euredact 0.5.1 → 0.7.0

package/dist/esm/rules/countries/index.js

@@ -1,5 +1,14 @@
 import { EntityType } from "../../types.js";
 import { IBAN_LENGTHS } from "../validators.js";
+import { MONTH_NAMES } from "../suppressors.js";
+/** Day, month as a word, year ("4. März 1948"), behind a date label (rules-engine#115). */
+function writtenDatePattern() {
+    const names = new Set(MONTH_NAMES.split("|").filter(Boolean));
+    for (const m of [...names])
+        names.add(m.charAt(0).toUpperCase() + m.slice(1));
+    const months = [...names].sort((a, b) => b.length - a.length || (a < b ? -1 : a > b ? 1 : 0)).join("|");
+    return String.raw `\b(?:0?[1-9]|[12][0-9]|3[01])\.?\s+(?:` + months + String.raw `)\.?\s+(?:19|20)\d{2}\b`;
+}
 /**
  * Build a country-independent IBAN pattern from the ISO 13616 length table.
  *
@@ -102,23 +111,56 @@ const SECRET_CONTEXT = [
 // ---------------------------------------------------------------------------
 // DOB context keywords (reused across SHARED patterns)
 // ---------------------------------------------------------------------------
+// Every way the documents this engine sees introduce a date of birth.
+//
+// DOB recall was 62.8% -- 33,441 unmasked birth dates -- because this covered
+// seven languages of thirty-one. Eleven countries scored exactly 100% (the
+// listed languages) while twenty sat at 42-51%, which is what proved it was
+// coverage rather than capability (rules-engine#38).
+//
+// Matching is substring, not word-boundary, so every entry was screened against
+// the 29.2-million-character corpus for occurrences inside a longer word. Two
+// were rejected: `fædd` lives inside `fæddur`, and `born` was found inside
+// `gabornagy` and `gabornemeth` -- Hungarian names as e-mail local parts -- so
+// `"born "` with the trailing space is listed instead.
+//
+// DOB_CONTEXT is gone: it was a second, shorter copy missing `nato il`,
+// `nascido`, `geburtstag` and more, so ISO dates were gated on fewer keywords
+// than DD/MM/YYYY ones for no stated reason.
 const DOB_CONTEXT = [
+    // Germanic / Romance -- the original set, kept verbatim.
     "geboren", "geboortedatum", "date de naissance", "né le", "née le",
     "né(e) le", "nee le", "nee(e) le", "date of birth", "DOB",
     "Geburtsdatum", "geboren am", "geboren op", "nascido", "nacido",
     "data di nascita", "nato il", "nata il", "geb.", "geb.datum", "geb ",
     "birth date", "birthday", "naissance", "geboorte", "geburtstag",
-];
-const DOB_ISO_CONTEXT = [
-    "geboren", "geboortedatum", "date de naissance", "né le", "née le",
-    "né(e) le", "nee le", "date of birth", "DOB", "Geburtsdatum",
-    "geboren am", "geboren op", "geb.", "birth date", "birthday",
-    "naissance", "geboorte",
+    // English and Italian forms the list was missing.
+    "born ", "d.o.b", "nato/a il",
+    // Nordic.
+    "født", "fødselsdato", "född", "födelsedatum",
+    "syntynyt", "syntymäaika", "fæddur", "fæðingardagur",
+    // Greek -- Greece and Cyprus.
+    "γεννηθείς", "γεννήθηκε", "ημερομηνία γέννησης",
+    // West Slavic.
+    "urodzony", "urodzona", "data urodzenia",
+    "narozen", "datum narození", "narodený", "dátum narodenia",
+    // Hungarian, Romanian, Bulgarian.
+    "született", "születési", "născut", "născută", "data nașterii",
+    "роден", "родена", "дата на раждане",
+    // South Slavic.
+    "rođen", "rođena", "datum rođenja", "rojen", "rojena", "datum rojstva",
+    // Baltic.
+    "sündinud", "sünniaeg", "dzimis", "dzimusi", "dzimšanas datums",
+    "gimęs", "gimusi", "gimimo data",
+    // Maltese, Irish, Turkish (Cyprus).
+    "twieled", "twieldet", "data tat-twelid",
+    "rugadh", "dáta breithe", "doğum tarihi",
 ];
 const DATE_OF_DEATH_CONTEXT = [
     "overleden", "overlijdensdatum", "date de décès", "décédé le",
     "date of death", "Sterbedatum", "verstorben am", "gestorven",
     "death date", "died on", "mort le", "décès",
+    "datum van overlijden", "décédée le", "Sterbetag",
 ];
 // ---------------------------------------------------------------------------
 // Country configurations
@@ -173,6 +215,9 @@ const SHARED = {
         p(EntityType.BIC, String.raw `\b[A-Z]{4} [A-Z]{2} [A-Z0-9]{2}(?: [A-Z0-9]{3})?\b`, "bic", "BIC/SWIFT code (space-separated groups)"),
         p(EntityType.CREDIT_CARD, String.raw `\b(?:4[0-9]{3}[\s\-]?[0-9]{4}[\s\-]?[0-9]{4}[\s\-]?[0-9]{4}|5[1-5][0-9]{2}[\s\-]?[0-9]{4}[\s\-]?[0-9]{4}[\s\-]?[0-9]{4}|3[47][0-9]{2}[\s\-]?[0-9]{6}[\s\-]?[0-9]{5})\b`, "luhn"),
         p(EntityType.VIN, String.raw `\b[A-HJ-NPR-Z0-9]{17}\b`, "vin"),
+        // Behind its label: any case, or in its three sections 3-6-8 (rules-engine#110).
+        p(EntityType.VIN, String.raw `\b[A-HJ-NPR-Za-hj-npr-z0-9]{13}\d{4}\b`, "vin", "VIN — any case, behind its label", ["VIN", "FIN:", "FIN-Nr", "FIN-Nummer", "Fahrgestellnummer", "Fahrzeug-Identifizierungsnummer", "Fahrzeugidentifizierungsnummer", "châssis", "chassis", "chassisnummer", "chasisnummer", "numéro de série", "vehicle identification", "numero di telaio", "telaio", "bastidor", "número de bastidor", "VIN-code", "VIN-kod"], true),
+        p(EntityType.VIN, String.raw `\b[A-HJ-NPR-Za-hj-npr-z0-9]{3}[\s\-][A-HJ-NPR-Za-hj-npr-z0-9]{6}[\s\-][A-HJ-NPR-Za-hj-npr-z0-9]{4}\d{4}\b`, "vin", "VIN — in sections, behind its label", ["VIN", "FIN:", "FIN-Nr", "FIN-Nummer", "Fahrgestellnummer", "Fahrzeug-Identifizierungsnummer", "Fahrzeugidentifizierungsnummer", "châssis", "chassis", "chassisnummer", "chasisnummer", "numéro de série", "vehicle identification", "numero di telaio", "telaio", "bastidor", "número de bastidor", "VIN-code", "VIN-kod"], true),
         p(EntityType.IP_ADDRESS, String.raw `\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b`),
         // Branch order is load-bearing: alternation is leftmost-first, not
         // longest-match, so the form that consumes most is tried first, and the
@@ -187,6 +232,8 @@ const SHARED = {
         p(EntityType.MAC_ADDRESS, String.raw `\b[0-9a-fA-F]{4}\.[0-9a-fA-F]{4}\.[0-9a-fA-F]{4}\b`, null, "Cisco"),
         p(EntityType.IMEI, String.raw `\b\d{15}\b`, "imei"),
         p(EntityType.IMEI, String.raw `\b\d{2}[\-\s]\d{6}[\-\s]\d{6}[\-\s]\d\b`, "imei", "formatted"),
+        // Behind "IMEI": 14 digits, the 16-digit IMEISV, or 15 with a failed check (rules-engine#110).
+        p(EntityType.IMEI, String.raw `\b\d{14,16}\b`, null, "IMEI / IMEISV — behind its label", ["IMEI"], true),
         p(EntityType.GPS_COORDINATES, String.raw `-?(?:[1-8]?\d(?:\.\d{4,})|90(?:\.0{4,}))\s*[,;/]\s*-?(?:1[0-7]\d(?:\.\d{4,})|180(?:\.0{4,})|\d{1,2}(?:\.\d{4,}))`),
         p(EntityType.UUID, String.raw `\b[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}\b`),
         p(EntityType.SOCIAL_HANDLE, String.raw `(?<![\p{L}\p{N}_])@\p{L}[\p{L}\p{N}_.]{1,29}\b`),
@@ -220,7 +267,12 @@ const SHARED = {
         // --- Secret / API Key (connection strings with embedded credentials) ---
         p(EntityType.SECRET, String.raw `(?:mongodb|mysql|postgres(?:ql)?|redis|amqp|rabbitmq):\/\/[^\s:]{1,256}:[^\s@]{1,256}@[^\s]+`, null, "Connection string with credentials"),
         // --- Secret / API Key (assignment-based: KEY=value or KEY: value) ---
-        p(EntityType.SECRET, String.raw `(?<=[:=] )\S{8,}|(?<=[:=])\S{8,}`, "high_entropy", "Assigned secret value", SECRET_CONTEXT, true),
+        // The final character may not be sentence punctuation. `\S` does not stop
+        // at a full stop, so "Reisepass: CA1234567." was claimed as the
+        // ten-character span "CA1234567." -- a passport number plus the sentence's
+        // period, masked as a credential because a "credentials" word sat within
+        // the context window (rules-engine#35).
+        p(EntityType.SECRET, String.raw `(?<=[:=] )\S{7,}[^\s.,;:!?)'"]|(?<=[:=])\S{7,}[^\s.,;:!?)'"]`, "high_entropy", "Assigned secret value", SECRET_CONTEXT, true),
         // --- Secret / API Key (entropy-based fallback for longer tokens) ---
         // Only the *trailing* \b is replaced. It could not match when the token run
         // ended on "-", "+" or "/", so the engine backtracked across two
@@ -238,19 +290,24 @@ const SHARED = {
         p(EntityType.SECRET, String.raw `\b[A-Za-z0-9_\-+/]{24,}[A-Za-z0-9_\-+/=]*(?![A-Za-z0-9_\-+/=])`, "high_entropy", "High-entropy token", SECRET_CONTEXT, true),
         p(EntityType.DOB, String.raw `\b(?:0[1-9]|[12][0-9]|3[01])[/.\-](?:0[1-9]|1[0-2])[/.\-](?:19|20)\d{2}\b`, null, "DD/MM/YYYY", DOB_CONTEXT, true),
         p(EntityType.DATE_OF_DEATH, String.raw `\b(?:0[1-9]|[12][0-9]|3[01])[/.\-](?:0[1-9]|1[0-2])[/.\-](?:19|20)\d{2}\b`, null, "", DATE_OF_DEATH_CONTEXT, true),
-        p(EntityType.DOB, String.raw `\b(?:19|20)\d{2}[/.\-](?:0[1-9]|1[0-2])[/.\-](?:0[1-9]|[12][0-9]|3[01])\b`, null, "ISO YYYY-MM-DD", DOB_ISO_CONTEXT, true),
+        // Written-month dates, behind the same labels (rules-engine#115).
+        p(EntityType.DOB, writtenDatePattern(), null, "Date with a written month", DOB_CONTEXT, true),
+        p(EntityType.DATE_OF_DEATH, writtenDatePattern(), null, "Date of death with a written month", DATE_OF_DEATH_CONTEXT, true),
+        p(EntityType.DOB, String.raw `\b(?:19|20)\d{2}[/.\-](?:0[1-9]|1[0-2])[/.\-](?:0[1-9]|[12][0-9]|3[01])\b`, null, "ISO YYYY-MM-DD", DOB_CONTEXT, true),
     ],
 };
 const NL = {
     code: "NL",
     name: "Netherlands",
     patterns: [
+        // Healthcare-provider numbers, behind their label: no shape of their own, so without a pattern nothing claimed them, or a phone or a foreign checksum did (canon HEALTHCARE_PROVIDER; rules-engine#111).
+        p(EntityType.HEALTHCARE_PROVIDER, String.raw `\b\d{8,11}\b`, null, "Dutch BIG-registratienummer — 8-11 digits", ["BIG-nummer", "BIG nummer", "BIG-registratie", "BIG registratie", "BIG-nr", "BIG nr", "BIG:"], true),
         p(EntityType.NATIONAL_ID, String.raw `\b[0-9]{9}\b`, "bsn"),
         p(EntityType.NATIONAL_ID, String.raw `\b[0-9]{2,4}\.[0-9]{2,4}\.[0-9]{2,4}\b`, "bsn"),
         p(EntityType.IBAN, String.raw `\bNL\d{2}\s?[A-Z]{4}\s?\d{4}\s?\d{4}\s?\d{2}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bNL\d{9}B\d{2}\b`, "vat_nl"),
+        p(EntityType.VAT, String.raw `\bNL[\s.]?\d{9}B\d{2}\b`, "vat_nl"),
         p(EntityType.CHAMBER_OF_COMMERCE, String.raw `\b\d{8}\b`, "kvk", "", ["KvK", "Kamer van Koophandel", "kvk-nummer", "KVK-nummer", "handelsregister", "chamber of commerce"], true),
-        p(EntityType.PHONE, String.raw `\b0[1-9]\d[\s\-]?\d{3}[\s\-]?\d{4}\b`),
+        p(EntityType.PHONE, String.raw `\b0[1-9]\d(?:\s-\s|[\s\-])?\d{3}[\s\-]?\d{4}\b`),
         p(EntityType.PHONE, String.raw `\b0[1-9]\d{2}[\s\-]?\d{6,7}\b`),
         p(EntityType.PHONE, String.raw `\b06[\s\-]?\d{4}[\s\-]?\d{4}\b`),
         p(EntityType.PHONE, String.raw `\b06\d{8}\b`),
@@ -275,7 +332,7 @@ const BE = {
         p(EntityType.PASSPORT, String.raw `\b[A-Z]{2}\d{6}\b`, null, "", PASSPORT_CONTEXT, true),
         p(EntityType.DRIVERS_LICENSE, String.raw `\b\d{10}\b`, null, "", ["rijbewijs", "permis de conduire", "driving licence", "driving license", "rijbewijsnummer"], true),
         p(EntityType.LICENSE_PLATE, String.raw `\b[12][\-\s]?[A-Z]{3}[\-\s]?\d{3}\b`),
-        p(EntityType.POSTAL_CODE, String.raw `\b[1-9]\d{3}\b`, null, "", ["postcode", "code postal", "postnummer", "postal code", "zip", "B-", "adres", "adresse", "wonende", "woonplaats", "rue", "straat", "laan", "avenue", "boulevard", "plein", "steenweg", "chaussée", "domicilié", "gedomicilieerd", "Levering:", "siège"], true),
+        p(EntityType.POSTAL_CODE, String.raw `\b[1-9]\d{3}\b`, null, "", ["postcode", "code postal", "postnummer", "postal code", "zip", "B-", "adres", "adresse", "wonende", "woonplaats", "domicile", "rue", "straat", "laan", "avenue", "boulevard", "plein", "steenweg", "chaussée", "domicilié", "gedomicilieerd", "Levering:", "siège"], true),
         p(EntityType.POSTAL_CODE, String.raw `(?<=, )[1-9]\d{3}(?= [A-Z])`),
         p(EntityType.HEALTHCARE_PROVIDER, String.raw `\b\d{1}[\-.]?\d{5}[\-.]?\d{2}[\-.]?\d{3}\b`, null, "", ["RIZIV", "INAMI", "arts", "médecin", "zorgverlener", "prestataire", "dokter", "doctor"], true),
     ],
@@ -284,13 +341,17 @@ const DE = {
     code: "DE",
     name: "Germany",
     patterns: [
+        // Healthcare-provider numbers, behind their label: no shape of their own, so without a pattern nothing claimed them, or a phone or a foreign checksum did (canon HEALTHCARE_PROVIDER; rules-engine#111).
+        p(EntityType.HEALTHCARE_PROVIDER, String.raw `\b\d{9}\b`, null, "German LANR — 9 digits", ["LANR", "Lebenslange Arztnummer", "Arztnummer"], true),
+        p(EntityType.HEALTHCARE_PROVIDER, String.raw `\b\d{9}\b`, null, "German BSNR — 9 digits", ["BSNR", "Betriebsstättennummer", "Betriebsstätten-Nr"], true),
         p(EntityType.TAX_ID, String.raw `\b[1-9]\d{10}\b`, "german_tax_id"),
         p(EntityType.TAX_ID, String.raw `\b[1-9]\d[\s.]?\d{3}[\s.]?\d{3}[\s.]?\d{3}\b`, "german_tax_id"),
         p(EntityType.NATIONAL_ID, String.raw `\b[CFGHJKLMNPRTVWXYZ][0-9CFGHJKLMNPRTVWXYZ]{8}\d?\b`, null, "", ["Personalausweis", "Personalausweisnummer", "Ausweis", "Ausweisnummer", "Ausweis-Nr", "identity card", "Identitätskarte", "Perso", "PA-Nummer"], true),
         p(EntityType.IBAN, String.raw `\bDE\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{2}\b`, "iban"),
         p(EntityType.VAT, String.raw `\bDE\s?\d{9}\b`, "vat_de"),
-        p(EntityType.PHONE, String.raw `\b0[1-9]\d{1,4}[\s/\-]?\d{3,8}\b`),
-        p(EntityType.PHONE, String.raw `\+49\s?\d{2,5}[\s/\-]?\d{3,8}\b`),
+        // Prefix may be set off by " / "; up to three trailing two-digit groups (rules-engine#51).
+        p(EntityType.PHONE, String.raw `\b0[1-9]\d{1,4}(?:\s?[/\-]\s?|\s)?\d{3,8}\b(?:[ \-]\d{2}\b(?![.,/:\-]\d)){0,3}`),
+        p(EntityType.PHONE, String.raw `\+49\s?\d{2,5}(?:\s?[/\-]\s?|\s)?\d{3,8}\b(?:[ \-]\d{2}\b(?![.,/:\-]\d)){0,3}`),
         p(EntityType.PASSPORT, String.raw `\b[CFGHJK][0-9CFGHJKLMNPRTVWXYZ]{8}\d?\b`, null, "", PASSPORT_CONTEXT, true),
         // The separator after the city code is mandatory. When it was optional, a
         // contiguous letter run split across both groups and the hyphen was
@@ -300,7 +361,7 @@ const DE = {
         // separates the city code: "B-AB 1234", "M-XY 99".
         p(EntityType.LICENSE_PLATE, String.raw `\b[A-ZÄÖÜ]{1,3}[\s\-][A-Z]{1,2}[\s\-]?\d{1,4}[EH]?\b`),
         p(EntityType.POSTAL_CODE, String.raw `\b\d{5}\b`, null, "", ["PLZ", "Postleitzahl", "postal code", "postcode", "Anschrift", "Adresse", "Wohnort", "Ort", "Stadt", "wohnt", "wohnhaft", "Straße", "Str.", "Weg", "Platz", "Allee", "Ring"], true),
-        p(EntityType.CHAMBER_OF_COMMERCE, String.raw `\bHR[AB]\s?\d{4,6}\b`),
+        p(EntityType.CHAMBER_OF_COMMERCE, String.raw `\bHR[AB]\s?\d{4,6}(?:\s[A-Z]\b)?`),
         p(EntityType.SSN, String.raw `\b\d{2}[\s]?\d{6}[\s]?[A-Z][\s]?\d{3}\b`, null, "", ["Rentenversicherung", "RV-Nummer", "Sozialversicherung", "SV-Nummer", "Versicherungsnummer", "Rentenversicherungsnummer", "Sozialversicherungsnummer", "SVNR", "SV-Nr", "RVNR"], true),
         p(EntityType.TAX_ID, String.raw `\b\d{2,3}/\d{3,4}/\d{4,5}\b`, null, "", ["Steuernummer", "St.-Nr", "StNr", "Finanzamt", "Steuer"], true),
         p(EntityType.TAX_ID, String.raw `\b\d{13}\b`, null, "", ["Steuernummer", "St.-Nr", "StNr", "Finanzamt", "Steuer"], true),
@@ -311,15 +372,16 @@ const AT = {
     code: "AT",
     name: "Austria",
     patterns: [
-        p(EntityType.NATIONAL_ID, String.raw `\b\d{4}\s?\d{6}\b`, "austrian_svnr"),
+        // SSN: Austria has no national ID; the SVNr is its separate social-insurance number (rules-engine#111).
+        p(EntityType.SSN, String.raw `\b\d{4}\s?\d{6}\b`, "austrian_svnr"),
         p(EntityType.IBAN, String.raw `\bAT\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bATU\d{8}\b`),
+        p(EntityType.VAT, String.raw `\bATU[\s.]?\d{8}\b`),
         p(EntityType.PHONE, String.raw `\b0\d{3,4}[\s\-]?\d{5,8}\b`),
         // Short area codes (Vienna is "01") split across three groups:
         // "01 53460 2215". The pattern above requires 3-4 digits after the trunk
         // 0, so it never matched these. Both separators are mandatory here, which
         // keeps "01 2025" (a date fragment) out.
-        p(EntityType.PHONE, String.raw `\b0\d{1,4}[\s\-/]\d{3,7}[\s\-/]\d{2,6}\b`, null, "Austrian national phone — short area code, grouped"),
+        p(EntityType.PHONE, String.raw `\b0\d{1,4}[\s\-/]\d{3,7}[\s\-/]\d{2,6}\b(?![.,/:]\d)`, null, "Austrian national phone — short area code, grouped"),
         p(EntityType.PHONE, String.raw `\+43\s?\d{3,4}[\s\-]?\d{5,8}`),
         p(EntityType.LICENSE_PLATE, String.raw `\b[A-ZÄÖÜ]{1,2}\s?\d{1,5}\s?[A-Z]{1,2}\b`, null, "", ["Kennzeichen", "Nummernschild", "Kfz-Kennzeichen"], true),
         p(EntityType.POSTAL_CODE, String.raw `\b[1-9]\d{3}\b`, null, "", ["PLZ", "Postleitzahl", "Adresse", "Anschrift", "Straße", "Str.", "Gasse", "Weg", "Platz", "Postal:", "Wohnort"], true),
@@ -331,6 +393,8 @@ const CH = {
     name: "Switzerland",
     patterns: [
         p(EntityType.NATIONAL_ID, String.raw `\b756\.\d{4}\.\d{4}\.\d{2}\b`, "swiss_ahv"),
+        // Dotted, check digit not required when the document names it nearby (rules-engine#82).
+        p(EntityType.NATIONAL_ID, String.raw `\b756\.\d{4}\.\d{4}\.\d{2}\b`, null, "Swiss AHV number — dotted, beside AVS/AHV", ["AVS", "AHV"], true),
         p(EntityType.NATIONAL_ID, String.raw `\b756\d{10}\b`, "swiss_ahv"),
         p(EntityType.CHAMBER_OF_COMMERCE, String.raw `\bCHE[\-\s]?\d{3}\.?\d{3}\.?\d{3}\b`),
         p(EntityType.VAT, String.raw `\bCHE[\-\s]?\d{3}\.?\d{3}\.?\d{3}\s?(?:MWST|TVA|IVA)\b`),
@@ -339,13 +403,16 @@ const CH = {
         p(EntityType.PHONE, String.raw `\+41\s?\d{2}\s?\d{3}\s?\d{2}\s?\d{2}`),
         p(EntityType.LICENSE_PLATE, String.raw `\b[A-Z]{2}\s?\d{1,6}\b`, null, "", ["Kontrollschild", "Nummernschild", "plaque", "immatriculation", "Kennzeichen"], true),
         p(EntityType.POSTAL_CODE, String.raw `\b[1-9]\d{3}\b`, null, "", ["PLZ", "Postleitzahl", "code postal", "NPA", "Adresse", "Anschrift", "adresse", "rue", "Straße", "Str.", "Gasse", "chemin", "Postal:", "Wohnort"], true),
-        p(EntityType.POSTAL_CODE, String.raw `(?<=, )[1-9]\d{3}(?= [A-Z])`),
+        p(EntityType.POSTAL_CODE, String.raw `(?:(?<=, )|(?<=, CH-)|(?<=^CH-)|(?<=\nCH-))[1-9]\d{3}(?= [A-Z])`), // also "…, CH-8004 Zürich" and a "CH-8004 Zürich" line (rules-engine#58)
     ],
 };
 const FR = {
     code: "FR",
     name: "France",
     patterns: [
+        // Healthcare-provider numbers, behind their label: no shape of their own, so without a pattern nothing claimed them, or a phone or a foreign checksum did (canon HEALTHCARE_PROVIDER; rules-engine#111).
+        p(EntityType.HEALTHCARE_PROVIDER, String.raw `\b\d{11}\b`, null, "French RPPS — 11 digits", ["RPPS", "Répertoire Partagé des Professionnels"], true),
+        p(EntityType.HEALTHCARE_PROVIDER, String.raw `\b\d{9}\b`, null, "French ADELI — 9 digits", ["ADELI"], true),
         p(EntityType.NATIONAL_ID, String.raw `\b[12]\s?\d{2}\s?(?:0[1-9]|1[0-2]|[2-9]\d)\s?\d{2}[0-9AB]?\s?\d{3}\s?\d{3}\s?\d{2}\b`, "french_nir"),
         p(EntityType.NATIONAL_ID, String.raw `\b\d{12}\b`, null, "", ["carte d'identité", "CNI", "carte nationale", "identity card", "pièce d'identité"], true),
         p(EntityType.IBAN, String.raw `\bFR\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{3}\b`, "iban"),
@@ -354,7 +421,7 @@ const FR = {
         p(EntityType.PHONE, String.raw `\+33\s?[1-9][\s.\-]?\d{2}[\s.\-]?\d{2}[\s.\-]?\d{2}[\s.\-]?\d{2}`),
         p(EntityType.PASSPORT, String.raw `\b\d{2}[A-Z]{2}\d{5}\b`, null, "", PASSPORT_CONTEXT, true),
         p(EntityType.LICENSE_PLATE, String.raw `\b[A-Z]{2}[\-\s]?\d{3}[\-\s]?[A-Z]{2}\b`),
-        p(EntityType.POSTAL_CODE, String.raw `\b(?:0[1-9]|[1-8]\d|9[0-5]|97[1-6])\d{3}\b`, null, "", ["code postal", "CP", "postal code", "postcode", "adresse", "domicilié", "résidant", "rue", "avenue", "boulevard", "place", "chemin", "allée", "impasse", "ville"], true),
+        p(EntityType.POSTAL_CODE, String.raw `\b(?:0[1-9]|[1-8]\d|9[0-5]|97[1-6])\d{3}\b`, null, "", ["code postal", "CP", "postal code", "postcode", "adresse", "domicile", "domicilié", "résidant", "rue", "avenue", "boulevard", "place", "chemin", "allée", "impasse", "ville"], true),
         p(EntityType.CHAMBER_OF_COMMERCE, String.raw `\b\d{3}\s?\d{3}\s?\d{3}\b`, null, "", ["SIREN", "siren", "RCS", "entreprise", "immatricul", "numéro d'entreprise", "registre du commerce"], true),
         p(EntityType.CHAMBER_OF_COMMERCE, String.raw `\b\d{3}\s?\d{3}\s?\d{3}\s?\d{5}\b`, null, "", ["SIRET", "siret", "établissement", "immatricul"], true),
         p(EntityType.TAX_ID, String.raw `\b\d{13}\b`, null, "", ["numéro fiscal", "SPI", "référence fiscale", "avis d'impôt", "impôt sur le revenu", "déclaration fiscale", "fiscal"], true),
@@ -387,9 +454,9 @@ const SE = {
         p(EntityType.PHONE, String.raw `\b0\d{1,3}[\-\s]?\d{2,3}[\s]?\d{2,3}[\s]?\d{2}\b`),
         p(EntityType.PHONE, String.raw `\+46\s?\d{1,3}[\s\-]?\d{2,3}[\s\-]?\d{2,3}[\s\-]?\d{2}`),
         p(EntityType.LICENSE_PLATE, String.raw `\b[A-Z]{3}\s?\d{2}[A-Z0-9]\b`),
-        p(EntityType.POSTAL_CODE, String.raw `\b\d{3}\s?\d{2}\b`, null, "", ["postnummer", "postort", "postkod", "adress", "bostadsadress", "gatuadress", "boende", "gatan", "vägen", "gata", "väg", "allé", "plats", "torg", "stigen", "Bostadsadress"], true),
-        p(EntityType.POSTAL_CODE, String.raw `\b\d{4}\s\d{2}\b`, null, "", ["postnummer", "postort", "postkod", "adress", "bostadsadress", "gatuadress", "boende", "gatan", "vägen", "gata", "väg", "allé"], true),
-        p(EntityType.POSTAL_CODE, String.raw `\b\d{6}\b`, null, "", ["postnummer", "postort", "postkod", "adress", "bostadsadress", "gatuadress", "boende", "gatan", "vägen", "gata", "väg", "allé"], true),
+        p(EntityType.POSTAL_CODE, String.raw `\b\d{3}\s?\d{2}\b`, null, "", ["postnummer", "postort", "postkod", "adress", "Postal:", "Address:", "bostadsadress", "gatuadress", "boende", "gatan", "vägen", "gata", "väg", "allé", "plats", "torg", "stigen", "Bostadsadress"], true),
+        p(EntityType.POSTAL_CODE, String.raw `\b\d{4}\s\d{2}\b`, null, "", ["postnummer", "postort", "postkod", "adress", "Postal:", "Address:", "bostadsadress", "gatuadress", "boende", "gatan", "vägen", "gata", "väg", "allé"], true),
+        p(EntityType.POSTAL_CODE, String.raw `\b\d{6}\b`, null, "", ["postnummer", "postort", "postkod", "adress", "Postal:", "Address:", "bostadsadress", "gatuadress", "boende", "gatan", "vägen", "gata", "väg", "allé"], true),
         p(EntityType.CHAMBER_OF_COMMERCE, String.raw `\b\d{6}-?\d{4}\b`, null, "", ["organisationsnummer", "org.nr", "org nr", "Bolagsverket", "registreringsnummer"], true),
     ],
 };
@@ -405,7 +472,7 @@ const NO = {
         p(EntityType.PHONE, String.raw `\b[2-9]\d\s?\d{2}\s?\d{2}\s?\d{2}\b`),
         p(EntityType.PHONE, String.raw `\+47\s?\d{2}\s?\d{2}\s?\d{2}\s?\d{2}`),
         p(EntityType.LICENSE_PLATE, String.raw `\b[A-Z]{2}\s?\d{5}\b`),
-        p(EntityType.POSTAL_CODE, String.raw `\b\d{4}\b`, null, "", ["postnummer", "poststed", "postnr", "adresse", "bostedsadresse", "gate", "vei", "veien", "gata", "plass", "stien", "allé"], true),
+        p(EntityType.POSTAL_CODE, String.raw `\b\d{4}\b`, null, "", ["postnummer", "poststed", "postnr", "adresse", "bostedsadresse", "gate", "vei", "veien", "gata", "plass", "stien", "allé", "Postal:", "Address:"], true),
     ],
 };
 const FI = {
@@ -414,7 +481,7 @@ const FI = {
     patterns: [
         p(EntityType.NATIONAL_ID, String.raw `\b\d{6}[-+ABCDEFYXWVU]\d{3}[0-9A-FHJK-NPR-Y]\b`, "finnish_hetu"),
         p(EntityType.IBAN, String.raw `\bFI\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{2}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bFI\d{8}\b`),
+        p(EntityType.VAT, String.raw `\bFI[\s.]?\d{8}\b`),
         p(EntityType.CHAMBER_OF_COMMERCE, String.raw `\b\d{7}-\d\b`, "finnish_business_id"),
         p(EntityType.PHONE, String.raw `\b0\d{1,2}\s?\d{3,4}\s?\d{3,4}\b`),
         p(EntityType.PHONE, String.raw `\+358\s?\d{1,3}[\s\-]?\d{3,4}[\s\-]?\d{3,4}`),
@@ -432,7 +499,7 @@ const IS = {
         p(EntityType.PHONE, String.raw `\b[3-9]\d{6}\b`, null, "", ["sími", "símanúmer", "farsími", "gsm", "phone", "tel", "hringja", "hringdu", "ná í", "nás á", "nás", "SMS", "sent to"], true),
         p(EntityType.PHONE, String.raw `\+354\s?\d{3}\s?\d{4}`),
         p(EntityType.LICENSE_PLATE, String.raw `\b[A-Z]{2}\s?\d{3}\b`, null, "", ["skráningarnúmer", "bílnúmer", "ökutæki", "bifreið", "plata"], true),
-        p(EntityType.POSTAL_CODE, String.raw `\b[1-9]\d{2}\b`, null, "", ["póstnúmer", "póstfang", "staður", "heimilisfang"], true),
+        p(EntityType.POSTAL_CODE, String.raw `\b[1-9]\d{2}\b`, null, "", ["póstnúmer", "póstfang", "staður", "heimilisfang", "Postal:", "Address:"], true),
     ],
 };
 const IT = {
@@ -442,7 +509,7 @@ const IT = {
         p(EntityType.NATIONAL_ID, String.raw `\b[A-Z]{6}\d{2}[ABCDEHLMPRST]\d{2}[A-Z]\d{3}[A-Z]\b`, "italian_cf"),
         p(EntityType.IBAN, String.raw `\bIT\d{2}\s?[A-Z]\d{3}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{3}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bIT\d{2}[A-Z]\d{22}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bIT\d{11}\b`),
+        p(EntityType.VAT, String.raw `\bIT[\s.]?\d{11}\b`),
         p(EntityType.PHONE, String.raw `\b3\d{2}[\s\-]?\d{3}[\s\-]?\d{4}\b`),
         p(EntityType.PHONE, String.raw `\b0\d{1,3}[\s\-]?\d{6,8}\b`),
         p(EntityType.PHONE, String.raw `\b0\d{1,2}[\s\-]\d{3}[\s\-]\d{4}\b`),
@@ -458,7 +525,7 @@ const ES = {
         p(EntityType.NATIONAL_ID, String.raw `\b\d{8}[A-Z]\b`, "spanish_dni"),
         p(EntityType.NATIONAL_ID, String.raw `\b[XYZ]\d{7}[A-Z]\b`, "spanish_nie"),
         p(EntityType.IBAN, String.raw `\bES\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bES[A-Z0-9]\d{7}[A-Z0-9]\b`),
+        p(EntityType.VAT, String.raw `\bES[\s.]?[A-Z0-9]\d{7}[A-Z0-9]\b`),
         p(EntityType.PHONE, String.raw `\b[679]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(EntityType.PHONE, String.raw `\b[679]\d{8}\b`),
         p(EntityType.PHONE, String.raw `\b[679]\d[\s\-]?\d{3}[\s\-]?\d{2}[\s\-]?\d{2}\b`),
@@ -481,7 +548,7 @@ const PT = {
         p(EntityType.NATIONAL_ID, String.raw `\b[1-35-9]\d{8}\b`, "portuguese_nif"),
         p(EntityType.NATIONAL_ID, String.raw `\b[1-35-9]\d{2}[\s.]\d{3}[\s.]\d{3}\b`, "portuguese_nif"),
         p(EntityType.IBAN, String.raw `\bPT\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{5}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bPT\d{9}\b`),
+        p(EntityType.VAT, String.raw `\bPT[\s.]?\d{9}\b`),
         p(EntityType.PHONE, String.raw `\b[29]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(EntityType.PHONE, String.raw `\b[29]\d{8}\b`),
         p(EntityType.PHONE, String.raw `\+351\s?[29]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}`),
@@ -493,7 +560,8 @@ const LU = {
     code: "LU",
     name: "Luxembourg",
     patterns: [
-        p(EntityType.NATIONAL_ID, String.raw `\b(?:19|20)\d{2}\s(?:0[1-9]|1[0-2])\s(?:0[1-9]|[12]\d|3[01])\s\d{3}\s\d{2}\b`),
+        // Grouped: one horizontal space is optional at each boundary of YYYY MM DD XXX XX (rules-engine#49).
+        p(EntityType.NATIONAL_ID, String.raw `\b(?:19|20)\d{2}[^\S\r\n]?(?:0[1-9]|1[0-2])[^\S\r\n]?(?:0[1-9]|[12]\d|3[01])[^\S\r\n]?\d{3}[^\S\r\n]?\d{2}\b`),
         p(EntityType.NATIONAL_ID, String.raw `\b(?:19|20)\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])\d{5}\b`),
         p(EntityType.IBAN, String.raw `\bLU\d{2}\s?[A-Z0-9]{4}\s?[A-Z0-9]{4}\s?[A-Z0-9]{4}\s?[A-Z0-9]{4}\b`, "iban"),
         p(EntityType.VAT, String.raw `\bLU\s?\d{8}\b`, "vat_lu"),
@@ -510,14 +578,32 @@ const PL = {
     code: "PL",
     name: "Poland",
     patterns: [
+        // Healthcare-provider numbers, behind their label: no shape of their own, so without a pattern nothing claimed them, or a phone or a foreign checksum did (canon HEALTHCARE_PROVIDER; rules-engine#111).
+        p(EntityType.HEALTHCARE_PROVIDER, String.raw `\b\d{7}\b`, null, "Polish PWZ — 7 digits", ["PWZ", "prawa wykonywania zawodu", "prawo wykonywania zawodu"], true),
         p(EntityType.NATIONAL_ID, String.raw `\b\d{11}\b`, "polish_pesel"),
-        p(EntityType.TAX_ID, String.raw `\b\d{3}-?\d{3}-?\d{2}-?\d{2}\b`, "polish_nip"),
+        // NIP in the company (3-3-2-2) or the personal (3-2-2-3) grouping (rules-engine#94).
+        p(EntityType.TAX_ID, String.raw `\b(?:\d{3}-?\d{3}-?\d{2}-?\d{2}|\d{3}-\d{2}-\d{2}-\d{3})\b`, "polish_nip"),
         p(EntityType.IBAN, String.raw `\bPL\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bPL\d{26}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bPL\d{10}\b`),
+        // NRB, the domestic account number: the IBAN without "PL" (rules-engine#93).
+        p(EntityType.BANK_ACCOUNT, String.raw `\b\d{2}(?: ?\d{4}){6}\b`, "polish_nrb", "Polish NRB"),
+        p(EntityType.VAT, String.raw `\bPL[\s.]?\d{10}\b`),
         p(EntityType.PHONE, String.raw `\b[5-8]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(EntityType.PHONE, String.raw `\b[5-8]\d{8}\b`),
         p(EntityType.PHONE, String.raw `\+48\s?[5-8]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}`),
+        // Identity card, REGON, driving licence: each behind its own label (rules-engine#75, #76, #77).
+        p(EntityType.NATIONAL_ID, String.raw `\b[A-Z]{3}\s?\d{6}\b`, "polish_id_card", "Polish identity card", ["dowód osobisty", "dowodu osobistego", "dowodem osobistym", "dowód", "dowodu", "nr dowodu", "identity card", "ID card"], true),
+        p(EntityType.CHAMBER_OF_COMMERCE, String.raw `\b\d{9}(?:\d{5})?\b`, "polish_regon", "Polish REGON", ["REGON"], true),
+        // KRS: ten digits with the leading zeros, so it begins "00", which no dialled number does (rules-engine#90).
+        p(EntityType.CHAMBER_OF_COMMERCE, String.raw `\b00\d{8}\b`, null, "Polish KRS", ["KRS"], true),
+        p(EntityType.DRIVERS_LICENSE, String.raw `\b\d{3,6}/\d{2}/\d{3,7}\b`, null, "Polish driving licence number — field 5", ["prawo jazdy", "prawa jazdy", "prawem jazdy", "driving licence", "driving license"], true),
+        p(EntityType.DRIVERS_LICENSE, String.raw `\b[A-Z]{2}\s?\d{6,7}\b`, null, "Polish driving licence document number", ["prawo jazdy", "prawa jazdy", "prawem jazdy", "driving licence", "driving license"], true),
+        // Military booklet: a 2- or 3-letter series + 7 digits, one identifier, also "seria MS nr 6620419" (rules-engine#102).
+        p(EntityType.INTERNAL_ID, String.raw `\b[A-Z]{2,3}(?:\s?|\s+nr\.?\s+)\d{7}\b`, null, "Polish military booklet", ["książeczka wojskowa", "książeczki wojskowej", "książeczkę wojskową", "książeczką wojskową", "książeczce wojskowej", "military booklet", "military record book"], true),
+        // Residence card and national-visa sticker: 2 letters + 7 digits (rules-engine#103).
+        p(EntityType.RESIDENCE_PERMIT, String.raw `\b[A-Z]{2}\s?\d{7}\b`, null, "Polish residence card or visa sticker", ["karta pobytu", "karty pobytu", "kartę pobytu", "kartą pobytu", "CUKR", "naklejka wizowa", "naklejki wizowej", "naklejkę wizową", "naklejką wizową", "residence card", "visa sticker"], true),
+        // Case reference (znak sprawy): prefix.class.number.year, one INTERNAL_ID (rules-engine#105).
+        p(EntityType.INTERNAL_ID, String.raw `\b[A-ZĄĆĘŁŃÓŚŹŻ]{2,}(?:-[A-Z0-9]{1,6})*(?:\.[A-Z0-9]{1,6})*\.\d{3,4}(?:\.\d{1,6})+\.(?:19|20)\d{2}\b`, null, "Polish case reference", ["znak sprawy", "znak pisma", "znak:", "sygnatura", "sygn.", "sprawa nr", "sprawy nr", "nr sprawy", "decyzj", "postanowieni", "pismo nr"], true),
         p(EntityType.POSTAL_CODE, String.raw `\b\d{2}-\d{3}\b`, null, "", ["kod pocztowy", "adres", "ulica", "Postal:", "Address:"]),
     ],
 };
@@ -525,10 +611,11 @@ const IE = {
     code: "IE",
     name: "Ireland",
     patterns: [
-        p(EntityType.NATIONAL_ID, String.raw `\b\d{7}[A-W][ABWTXZ]?\b`, "irish_pps"),
+        // The PPSN is SSN, never NATIONAL_ID: Ireland has no national ID (canon SSN; rules-engine#111).
+        p(EntityType.SSN, String.raw `\b\d{7}[A-W][ABWTXZ]?\b`, "irish_pps"),
         p(EntityType.IBAN, String.raw `\bIE\d{2}\s?[A-Z]{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{2}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bIE\d{2}[A-Z]{4}\d{14}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bIE\d{7}[A-Z]\b`),
+        p(EntityType.VAT, String.raw `\bIE[\s.]?\d{7}[A-Z]\b`),
         p(EntityType.PHONE, String.raw `\b0[89]\d[\s\-]?\d{3}[\s\-]?\d{4}\b`),
         p(EntityType.PHONE, String.raw `\b0[89]\d{8}\b`),
         p(EntityType.PHONE, String.raw `\b0[1-9]\d{0,2}[\s\-]?\d{5,8}\b`),
@@ -540,11 +627,14 @@ const UK = {
     code: "UK",
     name: "United Kingdom",
     patterns: [
-        p(EntityType.NATIONAL_ID, String.raw `\b[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z]\s?\d{2}\s?\d{2}\s?\d{2}\s?[ABCD]\b`),
+        // Healthcare-provider numbers, behind their label: no shape of their own, so without a pattern nothing claimed them, or a phone or a foreign checksum did (canon HEALTHCARE_PROVIDER; rules-engine#111).
+        p(EntityType.HEALTHCARE_PROVIDER, String.raw `\b\d{7}\b`, null, "UK GMC number — 7 digits", ["GMC number", "GMC no", "GMC reference", "GMC reg", "GMC:", "GMC-Nr", "General Medical Council"], true),
+        // UK NINO: a social-security number, so SSN, as the canon defaults it (rules-engine#47).
+        p(EntityType.SSN, String.raw `\b[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z]\s?\d{2}\s?\d{2}\s?\d{2}\s?[ABCD]\b`),
         p(EntityType.HEALTH_INSURANCE, String.raw `\b\d{3}\s?\d{3}\s?\d{4}\b`, "uk_nhs", "", ["NHS", "NHS number", "health number", "NHS no"], true),
         p(EntityType.IBAN, String.raw `\bGB\d{2}\s?[A-Z]{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{2}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bGB\d{2}[A-Z]{4}\d{14}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bGB\d{9}\b`),
+        p(EntityType.VAT, String.raw `\bGB[\s.]?\d{3}[\s.]?\d{4}[\s.]?\d{2}\b`),
         p(EntityType.PHONE, String.raw `\b07[4-9]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(EntityType.PHONE, String.raw `\b07[4-9]\d{8}\b`),
         p(EntityType.PHONE, String.raw `\b0[12]\d{2}[\s\-]?\d{3}[\s\-]?\d{4}\b`),
@@ -560,7 +650,7 @@ const BG = {
     patterns: [
         p(EntityType.NATIONAL_ID, String.raw `\b\d{10}\b`, "bulgarian_egn"),
         p(EntityType.IBAN, String.raw `\bBG\d{2}\s?[A-Z]{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{2}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bBG\d{9,10}\b`),
+        p(EntityType.VAT, String.raw `\bBG[\s.]?\d{9,10}\b`),
         p(EntityType.PHONE, String.raw `\b0?[89][789][\s\-]?\d{3}[\s\-]?\d{3,4}\b`),
         p(EntityType.PHONE, String.raw `\b0?[89][789]\d{7,8}\b`),
         p(EntityType.PHONE, String.raw `\+359\s?[89][789][\s\-]?\d{3}[\s\-]?\d{3,4}`),
@@ -575,7 +665,7 @@ const CY = {
         p(EntityType.NATIONAL_ID, String.raw `\b\d{8}[A-Z]\b`),
         p(EntityType.IBAN, String.raw `\bCY\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bCY\d{26}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bCY\d{8}[A-Z]\b`),
+        p(EntityType.VAT, String.raw `\bCY[\s.]?\d{8}[A-Z]\b`),
         p(EntityType.PHONE, String.raw `\b[29]\d{3}[\s\-]?\d{4}\b`),
         p(EntityType.PHONE, String.raw `\b[29]\d[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(EntityType.PHONE, String.raw `\b[29]\d{7}\b`),
@@ -591,7 +681,7 @@ const CZ = {
         p(EntityType.NATIONAL_ID, String.raw `\b\d{6}/?\d{3,4}\b`, "czech_birth_number"),
         p(EntityType.IBAN, String.raw `\bCZ\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bCZ\d{22}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bCZ\d{8,10}\b`),
+        p(EntityType.VAT, String.raw `\bCZ[\s.]?\d{8,10}\b`),
         p(EntityType.PHONE, String.raw `\b[67]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(EntityType.PHONE, String.raw `\b[67]\d{8}\b`),
         p(EntityType.PHONE, String.raw `\+420\s?[67]\d{2}[\s\-]?\d{3}[\s\-]?\d{3}`),
@@ -605,7 +695,7 @@ const SK = {
         p(EntityType.NATIONAL_ID, String.raw `\b\d{6}/?\d{3,4}\b`, "czech_birth_number"),
         p(EntityType.IBAN, String.raw `\bSK\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bSK\d{22}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bSK\d{10}\b`),
+        p(EntityType.VAT, String.raw `\bSK[\s.]?\d{10}\b`),
         p(EntityType.PHONE, String.raw `\b0?9\d{2}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(EntityType.PHONE, String.raw `\+421\s?9\d{2}[\s\-]?\d{3}[\s\-]?\d{3}`),
         p(EntityType.POSTAL_CODE, String.raw `\b\d{3}\s?\d{2}\b`, null, "", ["PSČ", "poštové", "adresa", "ulica", "Postal:", "Address:"], true),
@@ -618,7 +708,7 @@ const EE = {
         p(EntityType.NATIONAL_ID, String.raw `\b[1-6]\d{10}\b`, "estonian_id"),
         p(EntityType.IBAN, String.raw `\bEE\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bEE\d{18}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bEE\d{9}\b`),
+        p(EntityType.VAT, String.raw `\bEE[\s.]?\d{9}\b`),
         p(EntityType.PHONE, String.raw `\b5\d{3}[\s\-]?\d{4}\b`),
         p(EntityType.PHONE, String.raw `\b5\d{7}\b`),
         p(EntityType.PHONE, String.raw `\+372\s?5\d{3}[\s\-]?\d{3,4}`),
@@ -632,7 +722,7 @@ const LT = {
         p(EntityType.NATIONAL_ID, String.raw `\b[1-6]\d{10}\b`, "estonian_id"),
         p(EntityType.IBAN, String.raw `\bLT\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bLT\d{18}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bLT\d{9,12}\b`),
+        p(EntityType.VAT, String.raw `\bLT[\s.]?\d{9,12}\b`),
         p(EntityType.PHONE, String.raw `\b6\d{2}[\s\-]?\d{2}[\s\-]?\d{3}\b`),
         p(EntityType.PHONE, String.raw `\b6\d{7}\b`),
         p(EntityType.PHONE, String.raw `\b8[\s\-]?6\d{2}[\s\-]?\d{2}[\s\-]?\d{3}\b`),
@@ -648,7 +738,7 @@ const LV = {
         p(EntityType.NATIONAL_ID, String.raw `\b(?:0[1-9]|[12]\d|3[01])(?:0[1-9]|1[0-2])\d{7}\b`, null, "", ["personas kods", "PK", "identifikācijas"], true),
         p(EntityType.IBAN, String.raw `\bLV\d{2}\s?[A-Z]{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bLV\d{2}[A-Z]{4}\d{13}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bLV\d{11}\b`),
+        p(EntityType.VAT, String.raw `\bLV[\s.]?\d{11}\b`),
         p(EntityType.PHONE, String.raw `\b[2]\d{3}[\s\-]?\d{4}\b`),
         p(EntityType.PHONE, String.raw `\b[2]\d{7}\b`),
         p(EntityType.PHONE, String.raw `\+371\s?[2]\d{3}[\s\-]?\d{3,4}`),
@@ -663,7 +753,7 @@ const HR = {
         p(EntityType.IBAN, String.raw `\bHR\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{3}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bHR\d{2}\s\d{4}\s\d{4}\s\d{4}\s\d{5}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bHR\d{19}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bHR\d{11}\b`),
+        p(EntityType.VAT, String.raw `\bHR[\s.]?\d{11}\b`),
         p(EntityType.PHONE, String.raw `\b0?9[12579][\s\-]?\d{3}[\s\-]?\d{3,4}\b`),
         p(EntityType.PHONE, String.raw `\b0?9[12579]\d{7,8}\b`),
         p(EntityType.PHONE, String.raw `\+385\s?9[12579][\s\-]?\d{3}[\s\-]?\d{3,4}`),
@@ -677,7 +767,7 @@ const HU = {
         p(EntityType.NATIONAL_ID, String.raw `\b\d{9}\b`, "hungarian_taj"),
         p(EntityType.NATIONAL_ID, String.raw `\b\d{3}\s\d{3}\s\d{3}\b`, "hungarian_taj"),
         p(EntityType.TAX_ID, String.raw `\b8\d{9}\b`, null, "", ["adóazonosító", "adószám", "adóazonosító jel"], true),
-        p(EntityType.VAT, String.raw `\bHU\d{8,11}\b`, null, "", ["adószám", "ÁFA"]),
+        p(EntityType.VAT, String.raw `\bHU[\s.]?\d{8,11}\b`, null, "", ["adószám", "ÁFA"]),
         p(EntityType.IBAN, String.raw `\bHU\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bHU\d{26}\b`, "iban"),
         p(EntityType.PHONE, String.raw `\b06\s?\d{1,2}[\s\-]?\d{3}[\s\-]?\d{3,4}\b`),
@@ -692,7 +782,7 @@ const RO = {
     patterns: [
         p(EntityType.NATIONAL_ID, String.raw `\b[1-8]\d{12}\b`, "romanian_cnp"),
         p(EntityType.IBAN, String.raw `\bRO\d{2}[A-Z]{4}\d{16}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bRO\d{2,10}\b`),
+        p(EntityType.VAT, String.raw `\bRO[\s.]?\d{2,10}\b`),
         p(EntityType.PHONE, String.raw `\b0?7[2-9]\d{1}[\s\-]?\d{3}[\s\-]?\d{3,4}\b`),
         p(EntityType.PHONE, String.raw `\b0?7[2-9]\d{7,8}\b`),
         p(EntityType.PHONE, String.raw `\+40\s?7[2-9]\d{1}[\s\-]?\d{3}[\s\-]?\d{3,4}`),
@@ -707,7 +797,7 @@ const EL = {
         p(EntityType.NATIONAL_ID, String.raw `\b\d{11}\b`, "greek_amka"),
         p(EntityType.IBAN, String.raw `\bGR\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{3}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bGR\d{25}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bEL\d{9}\b`),
+        p(EntityType.VAT, String.raw `\bEL[\s.]?\d{9}\b`),
         p(EntityType.PHONE, String.raw `\b69\d[\s\-]?\d{3,4}[\s\-]?\d{4}\b`),
         p(EntityType.PHONE, String.raw `\b69\d{8}\b`),
         p(EntityType.PHONE, String.raw `\b2\d{1,3}[\s\-]?\d{3,4}[\s\-]?\d{3,4}\b`),
@@ -722,7 +812,7 @@ const SI = {
         p(EntityType.NATIONAL_ID, String.raw `\b\d{13}\b`, "slovenian_emso"),
         p(EntityType.IBAN, String.raw `\bSI\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\s?\d{3}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bSI\d{17}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bSI\d{8}\b`),
+        p(EntityType.VAT, String.raw `\bSI[\s.]?\d{8}\b`),
         p(EntityType.PHONE, String.raw `\b0?[34567]\d{1}[\s\-]?\d{3}[\s\-]?\d{3}\b`),
         p(EntityType.PHONE, String.raw `\b0?[34567]\d{7}\b`),
         p(EntityType.PHONE, String.raw `\+386\s?[34567]\d{1}[\s\-]?\d{3}[\s\-]?\d{3}`),
@@ -737,7 +827,7 @@ const MT = {
         p(EntityType.NATIONAL_ID, String.raw `\b\d{5,7}[MGAPLHBZ]\b`),
         p(EntityType.IBAN, String.raw `\bMT\d{2}\s?[A-Z]{4}\s?\d{4}\s?\d{4}\s?[A-Z0-9]{4}\s?[A-Z0-9]{4}\s?[A-Z0-9]{4}\s?[A-Z0-9]{3}\b`, "iban"),
         p(EntityType.IBAN, String.raw `\bMT\d{2}[A-Z]{4}\d{5}[A-Z0-9]{18}\b`, "iban"),
-        p(EntityType.VAT, String.raw `\bMT\d{8}\b`),
+        p(EntityType.VAT, String.raw `\bMT[\s.]?\d{8}\b`),
         p(EntityType.PHONE, String.raw `\b[79]\d{3}[\s\-]?\d{4}\b`),
         p(EntityType.PHONE, String.raw `\b[79]\d{7}\b`),
         p(EntityType.PHONE, String.raw `\+356\s?[79]\d{3}[\s\-]?\d{3,4}`),

package/dist/esm/rules/cues.d.ts

@@ -130,4 +130,4 @@ export declare const RESCUE_TARGETS: Set<string>;
  * `countryScore` is the document's support for the country the winning pattern
  * came from; see RETYPABLE_UNCORROBORATED.
  */
-export declare function retypedBy(text: string, start: number, entityType: EntityType | string, countryScore: number): EntityType | null;
+export declare function retypedBy(text: string, start: number, entityType: EntityType | string, countryScore: number, country?: string | null): EntityType | null;

package/dist/esm/rules/cues.js

@@ -90,7 +90,7 @@ export const CUES = [
         /(?<![A-Za-z0-9_])(?:phone|tel|telephone|téléphone|telefoon|telefon|telefono|teléfono|tlf|mobil|mobile|gsm|handy|sími|puh|móvil|cell|tālrunis|τηλέφωνο|τηλ)(?:(?:[A-Za-z0-9_]|[^\x00-\x7F])*|\s+[^\s:.\-\d,;()\/]{2,20})\s*\)?\s*[:.\-]*\s*$/i],
     // National identity number.
     [EntityType.NATIONAL_ID,
-        /(?<![A-Za-z0-9_])(?:bsn|burgerservicenummer(?:\s*\(bsn\))?|personnummer|rijksregisternummer|nationaal\s*nummer|numéro\s*national|national\s*(?:id|number)|identiteitsnummer|henkilötunnus|kennitala|cpr(?:-?nummer)?|nif|nie|dni|rr|nn|nir|insz|niss|nis|matricule|ausweisnummer|personalausweis|osobní\s*číslo|ЕГН|EGN)(?:(?:[A-Za-z0-9_]|[^\x00-\x7F])*|\s+[^\s:.\-\d,;()\/]{2,20})\s*\)?\s*[:.\-]*\s*$/i],
+        /(?<![A-Za-z0-9_])(?:bsn(?!r)|burgerservicenummer(?:\s*\(bsn\))?|personnummer|rijksregisternummer|nationaal\s*nummer|numéro\s*national|national\s*(?:id|number)|identiteitsnummer|henkilötunnus|kennitala|cpr(?:-?nummer)?|nif|nie|dnie?(?![A-Za-z]|[^\x00-\x7F])|rr|nn|nir|insz|niss|nis|matricule|id\s*card(?:\s*(?:no|nr|number))?|ausweisnummer|personalausweis|osobní\s*číslo|ЕГН|EGN|dow[óo]d(?:u|em)?\s*osobist(?:y|ego|ym)|nr\s*dowodu|ahv(?:-?(?:nr|nummer))?|avs)(?:(?:[A-Za-z0-9_]|[^\x00-\x7F])*|\s+[^\s:.\-\d,;()\/]{2,20})\s*\)?\s*[:.\-]*\s*$/i],
     // Cyprus: "ID number" in both official languages, plus the Greek abbreviation
     // ΑΔΤ (Αστυνομική Ταυτότητα). Neither has a phone reading.
     [EntityType.NATIONAL_ID,
@@ -111,16 +111,16 @@ export const CUES = [
         /(?<![A-Za-z0-9_])(?:αφμ|α\.φ\.μ\.|steuerliche\s*identifikations-?nummer|steuer-?identifikations-?nummer|steuer-?id-?nr\.?|steuer-?id|steuernummer|st\.?-?nr|stnr|tin|finanzamt\s+ist|tax\s*(?:id|no|number)|daňové\s*číslo|numer\s*podatkowy)(?:(?:[A-Za-z0-9_]|[^\x00-\x7F])*|\s+[^\s:.\-\d,;()\/]{2,20})\s*\)?\s*[:.\-]*\s*$/i],
     // Health insurance: the insured person.
     [EntityType.HEALTH_INSURANCE,
-        /(?<![A-Za-z0-9_])(?:versichertennummer|krankenversicherung|kvnr|kv-?nr|mutualité|ziekenfonds|aansluitingsnummer|medical\s*card(?:\s*(?:no|number))?)(?:(?:[A-Za-z0-9_]|[^\x00-\x7F])*|\s+[^\s:.\-\d,;()\/]{2,20})\s*\)?\s*[:.\-]*\s*$/i],
+        /(?<![A-Za-z0-9_])(?:versichertennummer|krankenversicherung|kvnr|kv-?nr|mutualité|ziekenfonds|aansluitingsnummer|medical\s*card(?:\s*(?:no|number))?|nhs(?:\s*(?:no|number))?)(?:(?:[A-Za-z0-9_]|[^\x00-\x7F])*|\s+[^\s:.\-\d,;()\/]{2,20})\s*\)?\s*[:.\-]*\s*$/i],
     // Healthcare provider: the clinician or practice, not the patient — the Dutch
     // AGB-code, the German LANR, the UK GMC number.
     [EntityType.HEALTHCARE_PROVIDER,
-        /(?<![A-Za-z0-9_])(?:agb-?code|lanr|bsnr|gmc(?:\s*(?:no|number|reg))?|big-?nummer|zorgverlener(?:snummer)?)(?:(?:[A-Za-z0-9_]|[^\x00-\x7F])*|\s+[^\s:.\-\d,;()\/]{2,20})\s*\)?\s*[:.\-]*\s*$/i],
+        /(?<![A-Za-z0-9_])(?:agb-?code|lanr|bsnr|gmc(?:\s*(?:no|number|reg))?|big(?:-?registratie)?-?(?:nummer|nr)|zorgverlener(?:snummer)?|lebenslange\s*arztnummer|betriebsst[äa]ttennummer|rpps|adeli|pwz)(?:(?:[A-Za-z0-9_]|[^\x00-\x7F])*|\s+[^\s:.\-\d,;()\/]{2,20})\s*\)?\s*[:.\-]*\s*$/i],
     // Company / trade register. "Companies House" and "Company Registration
     // Number" are written out: the tail allows a run-on *or* one qualifier word,
     // never a second word, so a three-word label needs to be spelled.
     [EntityType.CHAMBER_OF_COMMERCE,
-        /(?<![A-Za-z0-9_])(?:siren|siret|kbo|bce|kvk|ondernemingsnummer|ondernemingen\s+onder\s+nummer|kruispuntbank|numéro\s*d'entreprise|enterprise\s*number|handelsregister|companies\s*house(?:\s*(?:registration|reg|no|number))?|company\s*registration(?:\s*(?:number|no))?|company\s*(?:no|number|reg)|organisationsnummer|orgnr|i[čc]o|identifikační\s*číslo|ЕИК|eik|bulstat|cvr(?:-?nummer)?|virksomhedsnummer)(?:(?:[A-Za-z0-9_]|[^\x00-\x7F])*|\s+[^\s:.\-\d,;()\/]{2,20})\s*\)?\s*[:.\-]*\s*$/i],
+        /(?<![A-Za-z0-9_])(?:siren|siret|kbo|bce|kvk|ondernemingsnummer|ondernemingen\s+onder\s+nummer|kruispuntbank|numéro\s*d'entreprise|enterprise\s*number|handelsregister|companies\s*house(?:\s*(?:registration|reg|no|number))?|company\s*registration(?:\s*(?:number|no))?|company\s*(?:no|number|reg)|organisationsnummer|orgnr|i[čc]o|identifikační\s*číslo|ЕИК|eik|bulstat|cvr(?:-?nummer)?|virksomhedsnummer|regon|krs)(?:(?:[A-Za-z0-9_]|[^\x00-\x7F])*|\s+[^\s:.\-\d,;()\/]{2,20})\s*\)?\s*[:.\-]*\s*$/i],
     // VAT.
     [EntityType.VAT,
         /(?<![A-Za-z0-9_])(?:vat|btw|tva|ust|iva|moms|alv|mwst|dič|vsk)(?:(?:[A-Za-z0-9_.\-]|[^\x00-\x7F])*|\s+[^\s:.\-\d,;()\/]{2,20})\s*\)?\s*[:.\-]*\s*$/i],
@@ -130,6 +130,15 @@ export const CUES = [
     [EntityType.BANK_ACCOUNT,
         /(?<![A-Za-z0-9_])(?:sort\s*code|account\s*(?:no|number)|rekeningnummer|kontonummer|numéro\s*de\s*compte|sort-?code)(?:(?:[A-Za-z0-9_]|[^\x00-\x7F])*|\s+[^\s:.\-\d,;()\/]{2,20})\s*\)?\s*[:.\-]*\s*$/i],
     // Passport.
+    // Residence permit. No permit patterns exist, so a permit number was filed
+    // under whichever ID, passport or phone pattern fitted it (rules-engine#53).
+    // The tail admits the Belgian card category ("nr. B 565992336"), unmasked.
+    [EntityType.RESIDENCE_PERMIT,
+        /(?<![A-Za-z0-9_])(?:aufenthalts(?:titel|erlaubnis|karte|gestattung)|niederlassungs(?:erlaubnis|bewilligung)|verblijfs(?:vergunning|kaart|document|titel)|titre\s*de\s*s[ée]jour|carte\s*de\s*s[ée]jour|permis\s*de\s*s[ée]jour|carte\s*de\s*r[ée]sident|residence\s*(?:permit|card|document)|biometric\s*residence\s*permit|permesso\s*di\s*soggiorno|carta\s*di\s*soggiorno|kart(?:a|y|ę|ą)\s*pobytu(?:\s*cukr)?|naklejk(?:a|i|ę|ą)\s*wizow(?:a|ej|ą)|uppehållstillstånd|opholdstilladelse|oppholdstillatelse|oleskelulupa)(?:(?:[A-Za-z0-9_]|[^\x00-\x7F])*|\s+[^\s:.\-\d,;()\/]{2,20})\s*\)?\s*[:.\-]*\s*(?:[A-Z]\s+)?$/i],
+    // Driving licence: Polish labels; the document number has the passport
+    // shape, so without this cue it lost the span to the passport rule (rules-engine#77).
+    [EntityType.DRIVERS_LICENSE,
+        /(?<![A-Za-z0-9_])(?:(?:nr\s*dokumentu\s*)?(?:prawo|prawa|prawem)\s*jazdy|numer\s*blankietu\s*prawa\s*jazdy)(?:(?:[A-Za-z0-9_]|[^\x00-\x7F])*|\s+[^\s:.\-\d,;()\/]{2,20})\s*\)?\s*[:.\-]*\s*$/i],
     [EntityType.PASSPORT,
         /(?<![A-Za-z0-9_])(?:passport(?:\s*(?:no|number))?|paspoort(?:nummer)?|reisepass(?:nummer)?|passeport|passnummer)(?:(?:[A-Za-z0-9_]|[^\x00-\x7F])*|\s+[^\s:.\-\d,;()\/]{2,20})\s*\)?\s*[:.\-]*\s*$/i],
     // BIC / SWIFT.
@@ -146,7 +155,7 @@ export const CUES = [
     // only thing that identifies one, which is why the engine emits this type
     // from here and nowhere else.
     [EntityType.INTERNAL_ID,
-        /(?<![A-Za-z0-9_])(?:medarbejdernummer|ansattnummer|anställningsnummer|personalnummer|personeelsnummer|matricule\s*salarié|employee\s*(?:no|number|id)|badge(?:\s*(?:no|number))?|betriebsstätten(?:nr|nummer)|grundstücks(?:nr|nummer)|dossier-?(?:nr|nummer)|aktenzeichen|osobní\s*(?:číslo\s*)?zaměstnance)(?:(?:[A-Za-z0-9_]|[^\x00-\x7F])*|\s+[^\s:.\-\d,;()\/]{2,20})\s*\)?\s*[:.\-]*\s*$/i],
+        /(?<![A-Za-z0-9_])(?:medarbejdernummer|ansattnummer|anställningsnummer|personalnummer|personeelsnummer|matricule\s*salarié|employee\s*(?:no|number|id)|badge(?:\s*(?:no|number))?|betriebsstätten(?:nr|nummer)|grundstücks(?:nr|nummer)|dossier-?(?:nr|nummer)|aktenzeichen|schade(?:claim|nummer|dossier)|schadens?-?(?:nummer|nr)|num[ée]ro\s*de\s*sinistre|numero\s*(?:di\s*)?sinistro|n[úu]mero\s*de\s*siniestro|skade(?:nummer|sag)|claim\s*(?:no|number|id)|collar|osobní\s*(?:číslo\s*)?zaměstnance)(?:(?:[A-Za-z0-9_]|[^\x00-\x7F])*|\s+[^\s:.\-\d,;()\/]{2,20})\s*\)?\s*[:.\-]*\s*$/i],
     // Credential. Typed SECRET because that is the type this SDK has; the
     // training pipeline's report asks for CREDENTIAL, which does not exist here.
     [EntityType.SECRET,
@@ -192,6 +201,13 @@ const RETYPABLE = new Set([
  * "Betriebsstättennr. 260326822" both landed, each reported as Czech.
  */
 const RETYPABLE_UNCORROBORATED = new Set([EntityType.NATIONAL_ID]);
+/**
+ * Retypable to RESIDENCE_PERMIT by a permit label touching the span, whatever
+ * the country support: a German eAT number fits the identity-card pattern and a
+ * Dutch permit number the passport pattern (rules-engine#53). Not a Spanish
+ * NIE, which the canon keeps NATIONAL_ID.
+ */
+const RETYPABLE_BY_PERMIT_LABEL = new Set([EntityType.NATIONAL_ID, EntityType.PASSPORT]);
 /**
  * Types a label can assert on its own.
  *
@@ -205,7 +221,7 @@ export const CUE_TARGETS = new Set([
     EntityType.HEALTH_INSURANCE, EntityType.HEALTHCARE_PROVIDER,
     EntityType.CHAMBER_OF_COMMERCE, EntityType.VAT, EntityType.POSTAL_CODE,
     EntityType.PASSPORT, EntityType.INTERNAL_ID, EntityType.BANK_ACCOUNT,
-    EntityType.SECRET,
+    EntityType.SECRET, EntityType.RESIDENCE_PERMIT,
 ]);
 /**
  * Which of those a label may also *rescue* — re-admit after its checksum
@@ -242,13 +258,17 @@ export const RESCUE_TARGETS = new Set([
  * `countryScore` is the document's support for the country the winning pattern
  * came from; see RETYPABLE_UNCORROBORATED.
  */
-export function retypedBy(text, start, entityType, countryScore) {
+export function retypedBy(text, start, entityType, countryScore, country = null) {
     const type = String(entityType);
-    if (!RETYPABLE.has(type)
-        && !(RETYPABLE_UNCORROBORATED.has(type) && countryScore === 0))
+    const general = RETYPABLE.has(type)
+        || (RETYPABLE_UNCORROBORATED.has(type) && countryScore === 0);
+    const byPermit = RETYPABLE_BY_PERMIT_LABEL.has(type) && country !== "ES";
+    if (!general && !byPermit)
         return null;
     const cued = cuedType(text, start);
     if (cued === null || cued === entityType || !CUE_TARGETS.has(String(cued)))
         return null;
+    if (!general && cued !== EntityType.RESIDENCE_PERMIT)
+        return null;
     return cued;
 }