@discretion/core 0.1.0

package/src/detect/detectors/natid/ca.ts

@@ -0,0 +1,40 @@
+/**
+ * Canada: Social Insurance Number — nine digits closed by Luhn (a real
+ * checksum, HIGH). The leading digit encodes the registration region; 0 is
+ * unissued and 8 is not used. The canonical test SIN 046 454 286 (used in
+ * every CRA developer document) is non-sensitive.
+ */
+
+import { luhnValid } from '../../../checksums/index.js';
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+import type { ValidationResult } from '../../types.js';
+
+registerDetector({
+  id: 'national-id-ca-sin',
+  entityType: 'NATIONAL_ID',
+  regions: ['CA'],
+  pattern: /\b(\d{3})[- ](\d{3})[- ](\d{3})\b|\b(\d{9})\b/g,
+  baseConfidence: CONFIDENCE.HIGH,
+  description: 'Canadian SINs: Luhn-checksummed, delimited or contiguous.',
+  validate(ctx): ValidationResult {
+    const before = ctx.start > 0 ? ctx.text[ctx.start - 1] : '';
+    if (/[\d-]/.test(before ?? '')) return invalid('fragment of a longer number');
+    const after = ctx.text.slice(ctx.end, ctx.end + 2);
+    if (/^\d/.test(after) || /^-\d/.test(after)) return invalid('fragment of a longer number');
+
+    const digits = ctx.match[0].replace(/[- ]/g, '');
+    const first = digits[0]!;
+    if (first === '8') return invalid('unissued leading digit');
+    if (!luhnValid(digits)) return invalid('Luhn checksum failed');
+    // Leading 0 is not issued to people — which is exactly why the CRA's
+    // documentation specimens (046 454 286 et al.) use it. A Luhn-valid
+    // 0-leading SIN is detected but is definitionally not a real SIN.
+    return valid({
+      canonical: digits,
+      sensitive: first !== '0',
+      metadata: { scheme: 'sin', country: 'CA' },
+      validator: 'luhn',
+    });
+  },
+});

package/src/detect/detectors/natid/cl.ts

@@ -0,0 +1,47 @@
+/**
+ * Chile: RUT/RUN — digits (usually dotted in groups of three) plus a check
+ * character 0–9 or K: cycling weights 2,3,4,5,6,7 from the RIGHT, check =
+ * 11 − (sum mod 11), with 11 → 0 and 10 → 'K'. Bijective, hard-mutation
+ * tested.
+ */
+
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+import type { ValidationResult } from '../../types.js';
+
+/** The RUT check character for a digit body. */
+export function rutCheckChar(body: string): string | null {
+  let sum = 0;
+  let weight = 2;
+  for (let i = body.length - 1; i >= 0; i--) {
+    const d = Number(body[i]);
+    if (Number.isNaN(d)) return null;
+    sum += d * weight;
+    weight = weight === 7 ? 2 : weight + 1;
+  }
+  const result = 11 - (sum % 11);
+  if (result === 11) return '0';
+  if (result === 10) return 'K';
+  return String(result);
+}
+
+registerDetector({
+  id: 'national-id-cl-rut',
+  entityType: 'NATIONAL_ID',
+  regions: ['CL'],
+  pattern: /\b(\d{1,2}(?:\.\d{3}){2}|\d{7,8})-([\dKk])\b/g,
+  baseConfidence: CONFIDENCE.HIGH,
+  description: 'Chilean RUT with its right-cycling mod-11 check (K for 10).',
+  validate(ctx): ValidationResult {
+    const body = ctx.match[1]!.replace(/\./g, '');
+    const expected = rutCheckChar(body);
+    if (expected === null || expected !== ctx.match[2]!.toUpperCase()) {
+      return invalid('RUT check character failed');
+    }
+    return valid({
+      canonical: `${body}-${expected}`,
+      metadata: { scheme: 'rut', country: 'CL' },
+      validator: 'rut-mod11',
+    });
+  },
+});

package/src/detect/detectors/natid/cn.ts

@@ -0,0 +1,48 @@
+/**
+ * China: Resident Identity Card — eighteen characters: a six-digit
+ * administrative division whose PROVINCE prefix must be real, an eight-digit
+ * birth date validated as a date, three serial digits, and the ISO 7064
+ * MOD 11-2 check character (0–9 or X) from the shared library — the
+ * combination SPEC.md names.
+ */
+
+import { mod11_2Valid } from '../../../checksums/index.js';
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+import type { ValidationResult } from '../../types.js';
+
+/** Published province-level division prefixes. */
+const PROVINCES = new Set([
+  '11', '12', '13', '14', '15', '21', '22', '23',
+  '31', '32', '33', '34', '35', '36', '37',
+  '41', '42', '43', '44', '45', '46',
+  '50', '51', '52', '53', '54',
+  '61', '62', '63', '64', '65',
+  '71', '81', '82', '91',
+]);
+
+registerDetector({
+  id: 'national-id-cn-ric',
+  entityType: 'NATIONAL_ID',
+  regions: ['CN'],
+  pattern: /\b(\d{2})(\d{4})(\d{4})(\d{2})(\d{2})(\d{3})([0-9Xx])\b/g,
+  baseConfidence: CONFIDENCE.HIGH,
+  description: 'Chinese Resident Identity Card: province, birth date, ISO 7064 MOD 11-2.',
+  validate(ctx): ValidationResult {
+    if (!PROVINCES.has(ctx.match[1]!)) return invalid('not a province prefix');
+    const year = Number(ctx.match[3]);
+    if (year < 1900 || year > 2029) return invalid('implausible birth year');
+    const month = Number(ctx.match[4]);
+    if (month < 1 || month > 12) return invalid('month out of range');
+    const day = Number(ctx.match[5]);
+    if (day < 1 || day > 31) return invalid('day out of range');
+
+    const value = ctx.match[0].toUpperCase();
+    if (!mod11_2Valid(value.slice(0, 17), value[17]!)) return invalid('MOD 11-2 check failed');
+    return valid({
+      canonical: value,
+      metadata: { scheme: 'ric', country: 'CN' },
+      validator: 'iso7064-11-2',
+    });
+  },
+});

package/src/detect/detectors/natid/co.ts

@@ -0,0 +1,46 @@
+/**
+ * Colombia: NIT — a digit body (typically dotted) plus a DIAN check digit:
+ * prime weights 3,7,13,17,19,23,29,37,41,43,47,53,59,67,71 applied from
+ * the RIGHT; remainder r = sum mod 11; check = r > 1 ? 11 − r : r. The
+ * r ∈ {0,1} identity branch is a fold (check 1 ⇐ r=1 or r=10), so the
+ * mutation property is validation-only.
+ */
+
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+import type { ValidationResult } from '../../types.js';
+
+const NIT_WEIGHTS = [3, 7, 13, 17, 19, 23, 29, 37, 41, 43, 47, 53, 59, 67, 71];
+
+/** The DIAN check digit for a NIT body. */
+export function nitCheckDigit(body: string): number | null {
+  let sum = 0;
+  for (let i = 0; i < body.length; i++) {
+    const d = Number(body[body.length - 1 - i]);
+    if (Number.isNaN(d)) return null;
+    sum += d * NIT_WEIGHTS[i]!;
+  }
+  const r = sum % 11;
+  return r > 1 ? 11 - r : r;
+}
+
+registerDetector({
+  id: 'national-id-co-nit',
+  entityType: 'TAX_ID',
+  regions: ['CO'],
+  pattern: /\b(\d{1,3}(?:\.\d{3}){2,3}|\d{8,10})-(\d)\b/g,
+  baseConfidence: CONFIDENCE.HIGH,
+  description: 'Colombian NIT with the DIAN prime-weight check digit.',
+  validate(ctx): ValidationResult {
+    const body = ctx.match[1]!.replace(/\./g, '');
+    const expected = nitCheckDigit(body);
+    if (expected === null || expected !== Number(ctx.match[2])) {
+      return invalid('NIT check digit failed');
+    }
+    return valid({
+      canonical: `${body}${ctx.match[2]}`,
+      metadata: { scheme: 'nit', country: 'CO' },
+      validator: 'nit-mod11',
+    });
+  },
+});

package/src/detect/detectors/natid/cz.ts

@@ -0,0 +1,44 @@
+/**
+ * Czechia & Slovakia: Rodné číslo — the shared Czechoslovak birth number.
+ *
+ * Ten digits (born 1954 onward): the WHOLE number must be divisible by 11.
+ * Women add 50 to the month; the +20/+70 extension bands (used when a
+ * day's serials ran out) are accepted. The pre-1954 nine-digit form has no
+ * check at all and is deliberately not claimed — a bare nine-digit run
+ * belongs to checksummated schemes.
+ */
+
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+import type { ValidationResult } from '../../types.js';
+
+registerDetector({
+  id: 'national-id-cz-rodne-cislo',
+  entityType: 'NATIONAL_ID',
+  regions: ['CZ', 'SK'],
+  pattern: /\b(\d{2})(\d{2})(\d{2})\/?(\d{4})\b/g,
+  baseConfidence: CONFIDENCE.HIGH,
+  description: 'Czech/Slovak rodné číslo: month bands plus whole-number divisibility by 11.',
+  validate(ctx): ValidationResult {
+    const before = ctx.start > 0 ? ctx.text[ctx.start - 1] : '';
+    if (/[\d-]/.test(before ?? '')) return invalid('fragment of a longer number');
+    const after = ctx.text.slice(ctx.end, ctx.end + 2);
+    if (/^\d/.test(after) || /^-\d/.test(after)) return invalid('fragment of a longer number');
+
+    const month = Number(ctx.match[2]);
+    const monthValid =
+      (month >= 1 && month <= 12) || (month >= 51 && month <= 62) ||
+      (month >= 21 && month <= 32) || (month >= 71 && month <= 82);
+    if (!monthValid) return invalid('month outside all bands');
+    const day = Number(ctx.match[3]);
+    if (day < 1 || day > 31) return invalid('day out of range');
+
+    const ten = `${ctx.match[1]}${ctx.match[2]}${ctx.match[3]}${ctx.match[4]}`;
+    if (Number(ten) % 11 !== 0) return invalid('not divisible by 11');
+    return valid({
+      canonical: ten,
+      metadata: { scheme: 'rodne-cislo', country: 'CZ' },
+      validator: 'mod11-divisibility',
+    });
+  },
+});

package/src/detect/detectors/natid/de.ts

@@ -0,0 +1,75 @@
+/**
+ * Germany: Steuerliche Identifikationsnummer and Personalausweis number.
+ *
+ * Steuer-ID: 11 digits, leading digit nonzero, closed by ISO 7064 MOD 11,10
+ * (shared library), plus the distinctive digit-frequency rule: among the
+ * first ten digits, one digit appears exactly twice or thrice and at least
+ * one digit does not appear at all — that rule alone rejects most random
+ * digit runs before the checksum even speaks. HIGH.
+ *
+ * Personalausweis (ID card document number): 9 characters from the
+ * C-through-Z-minus-vowels+digits alphabet followed by an ICAO 9303 7-3-1
+ * check digit — the same algorithm as the MRZ, reused from the shared
+ * library. HIGH.
+ */
+
+import { mod11_10Valid, mrzCheckValid } from '../../../checksums/index.js';
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+import type { ValidationResult } from '../../types.js';
+
+registerDetector({
+  id: 'national-id-de-steuerid',
+  entityType: 'TAX_ID',
+  regions: ['DE'],
+  pattern: /\b[1-9]\d{2} ?\d{3} ?\d{3} ?\d{2}\b|\b[1-9]\d{10}\b/g,
+  baseConfidence: CONFIDENCE.HIGH,
+  description: 'German Steuer-IDs: digit-frequency rule plus ISO 7064 MOD 11,10.',
+  validate(ctx): ValidationResult {
+    const digits = ctx.match[0].replace(/ /g, '');
+    if (digits.length !== 11) return invalid('not eleven digits');
+
+    const counts = new Map<string, number>();
+    for (const d of digits.slice(0, 10)) counts.set(d, (counts.get(d) ?? 0) + 1);
+    const multiples = [...counts.values()].filter((c) => c > 1);
+    if (counts.size === 10) return invalid('all ten digits distinct — rule requires a repeat');
+    if (multiples.length !== 1) return invalid('exactly one digit may repeat');
+    if (multiples[0]! > 3) return invalid('a digit repeats more than three times');
+
+    if (!mod11_10Valid(digits.slice(0, 10), digits[10]!)) {
+      return invalid('ISO 7064 MOD 11,10 check failed');
+    }
+    return valid({
+      canonical: digits,
+      metadata: { scheme: 'steuer-id', country: 'DE' },
+      validator: 'iso7064-11-10',
+    });
+  },
+});
+
+/** Document-number alphabet: digits and consonants C–Z (no vowels, no B/Q/S? —
+ *  the BSI alphabet excludes A, E, I, O, U and B, D, Q, S for legibility). */
+const AUSWEIS_ALPHABET = /^[0-9CFGHJKLMNPRTVWXYZ]{9}$/;
+
+registerDetector({
+  id: 'national-id-de-personalausweis',
+  entityType: 'NATIONAL_ID',
+  regions: ['DE'],
+  pattern: /\b[0-9CFGHJKLMNPRTVWXYZ]{9}\d\b/g,
+  baseConfidence: CONFIDENCE.HIGH,
+  description: 'German Personalausweis document numbers with the ICAO 7-3-1 check digit.',
+  validate(ctx): ValidationResult {
+    const value = ctx.match[0];
+    const payload = value.slice(0, 9);
+    if (!AUSWEIS_ALPHABET.test(payload)) return invalid('character outside the BSI alphabet');
+    // All-digit payloads are indistinct from arbitrary ten-digit numbers
+    // even with a passing check digit; require at least one letter.
+    if (!/[A-Z]/.test(payload)) return invalid('no letter in document number');
+    if (!mrzCheckValid(payload, value[9]!)) return invalid('ICAO check digit failed');
+    return valid({
+      canonical: value,
+      metadata: { scheme: 'personalausweis', country: 'DE' },
+      validator: 'icao-731',
+    });
+  },
+});

package/src/detect/detectors/natid/dk.ts

@@ -0,0 +1,31 @@
+/**
+ * Denmark: CPR-nummer — DDMMYY-SSSS. The historical mod-11 check was
+ * OFFICIALLY ABANDONED in 2007 (serial capacity ran out), so enforcing it
+ * would reject genuine numbers issued since. What remains checkable is the
+ * date, so this is a structural detector at MEDIUM, hyphenated writing
+ * only, and says so — the same honest posture as the UK sort code.
+ */
+
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+import type { ValidationResult } from '../../types.js';
+
+registerDetector({
+  id: 'national-id-dk-cpr',
+  entityType: 'NATIONAL_ID',
+  regions: ['DK'],
+  pattern: /\b(\d{2})(\d{2})(\d{2})-(\d{4})\b/g,
+  baseConfidence: CONFIDENCE.MEDIUM,
+  description: 'Danish CPR numbers: date-validated structure (the mod-11 check was abolished in 2007).',
+  validate(ctx): ValidationResult {
+    const day = Number(ctx.match[1]);
+    if (day < 1 || day > 31) return invalid('day out of range');
+    const month = Number(ctx.match[2]);
+    if (month < 1 || month > 12) return invalid('month out of range');
+    return valid({
+      canonical: ctx.match[0].replace('-', ''),
+      metadata: { scheme: 'cpr', country: 'DK' },
+      validator: 'cpr-date-structure',
+    });
+  },
+});

package/src/detect/detectors/natid/es.ts

@@ -0,0 +1,95 @@
+/**
+ * Spain: DNI, NIE, CIF — all with real check characters.
+ *
+ * DNI: 8 digits + letter = "TRWAGMYFPDXBNJZSQVHLCKE"[n mod 23].
+ * NIE: X/Y/Z + 7 digits + the same letter check with X→0, Y→1, Z→2
+ * prepended. CIF: organization letter + 7 digits + check, where the check
+ * is computed Luhn-style over the seven digits and is a digit for some
+ * organization classes, a letter ("JABCDEFGHI"[value]) for others, and
+ * either for the rest.
+ */
+
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+import type { ValidationResult } from '../../types.js';
+
+const DNI_LETTERS = 'TRWAGMYFPDXBNJZSQVHLCKE';
+
+registerDetector({
+  id: 'national-id-es-dni',
+  entityType: 'NATIONAL_ID',
+  regions: ['ES'],
+  pattern: /\b(\d{8})[- ]?([A-Z])\b/g,
+  baseConfidence: CONFIDENCE.HIGH,
+  description: 'Spanish DNI with the mod-23 letter verified.',
+  validate(ctx): ValidationResult {
+    const expected = DNI_LETTERS[Number(ctx.match[1]) % 23]!;
+    if (ctx.match[2] !== expected) return invalid('mod-23 letter failed');
+    return valid({
+      canonical: `${ctx.match[1]}${ctx.match[2]}`,
+      metadata: { scheme: 'dni', country: 'ES' },
+      validator: 'dni-mod23',
+    });
+  },
+});
+
+registerDetector({
+  id: 'national-id-es-nie',
+  entityType: 'NATIONAL_ID',
+  regions: ['ES'],
+  pattern: /\b([XYZ])[- ]?(\d{7})[- ]?([A-Z])\b/g,
+  baseConfidence: CONFIDENCE.HIGH,
+  description: 'Spanish NIE (foreigner id) with the mod-23 letter verified.',
+  validate(ctx): ValidationResult {
+    const prefixValue = { X: '0', Y: '1', Z: '2' }[ctx.match[1] as 'X' | 'Y' | 'Z'];
+    const numeric = Number(`${prefixValue}${ctx.match[2]}`);
+    const expected = DNI_LETTERS[numeric % 23]!;
+    if (ctx.match[3] !== expected) return invalid('mod-23 letter failed');
+    return valid({
+      canonical: `${ctx.match[1]}${ctx.match[2]}${ctx.match[3]}`,
+      metadata: { scheme: 'nie', country: 'ES' },
+      validator: 'nie-mod23',
+    });
+  },
+});
+
+/** CIF organization letters and which check-character class each takes. */
+const CIF_DIGIT_ONLY = new Set(['A', 'B', 'E', 'H']);
+const CIF_LETTER_ONLY = new Set(['K', 'P', 'Q', 'S', 'N', 'W', 'R']);
+const CIF_ORG = /^[ABCDEFGHJKLMNPQRSUVW]$/;
+const CIF_CHECK_LETTERS = 'JABCDEFGHI';
+
+registerDetector({
+  id: 'national-id-es-cif',
+  entityType: 'TAX_ID',
+  regions: ['ES'],
+  pattern: /\b([A-HJ-NP-SUVW])[- ]?(\d{7})[- ]?([0-9A-J])\b/g,
+  baseConfidence: CONFIDENCE.HIGH,
+  description: 'Spanish CIF (company tax id) with its Luhn-style check verified.',
+  validate(ctx): ValidationResult {
+    const org = ctx.match[1]!;
+    if (!CIF_ORG.test(org)) return invalid('not a CIF organization letter');
+    const digits = ctx.match[2]!;
+    let sum = 0;
+    for (let i = 0; i < 7; i++) {
+      let v = Number(digits[i]);
+      if (i % 2 === 0) {
+        v *= 2;
+        if (v > 9) v -= 9;
+      }
+      sum += v;
+    }
+    const value = (10 - (sum % 10)) % 10;
+    const check = ctx.match[3]!;
+    const digitOk = check === String(value);
+    const letterOk = check === CIF_CHECK_LETTERS[value];
+    if (CIF_DIGIT_ONLY.has(org) && !digitOk) return invalid('digit check required and failed');
+    if (CIF_LETTER_ONLY.has(org) && !letterOk) return invalid('letter check required and failed');
+    if (!digitOk && !letterOk) return invalid('check character failed');
+    return valid({
+      canonical: `${org}${digits}${check}`,
+      metadata: { scheme: 'cif', country: 'ES' },
+      validator: 'cif-check',
+    });
+  },
+});

package/src/detect/detectors/natid/fi.ts

@@ -0,0 +1,41 @@
+/**
+ * Finland: Henkilötunnus (HETU) — DDMMYY, a century sign, a 3-digit
+ * individual number, and a base-31 check character over the nine digits:
+ * "0123456789ABCDEFHJKLMNPRSTUVWXY"[DDMMYYNNN mod 31] (G, I, O, Q and Z are
+ * excluded from the alphabet). Century signs: '+' 1800s, '-' 1900s, and the
+ * letters A–F for the 2000s (the 2023 reform made U–Y valid for the 1900s;
+ * accepted).
+ */
+
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+import type { ValidationResult } from '../../types.js';
+
+const HETU_ALPHABET = '0123456789ABCDEFHJKLMNPRSTUVWXY';
+const CENTURY_SIGNS = /^[-+A-FU-Y]$/;
+
+registerDetector({
+  id: 'national-id-fi-hetu',
+  entityType: 'NATIONAL_ID',
+  regions: ['FI'],
+  pattern: /\b(\d{2})(\d{2})(\d{2})([-+A-FU-Y])(\d{3})([0-9A-Y])\b/g,
+  baseConfidence: CONFIDENCE.HIGH,
+  description: 'Finnish HETU with the base-31 check character verified.',
+  validate(ctx): ValidationResult {
+    const day = Number(ctx.match[1]);
+    if (day < 1 || day > 31) return invalid('day out of range');
+    const month = Number(ctx.match[2]);
+    if (month < 1 || month > 12) return invalid('month out of range');
+    if (!CENTURY_SIGNS.test(ctx.match[4]!)) return invalid('not a century sign');
+
+    const nine = Number(`${ctx.match[1]}${ctx.match[2]}${ctx.match[3]}${ctx.match[5]}`);
+    const expected = HETU_ALPHABET[nine % 31]!;
+    if (ctx.match[6] !== expected) return invalid('base-31 check character failed');
+
+    return valid({
+      canonical: ctx.match[0],
+      metadata: { scheme: 'hetu', country: 'FI' },
+      validator: 'hetu-mod31',
+    });
+  },
+});

package/src/detect/detectors/natid/fr.ts

@@ -0,0 +1,63 @@
+/**
+ * France: INSEE/NIR — 13 digits + 2-digit key, key = 97 − (number mod 97).
+ *
+ * Corsican departments write 2A/2B in the department field; for the modulo
+ * the letter is replaced (2A→19, 2B→18 after subtracting from the numeric
+ * reading — the standard rule: replace A with 0 and subtract 1,000,000;
+ * B with 0 and subtract 2,000,000 — implemented via string substitution
+ * then the documented offsets). Structure gates first: sex digit 1–8,
+ * month 01–12 (or the 20+ pseudo-months INSEE uses for late registration).
+ */
+
+import { modString } from '../../../checksums/index.js';
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+import type { ValidationResult } from '../../types.js';
+
+registerDetector({
+  id: 'national-id-fr-nir',
+  entityType: 'NATIONAL_ID',
+  regions: ['FR'],
+  pattern: /\b([1-8])[ ]?(\d{2})[ ]?(\d{2})[ ]?(\d[0-9AB])[ ]?(\d{3})[ ]?(\d{3})[ ]?(\d{2})\b/gi,
+  baseConfidence: CONFIDENCE.HIGH,
+  description: 'French NIR (INSEE) numbers with the mod-97 key, Corsica handled.',
+  validate(ctx): ValidationResult {
+    const [, sex, , month, dept, commune, order, key] = ctx.match as unknown as string[];
+    const monthNum = Number(month);
+    const validMonth = (monthNum >= 1 && monthNum <= 12) || (monthNum >= 20 && monthNum <= 42) || monthNum >= 50;
+    if (!validMonth) return invalid('implausible month field');
+
+    const deptUpper = dept!.toUpperCase();
+    let thirteen = `${sex}${ctx.match[2]}${month}${deptUpper}${commune}${order}`;
+    let offset = 0n;
+    if (deptUpper.includes('A')) {
+      thirteen = thirteen.replace('A', '0');
+      offset = 1_000_000n;
+    } else if (deptUpper.includes('B')) {
+      thirteen = thirteen.replace('B', '0');
+      offset = 2_000_000n;
+    }
+    if (!/^\d{13}$/.test(thirteen)) return invalid('malformed NIR body');
+
+    // key = 97 − ((N − corsicaOffset) mod 97). The offset fits the rule
+    // published by INSEE for 2A/2B departments.
+    const n = BigInt(thirteen) - offset;
+    const expected = 97n - (n % 97n);
+    if (Number(expected) !== Number(key)) return invalid('mod-97 key failed');
+
+    // modString cross-check for the common (non-Corsican) path keeps the
+    // BigInt usage honest against the shared library.
+    if (offset === 0n) {
+      const viaLibrary = modString(thirteen, 97);
+      if (viaLibrary === null || 97 - viaLibrary !== Number(expected)) {
+        return invalid('internal checksum disagreement');
+      }
+    }
+
+    return valid({
+      canonical: `${thirteen.slice(0, 5)}${deptUpper}${commune}${order}${key}`.slice(0, 15),
+      metadata: { scheme: 'nir', country: 'FR', sex: sex === '1' ? 'M' : sex === '2' ? 'F' : 'other' },
+      validator: 'nir-mod97',
+    });
+  },
+});

package/src/detect/detectors/natid/gb.ts

@@ -0,0 +1,70 @@
+/**
+ * United Kingdom: National Insurance Number and NHS Number.
+ *
+ * NINO has no checksum — validation is the published prefix rules — so it
+ * caps at MEDIUM. The NHS Number closes with a real mod-11 check digit
+ * (weights 10..2; remainder 10 means the number is never issued) → HIGH.
+ * The NHS test range 999xxxxxxx is non-sensitive.
+ */
+
+import { toDigits, weightedMod } from '../../../checksums/index.js';
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+import type { ValidationResult } from '../../types.js';
+
+/** Letters never used in NINO prefixes, by position. */
+const NINO_BANNED_ANY = /[DFIQUV]/;
+const NINO_BANNED_SECOND = /[DFIQUVO]/;
+const NINO_BANNED_PAIRS = new Set(['BG', 'GB', 'NK', 'KN', 'TN', 'NT', 'ZZ']);
+
+registerDetector({
+  id: 'national-id-gb-nino',
+  entityType: 'NATIONAL_ID',
+  regions: ['GB'],
+  pattern: /\b([A-Z]{2})[ ]?(\d{2})[ ]?(\d{2})[ ]?(\d{2})[ ]?([A-D])\b/g,
+  baseConfidence: CONFIDENCE.MEDIUM,
+  description: 'UK National Insurance Numbers: prefix validity rules (no checksum exists).',
+  validate(ctx): ValidationResult {
+    const prefix = ctx.match[1]!;
+    if (NINO_BANNED_ANY.test(prefix[0]!)) return invalid('banned first prefix letter');
+    if (NINO_BANNED_SECOND.test(prefix[1]!)) return invalid('banned second prefix letter');
+    if (NINO_BANNED_PAIRS.has(prefix)) return invalid('banned prefix pair');
+    const digits = `${ctx.match[2]}${ctx.match[3]}${ctx.match[4]}`;
+    return valid({
+      canonical: `${prefix}${digits}${ctx.match[5]}`,
+      metadata: { scheme: 'nino', country: 'GB' },
+      validator: 'nino-prefix-rules',
+    });
+  },
+});
+
+const NHS_WEIGHTS = [10, 9, 8, 7, 6, 5, 4, 3, 2];
+
+registerDetector({
+  id: 'national-id-gb-nhs',
+  entityType: 'NATIONAL_ID',
+  regions: ['GB'],
+  pattern: /\b(\d{3})[ -]?(\d{3})[ -]?(\d{4})\b/g,
+  baseConfidence: CONFIDENCE.HIGH,
+  description: 'NHS Numbers: mod-11 check digit (remainder 10 never issued).',
+  validate(ctx): ValidationResult {
+    const before = ctx.start > 0 ? ctx.text[ctx.start - 1] : '';
+    if (/[\d-]/.test(before ?? '')) return invalid('fragment of a longer number');
+    const after = ctx.text.slice(ctx.end, ctx.end + 2);
+    if (/^\d/.test(after) || /^-\d/.test(after)) return invalid('fragment of a longer number');
+
+    const digits = ctx.match[0].replace(/[ -]/g, '');
+    const payload = toDigits(digits.slice(0, 9))!;
+    const remainder = weightedMod(payload, NHS_WEIGHTS, 11)!;
+    let check = 11 - remainder;
+    if (check === 11) check = 0;
+    if (check === 10) return invalid('remainder 10 is never issued');
+    if (check !== Number(digits[9])) return invalid('mod-11 check digit failed');
+    return valid({
+      canonical: digits,
+      sensitive: !digits.startsWith('999'), // NHS test range
+      metadata: { scheme: 'nhs', country: 'GB' },
+      validator: 'nhs-mod11',
+    });
+  },
+});

package/src/detect/detectors/natid/gr.ts

@@ -0,0 +1,35 @@
+/**
+ * Greece: AFM (ΑΦΜ) — nine digits, powers-of-two weights: the i-th of the
+ * first eight digits (left to right) is multiplied by 2^(8−i), the sum is
+ * taken mod 11, and that result mod 10 must equal the ninth digit.
+ */
+
+import { toDigits, weightedModBy } from '../../../checksums/index.js';
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+import type { ValidationResult } from '../../types.js';
+
+registerDetector({
+  id: 'national-id-gr-afm',
+  entityType: 'TAX_ID',
+  regions: ['GR'],
+  pattern: /\b\d{9}\b/g,
+  baseConfidence: CONFIDENCE.HIGH,
+  description: 'Greek AFM tax numbers with the power-of-two mod-11 check.',
+  validate(ctx): ValidationResult {
+    const before = ctx.start > 0 ? ctx.text[ctx.start - 1] : '';
+    if (/[\d-]/.test(before ?? '')) return invalid('fragment of a longer number');
+    const after = ctx.text.slice(ctx.end, ctx.end + 2);
+    if (/^\d/.test(after) || /^-\d/.test(after)) return invalid('fragment of a longer number');
+
+    const digits = toDigits(ctx.match[0])!;
+    if (digits.every((d) => d === 0)) return invalid('all zeros');
+    const sum = weightedModBy(digits.slice(0, 8), (i) => 2 ** (8 - i), 11)!;
+    if (sum % 10 !== digits[8]) return invalid('AFM checksum failed');
+    return valid({
+      canonical: ctx.match[0],
+      metadata: { scheme: 'afm', country: 'GR' },
+      validator: 'afm-mod11',
+    });
+  },
+});