@coderoftime/fints 0.1.0 → 0.2.0

package/dist/session/login-guard.js

@@ -1,109 +1,181 @@
-import { FinTsBankError, FinTsLoginDataChangedError, FinTsPinError, FinTsTanError } from '../core/errors.js';
+import { clientClosedError, FinTsLoginDataChangedError, FinTsLoginRefusedError, FinTsPinError, loginRefusalFor, } from '../core/errors.js';
 import { allowedTanMethodsIn, FeedbackCodes, hasCode } from '../core/feedback.js';
 /**
- * Keeps a retrying app from locking the user's access: once the bank has refused a login, the client does not send the
- * PIN again.
- *
- * Banks lock the access after a few failed attempts, and a return code does not always tell whether the PIN was the
- * reason. So `judge` counts as a refused login:
- * - a rejected PIN, wherever the bank reports it;
- * - any other error in the answer to a login, unless the login carries an order and the bank keeps the dialog open:
- *   then the error concerns the order.
- *
- * Errors in the answer to an order or an approval are no refusal, such as a wrong TAN at login: the bank checks the PIN
- * before it asks for the approval. New login data (return code 3072) end the old ones for good (`refuse`).
+ * Logins in a row whose answer the client could not read, after which it sends the PIN no more: one may be a glitch of
+ * the connection, but with two the client would not learn of a wrong PIN before the bank locks the access.
+ */
+const maxUnreadLogins = 2;
+/**
+ * Holds the PIN and hands it out only while no login is refused (`pin`), so that a retrying app cannot lock the user's
+ * access. `FinTsLoginRefusedError` tells which logins count as refused; `judge` decides it for each answer.
  *
- * The guard fails closed: a refusal counts from the moment `judge` sees it, and only `pardon` lifts it, once the
- * session has taken care of a `RefusalReason` the refusal names (`remediableReasons`). The protocol calls `check`
- * before every message it signs with the PIN.
+ * A refusal counts at once and fails closed: only `remedied` lifts it, within the call that met it (`runCall`), once
+ * the session has taken care of a reason it names, each reason once per call, so that a call sends at most three
+ * logins the bank refuses. A refusal that outlasts the call is final, and the guard forgets the PIN; only a PIN the
+ * user enters anew lifts it (`replacePin`), unless it brings new login data.
  */
 export class LoginGuard {
-    refusal;
-    /** The TAN method of the refused login; `undefined` without a refusal, and for new login data. */
-    refusedMethodValue;
-    /** Throws the bank's refusal of an earlier login, so that the PIN is not sent again. */
+    // ECMAScript private, so that neither `util.inspect` nor `JSON.stringify` of the client reaches it.
+    #pin;
+    refusalValue;
+    /** The TAN method of the login `refusalValue` refused, which a restored refusal does not tell. */
+    refusedMethod;
+    /** Logins sent since the bank last took the PIN whose answer the client has not read. */
+    unreadLogins = 0;
+    /** The refusal of `maxUnreadLogins` unread logins, kept so that `check` throws the same error each time. */
+    unreadLoginsRefusal;
+    /** The reasons `remedied` has lifted a refusal for in the running call. */
+    pardonedReasons = new Set();
+    constructor(pin) {
+        this.#pin = pin;
+    }
+    /** The PIN to sign a message with; throws the refusal instead (`check`), and `FinTsStateError` once closed. */
+    get pin() {
+        this.check();
+        if (this.#pin === undefined)
+            throw clientClosedError();
+        return this.#pin;
+    }
+    /** Throws the refusal, if there is one. */
     check() {
-        if (this.refusal !== undefined)
-            throw this.refusal;
+        const refusal = this.refusal;
+        if (refusal !== undefined)
+            throw refusal;
     }
-    /** Whether the guard holds a refusal. */
-    get hasRefusal() {
-        return this.refusal !== undefined;
+    /** The bank's refusal, else that of `maxUnreadLogins` unread logins; `undefined` while there is none. */
+    get refusal() {
+        if (this.refusalValue !== undefined || this.unreadLogins < maxUnreadLogins)
+            return this.refusalValue;
+        this.unreadLoginsRefusal ??= new FinTsLoginRefusedError([], `The answers to the last ${maxUnreadLogins} logins were lost or unreadable, and the bank may have counted them ` +
+            'as failed attempts');
+        return this.unreadLoginsRefusal;
     }
-    /** The TAN method the refused login was signed with; `undefined` where the guard holds no refusal of a login. */
-    get refusedMethod() {
-        return this.refusedMethodValue;
+    /** Counts a login signed with the PIN as unread until `judge` reads its answer. */
+    loginSent() {
+        this.unreadLogins++;
     }
     /**
-     * Whether `error`, raised for the answer to a request of `kind` in a dialog signed with `method`, refuses the login;
-     * records it if it does.
-     *
-     * `dialogOpen` tells whether the bank keeps the dialog open after its answer.
+     * Judges `error`, if the answer to a request of `kind` in a dialog signed with `method` has one: returns the refusal
+     * of the login it amounts to, and records it unless the guard holds one already. Any error refuses a login; after the
+     * login only one that refuses it itself, a rejected PIN or new login data, since the bank checked the PIN before.
      */
-    judge(error, kind, dialogOpen, method) {
-        const refused = error instanceof FinTsPinError || kind === 'login' || (kind === 'loginWithOrder' && !dialogOpen);
-        if (refused && this.refusal === undefined) {
-            this.refusal = error;
-            this.refusedMethodValue = method;
+    judge(error, kind, method) {
+        const refused = error instanceof FinTsLoginRefusedError || (error !== undefined && kind === 'login');
+        if (kind === 'login')
+            this.unreadLogins = refused ? Math.max(0, this.unreadLogins - 1) : 0;
+        if (!refused)
+            return undefined;
+        const refusal = loginRefusalFor(error.feedback);
+        if (this.refusalValue === undefined) {
+            this.refusalValue = refusal;
+            this.refusedMethod = method;
         }
-        return refused;
-    }
-    /** Records `error` as the reason the client logs in no more, unless it holds a refusal already. */
-    refuse(error) {
-        this.refusal ??= error;
+        return refusal;
     }
-    /**
-     * Runs `lookup`, which only completes data, such as the SEPA account list; `undefined` where the bank rejects it, so
-     * that the caller carries on without it.
-     *
-     * A refused login is thrown, and so is a wrong TAN, which the user must hear of. An aborted dialog counts as a
-     * rejection: banks end the dialog along with many.
-     */
-    async tryLookUp(lookup) {
+    /** Runs `call`, one call of the client; a refusal that outlasts it is final, and the next call remedies anew. */
+    async runCall(call) {
         try {
-            return await lookup();
+            return await call();
         }
-        catch (error) {
-            if (!(error instanceof FinTsBankError) || this.isRefusal(error) || error instanceof FinTsTanError)
-                throw error;
-            return undefined;
+        finally {
+            this.pardonedReasons.clear();
+            this.forgetPinIfRefused();
         }
     }
     /**
-     * The reasons the session can take care of in `error`: 3920 without the TAN method of the refused login, 9075 after
-     * the one-step method, and 9391. Empty if `error` is not the refusal the guard holds, rejects the PIN, or brings new
-     * login data.
-     *
-     * Only the return codes of the refusal itself count: TAN methods listed earlier say nothing about this login.
+     * Runs `attempt`, which may log in, and runs it once more each time `remedy` takes care of a reason the refusal it
+     * failed with names; `remedy` gets the reason and the TAN method of the refused login, and returns whether it could.
      */
-    remediableReasons(error) {
-        const method = this.refusedMethodValue;
-        if (!this.isRefusal(error) ||
-            method === undefined ||
-            error instanceof FinTsPinError ||
-            error instanceof FinTsLoginDataChangedError) {
-            return [];
-        }
-        const feedback = error.feedback;
-        const allowed = allowedTanMethodsIn(feedback);
-        const reasons = [];
-        if ((allowed.length > 0 && !allowed.includes(method.securityFunction)) ||
-            (method.isOneStep && hasCode(feedback, FeedbackCodes.scaRequired))) {
-            reasons.push('tanMethodNotAllowed');
+    async remedied(attempt, remedy) {
+        // A refusal of an earlier call stops the attempt before it sends the PIN; there is nothing to remedy.
+        if (this.refusal !== undefined)
+            return attempt();
+        for (;;) {
+            try {
+                return await attempt();
+            }
+            catch (error) {
+                const refusal = this.refusalValue;
+                const rejected = this.refusedMethod;
+                // Only the bank's refusal the guard holds names reasons; any other error, a second refusal too, fails the call.
+                if (refusal === undefined || error !== refusal || rejected === undefined)
+                    throw error;
+                const reason = remediableReasons(refusal, rejected).find((r) => !this.pardonedReasons.has(r));
+                if (reason === undefined || !(await remedy(reason, rejected)))
+                    throw error;
+                this.pardonedReasons.add(reason);
+                // A closed client keeps the refusal.
+                if (this.#pin !== undefined)
+                    this.liftRefusal();
+            }
         }
-        if (hasCode(feedback, FeedbackCodes.newSystemIdRequired))
-            reasons.push('systemIdRejected');
-        return reasons;
     }
-    /** Lifts `refusal` once the session has taken care of its reason, so that the next login may send the PIN. */
-    pardon(refusal) {
-        if (!this.isRefusal(refusal))
-            return;
-        this.refusal = undefined;
-        this.refusedMethodValue = undefined;
+    /**
+     * Signs with `pin` from now on, a PIN the user has entered anew and the protocol can send, and lifts the refusal.
+     * Throws the refusal instead where it brings new login data, which end the old ones for good.
+     */
+    replacePin(pin) {
+        if (this.refusalValue instanceof FinTsLoginDataChangedError)
+            throw this.refusalValue;
+        this.#pin = pin;
+        this.liftRefusal();
+        this.unreadLogins = 0;
+        this.unreadLoginsRefusal = undefined;
+    }
+    /** Forgets the PIN; the client calls it once it is closed. */
+    close() {
+        this.#pin = undefined;
+    }
+    saveState() {
+        return { refusal: this.refusalValue?.feedback, unreadLogins: this.unreadLogins };
     }
-    isRefusal(error) {
-        return error === this.refusal;
+    /** Restores what `saveState` returned; a restored refusal is final. */
+    restoreState(saved) {
+        if (saved.refusal !== undefined)
+            this.refusalValue = loginRefusalFor(saved.refusal);
+        this.unreadLogins = Math.max(0, saved.unreadLogins);
+        this.forgetPinIfRefused();
+    }
+    liftRefusal() {
+        this.refusalValue = undefined;
+        this.refusedMethod = undefined;
+    }
+    forgetPinIfRefused() {
+        if (this.refusal !== undefined)
+            this.#pin = undefined;
     }
 }
+/**
+ * The reasons `refusal`, of a login signed with `method`, names that the session can take care of: a TAN method the
+ * refusal names as not allowed (`refusesMethod`), and 9391. None for a rejected PIN or new login data.
+ */
+function remediableReasons(refusal, method) {
+    if (refusal instanceof FinTsPinError || refusal instanceof FinTsLoginDataChangedError)
+        return [];
+    const reasons = [];
+    if (refusesMethod(refusal.feedback, method))
+        reasons.push('tanMethodNotAllowed');
+    if (hasCode(refusal.feedback, FeedbackCodes.newSystemIdRequired))
+        reasons.push('systemIdRejected');
+    return reasons;
+}
+/** Error codes that only say that the message failed, not why: 9050 (the message contains errors) and 9800. */
+const unspecificErrors = new Set(['9050', FeedbackCodes.dialogAborted]);
+/**
+ * Whether `feedback`, which refuses a login signed with `method`, names the method as the reason: a 3920 that lists the
+ * methods the user may use without it, or 9075 after the one-step method.
+ *
+ * Only the return codes of the refusal itself count: TAN methods listed earlier say nothing about this login. Banks
+ * list two-step methods only, so a 3920 always leaves the one-step method out, also where the login succeeds. After
+ * the one-step method a 3920 counts only where the bank names no other error than an unspecific one: any other, such
+ * as "Anmeldung fehlgeschlagen", may be about the PIN.
+ */
+function refusesMethod(feedback, method) {
+    if (method.isOneStep && hasCode(feedback, FeedbackCodes.scaRequired))
+        return true;
+    const allowed = allowedTanMethodsIn(feedback);
+    if (allowed.length === 0 || allowed.includes(method.securityFunction))
+        return false;
+    return !method.isOneStep || feedback.every((f) => !f.isError || unspecificErrors.has(f.code));
+}
 //# sourceMappingURL=login-guard.js.map

package/dist/session/login-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"login-guard.js","sourceRoot":"","sources":["../../src/session/login-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC7G,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAmBlF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,UAAU;IACb,OAAO,CAA6B;IAE5C,kGAAkG;IAC1F,kBAAkB,CAAwB;IAElD,wFAAwF;IACxF,KAAK;QACH,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC;IACrD,CAAC;IAED,yCAAyC;IACzC,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC;IACpC,CAAC;IAED,iHAAiH;IACjH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAqB,EAAE,IAAiB,EAAE,UAAmB,EAAE,MAAiB;QACpF,MAAM,OAAO,GAAG,KAAK,YAAY,aAAa,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,UAAU,CAAC,CAAC;QACjH,IAAI,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACrB,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC;QACnC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,mGAAmG;IACnG,MAAM,CAAC,KAAqB;QAC1B,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAI,MAAwB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,cAAc,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,aAAa;gBAAE,MAAM,KAAK,CAAC;YAC/G,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,iBAAiB,CAAC,KAAqB;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACvC,IACE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YACtB,MAAM,KAAK,SAAS;YACpB,KAAK,YAAY,aAAa;YAC9B,KAAK,YAAY,0BAA0B,EAC3C,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAChC,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,IACE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAClE,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,EAClE,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,mBAAmB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC3F,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,8GAA8G;IAC9G,MAAM,CAAC,OAAuB;QAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,OAAO;QACrC,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC;IACtC,CAAC;IAEO,SAAS,CAAC,KAAc;QAC9B,OAAO,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC;IAChC,CAAC;CACF"}
+{"version":3,"file":"login-guard.js","sourceRoot":"","sources":["../../src/session/login-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,EACb,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,OAAO,EAAsB,MAAM,qBAAqB,CAAC;AAyBtG;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B;;;;;;;;GAQG;AACH,MAAM,OAAO,UAAU;IACrB,oGAAoG;IACpG,IAAI,CAAqB;IAEjB,YAAY,CAAqC;IAEzD,kGAAkG;IAC1F,aAAa,CAAwB;IAE7C,yFAAyF;IACjF,YAAY,GAAG,CAAC,CAAC;IAEzB,4GAA4G;IACpG,mBAAmB,CAAqC;IAEhE,2EAA2E;IAC1D,eAAe,GAAG,IAAI,GAAG,EAAiB,CAAC;IAE5D,YAAY,GAAW;QACrB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,+GAA+G;IAC/G,IAAI,GAAG;QACL,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,iBAAiB,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,2CAA2C;IAC3C,KAAK;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,OAAO,CAAC;IAC3C,CAAC;IAED,yGAAyG;IACzG,IAAI,OAAO;QACT,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,GAAG,eAAe;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC;QACrG,IAAI,CAAC,mBAAmB,KAAK,IAAI,sBAAsB,CACrD,EAAE,EACF,2BAA2B,eAAe,sEAAsE;YAC9G,oBAAoB,CACvB,CAAC;QACF,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED,mFAAmF;IACnF,SAAS;QACP,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAiC,EAAE,IAAiB,EAAE,MAAiB;QAC3E,MAAM,OAAO,GAAG,KAAK,YAAY,sBAAsB,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC;QACrG,IAAI,IAAI,KAAK,OAAO;YAAE,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;YAC5B,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;QAC9B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,iHAAiH;IACjH,KAAK,CAAC,OAAO,CAAI,IAAsB;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CACZ,OAAyB,EACzB,MAAwE;QAExE,sGAAsG;QACtG,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,OAAO,EAAE,CAAC;QACjD,SAAS,CAAC;YACR,IAAI,CAAC;gBACH,OAAO,MAAM,OAAO,EAAE,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;gBAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;gBACpC,gHAAgH;gBAChH,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,OAAO,IAAI,QAAQ,KAAK,SAAS;oBAAE,MAAM,KAAK,CAAC;gBACtF,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9F,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAC3E,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjC,qCAAqC;gBACrC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;oBAAE,IAAI,CAAC,WAAW,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,GAAW;QACpB,IAAI,IAAI,CAAC,YAAY,YAAY,0BAA0B;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC;QACrF,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAC;IACvC,CAAC;IAED,8DAA8D;IAC9D,KAAK;QACH,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;IACxB,CAAC;IAED,SAAS;QACP,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;IACnF,CAAC;IAED,uEAAuE;IACvE,YAAY,CAAC,KAAsB;QACjC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAC9B,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;IACjC,CAAC;IAEO,kBAAkB;QACxB,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;IACxD,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,OAA+B,EAAE,MAAiB;IAC3E,IAAI,OAAO,YAAY,aAAa,IAAI,OAAO,YAAY,0BAA0B;QAAE,OAAO,EAAE,CAAC;IACjG,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,IAAI,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,mBAAmB,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnG,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+GAA+G;AAC/G,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC;AAExE;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,QAAkC,EAAE,MAAiB;IAC1E,IAAI,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAClF,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAAE,OAAO,KAAK,CAAC;IACpF,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAChG,CAAC"}

package/dist/session/sepa-accounts.d.ts

@@ -1,32 +1,38 @@
-import type { Account } from '../core/account.js';
+import { Account } from '../core/account.js';
+import type { ParameterStore } from '../v3/parameter-store.js';
 import type { DialogRunner } from './dialog-runner.js';
-import type { LoginGuard } from './login-guard.js';
-import type { BankResponse, PinTanProtocol } from './protocol.js';
 import type { SessionState } from './session-state.js';
 /**
  * IBAN and BIC of the user's accounts, from the bank's SEPA account list where the user parameter data lack them
- * (Formals F.3.4).
+ * (Formals F.3.4), and the accounts the app passes completed from both.
  *
  * The list is read once per version of the user parameter data and kept in the saved state. Under version 0, which
- * holds for one dialog only (Formals E.2), without user parameter data, or where the bank rejects the list, it is kept
- * for this client only. Where the bank ends the dialog in answer to the list, the next call asks once more.
+ * holds for one dialog only (Formals E.2), without user parameter data, or where the bank rejects the list, also by
+ * ending the dialog, or names no account in it, it is kept for this client only: an empty list completes nothing, and
+ * saved it would outlast a fault of a single answer until the bank changes its user parameter data.
  */
-export declare class SepaAccounts<R extends BankResponse, O> {
-    private readonly protocol;
+export declare class SepaAccounts {
+    private readonly parameters;
     private readonly state;
     private readonly dialogs;
-    private readonly guard;
     /**
      * The list this client keeps unsaved, with the version of the user parameter data it was read under; empty where the
-     * bank rejected it.
+     * bank rejected it or named no account.
      */
     private unsaved;
-    /** Whether a call already went on without the list because the bank ended the dialog in answer to it. */
-    private abortSkipped;
-    constructor(protocol: PinTanProtocol<R, O>, state: SessionState, dialogs: DialogRunner<R, O>, guard: LoginGuard);
+    constructor(parameters: ParameterStore, state: SessionState, dialogs: DialogRunner);
     /** The accounts of the user parameter data completed with IBAN and BIC, then the accounts only the list names. */
     completedAccounts(): Promise<Account[]>;
-    /** `account` with IBAN and BIC filled in from the list. */
+    /**
+     * `account` as the bank knows it: the one of `completedAccounts` it matches, with what the bank states of it first,
+     * so that an account the app has built itself, such as from an IBAN alone, goes out with the account number, the
+     * sub-account and the BIC the bank's orders take, and the currency of its statements. Where the bank names none it
+     * matches, only what identifies `account`, and its currency: the rest, such as the transactions it permits, only the
+     * bank can state.
+     *
+     * Throws `FinTsUnsupportedError` for such an account where the user parameter data list all permitted transactions:
+     * they permit nothing for an account they leave out, and the client cannot tell it from a mistyped one.
+     */
     complete(account: Account): Promise<Account>;
     /** The list, read in the session's dialog, whose start delivers the user parameter data it is cached for. */
     private list;

package/dist/session/sepa-accounts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sepa-accounts.d.ts","sourceRoot":"","sources":["../../src/session/sepa-accounts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;;;;;GAOG;AACH,qBAAa,YAAY,CAAC,CAAC,SAAS,YAAY,EAAE,CAAC;IAW/C,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAbxB;;;OAGG;IACH,OAAO,CAAC,OAAO,CAA+E;IAE9F,yGAAyG;IACzG,OAAO,CAAC,YAAY,CAAS;gBAGV,QAAQ,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,EAC9B,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,EAC3B,KAAK,EAAE,UAAU;IAGpC,kHAAkH;IAC5G,iBAAiB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAS7C,2DAA2D;IACrD,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAKlD,6GAA6G;YAC/F,IAAI;CAwCnB"}
+{"version":3,"file":"sepa-accounts.d.ts","sourceRoot":"","sources":["../../src/session/sepa-accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAgB,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;;;;;;GAQG;AACH,qBAAa,YAAY;IAQrB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAT1B;;;OAGG;IACH,OAAO,CAAC,OAAO,CAA+E;gBAG3E,UAAU,EAAE,cAAc,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,YAAY;IAGxC,kHAAkH;IAC5G,iBAAiB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAW7C;;;;;;;;;OASG;IACG,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BlD,6GAA6G;YAC/F,IAAI;CA0BnB"}

package/dist/session/sepa-accounts.js

@@ -1,49 +1,80 @@
-import { FinTsDialogAbortedError } from '../core/errors.js';
+import { Account, AccountIndex } from '../core/account.js';
+import { FinTsUnsupportedError, tryLookUp } from '../core/errors.js';
+import { sepaAccountsQuery } from '../v3/queries.js';
 /**
  * IBAN and BIC of the user's accounts, from the bank's SEPA account list where the user parameter data lack them
- * (Formals F.3.4).
+ * (Formals F.3.4), and the accounts the app passes completed from both.
  *
  * The list is read once per version of the user parameter data and kept in the saved state. Under version 0, which
- * holds for one dialog only (Formals E.2), without user parameter data, or where the bank rejects the list, it is kept
- * for this client only. Where the bank ends the dialog in answer to the list, the next call asks once more.
+ * holds for one dialog only (Formals E.2), without user parameter data, or where the bank rejects the list, also by
+ * ending the dialog, or names no account in it, it is kept for this client only: an empty list completes nothing, and
+ * saved it would outlast a fault of a single answer until the bank changes its user parameter data.
  */
 export class SepaAccounts {
-    protocol;
+    parameters;
     state;
     dialogs;
-    guard;
     /**
      * The list this client keeps unsaved, with the version of the user parameter data it was read under; empty where the
-     * bank rejected it.
+     * bank rejected it or named no account.
      */
     unsaved;
-    /** Whether a call already went on without the list because the bank ended the dialog in answer to it. */
-    abortSkipped = false;
-    constructor(protocol, state, dialogs, guard) {
-        this.protocol = protocol;
+    constructor(parameters, state, dialogs) {
+        this.parameters = parameters;
         this.state = state;
         this.dialogs = dialogs;
-        this.guard = guard;
     }
     /** The accounts of the user parameter data completed with IBAN and BIC, then the accounts only the list names. */
     async completedAccounts() {
         const sepa = await this.list();
-        const accounts = this.protocol.userParameters?.accounts ?? [];
+        const accounts = this.parameters.userParameters?.accounts ?? [];
+        const listed = new AccountIndex(sepa);
+        const known = new AccountIndex(accounts);
         return [
-            ...accounts.map((account) => withSepaDetails(account, sepa)),
-            ...sepa.filter((s) => !accounts.some((a) => s.matches(a))),
+            ...accounts.map((account) => withSepaDetails(account, listed.find(account))),
+            ...sepa.filter((s) => known.find(s) === undefined),
         ];
     }
-    /** `account` with IBAN and BIC filled in from the list. */
+    /**
+     * `account` as the bank knows it: the one of `completedAccounts` it matches, with what the bank states of it first,
+     * so that an account the app has built itself, such as from an IBAN alone, goes out with the account number, the
+     * sub-account and the BIC the bank's orders take, and the currency of its statements. Where the bank names none it
+     * matches, only what identifies `account`, and its currency: the rest, such as the transactions it permits, only the
+     * bank can state.
+     *
+     * Throws `FinTsUnsupportedError` for such an account where the user parameter data list all permitted transactions:
+     * they permit nothing for an account they leave out, and the client cannot tell it from a mistyped one.
+     */
     async complete(account) {
-        if (account.iban !== undefined && account.bic !== undefined)
-            return account;
-        return withSepaDetails(account, await this.list());
+        const known = (await this.completedAccounts()).find((a) => account.matches(a));
+        if (known !== undefined) {
+            // A sub-account belongs to the account number it comes with.
+            const national = known.accountNumber === undefined ? account : known;
+            return known.copyWith({
+                accountNumber: national.accountNumber,
+                subAccount: national.subAccount,
+                iban: known.iban ?? account.iban,
+                bic: known.bic ?? account.bic,
+                currency: known.currency ?? account.currency,
+            });
+        }
+        if (this.parameters.userParameters?.listsAllTransactions === true) {
+            throw new FinTsUnsupportedError("The bank does not name this account among the user's, and so permits nothing");
+        }
+        return new Account({
+            accountNumber: account.accountNumber,
+            subAccount: account.subAccount,
+            bankCode: account.bankCode,
+            countryCode: account.countryCode,
+            iban: account.iban,
+            bic: account.bic,
+            currency: account.currency,
+        });
     }
     /** The list, read in the session's dialog, whose start delivers the user parameter data it is cached for. */
     async list() {
         await this.dialogs.open();
-        const upd = this.protocol.userParameters;
+        const upd = this.parameters.userParameters;
         if (upd !== undefined &&
             upd.accounts.length > 0 &&
             upd.accounts.every((a) => a.iban !== undefined && a.bic !== undefined)) {
@@ -55,29 +86,13 @@ export class SepaAccounts {
             return saved;
         if (this.unsaved !== undefined && this.unsaved.updVersion === updVersion)
             return this.unsaved.accounts;
-        const query = this.protocol.sepaAccounts();
+        const query = sepaAccountsQuery(this.parameters);
         if (query === undefined)
             return [];
-        // Where the bank rejects the list, the accounts stay as the user parameter data state them.
-        const outcome = { aborted: false };
-        const accounts = await this.guard.tryLookUp(async () => {
-            try {
-                return await this.dialogs.query(() => query);
-            }
-            catch (error) {
-                if (error instanceof FinTsDialogAbortedError)
-                    outcome.aborted = true;
-                throw error;
-            }
-        });
-        if (outcome.aborted && !this.abortSkipped) {
-            // The bank may have ended the dialog for a reason of its own, such as a timeout, so this call goes on without the
-            // list and the next one asks again in its new dialog. Only once: banks also end the dialog when they reject the
-            // list, and each time costs the next call a login.
-            this.abortSkipped = true;
-            return [];
-        }
-        if (accounts !== undefined && updVersion !== undefined && updVersion > 0) {
+        // Where the bank rejects the list, also by ending the dialog, the accounts stay as the user parameter data state
+        // them: asked again, a bank that ends the dialog in answer would cost each call a login.
+        const accounts = await tryLookUp(() => this.dialogs.query(() => query));
+        if (accounts !== undefined && accounts.length > 0 && updVersion !== undefined && updVersion > 0) {
             this.state.cacheSepaAccounts(accounts, updVersion);
         }
         else {
@@ -86,11 +101,12 @@ export class SepaAccounts {
         return accounts ?? [];
     }
 }
-function withSepaDetails(account, sepa) {
-    const match = sepa.find((s) => account.matches(s));
-    if (match === undefined)
-        return account;
+/**
+ * A copy of `account`, which shares no date with the user parameter data, with the IBAN and BIC of `match`, its entry
+ * in the SEPA account list, if any.
+ */
+function withSepaDetails(account, match) {
     // A BIC of the list takes precedence over the one of the user parameter data (Formals E.3.1.1, "BIC").
-    return account.copyWith({ iban: account.iban ?? match.iban, bic: match.bic ?? account.bic });
+    return account.copyWith({ iban: account.iban ?? match?.iban, bic: match?.bic ?? account.bic });
 }
 //# sourceMappingURL=sepa-accounts.js.map

package/dist/session/sepa-accounts.js.map

@@ -1 +1 @@
-{"version":3,"file":"sepa-accounts.js","sourceRoot":"","sources":["../../src/session/sepa-accounts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAM5D;;;;;;;GAOG;AACH,MAAM,OAAO,YAAY;IAWJ;IACA;IACA;IACA;IAbnB;;;OAGG;IACK,OAAO,CAA+E;IAE9F,yGAAyG;IACjG,YAAY,GAAG,KAAK,CAAC;IAE7B,YACmB,QAA8B,EAC9B,KAAmB,EACnB,OAA2B,EAC3B,KAAiB;QAHjB,aAAQ,GAAR,QAAQ,CAAsB;QAC9B,UAAK,GAAL,KAAK,CAAc;QACnB,YAAO,GAAP,OAAO,CAAoB;QAC3B,UAAK,GAAL,KAAK,CAAY;IACjC,CAAC;IAEJ,kHAAkH;IAClH,KAAK,CAAC,iBAAiB;QACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,IAAI,EAAE,CAAC;QAC9D,OAAO;YACL,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5D,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;SAC3D,CAAC;IACJ,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,QAAQ,CAAC,OAAgB;QAC7B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QAC5E,OAAO,eAAe,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,6GAA6G;IACrG,KAAK,CAAC,IAAI;QAChB,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;QACzC,IACE,GAAG,KAAK,SAAS;YACjB,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YACvB,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,EACtE,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,EAAE,OAAO,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACvG,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC3C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACnC,4FAA4F;QAC5F,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YACrD,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YAC/C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,uBAAuB;oBAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBACrE,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1C,kHAAkH;YAClH,gHAAgH;YAChH,mDAAmD;YACnD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1D,CAAC;QACD,OAAO,QAAQ,IAAI,EAAE,CAAC;IACxB,CAAC;CACF;AAED,SAAS,eAAe,CAAC,OAAgB,EAAE,IAAwB;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACxC,uGAAuG;IACvG,OAAO,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;AAC/F,CAAC"}
+{"version":3,"file":"sepa-accounts.js","sourceRoot":"","sources":["../../src/session/sepa-accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAErE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAIrD;;;;;;;;GAQG;AACH,MAAM,OAAO,YAAY;IAQJ;IACA;IACA;IATnB;;;OAGG;IACK,OAAO,CAA+E;IAE9F,YACmB,UAA0B,EAC1B,KAAmB,EACnB,OAAqB;QAFrB,eAAU,GAAV,UAAU,CAAgB;QAC1B,UAAK,GAAL,KAAK,CAAc;QACnB,YAAO,GAAP,OAAO,CAAc;IACrC,CAAC;IAEJ,kHAAkH;IAClH,KAAK,CAAC,iBAAiB;QACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,QAAQ,IAAI,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC;QACzC,OAAO;YACL,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5E,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;SACnD,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAgB;QAC7B,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,6DAA6D;YAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;YACrE,OAAO,KAAK,CAAC,QAAQ,CAAC;gBACpB,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI;gBAChC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;gBAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ;aAC7C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,oBAAoB,KAAK,IAAI,EAAE,CAAC;YAClE,MAAM,IAAI,qBAAqB,CAAC,8EAA8E,CAAC,CAAC;QAClH,CAAC;QACD,OAAO,IAAI,OAAO,CAAC;YACjB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,6GAA6G;IACrG,KAAK,CAAC,IAAI;QAChB,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;QAC3C,IACE,GAAG,KAAK,SAAS;YACjB,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YACvB,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,EACtE,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,EAAE,OAAO,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACvG,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACnC,iHAAiH;QACjH,yFAAyF;QACzF,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YAChG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1D,CAAC;QACD,OAAO,QAAQ,IAAI,EAAE,CAAC;IACxB,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,OAAgB,EAAE,KAA0B;IACnE,uGAAuG;IACvG,OAAO,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;AACjG,CAAC"}

package/dist/session/session-setup.d.ts

@@ -1,8 +1,7 @@
 import type { BankInfo } from '../core/bank-info.js';
-import type { TanMethod } from '../tan/tan-models.js';
-import type { LoginGuard } from './login-guard.js';
-import type { BankResponse, PinTanProtocol, ProtocolDialog } from './protocol.js';
-import type { ResponseHandler } from './response-handler.js';
+import type { TanMedium, TanMethod } from '../tan/tan-models.js';
+import type { FinTs3Protocol } from '../v3/protocol.js';
+import { SignedDialog, type SessionParts } from './signed-dialog.js';
 import type { TanSelection } from './tan-selection.js';
 /**
  * What has to be settled before a login: the bank parameter data, the synchronization, and through `TanSelection` the
@@ -10,14 +9,11 @@ import type { TanSelection } from './tan-selection.js';
  *
  * Where the bank refuses a login for a reason the session can take care of, `remedied` does so and logs in again.
  */
-export declare class SessionSetup<R extends BankResponse, O> {
+export declare class SessionSetup {
+    private readonly session;
     private readonly protocol;
-    private readonly responses;
     private readonly tans;
-    private readonly guard;
-    /** Whether a synchronization dialog ran, so that a helpful one runs once only. */
-    private synchronizationTried;
-    constructor(protocol: PinTanProtocol<R, O>, responses: ResponseHandler<R>, tans: TanSelection<R, O>, guard: LoginGuard);
+    constructor(session: SessionParts, protocol: FinTs3Protocol, tans: TanSelection);
     /**
      * The bank's general information: from an anonymous dialog where the bank answers one, else from the synchronization.
      * No TAN method or medium is chosen for it.
@@ -25,21 +21,19 @@ export declare class SessionSetup<R extends BankResponse, O> {
     bankInfo(): Promise<BankInfo>;
     /** The TAN methods the bank allows for this user, which the synchronization reports. */
     methods(): Promise<TanMethod[]>;
-    /** Settles what is still open: the bank parameter data, the synchronization, the TAN method and medium. */
-    prepare(): Promise<void>;
-    /** A new dialog signed with the TAN method and medium in use, once `prepare` has settled them. */
-    newDialog(): Promise<ProtocolDialog<R, O>>;
     /**
-     * Runs `attempt`, which may log in, and runs it once more for each reason of a refused login the session can take
-     * care of, so that a bank that keeps refusing fails with its own error:
-     *
-     * | Refusal (`LoginGuard.remediableReasons`) | Remedy |
-     * | --- | --- |
-     * | 3920 without the method, or 9075 after the one-step method | another allowed method (`TanSelection.replace`) |
-     * | 9391 | a new synchronization, which issues a customer system ID |
+     * Settles what is still open: the bank parameter data, the synchronization, the TAN method and medium. Returns the TAN
+     * media it looked up to choose the medium; `undefined` where it looked up none, or the bank listed none.
      */
+    prepare(): Promise<TanMedium[] | undefined>;
+    /** A new dialog signed with the TAN method and medium in use, once `prepare` has settled them. */
+    newDialog(): Promise<SignedDialog>;
+    /** Runs `attempt`, which may log in, once more after each refused login `remedy` takes care of. */
     remedied<T>(attempt: () => Promise<T>): Promise<T>;
-    /** Takes care of `reason`, given for refusing a login signed with `rejected`; returns whether it could. */
+    /**
+     * Takes care of `reason`, given for refusing a login signed with `rejected`, with another TAN method or a new
+     * synchronization; returns whether it could.
+     */
     private remedy;
     /**
      * Loads the bank parameter data if they are missing, then synchronizes if that is due.
@@ -52,11 +46,25 @@ export declare class SessionSetup<R extends BankResponse, O> {
      */
     private loadParameters;
     /**
-     * Asks for the bank parameter data without logging in. A bank that does not answer anonymously is no error, but a
-     * failed connection is: the synchronization would only wait for the same server again.
+     * Asks for the bank parameter data without logging in, keeps them where there are none from a dialog signed with the
+     * PIN (`ParameterStore.keepAnonymous`), and passes the bank's messages on: all an anonymous dialog tells, since the
+     * TAN methods it lists are not those of a user. A bank that does not answer anonymously is no error, but a failed
+     * connection is: the synchronization would only wait for the same server again.
      */
     private fetchBankParametersAnonymously;
-    /** Runs the synchronization dialog where it is due (`TanSelection.synchronizationDialog`). */
+    /**
+     * Asks for the bank parameter data in an anonymous dialog that announces strong customer authentication; a bank that
+     * rejects the announcement, with a return code or by failing on it, is asked again without it.
+     *
+     * A timeout or a broken connection is not a reason to ask again: it would only double the wait.
+     */
+    private requestBankParametersAnonymously;
+    private anonymousDialog;
+    /**
+     * Runs the synchronization, a login in a dialog of its own, while there is no customer system ID, without which no
+     * regular dialog starts. It runs before the TAN method and medium are settled (`TanSelection.synchronizationDialog`
+     * tells which method signs it).
+     */
     private synchronizeIfDue;
     /**
      * The TAN media of the method in use; `undefined` if the bank does not list them or rejects the list, after which the