[pavish]

Bumps the version to 0.4.0 in package.json and package-lock.json. No code changes.

After merge, the tag v0.4.0 on the merge commit triggers the publish job in CI.

What 0.4.0 contains (since 0.3.0)

• feat: value-level PII detection for unclassified fields (STABLE360-13580) #6 Value-level PII detection. scrub() now also redacts German street addresses (street word + 1–3 digit house number) and PII inside URLs: components are decoded and scrubbed, and map links lose the place name and place ids, with coordinates rounded to 2 decimals. IBANs are mod-97 checked. Classification fixes for internal_user, curated _title defaults, and data_classification: 'pii'.
• fix: keep UUIDs intact in scrubbed text #7 UUIDs stay intact in scrubbed text. The phone and IBAN patterns no longer match digit runs inside UUIDs.
• fix: check IBAN country code and length #8 IBAN country code and length check. An IBAN must have a known country code and that country's exact length, so hex ids no longer match as IBANs.

Why a minor version

#6 changes what scrub() redacts: text that 0.3.0 left unchanged can come out redacted. For a 0.x package, ^0.3.0 accepts any 0.3.x automatically, so a patch release would reach consumers on ^0.3.0 without them opting in. 0.4.0 needs an explicit bump.

Checks

• CI green (lint, test, build on Node 18, 20, 22, 24)
• After merge: push tag v0.4.0 on the merge commit, publish job succeeds
• npm view @epilot/anonymization versionreturns0.4.0`

---

Generated by Claude Code