euredact 0.5.0 → 0.6.0

package/dist/esm/rules/countries/index.js

@@ -28,6 +28,41 @@ function p(entityType, pattern, validator = null, description = "", contextKeywo
 // ---------------------------------------------------------------------------
 // Secret context keywords (consolidated, reused across SECRET patterns)
 // ---------------------------------------------------------------------------
+/**
+ * Words that name a travel document, in the official languages of the 31
+ * countries this engine covers, plus English.
+ *
+ * Shared by every passport pattern. Before this existed each country kept its
+ * own list, so a passport was only recognised when its shape and its label
+ * came from the same country: `Reisepass: CA1234567` was missed because the
+ * German pattern rejects that alphabet while the Dutch pattern, whose shape
+ * fits, had never heard of "Reisepass" (issue rules-engine#23).
+ *
+ * The bare Scandinavian "pass", Finnish "passi" and Latvian "pase" are
+ * omitted deliberately: context matching is substring, not word-boundary, so
+ * they fire inside "password", "passenger", "passive" and "phase". Only the
+ * compound forms are listed. Mirrors PASSPORT_CONTEXT in Python.
+ */
+const PASSPORT_CONTEXT = [
+    "passport", "passport no", "passport number", "travel document",
+    "reisepass", "passnummer", "reisepassnummer", "reisepass-nr", "pass nr",
+    "reisedokument",
+    "paspoort", "paspoortnummer", "reisdocument", "identiteitsbewijs",
+    "passeport", "numéro de passeport", "document de voyage",
+    "passaporto", "numero di passaporto", "documento di viaggio",
+    "pasaporte", "número de pasaporte", "documento de viaje",
+    "passaporte", "número do passaporte",
+    "passnr", "passets nummer", "passin numero", "passinumero",
+    "passi number", "passinumber",
+    "vegabréf", "vegabréfsnúmer",
+    "paso numeris", "pases numurs",
+    "paszport", "numer paszportu", "cestovní pas", "číslo pasu",
+    "cestovný pas", "potni list", "številka potnega lista",
+    "putovnica", "broj putovnice",
+    "útlevél", "útlevélszám", "pașaport", "numărul pașaportului",
+    "паспорт", "номер на паспорт", "διαβατήριο",
+    "αριθμός διαβατηρίου", "passaport",
+];
 const SECRET_CONTEXT = [
     // English
     "key", "token", "secret", "password", "credential",
@@ -67,18 +102,50 @@ const SECRET_CONTEXT = [
 // ---------------------------------------------------------------------------
 // DOB context keywords (reused across SHARED patterns)
 // ---------------------------------------------------------------------------
+// Every way the documents this engine sees introduce a date of birth.
+//
+// DOB recall was 62.8% -- 33,441 unmasked birth dates -- because this covered
+// seven languages of thirty-one. Eleven countries scored exactly 100% (the
+// listed languages) while twenty sat at 42-51%, which is what proved it was
+// coverage rather than capability (rules-engine#38).
+//
+// Matching is substring, not word-boundary, so every entry was screened against
+// the 29.2-million-character corpus for occurrences inside a longer word. Two
+// were rejected: `fædd` lives inside `fæddur`, and `born` was found inside
+// `gabornagy` and `gabornemeth` -- Hungarian names as e-mail local parts -- so
+// `"born "` with the trailing space is listed instead.
+//
+// DOB_CONTEXT is gone: it was a second, shorter copy missing `nato il`,
+// `nascido`, `geburtstag` and more, so ISO dates were gated on fewer keywords
+// than DD/MM/YYYY ones for no stated reason.
 const DOB_CONTEXT = [
+    // Germanic / Romance -- the original set, kept verbatim.
     "geboren", "geboortedatum", "date de naissance", "né le", "née le",
     "né(e) le", "nee le", "nee(e) le", "date of birth", "DOB",
     "Geburtsdatum", "geboren am", "geboren op", "nascido", "nacido",
     "data di nascita", "nato il", "nata il", "geb.", "geb.datum", "geb ",
     "birth date", "birthday", "naissance", "geboorte", "geburtstag",
-];
-const DOB_ISO_CONTEXT = [
-    "geboren", "geboortedatum", "date de naissance", "né le", "née le",
-    "né(e) le", "nee le", "date of birth", "DOB", "Geburtsdatum",
-    "geboren am", "geboren op", "geb.", "birth date", "birthday",
-    "naissance", "geboorte",
+    // English and Italian forms the list was missing.
+    "born ", "d.o.b", "nato/a il",
+    // Nordic.
+    "født", "fødselsdato", "född", "födelsedatum",
+    "syntynyt", "syntymäaika", "fæddur", "fæðingardagur",
+    // Greek -- Greece and Cyprus.
+    "γεννηθείς", "γεννήθηκε", "ημερομηνία γέννησης",
+    // West Slavic.
+    "urodzony", "urodzona", "data urodzenia",
+    "narozen", "datum narození", "narodený", "dátum narodenia",
+    // Hungarian, Romanian, Bulgarian.
+    "született", "születési", "născut", "născută", "data nașterii",
+    "роден", "родена", "дата на раждане",
+    // South Slavic.
+    "rođen", "rođena", "datum rođenja", "rojen", "rojena", "datum rojstva",
+    // Baltic.
+    "sündinud", "sünniaeg", "dzimis", "dzimusi", "dzimšanas datums",
+    "gimęs", "gimusi", "gimimo data",
+    // Maltese, Irish, Turkish (Cyprus).
+    "twieled", "twieldet", "data tat-twelid",
+    "rugadh", "dáta breithe", "doğum tarihi",
 ];
 const DATE_OF_DEATH_CONTEXT = [
     "overleden", "overlijdensdatum", "date de décès", "décédé le",
@@ -118,6 +185,17 @@ const SHARED = {
         // "Call (+32 475 12 34 56) today." also masked the ")" (issue
         // rules-engine#3). Mirrors the Python pattern character for character.
         p(EntityType.PHONE, String.raw `\+\d{1,3}(?:[\s\-/]?(?:\(\d{1,4}\)|\d{1,4})){2,7}`, "e164", "International phone number (E.164) — any country"),
+        // Passport (any country). The per-country patterns cover BE, DE, FR and NL
+        // only; the other 26 had none. Same argument as the E.164 phone rule: one
+        // country-independent shape, with the label carrying the precision.
+        // Shapes from the project canon (prompts/pii_definitions.md, PASSPORT):
+        // EU is 1-2 letters + 7 digits, UK is 9 digits optionally GBR-prefixed.
+        // The canon's position is that the EU converged on one shape, so national
+        // regexes would contradict it as well as being unverifiable. An earlier
+        // draft required a leading letter and missed all-numeric passports, the
+        // UK's own format among them; requiring exactly nine digits for the
+        // numeric form rejects eight-digit dates on shape (issue rules-engine#23).
+        p(EntityType.PASSPORT, String.raw `\b(?:GBR\d{9}|[A-Z]{1,2}\d{7}|\d{9})\b`, null, "Passport number — any country, label-gated", PASSPORT_CONTEXT, true),
         p(EntityType.BIC, String.raw `\b[A-Z]{4}[A-Z]{2}[A-Z0-9]{2}(?:[A-Z0-9]{3})?\b`, "bic"),
         // Space-separated form: "RZBA AT WW", "NICA BE BB". Written as a separate
         // pattern requiring a space between *every* group, rather than making the
@@ -174,7 +252,12 @@ const SHARED = {
         // --- Secret / API Key (connection strings with embedded credentials) ---
         p(EntityType.SECRET, String.raw `(?:mongodb|mysql|postgres(?:ql)?|redis|amqp|rabbitmq):\/\/[^\s:]{1,256}:[^\s@]{1,256}@[^\s]+`, null, "Connection string with credentials"),
         // --- Secret / API Key (assignment-based: KEY=value or KEY: value) ---
-        p(EntityType.SECRET, String.raw `(?<=[:=] )\S{8,}|(?<=[:=])\S{8,}`, "high_entropy", "Assigned secret value", SECRET_CONTEXT, true),
+        // The final character may not be sentence punctuation. `\S` does not stop
+        // at a full stop, so "Reisepass: CA1234567." was claimed as the
+        // ten-character span "CA1234567." -- a passport number plus the sentence's
+        // period, masked as a credential because a "credentials" word sat within
+        // the context window (rules-engine#35).
+        p(EntityType.SECRET, String.raw `(?<=[:=] )\S{7,}[^\s.,;:!?)'"]|(?<=[:=])\S{7,}[^\s.,;:!?)'"]`, "high_entropy", "Assigned secret value", SECRET_CONTEXT, true),
         // --- Secret / API Key (entropy-based fallback for longer tokens) ---
         // Only the *trailing* \b is replaced. It could not match when the token run
         // ended on "-", "+" or "/", so the engine backtracked across two
@@ -192,7 +275,7 @@ const SHARED = {
         p(EntityType.SECRET, String.raw `\b[A-Za-z0-9_\-+/]{24,}[A-Za-z0-9_\-+/=]*(?![A-Za-z0-9_\-+/=])`, "high_entropy", "High-entropy token", SECRET_CONTEXT, true),
         p(EntityType.DOB, String.raw `\b(?:0[1-9]|[12][0-9]|3[01])[/.\-](?:0[1-9]|1[0-2])[/.\-](?:19|20)\d{2}\b`, null, "DD/MM/YYYY", DOB_CONTEXT, true),
         p(EntityType.DATE_OF_DEATH, String.raw `\b(?:0[1-9]|[12][0-9]|3[01])[/.\-](?:0[1-9]|1[0-2])[/.\-](?:19|20)\d{2}\b`, null, "", DATE_OF_DEATH_CONTEXT, true),
-        p(EntityType.DOB, String.raw `\b(?:19|20)\d{2}[/.\-](?:0[1-9]|1[0-2])[/.\-](?:0[1-9]|[12][0-9]|3[01])\b`, null, "ISO YYYY-MM-DD", DOB_ISO_CONTEXT, true),
+        p(EntityType.DOB, String.raw `\b(?:19|20)\d{2}[/.\-](?:0[1-9]|1[0-2])[/.\-](?:0[1-9]|[12][0-9]|3[01])\b`, null, "ISO YYYY-MM-DD", DOB_CONTEXT, true),
     ],
 };
 const NL = {
@@ -202,7 +285,7 @@ const NL = {
         p(EntityType.NATIONAL_ID, String.raw `\b[0-9]{9}\b`, "bsn"),
         p(EntityType.NATIONAL_ID, String.raw `\b[0-9]{2,4}\.[0-9]{2,4}\.[0-9]{2,4}\b`, "bsn"),
         p(EntityType.IBAN, String.raw `\bNL\d{2}\s?[A-Z]{4}\s?\d{4}\s?\d{4}\s?\d{2}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bNL\d{9}B\d{2}\b`, "vat_nl"),
+        p(EntityType.VAT, String.raw `\bNL[\s.]?\d{9}B\d{2}\b`, "vat_nl"),
         p(EntityType.CHAMBER_OF_COMMERCE, String.raw `\b\d{8}\b`, "kvk", "", ["KvK", "Kamer van Koophandel", "kvk-nummer", "KVK-nummer", "handelsregister", "chamber of commerce"], true),
         p(EntityType.PHONE, String.raw `\b0[1-9]\d[\s\-]?\d{3}[\s\-]?\d{4}\b`),
         p(EntityType.PHONE, String.raw `\b0[1-9]\d{2}[\s\-]?\d{6,7}\b`),
@@ -211,7 +294,7 @@ const NL = {
         p(EntityType.PHONE, String.raw `\b06[\s\-]?\d{2}[\s\-]?\d{2}[\s\-]?\d{2}[\s\-]?\d{2}\b`),
         p(EntityType.PHONE, String.raw `\b0[1-9]\d{1,2}[\s\-]?\d{2,3}[\s\-]?\d{2}[\s\-]?\d{2}\b`),
         p(EntityType.PHONE, String.raw `\+31\s?[1-9]\d{0,2}[\s\-]?\d{3,4}[\s\-]?\d{3,4}\b`),
-        p(EntityType.PASSPORT, String.raw `\b[A-Z][A-Z0-9]{8}\b`, null, "", ["paspoort", "passport", "reisdocument", "travel document", "paspoortnummer", "identiteitsbewijs"], true),
+        p(EntityType.PASSPORT, String.raw `\b[A-Z][A-Z0-9]{8}\b`, null, "", PASSPORT_CONTEXT, true),
         p(EntityType.LICENSE_PLATE, String.raw `\b(?:[A-Z]{2}[\-\s]?\d{3}[\-\s]?[A-Z]|\d[\-\s]?[A-Z]{3}[\-\s]?\d{2}|\d{2}[\-\s]?[A-Z]{3}[\-\s]?\d|[A-Z]{2}[\-\s]?\d{2}[\-\s]?[A-Z]{2}|\d{2}[\-\s]?[A-Z]{2}[\-\s]?\d{2}|\d[\-\s]?[A-Z]{2}[\-\s]?\d{3})\b`),
         p(EntityType.POSTAL_CODE, String.raw `\b[1-9]\d{3}\s?[A-Z]{2}\b`),
     ],
@@ -226,10 +309,10 @@ const BE = {
         p(EntityType.CHAMBER_OF_COMMERCE, String.raw `\b0\d{3}\.?\d{3}\.?\d{3}\b`, null, "", ["KBO", "BCE", "ondernemingsnummer", "numéro d'entreprise", "enterprise number", "bedrijfsnummer", "Kruispuntbank", "Banque-Carrefour", "Banque Carrefour", "Ondernemingen", "Entreprises", "onder nummer"], true),
         p(EntityType.PHONE, String.raw `\b0[1-9]\d{0,2}[/\s.\-]?\d{2,3}[.\s\-]?\d{2,3}[.\s\-]?\d{2,3}\b`),
         p(EntityType.PHONE, String.raw `\+32\s?\d{1,3}[\s.\-]?\d{2,3}[\s.\-]?\d{2}[\s.\-]?\d{2}`),
-        p(EntityType.PASSPORT, String.raw `\b[A-Z]{2}\d{6}\b`, null, "", ["paspoort", "passport", "passeport", "reisdocument", "travel document", "document de voyage"], true),
+        p(EntityType.PASSPORT, String.raw `\b[A-Z]{2}\d{6}\b`, null, "", PASSPORT_CONTEXT, true),
         p(EntityType.DRIVERS_LICENSE, String.raw `\b\d{10}\b`, null, "", ["rijbewijs", "permis de conduire", "driving licence", "driving license", "rijbewijsnummer"], true),
         p(EntityType.LICENSE_PLATE, String.raw `\b[12][\-\s]?[A-Z]{3}[\-\s]?\d{3}\b`),
-        p(EntityType.POSTAL_CODE, String.raw `\b[1-9]\d{3}\b`, null, "", ["postcode", "code postal", "postnummer", "postal code", "zip", "B-", "adres", "adresse", "wonende", "woonplaats", "rue", "straat", "laan", "avenue", "boulevard", "plein", "steenweg", "chaussée", "domicilié", "gedomicilieerd", "Levering:", "siège"], true),
+        p(EntityType.POSTAL_CODE, String.raw `\b[1-9]\d{3}\b`, null, "", ["postcode", "code postal", "postnummer", "postal code", "zip", "B-", "adres", "adresse", "wonende", "woonplaats", "domicile", "rue", "straat", "laan", "avenue", "boulevard", "plein", "steenweg", "chaussée", "domicilié", "gedomicilieerd", "Levering:", "siège"], true),
         p(EntityType.POSTAL_CODE, String.raw `(?<=, )[1-9]\d{3}(?= [A-Z])`),
         p(EntityType.HEALTHCARE_PROVIDER, String.raw `\b\d{1}[\-.]?\d{5}[\-.]?\d{2}[\-.]?\d{3}\b`, null, "", ["RIZIV", "INAMI", "arts", "médecin", "zorgverlener", "prestataire", "dokter", "doctor"], true),
     ],
@@ -245,7 +328,7 @@ const DE = {
         p(EntityType.VAT, String.raw `\bDE\s?\d{9}\b`, "vat_de"),
         p(EntityType.PHONE, String.raw `\b0[1-9]\d{1,4}[\s/\-]?\d{3,8}\b`),
         p(EntityType.PHONE, String.raw `\+49\s?\d{2,5}[\s/\-]?\d{3,8}\b`),
-        p(EntityType.PASSPORT, String.raw `\b[CFGHJK][0-9CFGHJKLMNPRTVWXYZ]{8}\d?\b`, null, "", ["Reisepass", "passport", "Passnummer", "Reisepassnummer", "Reisepass Nummer", "Reisepass-Nr", "Pass Nr"], true),
+        p(EntityType.PASSPORT, String.raw `\b[CFGHJK][0-9CFGHJKLMNPRTVWXYZ]{8}\d?\b`, null, "", PASSPORT_CONTEXT, true),
         // The separator after the city code is mandatory. When it was optional, a
         // contiguous letter run split across both groups and the hyphen was
         // consumed as the *second* separator, so any "LETTERS-DIGITS" token
@@ -254,7 +337,7 @@ const DE = {
         // separates the city code: "B-AB 1234", "M-XY 99".
         p(EntityType.LICENSE_PLATE, String.raw `\b[A-ZÄÖÜ]{1,3}[\s\-][A-Z]{1,2}[\s\-]?\d{1,4}[EH]?\b`),
         p(EntityType.POSTAL_CODE, String.raw `\b\d{5}\b`, null, "", ["PLZ", "Postleitzahl", "postal code", "postcode", "Anschrift", "Adresse", "Wohnort", "Ort", "Stadt", "wohnt", "wohnhaft", "Straße", "Str.", "Weg", "Platz", "Allee", "Ring"], true),
-        p(EntityType.CHAMBER_OF_COMMERCE, String.raw `\bHR[AB]\s?\d{4,6}\b`),
+        p(EntityType.CHAMBER_OF_COMMERCE, String.raw `\bHR[AB]\s?\d{4,6}(?:\s[A-Z]\b)?`),
         p(EntityType.SSN, String.raw `\b\d{2}[\s]?\d{6}[\s]?[A-Z][\s]?\d{3}\b`, null, "", ["Rentenversicherung", "RV-Nummer", "Sozialversicherung", "SV-Nummer", "Versicherungsnummer", "Rentenversicherungsnummer", "Sozialversicherungsnummer", "SVNR", "SV-Nr", "RVNR"], true),
         p(EntityType.TAX_ID, String.raw `\b\d{2,3}/\d{3,4}/\d{4,5}\b`, null, "", ["Steuernummer", "St.-Nr", "StNr", "Finanzamt", "Steuer"], true),
         p(EntityType.TAX_ID, String.raw `\b\d{13}\b`, null, "", ["Steuernummer", "St.-Nr", "StNr", "Finanzamt", "Steuer"], true),
@@ -267,7 +350,7 @@ const AT = {
     patterns: [
         p(EntityType.NATIONAL_ID, String.raw `\b\d{4}\s?\d{6}\b`, "austrian_svnr"),
         p(EntityType.IBAN, String.raw `\bAT\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bATU\d{8}\b`),
+        p(EntityType.VAT, String.raw `\bATU[\s.]?\d{8}\b`),
         p(EntityType.PHONE, String.raw `\b0\d{3,4}[\s\-]?\d{5,8}\b`),
         // Short area codes (Vienna is "01") split across three groups:
         // "01 53460 2215". The pattern above requires 3-4 digits after the trunk
@@ -306,9 +389,9 @@ const FR = {
         p(EntityType.VAT, String.raw `\bFR\s?[0-9A-HJ-NP-Z]{2}\s?\d{9}\b`, "vat_fr"),
         p(EntityType.PHONE, String.raw `\b0[1-9][\s.\-]?\d{2}[\s.\-]?\d{2}[\s.\-]?\d{2}[\s.\-]?\d{2}\b`),
         p(EntityType.PHONE, String.raw `\+33\s?[1-9][\s.\-]?\d{2}[\s.\-]?\d{2}[\s.\-]?\d{2}[\s.\-]?\d{2}`),
-        p(EntityType.PASSPORT, String.raw `\b\d{2}[A-Z]{2}\d{5}\b`, null, "", ["passeport", "passport", "numéro de passeport"], true),
+        p(EntityType.PASSPORT, String.raw `\b\d{2}[A-Z]{2}\d{5}\b`, null, "", PASSPORT_CONTEXT, true),
         p(EntityType.LICENSE_PLATE, String.raw `\b[A-Z]{2}[\-\s]?\d{3}[\-\s]?[A-Z]{2}\b`),
-        p(EntityType.POSTAL_CODE, String.raw `\b(?:0[1-9]|[1-8]\d|9[0-5]|97[1-6])\d{3}\b`, null, "", ["code postal", "CP", "postal code", "postcode", "adresse", "domicilié", "résidant", "rue", "avenue", "boulevard", "place", "chemin", "allée", "impasse", "ville"], true),
+        p(EntityType.POSTAL_CODE, String.raw `\b(?:0[1-9]|[1-8]\d|9[0-5]|97[1-6])\d{3}\b`, null, "", ["code postal", "CP", "postal code", "postcode", "adresse", "domicile", "domicilié", "résidant", "rue", "avenue", "boulevard", "place", "chemin", "allée", "impasse", "ville"], true),
         p(EntityType.CHAMBER_OF_COMMERCE, String.raw `\b\d{3}\s?\d{3}\s?\d{3}\b`, null, "", ["SIREN", "siren", "RCS", "entreprise", "immatricul", "numéro d'entreprise", "registre du commerce"], true),
         p(EntityType.CHAMBER_OF_COMMERCE, String.raw `\b\d{3}\s?\d{3}\s?\d{3}\s?\d{5}\b`, null, "", ["SIRET", "siret", "établissement", "immatricul"], true),
         p(EntityType.TAX_ID, String.raw `\b\d{13}\b`, null, "", ["numéro fiscal", "SPI", "référence fiscale", "avis d'impôt", "impôt sur le revenu", "déclaration fiscale", "fiscal"], true),
@@ -341,9 +424,9 @@ const SE = {
         p(EntityType.PHONE, String.raw `\b0\d{1,3}[\-\s]?\d{2,3}[\s]?\d{2,3}[\s]?\d{2}\b`),
         p(EntityType.PHONE, String.raw `\+46\s?\d{1,3}[\s\-]?\d{2,3}[\s\-]?\d{2,3}[\s\-]?\d{2}`),
         p(EntityType.LICENSE_PLATE, String.raw `\b[A-Z]{3}\s?\d{2}[A-Z0-9]\b`),
-        p(EntityType.POSTAL_CODE, String.raw `\b\d{3}\s?\d{2}\b`, null, "", ["postnummer", "postort", "postkod", "adress", "bostadsadress", "gatuadress", "boende", "gatan", "vägen", "gata", "väg", "allé", "plats", "torg", "stigen", "Bostadsadress"], true),
-        p(EntityType.POSTAL_CODE, String.raw `\b\d{4}\s\d{2}\b`, null, "", ["postnummer", "postort", "postkod", "adress", "bostadsadress", "gatuadress", "boende", "gatan", "vägen", "gata", "väg", "allé"], true),
-        p(EntityType.POSTAL_CODE, String.raw `\b\d{6}\b`, null, "", ["postnummer", "postort", "postkod", "adress", "bostadsadress", "gatuadress", "boende", "gatan", "vägen", "gata", "väg", "allé"], true),
+        p(EntityType.POSTAL_CODE, String.raw `\b\d{3}\s?\d{2}\b`, null, "", ["postnummer", "postort", "postkod", "adress", "Postal:", "Address:", "bostadsadress", "gatuadress", "boende", "gatan", "vägen", "gata", "väg", "allé", "plats", "torg", "stigen", "Bostadsadress"], true),
+        p(EntityType.POSTAL_CODE, String.raw `\b\d{4}\s\d{2}\b`, null, "", ["postnummer", "postort", "postkod", "adress", "Postal:", "Address:", "bostadsadress", "gatuadress", "boende", "gatan", "vägen", "gata", "väg", "allé"], true),
+        p(EntityType.POSTAL_CODE, String.raw `\b\d{6}\b`, null, "", ["postnummer", "postort", "postkod", "adress", "Postal:", "Address:", "bostadsadress", "gatuadress", "boende", "gatan", "vägen", "gata", "väg", "allé"], true),
         p(EntityType.CHAMBER_OF_COMMERCE, String.raw `\b\d{6}-?\d{4}\b`, null, "", ["organisationsnummer", "org.nr", "org nr", "Bolagsverket", "registreringsnummer"], true),
     ],
 };
@@ -359,7 +442,7 @@ const NO = {
         p(EntityType.PHONE, String.raw `\b[2-9]\d\s?\d{2}\s?\d{2}\s?\d{2}\b`),
         p(EntityType.PHONE, String.raw `\+47\s?\d{2}\s?\d{2}\s?\d{2}\s?\d{2}`),
         p(EntityType.LICENSE_PLATE, String.raw `\b[A-Z]{2}\s?\d{5}\b`),
-        p(EntityType.POSTAL_CODE, String.raw `\b\d{4}\b`, null, "", ["postnummer", "poststed", "postnr", "adresse", "bostedsadresse", "gate", "vei", "veien", "gata", "plass", "stien", "allé"], true),
+        p(EntityType.POSTAL_CODE, String.raw `\b\d{4}\b`, null, "", ["postnummer", "poststed", "postnr", "adresse", "bostedsadresse", "gate", "vei", "veien", "gata", "plass", "stien", "allé", "Postal:", "Address:"], true),
     ],
 };
 const FI = {
@@ -368,7 +451,7 @@ const FI = {
     patterns: [
         p(EntityType.NATIONAL_ID, String.raw `\b\d{6}[-+ABCDEFYXWVU]\d{3}[0-9A-FHJK-NPR-Y]\b`, "finnish_hetu"),
         p(EntityType.IBAN, String.raw `\bFI\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{2}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bFI\d{8}\b`),
+        p(EntityType.VAT, String.raw `\bFI[\s.]?\d{8}\b`),
         p(EntityType.CHAMBER_OF_COMMERCE, String.raw `\b\d{7}-\d\b`, "finnish_business_id"),
         p(EntityType.PHONE, String.raw `\b0\d{1,2}\s?\d{3,4}\s?\d{3,4}\b`),
         p(EntityType.PHONE, String.raw `\+358\s?\d{1,3}[\s\-]?\d{3,4}[\s\-]?\d{3,4}`),
@@ -386,7 +469,7 @@ const IS = {
         p(EntityType.PHONE, String.raw `\b[3-9]\d{6}\b`, null, "", ["sími", "símanúmer", "farsími", "gsm", "phone", "tel", "hringja", "hringdu", "ná í", "nás á", "nás", "SMS", "sent to"], true),
         p(EntityType.PHONE, String.raw `\+354\s?\d{3}\s?\d{4}`),
         p(EntityType.LICENSE_PLATE, String.raw `\b[A-Z]{2}\s?\d{3}\b`, null, "", ["skráningarnúmer", "bílnúmer", "ökutæki", "bifreið", "plata"], true),
-        p(EntityType.POSTAL_CODE, String.raw `\b[1-9]\d{2}\b`, null, "", ["póstnúmer", "póstfang", "staður", "heimilisfang"], true),
+        p(EntityType.POSTAL_CODE, String.raw `\b[1-9]\d{2}\b`, null, "", ["póstnúmer", "póstfang", "staður", "heimilisfang", "Postal:", "Address:"], true),
     ],
 };
 const IT = {
@@ -396,7 +479,7 @@ const IT = {
         p(EntityType.NATIONAL_ID, String.raw `\b[A-Z]{6}\d{2}[ABCDEHLMPRST]\d{2}[A-Z]\d{3}[A-Z]\b`, "italian_cf"),
         p(EntityType.IBAN, String.raw `\bIT\d{2}\s?[A-Z]\d{3}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{3}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bIT\d{2}[A-Z]\d{22}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bIT\d{11}\b`),
+        p(EntityType.VAT, String.raw `\bIT[\s.]?\d{11}\b`),
         p(EntityType.PHONE, String.raw `\b3\d{2}[\s\-]?\d{3}[\s\-]?\d{4}\b`),
         p(EntityType.PHONE, String.raw `\b0\d{1,3}[\s\-]?\d{6,8}\b`),
         p(EntityType.PHONE, String.raw `\b0\d{1,2}[\s\-]\d{3}[\s\-]\d{4}\b`),
@@ -412,7 +495,7 @@ const ES = {
         p(EntityType.NATIONAL_ID, String.raw `\b\d{8}[A-Z]\b`, "spanish_dni"),
         p(EntityType.NATIONAL_ID, String.raw `\b[XYZ]\d{7}[A-Z]\b`, "spanish_nie"),
         p(EntityType.IBAN, String.raw `\bES\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bES[A-Z0-9]\d{7}[A-Z0-9]\b`),
+        p(EntityType.VAT, String.raw `\bES[\s.]?[A-Z0-9]\d{7}[A-Z0-9]\b`),
         p(EntityType.PHONE, String.raw `\b[679]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(EntityType.PHONE, String.raw `\b[679]\d{8}\b`),
         p(EntityType.PHONE, String.raw `\b[679]\d[\s\-]?\d{3}[\s\-]?\d{2}[\s\-]?\d{2}\b`),
@@ -435,7 +518,7 @@ const PT = {
         p(EntityType.NATIONAL_ID, String.raw `\b[1-35-9]\d{8}\b`, "portuguese_nif"),
         p(EntityType.NATIONAL_ID, String.raw `\b[1-35-9]\d{2}[\s.]\d{3}[\s.]\d{3}\b`, "portuguese_nif"),
         p(EntityType.IBAN, String.raw `\bPT\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{5}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bPT\d{9}\b`),
+        p(EntityType.VAT, String.raw `\bPT[\s.]?\d{9}\b`),
         p(EntityType.PHONE, String.raw `\b[29]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(EntityType.PHONE, String.raw `\b[29]\d{8}\b`),
         p(EntityType.PHONE, String.raw `\+351\s?[29]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}`),
@@ -468,7 +551,7 @@ const PL = {
         p(EntityType.TAX_ID, String.raw `\b\d{3}-?\d{3}-?\d{2}-?\d{2}\b`, "polish_nip"),
         p(EntityType.IBAN, String.raw `\bPL\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bPL\d{26}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bPL\d{10}\b`),
+        p(EntityType.VAT, String.raw `\bPL[\s.]?\d{10}\b`),
         p(EntityType.PHONE, String.raw `\b[5-8]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(EntityType.PHONE, String.raw `\b[5-8]\d{8}\b`),
         p(EntityType.PHONE, String.raw `\+48\s?[5-8]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}`),
@@ -482,7 +565,7 @@ const IE = {
         p(EntityType.NATIONAL_ID, String.raw `\b\d{7}[A-W][ABWTXZ]?\b`, "irish_pps"),
         p(EntityType.IBAN, String.raw `\bIE\d{2}\s?[A-Z]{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{2}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bIE\d{2}[A-Z]{4}\d{14}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bIE\d{7}[A-Z]\b`),
+        p(EntityType.VAT, String.raw `\bIE[\s.]?\d{7}[A-Z]\b`),
         p(EntityType.PHONE, String.raw `\b0[89]\d[\s\-]?\d{3}[\s\-]?\d{4}\b`),
         p(EntityType.PHONE, String.raw `\b0[89]\d{8}\b`),
         p(EntityType.PHONE, String.raw `\b0[1-9]\d{0,2}[\s\-]?\d{5,8}\b`),
@@ -498,7 +581,7 @@ const UK = {
         p(EntityType.HEALTH_INSURANCE, String.raw `\b\d{3}\s?\d{3}\s?\d{4}\b`, "uk_nhs", "", ["NHS", "NHS number", "health number", "NHS no"], true),
         p(EntityType.IBAN, String.raw `\bGB\d{2}\s?[A-Z]{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{2}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bGB\d{2}[A-Z]{4}\d{14}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bGB\d{9}\b`),
+        p(EntityType.VAT, String.raw `\bGB[\s.]?\d{3}[\s.]?\d{4}[\s.]?\d{2}\b`),
         p(EntityType.PHONE, String.raw `\b07[4-9]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(EntityType.PHONE, String.raw `\b07[4-9]\d{8}\b`),
         p(EntityType.PHONE, String.raw `\b0[12]\d{2}[\s\-]?\d{3}[\s\-]?\d{4}\b`),
@@ -514,7 +597,7 @@ const BG = {
     patterns: [
         p(EntityType.NATIONAL_ID, String.raw `\b\d{10}\b`, "bulgarian_egn"),
         p(EntityType.IBAN, String.raw `\bBG\d{2}\s?[A-Z]{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{2}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bBG\d{9,10}\b`),
+        p(EntityType.VAT, String.raw `\bBG[\s.]?\d{9,10}\b`),
         p(EntityType.PHONE, String.raw `\b0?[89][789][\s\-]?\d{3}[\s\-]?\d{3,4}\b`),
         p(EntityType.PHONE, String.raw `\b0?[89][789]\d{7,8}\b`),
         p(EntityType.PHONE, String.raw `\+359\s?[89][789][\s\-]?\d{3}[\s\-]?\d{3,4}`),
@@ -529,7 +612,7 @@ const CY = {
         p(EntityType.NATIONAL_ID, String.raw `\b\d{8}[A-Z]\b`),
         p(EntityType.IBAN, String.raw `\bCY\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bCY\d{26}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bCY\d{8}[A-Z]\b`),
+        p(EntityType.VAT, String.raw `\bCY[\s.]?\d{8}[A-Z]\b`),
         p(EntityType.PHONE, String.raw `\b[29]\d{3}[\s\-]?\d{4}\b`),
         p(EntityType.PHONE, String.raw `\b[29]\d[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(EntityType.PHONE, String.raw `\b[29]\d{7}\b`),
@@ -545,7 +628,7 @@ const CZ = {
         p(EntityType.NATIONAL_ID, String.raw `\b\d{6}/?\d{3,4}\b`, "czech_birth_number"),
         p(EntityType.IBAN, String.raw `\bCZ\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bCZ\d{22}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bCZ\d{8,10}\b`),
+        p(EntityType.VAT, String.raw `\bCZ[\s.]?\d{8,10}\b`),
         p(EntityType.PHONE, String.raw `\b[67]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(EntityType.PHONE, String.raw `\b[67]\d{8}\b`),
         p(EntityType.PHONE, String.raw `\+420\s?[67]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}`),
@@ -559,7 +642,7 @@ const SK = {
         p(EntityType.NATIONAL_ID, String.raw `\b\d{6}/?\d{3,4}\b`, "czech_birth_number"),
         p(EntityType.IBAN, String.raw `\bSK\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bSK\d{22}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bSK\d{10}\b`),
+        p(EntityType.VAT, String.raw `\bSK[\s.]?\d{10}\b`),
         p(EntityType.PHONE, String.raw `\b0?9\d{2}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(EntityType.PHONE, String.raw `\+421\s?9\d{2}[\s\-]?\d{3}[\s\-]?\d{3}`),
         p(EntityType.POSTAL_CODE, String.raw `\b\d{3}\s?\d{2}\b`, null, "", ["PSČ", "poštové", "adresa", "ulica", "Postal:", "Address:"], true),
@@ -572,7 +655,7 @@ const EE = {
         p(EntityType.NATIONAL_ID, String.raw `\b[1-6]\d{10}\b`, "estonian_id"),
         p(EntityType.IBAN, String.raw `\bEE\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bEE\d{18}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bEE\d{9}\b`),
+        p(EntityType.VAT, String.raw `\bEE[\s.]?\d{9}\b`),
         p(EntityType.PHONE, String.raw `\b5\d{3}[\s\-]?\d{4}\b`),
         p(EntityType.PHONE, String.raw `\b5\d{7}\b`),
         p(EntityType.PHONE, String.raw `\+372\s?5\d{3}[\s\-]?\d{3,4}`),
@@ -586,7 +669,7 @@ const LT = {
         p(EntityType.NATIONAL_ID, String.raw `\b[1-6]\d{10}\b`, "estonian_id"),
         p(EntityType.IBAN, String.raw `\bLT\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bLT\d{18}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bLT\d{9,12}\b`),
+        p(EntityType.VAT, String.raw `\bLT[\s.]?\d{9,12}\b`),
         p(EntityType.PHONE, String.raw `\b6\d{2}[\s\-]?\d{2}[\s\-]?\d{3}\b`),
         p(EntityType.PHONE, String.raw `\b6\d{7}\b`),
         p(EntityType.PHONE, String.raw `\b8[\s\-]?6\d{2}[\s\-]?\d{2}[\s\-]?\d{3}\b`),
@@ -602,7 +685,7 @@ const LV = {
         p(EntityType.NATIONAL_ID, String.raw `\b(?:0[1-9]|[12]\d|3[01])(?:0[1-9]|1[0-2])\d{7}\b`, null, "", ["personas kods", "PK", "identifikācijas"], true),
         p(EntityType.IBAN, String.raw `\bLV\d{2}\s?[A-Z]{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bLV\d{2}[A-Z]{4}\d{13}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bLV\d{11}\b`),
+        p(EntityType.VAT, String.raw `\bLV[\s.]?\d{11}\b`),
         p(EntityType.PHONE, String.raw `\b[2]\d{3}[\s\-]?\d{4}\b`),
         p(EntityType.PHONE, String.raw `\b[2]\d{7}\b`),
         p(EntityType.PHONE, String.raw `\+371\s?[2]\d{3}[\s\-]?\d{3,4}`),
@@ -617,7 +700,7 @@ const HR = {
         p(EntityType.IBAN, String.raw `\bHR\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{3}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bHR\d{2}\s\d{4}\s\d{4}\s\d{4}\s\d{5}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bHR\d{19}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bHR\d{11}\b`),
+        p(EntityType.VAT, String.raw `\bHR[\s.]?\d{11}\b`),
         p(EntityType.PHONE, String.raw `\b0?9[12579][\s\-]?\d{3}[\s\-]?\d{3,4}\b`),
         p(EntityType.PHONE, String.raw `\b0?9[12579]\d{7,8}\b`),
         p(EntityType.PHONE, String.raw `\+385\s?9[12579][\s\-]?\d{3}[\s\-]?\d{3,4}`),
@@ -631,7 +714,7 @@ const HU = {
         p(EntityType.NATIONAL_ID, String.raw `\b\d{9}\b`, "hungarian_taj"),
         p(EntityType.NATIONAL_ID, String.raw `\b\d{3}\s\d{3}\s\d{3}\b`, "hungarian_taj"),
         p(EntityType.TAX_ID, String.raw `\b8\d{9}\b`, null, "", ["adóazonosító", "adószám", "adóazonosító jel"], true),
-        p(EntityType.VAT, String.raw `\bHU\d{8,11}\b`, null, "", ["adószám", "ÁFA"]),
+        p(EntityType.VAT, String.raw `\bHU[\s.]?\d{8,11}\b`, null, "", ["adószám", "ÁFA"]),
         p(EntityType.IBAN, String.raw `\bHU\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bHU\d{26}\b`, "iban"),
         p(EntityType.PHONE, String.raw `\b06\s?\d{1,2}[\s\-]?\d{3}[\s\-]?\d{3,4}\b`),
@@ -646,7 +729,7 @@ const RO = {
     patterns: [
         p(EntityType.NATIONAL_ID, String.raw `\b[1-8]\d{12}\b`, "romanian_cnp"),
         p(EntityType.IBAN, String.raw `\bRO\d{2}[A-Z]{4}\d{16}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bRO\d{2,10}\b`),
+        p(EntityType.VAT, String.raw `\bRO[\s.]?\d{2,10}\b`),
         p(EntityType.PHONE, String.raw `\b0?7[2-9]\d{1}[\s\-]?\d{3}[\s\-]?\d{3,4}\b`),
         p(EntityType.PHONE, String.raw `\b0?7[2-9]\d{7,8}\b`),
         p(EntityType.PHONE, String.raw `\+40\s?7[2-9]\d{1}[\s\-]?\d{3}[\s\-]?\d{3,4}`),
@@ -661,7 +744,7 @@ const EL = {
         p(EntityType.NATIONAL_ID, String.raw `\b\d{11}\b`, "greek_amka"),
         p(EntityType.IBAN, String.raw `\bGR\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{3}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bGR\d{25}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bEL\d{9}\b`),
+        p(EntityType.VAT, String.raw `\bEL[\s.]?\d{9}\b`),
         p(EntityType.PHONE, String.raw `\b69\d[\s\-]?\d{3,4}[\s\-]?\d{4}\b`),
         p(EntityType.PHONE, String.raw `\b69\d{8}\b`),
         p(EntityType.PHONE, String.raw `\b2\d{1,3}[\s\-]?\d{3,4}[\s\-]?\d{3,4}\b`),
@@ -676,7 +759,7 @@ const SI = {
         p(EntityType.NATIONAL_ID, String.raw `\b\d{13}\b`, "slovenian_emso"),
         p(EntityType.IBAN, String.raw `\bSI\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{3}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bSI\d{17}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bSI\d{8}\b`),
+        p(EntityType.VAT, String.raw `\bSI[\s.]?\d{8}\b`),
         p(EntityType.PHONE, String.raw `\b0?[34567]\d{1}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(EntityType.PHONE, String.raw `\b0?[34567]\d{7}\b`),
         p(EntityType.PHONE, String.raw `\+386\s?[34567]\d{1}[\s\-]?\d{3}[\s\-]?\d{3}`),
@@ -691,7 +774,7 @@ const MT = {
         p(EntityType.NATIONAL_ID, String.raw `\b\d{5,7}[MGAPLHBZ]\b`),
         p(EntityType.IBAN, String.raw `\bMT\d{2}\s?[A-Z]{4}\s?\d{4}\s?\d{4}\s?[A-Z0-9]{4}\s?[A-Z0-9]{4}\s?[A-Z0-9]{4}\s?[A-Z0-9]{3}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bMT\d{2}[A-Z]{4}\d{5}[A-Z0-9]{18}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bMT\d{8}\b`),
+        p(EntityType.VAT, String.raw `\bMT[\s.]?\d{8}\b`),
         p(EntityType.PHONE, String.raw `\b[79]\d{3}[\s\-]?\d{4}\b`),
         p(EntityType.PHONE, String.raw `\b[79]\d{7}\b`),
         p(EntityType.PHONE, String.raw `\+356\s?[79]\d{3}[\s\-]?\d{3,4}`),

package/dist/esm/rules/cues.d.ts

@@ -64,8 +64,20 @@ import { EntityType } from "../types.js";
  * How far back a cue may sit. Short on purpose: a cue is only evidence about
  * the value it introduces, which is the lesson of the postal-code year defect,
  * where a cue 150 characters away licensed every number in the window.
+ *
+ * This bounds how long a *label* may be, not how far it may sit from the
+ * value: every pattern is anchored with `$`, so the label still has to reach
+ * the span through a run-on or one qualifier word.
+ *
+ * 32 was too short for German tax labels, the longest the engine carries.
+ * "Steuerliche Identifikationsnummer " is 34 characters and
+ * "Steueridentifikationsnummer lautet: " is 36, so the label's own start sat
+ * outside the window and `(?<![A-Za-z0-9_])` had nothing to anchor against,
+ * leaving a critical-tier identifier in the clear (rules-engine#26). 44
+ * admits the longest with a qualifier: "Steuerliche Identifikationsnummer
+ * lautet: " is 42.
  */
-export declare const CUE_WINDOW = 32;
+export declare const CUE_WINDOW = 44;
 /**
  * (entity type, label pattern). Ordered: the first match wins, so the narrower
  * label comes first where two could read the same text.

package/dist/esm/rules/cues.js

@@ -64,8 +64,20 @@ import { EntityType } from "../types.js";
  * How far back a cue may sit. Short on purpose: a cue is only evidence about
  * the value it introduces, which is the lesson of the postal-code year defect,
  * where a cue 150 characters away licensed every number in the window.
+ *
+ * This bounds how long a *label* may be, not how far it may sit from the
+ * value: every pattern is anchored with `$`, so the label still has to reach
+ * the span through a run-on or one qualifier word.
+ *
+ * 32 was too short for German tax labels, the longest the engine carries.
+ * "Steuerliche Identifikationsnummer " is 34 characters and
+ * "Steueridentifikationsnummer lautet: " is 36, so the label's own start sat
+ * outside the window and `(?<![A-Za-z0-9_])` had nothing to anchor against,
+ * leaving a critical-tier identifier in the clear (rules-engine#26). 44
+ * admits the longest with a qualifier: "Steuerliche Identifikationsnummer
+ * lautet: " is 42.
  */
-export const CUE_WINDOW = 32;
+export const CUE_WINDOW = 44;
 /**
  * (entity type, label pattern). Ordered: the first match wins, so the narrower
  * label comes first where two could read the same text.
@@ -88,8 +100,15 @@ export const CUES = [
         /(?<![A-Za-z0-9_])(?:ssn|social\s*security|sozialversicherungsnummer|svnr|sofi)(?:(?:[A-Za-z0-9_]|[^\x00-\x7F])*|\s+[^\s:.\-\d,;()\/]{2,20})\s*\)?\s*[:.\-]*\s*$/i],
     // Tax number. Greece's ΑΦΜ is issued by the tax authority; the identity-card
     // number is the ΑΔΤ, above.
+    //
+    // The German long forms are spelled out rather than left to the run-on after
+    // `steuer-?id`. A cue may use its run-on *or* one qualifier word, never both,
+    // and "Steuer-IdNr lautet:" needs both: the run-on for "Nr" and the qualifier
+    // for "lautet". Naming the whole label leaves the qualifier free.
+    // "Steuerliche Identifikationsnummer" matched nothing at all — it is two
+    // words, and `steuer-?id` cannot reach across "liche " (rules-engine#26).
     [EntityType.TAX_ID,
-        /(?<![A-Za-z0-9_])(?:αφμ|α\.φ\.μ\.|steuer-?id|steuernummer|st\.?-?nr|stnr|tin|finanzamt\s+ist|tax\s*(?:id|no|number)|daňové\s*číslo|numer\s*podatkowy)(?:(?:[A-Za-z0-9_]|[^\x00-\x7F])*|\s+[^\s:.\-\d,;()\/]{2,20})\s*\)?\s*[:.\-]*\s*$/i],
+        /(?<![A-Za-z0-9_])(?:αφμ|α\.φ\.μ\.|steuerliche\s*identifikations-?nummer|steuer-?identifikations-?nummer|steuer-?id-?nr\.?|steuer-?id|steuernummer|st\.?-?nr|stnr|tin|finanzamt\s+ist|tax\s*(?:id|no|number)|daňové\s*číslo|numer\s*podatkowy)(?:(?:[A-Za-z0-9_]|[^\x00-\x7F])*|\s+[^\s:.\-\d,;()\/]{2,20})\s*\)?\s*[:.\-]*\s*$/i],
     // Health insurance: the insured person.
     [EntityType.HEALTH_INSURANCE,
         /(?<![A-Za-z0-9_])(?:versichertennummer|krankenversicherung|kvnr|kv-?nr|mutualité|ziekenfonds|aansluitingsnummer|medical\s*card(?:\s*(?:no|number))?)(?:(?:[A-Za-z0-9_]|[^\x00-\x7F])*|\s+[^\s:.\-\d,;()\/]{2,20})\s*\)?\s*[:.\-]*\s*$/i],