@eifi1/ui-kit 0.20.1 → 0.22.0

package/src/index.ts

@@ -111,8 +111,25 @@ export * from "./components/disclosure";
 export * from "./components/dialog-frame";
 // Named, not `*`: danger-confirm also holds the password field and pending hook that
 // ReauthDialog shares with it, which are kit-internal.
-export { DangerConfirm, DEFAULT_DANGER_CONFIRM_LABELS, typedMatches } from "./components/danger-confirm";
-export type { DangerConfirmLabels, DangerConfirmProps, TypedMatch } from "./components/danger-confirm";
+export {
+  DangerConfirm,
+  DEFAULT_DANGER_CONFIRM_LABELS,
+  typedMatches,
+  // 0.22.0: the typed-confirmation field on its own (keksdose K7) and the current-password
+  // field kastlan wants for sign-in and re-authentication (kastlan 1).
+  TypedConfirmField,
+  CurrentPasswordInput,
+} from "./components/danger-confirm";
+export type {
+  DangerConfirmLabels,
+  DangerConfirmProps,
+  TypedMatch,
+  DangerConsequence,
+  TypedConfirmFieldProps,
+  TypedConfirmFieldLabels,
+  CurrentPasswordInputProps,
+  CurrentPasswordInputLabels,
+} from "./components/danger-confirm";
 // 0.18: re-authentication before a sensitive action (Kurvenschmiede 4).
 export { ReauthDialog, DEFAULT_REAUTH_DIALOG_LABELS } from "./components/reauth-dialog";
 export type { ReauthDialogProps, ReauthDialogLabels } from "./components/reauth-dialog";
@@ -259,8 +276,9 @@ export * from "./components/data-table-pagination";
 export { FilterPopover } from "./components/data-table-filter-popover";
 // data-table re-exports SortState internally; export the rest explicitly to
 // avoid a duplicate SortState star-export (it comes from data-table-sort).
-export { DataTable } from "./components/data-table";
+export { DataTable, DEFAULT_DATA_TABLE_SORT_LABELS } from "./components/data-table";
 export type {
+  DataTableSortLabels,
   DataTableColumn,
   DataTableCellProps,
   DataTableHeadProps,
@@ -406,3 +424,35 @@ export type {
 // The legal pages' shell (0.19, H10): Imprint, Privacy Policy, Terms in every app.
 export { LegalLayout, LegalSection, LegalLinks, DEFAULT_LEGAL_LABELS } from "./components/legal";
 export type { LegalLabels, LegalLink, LegalLinksProps, LegalSectionProps, LegalLayoutProps } from "./components/legal";
+
+// ── 0.22.0: the inputs round (kastlan's, keksdose's and Kurvenschmiede's audits) ──
+export * from "./components/checkbox-group";
+export * from "./components/one-time-code-input";
+export * from "./components/language-select";
+export * from "./components/tile-radio";
+export * from "./components/inline-edit-field";
+export * from "./components/sign-chip";
+export * from "./components/country-select";
+export { COUNTRY_CODES, countryName } from "./lib/countries";
+export * from "./components/iban-input";
+export {
+  IBAN_LENGTHS,
+  compactIban,
+  formatIban,
+  ibanCheckDigits,
+  ibanProblem,
+  isValidIban,
+  isQrIban,
+} from "./lib/iban";
+export type { IbanKind, IbanProblem } from "./lib/iban";
+export { formatIsin, isinCheckDigit, isValidIsin } from "./lib/isin";
+export * from "./components/phone-input";
+export {
+  PHONE_DIAL_CODES,
+  PHONE_COUNTRIES,
+  parsePhone,
+  formatNationalPhone,
+  formatPhone,
+  isE164,
+} from "./lib/phone";
+export type { PhoneCountryCode, PhoneCountry, ParsedPhone } from "./lib/phone";

package/src/lib/countries.ts

@@ -0,0 +1,91 @@
+/**
+ * Countries as ISO 3166-1 alpha-2 codes, named by the runtime — for {@link CountrySelect}
+ * and for an app that shows the code it stored ("CH") as a name somewhere else (a
+ * table cell, an address line).
+ *
+ * The kit ships CODES, not names. Every runtime the kit supports has
+ * `Intl.DisplayNames({ type: "region" })`, which names all of these in every locale
+ * the browser knows — so a table of 249 names per language would be a large file
+ * that is out of date the day a country is renamed (Türkiye, Czechia, Eswatini) and
+ * still covers fewer languages than the browser does. What is left to ship is the
+ * list of which codes ARE countries, and that is one string.
+ */
+
+/**
+ * Every officially assigned ISO 3166-1 alpha-2 code — the 249 countries, territories
+ * and areas of the standard, upper-case, in code order.
+ *
+ * User-assigned codes are deliberately not in it: `XK` (Kosovo) is a widespread
+ * convention, not ISO, and whether to offer it is the app's decision. An app that
+ * wants it passes its own list to `CountrySelect`'s `countries` — the runtime names
+ * `XK` as well.
+ */
+export const COUNTRY_CODES: readonly string[] = Object.freeze(
+  (
+    "AD AE AF AG AI AL AM AO AQ AR AS AT AU AW AX AZ BA BB BD BE BF BG BH BI BJ BL BM BN BO BQ " +
+    "BR BS BT BV BW BY BZ CA CC CD CF CG CH CI CK CL CM CN CO CR CU CV CW CX CY CZ DE DJ DK DM " +
+    "DO DZ EC EE EG EH ER ES ET FI FJ FK FM FO FR GA GB GD GE GF GG GH GI GL GM GN GP GQ GR GS " +
+    "GT GU GW GY HK HM HN HR HT HU ID IE IL IM IN IO IQ IR IS IT JE JM JO JP KE KG KH KI KM KN " +
+    "KP KR KW KY KZ LA LB LC LI LK LR LS LT LU LV LY MA MC MD ME MF MG MH MK ML MM MN MO MP MQ " +
+    "MR MS MT MU MV MW MX MY MZ NA NC NE NF NG NI NL NO NP NR NU NZ OM PA PE PF PG PH PK PL PM " +
+    "PN PR PS PT PW PY QA RE RO RS RU RW SA SB SC SD SE SG SH SI SJ SK SL SM SN SO SR SS ST SV " +
+    "SX SY SZ TC TD TF TG TH TJ TK TL TM TN TO TR TT TV TW TZ UA UG UM US UY UZ VA VC VE VG VI " +
+    "VN VU WF WS YE YT ZA ZM ZW"
+  ).split(" "),
+);
+
+/** Two ASCII letters — the shape of an alpha-2 code, whatever the case. */
+const ALPHA_2 = /^[A-Za-z]{2}$/;
+
+/** `code` upper-cased when it has the shape of an alpha-2 code, else `undefined`. Does
+ *  not check that ISO assigned it — see {@link COUNTRY_CODES} for why `XK` must pass. */
+export function normalizeCountryCode(code: string | null | undefined): string | undefined {
+  return code && ALPHA_2.test(code) ? code.toUpperCase() : undefined;
+}
+
+// One `DisplayNames` per locale, built on first use. `null` records a locale the
+// runtime refused (a malformed tag) or a runtime without the API, so neither is
+// retried for every row of a 249-row list.
+const namers = new Map<string, Intl.DisplayNames | null>();
+
+function namer(locale: string): Intl.DisplayNames | null {
+  let n = namers.get(locale);
+  if (n === undefined) {
+    try {
+      n = new Intl.DisplayNames([locale], { type: "region", fallback: "code" });
+    } catch {
+      n = null;
+    }
+    namers.set(locale, n);
+  }
+  return n;
+}
+
+/**
+ * The name of the country `code` stands for, in `locale` — `countryName("CH", "de-CH")`
+ * is "Schweiz". Falls back to the upper-cased code itself when the runtime has no name
+ * for it, rejects the locale, or has no `Intl.DisplayNames`: a code is still the right
+ * answer, where an empty cell would not be.
+ *
+ * `locale` defaults to English rather than to the runtime's language, the rule the
+ * kit's currency names follow (`currencyName`): an app that never set a locale reads
+ * the kit's English everywhere else, and a country list in the browser's language
+ * beside English labels — or in the test runner's — is two languages on one form.
+ *
+ * The code is upper-cased first. `DisplayNames` is case-sensitive about it in some
+ * runtimes (Node answers "ch" with "ch"), and the codes reach this from forms,
+ * URLs and databases in either case.
+ */
+export function countryName(code: string, locale: string = "en"): string {
+  const upper = code.toUpperCase();
+  const n = namer(locale);
+  if (n) {
+    try {
+      const name = n.of(upper);
+      if (name) return name;
+    } catch {
+      // Not a well-formed region subtag ("C1", "") — the code is all there is.
+    }
+  }
+  return upper;
+}

package/src/lib/decimal-marks.ts

@@ -0,0 +1,99 @@
+/**
+ * The locale's decimal mark and the reading of typed grouping marks, shared by the
+ * kit's numeric text fields: {@link AmountInput}, {@link NumberInput} and, through
+ * NumberInput, {@link NumberField} and {@link MoneyField}.
+ *
+ * Package-private — not re-exported from the barrel. It lives here rather than in
+ * `calc.ts` because that module is re-exported wholesale (`export * from
+ * "./lib/calc"`), and these are the fields' plumbing, not API.
+ *
+ * WHY ONE MODULE. AmountInput learned the locale's mark (kastlan 40) and the grouping
+ * parse (keksdose G1); NumberInput learned neither, so the same "1.234,56" a German
+ * user typed into a money field read as 1234.56 and, typed into the budget-goal field
+ * next to it, as 1.23456 (keksdose K5). Two private copies of the same rule are how
+ * that happened, so the rule now has one home.
+ */
+import { sanitizeLive } from "./calc";
+
+/**
+ * The locale's decimal mark, as far as a field can type it: "," or "." (kastlan 40).
+ * A mark outside those two (Arabic's "٫") is not one {@link sanitizeLive} lets
+ * through, so those locales keep the dot rather than get a field that eats the key it
+ * shows. `undefined` is the runtime's own locale, which is what `Intl` reads it as.
+ */
+export function decimalMark(locale: string | undefined): "," | "." {
+  try {
+    const part = new Intl.NumberFormat(locale).formatToParts(1.5).find((p) => p.type === "decimal");
+    return part?.value === "," ? "," : ".";
+  } catch {
+    // An invalid tag throws a RangeError; a typo in a locale must not take the form down.
+    return ".";
+  }
+}
+
+/**
+ * Which typed mark is the decimal one (keksdose G1). {@link sanitizeLive} folds every
+ * "," into ".", so on its own it read the German "1.234,56" as 1.23456 — and a money
+ * field's settle then made that 1.23, final. This decides per operand, from the
+ * typist's own text, before that fold:
+ *
+ * - both marks present: the one that is not the locale's is grouping, and goes;
+ * - in a "," locale, only "." present: grouping when it cannot be a decimal as a
+ *   German reader writes it — twice ("1.234.567"), or in thousands shape ("1.234",
+ *   "12.500") — otherwise a decimal ("1.5", typed by a dot-decimal habit);
+ * - in a "." locale, only "," present: grouping when it appears twice ("1,234,567");
+ *   once it stays a decimal, because Swiss and German typists write "1,5" in a
+ *   de-CH form (kastlan 40) and a unit price "1,789" is a decimal.
+ *
+ * Only a keystroke's text comes through here. A calculator result is dot-decimal
+ * already, and "1.234" from `100/81.03…` is never a thousand.
+ */
+export function normalizeTypedMarks(raw: string, mark: "," | "."): string {
+  const other = mark === "," ? "." : ",";
+  return raw.replace(/[0-9.,]+/g, (operand) => {
+    const hasMark = operand.includes(mark);
+    const count = operand.split(other).length - 1;
+    if (count === 0) return operand;
+    const grouping = hasMark
+      ? true
+      : count > 1 || (mark === "," && /^\d{1,3}(\.\d{3})+$/.test(operand));
+    return grouping ? operand.split(other).join("") : operand;
+  });
+}
+
+/** What a keystroke's raw text reports: grouping read off, then the field's live
+ *  sanitising (comma → dot, stray characters out, one decimal point per operand). */
+export function readTyped(raw: string, mark: "," | "."): string {
+  return sanitizeLive(normalizeTypedMarks(raw, mark));
+}
+
+// Spacing a typist uses to group digits — a space, the no-break and narrow no-break
+// spaces `Intl` itself writes for fr-CH ("1 234,5" with U+202F), and the Swiss
+// apostrophes ("1'234.50"). The live sanitising drops them, so they never reach the
+// value; the draft may still show them.
+const GROUP_SPACING = /[\s'’\u00a0\u202f]/g;
+
+/**
+ * Whether the field may keep SHOWING `raw` — the typist's own text — while it holds
+ * `canonical` (dot-decimal, as `onChange` reported it).
+ *
+ * Showing the typed text rather than re-spelling the value is what keeps the caret
+ * where the typist put it, and what keeps a grouping "." from being turned into a ","
+ * under their fingers — after which no rule could tell the two apart (keksdose G1).
+ * But only text that says the same as the value, and says it with nothing the field
+ * would have DROPPED: a letter, or a second decimal point in one operand ("1.2.3"),
+ * must not stay on screen while the value says "1.23" (Keksdose live #201 is the bug
+ * that showing it would bring back). Grouping marks and grouping spaces may stay.
+ */
+export function showsTyped(raw: string, mark: "," | ".", canonical: string): boolean {
+  const read = normalizeTypedMarks(raw, mark).replace(GROUP_SPACING, "");
+  const sanitized = sanitizeLive(read);
+  // Nothing dropped: the read text is the sanitised one, but for which mark it uses.
+  return sanitized === read.replace(/,/g, ".") && sanitized === sanitizeLive(canonical);
+}
+
+/** A dot-decimal text spelt in `mark` — display only, one character for one, so a
+ *  re-spelling never moves a caret. */
+export function localizeMark(text: string, mark: "," | "."): string {
+  return mark === "," ? text.replace(/\./g, ",") : text;
+}

package/src/lib/iban.ts

@@ -0,0 +1,171 @@
+/**
+ * IBAN helpers — ISO 13616 — for kastlan (supplier and customer bank details, the
+ * Swiss QR-bill) and keksdose (the accounts behind a household's transfers).
+ *
+ * Both apps validated an IBAN the same partial way: a regex for the shape, sometimes a
+ * mod-97, never the per-country length — so a Swiss IBAN with a digit missing passed
+ * as long as the shorter string happened to sum right, and "CH" followed by 22
+ * characters (a German length) was accepted as Swiss. And kastlan's QR-bill needs a
+ * second distinction neither had: a **QR-IBAN** (the institution id at positions 5–9 is
+ * 30000–31999) is the only account a QR-bill with a QR reference can be paid to, and it
+ * cannot receive an ordinary transfer — so a regular IBAN typed where a QR-IBAN is
+ * needed, or the other way round, is a payment that bounces weeks later.
+ *
+ * Everything here works on the **electronic format** (no spaces, upper case), which is
+ * what to store; {@link formatIban} is the paper format, which is what to show.
+ *
+ * Validation is the registry's two rules, nothing more: the length for the country and
+ * the mod-97 check digits. It does not check each country's BBAN layout (which places
+ * hold letters), nor whether the bank exists — a checksum catches a typo, not a closed
+ * account.
+ */
+
+/**
+ * The IBAN length for each country in the SWIFT IBAN Registry (2025 edition) — the
+ * whole string, country code and check digits included.
+ *
+ * A country that is not in the table does not issue IBANs, so {@link isValidIban}
+ * refuses it ("XX" is a typo, not an exotic bank). Territories that use another
+ * country's code (Åland under FI, Guernsey under GB, the French overseas departments
+ * under FR) are covered by that code, as the registry lists them.
+ */
+export const IBAN_LENGTHS: Readonly<Record<string, number>> = Object.freeze({
+  AD: 24, AE: 23, AL: 28, AT: 20, AZ: 28, BA: 20, BE: 16, BG: 22, BH: 22, BI: 27,
+  BR: 29, BY: 28, CH: 21, CR: 22, CY: 28, CZ: 24, DE: 22, DJ: 27, DK: 18, DO: 28,
+  EE: 20, EG: 29, ES: 24, FI: 18, FK: 18, FO: 18, FR: 27, GB: 22, GE: 22, GI: 23,
+  GL: 18, GR: 27, GT: 28, HN: 28, HR: 21, HU: 28, IE: 22, IL: 23, IQ: 23, IS: 26,
+  IT: 27, JO: 30, KW: 30, KZ: 20, LB: 28, LC: 32, LI: 21, LT: 20, LU: 20, LV: 21,
+  LY: 25, MC: 27, MD: 24, ME: 22, MK: 19, MN: 20, MR: 27, MT: 31, MU: 30, NI: 28,
+  NL: 18, NO: 15, OM: 23, PK: 24, PL: 28, PS: 29, PT: 25, QA: 29, RO: 24, RS: 22,
+  RU: 33, SA: 24, SC: 31, SD: 18, SE: 24, SI: 19, SK: 24, SM: 27, SO: 23, ST: 25,
+  SV: 28, TL: 23, TN: 24, TR: 26, UA: 29, VA: 22, VG: 24, XK: 20, YE: 30,
+});
+
+/**
+ * Which kind of IBAN a field accepts. `"any"`: every valid IBAN. `"qr"`: only a
+ * QR-IBAN (a QR-bill with a QR reference — kastlan's payment slips). `"plain"`: every
+ * valid IBAN EXCEPT a QR-IBAN (an account for ordinary transfers, which a QR-IBAN
+ * cannot receive).
+ */
+export type IbanKind = "qr" | "plain" | "any";
+
+/**
+ * Why a value is not the IBAN a field wants, most fundamental first:
+ *
+ *  - `"format"` — it does not start with a two-letter country code and two digits;
+ *  - `"country"` — the first two letters are not a country in {@link IBAN_LENGTHS};
+ *  - `"length"` — the wrong number of characters for that country;
+ *  - `"checksum"` — the mod-97 check digits do not match (a typo, a swapped pair);
+ *  - `"qrRequired"` — a valid IBAN, but not a QR-IBAN where `kind="qr"` needs one;
+ *  - `"qrNotAllowed"` — a valid QR-IBAN where `kind="plain"` refuses one.
+ */
+export type IbanProblem = "format" | "country" | "length" | "checksum" | "qrRequired" | "qrNotAllowed";
+
+/**
+ * The electronic format: every character that is not a letter or a digit dropped, the
+ * letters in upper case. Spaces, non-breaking spaces, hyphens and dots — what a paste
+ * from an invoice, a PDF or an e-banking screen carries — all go.
+ *
+ * A leading `"IBAN"` (the paper format's label: "IBAN CH56 …") is dropped too, but only
+ * in front of a country code and check digits, so typing the word does not make it
+ * vanish under the caret.
+ */
+export function compactIban(value: string): string {
+  const compact = value.replace(/[^0-9A-Za-z]/g, "").toUpperCase();
+  return /^IBAN[A-Z]{2}\d{2}/.test(compact) ? compact.slice(4) : compact;
+}
+
+/**
+ * The paper format: {@link compactIban}, then groups of four separated by a single
+ * space ("CH09 0000 0000 0000 0000 1"). The last group is whatever is left over.
+ */
+export function formatIban(value: string): string {
+  return compactIban(value).replace(/(.{4})(?=.)/g, "$1 ");
+}
+
+/** The remainder of a long digit string modulo 97, a few digits at a time so it never
+ *  leaves the safe-integer range — ISO 7064 MOD 97-10 without a BigInt. */
+function mod97(digits: string): number {
+  let rest = 0;
+  for (let i = 0; i < digits.length; i += 7) {
+    rest = Number(`${rest}${digits.slice(i, i + 7)}`) % 97;
+  }
+  return rest;
+}
+
+/** Letters to their two-digit numbers (A = 10 … Z = 35), digits as they are. */
+function expandLetters(value: string): string {
+  return value.replace(/[A-Z]/g, (c) => String(c.charCodeAt(0) - 55));
+}
+
+/**
+ * The two check digits for a country code and a BBAN (the account part after them):
+ * `98 − ((BBAN + country + "00") mod 97)`, letters expanded A = 10 … Z = 35.
+ *
+ * What an app needs to BUILD an IBAN — a test fixture, a demo, a migration that
+ * assembles one from a clearing number and an account number — rather than to check
+ * one. Both arguments are compacted first.
+ */
+export function ibanCheckDigits(country: string, bban: string): string {
+  const rearranged = `${compactIban(bban)}${compactIban(country)}00`;
+  const check = 98 - mod97(expandLetters(rearranged));
+  return String(check).padStart(2, "0");
+}
+
+/**
+ * The first thing wrong with `value` as an IBAN of `kind`, or `null` when it is one.
+ * The value is compacted first, so the paper format is accepted. An empty value is
+ * `"format"`: whether a field may be left empty is the form's rule, not the IBAN's.
+ */
+export function ibanProblem(value: string, kind: IbanKind = "any"): IbanProblem | null {
+  const iban = compactIban(value);
+  if (!/^[A-Z]{2}\d{2}/.test(iban)) return "format";
+  const expected = IBAN_LENGTHS[iban.slice(0, 2)];
+  if (expected === undefined) return "country";
+  if (iban.length !== expected) return "length";
+  // 00, 01 and 99 are never computed (98 − r lies in 2…98), but 01 ≡ 98 mod 97 and
+  // would otherwise pass the remainder test below — ISO 7064 rules them out.
+  const check = iban.slice(2, 4);
+  if (check === "00" || check === "01" || check === "99") return "checksum";
+  if (mod97(expandLetters(`${iban.slice(4)}${iban.slice(0, 4)}`)) !== 1) return "checksum";
+  if (kind === "any") return null;
+  const qr = qrIid(iban);
+  if (kind === "qr" && !qr) return "qrRequired";
+  if (kind === "plain" && qr) return "qrNotAllowed";
+  return null;
+}
+
+/**
+ * Whether `value` is a valid IBAN: a registry country, that country's length, and
+ * matching mod-97 check digits. Spaces and lower case are fine (see
+ * {@link compactIban}); what to store is the compact form.
+ */
+export function isValidIban(value: string): boolean {
+  return ibanProblem(value) === null;
+}
+
+/** A CH/LI IBAN whose institution id (positions 5–9) is in the QR range. Structure
+ *  only — the caller has checked or will check the rest. */
+function qrIid(iban: string): boolean {
+  const country = iban.slice(0, 2);
+  if (country !== "CH" && country !== "LI") return false;
+  const iid = iban.slice(4, 9);
+  if (!/^\d{5}$/.test(iid)) return false;
+  const n = Number(iid);
+  return n >= 30000 && n <= 31999;
+}
+
+/**
+ * Whether `value` is a valid **QR-IBAN**: a valid Swiss or Liechtenstein IBAN whose
+ * institution id — positions 5 to 9, the QR-IID — lies in 30000–31999 (SIX, Swiss
+ * Implementation Guidelines for the QR-bill).
+ *
+ * The distinction is not cosmetic (kastlan): a QR-bill with a QR reference can only be
+ * paid to a QR-IBAN, and a QR-IBAN can receive nothing else — so an app that prints
+ * payment slips needs one, and an app that stores an account for ordinary transfers
+ * must not take one.
+ */
+export function isQrIban(value: string): boolean {
+  const iban = compactIban(value);
+  return ibanProblem(iban) === null && qrIid(iban);
+}

package/src/lib/isin.ts

@@ -0,0 +1,62 @@
+/**
+ * ISIN helpers — ISO 6166 — for keksdose, whose securities holdings are keyed by ISIN
+ * and whose import and edit forms checked only the shape (two letters, ten
+ * characters): a mistyped ISIN saved happily and then matched no price feed.
+ *
+ * An ISIN is twelve characters: a two-letter prefix (the issuing country, or a
+ * supranational code such as `XS`), nine letters or digits (the national number) and
+ * one check digit. The check digit is the Luhn digit of the first eleven characters
+ * with every letter expanded to two digits (A = 10 … Z = 35) — which is all that is
+ * checked here. Whether the prefix is an assigned code, and whether the security
+ * exists, is a lookup, not a checksum.
+ */
+
+/** Letters to their two-digit numbers (A = 10 … Z = 35), digits as they are. */
+function expandLetters(value: string): string {
+  return value.replace(/[A-Z]/g, (c) => String(c.charCodeAt(0) - 55));
+}
+
+/** The Luhn sum of `digits` with the RIGHTMOST digit doubled first — the shape of the
+ *  sum when a check digit is about to be appended. */
+function luhnSum(digits: string, doubleRightmost: boolean): number {
+  let sum = 0;
+  let double = doubleRightmost;
+  for (let i = digits.length - 1; i >= 0; i--) {
+    let d = digits.charCodeAt(i) - 48;
+    if (double) {
+      d *= 2;
+      if (d > 9) d -= 9;
+    }
+    sum += d;
+    double = !double;
+  }
+  return sum;
+}
+
+/**
+ * The ISIN as it is printed: upper case, unbroken (ISO 6166 has no grouping), with
+ * the spaces and hyphens a paste from a broker's statement carries dropped.
+ */
+export function formatIsin(value: string): string {
+  return value.replace(/[\s-]/g, "").toUpperCase();
+}
+
+/**
+ * The check digit for the first eleven characters of an ISIN (prefix and national
+ * number). For BUILDING one — a test fixture, a demo — rather than checking it.
+ */
+export function isinCheckDigit(body: string): string {
+  const sum = luhnSum(expandLetters(formatIsin(body)), true);
+  return String((10 - (sum % 10)) % 10);
+}
+
+/**
+ * Whether `value` is a valid ISIN: two letters, nine letters or digits, one digit,
+ * and a matching Luhn check digit over the letter-expanded form. Spaces, hyphens and
+ * lower case are fine (see {@link formatIsin}).
+ */
+export function isValidIsin(value: string): boolean {
+  const isin = formatIsin(value);
+  if (!/^[A-Z]{2}[A-Z0-9]{9}\d$/.test(isin)) return false;
+  return luhnSum(expandLetters(isin), false) % 10 === 0;
+}