@link-foundation/sensitive-data-sanitizer 0.19.3 → 0.21.0

package/src/national-checks.js

@@ -127,3 +127,212 @@ export function southAfricanId(value) {
     shortLuhn(value)
   );
 }
+const repeated = (digits) => /^(\d)\1+$/.test(digits);
+// US ABA routing transit number: Federal Reserve prefix and 3-7-1 weights.
+export function abaRouting(value) {
+  const d = digitsOf(value),
+    prefix = Number(d.slice(0, 2));
+  return (
+    d.length === 9 &&
+    !repeated(d) &&
+    (prefix <= 12 ||
+      (prefix >= 21 && prefix <= 32) ||
+      (prefix >= 61 && prefix <= 72) ||
+      prefix === 80) &&
+    sum(d, [3, 7, 1, 3, 7, 1, 3, 7, 1]) % 10 === 0
+  );
+}
+const dniLetters = 'TRWAGMYFPDXBNJZSQVHLCKE';
+// Spanish NIE: X/Y/Z stands for 0/1/2 before the DNI mod-23 letter.
+export function spanishNie(value) {
+  const v = value.toUpperCase();
+  return (
+    /^[XYZ]\d{7}[A-Z]$/.test(v) &&
+    dniLetters[Number(`${'XYZ'.indexOf(v[0])}${v.slice(1, 8)}`) % 23] === v[8]
+  );
+}
+// Australian Business Number: subtract one from the first digit, mod 89.
+export function abn(value) {
+  const d = digitsOf(value).split('').map(Number);
+  if (d.length !== 11 || repeated(d.join(''))) {
+    return false;
+  }
+  d[0] -= 1;
+  return sum(d, [10, 1, 3, 5, 7, 9, 11, 13, 15, 17, 19]) % 89 === 0;
+}
+// Australian Company Number: weighted complement mod 10.
+export function acn(value) {
+  const d = digitsOf(value);
+  return (
+    d.length === 9 &&
+    !repeated(d) &&
+    (10 - (sum(d, [8, 7, 6, 5, 4, 3, 2, 1]) % 10)) % 10 === Number(d[8])
+  );
+}
+// Australian Medicare card: first digit 2-6, ninth digit is the check digit.
+export function medicare(value) {
+  const d = digitsOf(value);
+  return (
+    /^[2-6]\d{9,10}$/.test(d) &&
+    sum(d, [1, 3, 7, 9, 1, 3, 7, 9]) % 10 === Number(d[8])
+  );
+}
+const verhoeffD = [
+  [0, 1, 2, 3, 4, 5, 6, 7, 8, 9],
+  [1, 2, 3, 4, 0, 6, 7, 8, 9, 5],
+  [2, 3, 4, 0, 1, 7, 8, 9, 5, 6],
+  [3, 4, 0, 1, 2, 8, 9, 5, 6, 7],
+  [4, 0, 1, 2, 3, 9, 5, 6, 7, 8],
+  [5, 9, 8, 7, 6, 0, 4, 3, 2, 1],
+  [6, 5, 9, 8, 7, 1, 0, 4, 3, 2],
+  [7, 6, 5, 9, 8, 2, 1, 0, 4, 3],
+  [8, 7, 6, 5, 9, 3, 2, 1, 0, 4],
+  [9, 8, 7, 6, 5, 4, 3, 2, 1, 0],
+];
+const verhoeffP = [
+  [0, 1, 2, 3, 4, 5, 6, 7, 8, 9],
+  [1, 5, 7, 6, 2, 8, 3, 0, 9, 4],
+  [5, 8, 0, 3, 7, 9, 6, 1, 4, 2],
+  [8, 9, 1, 6, 0, 4, 3, 5, 2, 7],
+  [9, 4, 5, 3, 1, 2, 6, 8, 7, 0],
+  [4, 2, 8, 6, 5, 7, 3, 9, 0, 1],
+  [2, 7, 9, 3, 8, 0, 6, 4, 1, 5],
+  [7, 0, 4, 6, 9, 1, 3, 2, 5, 8],
+];
+export function verhoeff(value) {
+  const d = digitsOf(value);
+  let check = 0;
+  for (let i = 0; i < d.length; i++) {
+    check = verhoeffD[check][verhoeffP[i % 8][Number(d[d.length - 1 - i])]];
+  }
+  return d.length > 0 && !repeated(d) && check === 0;
+}
+// Indian Aadhaar: 12 digits, never starting with 0 or 1, Verhoeff check.
+export const aadhaar = (value) =>
+  /^[2-9]\d{11}$/.test(digitsOf(value)) && verhoeff(value);
+const base36 = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ';
+// Indian GSTIN: state code, PAN, entity number, "Z", mod-36 check character.
+export function gstin(value) {
+  const v = value.toUpperCase();
+  if (!/^\d{2}[A-Z]{5}\d{4}[A-Z][1-9A-Z]Z[0-9A-Z]$/.test(v)) {
+    return false;
+  }
+  let total = 0;
+  for (let i = 0; i < 14; i++) {
+    const product = base36.indexOf(v[i]) * (i % 2 === 0 ? 1 : 2);
+    total += Math.floor(product / 36) + (product % 36);
+  }
+  return base36[(36 - (total % 36)) % 36] === v[14];
+}
+// Finnish henkilötunnus: DDMMYY, century sign, individual number, mod 31.
+export function finnishIdentityCode(value) {
+  const v = value.toUpperCase(),
+    match = /^(\d{6})([-+A-FU-Y])(\d{3})([0-9A-Y])$/.exec(v);
+  if (!match) {
+    return false;
+  }
+  const [, date, , individual, check] = match;
+  const swapped = `${date.slice(4, 6)}${date.slice(2, 4)}${date.slice(0, 2)}`;
+  return (
+    datePart(swapped) &&
+    '0123456789ABCDEFHJKLMNPRSTUVWXY'[Number(date + individual) % 31] === check
+  );
+}
+// Thai national identification number: 13 digits, weighted mod 11.
+export function thaiId(value) {
+  const d = digitsOf(value);
+  return (
+    /^[1-8]\d{12}$/.test(d) &&
+    (11 - (sum(d, [13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2]) % 11)) % 10 ===
+      Number(d[12])
+  );
+}
+// US DEA registration: registrant letter, name letter or 9, six digits, check.
+export function dea(value) {
+  const v = value.toUpperCase();
+  if (!/^[ABCDEFGHJKLMPRSTUX][A-Z9]\d{7}$/.test(v)) {
+    return false;
+  }
+  const d = v.slice(2);
+  return (
+    (Number(d[0]) +
+      Number(d[2]) +
+      Number(d[4]) +
+      2 * (Number(d[1]) + Number(d[3]) + Number(d[5]))) %
+      10 ===
+    Number(d[6])
+  );
+}
+const regions = new Intl.DisplayNames(['en'], {
+  type: 'region',
+  fallback: 'none',
+});
+// ISO 3166 alpha-2 region known to the runtime's Unicode CLDR data.
+export const regionCode = (code) =>
+  /^[A-Z]{2}$/.test(code) && code !== 'ZZ' && regions.of(code) !== undefined;
+// SWIFT/BIC: bank, ISO country, location, optional branch.
+export const swiftCode = (value) =>
+  /^[A-Z]{4}[A-Z]{2}[A-Z0-9]{2}(?:[A-Z0-9]{3})?$/.test(value) &&
+  regionCode(value.slice(4, 6));
+// ISO 3779 / FMVSS 115 vehicle identification number: position 9 check digit.
+export function vin(value) {
+  const v = value.toUpperCase();
+  if (!/^[A-HJ-NPR-Z\d]{17}$/.test(v) || !/\d/.test(v) || !/[A-Z]/.test(v)) {
+    return false;
+  }
+  const weights = [8, 7, 6, 5, 4, 3, 2, 10, 0, 9, 8, 7, 6, 5, 4, 3, 2];
+  let total = 0;
+  for (let i = 0; i < 17; i++) {
+    const char = v[i];
+    // Transliteration: A-H 1-8, J-N 1-5, P 7, R 9, S-Z 2-9 (I, O, Q unused).
+    const code = /\d/.test(char)
+      ? Number(char)
+      : Number('12345678 12345 7 923456789'[char.charCodeAt(0) - 65]);
+    total += code * weights[i];
+  }
+  const check = total % 11;
+  return (check === 10 ? 'X' : String(check)) === v[8];
+}
+// German Steuerliche Identifikationsnummer: ISO 7064 MOD 11,10; no leading 0.
+// ISO 7064 MOD 11,10 over all digits but the last, which is the check digit.
+function mod11x10(d) {
+  let product = 10;
+  for (const digit of d.slice(0, -1)) {
+    const total = (Number(digit) + product) % 10 || 10;
+    product = (total * 2) % 11;
+  }
+  return (11 - product) % 10 === Number(d.at(-1));
+}
+export function germanTaxId(value) {
+  const d = digitsOf(value);
+  return /^[1-9]\d{10}$/.test(d) && mod11x10(d);
+}
+// German USt-IdNr: DE plus eight digits and a MOD 11,10 check digit.
+export function germanVat(value) {
+  const v = value.replace(/[\s.-]/g, '').toUpperCase();
+  return /^DE[1-9]\d{8}$/.test(v) && mod11x10(v.slice(2));
+}
+// UPS 1Z tracking number: letters map to (code - 63) mod 10, even positions
+// are doubled, and the last character is the check digit.
+export function upsTracking(value) {
+  const v = value.replace(/\s/g, '').toUpperCase();
+  if (!/^1Z[0-9A-Z]{15}\d$/.test(v)) {
+    return false;
+  }
+  let total = 0;
+  for (let i = 2; i < 17; i++) {
+    const code = /\d/.test(v[i]) ? Number(v[i]) : (v.charCodeAt(i) - 63) % 10;
+    total += i % 2 === 1 ? code * 2 : code;
+  }
+  return (10 - (total % 10)) % 10 === Number(v[17]);
+}
+// UAE Emirates ID: 784, birth year, serial and a Luhn check digit.
+export const emiratesId = (value) =>
+  /^784(?:19|20)\d{10}$/.test(digitsOf(value)) && shortLuhn(value);
+// Saudi national ID (1…) and Iqama (2…) numbers use Luhn over 10 digits.
+export const saudiId = (value) =>
+  /^[12]\d{9}$/.test(digitsOf(value)) && shortLuhn(value);
+// Israeli Teudat Zehut: up to 9 digits, left-padded, Luhn-weighted 1,2,1,2…
+export const israeliId = (value) =>
+  /^\d{5,9}$/.test(digitsOf(value)) &&
+  shortLuhn(digitsOf(value).padStart(9, '0'));

package/src/national.js

@@ -1,112 +1,330 @@
 import { numericNoise, epochNumber } from './confidence.js';
-import {
-  digitsOf,
-  datePart,
-  nhs,
-  snils,
-  inn,
-  pesel,
-  rrn,
-  tfn,
-  nric,
-  fiscalCode,
-  personnummer,
-  southAfricanId,
-  shortLuhn,
-} from './national-checks.js';
+import * as checks from './national-checks.js';
 
-const rules = [
+const never = () => false;
+const always = () => true;
+// Each rule is data: `context` near the value, a `checksum` and a distinctive
+// `plausible` shape raise confidence; `valid` (when present) must always hold.
+// Callers may reuse or extend this list through `nationalRules`.
+export const nationalRules = Object.freeze(
   [
-    'UK_NHS',
-    /\d{3}[ -]?\d{3}[ -]?\d{4}/g,
-    /\b(?:NHS|patient|healthcare|provider)\b/i,
-    nhs,
-  ],
-  [
-    'KR_RRN',
-    /\d{6}[ -]?[1-8]\d{6}/g,
-    /\bRRN\b|주민등록/iu,
-    rrn,
-    (v) => datePart(digitsOf(v)),
-  ],
-  [
-    'IT_FISCAL_CODE',
-    /[A-Z]{6}[0-9LMNPQRSTUV]{2}[ABCDEHLMPRST][0-9LMNPQRSTUV]{2}[A-Z][0-9LMNPQRSTUV]{3}[A-Z]/g,
-    /\bCF\b|codice fiscale/iu,
-    fiscalCode,
-    () => true,
-  ],
-  ['SG_NRIC_FIN', /[STFGM]\d{7}[A-Z]/g, /\b(?:NRIC|FIN)\b/iu, nric, () => true],
-  ['PL_PESEL', /\d{11}/g, /\bPESEL\b/iu, pesel],
-  [
-    'SE_PERSONNUMMER',
-    /(?:\d{2})?\d{6}[-+]\d{4}/g,
-    /personnummer/iu,
-    personnummer,
-  ],
-  [
-    'ZA_ID_NUMBER',
-    /\d{10}[0-2][89]\d/g,
-    /\b(?:SA ID|RSA ID)\b|south african id/iu,
-    southAfricanId,
-  ],
-  ['AU_TFN', /\d{3}[ -]?\d{3}[ -]?\d{3}/g, /\bTFN\b|tax file number/iu, tfn],
-  [
-    'CA_SIN',
-    /\d{3}[ -]?\d{3}[ -]?\d{3}/g,
-    /\bSIN\b|social insurance/iu,
-    shortLuhn,
-  ],
-  [
-    'RU_SNILS',
-    /\d{3}[- ]\d{3}[- ]\d{3}[ -]\d{2}|\d{11}/g,
-    /\bSNILS\b|снилс|пенсионное|страховое свидетельство|страховой номер/iu,
-    snils,
-  ],
-  ['RU_INN', /\d{12}|\d{10}/g, /\bINN\b|инн/iu, inn],
-];
+    {
+      type: 'UK_NHS',
+      pattern: /\d{3}[ -]?\d{3}[ -]?\d{4}/g,
+      context: /\b(?:NHS|patient|healthcare|provider)\b/i,
+      checksum: checks.nhs,
+    },
+    {
+      type: 'KR_RRN',
+      pattern: /\d{6}[ -]?[1-8]\d{6}/g,
+      context: /\bRRN\b|주민등록/iu,
+      checksum: checks.rrn,
+      plausible: (v) => checks.datePart(checks.digitsOf(v)),
+    },
+    {
+      type: 'IT_FISCAL_CODE',
+      pattern:
+        /[A-Z]{6}[0-9LMNPQRSTUV]{2}[ABCDEHLMPRST][0-9LMNPQRSTUV]{2}[A-Z][0-9LMNPQRSTUV]{3}[A-Z]/g,
+      context: /\bCF\b|codice fiscale/iu,
+      checksum: checks.fiscalCode,
+      plausible: always,
+    },
+    {
+      type: 'SG_NRIC_FIN',
+      pattern: /[STFGM]\d{7}[A-Z]/g,
+      context: /\b(?:NRIC|FIN)\b/iu,
+      checksum: checks.nric,
+      plausible: always,
+    },
+    {
+      type: 'PL_PESEL',
+      pattern: /\d{11}/g,
+      context: /\bPESEL\b/iu,
+      checksum: checks.pesel,
+    },
+    {
+      type: 'SE_PERSONNUMMER',
+      pattern: /(?:\d{2})?\d{6}[-+]\d{4}/g,
+      context: /personnummer/iu,
+      checksum: checks.personnummer,
+    },
+    {
+      type: 'ZA_ID_NUMBER',
+      pattern: /\d{10}[0-2][89]\d/g,
+      context: /\b(?:SA ID|RSA ID)\b|south african id/iu,
+      checksum: checks.southAfricanId,
+    },
+    {
+      type: 'AU_TFN',
+      pattern: /\d{3}[ -]?\d{3}[ -]?\d{3}/g,
+      context: /\bTFN\b|tax file number/iu,
+      checksum: checks.tfn,
+    },
+    {
+      type: 'CA_SIN',
+      pattern: /\d{3}[ -]?\d{3}[ -]?\d{3}/g,
+      context: /\b(?:SIN|NAS)\b|social insurance|assurance sociale/iu,
+      checksum: checks.shortLuhn,
+    },
+    {
+      type: 'RU_SNILS',
+      pattern: /\d{3}[- ]\d{3}[- ]\d{3}[ -]\d{2}|\d{11}/g,
+      context:
+        /\bSNILS\b|снилс|пенсионное|страховое свидетельство|страховой номер/iu,
+      checksum: checks.snils,
+    },
+    {
+      type: 'RU_INN',
+      pattern: /\d{12}|\d{10}/g,
+      context: /\bINN\b|инн/iu,
+      checksum: checks.inn,
+    },
+    {
+      type: 'US_ITIN',
+      pattern: /9\d{2}([- ]?)(?:5\d|6[0-5]|7\d|8[0-8]|9[0-2]|9[4-9])\1\d{4}/g,
+      context: /\bITIN\b|taxpayer identification/iu,
+      checksum: never,
+      plausible: (v) => /^\d{3}-\d{2}-\d{4}$/.test(v),
+    },
+    {
+      type: 'ABA_ROUTING_NUMBER',
+      pattern: /\d{4}-?\d{4}-?\d/g,
+      context: /\b(?:routing|ABA|RTN|transit)\b/iu,
+      checksum: checks.abaRouting,
+      valid: checks.abaRouting,
+    },
+    {
+      type: 'US_BANK_NUMBER',
+      pattern: /\d{8,17}/g,
+      context:
+        /\bbank\s+account\b|\b(?:account|acct)\.?\s*(?:number|num|no\.?|#)|\b(?:checking|savings)\s+account\b/iu,
+      checksum: never,
+    },
+    {
+      type: 'US_DRIVER_LICENSE',
+      pattern: /[A-Z]{1,2}\d{4,14}|\d{7,14}/g,
+      context: /\bdriver'?s?[ -]licen[cs]e\b|\bDLN?\b|\bD\.L\.(?=\s|$)/iu,
+      checksum: never,
+    },
+    {
+      type: 'UK_DRIVING_LICENCE',
+      pattern: /[A-Z9]{5}\d[0156]\d{4}[A-Z9]{2}\d[A-Z]{2}/g,
+      context: /\bdriv(?:ing|er'?s?)[ -]licen[cs]e\b|\bDVLA\b/iu,
+      checksum: never,
+      plausible: always,
+    },
+    {
+      type: 'UK_NATIONAL_INSURANCE_NUMBER',
+      pattern: /[A-Z]{2} ?\d{2} ?\d{2} ?\d{2} ?[A-D]/g,
+      context: /\bNINO\b|national insurance|\bNI (?:number|no\b)/iu,
+      checksum: never,
+    },
+    {
+      type: 'ES_NIE',
+      pattern: /[XYZ]-?\d{7}-?[A-Z]/g,
+      context: /\bNIE\b|extranjero/iu,
+      checksum: (v) => checks.spanishNie(v.replace(/-/g, '')),
+      plausible: always,
+    },
+    {
+      type: 'IT_VAT_CODE',
+      pattern: /\d{11}/g,
+      context: /partita\s+iva|\bP\.?\s?IVA\b|\bVAT\b/iu,
+      checksum: checks.shortLuhn,
+    },
+    {
+      type: 'AU_ABN',
+      pattern: /\d{2} ?\d{3} ?\d{3} ?\d{3}/g,
+      context: /\bABN\b|australian business number/iu,
+      checksum: checks.abn,
+      plausible: (v) => /^\d{2} \d{3} \d{3} \d{3}$/.test(v),
+    },
+    {
+      type: 'AU_ACN',
+      pattern: /\d{3} ?\d{3} ?\d{3}/g,
+      context: /\bACN\b|australian company number/iu,
+      checksum: checks.acn,
+    },
+    {
+      type: 'AU_MEDICARE',
+      pattern: /[2-6]\d{3} ?\d{5} ?\d(?:[ -/]?\d)?/g,
+      context: /\bmedicare\b/iu,
+      checksum: checks.medicare,
+    },
+    {
+      type: 'IN_AADHAAR',
+      pattern: /[2-9]\d{3}([ -]?)\d{4}\1\d{4}/g,
+      context: /aadhaa?r|आधार|\bUIDAI\b/iu,
+      checksum: checks.aadhaar,
+    },
+    {
+      type: 'IN_GSTIN',
+      pattern: /\d{2}[A-Z]{5}\d{4}[A-Z][1-9A-Z]Z[0-9A-Z]/g,
+      context: /\bGSTIN?\b|goods and services tax/iu,
+      checksum: checks.gstin,
+      plausible: always,
+    },
+    {
+      type: 'IN_VOTER',
+      pattern: /[A-Z]{3}\d{7}/g,
+      context: /\bvoter\b|\bEPIC\b|election commission/iu,
+      checksum: never,
+    },
+    {
+      type: 'IN_PASSPORT',
+      pattern: /[A-PR-WY][1-9]\d ?\d{4}[1-9]/g,
+      context: /\bpassport\b/iu,
+      checksum: never,
+    },
+    {
+      type: 'FI_PERSONAL_IDENTITY_CODE',
+      pattern: /\d{6}[-+A-FU-Y]\d{3}[0-9A-FHJ-NPR-Y]/g,
+      context:
+        /henkilötunnus|\bHETU\b|personal identity code|personbeteckning/iu,
+      checksum: checks.finnishIdentityCode,
+      plausible: always,
+    },
+    {
+      type: 'TH_TNIN',
+      pattern: /[1-8]\d{12}|[1-8]-\d{4}-\d{5}-\d{2}-\d/g,
+      context: /\bthai\b|\bTNIN\b|เลขประจำตัวประชาชน|บัตรประชาชน/iu,
+      checksum: checks.thaiId,
+    },
+    {
+      type: 'MEDICAL_LICENSE',
+      pattern: /[ABCDEFGHJKLMPRSTUX][A-Z9]\d{7}/g,
+      context: /\bDEA\b|medical licen[cs]e|prescriber/iu,
+      checksum: checks.dea,
+    },
+    {
+      type: 'IMEI',
+      pattern: /\d{15}|\d{2}-\d{6}-\d{6}-\d/g,
+      context: /\bIMEI\b/iu,
+      checksum: checks.shortLuhn,
+    },
+    {
+      type: 'SWIFT_CODE',
+      pattern: /[A-Z]{6}[A-Z0-9]{2}(?:[A-Z0-9]{3})?/g,
+      context: /\b(?:SWIFT|BIC)\b/iu,
+      checksum: never,
+      valid: checks.swiftCode,
+    },
+    {
+      type: 'VIN',
+      pattern: /[A-HJ-NPR-Z\d]{17}/g,
+      context: /\bVIN\b|vehicle identification|chassis/iu,
+      checksum: checks.vin,
+      valid: (v) => /\d/.test(v) && /[A-Z]/.test(v),
+    },
+    {
+      type: 'UK_POSTCODE',
+      pattern: /[A-Z]{1,2}\d[A-Z\d]? ?\d[ABD-HJLNP-UW-Z]{2}/g,
+      context: /\bpost ?code\b|\bpostal code\b/iu,
+      checksum: never,
+    },
+    {
+      type: 'SG_UEN',
+      pattern: /\d{8}[A-Z]|(?:19|20)\d{7}[A-Z]|[TSR]\d{2}[A-Z]{2}\d{4}[A-Z]/g,
+      context: /\bUEN\b|unique entity number/iu,
+      checksum: never,
+    },
+    {
+      type: 'DE_TAX_ID',
+      pattern: /[1-9]\d(?: ?\d{3}){3}|[1-9]\d{10}/g,
+      context: /steuer[ -]?id|steueridentifikationsnummer|\bIdNr\b|\bTIN\b/iu,
+      checksum: checks.germanTaxId,
+    },
+    {
+      // EU VAT identification numbers by member-state prefix (VIES formats).
+      type: 'EU_VAT_NUMBER',
+      pattern:
+        /(?:AT ?U\d{8}|BE ?[01]\d{9}|DE ?[1-9]\d{8}|DK ?\d{8}|EL ?\d{9}|ES ?[0-9A-Z]\d{7}[0-9A-Z]|FI ?\d{8}|FR ?[0-9A-HJ-NP-Z]{2}\d{9}|IE ?\d[0-9A-Z+*]\d{5}[A-Z]{1,2}|IT ?\d{11}|LU ?\d{8}|NL ?\d{9}B\d{2}|PL ?\d{10}|PT ?\d{9}|SE ?\d{12})/g,
+      context:
+        /\bVAT\b|\bUSt\b|USt-?Id|Umsatzsteuer|\bMwSt\b|\bTVA\b|\bBTW\b|\bIVA\b|\bALV\b|\bmoms\b|\bNIP\b|\bNIF\b/iu,
+      checksum: checks.germanVat,
+      plausible: (v) => /^(?:ATU|NL\d{9}B)/.test(v),
+    },
+    {
+      type: 'AE_EMIRATES_ID',
+      pattern: /784-?(?:19|20)\d{2}-?\d{7}-?\d/g,
+      context: /emirates\s+id|\bEID\b|الهوية/iu,
+      checksum: checks.emiratesId,
+      plausible: (v) => /^784-\d{4}-\d{7}-\d$/.test(v),
+    },
+    {
+      type: 'SA_NATIONAL_ID',
+      pattern: /[12]\d{9}/g,
+      context: /\biqama\b|saudi|national\s+id|رقم الهوية|الإقامة/iu,
+      checksum: checks.saudiId,
+    },
+    {
+      type: 'IL_ID_NUMBER',
+      pattern: /\d{9}/g,
+      context: /teudat\s+zehut|israeli\s+id|תעודת זהות|\bת\.ז\b/iu,
+      checksum: checks.israeliId,
+    },
+    {
+      type: 'STEAM_ID',
+      pattern: /7656119\d{10}/g,
+      context: /\bsteam/iu,
+      checksum: never,
+    },
+    {
+      type: 'TRACKING_NUMBER',
+      pattern: /1Z[0-9A-Z]{15}\d|9[2-5]\d{2}(?: ?\d{4}){4}(?: ?\d{2})?/g,
+      context: /tracking|\bUPS\b|\bUSPS\b|shipment|parcel/iu,
+      checksum: checks.upsTracking,
+      plausible: (v) => v.startsWith('1Z'),
+    },
+  ].map((rule) => Object.freeze(rule))
+);
 function distinctiveShape(type, value) {
   return (
     (type === 'RU_SNILS' && /^\d{3}([- ])\d{3}\1\d{3} \d{2}$/.test(value)) ||
     (type === 'RU_INN' && value.length === 12)
   );
 }
-export function detectNational(text, emit) {
-  for (const [type, pattern, context, checksum, plausible] of rules) {
-    for (const match of text.matchAll(pattern)) {
-      const start = match.index,
-        end = start + match[0].length;
-      if (!nationalBoundary(text, start, end)) {
-        continue;
-      }
-      const hasContext = context.test(
-        text.slice(Math.max(0, start - 64), end + 32)
-      );
-      if (
-        !hasContext &&
-        (numericNoise(text, start, end) || epochNumber(match[0]))
-      ) {
-        continue;
-      }
-      const checked = checksum(match[0]);
-      if (checked || hasContext || plausible?.(match[0])) {
+export function detectNational(text, emit, rules = nationalRules) {
+  for (const rule of rules) {
+    for (const match of text.matchAll(rule.pattern)) {
+      const confidence = nationalMatch(text, rule, match);
+      if (confidence !== undefined) {
         emit({
-          start,
-          end,
-          type,
+          start: match.index,
+          end: match.index + match[0].length,
+          type: rule.type,
           category: 'personal',
           rule: 'national-format',
-          confidence: nationalConfidence(
-            hasContext,
-            checked,
-            plausible?.(match[0]) ||
-              (checked && distinctiveShape(type, match[0]))
-          ),
+          confidence,
         });
       }
     }
   }
 }
+// Confidence for one candidate, or undefined when it is not an identifier.
+function nationalMatch(text, rule, match) {
+  const value = match[0],
+    start = match.index,
+    end = start + value.length;
+  if (!nationalBoundary(text, start, end) || rule.valid?.(value) === false) {
+    return undefined;
+  }
+  const hasContext = rule.context.test(
+    text.slice(Math.max(0, start - 64), end + 32)
+  );
+  if (!hasContext && (numericNoise(text, start) || epochNumber(value))) {
+    return undefined;
+  }
+  const checked = rule.checksum(value),
+    plausible = rule.plausible?.(value);
+  return checked || hasContext || plausible
+    ? nationalConfidence(
+        hasContext,
+        checked,
+        plausible || (checked && distinctiveShape(rule.type, value))
+      )
+    : undefined;
+}
 function nationalBoundary(text, start, end) {
   return !(
     /[\p{L}\p{N}_.+-]/u.test(text[start - 1] ?? '') ||