@coderoftime/fints 0.1.0 → 0.2.0

package/src/util/xml.ts

@@ -1,4 +1,5 @@
 import { FormatError } from './errors.js';
+import { characterReference, nonBlank } from './text.js';
 
 /**
  * An element of a parsed XML document, looked up by local name: camt documents come with and without namespace
@@ -29,7 +30,7 @@ export class XmlElement {
 
   /** The first child element called `localName`. */
   child(localName: string): XmlElement | undefined {
-    return this.childElements.find((c) => c.localName === localName);
+    return this.children.find((c): c is XmlElement => c instanceof XmlElement && c.localName === localName);
   }
 
   /** The element reached by following child names along `path`; this element for an empty path. */
@@ -39,21 +40,12 @@ export class XmlElement {
 
   /** The trimmed text of the element at `path`, or `undefined` if it is missing or empty. */
   textAt(path: readonly string[]): string | undefined {
-    const text = this.at(path)?.innerText.trim();
-    return text === undefined || text === '' ? undefined : text;
+    return nonBlank(this.at(path)?.innerText);
   }
 
-  /** All elements below this one called `localName`, in document order. */
-  descendantsNamed(localName: string): XmlElement[] {
-    const found: XmlElement[] = [];
-    const visit = (element: XmlElement): void => {
-      for (const c of element.childElements) {
-        if (c.localName === localName) found.push(c);
-        visit(c);
-      }
-    };
-    visit(this);
-    return found;
+  /** The child elements called `localName`, in document order. */
+  childrenNamed(localName: string): XmlElement[] {
+    return this.children.filter((c): c is XmlElement => c instanceof XmlElement && c.localName === localName);
   }
 }
 
@@ -65,7 +57,24 @@ function matchAt(pattern: RegExp, text: string, position: number): RegExpExecArr
   pattern.lastIndex = position;
   return pattern.exec(text);
 }
-const predefinedEntities: Record<string, string> = { amp: '&', lt: '<', gt: '>', quot: '"', apos: "'" };
+const predefinedEntities = new Map([
+  ['amp', '&'],
+  ['lt', '<'],
+  ['gt', '>'],
+  ['quot', '"'],
+  ['apos', "'"],
+]);
+
+/** Deepest nesting of elements the parser takes: camt needs fewer than 20 levels, and `innerText` recurses. */
+const maxDepth = 256;
+
+/**
+ * Most elements and attributes one document may hold. Real camt spends about 20 bytes on each, so the largest answer a
+ * bank can send holds fewer than 600,000, while a hostile document stays within about 150 MB of memory.
+ */
+const maxNodes = 1_000_000;
+
+const noAttributes: ReadonlyMap<string, string> = new Map();
 
 function localNameOf(qualified: string): string {
   const colon = qualified.indexOf(':');
@@ -77,22 +86,19 @@ function decodeEntities(text: string): string {
   return text.replace(/&([^;&\s]*);?/g, (match, name: string) => {
     if (!match.endsWith(';')) throw new FormatError('Invalid XML: unterminated entity reference');
     if (name.startsWith('#')) {
-      const hex = name.startsWith('#x');
-      const digits = name.substring(hex ? 2 : 1);
-      const code = (hex ? /^[0-9a-fA-F]+$/ : /^\d+$/).test(digits) ? parseInt(digits, hex ? 16 : 10) : NaN;
-      if (!(code > 0 && code <= 0x10ffff && (code < 0xd800 || code > 0xdfff))) {
-        throw new FormatError('Invalid XML character reference', match);
-      }
-      return String.fromCodePoint(code);
+      const character = characterReference(name);
+      if (character === undefined) throw new FormatError('Invalid XML character reference', match);
+      return character;
     }
-    const value = predefinedEntities[name];
+    const value = predefinedEntities.get(name);
     if (value === undefined) throw new FormatError('Invalid XML: unknown entity', match);
     return value;
   });
 }
 
 /**
- * Parses an XML document and returns its root element; throws `FormatError` if it is not well-formed.
+ * Parses an XML document and returns its root element; throws `FormatError` if it is not well-formed, nests elements
+ * deeper than 256 levels or holds more than a million elements and attributes.
  *
  * A document type declaration is refused: bank data have none, and its entities could expand without limit.
  */
@@ -100,6 +106,7 @@ export function parseXml(xml: string): XmlElement {
   let position = 0;
   const stack: XmlElement[] = [];
   let root: XmlElement | undefined;
+  let nodes = 0;
 
   const fail = (reason: string): never => {
     throw new FormatError(`Invalid XML: ${reason} at position ${position}`);
@@ -142,16 +149,20 @@ export function parseXml(xml: string): XmlElement {
       const open = stack.pop();
       if (open === undefined || open.localName !== localNameOf(name)) fail(`unexpected end tag ${name}`);
     } else {
+      if (stack.length >= maxDepth) fail(`elements nested deeper than ${maxDepth} levels`);
+      if (++nodes > maxNodes) fail(`more than ${maxNodes} elements and attributes`);
       position++;
       const name = matchAt(namePattern, xml, position)?.[0] ?? fail('missing element name');
       position += name.length;
-      const attributes = new Map<string, string>();
+      let attributes: Map<string, string> | undefined;
       for (;;) {
         const attribute = matchAt(attributePattern, xml, position);
         if (!attribute) break;
         position += attribute[0].length;
+        if (++nodes > maxNodes) fail(`more than ${maxNodes} elements and attributes`);
         const attributeName = attribute[1]!;
         if (attributeName !== 'xmlns' && !attributeName.startsWith('xmlns:')) {
+          attributes ??= new Map();
           attributes.set(localNameOf(attributeName), decodeEntities(attribute[2] ?? attribute[3] ?? ''));
         }
       }
@@ -159,7 +170,7 @@ export function parseXml(xml: string): XmlElement {
       const selfClosing = xml.startsWith('/>', position);
       if (!selfClosing && xml.charAt(position) !== '>') fail(`malformed start tag ${name}`);
       position += selfClosing ? 2 : 1;
-      const element = new XmlElement(localNameOf(name), attributes);
+      const element = new XmlElement(localNameOf(name), attributes ?? noAttributes);
       const parent = stack.at(-1);
       if (parent) parent.children.push(element);
       else if (root) fail('a second root element');

package/src/v3/account-extension.ts

@@ -4,7 +4,9 @@ import { AccountDataStatus, type Account } from '../core/account.js';
 import { Amount, withMark } from '../core/amount.js';
 import { Balance } from '../core/balance.js';
 import { parseFintsDate, parseUtcPlusOneDateTime } from '../util/dates.js';
-import { FormatError } from '../util/errors.js';
+import { fail, FormatError } from '../util/errors.js';
+import { isJsonObject } from '../util/json.js';
+import { nonBlank } from '../util/text.js';
 
 /** A booked or pending balance of the extension: credit/debit mark, value, date and time. */
 interface Saldo {
@@ -47,7 +49,7 @@ export class AccountExtension {
   static tryParse(json: string): AccountExtension | undefined {
     try {
       const decoded: unknown = JSON.parse(json);
-      return isObject(decoded) ? AccountExtension.read(new Json(decoded)) : undefined;
+      return isJsonObject(decoded) ? AccountExtension.read(new Json(decoded)) : undefined;
     } catch (error) {
       if (error instanceof FormatError || error instanceof SyntaxError) return undefined;
       throw error;
@@ -76,6 +78,7 @@ export class AccountExtension {
     if (b === undefined || !this.balanceComplete) return undefined;
     return new Balance({
       account,
+      productName: account.productName,
       booked: b.booked.amount,
       bookedAsOf: b.booked.date,
       bookedAsOfTime: b.booked.time,
@@ -129,14 +132,6 @@ function moment(json: Json, defaultTime?: string): Date | undefined {
   return parseUtcPlusOneDateTime(json.string('Date'), time) ?? fail('Extension date or time is malformed');
 }
 
-function fail(message: string): never {
-  throw new FormatError(message);
-}
-
-function isObject(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
 /**
  * A JSON object of the extension, read by key without regard to case: the specification itself spells some keys
  * differently (`OverDraftLim` and `OverdraftLim`). Values of the wrong type are a `FormatError`.
@@ -156,7 +151,7 @@ class Json {
   string(key: string): string | undefined {
     const value = this.value(key);
     if (value === undefined || value === null) return undefined;
-    if (typeof value === 'string') return value.trim() === '' ? undefined : value.trim();
+    if (typeof value === 'string') return nonBlank(value);
     if (typeof value === 'number') return String(value);
     throw new FormatError(`Extension element "${key}" is not text`);
   }
@@ -172,7 +167,7 @@ class Json {
   object(key: string): Json | undefined {
     const value = this.value(key);
     if (value === undefined || value === null) return undefined;
-    if (isObject(value)) return new Json(value);
+    if (isJsonObject(value)) return new Json(value);
     throw new FormatError(`Extension element "${key}" is not an object`);
   }
 

package/src/v3/bank-connection.ts

@@ -0,0 +1,67 @@
+import type { MessageDirection, MessageLogger } from '../core/client.js';
+import { FinTsProtocolError, FinTsTransportError } from '../core/errors.js';
+import { failureMessage, HttpTransport, type FinTsTransport } from '../core/transport.js';
+
+/**
+ * Throws `FinTsProtocolError` if a message of `size` bytes exceeds the bank's `limit` in kilobytes (1024 bytes): the
+ * specification does not allow to send such a message.
+ */
+export function checkMessageSize(size: number, limit: number | undefined): void {
+  if (limit !== undefined && limit > 0 && size > limit * 1024) {
+    throw new FinTsProtocolError(`A message of ${size} bytes exceeds the bank's maximum message size of ${limit} KB`);
+  }
+}
+
+/** The bank's FinTS endpoint: posts messages there and reports them to the logger. */
+export class BankConnection {
+  private readonly transport: FinTsTransport;
+
+  /** Where the messages go, as `FinTsConfig` checked it. */
+  private readonly href: string;
+
+  /** Aborts the requests on their way (`abortRequests`). */
+  private requests = new AbortController();
+
+  /** A connection to `url` through `transport`, an `HttpTransport` by default. */
+  constructor(
+    url: URL,
+    transport: FinTsTransport | undefined,
+    private readonly logger: MessageLogger | undefined,
+  ) {
+    this.href = url.href;
+    this.transport = transport ?? new HttpTransport();
+  }
+
+  /**
+   * Posts `body` to a new copy of the URL, so that a transport that changes the one it is given changes no later
+   * request.
+   *
+   * Reports any failure of the transport as `FinTsTransportError`: a custom transport that calls `fetch` fails with a
+   * `TypeError` where the network does, and one that throws another `FinTsError`, such as `FinTsPinError`, would pass
+   * for an answer of the bank. Of such an error only the message is kept (`failureMessage`), since it may hold `body`,
+   * as the errors of HTTP clients such as axios do.
+   */
+  async post(body: Uint8Array, contentType: string): Promise<Uint8Array> {
+    try {
+      return await this.transport.post(new URL(this.href), body, contentType, this.requests.signal);
+    } catch (error) {
+      if (error instanceof FinTsTransportError) throw error;
+      throw new FinTsTransportError(failureMessage(error));
+    }
+  }
+
+  /** Reports a message to the logger; `message` is only built when a logger is set. */
+  log(direction: MessageDirection, message: () => string): void {
+    this.logger?.(direction, message());
+  }
+
+  /** Aborts the requests on their way; those posted afterwards, such as the dialog ends of a closing client, go out. */
+  abortRequests(): void {
+    this.requests.abort();
+    this.requests = new AbortController();
+  }
+
+  close(): void {
+    this.transport.close();
+  }
+}

package/src/v3/dialog.ts

@@ -1,13 +1,12 @@
 // Internal to the package, and named after the FinTS specification. Documentation is where the meaning is not evident.
 
-import { FinTsProtocolError } from '../core/errors.js';
-import { FeedbackCodes, hasCode } from '../core/feedback.js';
-import { requireBankParameters } from '../session/parameter-data.js';
-import { PinTanDialog } from '../session/pin-tan-dialog.js';
-import type { Approval, StartWithOrder } from '../session/protocol.js';
+import { FinTsError, FinTsProtocolError, FinTsTransportError, parseBankData } from '../core/errors.js';
+import { endsDialog, FeedbackCodes, hasCode, hasErrors } from '../core/feedback.js';
+import { challengeText, TanChallenge } from '../tan/challenge.js';
 import { TanMethod } from '../tan/tan-models.js';
 import { IncomingMessage3 } from './message.js';
-import type { Bpd3 } from './parameters.js';
+import { requireBankParameters } from './parameters.js';
+import type { FinTs3Protocol } from './protocol.js';
 import { Segments, TanResponse } from './segments.js';
 import type { SegmentSpec } from './syntax.js';
 
@@ -20,96 +19,121 @@ const firstScaVersion = 6;
 /** The first version of HKTAN that supports app approvals, with the status request (process S). */
 const firstDecoupledVersion = 7;
 
-/** How a message is signed: the security function of the TAN method and the customer system ID. */
-export interface Signing3 {
-  readonly securityFunction: string;
-  readonly systemId: string;
-}
-
 /**
- * What a dialog needs from the session: the parameter data received so far, the segments that open a dialog, and the
- * way to the bank. The `FinTs3Protocol` provides it, and keeps the login data and the PIN to itself.
+ * How long a dialog may stay idle where the bank states no timeout: on the safe side, since a dialog given up too early
+ * only costs a new login, while one kept too long fails the next call.
  */
-export interface FinTs3DialogHost {
-  /** The bank parameter data received so far, if any. */
-  readonly bankParameters: Bpd3 | undefined;
+const defaultIdleLimitMs = 5 * 60_000;
+
+/** The bank's request to approve a message with a TAN or in a banking app; `R` is the bank's answer. */
+export interface Approval<R> {
+  /** What the user is asked. */
+  readonly challenge: TanChallenge;
 
-  /** The customer system ID the bank assigned; `undefined` before the synchronization. */
-  readonly systemId: string | undefined;
+  /** Sends the TAN the user entered. */
+  readonly submitTan: (tan: string) => Promise<R>;
 
-  /** Identification (HKIDN) and processing preparation (HKVVB), which open every dialog. */
-  initSegments(systemId: string, anonymous?: boolean): SegmentSpec[];
+  /** Asks the bank whether the user has approved in the banking app. */
+  readonly checkStatus: () => Promise<R>;
 
   /**
-   * Sends `segments` as message `number` of the dialog `dialogId` and returns the bank's answer, not yet parsed.
-   *
-   * With `signing` the message is signed with the PIN and the `tan`, after `LoginGuard.check`; without, it goes out
-   * unsigned, as in an anonymous dialog.
+   * Whether the bank announces a push message for once the user has approved (return code 3957), before which the
+   * status must not be asked. The client has no push channel, so the user reports the approval instead.
    */
-  post(message: {
-    dialogId: string;
-    number: number;
-    segments: readonly SegmentSpec[];
-    signing: Signing3 | undefined;
-    tan: string | undefined;
-  }): Promise<Uint8Array>;
+  readonly waitForPush: boolean;
+
+  /** The new instructions a status answer gives the user (return code 3956); `undefined` where it gives none. */
+  readonly instructionsIn: (response: R) => string | undefined;
 }
 
-/** One FinTS 3.0 dialog: numbered messages under the dialog ID the bank assigns in its first answer. */
-export class FinTs3Dialog extends PinTanDialog<IncomingMessage3, SegmentSpec> {
+/**
+ * One FinTS 3.0 dialog: numbered messages under the dialog ID the bank assigns in its first answer, signed with a TAN
+ * method and medium, and the approvals the bank asks for. The `FinTs3Protocol` builds the messages and signs them.
+ */
+export class FinTs3Dialog {
   private systemId: string;
   private id = unassigned;
+  private messageNumber = 1;
+  private ended = false;
+
+  /** When the bank last answered without rejecting the whole message, which shows it still knows the dialog. */
+  private lastAnswer: number | undefined;
 
   private constructor(
-    private readonly host: FinTs3DialogHost,
-    method: TanMethod,
-    tanMedium: string | undefined,
+    private readonly protocol: FinTs3Protocol,
+    readonly method: TanMethod,
+    /** The TAN medium the messages name, where the method takes one. */
+    readonly tanMedium: string | undefined,
     private readonly anonymous: boolean,
   ) {
-    super(method, tanMedium);
-    this.systemId = anonymous ? unassigned : (host.systemId ?? unassigned);
+    this.systemId = anonymous ? unassigned : (protocol.parameters.systemId ?? unassigned);
   }
 
-  static signed(host: FinTs3DialogHost, method: TanMethod, tanMedium?: string): FinTs3Dialog {
-    return new FinTs3Dialog(host, method, tanMedium, false);
+  static signed(protocol: FinTs3Protocol, method: TanMethod, tanMedium?: string): FinTs3Dialog {
+    return new FinTs3Dialog(protocol, method, tanMedium, false);
   }
 
   /** A dialog without login, which only delivers the bank parameter data. */
-  static anonymous(host: FinTs3DialogHost): FinTs3Dialog {
-    return new FinTs3Dialog(host, TanMethod.oneStep, undefined, true);
-  }
-
-  protected get bankParameters(): Bpd3 | undefined {
-    return this.host.bankParameters;
+  static anonymous(protocol: FinTs3Protocol): FinTs3Dialog {
+    return new FinTs3Dialog(protocol, TanMethod.oneStep, undefined, true);
   }
 
+  /** Whether the bank knows this dialog and it has not ended. */
   get isActive(): boolean {
     return this.id !== unassigned && !this.hasEnded;
   }
 
+  /**
+   * Whether the dialog has ended, on either side.
+   *
+   * The bank ends a dialog idle for longer than its maximum timeout (HIBPA, Formals C.9), or five minutes where it
+   * states none. Such a dialog is neither used nor ended again: the bank would refuse any message in it.
+   */
+  private get hasEnded(): boolean {
+    return this.ended || this.idleTooLong;
+  }
+
+  private get idleTooLong(): boolean {
+    const last = this.lastAnswer;
+    const timeout = this.protocol.parameters.bankParameters?.bankInfo.maxTimeout;
+    // A timeout of 0 or below: the bank keeps idle dialogs without limit.
+    const limit = timeout === undefined ? defaultIdleLimitMs : timeout <= 0 ? undefined : timeout * 1000;
+    return last !== undefined && limit !== undefined && Date.now() - last > limit;
+  }
+
+  /** Whether the messages are signed with a two-step TAN method, so that the bank may ask for approvals. */
+  private get isTwoStep(): boolean {
+    return !this.method.isOneStep;
+  }
+
   /** The version of the HKTAN segments: that of the HITANS segment the bank describes the method in. */
   private get tanVersion(): number {
-    return this.bankParameters?.tanVersion(this.method) ?? firstScaVersion;
+    return this.protocol.parameters.bankParameters?.tanVersion(this.method) ?? firstScaVersion;
   }
 
+  /** Opens the dialog; with `synchronize` the bank also assigns a customer system ID. */
   start(synchronize = false): Promise<IncomingMessage3> {
     if (synchronize) this.systemId = unassigned;
     return this.sendSegments([
-      ...this.host.initSegments(this.systemId),
+      ...this.protocol.initSegments(this.systemId),
       ...(this.isTwoStep ? [this.tanRequest('HKIDN')] : []),
       ...(synchronize ? [Segments.synchronization()] : []),
     ]);
   }
 
   /**
-   * Opens the dialog, asking strong authentication for `order` with a two-step method, then sends `order` in the next
-   * message.
+   * The messages that open the dialog and send `order` while no TAN medium is chosen yet, as for listing the media:
+   * `login` opens the dialog, asking strong authentication for `order` with a two-step method, and `order` sends the
+   * order in a message of its own.
    */
-  startWith(order: SegmentSpec): StartWithOrder<IncomingMessage3> {
+  startWith(order: SegmentSpec): {
+    readonly login: () => Promise<IncomingMessage3>;
+    readonly order: () => Promise<IncomingMessage3>;
+  } {
     return {
       login: () =>
         this.sendSegments([
-          ...this.host.initSegments(this.systemId),
+          ...this.protocol.initSegments(this.systemId),
           ...(this.isTwoStep ? [this.tanRequest(order.type)] : []),
         ]),
       order: () => this.sendSegments([order]),
@@ -124,69 +148,129 @@ export class FinTs3Dialog extends PinTanDialog<IncomingMessage3, SegmentSpec> {
    */
   requestBankParameters(announceSca = false): Promise<IncomingMessage3> {
     return this.sendSegments([
-      ...this.host.initSegments(unassigned, true),
+      ...this.protocol.initSegments(unassigned, true),
       ...(announceSca ? [Segments.tanProcess4(firstScaVersion, 'HKIDN')] : []),
     ]);
   }
 
+  /** Sends `order`, asking for strong customer authentication where the bank requires it. */
   send(order: SegmentSpec): Promise<IncomingMessage3> {
-    const needsTan = this.isTwoStep && requireBankParameters(this.bankParameters).pinTan.requiresTan(order.type);
+    const needsTan =
+      this.isTwoStep && requireBankParameters(this.protocol.parameters.bankParameters).pinTan.requiresTan(order.type);
     return this.sendSegments([order, ...(needsTan ? [this.tanRequest(order.type)] : [])]);
   }
 
-  protected async sendEnd(): Promise<void> {
-    await this.sendSegments([Segments.dialogEnd(this.id)]);
+  /**
+   * Ends the dialog at the bank and returns the answer; `undefined` if the dialog is not active or the end failed.
+   *
+   * Bank and connection errors are ignored, since the bank may have ended the dialog on its side already.
+   */
+  async end(): Promise<IncomingMessage3 | undefined> {
+    if (!this.isActive) return undefined;
+    this.ended = true;
+    try {
+      return await this.sendSegments([Segments.dialogEnd(this.id)]);
+    } catch (error) {
+      if (!(error instanceof FinTsError)) throw error;
+      return undefined;
+    }
   }
 
-  private tanRequest(segmentType: string): SegmentSpec {
-    return Segments.tanProcess4(this.tanVersion, segmentType, this.mediumName);
+  /** Forgets the dialog without contacting the bank, for example after the bank rejected the PIN. */
+  discard(): void {
+    this.ended = true;
   }
 
   /**
-   * The approval a HITAN segment of process 4 asks for, answered with HKTAN process 2 (TAN) or S (status).
+   * The approval `response`, the dialog's latest answer, asks for with return code 0030 (TAN) or 3955 (banking app):
+   * HITAN of process 4, answered with HKTAN process 2 (TAN) or S (status); `undefined` if it asks for none, or carries
+   * only the dummy challenge of a message the bank exempts from strong authentication.
    *
-   * Throws `FinTsProtocolError` for an app approval with a method of HITANS #6: the status request (process S) came with
-   * version 7, along with app approvals (PIN/TAN B.5.2).
+   * The bank has not executed the message then, so a request without a challenge is a `FinTsProtocolError`: read as
+   * done, it would report an empty result. So is an app approval with a method of HITANS #6: the status request
+   * (process S) came with version 7, along with app approvals (PIN/TAN B.5.2).
    */
-  protected approvalIn(response: IncomingMessage3): Approval<IncomingMessage3> | undefined {
+  approvalAskedIn(response: IncomingMessage3): Approval<IncomingMessage3> | undefined {
+    const feedback = response.feedback;
+    const decoupled = hasCode(feedback, FeedbackCodes.decoupledPending);
+    if (hasErrors(feedback) || !(hasCode(feedback, FeedbackCodes.tanRequired) || decoupled)) return undefined;
     const tan = tanResponseOf(response, '4');
-    if (tan === undefined || tan.isDummy) return undefined;
-    if (hasCode(response.feedback, FeedbackCodes.decoupledPending) && this.tanVersion < firstDecoupledVersion) {
+    if (tan === undefined || tan.isDummy) {
+      throw new FinTsProtocolError('The bank asks for an approval, but sends no challenge');
+    }
+    if (decoupled && this.tanVersion < firstDecoupledVersion) {
       throw new FinTsProtocolError('The bank asks for an app approval, which needs HKTAN version 7');
     }
     const reference = tan.reference!;
-    return this.approvalOf(response, {
-      reference,
-      message: tan.challenge,
-      hhdUc: tan.hhdUc,
-      validUntil: tan.validUntil,
-      tanMediumName: tan.mediumName,
+    return {
+      challenge: TanChallenge.create({
+        method: this.method,
+        reference,
+        message: tan.challenge,
+        hhdUc: tan.hhdUc,
+        isDecoupled: decoupled || this.method.decoupled,
+        validUntil: tan.validUntil,
+        tanMediumName: tan.mediumName ?? this.tanMedium,
+      }),
       submitTan: (value) => this.sendSegments([Segments.tanProcess2(this.tanVersion, reference)], value),
       checkStatus: () => this.sendSegments([Segments.tanProcessStatus(this.tanVersion, reference)]),
+      waitForPush: hasCode(feedback, FeedbackCodes.decoupledWaitForPush),
       // A status answer that the approval is still pending may carry new instructions (PIN/TAN B.4.2.2.1, step 2b).
-      instructionsIn: (status) => tanResponseOf(status, 'S')?.challenge,
-    });
-  }
-
-  private sendSegments(segments: readonly SegmentSpec[], tan?: string): Promise<IncomingMessage3> {
-    return this.transmit(
-      (number) =>
-        this.host.post({
-          dialogId: this.id,
-          number,
-          segments,
-          signing: this.anonymous
-            ? undefined
-            : { securityFunction: this.method.securityFunction, systemId: this.systemId },
-          tan,
-        }),
-      (answer) => IncomingMessage3.parse(answer),
+      instructionsIn: (status) => challengeText(tanResponseOf(status, 'S')?.challenge),
+    };
+  }
+
+  private tanRequest(segmentType: string): SegmentSpec {
+    const medium = this.method.mediumRequirement === 'notAllowed' ? undefined : this.tanMedium;
+    return Segments.tanProcess4(
+      this.tanVersion,
+      segmentType,
+      medium === undefined ? undefined : this.protocol.parameters.tanMediumAsSent(medium),
     );
   }
 
-  /** The bank assigns the dialog ID in its answer to the first message. */
-  protected readDialogData(response: IncomingMessage3): void {
-    if (this.id === unassigned) this.id = response.dialogId ?? unassigned;
+  /**
+   * Sends `segments`, with `tan` where they complete an approval, as the next message, and reads the bank's answer. The
+   * message counts once the bank has answered, whatever it answered.
+   *
+   * The bank assigns the dialog ID in its answer to the first message, so the answer to another user's first message
+   * passes for it (`ParameterStore.reportedUpdVersion`). Any other answer to another message fails with
+   * `FinTsProtocolError` before anything of it is kept: a relay or proxy that mixes up answers would hand the client
+   * another user's data, or a page of another query.
+   *
+   * The dialog ends on the client's side, without a dialog end, where it is over for the bank: after a return code that
+   * ends it, such as 9800, and after a rejected opening message (Formals C.1.2), or a broken connection (C.6).
+   *
+   * Only an answer that does not reject the whole message starts the idle time anew (`hasEnded`): a rejection may come
+   * from a bank that has ended the dialog without saying so.
+   */
+  private async sendSegments(segments: readonly SegmentSpec[], tan?: string): Promise<IncomingMessage3> {
+    const number = this.messageNumber;
+    let answer: Uint8Array;
+    try {
+      answer = await this.protocol.post({
+        dialogId: this.id,
+        number,
+        segments,
+        signing: this.anonymous
+          ? undefined
+          : { securityFunction: this.method.securityFunction, systemId: this.systemId },
+        tan,
+      });
+    } catch (error) {
+      if (error instanceof FinTsTransportError) this.discard();
+      throw error;
+    }
+    this.messageNumber++;
+    const response = parseBankData(() => IncomingMessage3.parse(answer));
+    const assigned = this.id === unassigned ? undefined : this.id;
+    if (!response.answers(number, assigned)) {
+      throw new FinTsProtocolError('The answer belongs to another message than the one sent');
+    }
+    if (assigned === undefined) this.id = response.dialogId ?? unassigned;
+    if (!response.messageRejected) this.lastAnswer = Date.now();
+    if (endsDialog(response.feedback) || (number === 1 && response.messageRejected)) this.discard();
+    return response;
   }
 }