
-const MONTH_NAMES = "january|february|march|april|may|june|july|august|september|october|november|december" +
+exports.MONTH_NAMES = "january|february|march|april|may|june|july|august|september|october|november|december" +
     "|jan|feb|mar|apr|jun|jul|aug|sep|sept|oct|nov|dec" +
     "|januar|jänner|februar|märz|mai|juni|juli|oktober|dezember|dez|okt|mrz" +
     "|janvier|février|mars|avril|juin|juillet|août|aout|septembre|octobre|novembre|décembre|decembre" +
+    "|janv|févr|fevr|avr|juil|déc" +
     "|januari|februari|maart|mei|augustus|mrt" +
     "|gennaio|febbraio|marzo|aprile|maggio|giugno|luglio|agosto|settembre|ottobre|dicembre" +
     "|enero|febrero|abril|mayo|junio|julio|septiembre|octubre|noviembre|diciembre" +
@@ -94,7 +106,7 @@ const SINCE_CUES = "seit|since|depuis|sinds|sedert|vanaf|desde|dal|od|sedan|side
  * candidate. Adjacent-only on purpose — a cue 150 characters away is what made
  * this a bug in the first place.
  */
-const DATE_BEFORE = new RegExp(`(?:\\b(?:${MONTH_NAMES})\\b\\.?|\\b(?:${SINCE_CUES})\\b|\\d{1,2}[./-]\\d{1,2}[./-])\\s*$`, "iu");
+const DATE_BEFORE = new RegExp(`(?:\\b(?:${exports.MONTH_NAMES})\\b\\.?|\\b(?:${SINCE_CUES})\\b|\\d{1,2}[./-]\\d{1,2}[./-])\\s*$`, "iu");
 /** A date separator immediately after, making the candidate a leading year. */
 const DATE_AFTER = /^[./-]\d{1,2}[./-]\d{1,2}\b/;
 /**
@@ -191,6 +203,27 @@ function suppressSecretOverStructured(text, match) {
  * natural word. A random all-letter token would be mixed case and is left alone
  * — losing a real secret is the expensive direction.
  */
+/**
+ * Values an assigned-secret rule finds after a "=" or ":" that are names, not
+ * secrets (rules-engine#126): `${VAR}` references, identifiers, hyphenated
+ * compounds, image tags, product versions, code calls. Not paths, host names
+ * or reference numbers: those carry personal data ("mac-mhartmann88").
+ * Kept in sync with the Python SDK's _SECRET_NAME_SHAPES.
+ */
+const SECRET_NAME_SHAPES = new RegExp([
+    String.raw `^\$\{[A-Za-z_][A-Za-z0-9_]*(?::?[-=?+][^}]*)?\}?$`,
+    String.raw `^[a-z]{2,}(?:_[a-z]{2,})+$`, String.raw `^[A-Z]{2,}(?:_[A-Z]{2,})+$`,
+    String.raw `^(?:[A-Z]+[a-z]{2,}){3,}(?:V?\d{1,2})?$`,
+    String.raw `^[a-z][a-z0-9._/-]*:(?:\d+(?:\.\d+)*(?:-[a-z0-9]+)*|latest|stable|alpine|slim)$`,
+    String.raw `^[A-Za-z][\w.-]*\/\d+(?:\.\d+)+$`,
+    String.raw `^[\w.]+\(["'\x60]`,
+].join("|"));
+/** A hyphenated compound of words and acronyms; two capitalised words alone
+ *  ("Ann-Sophie", "Caron-Cordier") are names and are left alone. */
+const COMPOUND_PART = String.raw `(?:[A-ZÀ-Þ]{2,6}\d{0,3}|[A-Za-zÀ-ÿ][a-zß-ÿ]{2,})`;
+const COMPOUND = new RegExp(String.raw `^` + COMPOUND_PART + String.raw `(?:-` + COMPOUND_PART + String.raw `)+$`);
+const NAME_PAIR = /^[A-ZÀ-Þ][a-zß-ÿ]{2,}-[A-ZÀ-Þ][a-zß-ÿ]{2,}$/;
+const CONNECTION_WITH_REFERENCE = /^[a-z]+:\/\/[^\s:@]+:\$\{[^}]*\}@/;
 function suppressSecretNotASecret(_text, match) {
     if (match.patternDef.entityType !== types_js_1.EntityType.SECRET)
         return false;
@@ -205,6 +238,10 @@ function suppressSecretNotASecret(_text, match) {
         return true;
     if (HYPHENATED_WORDS.test(bare))
         return true;
+    if (SECRET_NAME_SHAPES.test(bare) || CONNECTION_WITH_REFERENCE.test(bare))
+        return true;
+    if (COMPOUND.test(bare) && !NAME_PAIR.test(bare))
+        return true;
     const alpha = /^[A-Za-zÀ-ÿ]+$/.test(bare);
     const oneWord = bare === bare.toLowerCase() ||
         (bare.slice(0, 1) === bare.slice(0, 1).toUpperCase() &&
@@ -289,7 +326,19 @@ function suppressReference(text, match) {
     if (REFERENCE_BEFORE.test(before))
         return true;
     const adjacent = text.slice(Math.max(0, match.start - 8), match.start);
-    return HASH_BEFORE.test(adjacent) || REF_PREFIX_BEFORE.test(adjacent);
+    if (HASH_BEFORE.test(adjacent))
+        return true;
+    if (!REF_PREFIX_BEFORE.test(adjacent))
+        return false;
+    return !(match.patternDef.entityType === types_js_1.EntityType.POSTAL_CODE &&
+        isCountryPrefixedAddress(text, match.start, match.end));
+}
+/** "CH-8004 Zürich" on an address line, not the reference "IT-20431". */
+function isCountryPrefixedAddress(text, start, end) {
+    const found = COUNTRY_PREFIX_OPENS_LINE.exec(text.slice(Math.max(0, start - 12), start));
+    return (found !== null &&
+        POSTAL_PREFIX_COUNTRIES.has(found[1]) &&
+        CITY_AFTER.test(text.slice(end, end + 24)));
 }
 function suppressLegal(text, match) {
     const applicable = LEGAL_TYPES;
@@ -334,7 +383,20 @@ function suppressSequential(_text, match) {
 // the "]". The opening bracket is still required.
 const PLACEHOLDER = /^(?:\[([A-Z][A-Z0-9_]*)\]?|([A-Z][A-Z0-9_]*?)_(?:\d+|[A-HJ-NP-Z2-9]{4}))$/;
 const KNOWN_TYPE_NAMES = new Set(Object.values(types_js_1.EntityType));
-function suppressRedactionPlaceholder(_text, match) {
+function suppressRedactionPlaceholder(text, match) {
+    // The name between the brackets: an assigned value now starts after an
+    // opening bracket, so "credentials: [POSTAL_CODE]" offers "POSTAL_CODE" alone
+    // (rules-engine#33, #126).
+    if (text[match.start - 1] === "[" && text[match.end] === "]" && KNOWN_TYPE_NAMES.has(match.text))
+        return true;
+    // A placeholder inside the span: on text masked once, a value running across
+    // "[IP_ADDRESS]" is two things joined (rules-engine#126).
+    // One character either side: a span may start just inside the bracket.
+    const around = text.slice(Math.max(0, match.start - 1), match.end + 1);
+    for (const m of around.matchAll(/\[([A-Z][A-Z0-9_]*)\]/g)) {
+        if (KNOWN_TYPE_NAMES.has(m[1]))
+            return true;
+    }
     const found = PLACEHOLDER.exec(match.text);
     if (found === null)
         return false;
@@ -342,6 +404,8 @@ function suppressRedactionPlaceholder(_text, match) {
     return KNOWN_TYPE_NAMES.has(name);
 }
 const RECENT_YEAR = /^(?:19[5-9]\d|20[0-3]\d)$/;
+// Any year a written date can carry: the date-construction test applies to all of them (rules-engine#111).
+const DATE_YEAR = /^(?:1[89]\d\d|20\d\d)$/;
 const POSTAL_CONTEXT_NEAR = /(?:postcode|postal|code\s*postal|PLZ|Postleitzahl|postnummer|postinumero|póstnúmer|zip|straat|straße|strasse|rue\s|via\s|calle\s|rua\s|ulica|utca|street|avenue|laan\s|weg\s|plein|adres|adresse|address|woonplaats|wonende|woonachtig|gevestigd|domicili|demeurant|résidant|residant|bosatt|bopæl|wohnhaft|ansässig|stad\b|ville\b|city\b|Stadt|città|ciudad|cidade|miasto|město|város)/i;
 const DATE_KEYWORD_NEAR = /(?:født|fødselsdato|fødsel|Fødselsdato|född|födelsedatum|födelsedag|syntynyt|syntymäaika|fæddur|fæðingardagur|geboren|geboortedatum|Geburtsdatum|nascido|nacido|data di nascita|nato il|nata il|Tiltr[æa]delsesdato|Tiltredelsesdato|datum|date\b|Datum|jaar|year|année|Jahr|since|sinds|depuis|seit|\d{2}\.\d{2}\.|(?:januar|februar|marts|april|maj|juni|juli|august|september|oktober|november|december|januari|februari|mars|mei|juin|juillet|août))/i;
 // A sentence boundary: a full stop, question or exclamation mark followed by
@@ -371,14 +435,27 @@ function sentenceAround(text, start, end, reach = 160) {
 const POSTAL_LABEL_TOUCHING = new RegExp(`(?:${POSTAL_CONTEXT_NEAR.source})[\\s:.\\-]{0,4}$`, "i");
 // A capitalised place name after the code: "2000 Antwerpen". A following label
 // ("1970 Fødselsnummer:") is excluded by the colon.
-const CITY_AFTER = /^[ \t](?!\w+\s*:)[A-ZÀ-ÞŁŠŽ][\w\-']{2,}/u;
+// `\p{L}\p{N}_` rather than `\w`: JS `\w` is ASCII-only, so "8004 Zürich" failed
+// at the ü here while Python's Unicode `\w` accepted it (rules-engine#58).
+const CITY_AFTER = /^[ \t](?![\p{L}\p{N}_]+\s*:)[A-ZÀ-ÞŁŠŽ][\p{L}\p{N}_\-']{2,}/u;
 // Every position is local to the value or inside its own sentence. Proximity to
 // an address *word* anywhere in a 300-character window is what the old rescue
 // asked, and that is a neighbourhood rather than a position (rules-engine#32).
+/**
+ * The comma of an address line: the word before it is a place name or a number.
+ * "myocardial infarction, 2016" is a year in a list (rules-engine#111).
+ */
+const ADDRESS_COMMA = /(?<!\S)(?:[A-ZÀ-Þ\d][^\s,]*|[^\s,]*\]),[ \t]*$/;
+/**
+ * A redaction placeholder: "[POSTAL_CODE]" holds the words the address test
+ * looks for, so on masked text it made every year in its sentence a postcode
+ * (rules-engine#111). A masked value is no address word.
+ */
+const MASKED_VALUE = /\[[A-Z][A-Z_]*\]/g;
 function yearSitsInAddressStructure(text, start, end) {
     const before = text.slice(Math.max(0, start - 28), start);
     // "Amsterdam, 2026" -- the comma of an address line.
-    if (/,[ \t]*$/.test(before))
+    if (ADDRESS_COMMA.test(before))
         return true;
     // "PLZ: 2011" -- a postal label with nothing but punctuation between.
     if (POSTAL_LABEL_TOUCHING.test(before))
@@ -390,13 +467,13 @@ function yearSitsInAddressStructure(text, start, end) {
     // 12, rustige ligging in 2018, vlakbij openbaar vervoer." is an Antwerp
     // postal code in prose; the false positives put the year and the address in
     // different sentences.
-    return POSTAL_CONTEXT_NEAR.test(sentenceAround(text, start, end));
+    return POSTAL_CONTEXT_NEAR.test(sentenceAround(text, start, end).replace(MASKED_VALUE, " "));
 }
 function suppressYearAsPostal(text, match) {
     if (match.patternDef.entityType !== types_js_1.EntityType.POSTAL_CODE)
         return false;
     const clean = match.text.trim();
-    if (!RECENT_YEAR.test(clean))
+    if (!DATE_YEAR.test(clean))
         return false;
     // A date construction *touching* the candidate settles it, whatever the rest
     // of the document says. Without this, the postal-context test below rescued
@@ -408,6 +485,8 @@ function suppressYearAsPostal(text, match) {
         return true;
     if (DATE_AFTER.test(text.slice(match.end, match.end + 8)))
         return true;
+    if (!RECENT_YEAR.test(clean))
+        return false;
     const [before, after] = getContext(text, match.start, match.end);
     const context = before + after;
     // Keep as postal code only when the value sits in address *structure* --
@@ -415,10 +494,6 @@ function suppressYearAsPostal(text, match) {
     // words was the defect rather than the keyword list.
     if (yearSitsInAddressStructure(text, match.start, match.end))
         return false;
-    // Keep if preceded by comma+space (address pattern: "Amsterdam, 2026")
-    const immediateBefore = text.slice(Math.max(0, match.start - 3), match.start);
-    if (/,\s*$/.test(immediateBefore))
-        return false;
     // Suppress if date keyword nearby (birth date, employment date, etc.)
     if (DATE_KEYWORD_NEAR.test(context))
         return true;
@@ -461,26 +536,155 @@ const TOWN_AFTER = /^\s*[A-ZÀ-ÞĀ-Ž]/;
  * between the marker and the number, so allow exactly one.
  */
 const EXTENSION_BEFORE = /(?<![A-Za-z0-9_])(?:toest(?:el)?|ext|extension|poste|durchwahl|doorkiesnummer|tst|nebenstelle)\.?\s*(?:[a-zà-ÿ]{2,10}\s*)?[:.]?\s*$/i;
+/**
+ * What else a bare digit run after these is (rules-engine#111): a head count
+ * ("Employees: 214"), a standard ("ISO/IEC 27001"), a product model with an
+ * inner capital ("Dell OptiPlex 7090"). Not the digits after "[PHONE]": the
+ * rest of a number an earlier pass cut short, safer masked as a postcode.
+ */
+const COUNT_LABEL_BEFORE = /(?<![A-Za-z0-9_])(?:employees|headcount|staff|mitarbeiter(?:innen)?|beschäftigte|werknemers|medewerkers|employés|salariés|effectifs?|dipendenti|empleados|pracowników|zaměstnanců)\s*[:=]?\s*$/i;
+const NOT_POSTAL_BEFORE = /(?<![A-Za-z0-9_])(?:(?:ISO(?:\/IEC)?|IEC|EN|DIN(?:\s+EN)?|NEN(?:-EN)?|NF\s+EN|BS(?:\s+EN)?|PN-EN|ÖNORM)[\s\-]*|[A-Za-z]*[a-z][A-Z][A-Za-z]*\s+)$/;
+/**
+ * What else a number is, by what touches it (rules-engine#126): a build,
+ * version, event, lease, policy or ticket number; a port; an invoice, reference
+ * or study-subject number; a process id; a JSON id or port field; an HTTP
+ * response size; the hour after a date; a lab reference range; or a quantity
+ * with its unit after it. Kept in sync with the Python SDK.
+ */
+const TECH_WORD_BEFORE = /(?<![A-Za-z0-9_])(?:build|version|policy\s+id|ticket(?:\s+[A-Za-z]{2,10})?|event|lease|pid|job|port|rfc|facture|invoice|r[ée]f[ée]rence|n[°º]|tn|sae|uczestnik|subject|narratief|participant)\.?\s*[:#=]?\s*["(«[]?\s*$/i;
+const TECH_SHAPE_BEFORE = new RegExp("(?:" + [
+    String.raw `"[A-Za-z_]*(?:id|port)"\s*:\s*"?`, // "parent_id": 4400
+    String.raw `(?<![A-Za-z0-9])[A-Z_]*PORT\s*[:=]\s*"?`, // DB_PORT: "5432"
+    String.raw `(?:localhost|[a-z0-9\-]+\.[a-z0-9.\-]+):`, // localhost:3000
+    String.raw `(?<![\d.])\d{2,5}:`, // "8080:8080"
+    String.raw `HTTP\/\d(?:\.\d)?"?\s+\d{3}\s+`, // HTTP/1.1" 200 2048
+    String.raw `\d+\.\d+(?:\.\d+)+\s*\(`, // build 2.4.0 (4012)
+    String.raw `(?<!\d)\d{1,2}[./]\d{1,2}[./]`, // 03.10.2026 23:50
+    String.raw `\((?:N|norm(?:al)?|ref)\s*:?\s*`, // (N : 30-400)
+    String.raw `\|`,
+].join("|") + ")$", "i");
+const POSTAL_UNIT_AFTER = /^(?:\s?(?:ms|s|sec|secs|seconds?|secondes?|sekunden|sek|min|bits?|bytes?|kb|mb|gb|tb|kbps|mbps|px|%|records|rows|entries|datensätze|einträge|micrograms|µg|ug|mg|mmol|fl)(?![A-Za-zÀ-ÿ])|\s*→\s*\d+\s*(?:bits?|bytes?)(?![A-Za-z])|:\d|\|)/i;
+const PID_BEFORE = /[A-Za-z0-9_\-]\[$/;
+/** A standard's name as the letters of a lettered postcode: "RFC 5737". Not
+ *  BS or EN: those are Bristol and Enfield. */
+const STANDARD_LETTERS = /^(?:RFC|ISO|IEC|DIN)\s?\d/;
+/** A year closing a range: "1998–2011". En and em dashes only. */
+const YEAR_RANGE_BEFORE = /(?:19|20)\d\d\s?[–—]\s?$/;
+const YEAR_RANGE_AFTER = /^\s?[–—]\s?(?:19|20)\d\d(?!\d)/;
+/** A thousands group of an amount: the "750" of "£28,750,000". */
+const GROUP_BEFORE = /\d[,.]$/;
+const GROUP_AFTER = /^[,.]\d{3}(?!\d)/;
 /** Suppress a postal code the word in front of it rules out. */
 function suppressPostalAfterDisqualifyingWord(text, match) {
     if (match.patternDef.entityType !== types_js_1.EntityType.POSTAL_CODE)
         return false;
     const before = text.slice(Math.max(0, match.start - 24), match.start);
-    if (EXTENSION_BEFORE.test(before))
+    if (EXTENSION_BEFORE.test(before) || COUNT_LABEL_BEFORE.test(before)
+        || NOT_POSTAL_BEFORE.test(before))
+        return true;
+    if (GROUP_BEFORE.test(before) && GROUP_AFTER.test(text.slice(match.end, match.end + 5)))
+        return true;
+    const after = text.slice(match.end, match.end + 24);
+    if (TECH_WORD_BEFORE.test(before) || TECH_SHAPE_BEFORE.test(before) || POSTAL_UNIT_AFTER.test(after)
+        || STANDARD_LETTERS.test(match.text))
+        return true;
+    if (PID_BEFORE.test(before) && after.startsWith("]"))
+        return true;
+    if (DATE_YEAR.test(match.text.trim()) && (YEAR_RANGE_BEFORE.test(before) || YEAR_RANGE_AFTER.test(after)))
         return true;
     return RECENT_YEAR.test(match.text.trim())
         && (YEAR_WORD_BEFORE.test(before) || YEAR_VERB_BEFORE.test(before))
         && !TOWN_AFTER.test(text.slice(match.end, match.end + 3));
 }
+/** A group with a leading zero: "2.00.079.01" is a version, not an address. */
+const IP_LEADING_ZERO = /(?:^|\.)0\d/;
+const CIDR_PREFIX_AFTER = /^\/(\d{1,2})(?!\d)/;
+/** RFC 5737's documentation ranges: reserved, never routed, used in examples. */
+const DOCUMENTATION_NETS = ["192.0.2.", "198.51.100.", "203.0.113."];
+/**
+ * An IPv4 shape that names no host (rules-engine#126): a network address
+ * ("10.40.0.0/16"), a documentation address, or a version with leading zeros.
+ * An interface address with its prefix ("192.168.1.23/24") stays.
+ */
+function suppressIpNotAHost(text, match) {
+    if (match.patternDef.entityType !== types_js_1.EntityType.IP_ADDRESS)
+        return false;
+    const ip = match.text;
+    if (IP_LEADING_ZERO.test(ip) || DOCUMENTATION_NETS.some((n) => ip.startsWith(n)))
+        return true;
+    // Part of a longer dotted run: "urn:oid:1.2.250.1.71.4.2.1" is an OID.
+    if (/\d\.$/.test(text.slice(Math.max(0, match.start - 2), match.start))
+        || /^\.\d/.test(text.slice(match.end, match.end + 2)))
+        return true;
+    const prefix = CIDR_PREFIX_AFTER.exec(text.slice(match.end, match.end + 4));
+    if (prefix !== null && Number(prefix[1]) < 32) {
+        const value = ip.split(".").reduce((acc, o) => acc * 256 + Number(o), 0);
+        return value % 2 ** (32 - Number(prefix[1])) === 0;
+    }
+    return false;
+}
+/**
+ * The specimen of a form: "das Muster „C01X00T47“". Only "Muster": "z. B." and
+ * "e.g." introduce real values in prose as often as samples (rules-engine#126).
+ */
+const EXAMPLE_BEFORE = /(?<![A-Za-z])muster\s*[:,]?\s*[„"«']?$/i;
+/** A dummy value in placeholder glyphs ("XX0000000", "999 999 9999") or MAC
+ *  groups of one repeated letter. Not "111222333", the standard test BSN. */
+const DUMMY_VALUE = /^(?=(?:[\s:\-./]*[X09]){5})(?:[X\s:\-./]*[X][X0\s:\-./]*|[X9\s:\-./]*X[X9\s:\-./]*|[0\s:\-./]+|[9\s:\-./]+)$|^(?:([a-fA-F])\1[:\-]){2,}([a-fA-F])\2$/;
+/** Algorithm names in a key or signature line: "ED25519", "SHA256". */
+const ALGORITHM = /^(?:ED25519|ED448|SHA-?(?:1|224|256|384|512)|MD5|AES-?\d{3}|RSA-?\d{3,4}|[HRE]S(?:256|384|512))$/i;
+/** A date exactly, which no national number is written as. */
+const EXACT_DOTTED_DATE = /^(?:0[1-9]|[12]\d|3[01])\.(?:0[1-9]|1[0-2])\.(?:19|20)\d\d$/;
+/** The identifier types an example marker or a dummy value rules out. */
+const EXAMPLE_TYPES = new Set([
+    types_js_1.EntityType.NATIONAL_ID, types_js_1.EntityType.PASSPORT, types_js_1.EntityType.LICENSE_PLATE,
+    types_js_1.EntityType.HEALTH_INSURANCE, types_js_1.EntityType.MAC_ADDRESS,
+    types_js_1.EntityType.DRIVERS_LICENSE, types_js_1.EntityType.SSN, types_js_1.EntityType.TAX_ID,
+]);
+/** A placeholder in the shape of a value, for any type (#126). */
+function suppressDummyValue(_text, match) {
+    return DUMMY_VALUE.test(match.text.trim());
+}
+/** An identifier given as a form's specimen, not anyone's (#126). */
+function suppressExampleValue(text, match) {
+    if (!EXAMPLE_TYPES.has(match.patternDef.entityType))
+        return false;
+    return EXAMPLE_BEFORE.test(text.slice(Math.max(0, match.start - 24), match.start));
+}
+/**
+ * Shapes that fit an identifier pattern and are something else (#126): a
+ * passport without a digit, an algorithm or a law citation read as a plate,
+ * a date read as a dotted national number.
+ */
+function suppressNotAnIdentifier(text, match) {
+    const type = match.patternDef.entityType;
+    const value = match.text.trim();
+    if (type === types_js_1.EntityType.PASSPORT)
+        return !/\d/.test(value);
+    if (type === types_js_1.EntityType.LICENSE_PLATE) {
+        return ALGORITHM.test(value) || /§\s*$/.test(text.slice(Math.max(0, match.start - 4), match.start));
+    }
+    if (type === types_js_1.EntityType.NATIONAL_ID)
+        return EXACT_DOTTED_DATE.test(value);
+    return false;
+}
 function suppressPhoneServiceNumber(_text, match) {
     if (match.patternDef.entityType !== types_js_1.EntityType.PHONE)
         return false;
     return SERVICE_NUMBER.test(match.text);
 }
-function suppressPhoneDateOverlap(_text, match) {
+// A date and the hour of a time, "07.10.2026 08" out of "07.10.2026 08:42":
+// the French phone pattern took it as five pairs (rules-engine#101). Only when
+// the minutes follow, so the stamp is certain.
+const DATE_THEN_HOUR = /^\d{2}([-/.])\d{2}\1\d{4}\s+\d{1,2}$/;
+const MINUTES_AFTER = /^:\d{2}(?!\d)/;
+function suppressPhoneDateOverlap(text, match) {
     if (match.patternDef.entityType !== types_js_1.EntityType.PHONE)
         return false;
-    return DATE_PATTERN_FULL.test(match.text.trim());
+    const candidate = match.text.trim();
+    if (DATE_PATTERN_FULL.test(candidate))
+        return true;
+    return DATE_THEN_HOUR.test(candidate) && MINUTES_AFTER.test(text.slice(match.end, match.end + 3));
 }
 // Standards and classification prefixes that are plate-shaped once a letter and
 // digits follow: "ATC-N06", "ICD-O3". None is a German district code, but the
@@ -493,6 +697,16 @@ const NOT_CITY_CODES = new Set([
     "BE", "DE", "EU", "NL", "LU", "WS", "SS", "IP",
 ]);
 const CURRENCY_PLATE = /^(?:EUR|USD|GBP|CHF|SEK|NOK|DKK|ISK|CZK|PLN|HUF|RON|BGN|HRK)\s/i;
+const ALNUM = /[\p{L}\p{N}]/u;
+/** Characters that join a token to more of an identifier (rules-engine#50, #81). */
+const ID_CONNECTORS = "-/._+";
+/** A reference marker directly before the token: "#FR-S2", "№ …", "n° …". */
+const REFERENCE_MARK_BEFORE = /(?:#|№|(?<![A-Za-z])[nN][°º])\s?$/;
+/** A connector glues [start, end) to a letter or digit outside it. */
+function joinedToMore(text, start, end) {
+    return ((end + 1 < text.length && ID_CONNECTORS.includes(text[end]) && ALNUM.test(text[end + 1])) ||
+        (start >= 2 && ID_CONNECTORS.includes(text[start - 1]) && ALNUM.test(text[start - 2])));
+}
 function suppressPlateInCompound(text, match) {
     if (match.patternDef.entityType !== types_js_1.EntityType.LICENSE_PLATE)
         return false;
@@ -504,6 +718,18 @@ function suppressPlateInCompound(text, match) {
         if (/[A-Za-zÄÖÜäöüß]{2,}-$/.test(before))
             return true;
     }
+    // A plate is a token of its own: joined by a connector to more of an
+    // identifier ("TF-284-KL-00874", "FR-S2/2026") it is a segment of a reference
+    // (rules-engine#50, #81). A spaced dash or slash does not join.
+    if (joinedToMore(text, match.start, match.end))
+        return true;
+    // After a reference marker ("Ref #FR-S2") it is a reference, unless a plate
+    // cue says otherwise (rules-engine#81).
+    if (REFERENCE_MARK_BEFORE.test(text.slice(Math.max(0, match.start - 4), match.start))) {
+        const [b, a] = getContext(text, match.start, match.end);
+        if (!PLATE_CUE_NEAR.test(b + a))
+            return true;
+    }
     const matched = match.text.trim();
     const parts = matched.split(/[\s\-]+/);
     // A standards or classification reference, not a plate — unless a plate cue
@@ -553,7 +779,11 @@ function suppressDePlateUnknownDistrict(text, match) {
     const parts = match.text.trim().split(/[\s\-]+/);
     if (parts.length === 0 || !parts[0])
         return false;
-    if (deDistricts_js_1.DE_DISTRICT_CODES.has(parts[0].toUpperCase()))
+    // A German plate number never starts with 0: without a plate cue,
+    // "GR-NB-0412" is an asset tag and "HR-IT-03" a form (rules-engine#126).
+    const digits = /\d+/.exec(match.text);
+    const leadingZero = digits !== null && digits[0].startsWith("0");
+    if (deDistricts_js_1.DE_DISTRICT_CODES.has(parts[0].toUpperCase()) && !leadingZero)
         return false;
     const [before, after] = getContext(text, match.start, match.end);
     if (PLATE_CUE_NEAR.test(before + after))
@@ -834,10 +1064,34 @@ function suppressBicWithoutEvidence(text, match, scratch) {
     // The token itself is blanked out so it cannot vouch for itself.
     const unit = structuralUnit(text, match.start, match.end).split(token).join(" ".repeat(token.length));
     if (BIC_KEYWORD.test(unit) || IBAN_SHAPE.test(unit) || BANK_BLOCK.test(unit)) {
+        if (bicShapedWord(text, match.start, match.end, token))
+            return true;
         return occursAsLowercaseWord(text, token, scratch);
     }
     return true;
 }
+/** A personal title right before the token: "Dr. HOFFMANN", "Mme JANSSENS". */
+const TITLE_BEFORE = /(?<![A-Za-z])(?:dr|prof|mr|mrs|ms|mme|mlle|m|herr|frau|dhr|mevr|sig|sra?)\.?\s+$/i;
+const LETTER = /\p{L}/u;
+/** A BIC/SWIFT label touching the token: "BIC: ", "SWIFT-Code:\n", "Code SWIFT : ", "BIC Bank A: ". */
+const BIC_LABEL_BEFORE = /(?<![A-Za-z])(?:bic|swift)(?:[\s/\-]*(?:code|swift|bic))?(?:\s+bank\s+\w{1,3})?[\s:.\-()]*$/i;
+/**
+ * A registry miss sitting where only a word or a name can (rules-engine#57):
+ * joined to a word by a hyphen ("NGUYEN-HOFFMANN"), right after a personal
+ * title ("Dr. HOFFMANN"), or letters only (eight, or eleven without an `XXX`
+ * branch: "BETALING", "MAANDELIJKS") that the GLEIF mapping does not know and
+ * no BIC/SWIFT label touches.
+ */
+function bicShapedWord(text, start, end, token) {
+    if ((start >= 2 && text[start - 1] === "-" && LETTER.test(text[start - 2])) ||
+        (text[end] === "-" && end + 1 < text.length && LETTER.test(text[end + 1])))
+        return true;
+    if (TITLE_BEFORE.test(text.slice(Math.max(0, start - 8), start)))
+        return true;
+    return /^[A-Za-z]+$/.test(token) && !(token.length === 11 && token.endsWith("XXX"))
+        && !(0, bicRegistry_js_1.isKnownInstitution)(token)
+        && !BIC_LABEL_BEFORE.test(text.slice(Math.max(0, start - 30), start));
+}
 // ── Postal code: digits belonging to a longer identifier ────────────────
 // An identifier label immediately before the digits. A postal code is never
 // introduced this way; an SVNr, policy number or service number always is.
@@ -857,7 +1111,14 @@ const DIALLING_PREFIX_BEFORE = /\+\d{1,3}[\d\s\-().]*$/;
 // read as a country-prefixed address: in "PV-2026-LU-09143" the `LU` is
 // preceded by `-` and the German five-digit postal pattern kept `09143`
 // (rules-engine#31).
-const COUNTRY_PREFIXED = /(?:^|[^A-Za-z0-9\-])[A-Z]{1,2}$/;
+const COUNTRY_PREFIXED = /(?:^|[^A-Za-z0-9\-])([A-Z]{1,3})$/;
+// Postal country prefixes and the length of that country's postcode: any one or two capitals
+// used to pass, so "K-40817" and "B-51823" were country-prefixed postcodes (rules-engine#111).
+const POSTAL_PREFIX_DIGITS = { A: 4, AT: 4, B: 4, BE: 4, BG: 4, CH: 4, CY: 4, CZ: 5, D: 5, DE: 5, DK: 4, E: 5, EE: 5, ES: 5, F: 5, FI: 5, FIN: 5, FR: 5, GR: 5, H: 4, HR: 5, I: 5, IT: 5, L: 4, LT: 5, LU: 4, LV: 4, N: 4, NL: 4, NO: 4, P: 4, PL: 5, PT: 4, RO: 6, S: 5, SE: 5, SI: 4, SK: 5, SLO: 4 };
+function countryPrefixed(before, digits) {
+    const m = COUNTRY_PREFIXED.exec(before);
+    return m !== null && POSTAL_PREFIX_DIGITS[m[1]] === digits.length;
+}
 /**
  * Suppress bare digit runs that belong to a longer number, not an address.
  *
@@ -873,8 +1134,15 @@ function suppressPostalInLongerIdentifier(text, match) {
     if (match.patternDef.entityType !== types_js_1.EntityType.POSTAL_CODE)
         return false;
     const clean = match.text.trim();
-    if (!/^\d+$/.test(clean))
+    if (!/^\d+$/.test(clean)) {
+        // A structured form glued on by a hyphen is the tail of a reference: "CPS-HR-2026-019" (#111).
+        const glued = text.slice(Math.max(0, match.start - 2), match.start);
+        if (glued.length === 2 && glued[1] === "-" && /[A-Za-z0-9]/.test(glued[0])) {
+            const m = COUNTRY_PREFIXED.exec(text.slice(0, match.start - 1));
+            return !(m && m[1] in POSTAL_PREFIX_DIGITS);
+        }
         return false;
+    }
     const beforeChar = match.start > 0 ? text[match.start - 1] : "";
     const afterChar = match.end < text.length ? text[match.end] : "";
     const prevPrev = match.start >= 2 ? text[match.start - 2] : "";
@@ -893,7 +1161,10 @@ function suppressPostalInLongerIdentifier(text, match) {
         return true;
     if (afterChar === "-" && /\d/.test(nextNext))
         return true;
-    if (beforeChar === "-" && !COUNTRY_PREFIXED.test(text.slice(0, match.start - 1)))
+    // A hyphenated chain goes on after it: "réf. : L-2025-HD-0412" is a reference (#111).
+    if (/^-[A-Za-z0-9]+-/.test(text.slice(match.end, match.end + 12)))
+        return true;
+    if (beforeChar === "-" && !countryPrefixed(text.slice(0, match.start - 1), clean))
         return true;
     // A further digit group on the same line: "1268 040390", "1234 5678 925",
     // "+43 664 8213 907". Horizontal whitespace only — a digit on the *next*
@@ -954,12 +1225,186 @@ function suppressRequiresContext(text, match) {
         return false;
     // A value filling an entire field of a delimited row is introduced by its
     // column, not by a word, so that is context — but only for narrow shapes.
+    // A date's column decides when the table names it: under "début" or
+    // "last_day" a date is not a birth date (rules-engine#126).
     if (DELIMITED_FIELD_TYPES.has(match.patternDef.entityType) &&
-        fillsADelimitedField(text, match.start, match.end))
+        fillsADelimitedField(text, match.start, match.end) &&
+        !(DATE_LABEL_TYPES.has(match.patternDef.entityType) && columnHeader(text, match.start) !== null))
         return false;
+    if (DATE_LABEL_TYPES.has(match.patternDef.entityType)) {
+        return !labelsThisDate(text, match.start, match.end, match.patternDef.contextKeywords, match.patternDef.entityType);
+    }
     const [before, after] = getContext(text, match.start, match.end);
     const context = (before + " " + after).toLowerCase();
-    return !match.patternDef.contextKeywords.some(kw => context.includes(kw.toLowerCase()));
+    if (match.patternDef.contextKeywords.some(kw => context.includes(kw.toLowerCase())))
+        return false;
+    // The column names it: a passport under "Passport" rows below the header (#130).
+    const header = columnHeader(text, match.start);
+    return header === null || !match.patternDef.contextKeywords.some(kw => keywordAt(header, kw, false) >= 0);
+}
+/** Date types decided by a label: DOB and DATE_OF_DEATH share one date shape. */
+const DATE_LABEL_TYPES = new Set([types_js_1.EntityType.DOB, types_js_1.EntityType.DATE_OF_DEATH]);
+/** Any common numeric date, to tell whether a label belongs to another date. */
+// A masked date counts as one: the gateway's rules pass reads SDK-masked text (rules-engine#111).
+// ... and a written-month date, now a DOB shape of its own (rules-engine#115).
+const ANY_DATE = new RegExp(String.raw `\d{1,4}[/.\-]\d{1,2}[/.\-]\d{2,4}|\[(?:dob|date_of_death)\]|(?<![A-Za-z0-9_])\d{1,2}\.?\s+(?:` + exports.MONTH_NAMES + String.raw `)\.?\s+\d{4}(?![A-Za-z0-9_])`, "i");
+/**
+ * True when one of `keywords` is this date's own label: before the date with no
+ * other date between, or after it inside the date's own sentence. Anywhere in
+ * the window typed every date from whichever date label the document carried
+ * (rules-engine#52).
+ */
+/** A date followed by a list separator: an item of the list a label introduces. */
+const LIST_ITEM = /\d{1,4}[/.\-]\d{1,2}[/.\-]\d{2,4}\s*(?:,|;|–|&|\band\b|\ben\b|\bet\b|\bund\b|\bor\b|\bof\b|\bou\b|\boder\b|\brespectievelijk\b|\bbzw\.?)\s*/g;
+/** Punctuation and at most two short words ("e.g.", "bv.", "op") between label and date. */
+const LABEL_TAIL = /^[\s:.,()\-]*(?:\p{L}{1,4}(?:\.\p{L}{1,2})*\.?(?:[\s:.,()\-]+|$)){0,2}$/u;
+/** The birth sign "°" directly before the date, but not the number sign "n°". */
+const BIRTH_SIGN = /(?<![a-z])°\s?$/;
+/** No other date between a label and the date, except items of its list. */
+function nothingButAListBetween(gap) {
+    if (!ANY_DATE.test(gap))
+        return true;
+    const rest = gap.replace(LIST_ITEM, " ");
+    return !ANY_DATE.test(rest) && LABEL_TAIL.test(rest);
+}
+/**
+ * Where `keyword` occurs in the lower-cased `haystack`, or -1. An all-capitals
+ * keyword is an abbreviation and counts only as a word of its own: "DOB" is a
+ * label, the "dob" in Polish "dobrowolnej" is not (rules-engine#100); a plural
+ * "s" may follow ("DOBs e.g. …"). Other
+ * keywords still match inside a longer word, which inflected forms need.
+ */
+function keywordAt(haystack, keyword, last) {
+    const kw = keyword.toLowerCase();
+    const isLetter = (c) => c !== "" && c.toLowerCase() !== c.toUpperCase();
+    if (keyword !== keyword.toUpperCase() || keyword === kw) {
+        // It must start a word, though it may run on into a longer one: "née le"
+        // in "signée le" and "born" in "Newborn" are other words (rules-engine#126).
+        let i = last ? haystack.lastIndexOf(kw) : haystack.indexOf(kw);
+        while (i > 0 && isLetter(haystack[i - 1])) {
+            i = last ? (i === 0 ? -1 : haystack.lastIndexOf(kw, i - 1)) : haystack.indexOf(kw, i + 1);
+        }
+        return i;
+    }
+    const hits = [];
+    for (let i = haystack.indexOf(kw); i !== -1; i = haystack.indexOf(kw, i + 1)) {
+        let next = i + kw.length;
+        if (haystack[i - 1] === "[" && haystack[next] === "]")
+            continue; // a placeholder ("[DOB]"), not a label (#111)
+        if (haystack[next] === "s")
+            next++;
+        if (!isLetter(haystack.slice(i - 1, i)) && !isLetter(haystack.slice(next, next + 1))) {
+            hits.push(i);
+        }
+    }
+    if (hits.length === 0)
+        return -1;
+    return last ? hits[hits.length - 1] : hits[0];
+}
+function labelsThisDate(text, start, end, keywords, entityType) {
+    const [before, after] = getContext(text, start, end);
+    const lowerBefore = before.toLowerCase();
+    const lowerAfter = after.toLowerCase();
+    // A label on an earlier line counts only when the date opens its own line or
+    // the label was asked as a question (a call transcript's answer turn);
+    // a column header is a fallback and never overrules a label of the date's own.
+    const lineStart = lowerBefore.lastIndexOf("\n") + 1;
+    const opensLine = lowerBefore.slice(lineStart).replace(/[ \t:|;*\-•(\[]/g, "") === "";
+    if (entityType === types_js_1.EntityType.DOB && BIRTH_SIGN.test(lowerBefore))
+        return true;
+    for (const keyword of keywords) {
+        const kw = keyword.toLowerCase();
+        const i = keywordAt(lowerBefore, keyword, true);
+        if (i >= 0 && nothingButAListBetween(lowerBefore.slice(i + kw.length))
+            && (i >= lineStart || opensLine
+                || lowerBefore.slice(i + kw.length, lineStart).includes("?")))
+            return true;
+        const j = keywordAt(lowerAfter, keyword, false);
+        if (j >= 0) {
+            const gap = lowerAfter.slice(0, j);
+            if (!ANY_DATE.test(gap) && !SENTENCE_BREAK.test(gap)
+                && !LEADS_TO_A_DATE.test(lowerAfter.slice(j + kw.length)))
+                return true;
+        }
+    }
+    const header = columnHeader(text, start);
+    return header !== null && keywords.some(kw => keywordAt(header, kw, false) >= 0);
+}
+/**
+ * A label running straight into a date of its own introduces that date, not the
+ * one before it ("Verstorben am 01.02.2020, geboren am 12.03.1940").
+ */
+// ... or into a value already masked ("né le [DOB]"): the label is that value's (rules-engine#111).
+const LEADS_TO_A_DATE = new RegExp(String.raw `^[\s:.\-]*(?:[a-zà-ÿ]{1,3}[\s:.]+)?(?:\d{1,4}[/.\-]\d{1,2}[/.\-]\d{2,4}|\[[a-z_]+\]|\d{1,2}\.?\s+(?:` + exports.MONTH_NAMES + String.raw `)\.?\s+\d{4})`, "i");
+/** Field separators a table row may use. */
+const COLUMN_SEPARATORS = [";", "|", "\t", ","];
+/**
+ * The lower-cased header cell above the value, if it sits in a table: in a table
+ * the column decides the label, not proximity. A header is one of the three
+ * lines above, split by the row's separator into the same number of cells.
+ */
+function columnHeader(text, start) {
+    const lineStart = text.lastIndexOf("\n", start - 1) + 1;
+    const lineEndAt = text.indexOf("\n", start);
+    const line = text.slice(lineStart, lineEndAt >= 0 ? lineEndAt : text.length);
+    for (const sep of COLUMN_SEPARATORS) {
+        if (!line.includes(sep))
+            continue;
+        const cells = line.split(sep);
+        const column = text.slice(lineStart, start).split(sep).length - 1;
+        // Lines above, one lastIndexOf at a time: one of the three lines above, or
+        // further up through rows of the same table (rules-engine#126).
+        let end = lineStart - 1;
+        let seen = 0;
+        while (end >= 0 && seen < HEADER_REACH) {
+            const begin = end === 0 ? 0 : text.lastIndexOf("\n", end - 1) + 1;
+            const header = text.slice(begin, end);
+            seen++;
+            // A rule line ("|---|---|", "----+----") is neither header nor row (#130).
+            if (RULE_LINE.test(header)) {
+                end = begin - 1;
+                continue;
+            }
+            const heads = header.split(sep);
+            const same = heads.length === cells.length;
+            // A "label : value" field with a comma in its value is not a header
+            // (#111); a commented header ("# Spalten: Name;von;bis") is (#126).
+            // Nor is a data row without a date: a header has no cell with four digits or more (#130).
+            if (same && (!header.includes(":") || header.trimStart().startsWith("#")) && !ANY_DATE.test(header)
+                && !heads.some((h) => (h.match(/\d/g) ?? []).length >= 4)) {
+                return heads[column].toLowerCase();
+            }
+            if (seen >= 3 && !same)
+                break; // past the table this value sits in
+            end = begin - 1;
+        }
+    }
+    return null;
+}
+/** How many lines up a table's header is looked for. */
+const HEADER_REACH = 200;
+/** A table's rule line: only dashes, equals signs, plus signs, colons, pipes. */
+const RULE_LINE = /^[\s\-=+:|]*-[\s\-=+:|]*$/;
+/** A dotted MAC shape glued to more of a reference is part of it: the tail of
+ *  "WSO-II.6151.4471.2025" (rules-engine#105). Dotted form only. */
+function suppressMacInReference(text, match) {
+    if (match.patternDef.entityType !== types_js_1.EntityType.MAC_ADDRESS || !match.text.includes("."))
+        return false;
+    return joinedToMore(text, match.start, match.end);
+}
+/** A card number is never carved out of a longer run of digit groups: a
+ *  four-digit group joined by the card's own separator on either side means the
+ *  run is longer, e.g. a Polish account number (rules-engine#106). */
+function suppressCardInsideDigitRun(text, match) {
+    if (match.patternDef.entityType !== types_js_1.EntityType.CREDIT_CARD)
+        return false;
+    const sep = [...match.text].find(c => !/\d/.test(c)) ?? "";
+    if (!sep)
+        return false;
+    const s = sep.replace(/[-\\^$.*+?()[\]{}|]/g, "\\$&");
+    const before = text.slice(Math.max(0, match.start - 6), match.start);
+    const after = text.slice(match.end, match.end + 6);
+    return new RegExp(`(?<!\\d)\\d{4}${s}$`).test(before) || new RegExp(`^${s}\\d{4}(?!\\d)`).test(after);
 }
 const TYPE_SUPPRESSORS = {
     [types_js_1.EntityType.PHONE]: [suppressCurrency, suppressUnits, suppressReference, suppressMath, suppressPhoneServiceNumber, suppressPhoneInsideAccountRun, suppressPhoneDateOverlap, suppressPhoneAsNumberRange],
@@ -972,12 +1417,20 @@ const TYPE_SUPPRESSORS = {
     [types_js_1.EntityType.LICENSE_PLATE]: [suppressPlateInCompound, suppressDePlateUnknownDistrict, suppressPlateAsCurrencyAmount],
     [types_js_1.EntityType.SECRET]: [suppressSecretOverStructured, suppressSecretNotASecret],
     [types_js_1.EntityType.CHAMBER_OF_COMMERCE]: [suppressReference],
+    [types_js_1.EntityType.MAC_ADDRESS]: [suppressMacInReference],
+    [types_js_1.EntityType.CREDIT_CARD]: [suppressCardInsideDigitRun],
+    [types_js_1.EntityType.IP_ADDRESS]: [suppressIpNotAHost],
 };
+for (const type of EXAMPLE_TYPES) {
+    TYPE_SUPPRESSORS[type] = [...(TYPE_SUPPRESSORS[type] ?? []), suppressExampleValue, suppressNotAnIdentifier];
+}
 function shouldSuppress(text, match, scratch) {
     if (suppressSequential(text, match))
         return true;
     if (suppressRedactionPlaceholder(text, match))
         return true;
+    if (suppressDummyValue(text, match))
+        return true;
     const typeSups = TYPE_SUPPRESSORS[match.patternDef.entityType];
     if (typeSups) {
         for (const s of typeSups) {