euredact 0.7.0 → 0.7.1

package/README.md

@@ -82,7 +82,8 @@ console.log(result.detections);
 | keep relationships visible across a whole session | `{ referentialIntegrity: true }` |
 | never redact my own company name or addresses | `{ allowlist: [...] }`, or `new EuRedact({ allowlist })` |
 | never redact anything at my own domain | `{ allowlistDomains: ["acme.be"] }` |
-| audit what the allowlist kept in the document | `result.exempted` |
+| leave whole types in the text (job titles, amounts) | `{ excludeTypes: ["JOB_TITLE", "FINANCIAL_AMOUNT"] }`, or `new EuRedact({ excludeTypes })` — see [Excluding entity types](#excluding-entity-types) |
+| audit what the allowlist or `excludeTypes` kept in the document | `result.exempted` |
 | catch person names, employers, job titles, diagnoses | `redactAsync(text, { mode: "cloud" })` — see [Cloud tier](#cloud-tier) |
 | include dates of birth | `{ detectDates: true }` |
 | redact a document too large for one call | `context` + `chunkOffset` — see [Chunked documents](#chunked-documents) |
@@ -112,6 +113,7 @@ interface RedactOptions {
   tokenize?: boolean;               // reversible tokens, EMAIL_K7Q2
   allowlist?: string[] | null;      // values never redacted
   allowlistDomains?: string[] | null; // domains never redacted (EMAIL/URL)
+  excludeTypes?: string[] | null;   // entity types neither reported nor masked
   detectDates?: boolean;            // include DOB / date of death
   cache?: boolean;                  // reuse results for identical input
   idempotencyKey?: string;          // mode: "cloud" only; see the table below
@@ -136,6 +138,7 @@ interface RedactOptions {
 | `tokenize` | `false` | Reversible token per value (`EMAIL_K7Q2`), with the mapping in `result.tokens` for [`restore()`](#restoretext-tokens). Unique to the **call**. Cannot be combined with `referentialIntegrity`. See [Reversible tokenization](#reversible-tokenization). |
 | `allowlist` | `null` | Values never to redact, whole-span and case-insensitive, merged with the instance's list. Structured identifiers (IBAN, phone, VAT, …) also match across spacing and hyphenation. Applies to cloud-tier types too. See [Allowlist](#allowlist). |
 | `allowlistDomains` | `null` | Domains whose addresses are never redacted, e.g. `["acme.be"]`. Applies to `EMAIL` and `URL` only, and covers subdomains. See [Allowlist](#allowlist). |
+| `excludeTypes` | `null` | Entity types neither reported nor masked, e.g. `["JOB_TITLE"]`; merged with the instance's list. Unknown names throw. See [Excluding entity types](#excluding-entity-types). |
 
 **Long documents and tiers**
 
@@ -229,6 +232,8 @@ The `EuRedact` class exposes `redact()`, `redactAsync()`, `redactBatch()`,
 new EuRedact({
   maxInputLength?: number,   // default 10_485_760 (~10 MB)
   allowlist?: string[] | null,
+  allowlistDomains?: string[] | null,
+  excludeTypes?: string[] | null,
 })
 ```
 
@@ -237,6 +242,7 @@ new EuRedact({
 | `maxInputLength` | `10_485_760` | Longest document `redact()` accepts, in characters. Above it, it throws — split the input or raise the ceiling. |
 | `allowlist` | `null` | Values never to redact, for every call on this instance. Merged with the per-call `allowlist`. See [Allowlist](#allowlist). |
 | `allowlistDomains` | `null` | Domains never to redact, for every call on this instance. |
+| `excludeTypes` | `null` | Entity types never reported or masked, for every call on this instance. See [Excluding entity types](#excluding-entity-types). |
 
 The result cache, referential-integrity labels and custom patterns are all per
 instance, which is what makes one instance per tenant the right default.
@@ -259,7 +265,7 @@ interface RedactResult {
   detectionMode: string;                      // "declared" if countries was passed,
                                               // "inferred" otherwise
   tokens: Record<string, string>; // token -> original value; only with tokenize: true
-  exempted: Exemption[];          // spans the allowlist kept, with the rule that matched
+  exempted: Exemption[];          // spans the allowlist or excludeTypes kept, with the rule
   cloud?: CloudInfo;              // mode: "cloud" only: job id, model, cost, unplaced
                                   // findings — see "What the service said"
 }
@@ -1409,8 +1415,8 @@ sdk.redact("Mail jan@acme.be or piet@acme.be", { countries: ["NL"] }).redactedTe
 label boundary, so `acme.be` does **not** exempt `evilacme.be`. Entries may be
 written `acme.be`, `@acme.be` or `.acme.be`.
 
-There are deliberately **no wildcards**. The allowlist is the only option that
-turns redaction *off*, so an over-broad entry fails toward under-redaction and
+There are deliberately **no wildcards**. The allowlist and `excludeTypes` are
+the only options that turn redaction *off*, so an over-broad entry fails toward under-redaction and
 does so silently.
 
 ### What was exempted
@@ -1422,10 +1428,51 @@ for (const e of r.exempted) console.log(e.entityType, e.text, e.rule, e.ruleKind
 ```
 
 `Exemption` carries `entityType`, `start`, `end`, `text`, the `rule` that
-matched as you wrote it, and `ruleKind` (`"value"` or `"domain"`). An exempted
+matched as you wrote it, and `ruleKind` (`"value"`, `"domain"` or `"type"`). An exempted
 span is absent from `detections`, so `exempted` is the only record that it was
 found at all.
 
+## Excluding entity types
+
+A deployment whose taxonomy is narrower than euRedact's can switch whole types
+off instead of filtering every result itself. Excluded types are neither in
+`detections` nor masked:
+
+```ts
+const r = redact("Mail anna@acme.be or call +32 470 12 34 56.", {
+  countries: ["BE"], excludeTypes: ["PHONE"],
+});
+r.redactedText;
+// 'Mail [EMAIL] or call +32 470 12 34 56.'
+for (const e of r.exempted) console.log(e.entityType, e.text, e.rule, e.ruleKind);
+// PHONE +32 470 12 34 56 PHONE type
+```
+
+Set it once for a deployment with `new EuRedact({ excludeTypes: [...] })`; a per-call
+list is merged with it.
+
+- **Nothing is excluded by default.** Every type is detected and redacted
+  unless you name it.
+- **Names are checked.** They are case-insensitive, and legacy names resolve
+  (`IBAN` is `BANK_ACCOUNT`, `CREDENTIAL` is `SECRET`). A registered custom
+  pattern's name works too. An unknown name throws, so a typo
+  cannot silently switch nothing off.
+- **It applies to each span's final type.** In
+  `NHS Number: 5556953627` the digits also pass the Austrian SVNr check.
+  Excluding `HEALTH_INSURANCE` leaves them in the text; it does not let them
+  be masked as an `SSN` instead.
+- **Every excluded detection is recorded** in `result.exempted`, with
+  `ruleKind: "type"` and the type's name as `rule`, so an audit can see what
+  was deliberately left in.
+- **In `mode: "cloud"`** an excluded rules type is still masked in the text
+  sent to the service. The option decides what comes back, not what may leave
+  your machine. Model types (`JOB_TITLE`, `FINANCIAL_AMOUNT`, …) are filtered
+  from the merged result.
+- **There is no include-list.** A list of types to keep would leave every type
+  a later release adds unmasked for you, without notice.
+- **A type is one switch.** `INTERNAL_ID` covers employee and customer numbers
+  as well as ticket and case numbers; excluding it leaves all of them in.
+
 ## Architecture
 
 ```

package/dist/cjs/rules/countries/index.js

@@ -4,6 +4,11 @@ exports.COUNTRY_CONFIGS = void 0;
 const types_js_1 = require("../../types.js");
 const validators_js_1 = require("../validators.js");
 const suppressors_js_1 = require("../suppressors.js");
+/** An assigned value: not opened by a quote or bracket, eight characters or
+ *  more, not ended by punctuation or a closer (rules-engine#35, #126). */
+const ASSIGNED = String.raw `[^\s"'\x60\[\]{}()<>„“”«»‚‘’]\S{6,}[^\s.,;:!?)'"\]}\x60“”»‘’]`;
+/** A quoted assigned value: exactly what the quotes hold (rules-engine#126). */
+const QUOTED_ASSIGNED = ['"', "'", "\x60"].flatMap((q) => [" ", ""].map((gap) => String.raw `(?<=[:=]` + gap + q + String.raw `)[^\s` + q + String.raw `]{8,}(?=` + q + ")")).join("|");
 /** Day, month as a word, year ("4. März 1948"), behind a date label (rules-engine#115). */
 function writtenDatePattern() {
     const names = new Set(suppressors_js_1.MONTH_NAMES.split("|").filter(Boolean));
@@ -146,6 +151,7 @@ const DOB_CONTEXT = [
     "γεννηθείς", "γεννήθηκε", "ημερομηνία γέννησης",
     // West Slavic.
     "urodzony", "urodzona", "data urodzenia",
+    "ur.",
     "narozen", "datum narození", "narodený", "dátum narodenia",
     // Hungarian, Romanian, Bulgarian.
     "született", "születési", "născut", "născută", "data nașterii",
@@ -268,14 +274,20 @@ const SHARED = {
         // AWS Secret Access Key (40 chars, base64 with +/ after an AKIA line)
         p(types_js_1.EntityType.SECRET, String.raw `(?<=aws_secret_access_key\s{0,4}[:=]\s{0,4})[A-Za-z0-9+/]{40}`, null, "AWS Secret Access Key"),
         // --- Secret / API Key (connection strings with embedded credentials) ---
-        p(types_js_1.EntityType.SECRET, String.raw `(?:mongodb|mysql|postgres(?:ql)?|redis|amqp|rabbitmq):\/\/[^\s:]{1,256}:[^\s@]{1,256}@[^\s]+`, null, "Connection string with credentials"),
+        // The tail stops at a quote (rules-engine#126).
+        p(types_js_1.EntityType.SECRET, String.raw `(?:mongodb|mysql|postgres(?:ql)?|redis|amqp|rabbitmq):\/\/[^\s:]{1,256}:[^\s@]{1,256}@[^\s"'\x60]+`, null, "Connection string with credentials"),
         // --- Secret / API Key (assignment-based: KEY=value or KEY: value) ---
         // The final character may not be sentence punctuation. `\S` does not stop
         // at a full stop, so "Reisepass: CA1234567." was claimed as the
         // ten-character span "CA1234567." -- a passport number plus the sentence's
         // period, masked as a credential because a "credentials" word sat within
         // the context window (rules-engine#35).
-        p(types_js_1.EntityType.SECRET, String.raw `(?<=[:=] )\S{7,}[^\s.,;:!?)'"]|(?<=[:=])\S{7,}[^\s.,;:!?)'"]`, "high_entropy", "Assigned secret value", SECRET_CONTEXT, true),
+        // The value starts after an opening quote or bracket and ends before its
+        // closer: `user = "svc_terraform"` was the span `"svc_terraform`
+        // (rules-engine#126).
+        // A quoted value is what the quotes hold, closing punctuation included.
+        p(types_js_1.EntityType.SECRET, QUOTED_ASSIGNED + "|" + [String.raw `(?<=[:=] )`, String.raw `(?<=[:=])`, String.raw `(?<=[:=] ["'\x60\[{(])`, String.raw `(?<=[:=]["'\x60\[{(])`]
+            .map((lb) => lb + ASSIGNED).join("|"), "high_entropy", "Assigned secret value", SECRET_CONTEXT, true),
         // --- Secret / API Key (entropy-based fallback for longer tokens) ---
         // Only the *trailing* \b is replaced. It could not match when the token run
         // ended on "-", "+" or "/", so the engine backtracked across two
@@ -555,7 +567,10 @@ const PT = {
         p(types_js_1.EntityType.PHONE, String.raw `\b[29]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\b[29]\d{8}\b`),
         p(types_js_1.EntityType.PHONE, String.raw `\+351\s?[29]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}`),
-        p(types_js_1.EntityType.LICENSE_PLATE, String.raw `\b[A-Z0-9]{2}-[A-Z0-9]{2}-[A-Z0-9]{2}\b`),
+        // The four formats Portugal has issued (rules-engine#126).
+        p(types_js_1.EntityType.LICENSE_PLATE, String.raw `\b(?:\d{2}-\d{2}-[A-Z]{2}|\d{2}-[A-Z]{2}-\d{2}|[A-Z]{2}-\d{2}-\d{2}|[A-Z]{2}-\d{2}-[A-Z]{2})\b`),
+        // Any three pairs, behind a plate label (rules-engine#126).
+        p(types_js_1.EntityType.LICENSE_PLATE, String.raw `\b[A-Z0-9]{2}-[A-Z0-9]{2}-[A-Z0-9]{2}\b`, null, "Portuguese license plate — AA-XX-XX, behind its label", ["matrícula", "matricula", "placa", "license plate", "number plate", "plate", "Kennzeichen", "kenteken", "immatriculation", "targa"], true),
         p(types_js_1.EntityType.POSTAL_CODE, String.raw `\b\d{4}-\d{3}\b`),
     ],
 };
@@ -630,6 +645,8 @@ const UK = {
     code: "UK",
     name: "United Kingdom",
     patterns: [
+        // A sort code behind its label; no longer found through the Portuguese plate shape (rules-engine#126).
+        p(types_js_1.EntityType.BANK_ACCOUNT, String.raw `\b\d{2}-\d{2}-\d{2}\b`, null, "UK sort code — NN-NN-NN, behind its label", ["sort code", "sortcode", "sort-code"], true),
         // Healthcare-provider numbers, behind their label: no shape of their own, so without a pattern nothing claimed them, or a phone or a foreign checksum did (canon HEALTHCARE_PROVIDER; rules-engine#111).
         p(types_js_1.EntityType.HEALTHCARE_PROVIDER, String.raw `\b\d{7}\b`, null, "UK GMC number — 7 digits", ["GMC number", "GMC no", "GMC reference", "GMC reg", "GMC:", "GMC-Nr", "General Medical Council"], true),
         // UK NINO: a social-security number, so SSN, as the canon defaults it (rules-engine#47).

package/dist/cjs/rules/suppressors.js

@@ -203,6 +203,27 @@ function suppressSecretOverStructured(text, match) {
  * natural word. A random all-letter token would be mixed case and is left alone
  * — losing a real secret is the expensive direction.
  */
+/**
+ * Values an assigned-secret rule finds after a "=" or ":" that are names, not
+ * secrets (rules-engine#126): `${VAR}` references, identifiers, hyphenated
+ * compounds, image tags, product versions, code calls. Not paths, host names
+ * or reference numbers: those carry personal data ("mac-mhartmann88").
+ * Kept in sync with the Python SDK's _SECRET_NAME_SHAPES.
+ */
+const SECRET_NAME_SHAPES = new RegExp([
+    String.raw `^\$\{[A-Za-z_][A-Za-z0-9_]*(?::?[-=?+][^}]*)?\}?$`,
+    String.raw `^[a-z]{2,}(?:_[a-z]{2,})+$`, String.raw `^[A-Z]{2,}(?:_[A-Z]{2,})+$`,
+    String.raw `^(?:[A-Z]+[a-z]{2,}){3,}(?:V?\d{1,2})?$`,
+    String.raw `^[a-z][a-z0-9._/-]*:(?:\d+(?:\.\d+)*(?:-[a-z0-9]+)*|latest|stable|alpine|slim)$`,
+    String.raw `^[A-Za-z][\w.-]*\/\d+(?:\.\d+)+$`,
+    String.raw `^[\w.]+\(["'\x60]`,
+].join("|"));
+/** A hyphenated compound of words and acronyms; two capitalised words alone
+ *  ("Ann-Sophie", "Caron-Cordier") are names and are left alone. */
+const COMPOUND_PART = String.raw `(?:[A-ZÀ-Þ]{2,6}\d{0,3}|[A-Za-zÀ-ÿ][a-zß-ÿ]{2,})`;
+const COMPOUND = new RegExp(String.raw `^` + COMPOUND_PART + String.raw `(?:-` + COMPOUND_PART + String.raw `)+$`);
+const NAME_PAIR = /^[A-ZÀ-Þ][a-zß-ÿ]{2,}-[A-ZÀ-Þ][a-zß-ÿ]{2,}$/;
+const CONNECTION_WITH_REFERENCE = /^[a-z]+:\/\/[^\s:@]+:\$\{[^}]*\}@/;
 function suppressSecretNotASecret(_text, match) {
     if (match.patternDef.entityType !== types_js_1.EntityType.SECRET)
         return false;
@@ -217,6 +238,10 @@ function suppressSecretNotASecret(_text, match) {
         return true;
     if (HYPHENATED_WORDS.test(bare))
         return true;
+    if (SECRET_NAME_SHAPES.test(bare) || CONNECTION_WITH_REFERENCE.test(bare))
+        return true;
+    if (COMPOUND.test(bare) && !NAME_PAIR.test(bare))
+        return true;
     const alpha = /^[A-Za-zÀ-ÿ]+$/.test(bare);
     const oneWord = bare === bare.toLowerCase() ||
         (bare.slice(0, 1) === bare.slice(0, 1).toUpperCase() &&
@@ -358,7 +383,20 @@ function suppressSequential(_text, match) {
 // the "]". The opening bracket is still required.
 const PLACEHOLDER = /^(?:\[([A-Z][A-Z0-9_]*)\]?|([A-Z][A-Z0-9_]*?)_(?:\d+|[A-HJ-NP-Z2-9]{4}))$/;
 const KNOWN_TYPE_NAMES = new Set(Object.values(types_js_1.EntityType));
-function suppressRedactionPlaceholder(_text, match) {
+function suppressRedactionPlaceholder(text, match) {
+    // The name between the brackets: an assigned value now starts after an
+    // opening bracket, so "credentials: [POSTAL_CODE]" offers "POSTAL_CODE" alone
+    // (rules-engine#33, #126).
+    if (text[match.start - 1] === "[" && text[match.end] === "]" && KNOWN_TYPE_NAMES.has(match.text))
+        return true;
+    // A placeholder inside the span: on text masked once, a value running across
+    // "[IP_ADDRESS]" is two things joined (rules-engine#126).
+    // One character either side: a span may start just inside the bracket.
+    const around = text.slice(Math.max(0, match.start - 1), match.end + 1);
+    for (const m of around.matchAll(/\[([A-Z][A-Z0-9_]*)\]/g)) {
+        if (KNOWN_TYPE_NAMES.has(m[1]))
+            return true;
+    }
     const found = PLACEHOLDER.exec(match.text);
     if (found === null)
         return false;
@@ -506,6 +544,33 @@ const EXTENSION_BEFORE = /(?<![A-Za-z0-9_])(?:toest(?:el)?|ext|extension|poste|d
  */
 const COUNT_LABEL_BEFORE = /(?<![A-Za-z0-9_])(?:employees|headcount|staff|mitarbeiter(?:innen)?|beschäftigte|werknemers|medewerkers|employés|salariés|effectifs?|dipendenti|empleados|pracowników|zaměstnanců)\s*[:=]?\s*$/i;
 const NOT_POSTAL_BEFORE = /(?<![A-Za-z0-9_])(?:(?:ISO(?:\/IEC)?|IEC|EN|DIN(?:\s+EN)?|NEN(?:-EN)?|NF\s+EN|BS(?:\s+EN)?|PN-EN|ÖNORM)[\s\-]*|[A-Za-z]*[a-z][A-Z][A-Za-z]*\s+)$/;
+/**
+ * What else a number is, by what touches it (rules-engine#126): a build,
+ * version, event, lease, policy or ticket number; a port; an invoice, reference
+ * or study-subject number; a process id; a JSON id or port field; an HTTP
+ * response size; the hour after a date; a lab reference range; or a quantity
+ * with its unit after it. Kept in sync with the Python SDK.
+ */
+const TECH_WORD_BEFORE = /(?<![A-Za-z0-9_])(?:build|version|policy\s+id|ticket(?:\s+[A-Za-z]{2,10})?|event|lease|pid|job|port|rfc|facture|invoice|r[ée]f[ée]rence|n[°º]|tn|sae|uczestnik|subject|narratief|participant)\.?\s*[:#=]?\s*["(«[]?\s*$/i;
+const TECH_SHAPE_BEFORE = new RegExp("(?:" + [
+    String.raw `"[A-Za-z_]*(?:id|port)"\s*:\s*"?`, // "parent_id": 4400
+    String.raw `(?<![A-Za-z0-9])[A-Z_]*PORT\s*[:=]\s*"?`, // DB_PORT: "5432"
+    String.raw `(?:localhost|[a-z0-9\-]+\.[a-z0-9.\-]+):`, // localhost:3000
+    String.raw `(?<![\d.])\d{2,5}:`, // "8080:8080"
+    String.raw `HTTP\/\d(?:\.\d)?"?\s+\d{3}\s+`, // HTTP/1.1" 200 2048
+    String.raw `\d+\.\d+(?:\.\d+)+\s*\(`, // build 2.4.0 (4012)
+    String.raw `(?<!\d)\d{1,2}[./]\d{1,2}[./]`, // 03.10.2026 23:50
+    String.raw `\((?:N|norm(?:al)?|ref)\s*:?\s*`, // (N : 30-400)
+    String.raw `\|`,
+].join("|") + ")$", "i");
+const POSTAL_UNIT_AFTER = /^(?:\s?(?:ms|s|sec|secs|seconds?|secondes?|sekunden|sek|min|bits?|bytes?|kb|mb|gb|tb|kbps|mbps|px|%|records|rows|entries|datensätze|einträge|micrograms|µg|ug|mg|mmol|fl)(?![A-Za-zÀ-ÿ])|\s*→\s*\d+\s*(?:bits?|bytes?)(?![A-Za-z])|:\d|\|)/i;
+const PID_BEFORE = /[A-Za-z0-9_\-]\[$/;
+/** A standard's name as the letters of a lettered postcode: "RFC 5737". Not
+ *  BS or EN: those are Bristol and Enfield. */
+const STANDARD_LETTERS = /^(?:RFC|ISO|IEC|DIN)\s?\d/;
+/** A year closing a range: "1998–2011". En and em dashes only. */
+const YEAR_RANGE_BEFORE = /(?:19|20)\d\d\s?[–—]\s?$/;
+const YEAR_RANGE_AFTER = /^\s?[–—]\s?(?:19|20)\d\d(?!\d)/;
 /** A thousands group of an amount: the "750" of "£28,750,000". */
 const GROUP_BEFORE = /\d[,.]$/;
 const GROUP_AFTER = /^[,.]\d{3}(?!\d)/;
@@ -519,10 +584,90 @@ function suppressPostalAfterDisqualifyingWord(text, match) {
         return true;
     if (GROUP_BEFORE.test(before) && GROUP_AFTER.test(text.slice(match.end, match.end + 5)))
         return true;
+    const after = text.slice(match.end, match.end + 24);
+    if (TECH_WORD_BEFORE.test(before) || TECH_SHAPE_BEFORE.test(before) || POSTAL_UNIT_AFTER.test(after)
+        || STANDARD_LETTERS.test(match.text))
+        return true;
+    if (PID_BEFORE.test(before) && after.startsWith("]"))
+        return true;
+    if (DATE_YEAR.test(match.text.trim()) && (YEAR_RANGE_BEFORE.test(before) || YEAR_RANGE_AFTER.test(after)))
+        return true;
     return RECENT_YEAR.test(match.text.trim())
         && (YEAR_WORD_BEFORE.test(before) || YEAR_VERB_BEFORE.test(before))
         && !TOWN_AFTER.test(text.slice(match.end, match.end + 3));
 }
+/** A group with a leading zero: "2.00.079.01" is a version, not an address. */
+const IP_LEADING_ZERO = /(?:^|\.)0\d/;
+const CIDR_PREFIX_AFTER = /^\/(\d{1,2})(?!\d)/;
+/** RFC 5737's documentation ranges: reserved, never routed, used in examples. */
+const DOCUMENTATION_NETS = ["192.0.2.", "198.51.100.", "203.0.113."];
+/**
+ * An IPv4 shape that names no host (rules-engine#126): a network address
+ * ("10.40.0.0/16"), a documentation address, or a version with leading zeros.
+ * An interface address with its prefix ("192.168.1.23/24") stays.
+ */
+function suppressIpNotAHost(text, match) {
+    if (match.patternDef.entityType !== types_js_1.EntityType.IP_ADDRESS)
+        return false;
+    const ip = match.text;
+    if (IP_LEADING_ZERO.test(ip) || DOCUMENTATION_NETS.some((n) => ip.startsWith(n)))
+        return true;
+    // Part of a longer dotted run: "urn:oid:1.2.250.1.71.4.2.1" is an OID.
+    if (/\d\.$/.test(text.slice(Math.max(0, match.start - 2), match.start))
+        || /^\.\d/.test(text.slice(match.end, match.end + 2)))
+        return true;
+    const prefix = CIDR_PREFIX_AFTER.exec(text.slice(match.end, match.end + 4));
+    if (prefix !== null && Number(prefix[1]) < 32) {
+        const value = ip.split(".").reduce((acc, o) => acc * 256 + Number(o), 0);
+        return value % 2 ** (32 - Number(prefix[1])) === 0;
+    }
+    return false;
+}
+/**
+ * The specimen of a form: "das Muster „C01X00T47“". Only "Muster": "z. B." and
+ * "e.g." introduce real values in prose as often as samples (rules-engine#126).
+ */
+const EXAMPLE_BEFORE = /(?<![A-Za-z])muster\s*[:,]?\s*[„"«']?$/i;
+/** A dummy value in placeholder glyphs ("XX0000000", "999 999 9999") or MAC
+ *  groups of one repeated letter. Not "111222333", the standard test BSN. */
+const DUMMY_VALUE = /^(?=(?:[\s:\-./]*[X09]){5})(?:[X\s:\-./]*[X][X0\s:\-./]*|[X9\s:\-./]*X[X9\s:\-./]*|[0\s:\-./]+|[9\s:\-./]+)$|^(?:([a-fA-F])\1[:\-]){2,}([a-fA-F])\2$/;
+/** Algorithm names in a key or signature line: "ED25519", "SHA256". */
+const ALGORITHM = /^(?:ED25519|ED448|SHA-?(?:1|224|256|384|512)|MD5|AES-?\d{3}|RSA-?\d{3,4}|[HRE]S(?:256|384|512))$/i;
+/** A date exactly, which no national number is written as. */
+const EXACT_DOTTED_DATE = /^(?:0[1-9]|[12]\d|3[01])\.(?:0[1-9]|1[0-2])\.(?:19|20)\d\d$/;
+/** The identifier types an example marker or a dummy value rules out. */
+const EXAMPLE_TYPES = new Set([
+    types_js_1.EntityType.NATIONAL_ID, types_js_1.EntityType.PASSPORT, types_js_1.EntityType.LICENSE_PLATE,
+    types_js_1.EntityType.HEALTH_INSURANCE, types_js_1.EntityType.MAC_ADDRESS,
+    types_js_1.EntityType.DRIVERS_LICENSE, types_js_1.EntityType.SSN, types_js_1.EntityType.TAX_ID,
+]);
+/** A placeholder in the shape of a value, for any type (#126). */
+function suppressDummyValue(_text, match) {
+    return DUMMY_VALUE.test(match.text.trim());
+}
+/** An identifier given as a form's specimen, not anyone's (#126). */
+function suppressExampleValue(text, match) {
+    if (!EXAMPLE_TYPES.has(match.patternDef.entityType))
+        return false;
+    return EXAMPLE_BEFORE.test(text.slice(Math.max(0, match.start - 24), match.start));
+}
+/**
+ * Shapes that fit an identifier pattern and are something else (#126): a
+ * passport without a digit, an algorithm or a law citation read as a plate,
+ * a date read as a dotted national number.
+ */
+function suppressNotAnIdentifier(text, match) {
+    const type = match.patternDef.entityType;
+    const value = match.text.trim();
+    if (type === types_js_1.EntityType.PASSPORT)
+        return !/\d/.test(value);
+    if (type === types_js_1.EntityType.LICENSE_PLATE) {
+        return ALGORITHM.test(value) || /§\s*$/.test(text.slice(Math.max(0, match.start - 4), match.start));
+    }
+    if (type === types_js_1.EntityType.NATIONAL_ID)
+        return EXACT_DOTTED_DATE.test(value);
+    return false;
+}
 function suppressPhoneServiceNumber(_text, match) {
     if (match.patternDef.entityType !== types_js_1.EntityType.PHONE)
         return false;
@@ -634,7 +779,11 @@ function suppressDePlateUnknownDistrict(text, match) {
     const parts = match.text.trim().split(/[\s\-]+/);
     if (parts.length === 0 || !parts[0])
         return false;
-    if (deDistricts_js_1.DE_DISTRICT_CODES.has(parts[0].toUpperCase()))
+    // A German plate number never starts with 0: without a plate cue,
+    // "GR-NB-0412" is an asset tag and "HR-IT-03" a form (rules-engine#126).
+    const digits = /\d+/.exec(match.text);
+    const leadingZero = digits !== null && digits[0].startsWith("0");
+    if (deDistricts_js_1.DE_DISTRICT_CODES.has(parts[0].toUpperCase()) && !leadingZero)
         return false;
     const [before, after] = getContext(text, match.start, match.end);
     if (PLATE_CUE_NEAR.test(before + after))
@@ -1076,15 +1225,22 @@ function suppressRequiresContext(text, match) {
         return false;
     // A value filling an entire field of a delimited row is introduced by its
     // column, not by a word, so that is context — but only for narrow shapes.
+    // A date's column decides when the table names it: under "début" or
+    // "last_day" a date is not a birth date (rules-engine#126).
     if (DELIMITED_FIELD_TYPES.has(match.patternDef.entityType) &&
-        fillsADelimitedField(text, match.start, match.end))
+        fillsADelimitedField(text, match.start, match.end) &&
+        !(DATE_LABEL_TYPES.has(match.patternDef.entityType) && columnHeader(text, match.start) !== null))
         return false;
     if (DATE_LABEL_TYPES.has(match.patternDef.entityType)) {
         return !labelsThisDate(text, match.start, match.end, match.patternDef.contextKeywords, match.patternDef.entityType);
     }
     const [before, after] = getContext(text, match.start, match.end);
     const context = (before + " " + after).toLowerCase();
-    return !match.patternDef.contextKeywords.some(kw => context.includes(kw.toLowerCase()));
+    if (match.patternDef.contextKeywords.some(kw => context.includes(kw.toLowerCase())))
+        return false;
+    // The column names it: a passport under "Passport" rows below the header (#130).
+    const header = columnHeader(text, match.start);
+    return header === null || !match.patternDef.contextKeywords.some(kw => keywordAt(header, kw, false) >= 0);
 }
 /** Date types decided by a label: DOB and DATE_OF_DEATH share one date shape. */
 const DATE_LABEL_TYPES = new Set([types_js_1.EntityType.DOB, types_js_1.EntityType.DATE_OF_DEATH]);
@@ -1120,10 +1276,16 @@ function nothingButAListBetween(gap) {
  */
 function keywordAt(haystack, keyword, last) {
     const kw = keyword.toLowerCase();
+    const isLetter = (c) => c !== "" && c.toLowerCase() !== c.toUpperCase();
     if (keyword !== keyword.toUpperCase() || keyword === kw) {
-        return last ? haystack.lastIndexOf(kw) : haystack.indexOf(kw);
+        // It must start a word, though it may run on into a longer one: "née le"
+        // in "signée le" and "born" in "Newborn" are other words (rules-engine#126).
+        let i = last ? haystack.lastIndexOf(kw) : haystack.indexOf(kw);
+        while (i > 0 && isLetter(haystack[i - 1])) {
+            i = last ? (i === 0 ? -1 : haystack.lastIndexOf(kw, i - 1)) : haystack.indexOf(kw, i + 1);
+        }
+        return i;
     }
-    const isLetter = (c) => c !== "" && c.toLowerCase() !== c.toUpperCase();
     const hits = [];
     for (let i = haystack.indexOf(kw); i !== -1; i = haystack.indexOf(kw, i + 1)) {
         let next = i + kw.length;
@@ -1185,29 +1347,44 @@ function columnHeader(text, start) {
     const lineStart = text.lastIndexOf("\n", start - 1) + 1;
     const lineEndAt = text.indexOf("\n", start);
     const line = text.slice(lineStart, lineEndAt >= 0 ? lineEndAt : text.length);
-    // The three lines above, by lastIndexOf: splitting the whole prefix was
-    // quadratic in the document, once per date candidate.
-    let aboveStart = lineStart - 1;
-    for (let k = 0; k < 3 && aboveStart >= 0; k++) {
-        aboveStart = aboveStart === 0 ? -1 : text.lastIndexOf("\n", aboveStart - 1);
-    }
-    const above = lineStart ? text.slice(aboveStart + 1, Math.max(0, lineStart - 1)).split("\n") : [];
     for (const sep of COLUMN_SEPARATORS) {
         if (!line.includes(sep))
             continue;
         const cells = line.split(sep);
         const column = text.slice(lineStart, start).split(sep).length - 1;
-        for (const header of [...above].reverse()) {
-            // A "label : value" field with a comma in its value is not a header (#111).
-            if (header.includes(":"))
+        // Lines above, one lastIndexOf at a time: one of the three lines above, or
+        // further up through rows of the same table (rules-engine#126).
+        let end = lineStart - 1;
+        let seen = 0;
+        while (end >= 0 && seen < HEADER_REACH) {
+            const begin = end === 0 ? 0 : text.lastIndexOf("\n", end - 1) + 1;
+            const header = text.slice(begin, end);
+            seen++;
+            // A rule line ("|---|---|", "----+----") is neither header nor row (#130).
+            if (RULE_LINE.test(header)) {
+                end = begin - 1;
                 continue;
+            }
             const heads = header.split(sep);
-            if (heads.length === cells.length && !ANY_DATE.test(header))
+            const same = heads.length === cells.length;
+            // A "label : value" field with a comma in its value is not a header
+            // (#111); a commented header ("# Spalten: Name;von;bis") is (#126).
+            // Nor is a data row without a date: a header has no cell with four digits or more (#130).
+            if (same && (!header.includes(":") || header.trimStart().startsWith("#")) && !ANY_DATE.test(header)
+                && !heads.some((h) => (h.match(/\d/g) ?? []).length >= 4)) {
                 return heads[column].toLowerCase();
+            }
+            if (seen >= 3 && !same)
+                break; // past the table this value sits in
+            end = begin - 1;
         }
     }
     return null;
 }
+/** How many lines up a table's header is looked for. */
+const HEADER_REACH = 200;
+/** A table's rule line: only dashes, equals signs, plus signs, colons, pipes. */
+const RULE_LINE = /^[\s\-=+:|]*-[\s\-=+:|]*$/;
 /** A dotted MAC shape glued to more of a reference is part of it: the tail of
  *  "WSO-II.6151.4471.2025" (rules-engine#105). Dotted form only. */
 function suppressMacInReference(text, match) {
@@ -1242,12 +1419,18 @@ const TYPE_SUPPRESSORS = {
     [types_js_1.EntityType.CHAMBER_OF_COMMERCE]: [suppressReference],
     [types_js_1.EntityType.MAC_ADDRESS]: [suppressMacInReference],
     [types_js_1.EntityType.CREDIT_CARD]: [suppressCardInsideDigitRun],
+    [types_js_1.EntityType.IP_ADDRESS]: [suppressIpNotAHost],
 };
+for (const type of EXAMPLE_TYPES) {
+    TYPE_SUPPRESSORS[type] = [...(TYPE_SUPPRESSORS[type] ?? []), suppressExampleValue, suppressNotAnIdentifier];
+}
 function shouldSuppress(text, match, scratch) {
     if (suppressSequential(text, match))
         return true;
     if (suppressRedactionPlaceholder(text, match))
         return true;
+    if (suppressDummyValue(text, match))
+        return true;
     const typeSups = TYPE_SUPPRESSORS[match.patternDef.entityType];
     if (typeSups) {
         for (const s of typeSups) {