euredact 0.2.0 → 0.3.0

package/dist/cjs/rules/validators.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VALIDATORS = void 0;
+exports.VALIDATORS = exports.ISO_3166_ALPHA2 = exports.IBAN_LENGTHS = void 0;
 exports.validateIban = validateIban;
 exports.validateBsn = validateBsn;
 exports.validateBelgianNn = validateBelgianNn;
@@ -14,6 +14,7 @@ exports.validateGermanTaxId = validateGermanTaxId;
 exports.validateFrenchNir = validateFrenchNir;
 exports.validateVin = validateVin;
 exports.validateBic = validateBic;
+exports.validateE164 = validateE164;
 exports.validateKvk = validateKvk;
 exports.validateSwedishPnr = validateSwedishPnr;
 exports.validateNorwegianFnr = validateNorwegianFnr;
@@ -46,21 +47,45 @@ exports.validateGreekAmka = validateGreekAmka;
 function clean(candidate, chars = /[\s.\-]/g) {
     return candidate.replace(chars, "");
 }
+/**
+ * Total IBAN length per country (ISO 13616 registry). Also used to build the
+ * country-independent IBAN pattern in rules/countries, so an IBAN is detected
+ * on its own structure rather than on the caller's `countries` setting.
+ */
+exports.IBAN_LENGTHS = {
+    AL: 28, AD: 24, AT: 20, AZ: 28, BH: 22, BY: 28, BE: 16, BA: 20, BR: 29, BG: 22, CR: 22, HR: 21,
+    CY: 28, CZ: 24, DK: 18, DO: 28, TL: 23, EE: 20, FO: 18, FI: 18, FR: 27, GE: 22, DE: 22, GI: 23,
+    GR: 27, GL: 18, GT: 28, HU: 28, IS: 26, IQ: 23, IE: 22, IL: 23, IT: 27, JO: 30, KZ: 20, XK: 20,
+    KW: 30, LV: 21, LB: 28, LI: 21, LT: 20, LU: 20, MT: 31, MR: 27, MU: 30, MC: 27, MD: 24, ME: 22,
+    NL: 18, MK: 19, NO: 15, PK: 24, PS: 29, PL: 28, PT: 25, QA: 29, RO: 24, LC: 32, SM: 27, SA: 24,
+    RS: 22, SC: 31, SK: 24, SI: 19, ES: 24, SE: 24, CH: 21, TN: 24, TR: 26, UA: 29, AE: 23, GB: 22,
+    VA: 22, VG: 24,
+};
+/** ISO 3166-1 alpha-2 codes, plus XK (Kosovo, user-assigned but in banking use). */
+exports.ISO_3166_ALPHA2 = new Set([
+    "AD", "AE", "AF", "AG", "AI", "AL", "AM", "AO", "AQ", "AR", "AS", "AT", "AU", "AW", "AX", "AZ",
+    "BA", "BB", "BD", "BE", "BF", "BG", "BH", "BI", "BJ", "BL", "BM", "BN", "BO", "BQ", "BR", "BS",
+    "BT", "BV", "BW", "BY", "BZ", "CA", "CC", "CD", "CF", "CG", "CH", "CI", "CK", "CL", "CM", "CN",
+    "CO", "CR", "CU", "CV", "CW", "CX", "CY", "CZ", "DE", "DJ", "DK", "DM", "DO", "DZ", "EC", "EE",
+    "EG", "EH", "ER", "ES", "ET", "FI", "FJ", "FK", "FM", "FO", "FR", "GA", "GB", "GD", "GE", "GF",
+    "GG", "GH", "GI", "GL", "GM", "GN", "GP", "GQ", "GR", "GS", "GT", "GU", "GW", "GY", "HK", "HM",
+    "HN", "HR", "HT", "HU", "ID", "IE", "IL", "IM", "IN", "IO", "IQ", "IR", "IS", "IT", "JE", "JM",
+    "JO", "JP", "KE", "KG", "KH", "KI", "KM", "KN", "KP", "KR", "KW", "KY", "KZ", "LA", "LB", "LC",
+    "LI", "LK", "LR", "LS", "LT", "LU", "LV", "LY", "MA", "MC", "MD", "ME", "MF", "MG", "MH", "MK",
+    "ML", "MM", "MN", "MO", "MP", "MQ", "MR", "MS", "MT", "MU", "MV", "MW", "MX", "MY", "MZ", "NA",
+    "NC", "NE", "NF", "NG", "NI", "NL", "NO", "NP", "NR", "NU", "NZ", "OM", "PA", "PE", "PF", "PG",
+    "PH", "PK", "PL", "PM", "PN", "PR", "PS", "PT", "PW", "PY", "QA", "RE", "RO", "RS", "RU", "RW",
+    "SA", "SB", "SC", "SD", "SE", "SG", "SH", "SI", "SJ", "SK", "SL", "SM", "SN", "SO", "SR", "SS",
+    "ST", "SV", "SX", "SY", "SZ", "TC", "TD", "TF", "TG", "TH", "TJ", "TK", "TL", "TM", "TN", "TO",
+    "TR", "TT", "TV", "TW", "TZ", "UA", "UG", "UM", "US", "UY", "UZ", "VA", "VC", "VE", "VG", "VI",
+    "VN", "VU", "WF", "WS", "XK", "YE", "YT", "ZA", "ZM", "ZW",
+]);
 function validateIban(candidate) {
     const c = candidate.replace(/[\s\-]/g, "").toUpperCase();
     if (c.length < 5 || !/^[A-Z]{2}/.test(c) || !/^\d{2}$/.test(c.slice(2, 4)))
         return false;
-    const ibanLengths = {
-        AL: 28, AD: 24, AT: 20, AZ: 28, BH: 22, BY: 28, BE: 16, BA: 20, BR: 29, BG: 22, CR: 22, HR: 21,
-        CY: 28, CZ: 24, DK: 18, DO: 28, TL: 23, EE: 20, FO: 18, FI: 18, FR: 27, GE: 22, DE: 22, GI: 23,
-        GR: 27, GL: 18, GT: 28, HU: 28, IS: 26, IQ: 23, IE: 22, IL: 23, IT: 27, JO: 30, KZ: 20, XK: 20,
-        KW: 30, LV: 21, LB: 28, LI: 21, LT: 20, LU: 20, MT: 31, MR: 27, MU: 30, MC: 27, MD: 24, ME: 22,
-        NL: 18, MK: 19, NO: 15, PK: 24, PS: 29, PL: 28, PT: 25, QA: 29, RO: 24, LC: 32, SM: 27, SA: 24,
-        RS: 22, SC: 31, SK: 24, SI: 19, ES: 24, SE: 24, CH: 21, TN: 24, TR: 26, UA: 29, AE: 23, GB: 22,
-        VA: 22, VG: 24,
-    };
     const country = c.slice(0, 2);
-    const expected = ibanLengths[country];
+    const expected = exports.IBAN_LENGTHS[country];
     if (expected !== undefined && c.length !== expected)
         return false;
     const rearranged = c.slice(4) + c.slice(0, 4);
@@ -206,13 +231,22 @@ function validateVin(candidate) {
         return false;
     return !/[IOQ]/.test(c);
 }
+/**
+ * BIC/SWIFT structural validation (ISO 9362): BBBB CC LL (PPP).
+ *
+ * Necessary but **not sufficient** — BIC has no check digit, and characters
+ * 5-6 of ordinary uppercase words are frequently valid country codes
+ * (`DRINGEND` -> `GE`, `HOSPITAL` -> `IT`). Emission additionally requires a
+ * registry hit or banking context; see `suppressBicWithoutEvidence`.
+ */
 function validateBic(candidate) {
     const c = candidate.replace(/ /g, "").toUpperCase();
     if (c.length !== 8 && c.length !== 11)
         return false;
     if (!/^[A-Z]{4}/.test(c))
         return false;
-    if (!/^[A-Z]{2}$/.test(c.slice(4, 6)))
+    // Country code must be a real ISO 3166-1 alpha-2 code
+    if (!exports.ISO_3166_ALPHA2.has(c.slice(4, 6)))
         return false;
     if (!/^[A-Z0-9]{2}$/.test(c.slice(6, 8)))
         return false;
@@ -220,6 +254,21 @@ function validateBic(candidate) {
         return false;
     return true;
 }
+/**
+ * International phone number in E.164 form: `+` then 8-15 digits.
+ *
+ * A `+` prefix makes a phone number self-identifying, so this backs a
+ * country-independent pattern: the per-country patterns each hard-code one
+ * grouping and miss the others (`+43 664 8213 907` was invisible because the
+ * Austrian pattern expects an unbroken subscriber number).
+ */
+function validateE164(candidate) {
+    if (!candidate.trimStart().startsWith("+"))
+        return false;
+    // A trunk prefix written as "(0)" is not part of the E.164 digit count.
+    const digits = candidate.replace(/\(\s*0\s*\)/g, "").replace(/\D/g, "");
+    return digits.length >= 8 && digits.length <= 15;
+}
 function validateKvk(candidate) {
     const c = clean(candidate);
     return c.length === 8 && /^\d{8}$/.test(c);
@@ -666,6 +715,7 @@ exports.VALIDATORS = {
     french_nir: validateFrenchNir,
     vin: validateVin,
     bic: validateBic,
+    e164: validateE164,
     kvk: validateKvk,
     swedish_pnr: validateSwedishPnr,
     norwegian_fnr: validateNorwegianFnr,

package/dist/cjs/sdk.js

@@ -17,16 +17,36 @@ class ReferentialMapper {
         }
         return this.mapping.get(text);
     }
+    clear() {
+        this.counters.clear();
+        this.mapping.clear();
+    }
 }
+const DEFAULT_MAX_INPUT_LENGTH = 10_485_760; // ~10 MB of text
 class EuRedact {
     engine = new engine_js_1.RuleEngine();
     cache = new cache_js_1.ResultCache();
     referentialMapper = new ReferentialMapper();
+    maxInputLength;
+    constructor(options) {
+        this.maxInputLength = options?.maxInputLength ?? DEFAULT_MAX_INPUT_LENGTH;
+    }
     addCustomPattern(name, pattern) {
         this.engine.addCustomPattern(name, pattern);
         this.cache.clear();
     }
+    /** Clear the result cache and referential integrity mappings.
+     *  Call this in long-running processes to free PII from memory. */
+    clear() {
+        this.cache.clear();
+        this.referentialMapper.clear();
+    }
     redact(text, options = {}) {
+        if (text.length > this.maxInputLength) {
+            throw new Error(`Input text length (${text.length.toLocaleString()} chars) exceeds the maximum ` +
+                `(${this.maxInputLength.toLocaleString()} chars). Split the input or ` +
+                `increase maxInputLength when constructing EuRedact.`);
+        }
         const { countries = null, mode = "rules", referentialIntegrity = false, detectDates = false, cache = true, } = options;
         const [normalizedText, offsetMapping] = (0, normalizer_js_1.normalize)(text);
         const countriesTuple = countries

package/dist/cjs/types.js

@@ -1,11 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DetectionSource = exports.EntityType = void 0;
+exports.DetectionSource = exports.LEGACY_TYPE_ALIASES = exports.EntityType = void 0;
 var EntityType;
 (function (EntityType) {
     EntityType["NAME"] = "NAME";
     EntityType["ADDRESS"] = "ADDRESS";
-    EntityType["IBAN"] = "IBAN";
+    /**
+     * Canonical name for a bank account identifier. `IBAN` is kept below as a
+     * legacy alias with the same value, so `EntityType.IBAN === EntityType.BANK_ACCOUNT`
+     * and existing code keeps working — but the emitted value, and therefore the
+     * `[BANK_ACCOUNT]` placeholder written into redacted text, is canonical.
+     */
+    EntityType["BANK_ACCOUNT"] = "BANK_ACCOUNT";
+    /** @deprecated legacy alias of {@link EntityType.BANK_ACCOUNT} */
+    EntityType["IBAN"] = "BANK_ACCOUNT";
     EntityType["BIC"] = "BIC";
     EntityType["CREDIT_CARD"] = "CREDIT_CARD";
     EntityType["PHONE"] = "PHONE";
@@ -35,6 +43,14 @@ var EntityType;
     EntityType["SECRET"] = "SECRET";
     EntityType["OTHER"] = "OTHER";
 })(EntityType || (exports.EntityType = EntityType = {}));
+/**
+ * Legacy type names accepted on input and mapped to their canonical form.
+ * Kept in sync with the pipeline canon (config/entity_types.json →
+ * legacy_aliases). The engine never *emits* these names.
+ */
+exports.LEGACY_TYPE_ALIASES = {
+    IBAN: "BANK_ACCOUNT",
+};
 var DetectionSource;
 (function (DetectionSource) {
     DetectionSource["RULES"] = "rules";

package/dist/esm/cache.js

@@ -18,10 +18,10 @@ export class ResultCache {
     key(text, countries, mode) {
         const sorted = [...countries].sort();
         const raw = `${text}|${sorted.join("|")}|${mode}`;
-        // Use multiple FNV-1a hashes on different slices for reduced collisions
+        // Include raw length to reduce collision risk alongside dual FNV-1a hashes
         const h1 = fnv1aHash(raw);
         const h2 = fnv1aHash(raw.slice(Math.floor(raw.length / 2)) + raw.slice(0, Math.floor(raw.length / 2)));
-        return h1 + h2;
+        return `${raw.length}:${h1}${h2}`;
     }
     get(key) {
         if (!this.enabled)

package/dist/esm/index.d.ts

@@ -1,10 +1,12 @@
-export { EntityType, DetectionSource } from "./types.js";
+export { EntityType, DetectionSource, LEGACY_TYPE_ALIASES } from "./types.js";
 export type { Detection, RedactResult, PatternDef, CountryConfig } from "./types.js";
 export { EuRedact, type RedactOptions } from "./sdk.js";
 export { COUNTRY_CONFIGS } from "./rules/countries/index.js";
+export { setBicRegistry, getBicRegistry, SEED_BIC6_PREFIXES, type BicRegistryProvider } from "./rules/bicRegistry.js";
 import { type RedactOptions } from "./sdk.js";
 import type { RedactResult } from "./types.js";
 export declare function availableCountries(): string[];
 export declare function redact(text: string, options?: RedactOptions): RedactResult;
 export declare function addCustomPattern(name: string, pattern: string): void;
+export declare function clear(): void;
 export declare function redactBatch(texts: string[], options?: RedactOptions): RedactResult[];

package/dist/esm/index.js

@@ -1,6 +1,7 @@
-export { EntityType, DetectionSource } from "./types.js";
+export { EntityType, DetectionSource, LEGACY_TYPE_ALIASES } from "./types.js";
 export { EuRedact } from "./sdk.js";
 export { COUNTRY_CONFIGS } from "./rules/countries/index.js";
+export { setBicRegistry, getBicRegistry, SEED_BIC6_PREFIXES } from "./rules/bicRegistry.js";
 import { EuRedact } from "./sdk.js";
 import { COUNTRY_CONFIGS } from "./rules/countries/index.js";
 let _instance = null;
@@ -18,6 +19,9 @@ export function redact(text, options) {
 export function addCustomPattern(name, pattern) {
     getInstance().addCustomPattern(name, pattern);
 }
+export function clear() {
+    getInstance().clear();
+}
 export function redactBatch(texts, options) {
     return getInstance().redactBatch(texts, options);
 }

package/dist/esm/normalizer.js

@@ -5,27 +5,25 @@ export function normalize(text) {
     return [normalized, buildOffsetMapping(text, normalized)];
 }
 function buildOffsetMapping(original, normalized) {
-    const nfdOriginal = original.normalize("NFD");
-    const nfdNormalized = normalized.normalize("NFD");
-    // Build: normalized index -> original index via NFD as intermediate
+    // Precompute cumulative NFD lengths for normalized characters
+    const normNfdCum = [0];
+    for (let i = 0; i < normalized.length; i++) {
+        normNfdCum.push(normNfdCum[i] + normalized[i].normalize("NFD").length);
+    }
+    // Precompute cumulative NFD lengths for original characters
+    const origNfdCum = [0];
+    for (let i = 0; i < original.length; i++) {
+        origNfdCum.push(origNfdCum[i] + original[i].normalize("NFD").length);
+    }
+    // Two-pointer scan: map each normalized position to its original position
     const normToOrig = [];
+    let origPtr = 0;
     for (let normIdx = 0; normIdx < normalized.length; normIdx++) {
-        const nfdOfNormChar = normalized[normIdx].normalize("NFD");
-        let nfdStart = 0;
-        for (let i = 0; i < normIdx; i++) {
-            nfdStart += normalized[i].normalize("NFD").length;
-        }
-        let targetOrig = 0;
-        let running = 0;
-        for (let oi = 0; oi < original.length; oi++) {
-            const nfdOc = original[oi].normalize("NFD");
-            if (running + nfdOc.length > nfdStart) {
-                targetOrig = oi;
-                break;
-            }
-            running += nfdOc.length;
+        const nfdStart = normNfdCum[normIdx];
+        while (origPtr + 1 < original.length && origNfdCum[origPtr + 1] <= nfdStart) {
+            origPtr++;
         }
-        normToOrig.push(targetOrig);
+        normToOrig.push(origPtr);
     }
     return normToOrig;
 }

package/dist/esm/rules/bicRegistry.d.ts

@@ -0,0 +1,50 @@
+/**
+ * BIC registry — tier-1 membership testing for ISO 9362 bank identifier codes.
+ *
+ * BIC is the only bank identifier in the supported set with **no check digit**
+ * (IBAN has mod-97, VAT has country-specific checksums). Structure alone cannot
+ * separate a genuine BIC from an ordinary 8- or 11-character uppercase word,
+ * because characters 5-6 of everyday words are frequently valid ISO 3166
+ * country codes (`DRINGEND` -> `GE`, `HOSPITAL` -> `IT`). Registry membership
+ * is therefore the strongest precision signal available.
+ *
+ * Two sources are consulted, in order:
+ *
+ * 1. A deployment-supplied registry, installed via {@link setBicRegistry}.
+ *    This is the path for anyone holding a licensed directory (SWIFTRef).
+ * 2. {@link SEED_BIC6_PREFIXES} — a small bundled set of institution+country
+ *    prefixes for major European banks, compiled from publicly published bank
+ *    data. No licensed directory is bundled.
+ *
+ * Matching is on the **BIC6 prefix** (4-letter institution + 2-letter country),
+ * so any location and branch code on a known institution is accepted. The
+ * prefix is the stable part of a BIC; branch codes churn as branches open and
+ * close.
+ *
+ * The registry is used as an *accept* signal, never as a filter: a candidate
+ * that misses it falls through to the context gate in `suppressors.ts` and is
+ * still detected when banking context is present. A stale list therefore costs
+ * a little recall on bare, contextless BICs — it never causes a leak. Annual
+ * review is sufficient.
+ */
+export declare const SEED_BIC6_PREFIXES: ReadonlySet<string>;
+/** A membership test over BIC8/BIC11 codes or bare BIC6 prefixes. */
+export type BicRegistryProvider = (bic: string) => boolean;
+/**
+ * Install a deployment-supplied BIC registry, consulted ahead of the seed list.
+ *
+ * Accepts a membership callable, any iterable of BIC strings, or `null` to
+ * remove a previously installed registry. Entries may be full BIC8/BIC11 codes
+ * or bare BIC6 prefixes; both are matched, case-insensitively and ignoring
+ * spaces.
+ */
+export declare function setBicRegistry(registry: BicRegistryProvider | Iterable<string> | null): void;
+/** Return the installed registry provider, or null if none is installed. */
+export declare function getBicRegistry(): BicRegistryProvider | null;
+/**
+ * Tier 1: is `candidate` a BIC of a known institution?
+ *
+ * Checks the deployment-supplied registry first (full code, then BIC6 prefix),
+ * then the bundled seed prefixes.
+ */
+export declare function isRegisteredBic(candidate: string): boolean;

package/dist/esm/rules/bicRegistry.js

@@ -0,0 +1,233 @@
+/**
+ * BIC registry — tier-1 membership testing for ISO 9362 bank identifier codes.
+ *
+ * BIC is the only bank identifier in the supported set with **no check digit**
+ * (IBAN has mod-97, VAT has country-specific checksums). Structure alone cannot
+ * separate a genuine BIC from an ordinary 8- or 11-character uppercase word,
+ * because characters 5-6 of everyday words are frequently valid ISO 3166
+ * country codes (`DRINGEND` -> `GE`, `HOSPITAL` -> `IT`). Registry membership
+ * is therefore the strongest precision signal available.
+ *
+ * Two sources are consulted, in order:
+ *
+ * 1. A deployment-supplied registry, installed via {@link setBicRegistry}.
+ *    This is the path for anyone holding a licensed directory (SWIFTRef).
+ * 2. {@link SEED_BIC6_PREFIXES} — a small bundled set of institution+country
+ *    prefixes for major European banks, compiled from publicly published bank
+ *    data. No licensed directory is bundled.
+ *
+ * Matching is on the **BIC6 prefix** (4-letter institution + 2-letter country),
+ * so any location and branch code on a known institution is accepted. The
+ * prefix is the stable part of a BIC; branch codes churn as branches open and
+ * close.
+ *
+ * The registry is used as an *accept* signal, never as a filter: a candidate
+ * that misses it falls through to the context gate in `suppressors.ts` and is
+ * still detected when banking context is present. A stale list therefore costs
+ * a little recall on bare, contextless BICs — it never causes a leak. Annual
+ * review is sufficient.
+ */
+// BIC6 prefixes (institution + country) of major European institutions,
+// compiled from publicly published bank data — not from a licensed directory.
+// Kept deliberately small: this covers the banks that appear bare and
+// contextless in real documents. Anything outside this list is still detected
+// via the context gate.
+export const SEED_BIC6_PREFIXES = new Set([
+    // --- Netherlands ---
+    "ABNANL", // ABN AMRO
+    "INGBNL", // ING
+    "RABONL", // Rabobank
+    "SNSBNL", // SNS Bank
+    "TRIONL", // Triodos
+    "BUNQNL", // bunq
+    "KNABNL", // Knab
+    "ASNBNL", // ASN Bank
+    "RBRBNL", // RegioBank
+    "FVLBNL", // Van Lanschot
+    "BITSNL", // BinckBank
+    "DEUTNL", // Deutsche Bank NL
+    // --- Belgium ---
+    "BBRUBE", // BNP Paribas Fortis
+    "GEBABE", // BNP Paribas Fortis (legacy)
+    "KREDBE", // KBC
+    "GKCCBE", // Belfius
+    "BPOTBE", // bpost bank
+    "ARSPBE", // Argenta
+    "AXABBE", // AXA Bank Belgium
+    "CREGBE", // Belfius (legacy)
+    "NICABE", // Crelan
+    "TRIOBE", // Triodos Belgium
+    "CTBKBE", // Banca Monte Paschi Belgio
+    "JVBABE", // Van Breda
+    // --- Germany ---
+    "DEUTDE", // Deutsche Bank
+    "COBADE", // Commerzbank
+    "PBNKDE", // Postbank
+    "GENODE", // Volksbanken / Raiffeisen
+    "MALADE", // Sparkassen
+    "HELADE", // Helaba / Sparkassen
+    "BYLADE", // BayernLB / Sparkassen
+    "SOLADE", // Sparkassen (Baden-Wurttemberg)
+    "WELADE", // Sparkassen (Westfalen)
+    "NOLADE", // Norddeutsche Landesbank
+    "SPKKDE", // Sparkasse
+    "HYVEDE", // UniCredit / HypoVereinsbank
+    "DRESDE", // Dresdner (legacy Commerzbank)
+    "INGDDE", // ING-DiBa
+    "NTSBDE", // N26
+    "SFRTDE", // Sutor / fintech BaaS
+    "TEDADE", // Telda / BaaS
+    // --- France ---
+    "BNPAFR", // BNP Paribas
+    "SOGEFR", // Societe Generale
+    "AGRIFR", // Credit Agricole
+    "CCBPFR", // Banque Populaire
+    "CEPAFR", // Caisse d'Epargne
+    "CMCIFR", // Credit Mutuel / CIC
+    "PSSTFR", // La Banque Postale
+    "BREDFR", // BRED Banque Populaire
+    "CRLYFR", // LCL
+    "HSBCFR", // HSBC France
+    "TRZOFR", // Treezor
+    "QNTOFR", // Qonto
+    // --- Austria ---
+    "GIBAAT", // Erste Bank / Sparkassen
+    "BKAUAT", // UniCredit Bank Austria
+    "RZBAAT", // Raiffeisen Bank International
+    "RLNWAT", // Raiffeisen NO-Wien
+    "OBKLAT", // Oberbank
+    "BAWAAT", // BAWAG P.S.K.
+    "VBOEAT", // Volksbank
+    "HYPTAT", // Hypo Tirol
+    "SPIHAT", // Sparkasse
+    // --- Luxembourg ---
+    "BCEELU", // Banque et Caisse d'Epargne de l'Etat
+    "BILLLU", // Banque Internationale a Luxembourg
+    "BGLLLU", // BGL BNP Paribas
+    "CCRALU", // Banque Raiffeisen
+    "BLUXLU", // Banque de Luxembourg
+    // --- Ireland / UK ---
+    "AIBKIE", // Allied Irish Banks
+    "BOFIIE", // Bank of Ireland
+    "ULSBIE", // Ulster Bank
+    "CITIIE", // Citibank Ireland
+    "BARCGB", // Barclays
+    "HBUKGB", // HSBC UK
+    "MIDLGB", // HSBC (legacy Midland)
+    "LOYDGB", // Lloyds
+    "NWBKGB", // NatWest
+    "RBOSGB", // Royal Bank of Scotland
+    "TSBSGB", // TSB
+    "REVOGB", // Revolut
+    "MONZGB", // Monzo
+    "STARGB", // Starling
+    "CHASGB", // JP Morgan Chase UK
+    // --- Nordics ---
+    "NDEADK", // Nordea Denmark
+    "DABADK", // Danske Bank
+    "JYBADK", // Jyske Bank
+    "SYBKDK", // Sydbank
+    "NDEASE", // Nordea Sweden
+    "ESSESE", // SEB
+    "HANDSE", // Handelsbanken
+    "SWEDSE", // Swedbank
+    "DNBANO", // DNB
+    "NDEANO", // Nordea Norway
+    "NDEAFI", // Nordea Finland
+    "OKOYFI", // OP Corporate Bank
+    "HELSFI", // Aktia
+    "NBIIIS", // Landsbankinn (NBIIISRE)
+    "ESJAIS", // Arion Bank (ESJAISRE)
+    "GLITIS", // Islandsbanki (GLITISRE)
+    "MPBAIS", // Kvika banki (MPBAISRE)
+    "KBNONO", // BNbank ASA (KBNONO22)
+    "PRBONO", // Boligbanken ASA (PRBONO22)
+    "AARBDE", // Aareal Bank AG (AARBDE5W)
+    // --- Southern / Central Europe ---
+    "UNCRIT", // UniCredit Italy
+    "BCITIT", // Intesa Sanpaolo
+    "PASCIT", // Monte dei Paschi
+    "BPMOIT", // Banco BPM
+    "CRPPIT", // Cassa di Risparmio
+    "BSCHES", // Banco Santander
+    "BBVAES", // BBVA
+    "CAIXES", // CaixaBank
+    "SABBES", // Banco Sabadell
+    "BKBKES", // Bankinter
+    "BCOMPT", // Millennium BCP
+    "CGDIPT", // Caixa Geral de Depositos
+    "BPIPPT", // Banco BPI
+    "NOVBPT", // Novo Banco
+    "BPKOPL", // PKO Bank Polski
+    "BREXPL", // mBank
+    "INGBPL", // ING Bank Slaski
+    "WBKPPL", // Santander Bank Polska
+    "KOMBCZ", // Komercni banka
+    "CEKOCZ", // CSOB
+    "GIBACZ", // Ceska sporitelna
+    "TATRSK", // Tatra banka
+    "SUBASK", // Vseobecna uverova banka
+    "GIBASK", // Slovenska sporitelna
+    "OTPVHU", // OTP Bank
+    "BUDAHU", // Budapest Bank
+    "MKKBHU", // MKB Bank
+    // --- Switzerland ---
+    "UBSWCH", // UBS
+    "CRESCH", // Credit Suisse
+    "POFICH", // PostFinance
+    "ZKBKCH", // Zurcher Kantonalbank
+    "RAIFCH", // Raiffeisen Switzerland
+    "MIGRCH", // Migros Bank
+]);
+let provider = null;
+/**
+ * Install a deployment-supplied BIC registry, consulted ahead of the seed list.
+ *
+ * Accepts a membership callable, any iterable of BIC strings, or `null` to
+ * remove a previously installed registry. Entries may be full BIC8/BIC11 codes
+ * or bare BIC6 prefixes; both are matched, case-insensitively and ignoring
+ * spaces.
+ */
+export function setBicRegistry(registry) {
+    if (registry === null) {
+        provider = null;
+        return;
+    }
+    if (typeof registry === "function") {
+        provider = registry;
+        return;
+    }
+    const known = new Set();
+    for (const entry of registry) {
+        const e = String(entry).trim();
+        if (e && !e.startsWith("#"))
+            known.add(e.replace(/ /g, "").toUpperCase());
+    }
+    provider = (bic) => known.has(bic);
+}
+/** Return the installed registry provider, or null if none is installed. */
+export function getBicRegistry() {
+    return provider;
+}
+/**
+ * Tier 1: is `candidate` a BIC of a known institution?
+ *
+ * Checks the deployment-supplied registry first (full code, then BIC6 prefix),
+ * then the bundled seed prefixes.
+ */
+export function isRegisteredBic(candidate) {
+    const c = candidate.replace(/ /g, "").toUpperCase();
+    if (c.length !== 8 && c.length !== 11)
+        return false;
+    const prefix = c.slice(0, 6);
+    if (provider !== null) {
+        try {
+            if (provider(c) || provider(prefix))
+                return true;
+        }
+        catch {
+            // a broken provider must not break detection
+        }
+    }
+    return SEED_BIC6_PREFIXES.has(prefix);
+}