@discretion/core 0.1.0

package/src/detect/detectors/location/postalCode.ts

@@ -0,0 +1,56 @@
+/**
+ * POSTAL_CODE — the per-country table, context-gated.
+ *
+ * A five-digit number satisfies twenty countries' postal formats and is
+ * also a quantity, a price, and a PIN. SPEC.md therefore assigns "low base
+ * confidence, requires context boost": this detector declares
+ * requiresContext, the runner caps it at LOW until Stage 3 supplies a
+ * trigger ("postcode", "PLZ", "郵便番号") or an address co-occurrence, and
+ * the candidate carries every country whose format it satisfies so fusion
+ * can reconcile it with the document's other evidence.
+ */
+
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, GLOBAL_REGION, invalid, valid } from '../../types.js';
+import type { ValidationContext, ValidationResult } from '../../types.js';
+import { postalCountriesFor } from './postalRegistry.js';
+
+function validatePostal(ctx: ValidationContext): ValidationResult {
+  const before = ctx.start > 0 ? ctx.text[ctx.start - 1] : '';
+  if (/[\d,.-]/.test(before ?? '')) return invalid('fragment of a longer number');
+  const after = ctx.text.slice(ctx.end, ctx.end + 2);
+  if (/^[\d]/.test(after) || /^[.,]\d/.test(after)) return invalid('fragment of a longer number');
+
+  const candidate = ctx.match[0].toUpperCase();
+  const countries = postalCountriesFor(candidate);
+  if (countries.length === 0) return invalid('no country format matched');
+
+  // A year-shaped 4-digit number is overwhelmingly a year in running text;
+  // the postal reading needs Stage 3 to argue otherwise, and until then it
+  // is noise we do not emit at all.
+  if (/^\d{4}$/.test(candidate)) {
+    const year = Number(candidate);
+    if (year >= 1900 && year <= 2099) return invalid('year-shaped');
+  }
+
+  return valid({
+    canonical: candidate.replace(/ /g, ''),
+    metadata: { countries },
+    validator: 'postal-format-table',
+  });
+}
+
+registerDetector({
+  id: 'postal-code',
+  entityType: 'POSTAL_CODE',
+  regions: [GLOBAL_REGION],
+  // Structured letter formats (UK, CA, NL, IE, MT, AZ/AD/MD/LV/LT…) plus
+  // digit groups with optional internal dash/space. Uppercase only — postal
+  // codes are written uppercase, and lowercase admits ordinary words.
+  pattern:
+    /\b(?:[A-Z]{1,2}\d[A-Z\d]? ?\d[A-Z]{2}|[A-Z]\d[A-Z] ?\d[A-Z]\d|\d{4} ?[A-Z]{2}|[A-Z]{2,3}[- ]?\d{4,5}|[A-Z]\d{2} ?[A-Z0-9]{4}|\d{2,7}(?:[- ]\d{2,4})?)\b/g,
+  baseConfidence: CONFIDENCE.MEDIUM,
+  requiresContext: true,
+  description: 'Postal codes against the per-country format table; LOW until Stage 3 context.',
+  validate: validatePostal,
+});

package/src/detect/detectors/location/postalRegistry.ts

@@ -0,0 +1,74 @@
+/**
+ * Per-country postal code formats.
+ *
+ * SPEC.md: "per-country format table covering all countries with postal
+ * systems, low base confidence, requires context boost." This table is the
+ * format half; the LOW cap comes from the detector's requiresContext flag.
+ *
+ * Countries sharing a bare digit-count share a regex constant; countries
+ * with real internal structure (UK, CA, NL, PL, PT, BR, JP, IE, MT…) get
+ * their own, and where the structure encodes genuine rules — Canada's
+ * excluded letters, the UK outward/inward split — those rules are in the
+ * regex, not commentary. Countries without an operating postal-code system
+ * (e.g. AE, HK, PA at the street level, many Caribbean and African states)
+ * are deliberately absent; absence here is a statement, not an omission.
+ */
+
+const D3 = /^\d{3}$/; // IS, PG (also FO)
+const D4 = /^\d{4}$/;
+const D5 = /^\d{5}$/;
+const D6 = /^\d{6}$/;
+const D7 = /^\d{7}$/;
+const D3_SP_D2 = /^\d{3} ?\d{2}$/; // CZ, SK, SE, GR
+
+export const POSTAL_FORMATS: Readonly<Record<string, RegExp>> = {
+  // ── structured formats ──
+  GB: /^(?:GIR ?0AA|[A-Z]{1,2}\d[A-Z\d]? ?\d[A-Z]{2})$/, // outward + inward
+  // First letter excludes D F I O Q U W Z; later letters exclude D F I O Q U.
+  CA: /^[ABCEGHJ-NPRSTVXY]\d[ABCEGHJ-NPRSTV-Z] ?\d[ABCEGHJ-NPRSTV-Z]\d$/,
+  NL: /^\d{4} ?[A-Z]{2}$/,
+  PL: /^\d{2}-\d{3}$/,
+  PT: /^\d{4}-\d{3}$/,
+  BR: /^\d{5}-?\d{3}$/,
+  JP: /^\d{3}-?\d{4}$/,
+  US: /^\d{5}(?:-\d{4})?$/,
+  IE: /^[A-Z]\d{2} ?[A-Z0-9]{4}$|^D6W ?[A-Z0-9]{4}$/, // Eircode
+  MT: /^[A-Z]{3} ?\d{4}$/,
+  AZ: /^AZ ?\d{4}$/,
+  AD: /^AD\d{3}$/,
+  BB: /^BB\d{5}$/,
+  MD: /^MD-?\d{4}$/,
+  LV: /^LV-?\d{4}$/,
+  LT: /^LT-?\d{5}$/,
+  MC: /^980\d{2}$/,
+  SM: /^4789\d$/,
+  VA: /^00120$/,
+  GR: D3_SP_D2, CZ: D3_SP_D2, SK: D3_SP_D2, SE: D3_SP_D2,
+  KY: /^KY\d-\d{4}$/,
+  BM: /^[A-Z]{2} ?\d{2}$/,
+  // ── plain digit counts ──
+  IS: D3, PG: D3, FO: D3,
+  AT: D4, AU: D4, BE: D4, BG: D4, CH: D4, CY: D4, DK: D4, HU: D4, LI: D4,
+  LU: D4, MK: D4, NO: D4, NZ: D4, PH: D4, SI: D4, ZA: D4, AL: D4, BD: D4,
+  CV: D4, ET: D4, GE: D4, PY: D4, SV: D4, TN: D4, AM: D4, NE: D4, SJ: D4,
+  DE: D5, FR: D5, ES: D5, IT: D5, FI: D5, TR: D5, TH: D5, MY: D5, MX: D5,
+  ID: D5, PK: D5, EG: D5, DZ: D5, MA: D5, KE: D5, JO: D5, IQ: D5, KW: D5,
+  LK: D5, MN: D5, UA: D5, UZ: D5, HR: D5, EE: D5, RS: D5, ME: D5, BA: D5,
+  CU: D5, DO: D5, GT: D5, HN: D5, NI: D5, CR: D5, PE: D5, KR: D5, SA: D5,
+  SD: D5, ZM: D5, MZ: D4, TZ: D5, UY: D5, MM: D5, KH: D5, LA: D5, NP: D5,
+  BT: D5, MV: D5, SN: D5, GN: D6,
+  CN: D6, IN: D6, SG: D6, RU: D6, KZ: D6, BY: D6, NG: D6, RO: D6, KG: D6,
+  TJ: D6, TM: D6, VN: D6, EC: D6,
+  IL: D7, CL: D7,
+  TW: /^\d{3}(?:-?\d{2,3})?$/,
+  AR: /^[A-Z]?\d{4}[A-Z]{0,3}$/, // CPA: letter + 4 digits + 3 letters, or legacy 4
+};
+
+/** Every country whose format the candidate satisfies. */
+export function postalCountriesFor(candidate: string): string[] {
+  const out: string[] = [];
+  for (const [country, format] of Object.entries(POSTAL_FORMATS)) {
+    if (format.test(candidate)) out.push(country);
+  }
+  return out;
+}

package/src/detect/detectors/location/streetAddress.ts

@@ -0,0 +1,84 @@
+/**
+ * STREET_ADDRESS — multilingual heuristics, context-gated.
+ *
+ * SPEC.md: "multilingual heuristics across address conventions (Western,
+ * East Asian reverse-order, Arabic), low base confidence, requires context
+ * boost." Address grammar differs by convention, so the pattern is an
+ * alternation of convention-specific shapes, each keyed by the street-type
+ * lexicon of its languages rather than one English list:
+ *
+ *   • Western number-first:  221B Baker Street, 1600 Pennsylvania Avenue
+ *   • Romance type-first:    12 rue de la Paix, Calle Mayor 8, Via Roma 3
+ *   • Germanic name+number:  Hauptstraße 12a, Prinsengracht 263
+ *   • Turkish:               Atatürk Caddesi No: 15, Çiçek Sok. 3
+ *   • East Asian:            中山路25号, 銀座4丁目5番6号, 세종대로 110
+ *   • Arabic:                شارع الملك فهد 12
+ *
+ * requiresContext caps everything at LOW until Stage 3; the convention
+ * travels in metadata for fusion and for M4's surrogate generation.
+ */
+
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, GLOBAL_REGION, invalid, valid } from '../../types.js';
+import type { ValidationContext, ValidationResult } from '../../types.js';
+
+const WESTERN_TYPES =
+  '(?:Street|St|Avenue|Ave|Road|Rd|Boulevard|Blvd|Lane|Ln|Drive|Dr|Court|Ct|Way|Place|Pl|Terrace|Square|Sq|Crescent|Close|Gardens)';
+const ROMANCE_TYPES =
+  '(?:rue|avenue|boulevard|impasse|allée|chemin|place|quai|calle|avenida|paseo|plaza|carrer|via|viale|piazza|corso|rua|travessa|praça)';
+const GERMANIC_SUFFIX =
+  '(?:straße|strasse|weg|gasse|platz|allee|ring|damm|ufer|straat|laan|plein|gracht|kade|singel|gade|vej|gatan|vägen|veien|gata)';
+const TURKISH_TYPES = '(?:Caddesi|Cadde|Cad\\.|Sokak|Sokağı|Sok\\.|Bulvarı|Bulvar|Blv\\.|Mahallesi|Mah\\.)';
+
+type Convention = 'western' | 'romance' | 'germanic' | 'turkish' | 'east-asian' | 'arabic';
+
+const CLASSIFIERS: readonly (readonly [RegExp, Convention])[] = [
+  [new RegExp(`^\\d{1,5}[A-Za-z]? [\\p{Lu}][\\p{L}.'-]*(?: [\\p{Lu}][\\p{L}.'-]*){0,3} ${WESTERN_TYPES}\\.?$`, 'u'), 'western'],
+  [new RegExp(`^\\d{1,5},? ${ROMANCE_TYPES} [\\p{L}][\\p{L} .'-]{2,40}$`, 'iu'), 'romance'],
+  [new RegExp(`^${ROMANCE_TYPES} [\\p{L}][\\p{L} .'-]{2,40},? \\d{1,5}$`, 'iu'), 'romance'],
+  [new RegExp(`^[\\p{Lu}][\\p{L}]{2,30}${GERMANIC_SUFFIX} \\d{1,4}[a-z]?$`, 'u'), 'germanic'],
+  [new RegExp(`^[\\p{Lu}][\\p{L}]{1,20}(?: [\\p{Lu}][\\p{L}]{1,20})? ${TURKISH_TYPES}(?: No:? ?\\d{1,4}(?:\\/\\d{1,3})?)?$`, 'u'), 'turkish'],
+  [/^[一-鿿]{1,12}(?:路|街|大道)\d{1,4}号(?:楼|栋)?$/u, 'east-asian'],
+  [/^[一-鿿぀-ヿ]{1,12}\d{1,3}丁目(?:\d{1,3}番地?)?(?:\d{1,3}号)?$/u, 'east-asian'],
+  [/^[가-힯]{2,12}(?:로|길) ?\d{1,4}(?:-\d{1,3})?$/u, 'east-asian'],
+  [/^شارع [؀-ۿ]{2,20}(?: [؀-ۿ]{2,20}){0,3}(?: \d{1,4})?$/u, 'arabic'],
+];
+
+function validateStreet(ctx: ValidationContext): ValidationResult {
+  const value = ctx.match[0].trim();
+
+  for (const [shape, convention] of CLASSIFIERS) {
+    if (shape.test(value)) {
+      return valid({
+        metadata: { convention },
+        validator: 'address-heuristic',
+      });
+    }
+  }
+  return invalid('no address convention matched');
+}
+
+registerDetector({
+  id: 'street-address',
+  entityType: 'STREET_ADDRESS',
+  regions: [GLOBAL_REGION],
+  // The harvest union of every convention shape; the validator classifies.
+  pattern: new RegExp(
+    [
+      `\\d{1,5}[A-Za-z]? [\\p{Lu}][\\p{L}.'-]*(?: [\\p{Lu}][\\p{L}.'-]*){0,3} ${WESTERN_TYPES}\\.?(?![\\p{L}])`,
+      `\\d{1,5},? ${ROMANCE_TYPES} [\\p{L}][\\p{L} .'-]{2,40}`,
+      `${ROMANCE_TYPES} [\\p{L}][\\p{L} .'-]{2,40},? \\d{1,5}`,
+      `[\\p{Lu}][\\p{L}]{2,30}${GERMANIC_SUFFIX} \\d{1,4}[a-z]?`,
+      `[\\p{Lu}][\\p{L}]{1,20}(?: [\\p{Lu}][\\p{L}]{1,20})? ${TURKISH_TYPES}(?: No:? ?\\d{1,4}(?:\\/\\d{1,3})?)?`,
+      `[\\u4e00-\\u9fff]{1,12}(?:路|街|大道)\\d{1,4}号(?:楼|栋)?`,
+      `[\\u4e00-\\u9fff\\u3040-\\u30ff]{1,12}\\d{1,3}丁目(?:\\d{1,3}番地?)?(?:\\d{1,3}号)?`,
+      `[\\uac00-\\ud7af]{2,12}(?:로|길) ?\\d{1,4}(?:-\\d{1,3})?`,
+      `شارع [\\u0600-\\u06ff]{2,20}(?: [\\u0600-\\u06ff]{2,20}){0,3}(?: \\d{1,4})?`,
+    ].join('|'),
+    'gu',
+  ),
+  baseConfidence: CONFIDENCE.MEDIUM,
+  requiresContext: true,
+  description: 'Street addresses across six writing conventions; LOW until Stage 3 context.',
+  validate: validateStreet,
+});

package/src/detect/detectors/natid/africa.ts

@@ -0,0 +1,108 @@
+/**
+ * Africa beyond South Africa: Nigeria, Kenya, Egypt, Morocco.
+ *
+ * None of these publishes a verifiable checksum, so all four are
+ * structural/labeled at MEDIUM, each stating its gates:
+ *  • NG NIN — eleven digits, labeled ("NIN"), since a bare 11-digit run
+ *    belongs to the checksummed schemes.
+ *  • KE National ID — eight digits behind an explicit "ID No/Number" label.
+ *  • EG National ID — fourteen digits with REAL structure: century digit
+ *    2/3, a valid birth date, and a governorate code from the published
+ *    table. (A final check digit exists but its algorithm is not officially
+ *    published — stated here, structural only.)
+ *  • MA CNIE — one or two letters + six digits, labeled ("CNIE"/"CIN"),
+ *    since the bare shape collides with order numbers everywhere.
+ */
+
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+import type { ValidationResult } from '../../types.js';
+
+registerDetector({
+  id: 'national-id-ng-nin',
+  entityType: 'NATIONAL_ID',
+  regions: ['NG'],
+  pattern: /\bNIN:?\s*(\d{11})\b/g,
+  baseConfidence: CONFIDENCE.MEDIUM,
+  description: 'Nigerian NIN in labeled notation (no public checksum).',
+  validate(ctx): ValidationResult {
+    const numberPart = ctx.match[1]!;
+    const start = ctx.start + ctx.match[0].indexOf(numberPart);
+    return valid({
+      canonical: numberPart,
+      metadata: { scheme: 'nin', country: 'NG' },
+      validator: 'nin-labeled',
+      span: { start, end: start + numberPart.length },
+    });
+  },
+});
+
+registerDetector({
+  id: 'national-id-ke',
+  entityType: 'NATIONAL_ID',
+  regions: ['KE'],
+  pattern: /\bID\s?(?:No\.?|Number):?\s*(\d{8})\b/g,
+  baseConfidence: CONFIDENCE.MEDIUM,
+  description: 'Kenyan National ID behind an explicit ID-number label (no checksum).',
+  validate(ctx): ValidationResult {
+    const numberPart = ctx.match[1]!;
+    const start = ctx.start + ctx.match[0].lastIndexOf(numberPart);
+    return valid({
+      canonical: numberPart,
+      metadata: { scheme: 'ke-id', country: 'KE' },
+      validator: 'ke-id-labeled',
+      span: { start, end: start + numberPart.length },
+    });
+  },
+});
+
+/** Egyptian governorate codes (the published table, 88 = born abroad). */
+const EG_GOVERNORATES = new Set([
+  '01', '02', '03', '04', '11', '12', '13', '14', '15', '16', '17', '18', '19',
+  '21', '22', '23', '24', '25', '26', '27', '28', '29', '31', '32', '33', '34', '35', '88',
+]);
+
+registerDetector({
+  id: 'national-id-eg',
+  entityType: 'NATIONAL_ID',
+  regions: ['EG'],
+  pattern: /\b([23])(\d{2})(\d{2})(\d{2})(\d{2})(\d{4})(\d)\b/g,
+  baseConfidence: CONFIDENCE.MEDIUM,
+  description: 'Egyptian National ID: century, date and governorate gates (check algorithm unpublished).',
+  validate(ctx): ValidationResult {
+    const before = ctx.start > 0 ? ctx.text[ctx.start - 1] : '';
+    if (/[\d-]/.test(before ?? '')) return invalid('fragment of a longer number');
+    const after = ctx.text.slice(ctx.end, ctx.end + 2);
+    if (/^\d/.test(after) || /^-\d/.test(after)) return invalid('fragment of a longer number');
+
+    const month = Number(ctx.match[3]);
+    if (month < 1 || month > 12) return invalid('month out of range');
+    const day = Number(ctx.match[4]);
+    if (day < 1 || day > 31) return invalid('day out of range');
+    if (!EG_GOVERNORATES.has(ctx.match[5]!)) return invalid('not a governorate code');
+    return valid({
+      canonical: ctx.match[0],
+      metadata: { scheme: 'eg-id', country: 'EG' },
+      validator: 'eg-id-structure',
+    });
+  },
+});
+
+registerDetector({
+  id: 'national-id-ma-cnie',
+  entityType: 'NATIONAL_ID',
+  regions: ['MA'],
+  pattern: /\b(?:CNIE|CIN):?\s*([A-Z]{1,2}\d{6})\b/g,
+  baseConfidence: CONFIDENCE.MEDIUM,
+  description: 'Moroccan CNIE in labeled notation (no public checksum).',
+  validate(ctx): ValidationResult {
+    const numberPart = ctx.match[1]!;
+    const start = ctx.start + ctx.match[0].indexOf(numberPart);
+    return valid({
+      canonical: numberPart,
+      metadata: { scheme: 'cnie', country: 'MA' },
+      validator: 'cnie-labeled',
+      span: { start, end: start + numberPart.length },
+    });
+  },
+});

package/src/detect/detectors/natid/ar.ts

@@ -0,0 +1,62 @@
+/**
+ * Argentina: CUIT/CUIL and DNI.
+ *
+ * CUIT — XX-XXXXXXXX-X with a real mod-11 check: type prefix from the
+ * issued set (20/23/24/25/26/27 people, 30/33/34 companies), weights
+ * 5,4,3,2,7,6,5,4,3,2, check = 11 − remainder with 11→0 and 10 unissuable
+ * — a bijective mapping, so the hard mutation property applies.
+ *
+ * DNI — seven or eight digits with NO checksum; only the labeled dotted
+ * notation ("DNI 12.345.678") is claimed, span narrowed to the number,
+ * MEDIUM — the same posture as the Brazilian agência.
+ */
+
+import { toDigits, weightedMod } from '../../../checksums/index.js';
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+import type { ValidationResult } from '../../types.js';
+
+const CUIT_PREFIXES = new Set(['20', '23', '24', '25', '26', '27', '30', '33', '34']);
+const CUIT_WEIGHTS = [5, 4, 3, 2, 7, 6, 5, 4, 3, 2];
+
+registerDetector({
+  id: 'national-id-ar-cuit',
+  entityType: 'TAX_ID',
+  regions: ['AR'],
+  pattern: /\b(\d{2})-(\d{8})-(\d)\b/g,
+  baseConfidence: CONFIDENCE.HIGH,
+  description: 'Argentine CUIT/CUIL with prefix set and mod-11 check.',
+  validate(ctx): ValidationResult {
+    if (!CUIT_PREFIXES.has(ctx.match[1]!)) return invalid('not an issued type prefix');
+    const digits = toDigits(`${ctx.match[1]}${ctx.match[2]}`)!;
+    const remainder = weightedMod(digits, CUIT_WEIGHTS, 11)!;
+    let check = 11 - remainder;
+    if (check === 11) check = 0;
+    if (check === 10) return invalid('remainder 1 is unissuable');
+    if (check !== Number(ctx.match[3])) return invalid('CUIT check digit failed');
+    return valid({
+      canonical: `${ctx.match[1]}${ctx.match[2]}${ctx.match[3]}`,
+      metadata: { scheme: 'cuit', country: 'AR' },
+      validator: 'cuit-mod11',
+    });
+  },
+});
+
+registerDetector({
+  id: 'national-id-ar-dni',
+  entityType: 'NATIONAL_ID',
+  regions: ['AR'],
+  pattern: /\bDNI:?\s*(\d{1,2}\.\d{3}\.\d{3})\b/g,
+  baseConfidence: CONFIDENCE.MEDIUM,
+  description: 'Argentine DNI in labeled dotted notation (no checksum exists).',
+  validate(ctx): ValidationResult {
+    const numberPart = ctx.match[1]!;
+    const start = ctx.start + ctx.match[0].indexOf(numberPart);
+    return valid({
+      canonical: numberPart.replace(/\./g, ''),
+      metadata: { scheme: 'dni', country: 'AR' },
+      validator: 'dni-labeled',
+      span: { start, end: start + numberPart.length },
+    });
+  },
+});

package/src/detect/detectors/natid/au.ts

@@ -0,0 +1,99 @@
+/**
+ * Australia: TFN, Medicare number, ABN.
+ *
+ * TFN — nine digits, weights 1,4,3,7,5,8,6,9,10, valid when the weighted
+ * sum is divisible by 11 (SPEC.md: "TFN (mod 11)").
+ * Medicare — ten digits + optional IRN: first digit 2–6, weights
+ * 1,3,7,9,1,3,7,9 over the first eight, sum mod 10 equals the ninth digit;
+ * the tenth is the issue number.
+ * ABN — eleven digits: subtract 1 from the first digit, weights
+ * 10,1,3,5,7,9,11,13,15,17,19, divisible by 89 (SPEC.md: "ABN (mod 89)").
+ */
+
+import { toDigits, weightedSum, weightedMod } from '../../../checksums/index.js';
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+import type { ValidationContext, ValidationResult } from '../../types.js';
+
+function guard(ctx: ValidationContext): string | null {
+  const before = ctx.start > 0 ? ctx.text[ctx.start - 1] : '';
+  if (/[\d-]/.test(before ?? '')) return 'fragment of a longer number';
+  const after = ctx.text.slice(ctx.end, ctx.end + 2);
+  if (/^\d/.test(after) || /^-\d/.test(after)) return 'fragment of a longer number';
+  return null;
+}
+
+const TFN_WEIGHTS = [1, 4, 3, 7, 5, 8, 6, 9, 10];
+
+registerDetector({
+  id: 'national-id-au-tfn',
+  entityType: 'TAX_ID',
+  regions: ['AU'],
+  pattern: /\b(\d{3})[ ]?(\d{3})[ ]?(\d{3})\b/g,
+  baseConfidence: CONFIDENCE.HIGH,
+  description: 'Australian TFNs: nine digits, weighted sum divisible by 11.',
+  validate(ctx): ValidationResult {
+    const g = guard(ctx);
+    if (g !== null) return invalid(g);
+    const digits = toDigits(`${ctx.match[1]}${ctx.match[2]}${ctx.match[3]}`)!;
+    if (weightedMod(digits, TFN_WEIGHTS, 11) !== 0) return invalid('TFN sum not divisible by 11');
+    return valid({
+      canonical: digits.join(''),
+      metadata: { scheme: 'tfn', country: 'AU' },
+      validator: 'tfn-mod11',
+    });
+  },
+});
+
+const MEDICARE_WEIGHTS = [1, 3, 7, 9, 1, 3, 7, 9];
+
+registerDetector({
+  id: 'national-id-au-medicare',
+  entityType: 'NATIONAL_ID',
+  regions: ['AU'],
+  // The optional issue number is grouped WITH its separating space. Written
+  // as `[ ]?(\d)?` the space could be consumed while the digit matched
+  // nothing, leaving trailing whitespace inside the emitted span — which
+  // masking would then overwrite along with the identifier.
+  pattern: /\b([2-6]\d{3})[ ]?(\d{5})[ ]?(\d)(?:[ ]?(\d))?\b/g,
+  baseConfidence: CONFIDENCE.HIGH,
+  description: 'Australian Medicare numbers with the weighted mod-10 check digit.',
+  validate(ctx): ValidationResult {
+    const g = guard(ctx);
+    if (g !== null) return invalid(g);
+    const nine = `${ctx.match[1]}${ctx.match[2]}`;
+    const digits = toDigits(nine)!;
+    const check = weightedMod(digits.slice(0, 8), MEDICARE_WEIGHTS, 10)!;
+    if (check !== digits[8]) return invalid('Medicare check digit failed');
+    return valid({
+      canonical: nine + (ctx.match[4] ?? ''),
+      metadata: { scheme: 'medicare', country: 'AU' },
+      validator: 'medicare-mod10',
+    });
+  },
+});
+
+const ABN_WEIGHTS = [10, 1, 3, 5, 7, 9, 11, 13, 15, 17, 19];
+
+registerDetector({
+  id: 'national-id-au-abn',
+  entityType: 'TAX_ID',
+  regions: ['AU'],
+  pattern: /\b(\d{2})[ ]?(\d{3})[ ]?(\d{3})[ ]?(\d{3})\b/g,
+  baseConfidence: CONFIDENCE.HIGH,
+  description: 'Australian ABNs: first digit minus one, weighted sum divisible by 89.',
+  validate(ctx): ValidationResult {
+    const g = guard(ctx);
+    if (g !== null) return invalid(g);
+    const digits = toDigits(`${ctx.match[1]}${ctx.match[2]}${ctx.match[3]}${ctx.match[4]}`)!;
+    if (digits[0] === 0) return invalid('first digit cannot be 0');
+    const adjusted = [digits[0]! - 1, ...digits.slice(1)];
+    const sum = weightedSum(adjusted, ABN_WEIGHTS)!;
+    if (sum % 89 !== 0) return invalid('ABN sum not divisible by 89');
+    return valid({
+      canonical: digits.join(''),
+      metadata: { scheme: 'abn', country: 'AU' },
+      validator: 'abn-mod89',
+    });
+  },
+});

package/src/detect/detectors/natid/be.ts

@@ -0,0 +1,45 @@
+/**
+ * Belgium: Rijksregisternummer — YY.MM.DD-xxx.cc with a mod-97 check:
+ * cc = 97 − (first nine digits mod 97). For people born in or after 2000
+ * the nine digits are checked with a leading '2' prepended; the validator
+ * accepts whichever century closes, and reports it.
+ */
+
+import { modString } from '../../../checksums/index.js';
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+import type { ValidationResult } from '../../types.js';
+
+registerDetector({
+  id: 'national-id-be-rijksregister',
+  entityType: 'NATIONAL_ID',
+  regions: ['BE'],
+  pattern: /\b(\d{2})[. ]?(\d{2})[. ]?(\d{2})[- ]?(\d{3})[. ]?(\d{2})\b/g,
+  baseConfidence: CONFIDENCE.HIGH,
+  description: 'Belgian national register numbers with the century-aware mod-97 check.',
+  validate(ctx): ValidationResult {
+    const month = Number(ctx.match[2]);
+    // Ordinary months, plus the +20/+40 BIS-register offsets.
+    const monthValid =
+      (month >= 1 && month <= 12) || (month >= 21 && month <= 32) || (month >= 41 && month <= 52) || month === 0;
+    if (!monthValid) return invalid('implausible month field');
+    const day = Number(ctx.match[3]);
+    if (day > 31) return invalid('implausible day field');
+
+    const nine = `${ctx.match[1]}${ctx.match[2]}${ctx.match[3]}${ctx.match[4]}`;
+    const check = Number(ctx.match[5]);
+
+    const r1900 = modString(nine, 97)!;
+    const r2000 = modString(`2${nine}`, 97)!;
+    let century: number;
+    if (97 - r1900 === check) century = 1900;
+    else if (97 - r2000 === check) century = 2000;
+    else return invalid('mod-97 check failed for both centuries');
+
+    return valid({
+      canonical: `${nine}${ctx.match[5]}`,
+      metadata: { scheme: 'rijksregister', country: 'BE', century },
+      validator: 'rrn-mod97',
+    });
+  },
+});

package/src/detect/detectors/natid/bg.ts

@@ -0,0 +1,44 @@
+/**
+ * Bulgaria: EGN (ЕГН) — ten digits: YYMMDD NNN C. The month encodes the
+ * century (+20 → born 1800s, +40 → 2000s). Check: weights
+ * 2,4,8,5,10,9,7,3,6 mod 11 with 10 → 0.
+ */
+
+import { toDigits, weightedMod } from '../../../checksums/index.js';
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+import type { ValidationResult } from '../../types.js';
+
+const EGN_WEIGHTS = [2, 4, 8, 5, 10, 9, 7, 3, 6];
+
+registerDetector({
+  id: 'national-id-bg-egn',
+  entityType: 'NATIONAL_ID',
+  regions: ['BG'],
+  pattern: /\b(\d{2})(\d{2})(\d{2})(\d{4})\b/g,
+  baseConfidence: CONFIDENCE.HIGH,
+  description: 'Bulgarian EGN: century-banded month plus the mod-11 check.',
+  validate(ctx): ValidationResult {
+    const before = ctx.start > 0 ? ctx.text[ctx.start - 1] : '';
+    if (/[\d-]/.test(before ?? '')) return invalid('fragment of a longer number');
+    const after = ctx.text.slice(ctx.end, ctx.end + 2);
+    if (/^\d/.test(after) || /^-\d/.test(after)) return invalid('fragment of a longer number');
+
+    const month = Number(ctx.match[2]);
+    const monthValid =
+      (month >= 1 && month <= 12) || (month >= 21 && month <= 32) || (month >= 41 && month <= 52);
+    if (!monthValid) return invalid('month outside century bands');
+    const day = Number(ctx.match[3]);
+    if (day < 1 || day > 31) return invalid('day out of range');
+
+    const digits = toDigits(ctx.match[0])!;
+    let check = weightedMod(digits.slice(0, 9), EGN_WEIGHTS, 11)!;
+    if (check === 10) check = 0;
+    if (check !== digits[9]) return invalid('EGN checksum failed');
+    return valid({
+      canonical: ctx.match[0],
+      metadata: { scheme: 'egn', country: 'BG' },
+      validator: 'egn-mod11',
+    });
+  },
+});

package/src/detect/detectors/natid/br.ts

@@ -0,0 +1,81 @@
+/**
+ * Brazil: CPF and CNPJ — both with two chained mod-11 check digits (r < 2
+ * folds to 0, so mutation detection is ~10/11 by design — the property
+ * tests say so). Repdigit CPFs (111.111.111-11 and friends) satisfy the
+ * arithmetic but are never issued and are rejected outright.
+ */
+
+import { toDigits, weightedModBy } from '../../../checksums/index.js';
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+import type { ValidationContext, ValidationResult } from '../../types.js';
+
+function guard(ctx: ValidationContext): string | null {
+  const before = ctx.start > 0 ? ctx.text[ctx.start - 1] : '';
+  if (/[\d.-]/.test(before ?? '')) return 'fragment of a longer number';
+  const after = ctx.text.slice(ctx.end, ctx.end + 2);
+  if (/^\d/.test(after) || /^[.-]\d/.test(after)) return 'fragment of a longer number';
+  return null;
+}
+
+/** Check digit: weights descending from `start`, fold r<2 → 0. */
+function brCheck(digits: readonly number[], start: number): number {
+  const remainder = weightedModBy(digits, (i) => start - i, 11)!;
+  return remainder < 2 ? 0 : 11 - remainder;
+}
+
+registerDetector({
+  id: 'national-id-br-cpf',
+  entityType: 'NATIONAL_ID',
+  regions: ['BR'],
+  pattern: /\b(\d{3})\.?(\d{3})\.?(\d{3})-?(\d{2})\b/g,
+  baseConfidence: CONFIDENCE.HIGH,
+  description: 'Brazilian CPF with both mod-11 check digits; repdigits rejected.',
+  validate(ctx): ValidationResult {
+    const g = guard(ctx);
+    if (g !== null) return invalid(g);
+    const all = `${ctx.match[1]}${ctx.match[2]}${ctx.match[3]}${ctx.match[4]}`;
+    if (/^(.)\1+$/.test(all)) return invalid('repdigit CPFs are never issued');
+    const digits = toDigits(all)!;
+    if (brCheck(digits.slice(0, 9), 10) !== digits[9]) return invalid('first check digit failed');
+    if (brCheck(digits.slice(0, 10), 11) !== digits[10]) return invalid('second check digit failed');
+    return valid({
+      canonical: all,
+      metadata: { scheme: 'cpf', country: 'BR' },
+      validator: 'cpf-dual-mod11',
+    });
+  },
+});
+
+const CNPJ_W1 = [5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, 2];
+const CNPJ_W2 = [6, 5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, 2];
+
+function cnpjCheck(digits: readonly number[], weights: readonly number[]): number {
+  let sum = 0;
+  for (let i = 0; i < digits.length; i++) sum += digits[i]! * weights[i]!;
+  const remainder = sum % 11;
+  return remainder < 2 ? 0 : 11 - remainder;
+}
+
+registerDetector({
+  id: 'national-id-br-cnpj',
+  entityType: 'TAX_ID',
+  regions: ['BR'],
+  pattern: /\b(\d{2})\.?(\d{3})\.?(\d{3})\/?(\d{4})-?(\d{2})\b/g,
+  baseConfidence: CONFIDENCE.HIGH,
+  description: 'Brazilian CNPJ with both mod-11 check digits.',
+  validate(ctx): ValidationResult {
+    const g = guard(ctx);
+    if (g !== null) return invalid(g);
+    const all = `${ctx.match[1]}${ctx.match[2]}${ctx.match[3]}${ctx.match[4]}${ctx.match[5]}`;
+    if (/^0+$/.test(all)) return invalid('all zeros');
+    const digits = toDigits(all)!;
+    if (cnpjCheck(digits.slice(0, 12), CNPJ_W1) !== digits[12]) return invalid('first check digit failed');
+    if (cnpjCheck(digits.slice(0, 13), CNPJ_W2) !== digits[13]) return invalid('second check digit failed');
+    return valid({
+      canonical: all,
+      metadata: { scheme: 'cnpj', country: 'BR' },
+      validator: 'cnpj-dual-mod11',
+    });
+  },
+});