@coderoftime/fints 0.1.0 → 0.2.0

package/src/tan/flicker.ts

@@ -26,7 +26,8 @@ export function challengeInstruction(message: string): string {
 /**
  * Digit counts of the challenge length (LC) and of the data element lengths (LDE) to try when parsing.
  *
- * HHD 1.4 states the LC with three digits, HHD 1.3 with two.
+ * HHD 1.4 states the LC with three digits, HHD 1.3 with two. Some banks state the LDE of HHD 1.4 with three digits;
+ * a code that both LDE widths read is taken with two, as the specification has it.
  */
 const layouts = [
   { lcDigits: 3, lengthDigits: 2 },
@@ -34,6 +35,15 @@ const layouts = [
   { lcDigits: 2, lengthDigits: 2 },
 ];
 
+/** The most bytes a length field states: HHD 1.3 flags ASCII data in bit 4 of it, HHD 1.4 in bit 6. */
+const maxElementLength: Readonly<Record<HhdVersion, number>> = { hhd13: 0x0f, hhd14: 0x3f };
+
+/** The most bytes of a rendered code, which its one-byte length (LC) states. */
+const maxCodeLength = 0xff;
+
+/** The characters a TAN generator shows; one byte each. */
+const printableAscii = /^[\x20-\x7E]*$/;
+
 function hex(value: number, width: number): string {
   return value.toString(16).toUpperCase().padStart(width, '0');
 }
@@ -49,7 +59,11 @@ export class FlickerCode {
     private readonly dataElements: readonly DataElement[],
   ) {}
 
-  /** Parses the challenge data sent by the bank; throws `FormatError` if it is not a flicker code. */
+  /**
+   * Parses the challenge data sent by the bank; throws `FormatError` if it is not a flicker code a TAN generator can
+   * take: one with characters after the length it states, an empty data element, data other than printable ASCII, or
+   * more data than its length fields can state, such as more than 15 bytes in an element in HHD 1.3 or 255 bytes in all.
+   */
   static parse(code: string): FlickerCode {
     const cleaned = extractCode(code);
     for (const layout of layouts) {
@@ -89,12 +103,20 @@ export class FlickerCode {
     const dataElements: DataElement[] = [];
     for (let i = 0; i < 3; i++) {
       dataElements.push(
-        new DataElement(challenge.isAtEnd ? undefined : challenge.take(challenge.decimal(lengthDigits) & 0x3f)),
+        new DataElement(challenge.isAtEnd ? undefined : challenge.take(challenge.dataLength(lengthDigits))),
       );
     }
-    // The fields fill exactly the LC characters; a layout that reads them otherwise is the wrong one.
-    if (!challenge.isAtEnd) throw new FormatError('Flicker code fields do not match its length');
-    return new FlickerCode(controlBytes.length === 0 ? 'hhd13' : 'hhd14', lc, startCode, dataElements);
+    // Only a layout whose fields fill exactly the LC characters, which end the code, can be the right one.
+    if (!challenge.isAtEnd || !code.isAtEnd) throw new FormatError('Flicker code fields do not match its length');
+    const flicker = new FlickerCode(controlBytes.length === 0 ? 'hhd13' : 'hhd14', lc, startCode, dataElements);
+    if (!flicker.fitsTanGenerator) throw new FormatError('Flicker code data the TAN generator cannot take');
+    return flicker;
+  }
+
+  /** Whether the code renders as the bank sent it: its data printable ASCII, every length within its field. */
+  private get fitsTanGenerator(): boolean {
+    const elements = [this.startCode, ...this.dataElements];
+    return elements.every((element) => element.fits(this.version)) && this.payload().length <= 2 * maxCodeLength;
   }
 
   /** The data of the start code, which opens the challenge. */
@@ -216,6 +238,16 @@ class Reader {
     return parseInt(Reader.match(/^[0-9A-Fa-f]+$/, this.take(digits)), 16);
   }
 
+  /**
+   * A data element length field (LDE) of `digits` decimal digits: 1 to 63 characters. The challenge leaves out an
+   * element without data, and sets none of the flags in bits 6 and 7, which only the rendered code carries.
+   */
+  dataLength(digits: number): number {
+    const length = this.decimal(digits);
+    if (length === 0 || length > 0x3f) throw new FormatError('Invalid data element length');
+    return length;
+  }
+
   private static match(pattern: RegExp, field: string): string {
     if (!pattern.test(field)) throw new FormatError('Invalid length field', field);
     return field;
@@ -233,6 +265,12 @@ class DataElement {
     return this.data === undefined || /^[0-9]+$/.test(this.data);
   }
 
+  /** Whether the data are printable ASCII, and no more bytes than the length field of `version` can state. */
+  fits(version: HhdVersion): boolean {
+    const d = this.data;
+    return d === undefined || (printableAscii.test(d) && this.renderData().length / 2 <= maxElementLength[version]);
+  }
+
   renderData(): string {
     const d = this.data;
     if (d === undefined) return '';

package/src/tan/tan-image.ts

@@ -1,6 +1,7 @@
 import { base64Encode, latin1Decode } from '../util/bytes.js';
 
-const imageMimeType = /^image\/[a-zA-Z0-9.+-]+$/;
+/** The formats of photoTAN and QR-TAN images: raster images, which unlike SVG cannot carry scripts. */
+const imageMimeTypes = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp', 'image/bmp']);
 
 /** An image challenge (photoTAN, QR-TAN) with its MIME type. */
 export class TanImage {
@@ -14,14 +15,15 @@ export class TanImage {
   /**
    * Reads the bank's image container: a two-byte length and the MIME type, then a two-byte length and the image.
    *
-   * `undefined` unless the MIME type is an image type and the container holds the whole image.
+   * `undefined` unless the MIME type, in any case, is that of a PNG, JPEG, GIF, WebP or BMP image, and the container
+   * holds the whole image.
    */
   static tryParse(data: Uint8Array): TanImage | undefined {
     if (data.length < 4) return undefined;
     const mimeLength = (data[0]! << 8) | data[1]!;
     if (mimeLength === 0 || data.length < 2 + mimeLength + 2) return undefined;
-    const mime = latin1Decode(data.subarray(2, 2 + mimeLength));
-    if (!imageMimeType.test(mime)) return undefined;
+    const mime = latin1Decode(data.subarray(2, 2 + mimeLength)).toLowerCase();
+    if (!imageMimeTypes.has(mime)) return undefined;
     const offset = 2 + mimeLength;
     const imageLength = (data[offset]! << 8) | data[offset + 1]!;
     const start = offset + 2;
@@ -29,7 +31,7 @@ export class TanImage {
     return new TanImage(mime, data.subarray(start, start + imageLength));
   }
 
-  /** The image as a `data:` URL, ready for the `src` of an `<img>`. */
+  /** The image as a `data:` URL, for the `src` of an `<img>` only: the bytes are the bank's, whatever their type says. */
   toDataUrl(): string {
     return `data:${this.mimeType};base64,${base64Encode(this.bytes)}`;
   }

package/src/tan/tan-models.ts

@@ -1,3 +1,4 @@
+import { copyDate } from '../util/dates.js';
 import { maskedId } from '../util/text.js';
 
 /** Whether a TAN method needs the name of a TAN medium. */
@@ -82,7 +83,10 @@ export class TanMethod {
   /** Whether approval happens in a separate app instead of entering a TAN. */
   readonly decoupled: boolean;
 
-  /** Most status requests the bank allows for a decoupled approval; 0 allows any number. */
+  /**
+   * Most status requests the bank allows for a decoupled approval, 0 for any number. The client sends 60 where the bank
+   * states none, and polls for 10 minutes at most.
+   */
   readonly decoupledMaxPolls: number | undefined;
 
   /** How long to wait before the first status request of a decoupled approval, in seconds. */
@@ -219,6 +223,7 @@ export class TanMedium {
   /** When the medium was activated. */
   readonly activatedOn: Date | undefined;
 
+  /** Takes copies of the dates of `init`: each medium has its own, which no other one shares. */
   constructor(init: TanMediumInit) {
     this.mediumClass = init.mediumClass;
     this.status = init.status;
@@ -228,10 +233,10 @@ export class TanMedium {
     this.cardSequenceNumber = init.cardSequenceNumber;
     this.mobileNumber = init.mobileNumber;
     this.mobileNumberMasked = init.mobileNumberMasked;
-    this.validFrom = init.validFrom;
-    this.validUntil = init.validUntil;
-    this.lastUsed = init.lastUsed;
-    this.activatedOn = init.activatedOn;
+    this.validFrom = copyDate(init.validFrom);
+    this.validUntil = copyDate(init.validUntil);
+    this.lastUsed = copyDate(init.lastUsed);
+    this.activatedOn = copyDate(init.activatedOn);
   }
 
   /** Whether the medium is the one in use. */

package/src/util/async.ts

@@ -46,8 +46,3 @@ export class SerialExecutor {
     return result;
   }
 }
-
-/** Waits for `promise` and ignores its result, so that neither a value nor an error goes unhandled. */
-export function ignoreOutcome(promise: Promise<unknown>): void {
-  promise.catch(() => undefined);
-}

package/src/util/bytes.ts

@@ -16,16 +16,9 @@ export function concatBytes(parts: readonly Uint8Array[]): Uint8Array {
 /** Collects bytes, like a growing buffer. */
 export class BytesBuilder {
   private readonly parts: Uint8Array[] = [];
-  private size = 0;
-
-  get length(): number {
-    return this.size;
-  }
 
   add(bytes: Uint8Array | readonly number[]): void {
-    const part = bytes instanceof Uint8Array ? bytes : Uint8Array.from(bytes);
-    this.parts.push(part);
-    this.size += part.length;
+    this.parts.push(bytes instanceof Uint8Array ? bytes : Uint8Array.from(bytes));
   }
 
   addByte(byte: number): void {
@@ -35,7 +28,6 @@ export class BytesBuilder {
   takeBytes(): Uint8Array {
     const result = concatBytes(this.parts);
     this.parts.length = 0;
-    this.size = 0;
     return result;
   }
 }
@@ -49,15 +41,23 @@ export function latin1Encode(text: string): Uint8Array {
 
 /** The text of ISO 8859-1 `bytes`. */
 export function latin1Decode(bytes: Uint8Array): string {
+  return fromCharCodes(bytes);
+}
+
+/** The text of the UTF-16 code units `codes`. */
+export function fromCharCodes(codes: Uint8Array | Uint16Array): string {
   let text = '';
-  // In chunks, since a spread of a large array exceeds the argument limit of some engines.
-  for (let i = 0; i < bytes.length; i += 0x8000) {
-    text += String.fromCharCode(...bytes.subarray(i, i + 0x8000));
+  // In chunks, since a large array exceeds the argument limit of some engines. `apply` takes the array as it is, where a
+  // spread would iterate over it.
+  for (let i = 0; i < codes.length; i += 0x8000) {
+    text += Reflect.apply(String.fromCharCode, undefined, codes.subarray(i, i + 0x8000)) as string;
   }
   return text;
 }
 
 const utf8Encoder = new TextEncoder();
+const utf8Decoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+const lenientUtf8Decoder = new TextDecoder('utf-8', { ignoreBOM: true });
 
 export function utf8Encode(text: string): Uint8Array {
   return utf8Encoder.encode(text);
@@ -66,7 +66,7 @@ export function utf8Encode(text: string): Uint8Array {
 /** Decodes UTF-8; throws `FormatError` for malformed data unless `allowMalformed`. */
 export function utf8Decode(bytes: Uint8Array, allowMalformed = false): string {
   try {
-    return new TextDecoder('utf-8', { fatal: !allowMalformed, ignoreBOM: true }).decode(bytes);
+    return (allowMalformed ? lenientUtf8Decoder : utf8Decoder).decode(bytes);
   } catch {
     throw new FormatError('Invalid UTF-8');
   }
@@ -127,9 +127,3 @@ export function base64Decode(text: string): Uint8Array {
   }
   return out;
 }
-
-export function bytesEqual(a: Uint8Array, b: Uint8Array): boolean {
-  if (a.length !== b.length) return false;
-  for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
-  return true;
-}

package/src/util/call-context.ts

@@ -7,8 +7,9 @@ interface AsyncStorage<T> {
 type AsyncStorageConstructor = new <T>() => AsyncStorage<T>;
 
 /**
- * `AsyncLocalStorage` where the runtime has it (Node.js, Deno, Bun), found without importing `node:async_hooks`, so that
- * bundlers for the browser have nothing to resolve.
+ * `AsyncLocalStorage` where the runtime has it, found through `process.getBuiltinModule` (Node.js 22.3, Deno 2.1 and
+ * Bun 1.2.6 or later) rather than by importing `node:async_hooks`, so that bundlers for the browser have nothing to
+ * resolve.
  */
 const AsyncStorageClass: AsyncStorageConstructor | undefined = (() => {
   const runtime = globalThis as {

package/src/util/dates.ts

@@ -31,6 +31,7 @@ const fintsDate = /^(\d{4})(\d{2})(\d{2})$/;
 const fintsTime = /^(\d{2})(\d{2})(\d{2})/;
 const isoDate = /^(\d{4})-(\d{2})-(\d{2})/;
 const isoTime = /^(\d{2}):(\d{2}):(\d{2})/;
+const isoDateTime = /^(\d{4}-\d{2}-\d{2})T(\d{2}:\d{2}:\d{2})(?:\.\d+)?(Z|[+-]\d{2}:\d{2})?$/;
 
 /** Parses a FinTS 3.0 date `YYYYMMDD` as a calendar date; `undefined` if it is missing or invalid. */
 export function parseFintsDate(date: string | undefined): Date | undefined {
@@ -53,9 +54,21 @@ export function parseIsoDate(date: string | undefined): Date | undefined {
   return parseDate(isoDate, date);
 }
 
-/** Parses an ISO 8601 date `YYYY-MM-DD` and time `HH:MM:SS` as the moment they name. */
-export function parseIsoDateTime(date: string | undefined, time: string | undefined): Date | undefined {
-  return moment(parseDate(isoDate, date), isoTime, time);
+/**
+ * Parses an ISO 8601 date and time as XML Schema writes it, `YYYY-MM-DDThh:mm:ss` with optional fractional seconds and
+ * UTC offset (`Z` or `±hh:mm`), as the moment it names, to the second: in German time where it states no offset.
+ * `undefined` if it is missing or invalid.
+ */
+export function parseIsoMoment(dateTime: string | undefined): Date | undefined {
+  const m = dateTime === undefined ? null : isoDateTime.exec(dateTime);
+  if (!m) return undefined;
+  const [, date, time, offset] = m;
+  const german = moment(parseIsoDate(date), isoTime, time);
+  if (german === undefined || offset === undefined) return german;
+  // Every engine reads a valid date and time with an offset alike (ECMAScript Date Time String Format), but some roll
+  // an invalid date, such as 30 February, over into the next month: `german` has checked them.
+  const exact = new Date(`${date}T${time}${offset}`);
+  return Number.isNaN(exact.getTime()) ? undefined : exact;
 }
 
 function parseDate(pattern: RegExp, date: string | undefined): Date | undefined {
@@ -63,13 +76,19 @@ function parseDate(pattern: RegExp, date: string | undefined): Date | undefined
   return d ? validDate(Number(d[1]), Number(d[2]), Number(d[3])) : undefined;
 }
 
+/** Hour, minute and second of the time matched by `pattern` in `time`; `undefined` if it is missing or invalid. */
+function parseTime(pattern: RegExp, time: string | undefined): [number, number, number] | undefined {
+  const t = time === undefined ? null : pattern.exec(time);
+  if (!t) return undefined;
+  const [hour, minute, second] = [Number(t[1]), Number(t[2]), Number(t[3])];
+  return hour > 23 || minute > 59 || second > 59 ? undefined : [hour, minute, second];
+}
+
 /** The moment of the German time matched by `timePattern` in `time` on `day`. */
 function moment(day: Date | undefined, timePattern: RegExp, time: string | undefined): Date | undefined {
-  const t = time === undefined ? null : timePattern.exec(time);
-  if (day === undefined || !t) return undefined;
-  const [hour, minute, second] = [Number(t[1]), Number(t[2]), Number(t[3])];
-  if (hour > 23 || minute > 59 || second > 59) return undefined;
-  return germanTime(day.getFullYear(), day.getMonth() + 1, day.getDate(), hour, minute, second);
+  const t = parseTime(timePattern, time);
+  if (day === undefined || t === undefined) return undefined;
+  return germanTime(day.getFullYear(), day.getMonth() + 1, day.getDate(), ...t);
 }
 
 /**
@@ -79,11 +98,9 @@ function moment(day: Date | undefined, timePattern: RegExp, time: string | undef
  */
 export function parseUtcPlusOneDateTime(date: string | undefined, time: string | undefined): Date | undefined {
   const day = parseDate(fintsDate, date);
-  const t = time === undefined ? null : fintsTime.exec(time.padStart(6, '0'));
-  if (day === undefined || !t) return undefined;
-  const [hour, minute, second] = [Number(t[1]), Number(t[2]), Number(t[3])];
-  if (hour > 23 || minute > 59 || second > 59) return undefined;
-  return new Date(utc(day.getFullYear(), day.getMonth() + 1, day.getDate(), hour, minute, second) - hourMs);
+  const t = parseTime(fintsTime, time?.padStart(6, '0'));
+  if (day === undefined || t === undefined) return undefined;
+  return new Date(utc(day.getFullYear(), day.getMonth() + 1, day.getDate(), ...t) - hourMs);
 }
 
 /**
@@ -93,14 +110,7 @@ export function parseUtcPlusOneDateTime(date: string | undefined, time: string |
  * Sunday of October (the EU rule). The hour the clocks show twice in October counts as CEST; a time in the hour that is
  * skipped in March counts as CET.
  */
-export function germanTime(
-  year: number,
-  month: number,
-  day: number,
-  hour: number,
-  minute: number,
-  second: number,
-): Date {
+function germanTime(year: number, month: number, day: number, hour: number, minute: number, second: number): Date {
   const clock = utc(year, month, day, hour, minute, second);
   const summer = clock - 2 * hourMs;
   return new Date(isSummerTime(summer) ? summer : clock - hourMs);
@@ -134,7 +144,7 @@ function utc(year: number, month: number, day: number, hour: number, minute: num
 }
 
 /** Local midnight of the day; `month` counts from 1, and years below 100 are not moved to 19xx. */
-export function localDate(year: number, month: number, day: number): Date {
+function localDate(year: number, month: number, day: number): Date {
   const d = new Date(0);
   d.setFullYear(year, month - 1, day);
   d.setHours(0, 0, 0, 0);
@@ -142,7 +152,7 @@ export function localDate(year: number, month: number, day: number): Date {
 }
 
 /** The date, or `undefined` if `month` or `day` is out of range; `Date` would roll it over into another date. */
-export function validDate(year: number, month: number, day: number): Date | undefined {
+function validDate(year: number, month: number, day: number): Date | undefined {
   if (month < 1 || month > 12 || day < 1 || day > daysInMonth(year, month)) return undefined;
   return localDate(year, month, day);
 }
@@ -170,11 +180,18 @@ export function parseSwiftDate(yymmdd: string): Date | undefined {
 }
 
 /** Number of days the `month` (1 to 12) of `year` has. */
-export function daysInMonth(year: number, month: number): number {
+function daysInMonth(year: number, month: number): number {
   if (month === 2) return (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0 ? 29 : 28;
   return [4, 6, 9, 11].includes(month) ? 30 : 31;
 }
 
+/** A copy of `d`, so that a model keeps dates of its own: a `Date` can be changed in place. */
+export function copyDate(d: Date): Date;
+export function copyDate(d: Date | undefined): Date | undefined;
+export function copyDate(d: Date | undefined): Date | undefined {
+  return d && new Date(d.getTime());
+}
+
 /** The calendar day `moment` falls on in local time, as a local `Date` at midnight. */
 export function calendarDay(moment: Date): Date {
   return localDate(moment.getFullYear(), moment.getMonth() + 1, moment.getDate());

package/src/util/errors.ts

@@ -1,15 +1,26 @@
-/** Data that do not have the expected format, such as a malformed MT940 line or amount. */
+/**
+ * Data that do not have the expected format, such as a malformed MT940 line or amount.
+ *
+ * The message leaves out `source`, which may hold account data, such as amounts, names and IBANs, so that logs and
+ * crash reports do not collect them.
+ */
 export class FormatError extends Error {
+  override name = 'FormatError';
+
   /** The part of the data that is malformed, where the parser can tell it. */
   readonly source: string | undefined;
 
   constructor(message: string, source?: string) {
-    super(source === undefined ? message : `${message}: ${source}`);
-    this.name = 'FormatError';
+    super(message);
     this.source = source;
   }
 }
 
+/** Throws a `FormatError`, where an expression is expected, such as `value ?? fail('…')`. */
+export function fail(message: string, source?: string): never {
+  throw new FormatError(message, source);
+}
+
 /** An argument the function cannot work with, such as an empty PIN. The message never contains a PIN. */
 export function invalidArgument(message: string, name?: string): TypeError {
   return new TypeError(name === undefined ? message : `Invalid argument (${name}): ${message}`);

package/src/util/json.ts

@@ -25,6 +25,14 @@ export function readOptionalInt(json: JsonObject, key: string): number | undefin
   return value;
 }
 
+/** The optional boolean at `key`; throws `FormatError` for a value of another type. */
+export function readOptionalBoolean(json: JsonObject, key: string): boolean | undefined {
+  const value = json[key];
+  if (value === undefined || value === null) return undefined;
+  if (typeof value !== 'boolean') throw new FormatError(`Saved state: "${key}" is not a boolean`);
+  return value;
+}
+
 /** The object at `key`; throws `FormatError` if it is missing or not an object. */
 export function readObject(json: JsonObject, key: string): JsonObject {
   const value = json[key];
@@ -32,6 +40,14 @@ export function readObject(json: JsonObject, key: string): JsonObject {
   return value;
 }
 
+/** The optional object at `key`; throws `FormatError` for a value of another type. */
+export function readOptionalObject(json: JsonObject, key: string): JsonObject | undefined {
+  const value = json[key];
+  if (value === undefined || value === null) return undefined;
+  if (!isJsonObject(value)) throw new FormatError(`Saved state: "${key}" is not an object`);
+  return value;
+}
+
 /** The optional list at `key`, each element checked by `isElement`; throws `FormatError` for anything else. */
 export function readOptionalList<T>(
   json: JsonObject,

package/src/util/text.ts

@@ -1,14 +1,19 @@
-import { base64Decode, latin1Decode, utf8Decode } from './bytes.js';
+import { base64Decode, fromCharCodes, latin1Decode, utf8Decode } from './bytes.js';
 import { FormatError } from './errors.js';
 
 const xmlEncodingDeclaration = /encoding\s*=\s*["']([A-Za-z0-9._-]+)["']/;
 const whitespace = /\s/g;
 
-/** Decodes text from the bank, which may be UTF-8 (with or without BOM) or ISO 8859-1. */
+/**
+ * Decodes text from the bank, which may be UTF-8 (with or without BOM) or ISO 8859-1; ASCII reads the same in both.
+ *
+ * UTF-8 comes first, since some banks send it. ISO 8859-1 text that happens to be valid UTF-8, such as `ß°`, reads as
+ * UTF-8 then: a rare misreading of text shown, as values sent back to the bank are read byte for byte
+ * (`Segment.verbatim`).
+ */
 export function decodeBankText(bytes: Uint8Array): string {
   const hasBom = bytes.length >= 3 && bytes[0] === 0xef && bytes[1] === 0xbb && bytes[2] === 0xbf;
   const content = hasBom ? bytes.subarray(3) : bytes;
-  if (content.every((b) => b < 0x80)) return latin1Decode(content);
   try {
     return utf8Decode(content);
   } catch (error) {
@@ -44,11 +49,18 @@ const windows1252High = [
   0x0153, 0x009d, 0x017e, 0x0178,
 ];
 
-/** Decodes Windows-1252, which matches ISO 8859-1 except for `€`, typographic quotes and a few letters. */
+/**
+ * Decodes Windows-1252, which matches ISO 8859-1 except for `€`, typographic quotes and a few letters.
+ *
+ * @internal Exported for the tests.
+ */
 export function decodeWindows1252(bytes: Uint8Array): string {
-  let text = '';
-  for (const b of bytes) text += String.fromCharCode(b >= 0x80 && b < 0xa0 ? windows1252High[b - 0x80]! : b);
-  return text;
+  const codes = new Uint16Array(bytes.length);
+  for (let i = 0; i < bytes.length; i++) {
+    const b = bytes[i]!;
+    codes[i] = b >= 0x80 && b < 0xa0 ? windows1252High[b - 0x80]! : b;
+  }
+  return fromCharCodes(codes);
 }
 
 /**
@@ -59,6 +71,29 @@ export function maskedId(id: string): string {
   return id.length <= 4 ? '…' : `…${id.substring(id.length - 4)}`;
 }
 
+/** Whether `value` fits into ISO 8859-1, the FinTS 3.0 character set. */
+export function isLatin1(value: string): boolean {
+  for (let i = 0; i < value.length; i++) if (value.charCodeAt(i) > 0xff) return false;
+  return true;
+}
+
+/** `text` without blanks around it; `undefined` if that leaves nothing. */
+export function nonBlank(text: string | undefined): string | undefined {
+  const trimmed = text?.trim();
+  return trimmed === '' ? undefined : trimmed;
+}
+
+/**
+ * The character the numeric character reference `name` names, such as `#x41` or `#65`; `undefined` for any other name,
+ * and for a number that is no character as XML defines them: `NUL`, half a surrogate pair, or beyond Unicode.
+ */
+export function characterReference(name: string): string | undefined {
+  const m = /^#(?:x([0-9a-fA-F]+)|([0-9]+))$/.exec(name);
+  if (!m) return undefined;
+  const code = m[1] === undefined ? parseInt(m[2]!, 10) : parseInt(m[1], 16);
+  return code > 0 && (code < 0xd800 || code > 0xdfff) && code <= 0x10ffff ? String.fromCodePoint(code) : undefined;
+}
+
 /** `text` without spaces and line breaks. */
 export function withoutWhitespace(text: string): string {
   return text.replace(whitespace, '');
@@ -69,11 +104,6 @@ export function decodeBase64Lines(text: string): Uint8Array {
   return base64Decode(withoutWhitespace(text));
 }
 
-/** `text` with every match of `pattern`, a literal string, escaped for use in a regular expression. */
-export function escapeRegExp(text: string): string {
-  return text.replace(/[.*+?^${}()|[\]\\/-]/g, '\\$&');
-}
-
 /** The integer `text` states, decimal digits with an optional sign and blanks around; `undefined` for anything else. */
 export function tryParseInt(text: string | undefined): number | undefined {
   if (text === undefined) return undefined;