@coderoftime/fints 0.0.0-stage → 0.2.0

package/dist/v3/dialog.js

@@ -0,0 +1,241 @@
+// Internal to the package, and named after the FinTS specification. Documentation is where the meaning is not evident.
+import { FinTsError, FinTsProtocolError, FinTsTransportError, parseBankData } from '../core/errors.js';
+import { endsDialog, FeedbackCodes, hasCode, hasErrors } from '../core/feedback.js';
+import { challengeText, TanChallenge } from '../tan/challenge.js';
+import { TanMethod } from '../tan/tan-models.js';
+import { IncomingMessage3 } from './message.js';
+import { requireBankParameters } from './parameters.js';
+import { Segments, TanResponse } from './segments.js';
+/** Dialog ID of a dialog the bank has not answered yet, and customer system ID before synchronization. */
+const unassigned = '0';
+/** The first version of HKTAN that supports strong customer authentication. */
+const firstScaVersion = 6;
+/** The first version of HKTAN that supports app approvals, with the status request (process S). */
+const firstDecoupledVersion = 7;
+/**
+ * How long a dialog may stay idle where the bank states no timeout: on the safe side, since a dialog given up too early
+ * only costs a new login, while one kept too long fails the next call.
+ */
+const defaultIdleLimitMs = 5 * 60_000;
+/**
+ * One FinTS 3.0 dialog: numbered messages under the dialog ID the bank assigns in its first answer, signed with a TAN
+ * method and medium, and the approvals the bank asks for. The `FinTs3Protocol` builds the messages and signs them.
+ */
+export class FinTs3Dialog {
+    protocol;
+    method;
+    tanMedium;
+    anonymous;
+    systemId;
+    id = unassigned;
+    messageNumber = 1;
+    ended = false;
+    /** When the bank last answered without rejecting the whole message, which shows it still knows the dialog. */
+    lastAnswer;
+    constructor(protocol, method, 
+    /** The TAN medium the messages name, where the method takes one. */
+    tanMedium, anonymous) {
+        this.protocol = protocol;
+        this.method = method;
+        this.tanMedium = tanMedium;
+        this.anonymous = anonymous;
+        this.systemId = anonymous ? unassigned : (protocol.parameters.systemId ?? unassigned);
+    }
+    static signed(protocol, method, tanMedium) {
+        return new FinTs3Dialog(protocol, method, tanMedium, false);
+    }
+    /** A dialog without login, which only delivers the bank parameter data. */
+    static anonymous(protocol) {
+        return new FinTs3Dialog(protocol, TanMethod.oneStep, undefined, true);
+    }
+    /** Whether the bank knows this dialog and it has not ended. */
+    get isActive() {
+        return this.id !== unassigned && !this.hasEnded;
+    }
+    /**
+     * Whether the dialog has ended, on either side.
+     *
+     * The bank ends a dialog idle for longer than its maximum timeout (HIBPA, Formals C.9), or five minutes where it
+     * states none. Such a dialog is neither used nor ended again: the bank would refuse any message in it.
+     */
+    get hasEnded() {
+        return this.ended || this.idleTooLong;
+    }
+    get idleTooLong() {
+        const last = this.lastAnswer;
+        const timeout = this.protocol.parameters.bankParameters?.bankInfo.maxTimeout;
+        // A timeout of 0 or below: the bank keeps idle dialogs without limit.
+        const limit = timeout === undefined ? defaultIdleLimitMs : timeout <= 0 ? undefined : timeout * 1000;
+        return last !== undefined && limit !== undefined && Date.now() - last > limit;
+    }
+    /** Whether the messages are signed with a two-step TAN method, so that the bank may ask for approvals. */
+    get isTwoStep() {
+        return !this.method.isOneStep;
+    }
+    /** The version of the HKTAN segments: that of the HITANS segment the bank describes the method in. */
+    get tanVersion() {
+        return this.protocol.parameters.bankParameters?.tanVersion(this.method) ?? firstScaVersion;
+    }
+    /** Opens the dialog; with `synchronize` the bank also assigns a customer system ID. */
+    start(synchronize = false) {
+        if (synchronize)
+            this.systemId = unassigned;
+        return this.sendSegments([
+            ...this.protocol.initSegments(this.systemId),
+            ...(this.isTwoStep ? [this.tanRequest('HKIDN')] : []),
+            ...(synchronize ? [Segments.synchronization()] : []),
+        ]);
+    }
+    /**
+     * The messages that open the dialog and send `order` while no TAN medium is chosen yet, as for listing the media:
+     * `login` opens the dialog, asking strong authentication for `order` with a two-step method, and `order` sends the
+     * order in a message of its own.
+     */
+    startWith(order) {
+        return {
+            login: () => this.sendSegments([
+                ...this.protocol.initSegments(this.systemId),
+                ...(this.isTwoStep ? [this.tanRequest(order.type)] : []),
+            ]),
+            order: () => this.sendSegments([order]),
+        };
+    }
+    /**
+     * Opens the anonymous dialog; the answer carries the bank parameter data.
+     *
+     * With `announceSca` the message also carries HKTAN, the way a client that can do strong customer authentication
+     * tells the bank so, whereupon the bank may send parameter data suited to it (PIN/TAN, B.4.3.1).
+     */
+    requestBankParameters(announceSca = false) {
+        return this.sendSegments([
+            ...this.protocol.initSegments(unassigned, true),
+            ...(announceSca ? [Segments.tanProcess4(firstScaVersion, 'HKIDN')] : []),
+        ]);
+    }
+    /** Sends `order`, asking for strong customer authentication where the bank requires it. */
+    send(order) {
+        const needsTan = this.isTwoStep && requireBankParameters(this.protocol.parameters.bankParameters).pinTan.requiresTan(order.type);
+        return this.sendSegments([order, ...(needsTan ? [this.tanRequest(order.type)] : [])]);
+    }
+    /**
+     * Ends the dialog at the bank and returns the answer; `undefined` if the dialog is not active or the end failed.
+     *
+     * Bank and connection errors are ignored, since the bank may have ended the dialog on its side already.
+     */
+    async end() {
+        if (!this.isActive)
+            return undefined;
+        this.ended = true;
+        try {
+            return await this.sendSegments([Segments.dialogEnd(this.id)]);
+        }
+        catch (error) {
+            if (!(error instanceof FinTsError))
+                throw error;
+            return undefined;
+        }
+    }
+    /** Forgets the dialog without contacting the bank, for example after the bank rejected the PIN. */
+    discard() {
+        this.ended = true;
+    }
+    /**
+     * The approval `response`, the dialog's latest answer, asks for with return code 0030 (TAN) or 3955 (banking app):
+     * HITAN of process 4, answered with HKTAN process 2 (TAN) or S (status); `undefined` if it asks for none, or carries
+     * only the dummy challenge of a message the bank exempts from strong authentication.
+     *
+     * The bank has not executed the message then, so a request without a challenge is a `FinTsProtocolError`: read as
+     * done, it would report an empty result. So is an app approval with a method of HITANS #6: the status request
+     * (process S) came with version 7, along with app approvals (PIN/TAN B.5.2).
+     */
+    approvalAskedIn(response) {
+        const feedback = response.feedback;
+        const decoupled = hasCode(feedback, FeedbackCodes.decoupledPending);
+        if (hasErrors(feedback) || !(hasCode(feedback, FeedbackCodes.tanRequired) || decoupled))
+            return undefined;
+        const tan = tanResponseOf(response, '4');
+        if (tan === undefined || tan.isDummy) {
+            throw new FinTsProtocolError('The bank asks for an approval, but sends no challenge');
+        }
+        if (decoupled && this.tanVersion < firstDecoupledVersion) {
+            throw new FinTsProtocolError('The bank asks for an app approval, which needs HKTAN version 7');
+        }
+        const reference = tan.reference;
+        return {
+            challenge: TanChallenge.create({
+                method: this.method,
+                reference,
+                message: tan.challenge,
+                hhdUc: tan.hhdUc,
+                isDecoupled: decoupled || this.method.decoupled,
+                validUntil: tan.validUntil,
+                tanMediumName: tan.mediumName ?? this.tanMedium,
+            }),
+            submitTan: (value) => this.sendSegments([Segments.tanProcess2(this.tanVersion, reference)], value),
+            checkStatus: () => this.sendSegments([Segments.tanProcessStatus(this.tanVersion, reference)]),
+            waitForPush: hasCode(feedback, FeedbackCodes.decoupledWaitForPush),
+            // A status answer that the approval is still pending may carry new instructions (PIN/TAN B.4.2.2.1, step 2b).
+            instructionsIn: (status) => challengeText(tanResponseOf(status, 'S')?.challenge),
+        };
+    }
+    tanRequest(segmentType) {
+        const medium = this.method.mediumRequirement === 'notAllowed' ? undefined : this.tanMedium;
+        return Segments.tanProcess4(this.tanVersion, segmentType, medium === undefined ? undefined : this.protocol.parameters.tanMediumAsSent(medium));
+    }
+    /**
+     * Sends `segments`, with `tan` where they complete an approval, as the next message, and reads the bank's answer. The
+     * message counts once the bank has answered, whatever it answered.
+     *
+     * The bank assigns the dialog ID in its answer to the first message, so the answer to another user's first message
+     * passes for it (`ParameterStore.reportedUpdVersion`). Any other answer to another message fails with
+     * `FinTsProtocolError` before anything of it is kept: a relay or proxy that mixes up answers would hand the client
+     * another user's data, or a page of another query.
+     *
+     * The dialog ends on the client's side, without a dialog end, where it is over for the bank: after a return code that
+     * ends it, such as 9800, and after a rejected opening message (Formals C.1.2), or a broken connection (C.6).
+     *
+     * Only an answer that does not reject the whole message starts the idle time anew (`hasEnded`): a rejection may come
+     * from a bank that has ended the dialog without saying so.
+     */
+    async sendSegments(segments, tan) {
+        const number = this.messageNumber;
+        let answer;
+        try {
+            answer = await this.protocol.post({
+                dialogId: this.id,
+                number,
+                segments,
+                signing: this.anonymous
+                    ? undefined
+                    : { securityFunction: this.method.securityFunction, systemId: this.systemId },
+                tan,
+            });
+        }
+        catch (error) {
+            if (error instanceof FinTsTransportError)
+                this.discard();
+            throw error;
+        }
+        this.messageNumber++;
+        const response = parseBankData(() => IncomingMessage3.parse(answer));
+        const assigned = this.id === unassigned ? undefined : this.id;
+        if (!response.answers(number, assigned)) {
+            throw new FinTsProtocolError('The answer belongs to another message than the one sent');
+        }
+        if (assigned === undefined)
+            this.id = response.dialogId ?? unassigned;
+        if (!response.messageRejected)
+            this.lastAnswer = Date.now();
+        if (endsDialog(response.feedback) || (number === 1 && response.messageRejected))
+            this.discard();
+        return response;
+    }
+}
+/** The TAN part of `response` that answers TAN `process`. */
+function tanResponseOf(response, process) {
+    return response
+        .findAll('HITAN')
+        .map((s) => TanResponse.parse(s))
+        .find((t) => t.process === process);
+}
+//# sourceMappingURL=dialog.js.map

package/dist/v3/dialog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dialog.js","sourceRoot":"","sources":["../../src/v3/dialog.ts"],"names":[],"mappings":"AAAA,uHAAuH;AAEvH,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGtD,0GAA0G;AAC1G,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,+EAA+E;AAC/E,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B,mGAAmG;AACnG,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC;;;GAGG;AACH,MAAM,kBAAkB,GAAG,CAAC,GAAG,MAAM,CAAC;AAuBtC;;;GAGG;AACH,MAAM,OAAO,YAAY;IAUJ;IACR;IAEA;IACQ;IAbX,QAAQ,CAAS;IACjB,EAAE,GAAG,UAAU,CAAC;IAChB,aAAa,GAAG,CAAC,CAAC;IAClB,KAAK,GAAG,KAAK,CAAC;IAEtB,8GAA8G;IACtG,UAAU,CAAqB;IAEvC,YACmB,QAAwB,EAChC,MAAiB;IAC1B,oEAAoE;IAC3D,SAA6B,EACrB,SAAkB;QAJlB,aAAQ,GAAR,QAAQ,CAAgB;QAChC,WAAM,GAAN,MAAM,CAAW;QAEjB,cAAS,GAAT,SAAS,CAAoB;QACrB,cAAS,GAAT,SAAS,CAAS;QAEnC,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,QAAwB,EAAE,MAAiB,EAAE,SAAkB;QAC3E,OAAO,IAAI,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED,2EAA2E;IAC3E,MAAM,CAAC,SAAS,CAAC,QAAwB;QACvC,OAAO,IAAI,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,+DAA+D;IAC/D,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,EAAE,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACH,IAAY,QAAQ;QAClB,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC;IACxC,CAAC;IAED,IAAY,WAAW;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,EAAE,QAAQ,CAAC,UAAU,CAAC;QAC7E,sEAAsE;QACtE,MAAM,KAAK,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;QACrG,OAAO,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,KAAK,CAAC;IAChF,CAAC;IAED,0GAA0G;IAC1G,IAAY,SAAS;QACnB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;IAChC,CAAC;IAED,sGAAsG;IACtG,IAAY,UAAU;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC;IAC7F,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,WAAW,GAAG,KAAK;QACvB,IAAI,WAAW;YAAE,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC;QAC5C,OAAO,IAAI,CAAC,YAAY,CAAC;YACvB,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,KAAkB;QAI1B,OAAO;YACL,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,CAAC,YAAY,CAAC;gBAChB,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACzD,CAAC;YACJ,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC;SACxC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,qBAAqB,CAAC,WAAW,GAAG,KAAK;QACvC,OAAO,IAAI,CAAC,YAAY,CAAC;YACvB,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC;YAC/C,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;IACL,CAAC;IAED,2FAA2F;IAC3F,IAAI,CAAC,KAAkB;QACrB,MAAM,QAAQ,GACZ,IAAI,CAAC,SAAS,IAAI,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClH,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG;QACP,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QACrC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;gBAAE,MAAM,KAAK,CAAC;YAChD,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,mGAAmG;IACnG,OAAO;QACL,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;;;;;;OAQG;IACH,eAAe,CAAC,QAA0B;QACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACnC,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACpE,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1G,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,kBAAkB,CAAC,uDAAuD,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,SAAS,IAAI,IAAI,CAAC,UAAU,GAAG,qBAAqB,EAAE,CAAC;YACzD,MAAM,IAAI,kBAAkB,CAAC,gEAAgE,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAU,CAAC;QACjC,OAAO;YACL,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC;gBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,SAAS;gBACT,OAAO,EAAE,GAAG,CAAC,SAAS;gBACtB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,WAAW,EAAE,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS;gBAC/C,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,aAAa,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS;aAChD,CAAC;YACF,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC;YAClG,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;YAC7F,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,oBAAoB,CAAC;YAClE,8GAA8G;YAC9G,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,CAAC;SACjF,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,WAAmB;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;QAC3F,OAAO,QAAQ,CAAC,WAAW,CACzB,IAAI,CAAC,UAAU,EACf,WAAW,EACX,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,CACpF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,KAAK,CAAC,YAAY,CAAC,QAAgC,EAAE,GAAY;QACvE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC;QAClC,IAAI,MAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAChC,QAAQ,EAAE,IAAI,CAAC,EAAE;gBACjB,MAAM;gBACN,QAAQ;gBACR,OAAO,EAAE,IAAI,CAAC,SAAS;oBACrB,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;gBAC/E,GAAG;aACJ,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mBAAmB;gBAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YACzD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,kBAAkB,CAAC,yDAAyD,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,QAAQ,IAAI,UAAU,CAAC;QACtE,IAAI,CAAC,QAAQ,CAAC,eAAe;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5D,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,eAAe,CAAC;YAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QAChG,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED,6DAA6D;AAC7D,SAAS,aAAa,CAAC,QAA0B,EAAE,OAAe;IAChE,OAAO,QAAQ;SACZ,OAAO,CAAC,OAAO,CAAC;SAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAChC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;AACxC,CAAC"}

package/dist/v3/message.d.ts

@@ -0,0 +1,85 @@
+import { BankMessage } from '../core/bank-info.js';
+import { FinTsFeedback } from '../core/feedback.js';
+import { type Segment, SegmentSpec } from './syntax.js';
+/** Signature data of a PIN/TAN message. */
+export interface PinTanCredentials {
+    readonly countryCode: string;
+    readonly bankCode: string;
+    readonly userId: string;
+    readonly systemId: string;
+    readonly pin: string;
+    readonly securityFunction: string;
+}
+/** A message to send, and the same message with PIN and TAN masked for logging. */
+export declare class OutgoingMessage {
+    readonly bytes: Uint8Array;
+    /** The parts of the masked message, each decoded on its own as the bank's text is. */
+    private readonly maskedParts;
+    constructor(bytes: Uint8Array, 
+    /** The parts of the masked message, each decoded on its own as the bank's text is. */
+    maskedParts: readonly Uint8Array[]);
+    /** The message with PIN and TAN masked; decoded only when a logger asks for it. */
+    get masked(): string;
+}
+/**
+ * Builds a message: header (HNHBK), the `segments`, trailer (HNHBS).
+ *
+ * With `security` the segments are signed with PIN and optional `tan` (HNSHK … HNSHA) and wrapped in the encryption
+ * envelope (HNVSK, HNVSD) that PIN/TAN uses without actual encryption.
+ *
+ * The masked message states the sizes of its masked content, so that the log does not tell how long PIN and TAN are.
+ */
+export declare function buildMessage(parts: {
+    dialogId: string;
+    messageNumber: number;
+    segments: readonly SegmentSpec[];
+    security?: PinTanCredentials | undefined;
+    tan?: string | undefined;
+    now?: Date;
+}): OutgoingMessage;
+/** A received message, with the segments of the encryption envelope unpacked. */
+export declare class IncomingMessage3 {
+    readonly segments: readonly Segment[];
+    /** The memory the message holds, in bytes: its length, and what its parts take beyond that. */
+    readonly size: number;
+    /**
+     * Return codes for the whole message (HIRMG), then for single request segments (HIRMS).
+     *
+     * The segment a HIRMS refers to is not kept: each message carries one order, and the answer that completes an
+     * approval reports on the order of an earlier message (PIN/TAN B.4.2.1).
+     */
+    readonly feedback: readonly FinTsFeedback[];
+    /** Whether the bank rejected the message as a whole (an error in HIRMG), rather than single orders in it. */
+    readonly messageRejected: boolean;
+    private constructor();
+    /**
+     * Parses a message; throws `FormatError` if `data` is not one complete FinTS message, such as the HTML page of a
+     * proxy, a maintenance notice, a message cut short, which lacks the message trailer (HNHBS) at its end, or two
+     * messages run together, whose second would pass for part of the first.
+     *
+     * Its `size` counts the memory of its data elements along with its bytes, since a message of many short elements
+     * takes far more memory than bytes.
+     */
+    static parse(data: Uint8Array): IncomingMessage3;
+    static combine(first: IncomingMessage3, second: IncomingMessage3): IncomingMessage3;
+    /** Free-text messages the bank addresses to the user. */
+    get bankMessages(): BankMessage[];
+    /** The dialog ID the bank assigned, as `Segment.verbatim` reads it, to send back byte for byte. */
+    get dialogId(): string | undefined;
+    /**
+     * Whether the message answers message `number` of the dialog `dialogId`: header and trailer carry that number, and the
+     * header names that message where it names the message it refers to (Bezugsnachricht). The dialog ID counts only once
+     * the bank has assigned one; before, `dialogId` is `undefined`, since every first message goes out under the same.
+     */
+    answers(number: number, dialogId: string | undefined): boolean;
+    find(type: string): Segment | undefined;
+    findAll(type: string): Segment[];
+}
+/**
+ * Unpacks the transport encoding: PIN/TAN servers answer in base64, a few with the raw message.
+ *
+ * Returns anything else unchanged, for `IncomingMessage3.parse` to reject.
+ */
+export declare function decodeTransport(body: Uint8Array): Uint8Array;
+export declare function encodeTransport(message: Uint8Array): Uint8Array;
+//# sourceMappingURL=message.d.ts.map

package/dist/v3/message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message.d.ts","sourceRoot":"","sources":["../../src/v3/message.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMpD,OAAO,EAKL,KAAK,OAAO,EACZ,WAAW,EAGZ,MAAM,aAAa,CAAC;AAErB,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AA+DD,mFAAmF;AACnF,qBAAa,eAAe;IAExB,QAAQ,CAAC,KAAK,EAAE,UAAU;IAC1B,sFAAsF;IACtF,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAFnB,KAAK,EAAE,UAAU;IAC1B,sFAAsF;IACrE,WAAW,EAAE,SAAS,UAAU,EAAE;IAGrD,mFAAmF;IACnF,IAAI,MAAM,IAAI,MAAM,CAEnB;CACF;AASD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IACjC,QAAQ,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,eAAe,CAoBlB;AAgFD,iFAAiF;AACjF,qBAAa,gBAAgB;IAazB,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE;IACrC,+FAA+F;IAC/F,QAAQ,CAAC,IAAI,EAAE,MAAM;IAdvB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAE5C,6GAA6G;IAC7G,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAElC,OAAO;IAcP;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,GAAG,gBAAgB;IAqBhD,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,GAAG,gBAAgB;IAInF,yDAAyD;IACzD,IAAI,YAAY,IAAI,WAAW,EAAE,CAEhC;IAED,mGAAmG;IACnG,IAAI,QAAQ,IAAI,MAAM,GAAG,SAAS,CAEjC;IAED;;;;OAIG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;IAe9D,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS;IAIvC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE;CAGjC;AAmBD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAS5D;AAaD,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU,CAE/D"}

package/dist/v3/message.js

@@ -0,0 +1,303 @@
+// Internal to the package, and named after the FinTS specification. Documentation is where the meaning is not evident.
+import { BankMessage } from '../core/bank-info.js';
+import { FinTsFeedback } from '../core/feedback.js';
+import { TanMethod } from '../tan/tan-models.js';
+import { base64Encode, BytesBuilder, latin1Encode, utf8Decode } from '../util/bytes.js';
+import { formatFintsDate, formatFintsTime } from '../util/dates.js';
+import { FormatError } from '../util/errors.js';
+import { decodeBankText, decodeBase64Lines } from '../util/text.js';
+import { Binary, dataElementMemory, maxDataElements, parseSegments, SegmentSpec, Verbatim, } from './syntax.js';
+function isTwoStep(c) {
+    return c.securityFunction !== TanMethod.oneStep.securityFunction;
+}
+// Codes of the PIN/TAN security envelope, from the FinTS security specification. PIN/TAN neither hashes, signs nor
+// encrypts, but the envelope must name the algorithms of the chip card procedures all the same.
+/** Area the signature covers: signature head and data (SHM). */
+const signedArea = 1;
+/** Role of the security supplier: issuer (ISS). */
+const issuer = 1;
+/** Security identification: message sender (MS), empty CID, then the customer system ID. */
+function sender(systemId) {
+    return [1, null, new Verbatim(systemId)];
+}
+/** Security reference number, the same in every message. */
+const securityReference = 1;
+/** Security time stamp (STS). */
+function timestamp(time) {
+    return [1, formatFintsDate(time), formatFintsTime(time)];
+}
+/** Hash algorithm: owner hashing (OHA), mutually agreed algorithm (ZZZ), initialisation value in clear (IVC). */
+const hashAlgorithm = [1, 999, 1];
+/** Signature algorithm: owner signing (OSG), RSA, ISO 9796-1. */
+const signatureAlgorithm = [6, 10, 16];
+/** Security function of the encryption head: plain text, since PIN/TAN does not encrypt. */
+const plainText = 998;
+/**
+ * Encryption algorithm: owner symmetric (OSY), CBC, 2-key triple DES, a key of zeros, symmetric key (KYE),
+ * initialisation value in clear (IVC).
+ */
+const encryptionAlgorithm = [2, 2, 13, new Binary(new Uint8Array(8)), 5, 1];
+/** Compression function: none. */
+const noCompression = 0;
+/** Key name: bank, user, key type `S` (signature) or `V` (encryption), key number and version 0. */
+function keyName(c, keyType) {
+    return [c.countryCode, c.bankCode, c.userId, keyType, 0, 0];
+}
+/** A random integer from 0 below `bound`, from a cryptographically secure source. */
+function secureRandom(bound) {
+    const values = new Uint32Array(1);
+    crypto.getRandomValues(values);
+    return values[0] % bound;
+}
+/** A random 14-digit reference that ties the signature head (HNSHK) to the signature end (HNSHA). */
+function securityControlReference() {
+    return `${secureRandom(900000000) + 100000000}${secureRandom(100000).toString().padStart(5, '0')}`;
+}
+/** A message to send, and the same message with PIN and TAN masked for logging. */
+export class OutgoingMessage {
+    bytes;
+    maskedParts;
+    constructor(bytes, 
+    /** The parts of the masked message, each decoded on its own as the bank's text is. */
+    maskedParts) {
+        this.bytes = bytes;
+        this.maskedParts = maskedParts;
+    }
+    /** The message with PIN and TAN masked; decoded only when a logger asks for it. */
+    get masked() {
+        return this.maskedParts.map(decodeBankText).join('');
+    }
+}
+/**
+ * Builds a message: header (HNHBK), the `segments`, trailer (HNHBS).
+ *
+ * With `security` the segments are signed with PIN and optional `tan` (HNSHK … HNSHA) and wrapped in the encryption
+ * envelope (HNVSK, HNVSD) that PIN/TAN uses without actual encryption.
+ *
+ * The masked message states the sizes of its masked content, so that the log does not tell how long PIN and TAN are.
+ */
+export function buildMessage(parts) {
+    const body = parts.security === undefined
+        ? plainBody(parts.segments)
+        : signedBody(parts.segments, parts.security, parts.tan, parts.now ?? new Date());
+    const trailer = new SegmentSpec('HNHBS', 1, [parts.messageNumber]).build(body.nextNumber);
+    // The header states the size of the whole message, itself included; its own size does not depend on it.
+    const header = (size) => new SegmentSpec('HNHBK', 3, [
+        size.toString().padStart(12, '0'),
+        300,
+        new Verbatim(parts.dialogId),
+        parts.messageNumber,
+    ]).build(1);
+    const sizeOf = (sections) => header(0).length + lengthOf(sections) + trailer.length;
+    const result = new BytesBuilder();
+    result.add(header(sizeOf([body.bytes])));
+    result.add(body.bytes);
+    result.add(trailer);
+    return new OutgoingMessage(result.takeBytes(), [header(sizeOf(body.masked)), ...body.masked, trailer]);
+}
+/** The number of bytes in `parts` together. */
+function lengthOf(parts) {
+    return parts.reduce((sum, part) => sum + part.length, 0);
+}
+/** The segments of a message without security, as the anonymous dialog sends them. */
+function plainBody(segments) {
+    const built = segments.map((segment, i) => segment.build(i + 2));
+    const bytes = new BytesBuilder();
+    built.forEach((b) => {
+        bytes.add(b);
+    });
+    return { bytes: bytes.takeBytes(), masked: built, nextNumber: built.length + 2 };
+}
+/** The segments signed with PIN and optional `tan`, inside the encryption envelope. */
+function signedBody(segments, security, tan, time) {
+    const profile = ['PIN', isTwoStep(security) ? 2 : 1];
+    const controlReference = securityControlReference();
+    const inner = new BytesBuilder();
+    const maskedInner = [];
+    const addInner = (built, masked) => {
+        inner.add(built);
+        maskedInner.push(masked ?? built);
+    };
+    addInner(new SegmentSpec('HNSHK', 4, [
+        profile,
+        security.securityFunction,
+        controlReference,
+        signedArea,
+        issuer,
+        sender(security.systemId),
+        securityReference,
+        timestamp(time),
+        hashAlgorithm,
+        signatureAlgorithm,
+        keyName(security, 'S'),
+    ]).build(2));
+    let number = 3;
+    for (const segment of segments)
+        addInner(segment.build(number++));
+    const signatureEnd = (pin, tanValue) => new SegmentSpec('HNSHA', 2, [controlReference, null, [pin, tanValue]]);
+    addInner(signatureEnd(security.pin, tan).build(number), signatureEnd('***', tan === undefined ? undefined : '***').build(number));
+    const innerBytes = inner.takeBytes();
+    const encryptionHead = new SegmentSpec('HNVSK', 3, [
+        profile,
+        plainText,
+        issuer,
+        sender(security.systemId),
+        timestamp(time),
+        encryptionAlgorithm,
+        keyName(security, 'V'),
+        noCompression,
+    ]).build(998);
+    const bytes = new BytesBuilder();
+    bytes.add(encryptionHead);
+    bytes.add(new SegmentSpec('HNVSD', 1, [new Binary(innerBytes)]).build(999));
+    const masked = [
+        encryptionHead,
+        latin1Encode(`HNVSD:999:1+@${lengthOf(maskedInner)}@`),
+        ...maskedInner,
+        latin1Encode("'"),
+    ];
+    return { bytes: bytes.takeBytes(), masked, nextNumber: number + 1 };
+}
+/** A received message, with the segments of the encryption envelope unpacked. */
+export class IncomingMessage3 {
+    segments;
+    size;
+    /**
+     * Return codes for the whole message (HIRMG), then for single request segments (HIRMS).
+     *
+     * The segment a HIRMS refers to is not kept: each message carries one order, and the answer that completes an
+     * approval reports on the order of an earlier message (PIN/TAN B.4.2.1).
+     */
+    feedback;
+    /** Whether the bank rejected the message as a whole (an error in HIRMG), rather than single orders in it. */
+    messageRejected;
+    constructor(segments, 
+    /** The memory the message holds, in bytes: its length, and what its parts take beyond that. */
+    size) {
+        this.segments = segments;
+        this.size = size;
+        this.feedback = Object.freeze(['HIRMG', 'HIRMS'].flatMap((type) => segments.filter((s) => s.type === type).flatMap(feedbackOf)));
+        this.messageRejected = segments
+            .filter((s) => s.type === 'HIRMG')
+            .flatMap(feedbackOf)
+            .some((f) => f.isError);
+    }
+    /**
+     * Parses a message; throws `FormatError` if `data` is not one complete FinTS message, such as the HTML page of a
+     * proxy, a maintenance notice, a message cut short, which lacks the message trailer (HNHBS) at its end, or two
+     * messages run together, whose second would pass for part of the first.
+     *
+     * Its `size` counts the memory of its data elements along with its bytes, since a message of many short elements
+     * takes far more memory than bytes.
+     */
+    static parse(data) {
+        const budget = { elements: maxDataElements };
+        const outer = parseSegments(data, budget);
+        if (outer[0]?.type !== 'HNHBK')
+            throw new FormatError('Not a FinTS message: no message header');
+        if (outer.at(-1)?.type !== 'HNHBS')
+            throw new FormatError('Incomplete FinTS message: no message trailer');
+        if (outer.filter((s) => s.type === 'HNHBK' || s.type === 'HNHBS').length > 2) {
+            throw new FormatError('More than one FinTS message');
+        }
+        const segments = [];
+        for (const s of outer) {
+            if (s.type !== 'HNVSD') {
+                segments.push(s);
+                continue;
+            }
+            const payload = s.binary(1);
+            if (payload === undefined)
+                throw new FormatError('Encrypted data (HNVSD) without binary data');
+            for (const inner of parseSegments(payload, budget))
+                segments.push(inner);
+        }
+        return new IncomingMessage3(segments, data.length + (maxDataElements - budget.elements) * dataElementMemory);
+    }
+    static combine(first, second) {
+        return new IncomingMessage3([...first.segments, ...second.segments], first.size + second.size);
+    }
+    /** Free-text messages the bank addresses to the user. */
+    get bankMessages() {
+        return this.findAll('HIKIM').map((m) => new BankMessage(m.text(1) ?? '', m.text(2) ?? ''));
+    }
+    /** The dialog ID the bank assigned, as `Segment.verbatim` reads it, to send back byte for byte. */
+    get dialogId() {
+        return this.find('HNHBK')?.verbatim(3);
+    }
+    /**
+     * Whether the message answers message `number` of the dialog `dialogId`: header and trailer carry that number, and the
+     * header names that message where it names the message it refers to (Bezugsnachricht). The dialog ID counts only once
+     * the bank has assigned one; before, `dialogId` is `undefined`, since every first message goes out under the same.
+     */
+    answers(number, dialogId) {
+        const header = this.find('HNHBK');
+        // The trailer comes last, after the segments of the encryption envelope, which might hold one of their own.
+        const trailer = this.segments.at(-1);
+        if (header === undefined || trailer?.type !== 'HNHBS')
+            return false;
+        const inDialog = (id) => dialogId === undefined || id === dialogId;
+        const namesReference = header.group(5).some((e) => !e.isEmpty);
+        return (header.integer(4) === number &&
+            trailer.integer(1) === number &&
+            inDialog(header.verbatim(3)) &&
+            (!namesReference || (header.integer(5, 1) === number && inDialog(header.verbatim(5, 0)))));
+    }
+    find(type) {
+        return this.segments.find((s) => s.type === type);
+    }
+    findAll(type) {
+        return this.segments.filter((s) => s.type === type);
+    }
+}
+/**
+ * The return codes of `s`. Their parameters are values the client or the app sends back, such as the position to
+ * continue at or new login data, so they are read as `Segment.verbatim` reads them.
+ */
+function feedbackOf(s) {
+    const feedback = [];
+    for (let i = 1; i < s.length; i++) {
+        const code = s.text(i);
+        if (code === undefined)
+            continue;
+        const parameters = [];
+        // Empty parameters stay, as empty text, so that each keeps its position.
+        for (let j = 3; j < s.group(i).length; j++)
+            parameters.push(s.verbatim(i, j) ?? '');
+        feedback.push(new FinTsFeedback({ code, reference: s.text(i, 1), text: s.text(i, 2) ?? '', parameters }));
+    }
+    return feedback;
+}
+/**
+ * Unpacks the transport encoding: PIN/TAN servers answer in base64, a few with the raw message.
+ *
+ * Returns anything else unchanged, for `IncomingMessage3.parse` to reject.
+ */
+export function decodeTransport(body) {
+    if (startsWithMessageHeader(body))
+        return body;
+    try {
+        // Base64 is ASCII, which UTF-8 decodes natively; anything else is no base64 either way.
+        return decodeBase64Lines(utf8Decode(body, true));
+    }
+    catch (error) {
+        if (error instanceof FormatError)
+            return body;
+        throw error;
+    }
+}
+const messageHeader = latin1Encode('HNHBK');
+const whitespaceBytes = new Set([0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x20]);
+/** Whether `body` is a raw message: its header segment comes first, after any white space. */
+function startsWithMessageHeader(body) {
+    let start = 0;
+    while (start < body.length && whitespaceBytes.has(body[start]))
+        start++;
+    if (body.length - start < messageHeader.length)
+        return false;
+    return messageHeader.every((byte, i) => body[start + i] === byte);
+}
+export function encodeTransport(message) {
+    return latin1Encode(base64Encode(message));
+}
+//# sourceMappingURL=message.js.map