euredact 0.7.0 → 0.7.1

package/dist/cjs/sdk.js

@@ -38,6 +38,7 @@ exports.applyReplacements = applyReplacements;
 exports.maskForCloud = maskForCloud;
 exports.ontoOriginal = ontoOriginal;
 exports.restore = restore;
+exports.normalizeExcludeTypes = normalizeExcludeTypes;
 const platform_js_1 = require("./platform.js");
 const cache_js_1 = require("./cache.js");
 const normalizer_js_1 = require("./normalizer.js");
@@ -394,6 +395,70 @@ function applyAllowlist(text, detections, allowed, domains) {
     }
     return [kept, exempted];
 }
+const KNOWN_TYPES = new Set(Object.values(types_js_1.EntityType));
+/**
+ * The entity types a caller asked to leave in the text, by canonical name.
+ *
+ * Names are matched case-insensitively and legacy names resolve (`IBAN` is
+ * `BANK_ACCOUNT`, `CREDENTIAL` is `SECRET`). A custom pattern's name counts
+ * once it is registered. Anything else throws: a typo in a type meant to be
+ * switched off would otherwise switch nothing off (rules-engine#125).
+ */
+function normalizeExcludeTypes(values, customNames = new Set(), param = "excludeTypes") {
+    const out = new Set();
+    if (values === null || values === undefined)
+        return out;
+    checkAllowlistArg(values, param);
+    for (const v of values) {
+        if (typeof v !== "string") {
+            throw new TypeError(`${param} entries must be type names, not ${typeof v}`);
+        }
+        if (customNames.has(v)) {
+            out.add(v);
+            continue;
+        }
+        const name = (0, types_js_1.canonicalType)(v);
+        if (!KNOWN_TYPES.has(name)) {
+            throw new Error(`unknown entity type ${JSON.stringify(v)} in ${param}. Known types: ` +
+                [...KNOWN_TYPES].sort().join(", ") +
+                (customNames.size ? `; custom patterns: ${[...customNames].sort().join(", ")}` : ""));
+        }
+        out.add(name);
+    }
+    return out;
+}
+/**
+ * Split off the detections of the types the caller excluded. Applied to each
+ * span's final type, after ranking: dropping an excluded type's candidates
+ * earlier would let the next-best type claim the same span.
+ */
+function applyTypeExclusion(text, detections, excluded) {
+    if (excluded.size === 0)
+        return [detections, []];
+    const kept = [];
+    const exempted = [];
+    for (const d of detections) {
+        const name = String(d.entityType);
+        if (excluded.has(name)) {
+            exempted.push({
+                entityType: d.entityType, start: d.start, end: d.end,
+                text: text.slice(d.start, d.end), rule: name, ruleKind: "type",
+            });
+        }
+        else
+            kept.push(d);
+    }
+    return [kept, exempted];
+}
+/** Allowlist first, then excluded types; every exemption in text order. */
+function exempt(text, detections, allowed, domains, excluded) {
+    const [afterValues, byValue] = applyAllowlist(text, detections, allowed, domains);
+    const [kept, byType] = applyTypeExclusion(text, afterValues, excluded);
+    const exempted = [...byValue, ...byType];
+    if (byValue.length && byType.length)
+        exempted.sort((a, b) => a.start - b.start || b.end - a.end);
+    return [kept, exempted];
+}
 /** Two label schemes for the same spans cannot both apply. */
 function checkLabelOptions(options) {
     if (options.tokenize && options.referentialIntegrity) {
@@ -474,19 +539,26 @@ class EuRedact {
     maxInputLength;
     allowlist;
     allowlistDomains;
+    customNames = new Set();
+    excludeTypes;
     /**
      * @param options.maxInputLength Longest document `redact` accepts, in characters.
      * @param options.allowlist Values never to redact, for every call on this
      *   instance — an organisation's own name, its own addresses. Merged with
      *   the per-call `allowlist`. Matched whole, case-insensitively.
+     * @param options.excludeTypes Entity types never reported or masked, for
+     *   every call on this instance, e.g. `["JOB_TITLE", "FINANCIAL_AMOUNT"]`.
+     *   Merged with the per-call value. Unknown names throw.
      */
     constructor(options) {
         this.maxInputLength = options?.maxInputLength ?? DEFAULT_MAX_INPUT_LENGTH;
         this.allowlist = normalizeAllowlist(options?.allowlist);
         this.allowlistDomains = normalizeDomains(options?.allowlistDomains);
+        this.excludeTypes = normalizeExcludeTypes(options?.excludeTypes);
     }
     addCustomPattern(name, pattern) {
         this.engine.addCustomPattern(name, pattern);
+        this.customNames.add(name);
         this.cache.clear();
     }
     /** Clear the result cache and referential integrity mappings.
@@ -502,6 +574,13 @@ class EuRedact {
             allowed.set(k, v);
         return allowed;
     }
+    /** The instance's excluded types merged with a call's. */
+    excludedFor(options) {
+        const excluded = new Set(this.excludeTypes);
+        for (const t of normalizeExcludeTypes(options.excludeTypes, this.customNames))
+            excluded.add(t);
+        return excluded;
+    }
     /** The instance domain list merged with a call's. */
     domainsFor(options) {
         const domains = new Map(this.allowlistDomains);
@@ -558,14 +637,16 @@ class EuRedact {
         }
         const allowed = this.allowedFor(options);
         const domains = this.domainsFor(options);
+        const excluded = this.excludedFor(options);
         const client = new CloudClient();
         // Dates are always on, whatever detectDates says: that is the rules output
         // the model was trained against, and a date of birth the rules can place
         // has no reason to travel. It is the one ignored option that is safe to
         // ignore — it can only cause MORE to be detected, never less.
         //
-        // No allowlist and no tokens on this pass. An exemption says what the
-        // caller wants back, not what may leave; both are applied below, after the
+        // No allowlist, no excluded types and no tokens on this pass. An exemption
+        // says what the caller wants back, not what may leave: an excluded EMAIL is
+        // still masked in the request. All three are applied below, after the
         // response, to the merged spans.
         const local = this.redactRules(text, { countries, detectDates: true, cache: options.cache }, new Map(), new Map());
         const [masked, labels] = maskForCloud(text, local.detections);
@@ -575,7 +656,7 @@ class EuRedact {
             country: countries[0], idempotencyKey: options.idempotencyKey,
         });
         // A new array throughout: `local` may be the cached rules result.
-        const [detections, exempted] = applyAllowlist(text, [...local.detections, ...ontoOriginal(remote.detections, masked, text, labels, CloudError)], allowed, domains);
+        const [detections, exempted] = exempt(text, [...local.detections, ...ontoOriginal(remote.detections, masked, text, labels, CloudError)], allowed, domains, excluded);
         detections.sort((a, b) => a.start - b.start || b.end - a.end);
         const tokenMapper = options.tokenize ? new TokenMapper(text, detections) : null;
         return {
@@ -594,6 +675,7 @@ class EuRedact {
         checkLabelOptions(options);
         const allowed = this.allowedFor(options);
         const domains = this.domainsFor(options);
+        const excluded = this.excludedFor(options);
         const requestedMode = options.mode ?? "rules";
         if (requestedMode === "cloud") {
             // Cannot be served synchronously: the cloud tier is a network call, and
@@ -610,10 +692,10 @@ class EuRedact {
         if (options.idempotencyKey !== undefined) {
             throw new Error('idempotencyKey applies to mode: "cloud" only: a rules-only redaction makes no request to deduplicate');
         }
-        return this.redactRules(text, options, allowed, domains);
+        return this.redactRules(text, options, allowed, domains, excluded);
     }
     /** The local pipeline: normalise, detect, exempt, mask. */
-    redactRules(text, options, allowed, domains) {
+    redactRules(text, options, allowed, domains, excluded = new Set()) {
         if (text.length > this.maxInputLength) {
             throw new Error(`Input text length (${text.length.toLocaleString()} chars) exceeds the maximum ` +
                 `(${this.maxInputLength.toLocaleString()} chars). Split the input or ` +
@@ -636,7 +718,8 @@ class EuRedact {
         // JSON rather than a joined string: an entry may itself contain the
         // separator, and two different lists must never share a key.
         const allowKey = (allowed.size ? JSON.stringify([...allowed.keys()].sort()) : "")
-            + (domains.size ? "|dom=" + JSON.stringify([...domains.keys()].sort()) : "");
+            + (domains.size ? "|dom=" + JSON.stringify([...domains.keys()].sort()) : "")
+            + (excluded.size ? "|excl=" + JSON.stringify([...excluded].sort()) : "");
         const cacheMode = `rules|dates=${detectDates}|hint=${hintKey}|ri=${referentialIntegrity}|tok=${tokenize}|allow=${allowKey}`;
         let cacheKey;
         if (cache) {
@@ -660,7 +743,7 @@ class EuRedact {
             detections = detections.filter(d => !DATE_TYPES.has(d.entityType));
         }
         let exempted;
-        [detections, exempted] = applyAllowlist(text, detections, allowed, domains);
+        [detections, exempted] = exempt(text, detections, allowed, domains, excluded);
         detections.sort((a, b) => a.start - b.start || b.end - a.end);
         const tokenMapper = tokenize ? new TokenMapper(text, detections) : null;
         const redacted = applyReplacements(text, detections, this.labelFor(referentialIntegrity, tokenMapper));

package/dist/esm/rules/countries/index.js

@@ -1,6 +1,11 @@
 import { EntityType } from "../../types.js";
 import { IBAN_LENGTHS } from "../validators.js";
 import { MONTH_NAMES } from "../suppressors.js";
+/** An assigned value: not opened by a quote or bracket, eight characters or
+ *  more, not ended by punctuation or a closer (rules-engine#35, #126). */
+const ASSIGNED = String.raw `[^\s"'\x60\[\]{}()<>„“”«»‚‘’]\S{6,}[^\s.,;:!?)'"\]}\x60“”»‘’]`;
+/** A quoted assigned value: exactly what the quotes hold (rules-engine#126). */
+const QUOTED_ASSIGNED = ['"', "'", "\x60"].flatMap((q) => [" ", ""].map((gap) => String.raw `(?<=[:=]` + gap + q + String.raw `)[^\s` + q + String.raw `]{8,}(?=` + q + ")")).join("|");
 /** Day, month as a word, year ("4. März 1948"), behind a date label (rules-engine#115). */
 function writtenDatePattern() {
     const names = new Set(MONTH_NAMES.split("|").filter(Boolean));
@@ -143,6 +148,7 @@ const DOB_CONTEXT = [
     "γεννηθείς", "γεννήθηκε", "ημερομηνία γέννησης",
     // West Slavic.
     "urodzony", "urodzona", "data urodzenia",
+    "ur.",
     "narozen", "datum narození", "narodený", "dátum narodenia",
     // Hungarian, Romanian, Bulgarian.
     "született", "születési", "născut", "născută", "data nașterii",
@@ -265,14 +271,20 @@ const SHARED = {
         // AWS Secret Access Key (40 chars, base64 with +/ after an AKIA line)
         p(EntityType.SECRET, String.raw `(?<=aws_secret_access_key\s{0,4}[:=]\s{0,4})[A-Za-z0-9+/]{40}`, null, "AWS Secret Access Key"),
         // --- Secret / API Key (connection strings with embedded credentials) ---
-        p(EntityType.SECRET, String.raw `(?:mongodb|mysql|postgres(?:ql)?|redis|amqp|rabbitmq):\/\/[^\s:]{1,256}:[^\s@]{1,256}@[^\s]+`, null, "Connection string with credentials"),
+        // The tail stops at a quote (rules-engine#126).
+        p(EntityType.SECRET, String.raw `(?:mongodb|mysql|postgres(?:ql)?|redis|amqp|rabbitmq):\/\/[^\s:]{1,256}:[^\s@]{1,256}@[^\s"'\x60]+`, null, "Connection string with credentials"),
         // --- Secret / API Key (assignment-based: KEY=value or KEY: value) ---
         // The final character may not be sentence punctuation. `\S` does not stop
         // at a full stop, so "Reisepass: CA1234567." was claimed as the
         // ten-character span "CA1234567." -- a passport number plus the sentence's
         // period, masked as a credential because a "credentials" word sat within
         // the context window (rules-engine#35).
-        p(EntityType.SECRET, String.raw `(?<=[:=] )\S{7,}[^\s.,;:!?)'"]|(?<=[:=])\S{7,}[^\s.,;:!?)'"]`, "high_entropy", "Assigned secret value", SECRET_CONTEXT, true),
+        // The value starts after an opening quote or bracket and ends before its
+        // closer: `user = "svc_terraform"` was the span `"svc_terraform`
+        // (rules-engine#126).
+        // A quoted value is what the quotes hold, closing punctuation included.
+        p(EntityType.SECRET, QUOTED_ASSIGNED + "|" + [String.raw `(?<=[:=] )`, String.raw `(?<=[:=])`, String.raw `(?<=[:=] ["'\x60\[{(])`, String.raw `(?<=[:=]["'\x60\[{(])`]
+            .map((lb) => lb + ASSIGNED).join("|"), "high_entropy", "Assigned secret value", SECRET_CONTEXT, true),
         // --- Secret / API Key (entropy-based fallback for longer tokens) ---
         // Only the *trailing* \b is replaced. It could not match when the token run
         // ended on "-", "+" or "/", so the engine backtracked across two
@@ -552,7 +564,10 @@ const PT = {
         p(EntityType.PHONE, String.raw `\b[29]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(EntityType.PHONE, String.raw `\b[29]\d{8}\b`),
         p(EntityType.PHONE, String.raw `\+351\s?[29]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}`),
-        p(EntityType.LICENSE_PLATE, String.raw `\b[A-Z0-9]{2}-[A-Z0-9]{2}-[A-Z0-9]{2}\b`),
+        // The four formats Portugal has issued (rules-engine#126).
+        p(EntityType.LICENSE_PLATE, String.raw `\b(?:\d{2}-\d{2}-[A-Z]{2}|\d{2}-[A-Z]{2}-\d{2}|[A-Z]{2}-\d{2}-\d{2}|[A-Z]{2}-\d{2}-[A-Z]{2})\b`),
+        // Any three pairs, behind a plate label (rules-engine#126).
+        p(EntityType.LICENSE_PLATE, String.raw `\b[A-Z0-9]{2}-[A-Z0-9]{2}-[A-Z0-9]{2}\b`, null, "Portuguese license plate — AA-XX-XX, behind its label", ["matrícula", "matricula", "placa", "license plate", "number plate", "plate", "Kennzeichen", "kenteken", "immatriculation", "targa"], true),
         p(EntityType.POSTAL_CODE, String.raw `\b\d{4}-\d{3}\b`),
     ],
 };
@@ -627,6 +642,8 @@ const UK = {
     code: "UK",
     name: "United Kingdom",
     patterns: [
+        // A sort code behind its label; no longer found through the Portuguese plate shape (rules-engine#126).
+        p(EntityType.BANK_ACCOUNT, String.raw `\b\d{2}-\d{2}-\d{2}\b`, null, "UK sort code — NN-NN-NN, behind its label", ["sort code", "sortcode", "sort-code"], true),
         // Healthcare-provider numbers, behind their label: no shape of their own, so without a pattern nothing claimed them, or a phone or a foreign checksum did (canon HEALTHCARE_PROVIDER; rules-engine#111).
         p(EntityType.HEALTHCARE_PROVIDER, String.raw `\b\d{7}\b`, null, "UK GMC number — 7 digits", ["GMC number", "GMC no", "GMC reference", "GMC reg", "GMC:", "GMC-Nr", "General Medical Council"], true),
         // UK NINO: a social-security number, so SSN, as the canon defaults it (rules-engine#47).

package/dist/esm/rules/suppressors.js

@@ -199,6 +199,27 @@ function suppressSecretOverStructured(text, match) {
  * natural word. A random all-letter token would be mixed case and is left alone
  * — losing a real secret is the expensive direction.
  */
+/**
+ * Values an assigned-secret rule finds after a "=" or ":" that are names, not
+ * secrets (rules-engine#126): `${VAR}` references, identifiers, hyphenated
+ * compounds, image tags, product versions, code calls. Not paths, host names
+ * or reference numbers: those carry personal data ("mac-mhartmann88").
+ * Kept in sync with the Python SDK's _SECRET_NAME_SHAPES.
+ */
+const SECRET_NAME_SHAPES = new RegExp([
+    String.raw `^\$\{[A-Za-z_][A-Za-z0-9_]*(?::?[-=?+][^}]*)?\}?$`,
+    String.raw `^[a-z]{2,}(?:_[a-z]{2,})+$`, String.raw `^[A-Z]{2,}(?:_[A-Z]{2,})+$`,
+    String.raw `^(?:[A-Z]+[a-z]{2,}){3,}(?:V?\d{1,2})?$`,
+    String.raw `^[a-z][a-z0-9._/-]*:(?:\d+(?:\.\d+)*(?:-[a-z0-9]+)*|latest|stable|alpine|slim)$`,
+    String.raw `^[A-Za-z][\w.-]*\/\d+(?:\.\d+)+$`,
+    String.raw `^[\w.]+\(["'\x60]`,
+].join("|"));
+/** A hyphenated compound of words and acronyms; two capitalised words alone
+ *  ("Ann-Sophie", "Caron-Cordier") are names and are left alone. */
+const COMPOUND_PART = String.raw `(?:[A-ZÀ-Þ]{2,6}\d{0,3}|[A-Za-zÀ-ÿ][a-zß-ÿ]{2,})`;
+const COMPOUND = new RegExp(String.raw `^` + COMPOUND_PART + String.raw `(?:-` + COMPOUND_PART + String.raw `)+$`);
+const NAME_PAIR = /^[A-ZÀ-Þ][a-zß-ÿ]{2,}-[A-ZÀ-Þ][a-zß-ÿ]{2,}$/;
+const CONNECTION_WITH_REFERENCE = /^[a-z]+:\/\/[^\s:@]+:\$\{[^}]*\}@/;
 function suppressSecretNotASecret(_text, match) {
     if (match.patternDef.entityType !== EntityType.SECRET)
         return false;
@@ -213,6 +234,10 @@ function suppressSecretNotASecret(_text, match) {
         return true;
     if (HYPHENATED_WORDS.test(bare))
         return true;
+    if (SECRET_NAME_SHAPES.test(bare) || CONNECTION_WITH_REFERENCE.test(bare))
+        return true;
+    if (COMPOUND.test(bare) && !NAME_PAIR.test(bare))
+        return true;
     const alpha = /^[A-Za-zÀ-ÿ]+$/.test(bare);
     const oneWord = bare === bare.toLowerCase() ||
         (bare.slice(0, 1) === bare.slice(0, 1).toUpperCase() &&
@@ -354,7 +379,20 @@ function suppressSequential(_text, match) {
 // the "]". The opening bracket is still required.
 const PLACEHOLDER = /^(?:\[([A-Z][A-Z0-9_]*)\]?|([A-Z][A-Z0-9_]*?)_(?:\d+|[A-HJ-NP-Z2-9]{4}))$/;
 const KNOWN_TYPE_NAMES = new Set(Object.values(EntityType));
-function suppressRedactionPlaceholder(_text, match) {
+function suppressRedactionPlaceholder(text, match) {
+    // The name between the brackets: an assigned value now starts after an
+    // opening bracket, so "credentials: [POSTAL_CODE]" offers "POSTAL_CODE" alone
+    // (rules-engine#33, #126).
+    if (text[match.start - 1] === "[" && text[match.end] === "]" && KNOWN_TYPE_NAMES.has(match.text))
+        return true;
+    // A placeholder inside the span: on text masked once, a value running across
+    // "[IP_ADDRESS]" is two things joined (rules-engine#126).
+    // One character either side: a span may start just inside the bracket.
+    const around = text.slice(Math.max(0, match.start - 1), match.end + 1);
+    for (const m of around.matchAll(/\[([A-Z][A-Z0-9_]*)\]/g)) {
+        if (KNOWN_TYPE_NAMES.has(m[1]))
+            return true;
+    }
     const found = PLACEHOLDER.exec(match.text);
     if (found === null)
         return false;
@@ -502,6 +540,33 @@ const EXTENSION_BEFORE = /(?<![A-Za-z0-9_])(?:toest(?:el)?|ext|extension|poste|d
  */
 const COUNT_LABEL_BEFORE = /(?<![A-Za-z0-9_])(?:employees|headcount|staff|mitarbeiter(?:innen)?|beschäftigte|werknemers|medewerkers|employés|salariés|effectifs?|dipendenti|empleados|pracowników|zaměstnanců)\s*[:=]?\s*$/i;
 const NOT_POSTAL_BEFORE = /(?<![A-Za-z0-9_])(?:(?:ISO(?:\/IEC)?|IEC|EN|DIN(?:\s+EN)?|NEN(?:-EN)?|NF\s+EN|BS(?:\s+EN)?|PN-EN|ÖNORM)[\s\-]*|[A-Za-z]*[a-z][A-Z][A-Za-z]*\s+)$/;
+/**
+ * What else a number is, by what touches it (rules-engine#126): a build,
+ * version, event, lease, policy or ticket number; a port; an invoice, reference
+ * or study-subject number; a process id; a JSON id or port field; an HTTP
+ * response size; the hour after a date; a lab reference range; or a quantity
+ * with its unit after it. Kept in sync with the Python SDK.
+ */
+const TECH_WORD_BEFORE = /(?<![A-Za-z0-9_])(?:build|version|policy\s+id|ticket(?:\s+[A-Za-z]{2,10})?|event|lease|pid|job|port|rfc|facture|invoice|r[ée]f[ée]rence|n[°º]|tn|sae|uczestnik|subject|narratief|participant)\.?\s*[:#=]?\s*["(«[]?\s*$/i;
+const TECH_SHAPE_BEFORE = new RegExp("(?:" + [
+    String.raw `"[A-Za-z_]*(?:id|port)"\s*:\s*"?`, // "parent_id": 4400
+    String.raw `(?<![A-Za-z0-9])[A-Z_]*PORT\s*[:=]\s*"?`, // DB_PORT: "5432"
+    String.raw `(?:localhost|[a-z0-9\-]+\.[a-z0-9.\-]+):`, // localhost:3000
+    String.raw `(?<![\d.])\d{2,5}:`, // "8080:8080"
+    String.raw `HTTP\/\d(?:\.\d)?"?\s+\d{3}\s+`, // HTTP/1.1" 200 2048
+    String.raw `\d+\.\d+(?:\.\d+)+\s*\(`, // build 2.4.0 (4012)
+    String.raw `(?<!\d)\d{1,2}[./]\d{1,2}[./]`, // 03.10.2026 23:50
+    String.raw `\((?:N|norm(?:al)?|ref)\s*:?\s*`, // (N : 30-400)
+    String.raw `\|`,
+].join("|") + ")$", "i");
+const POSTAL_UNIT_AFTER = /^(?:\s?(?:ms|s|sec|secs|seconds?|secondes?|sekunden|sek|min|bits?|bytes?|kb|mb|gb|tb|kbps|mbps|px|%|records|rows|entries|datensätze|einträge|micrograms|µg|ug|mg|mmol|fl)(?![A-Za-zÀ-ÿ])|\s*→\s*\d+\s*(?:bits?|bytes?)(?![A-Za-z])|:\d|\|)/i;
+const PID_BEFORE = /[A-Za-z0-9_\-]\[$/;
+/** A standard's name as the letters of a lettered postcode: "RFC 5737". Not
+ *  BS or EN: those are Bristol and Enfield. */
+const STANDARD_LETTERS = /^(?:RFC|ISO|IEC|DIN)\s?\d/;
+/** A year closing a range: "1998–2011". En and em dashes only. */
+const YEAR_RANGE_BEFORE = /(?:19|20)\d\d\s?[–—]\s?$/;
+const YEAR_RANGE_AFTER = /^\s?[–—]\s?(?:19|20)\d\d(?!\d)/;
 /** A thousands group of an amount: the "750" of "£28,750,000". */
 const GROUP_BEFORE = /\d[,.]$/;
 const GROUP_AFTER = /^[,.]\d{3}(?!\d)/;
@@ -515,10 +580,90 @@ function suppressPostalAfterDisqualifyingWord(text, match) {
         return true;
     if (GROUP_BEFORE.test(before) && GROUP_AFTER.test(text.slice(match.end, match.end + 5)))
         return true;
+    const after = text.slice(match.end, match.end + 24);
+    if (TECH_WORD_BEFORE.test(before) || TECH_SHAPE_BEFORE.test(before) || POSTAL_UNIT_AFTER.test(after)
+        || STANDARD_LETTERS.test(match.text))
+        return true;
+    if (PID_BEFORE.test(before) && after.startsWith("]"))
+        return true;
+    if (DATE_YEAR.test(match.text.trim()) && (YEAR_RANGE_BEFORE.test(before) || YEAR_RANGE_AFTER.test(after)))
+        return true;
     return RECENT_YEAR.test(match.text.trim())
         && (YEAR_WORD_BEFORE.test(before) || YEAR_VERB_BEFORE.test(before))
         && !TOWN_AFTER.test(text.slice(match.end, match.end + 3));
 }
+/** A group with a leading zero: "2.00.079.01" is a version, not an address. */
+const IP_LEADING_ZERO = /(?:^|\.)0\d/;
+const CIDR_PREFIX_AFTER = /^\/(\d{1,2})(?!\d)/;
+/** RFC 5737's documentation ranges: reserved, never routed, used in examples. */
+const DOCUMENTATION_NETS = ["192.0.2.", "198.51.100.", "203.0.113."];
+/**
+ * An IPv4 shape that names no host (rules-engine#126): a network address
+ * ("10.40.0.0/16"), a documentation address, or a version with leading zeros.
+ * An interface address with its prefix ("192.168.1.23/24") stays.
+ */
+function suppressIpNotAHost(text, match) {
+    if (match.patternDef.entityType !== EntityType.IP_ADDRESS)
+        return false;
+    const ip = match.text;
+    if (IP_LEADING_ZERO.test(ip) || DOCUMENTATION_NETS.some((n) => ip.startsWith(n)))
+        return true;
+    // Part of a longer dotted run: "urn:oid:1.2.250.1.71.4.2.1" is an OID.
+    if (/\d\.$/.test(text.slice(Math.max(0, match.start - 2), match.start))
+        || /^\.\d/.test(text.slice(match.end, match.end + 2)))
+        return true;
+    const prefix = CIDR_PREFIX_AFTER.exec(text.slice(match.end, match.end + 4));
+    if (prefix !== null && Number(prefix[1]) < 32) {
+        const value = ip.split(".").reduce((acc, o) => acc * 256 + Number(o), 0);
+        return value % 2 ** (32 - Number(prefix[1])) === 0;
+    }
+    return false;
+}
+/**
+ * The specimen of a form: "das Muster „C01X00T47“". Only "Muster": "z. B." and
+ * "e.g." introduce real values in prose as often as samples (rules-engine#126).
+ */
+const EXAMPLE_BEFORE = /(?<![A-Za-z])muster\s*[:,]?\s*[„"«']?$/i;
+/** A dummy value in placeholder glyphs ("XX0000000", "999 999 9999") or MAC
+ *  groups of one repeated letter. Not "111222333", the standard test BSN. */
+const DUMMY_VALUE = /^(?=(?:[\s:\-./]*[X09]){5})(?:[X\s:\-./]*[X][X0\s:\-./]*|[X9\s:\-./]*X[X9\s:\-./]*|[0\s:\-./]+|[9\s:\-./]+)$|^(?:([a-fA-F])\1[:\-]){2,}([a-fA-F])\2$/;
+/** Algorithm names in a key or signature line: "ED25519", "SHA256". */
+const ALGORITHM = /^(?:ED25519|ED448|SHA-?(?:1|224|256|384|512)|MD5|AES-?\d{3}|RSA-?\d{3,4}|[HRE]S(?:256|384|512))$/i;
+/** A date exactly, which no national number is written as. */
+const EXACT_DOTTED_DATE = /^(?:0[1-9]|[12]\d|3[01])\.(?:0[1-9]|1[0-2])\.(?:19|20)\d\d$/;
+/** The identifier types an example marker or a dummy value rules out. */
+const EXAMPLE_TYPES = new Set([
+    EntityType.NATIONAL_ID, EntityType.PASSPORT, EntityType.LICENSE_PLATE,
+    EntityType.HEALTH_INSURANCE, EntityType.MAC_ADDRESS,
+    EntityType.DRIVERS_LICENSE, EntityType.SSN, EntityType.TAX_ID,
+]);
+/** A placeholder in the shape of a value, for any type (#126). */
+function suppressDummyValue(_text, match) {
+    return DUMMY_VALUE.test(match.text.trim());
+}
+/** An identifier given as a form's specimen, not anyone's (#126). */
+function suppressExampleValue(text, match) {
+    if (!EXAMPLE_TYPES.has(match.patternDef.entityType))
+        return false;
+    return EXAMPLE_BEFORE.test(text.slice(Math.max(0, match.start - 24), match.start));
+}
+/**
+ * Shapes that fit an identifier pattern and are something else (#126): a
+ * passport without a digit, an algorithm or a law citation read as a plate,
+ * a date read as a dotted national number.
+ */
+function suppressNotAnIdentifier(text, match) {
+    const type = match.patternDef.entityType;
+    const value = match.text.trim();
+    if (type === EntityType.PASSPORT)
+        return !/\d/.test(value);
+    if (type === EntityType.LICENSE_PLATE) {
+        return ALGORITHM.test(value) || /§\s*$/.test(text.slice(Math.max(0, match.start - 4), match.start));
+    }
+    if (type === EntityType.NATIONAL_ID)
+        return EXACT_DOTTED_DATE.test(value);
+    return false;
+}
 function suppressPhoneServiceNumber(_text, match) {
     if (match.patternDef.entityType !== EntityType.PHONE)
         return false;
@@ -630,7 +775,11 @@ function suppressDePlateUnknownDistrict(text, match) {
     const parts = match.text.trim().split(/[\s\-]+/);
     if (parts.length === 0 || !parts[0])
         return false;
-    if (DE_DISTRICT_CODES.has(parts[0].toUpperCase()))
+    // A German plate number never starts with 0: without a plate cue,
+    // "GR-NB-0412" is an asset tag and "HR-IT-03" a form (rules-engine#126).
+    const digits = /\d+/.exec(match.text);
+    const leadingZero = digits !== null && digits[0].startsWith("0");
+    if (DE_DISTRICT_CODES.has(parts[0].toUpperCase()) && !leadingZero)
         return false;
     const [before, after] = getContext(text, match.start, match.end);
     if (PLATE_CUE_NEAR.test(before + after))
@@ -1071,15 +1220,22 @@ function suppressRequiresContext(text, match) {
         return false;
     // A value filling an entire field of a delimited row is introduced by its
     // column, not by a word, so that is context — but only for narrow shapes.
+    // A date's column decides when the table names it: under "début" or
+    // "last_day" a date is not a birth date (rules-engine#126).
     if (DELIMITED_FIELD_TYPES.has(match.patternDef.entityType) &&
-        fillsADelimitedField(text, match.start, match.end))
+        fillsADelimitedField(text, match.start, match.end) &&
+        !(DATE_LABEL_TYPES.has(match.patternDef.entityType) && columnHeader(text, match.start) !== null))
         return false;
     if (DATE_LABEL_TYPES.has(match.patternDef.entityType)) {
         return !labelsThisDate(text, match.start, match.end, match.patternDef.contextKeywords, match.patternDef.entityType);
     }
     const [before, after] = getContext(text, match.start, match.end);
     const context = (before + " " + after).toLowerCase();
-    return !match.patternDef.contextKeywords.some(kw => context.includes(kw.toLowerCase()));
+    if (match.patternDef.contextKeywords.some(kw => context.includes(kw.toLowerCase())))
+        return false;
+    // The column names it: a passport under "Passport" rows below the header (#130).
+    const header = columnHeader(text, match.start);
+    return header === null || !match.patternDef.contextKeywords.some(kw => keywordAt(header, kw, false) >= 0);
 }
 /** Date types decided by a label: DOB and DATE_OF_DEATH share one date shape. */
 const DATE_LABEL_TYPES = new Set([EntityType.DOB, EntityType.DATE_OF_DEATH]);
@@ -1115,10 +1271,16 @@ function nothingButAListBetween(gap) {
  */
 function keywordAt(haystack, keyword, last) {
     const kw = keyword.toLowerCase();
+    const isLetter = (c) => c !== "" && c.toLowerCase() !== c.toUpperCase();
     if (keyword !== keyword.toUpperCase() || keyword === kw) {
-        return last ? haystack.lastIndexOf(kw) : haystack.indexOf(kw);
+        // It must start a word, though it may run on into a longer one: "née le"
+        // in "signée le" and "born" in "Newborn" are other words (rules-engine#126).
+        let i = last ? haystack.lastIndexOf(kw) : haystack.indexOf(kw);
+        while (i > 0 && isLetter(haystack[i - 1])) {
+            i = last ? (i === 0 ? -1 : haystack.lastIndexOf(kw, i - 1)) : haystack.indexOf(kw, i + 1);
+        }
+        return i;
     }
-    const isLetter = (c) => c !== "" && c.toLowerCase() !== c.toUpperCase();
     const hits = [];
     for (let i = haystack.indexOf(kw); i !== -1; i = haystack.indexOf(kw, i + 1)) {
         let next = i + kw.length;
@@ -1180,29 +1342,44 @@ function columnHeader(text, start) {
     const lineStart = text.lastIndexOf("\n", start - 1) + 1;
     const lineEndAt = text.indexOf("\n", start);
     const line = text.slice(lineStart, lineEndAt >= 0 ? lineEndAt : text.length);
-    // The three lines above, by lastIndexOf: splitting the whole prefix was
-    // quadratic in the document, once per date candidate.
-    let aboveStart = lineStart - 1;
-    for (let k = 0; k < 3 && aboveStart >= 0; k++) {
-        aboveStart = aboveStart === 0 ? -1 : text.lastIndexOf("\n", aboveStart - 1);
-    }
-    const above = lineStart ? text.slice(aboveStart + 1, Math.max(0, lineStart - 1)).split("\n") : [];
     for (const sep of COLUMN_SEPARATORS) {
         if (!line.includes(sep))
             continue;
         const cells = line.split(sep);
         const column = text.slice(lineStart, start).split(sep).length - 1;
-        for (const header of [...above].reverse()) {
-            // A "label : value" field with a comma in its value is not a header (#111).
-            if (header.includes(":"))
+        // Lines above, one lastIndexOf at a time: one of the three lines above, or
+        // further up through rows of the same table (rules-engine#126).
+        let end = lineStart - 1;
+        let seen = 0;
+        while (end >= 0 && seen < HEADER_REACH) {
+            const begin = end === 0 ? 0 : text.lastIndexOf("\n", end - 1) + 1;
+            const header = text.slice(begin, end);
+            seen++;
+            // A rule line ("|---|---|", "----+----") is neither header nor row (#130).
+            if (RULE_LINE.test(header)) {
+                end = begin - 1;
                 continue;
+            }
             const heads = header.split(sep);
-            if (heads.length === cells.length && !ANY_DATE.test(header))
+            const same = heads.length === cells.length;
+            // A "label : value" field with a comma in its value is not a header
+            // (#111); a commented header ("# Spalten: Name;von;bis") is (#126).
+            // Nor is a data row without a date: a header has no cell with four digits or more (#130).
+            if (same && (!header.includes(":") || header.trimStart().startsWith("#")) && !ANY_DATE.test(header)
+                && !heads.some((h) => (h.match(/\d/g) ?? []).length >= 4)) {
                 return heads[column].toLowerCase();
+            }
+            if (seen >= 3 && !same)
+                break; // past the table this value sits in
+            end = begin - 1;
         }
     }
     return null;
 }
+/** How many lines up a table's header is looked for. */
+const HEADER_REACH = 200;
+/** A table's rule line: only dashes, equals signs, plus signs, colons, pipes. */
+const RULE_LINE = /^[\s\-=+:|]*-[\s\-=+:|]*$/;
 /** A dotted MAC shape glued to more of a reference is part of it: the tail of
  *  "WSO-II.6151.4471.2025" (rules-engine#105). Dotted form only. */
 function suppressMacInReference(text, match) {
@@ -1237,12 +1414,18 @@ const TYPE_SUPPRESSORS = {
     [EntityType.CHAMBER_OF_COMMERCE]: [suppressReference],
     [EntityType.MAC_ADDRESS]: [suppressMacInReference],
     [EntityType.CREDIT_CARD]: [suppressCardInsideDigitRun],
+    [EntityType.IP_ADDRESS]: [suppressIpNotAHost],
 };
+for (const type of EXAMPLE_TYPES) {
+    TYPE_SUPPRESSORS[type] = [...(TYPE_SUPPRESSORS[type] ?? []), suppressExampleValue, suppressNotAnIdentifier];
+}
 export function shouldSuppress(text, match, scratch) {
     if (suppressSequential(text, match))
         return true;
     if (suppressRedactionPlaceholder(text, match))
         return true;
+    if (suppressDummyValue(text, match))
+        return true;
     const typeSups = TYPE_SUPPRESSORS[match.patternDef.entityType];
     if (typeSups) {
         for (const s of typeSups) {

package/dist/esm/sdk.d.ts

@@ -104,6 +104,15 @@ export declare class TokenMapper {
  * restored, since leaving a token behind is the worse failure.
  */
 export declare function restore(text: string, tokens: Record<string, string>): string;
+/**
+ * The entity types a caller asked to leave in the text, by canonical name.
+ *
+ * Names are matched case-insensitively and legacy names resolve (`IBAN` is
+ * `BANK_ACCOUNT`, `CREDENTIAL` is `SECRET`). A custom pattern's name counts
+ * once it is registered. Anything else throws: a typo in a type meant to be
+ * switched off would otherwise switch nothing off (rules-engine#125).
+ */
+export declare function normalizeExcludeTypes(values: unknown, customNames?: ReadonlySet<string>, param?: string): Set<string>;
 export interface RedactOptions {
     /**
      * Scope. Detections attributed elsewhere are flagged `outOfScope`, never
@@ -144,6 +153,15 @@ export interface RedactOptions {
      * EMAIL and URL only, and covers subdomains. Merged with the instance list.
      */
     allowlistDomains?: string[] | null;
+    /**
+     * Entity types to leave in the text: neither in `detections` nor masked, and
+     * each such detection reported in `RedactResult.exempted` (`ruleKind:
+     * "type"`). Names are case-insensitive and legacy names resolve; unknown
+     * names throw. Merged with the instance's list. Default: nothing excluded.
+     * In `mode: "cloud"` an excluded rules type is still masked in the text sent
+     * to the service — this decides what comes back, not what may leave.
+     */
+    excludeTypes?: string[] | null;
     detectDates?: boolean;
     cache?: boolean;
     /**
@@ -161,16 +179,22 @@ export declare class EuRedact {
     private maxInputLength;
     private allowlist;
     private allowlistDomains;
+    private customNames;
+    private excludeTypes;
     /**
      * @param options.maxInputLength Longest document `redact` accepts, in characters.
      * @param options.allowlist Values never to redact, for every call on this
      *   instance — an organisation's own name, its own addresses. Merged with
      *   the per-call `allowlist`. Matched whole, case-insensitively.
+     * @param options.excludeTypes Entity types never reported or masked, for
+     *   every call on this instance, e.g. `["JOB_TITLE", "FINANCIAL_AMOUNT"]`.
+     *   Merged with the per-call value. Unknown names throw.
      */
     constructor(options?: {
         maxInputLength?: number;
         allowlist?: string[] | null;
         allowlistDomains?: string[] | null;
+        excludeTypes?: string[] | null;
     });
     addCustomPattern(name: string, pattern: string): void;
     /** Clear the result cache and referential integrity mappings.
@@ -178,6 +202,8 @@ export declare class EuRedact {
     clear(): void;
     /** The instance allowlist merged with a call's, in comparison form. */
     private allowedFor;
+    /** The instance's excluded types merged with a call's. */
+    private excludedFor;
     /** The instance domain list merged with a call's. */
     private domainsFor;
     /** The label function for one call, given its output options. */