@coderoftime/fints 0.1.0 → 0.3.0

package/src/core/errors.ts

@@ -1,61 +1,89 @@
 import { FormatError } from '../util/errors.js';
-import { endsDialog, FeedbackCodes, type FinTsFeedback } from './feedback.js';
+import { nonBlank } from '../util/text.js';
+import { endsDialog, FeedbackCodes, hasCode, type FinTsFeedback } from './feedback.js';
 
-/** Base class of all errors the client raises about the bank and its data. */
+/**
+ * Base class of all errors the client raises about the bank and its data.
+ *
+ * Each error class states its `name`: a minifier renames classes, and `constructor.name` would show a meaningless one.
+ */
 export abstract class FinTsError extends Error {
-  protected constructor(name: string, message: string, cause?: unknown) {
-    super(message, cause === undefined ? undefined : { cause });
-    // Set explicitly: a minifier renames classes, and `constructor.name` would show a meaningless name.
-    this.name = name;
-  }
+  abstract override name: string;
 }
 
-/** The connection to the bank failed or returned an HTTP error. */
+/**
+ * The connection to the bank failed or returned an HTTP error.
+ *
+ * It carries no `cause`: the transport's own error may hold the message it was sending, PIN and TAN included.
+ */
 export class FinTsTransportError extends FinTsError {
-  /** The HTTP status code of the response, `undefined` if there was none, for example after a timeout. */
+  override name = 'FinTsTransportError';
+
+  /**
+   * The HTTP status code of the bank's answer, `undefined` where none came, for example after a timeout; the client
+   * acts on it (`FinTsTransport.post`).
+   */
   readonly statusCode: number | undefined;
 
-  constructor(message: string, options?: { statusCode?: number; cause?: unknown }) {
-    super('FinTsTransportError', message, options?.cause);
+  constructor(message: string, options?: { statusCode?: number }) {
+    super(message);
     this.statusCode = options?.statusCode;
   }
 }
 
 /** The bank's response could not be understood. */
 export class FinTsProtocolError extends FinTsError {
-  constructor(message: string) {
-    super('FinTsProtocolError', message);
-  }
+  override name = 'FinTsProtocolError';
 }
 
 /** The bank does not offer the requested business transaction. */
 export class FinTsUnsupportedError extends FinTsError {
-  constructor(message: string) {
-    super('FinTsUnsupportedError', message);
-  }
+  override name = 'FinTsUnsupportedError';
+}
+
+/**
+ * The client has no TAN method or medium to log in with: the method in use needs a TAN medium the client could not
+ * learn, or the bank offers the user only TAN methods the client cannot run. Pass a medium to
+ * `FinTsClient.selectTanMethod`, or choose another method.
+ *
+ * The client does not send a login the bank would refuse for it, but the steps before, such as the synchronization or
+ * the lookup of the TAN media, may have gone out.
+ */
+export class FinTsTanSetupError extends FinTsError {
+  override name = 'FinTsTanSetupError';
 }
 
 /**
- * The bank rejected the request; `feedback` holds all return codes.
+ * The bank rejected the request; `feedback` holds all return codes. A refused login is a `FinTsLoginRefusedError`.
  *
- * After a refused login every later call that would send the PIN fails with the same error, without contacting the
- * bank; create a new client to try again. The README tells which errors refuse a login.
+ * The message is not safe to log: by default it holds the code, text and parameters of each error the bank names, such
+ * as an IBAN or a login name, and so does `stack`. Log `codes` instead. `feedback` is a getter, not a field, so that
+ * `JSON.stringify` and Node.js's report of an uncaught error, which show an error's fields as they are, leave out at
+ * least the warnings and successes, such as the new login data of return code 3072.
  */
 export class FinTsBankError extends FinTsError {
-  /** All return codes of the response, warnings and successes included. */
-  readonly feedback: readonly FinTsFeedback[];
+  override name = 'FinTsBankError';
 
-  /** A rejection with the return codes in `feedback`; `message` defaults to the errors among them. */
-  constructor(feedback: readonly FinTsFeedback[], message?: string, name = 'FinTsBankError') {
+  readonly #feedback: readonly FinTsFeedback[];
+
+  /**
+   * A rejection with the return codes in `feedback`; `message` defaults to the errors among them, with the bank's texts
+   * and parameters, such as `9010: Konto gesperrt [DE89370400440532013000]`, so it is not safe to log.
+   */
+  constructor(feedback: readonly FinTsFeedback[], message?: string) {
     super(
-      name,
       message ??
         feedback
           .filter((f) => f.isError)
-          .map((f) => f.toString())
+          .map(withText)
           .join('; '),
     );
-    this.feedback = Object.freeze([...feedback]);
+    this.#feedback = Object.freeze([...feedback]);
+  }
+
+  /** All return codes of the response, warnings and successes included. */
+  get feedback(): readonly FinTsFeedback[] {
+    return this.#feedback;
   }
 
   /** The return codes of `feedback`. */
@@ -64,29 +92,45 @@ export class FinTsBankError extends FinTsError {
   }
 }
 
-/** Wrong or blocked PIN, a refused login as `FinTsBankError` describes it. */
-export class FinTsPinError extends FinTsBankError {
-  constructor(feedback: readonly FinTsFeedback[]) {
-    super(feedback, undefined, 'FinTsPinError');
-  }
+/**
+ * The bank refused the login, so the client sends the PIN no more: every later call that would send it fails with this
+ * error without contacting the bank, also in a client restored from the saved state, until
+ * `FinTsClient.clearLoginRefusal` takes a PIN the user has entered anew; for good where the bank has changed the login
+ * data (`FinTsLoginDataChangedError`).
+ *
+ * Banks lock the access after a few failed logins, and a return code does not always tell whether the PIN was the
+ * reason, so any error in the answer to a login refuses it, also one that ends the dialog, and so does a wrong PIN
+ * wherever the bank reports it. Only where the bank names a reason the client can take care of, another TAN method or a
+ * new customer system ID, does the same call log in once more, for each reason once. The client refuses the login
+ * itself where it could not read the answers to two logins in a row, which the bank may have counted as failed
+ * attempts; `feedback` is empty then.
+ */
+export class FinTsLoginRefusedError extends FinTsBankError {
+  override name = 'FinTsLoginRefusedError';
+}
+
+/** Wrong or blocked PIN. */
+export class FinTsPinError extends FinTsLoginRefusedError {
+  override name = 'FinTsPinError';
 }
 
 /** Invalid, expired or rejected TAN, as the bank reports it in answer to a TAN or to an approval status request. */
 export class FinTsTanError extends FinTsBankError {
-  constructor(feedback: readonly FinTsFeedback[]) {
-    super(feedback, undefined, 'FinTsTanError');
-  }
+  override name = 'FinTsTanError';
 }
 
 /**
- * The bank has changed the user's login data and expects the new ones from now on (return code 3072).
+ * The bank has changed the user's login data and expects the new ones from now on (return code 3072), also where it
+ * names an error next to them, but for a rejected PIN, which is a `FinTsPinError`.
  *
- * The client has ended the dialog, and every later call fails with this error. Create a new client with the new data; a
- * `loginName` replaces user ID and customer ID: pass it as `userId`, without a customer ID.
+ * The client has ended the dialog, where the bank opened one, and logs in with the old data no more. Create a new
+ * client with the new data; a `loginName` replaces user ID and customer ID: pass it as `userId`, without a customer ID.
  */
-export class FinTsLoginDataChangedError extends FinTsBankError {
+export class FinTsLoginDataChangedError extends FinTsLoginRefusedError {
+  override name = 'FinTsLoginDataChangedError';
+
   constructor(feedback: readonly FinTsFeedback[]) {
-    super(feedback, 'The bank has changed the login data', 'FinTsLoginDataChangedError');
+    super(feedback, 'The bank has changed the login data');
   }
 
   /** The new user ID (Benutzerkennung); `undefined` where the bank names none. */
@@ -106,29 +150,36 @@ export class FinTsLoginDataChangedError extends FinTsBankError {
 
   private parameter(index: number): string | undefined {
     const change = this.feedback.find((f) => f.code === FeedbackCodes.newLoginData);
-    const value = change?.parameters[index]?.trim();
-    return value === undefined || value === '' ? undefined : value;
+    return nonBlank(change?.parameters[index]);
   }
 }
 
-/** The bank ended the dialog, for example after a timeout. */
+/**
+ * The bank ended the dialog, for example after a timeout; the next call logs in anew. Where the bank ends the dialog
+ * in answer to a login, the call fails with `FinTsLoginRefusedError` instead.
+ */
 export class FinTsDialogAbortedError extends FinTsBankError {
-  constructor(feedback: readonly FinTsFeedback[]) {
-    super(feedback, undefined, 'FinTsDialogAbortedError');
-  }
+  override name = 'FinTsDialogAbortedError';
 }
 
 /** The user cancelled the TAN entry or the approval in the banking app. */
 export class FinTsTanCancelledError extends FinTsError {
+  override name = 'FinTsTanCancelledError';
+
   constructor() {
-    super('FinTsTanCancelledError', 'TAN entry cancelled');
+    super('TAN entry cancelled');
   }
 }
 
-/** The user did not approve in the banking app within the bank's polling limit. */
+/**
+ * The user did not approve in the banking app in time: within the status requests the bank allows, 60 where it states
+ * none, and 10 minutes of polling at most.
+ */
 export class FinTsDecoupledTimeoutError extends FinTsError {
+  override name = 'FinTsDecoupledTimeoutError';
+
   constructor() {
-    super('FinTsDecoupledTimeoutError', 'Approval on the separate device was not completed in time');
+    super('Approval on the separate device was not completed in time');
   }
 }
 
@@ -138,10 +189,12 @@ export class FinTsDecoupledTimeoutError extends FinTsError {
  * It does not extend `FinTsError`: it tells about the app's use of the client, not about the bank.
  */
 export class FinTsStateError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = 'FinTsStateError';
-  }
+  override name = 'FinTsStateError';
+}
+
+/** The error of whatever a closed client is asked to do. */
+export function clientClosedError(): FinTsStateError {
+  return new FinTsStateError('The FinTS client is closed');
 }
 
 /**
@@ -176,6 +229,11 @@ function isPinError(f: FinTsFeedback): boolean {
   }
 }
 
+/** `f` with the bank's text and parameters, which `FinTsFeedback.toString` leaves out. */
+function withText(f: FinTsFeedback): string {
+  return `${f.code}: ${f.text}${f.parameters.length === 0 ? '' : ` [${f.parameters.join(', ')}]`}`;
+}
+
 /**
  * The most specific error for the errors in `feedback`, the answer to a message that `completesApproval` or not.
  *
@@ -192,7 +250,23 @@ export function bankErrorFor(feedback: readonly FinTsFeedback[], completesApprov
   return new FinTsBankError(feedback);
 }
 
-/** Runs `parse` on data from the bank and reports malformed data as `FinTsProtocolError`. */
+/**
+ * The refusal of a login whose answer carried `feedback`: `FinTsPinError` for a rejected PIN, else
+ * `FinTsLoginDataChangedError` for new login data, also next to other errors, and `FinTsLoginRefusedError` for anything
+ * else. The same for a refusal restored from the saved state, which keeps only `feedback`.
+ *
+ * New login data end the old ones for good, so the session takes care of no other reason the answer names.
+ */
+export function loginRefusalFor(feedback: readonly FinTsFeedback[]): FinTsLoginRefusedError {
+  if (feedback.some(isPinError)) return new FinTsPinError(feedback);
+  if (hasCode(feedback, FeedbackCodes.newLoginData)) return new FinTsLoginDataChangedError(feedback);
+  return new FinTsLoginRefusedError(feedback);
+}
+
+/**
+ * Runs `parse` on data from the bank and reports malformed data as `FinTsProtocolError`, whose message leaves the data
+ * out (`FormatError`).
+ */
 export function parseBankData<T>(parse: () => T): T {
   try {
     return parse();
@@ -201,3 +275,23 @@ export function parseBankData<T>(parse: () => T): T {
     throw error;
   }
 }
+
+/**
+ * Runs `lookup`, which only completes data, such as the SEPA account list; `undefined` where the bank rejects it, so
+ * that the caller carries on without it. An aborted dialog counts as a rejection: banks end the dialog along with many.
+ * A refused login and a rejected TAN fail the call: the user must hear of them.
+ */
+export async function tryLookUp<T>(lookup: () => Promise<T>): Promise<T | undefined> {
+  try {
+    return await lookup();
+  } catch (error) {
+    if (
+      !(error instanceof FinTsBankError) ||
+      error instanceof FinTsLoginRefusedError ||
+      error instanceof FinTsTanError
+    ) {
+      throw error;
+    }
+    return undefined;
+  }
+}

package/src/core/feedback.ts

@@ -1,3 +1,5 @@
+import { inspectCustom } from '../util/inspect.js';
+
 /** A return code with text from the bank, for example `0020: Auftrag ausgeführt`. */
 export class FinTsFeedback {
   /** The four-digit return code; `0…` reports success, `3…` a warning and `9…` an error. */
@@ -9,7 +11,10 @@ export class FinTsFeedback {
   /** The bank's explanation of the code. */
   readonly text: string;
 
-  /** Values the bank adds to the code, such as the position to continue at. */
+  /**
+   * Values the bank adds to the code, such as the position to continue at: one character per byte the bank sent (ISO
+   * 8859-1, the FinTS character set), since the client and the app send them back as they came.
+   */
   readonly parameters: readonly string[];
 
   constructor(init: { code: string; reference?: string | undefined; text: string; parameters?: readonly string[] }) {
@@ -34,8 +39,17 @@ export class FinTsFeedback {
     return this.code.startsWith('9');
   }
 
+  /**
+   * The code only, not the text and parameters, which may name the account or hold login data, such as those of return
+   * code 3072, so that logs and crash reports do not collect them; show `text` to the user.
+   */
   toString(): string {
-    return `${this.code}: ${this.text}${this.parameters.length === 0 ? '' : ` [${this.parameters.join(', ')}]`}`;
+    return `FinTsFeedback(${this.code})`;
+  }
+
+  /** What Node.js's `util.inspect` and `console.log` show: `toString`, not the fields. */
+  [inspectCustom](): string {
+    return this.toString();
   }
 }
 

package/src/core/transaction.ts

@@ -1,10 +1,18 @@
-import { formatIsoDate } from '../util/dates.js';
+import { copyDate, formatIsoDate } from '../util/dates.js';
+import { invalidArgument } from '../util/errors.js';
 import { ImmutableMap } from '../util/immutable-map.js';
+import { inspectCustom } from '../util/inspect.js';
 import type { Amount } from './amount.js';
 
 /** Whether a transaction is booked or still pending. */
 export type TransactionStatus = 'booked' | 'pending';
 
+/** `status`; throws `TypeError` unless it is a `TransactionStatus`. */
+export function requireStatus(status: unknown): TransactionStatus {
+  if (status === 'booked' || status === 'pending') return status;
+  throw invalidArgument("Must be 'booked' or 'pending'", 'status');
+}
+
 /** Transaction format to request; `auto` prefers camt.052 when the bank supports it. */
 export type TransactionFormat =
   /** camt.052 where the bank offers it, otherwise MT940. */
@@ -112,13 +120,18 @@ export class Transaction {
   /** The party the payer acts for, where that is not the payer itself. */
   readonly ultimateDebtor: string | undefined;
 
-  /** All SEPA keywords found in the purpose, keyed by keyword (EREF, KREF, MREF, CRED, SVWZ, …). */
+  /**
+   * The SEPA keywords of the purpose, keyed by keyword (EREF, KREF, MREF, CRED, SVWZ, …): those `SepaPurpose` reads. In
+   * camt, EREF, MREF and CRED are those of `endToEndId`, `mandateId` and `creditorId`, which the bank states apart,
+   * never keywords of the remittance text the payer or the payee writes.
+   */
   readonly purposeCodes: ReadonlyMap<string, string>;
 
+  /** Takes copies of the dates and purpose codes of `init`: each transaction has its own, which no other one shares. */
   constructor(init: TransactionInit) {
     this.status = init.status ?? 'booked';
-    this.bookingDate = init.bookingDate;
-    this.valueDate = init.valueDate;
+    this.bookingDate = copyDate(init.bookingDate);
+    this.valueDate = copyDate(init.valueDate);
     this.amount = init.amount;
     this.isReversal = init.isReversal ?? false;
     this.bookingText = init.bookingText;
@@ -153,4 +166,9 @@ export class Transaction {
   toString(): string {
     return `Transaction(${formatIsoDate(this.bookingDate ?? this.valueDate)}, ${this.status}${this.isReversal ? ', reversal' : ''})`;
   }
+
+  /** What Node.js's `util.inspect` and `console.log` show: `toString`, not the fields. */
+  [inspectCustom](): string {
+    return this.toString();
+  }
 }

package/src/core/transport.ts

@@ -1,4 +1,5 @@
-import { concatBytes } from '../util/bytes.js';
+import { invalidArgument } from '../util/errors.js';
+import { trimBlanks } from '../util/text.js';
 import { FinTsTransportError } from './errors.js';
 
 /** Sends one FinTS message and returns the bank's reply; replace it for a relay, proxies, pinning or tests. */
@@ -6,9 +7,22 @@ export interface FinTsTransport {
   /**
    * Posts `body` to `url` and returns the response body.
    *
-   * Implementations report failures as `FinTsTransportError`.
+   * Once the client is closed, it aborts `signal` five seconds later, and that of the dialog ends it then sends five
+   * seconds after the request on its way, if any, is over: the client no longer waits for the answer then, and the
+   * transport should stop the request, since the dialog end may go out while it still runs.
+   *
+   * The client bounds neither the time of the exchange nor the size of the answer: do so in the transport, as
+   * `HttpTransport` does, so that a server that stops answering cannot hold up a call and one that sends without end
+   * cannot exhaust the memory.
+   *
+   * Implementations report failures as `FinTsTransportError`, with the HTTP status as `statusCode` where the bank
+   * answered with an HTTP error: an anonymous request for the bank parameter data that fails so goes out once more,
+   * without the announcement of strong authentication, which some banks fail on. Of any other error, another
+   * `FinTsError` included, the client keeps only its message and the reason its cause gives (its message, or else the
+   * messages of its errors or its code), as a `FinTsTransportError` without `statusCode`. `body` holds PIN and TAN in
+   * plain text: keep it out of error messages and logs.
    */
-  post(url: URL, body: Uint8Array, contentType: string): Promise<Uint8Array>;
+  post(url: URL, body: Uint8Array, contentType: string, signal: AbortSignal): Promise<Uint8Array>;
 
   /** Releases the connection; the client calls it when it is closed. */
   close(): void;
@@ -16,17 +30,38 @@ export interface FinTsTransport {
 
 /** What `HttpTransport` takes; all optional. */
 export interface HttpTransportOptions {
-  /** The `fetch` to send with, for example one with a proxy agent; the global `fetch` by default. */
+  /**
+   * The `fetch` to send with, for example one with a proxy agent; the global `fetch` by default, as it is at each
+   * request.
+   *
+   * It must post to the URL it is given: an answer from another URL counts as a redirect, which fails the request. Of
+   * an answer whose `body` is no `ReadableStream`, as with node-fetch, the size can only be checked once it is read
+   * whole.
+   */
   fetch?: typeof fetch;
-  /** Time for the whole exchange in milliseconds, from sending the request to the last byte of the response; 90 s. */
+  /**
+   * Time for the whole exchange in milliseconds, from sending the request to the last byte of the response; 90 s. At
+   * most 2147483647 (about 24 days), the longest `setTimeout` waits.
+   */
   timeoutMs?: number;
-  /** Largest response accepted, so that a faulty server cannot exhaust the memory; 16 MiB. */
+  /** Largest response accepted in bytes, so that a faulty server cannot exhaust the memory; 16 MiB. */
   maxResponseBytes?: number;
 }
 
+/** The longest delay `setTimeout` takes; it fires at once for a longer one, such as `Infinity`. */
+const maxTimeoutMs = 2 ** 31 - 1;
+
 /**
  * Default `FinTsTransport`: HTTP POST with `fetch`.
  *
+ * Without the `fetch` option it sends with the global `fetch` as it is at each request, and cannot bypass what that
+ * does, for plain http to a local server (`FinTsConfig.allowInsecureUrl`) as for https: whatever replaces that `fetch`
+ * or handles its requests, such as a test's stub of `globalThis.fetch` or on Node.js a global dispatcher (undici's
+ * `setGlobalDispatcher`), gets every message, PIN and TAN included, and a proxy that the runtime takes from the
+ * environment, as Node.js does with `NODE_USE_ENV_PROXY=1`, and Deno and Bun do from `HTTP_PROXY`, sees the PIN of
+ * plain http unencrypted. Exempt the host with `NO_PROXY`, such as `localhost,127.0.0.1,::1`, or pass a `fetch` that
+ * connects directly.
+ *
  * In a browser it only reaches servers that allow the page's origin (CORS), which bank servers do not: a web app needs
  * a server of its own between browser and bank, reached with a `FinTsTransport` of its own.
  */
@@ -35,30 +70,47 @@ export class HttpTransport implements FinTsTransport {
   readonly maxResponseBytes: number;
   private readonly fetchFn: typeof fetch;
 
+  /**
+   * Throws `TypeError` if `timeoutMs` is not a positive number of at most 2147483647, or `maxResponseBytes` is not a
+   * positive number.
+   */
   constructor(options: HttpTransportOptions = {}) {
-    this.fetchFn = options.fetch ?? ((input, init) => fetch(input, init));
+    const custom = options.fetch;
+    // Called as a plain function: a browser's native `fetch` fails as a method of another object.
+    this.fetchFn = custom === undefined ? (input, init) => fetch(input, init) : (input, init) => custom(input, init);
     this.timeoutMs = options.timeoutMs ?? 90_000;
     this.maxResponseBytes = options.maxResponseBytes ?? 16 << 20;
+    if (!isPositive(this.timeoutMs) || this.timeoutMs > maxTimeoutMs) {
+      throw invalidArgument(`Must be a positive number of at most ${maxTimeoutMs}`, 'timeoutMs');
+    }
+    if (!isPositive(this.maxResponseBytes)) throw invalidArgument('Must be a positive number', 'maxResponseBytes');
   }
 
-  async post(url: URL, body: Uint8Array, contentType: string): Promise<Uint8Array> {
+  /** Fails with `FinTsTransportError` at the timeout or once `signal` is aborted; sends nothing if it is already. */
+  async post(url: URL, body: Uint8Array, contentType: string, signal?: AbortSignal): Promise<Uint8Array> {
+    if (signal?.aborted) throw new FinTsTransportError('Request aborted');
     const controller = new AbortController();
-    let timer: ReturnType<typeof setTimeout> | undefined;
-    // Waiting for the timeout as well covers a `fetch` that cannot abort a request.
-    const timedOut = new Promise<never>((_, reject) => {
-      timer = setTimeout(() => {
-        controller.abort();
-        reject(new FinTsTransportError('Request timed out'));
-      }, this.timeoutMs);
+    // Raced with the exchange, for a `fetch` that cannot abort a request.
+    const stopped = new Promise<never>((_, reject) => {
+      controller.signal.addEventListener('abort', () => {
+        reject(controller.signal.reason as FinTsTransportError);
+      });
     });
+    const stop = (message: string) => (): void => {
+      controller.abort(new FinTsTransportError(message));
+    };
+    const timer = setTimeout(stop('Request timed out'), this.timeoutMs);
+    const abort = stop('Request aborted');
+    signal?.addEventListener('abort', abort);
     try {
-      return await Promise.race([this.exchange(url, body, contentType, controller.signal), timedOut]);
+      return await Promise.race([this.exchange(url, body, contentType, controller.signal), stopped]);
     } catch (error) {
+      if (controller.signal.aborted) throw controller.signal.reason as FinTsTransportError;
       if (error instanceof FinTsTransportError) throw error;
-      if (controller.signal.aborted) throw new FinTsTransportError('Request timed out');
-      throw new FinTsTransportError(describe(error));
+      throw new FinTsTransportError(failureMessage(error));
     } finally {
       clearTimeout(timer);
+      signal?.removeEventListener('abort', abort);
     }
   }
 
@@ -69,36 +121,68 @@ export class HttpTransport implements FinTsTransport {
       headers: { 'Content-Type': contentType, 'Cache-Control': 'no-cache', Pragma: 'no-cache' },
       // The PIN travels in the body: never let the request be repeated at another address.
       redirect: 'manual',
+      // In a browser: no cookies of the page and no referrer go with the PIN, and no cache keeps the exchange.
+      credentials: 'omit',
+      referrerPolicy: 'no-referrer',
+      cache: 'no-store',
       signal,
     });
     if (response.type === 'opaqueredirect') {
       throw new FinTsTransportError('The server redirects the request, which the client does not follow');
     }
+    // A `fetch` that ignores `redirect`, as one over XMLHttpRequest does, shows a redirect it followed only here.
+    if (response.redirected || (response.url && response.url !== withoutFragment(url))) {
+      await discard(response);
+      throw new FinTsTransportError('The fetch followed a redirect: the request may have gone to another address');
+    }
     if (response.status < 200 || response.status > 299) {
-      await response.body?.cancel().catch(() => undefined);
-      throw new FinTsTransportError(`HTTP ${response.status} ${response.statusText}`.trim(), {
+      await discard(response);
+      throw new FinTsTransportError(trimBlanks(`HTTP ${response.status} ${response.statusText}`), {
         statusCode: response.status,
       });
     }
+    const announced = response.headers.get('Content-Length');
+    if (announced !== null && /^\d+$/.test(announced) && Number(announced) > this.maxResponseBytes) {
+      await discard(response);
+      throw this.tooLarge();
+    }
     return this.readBody(response);
   }
 
   private async readBody(response: Response): Promise<Uint8Array> {
-    const reader = response.body?.getReader();
-    if (reader === undefined) return new Uint8Array(await response.arrayBuffer());
-    const chunks: Uint8Array[] = [];
+    // A `fetch` that does not stream, as one over XMLHttpRequest or node-fetch, gives no body or one of another kind.
+    const body = response.body as ReadableStream<Uint8Array> | null | undefined;
+    if (typeof body?.getReader !== 'function') {
+      const bytes = new Uint8Array(await response.arrayBuffer());
+      if (bytes.length > this.maxResponseBytes) throw this.tooLarge();
+      return bytes;
+    }
+    const reader = body.getReader();
+    // Copied as they arrive: many tiny chunks kept as they are would take many times the bytes they hold, and a `fetch`
+    // may refill the chunk it handed out.
+    let bytes = new Uint8Array(0);
     let size = 0;
     for (;;) {
       const { done, value } = await reader.read();
       if (done) break;
-      chunks.push(value);
-      size += value.length;
-      if (size > this.maxResponseBytes) {
+      const end = size + value.length;
+      if (end > this.maxResponseBytes) {
         await reader.cancel().catch(() => undefined);
-        throw new FinTsTransportError(`Response larger than ${this.maxResponseBytes} bytes`);
+        throw this.tooLarge();
+      }
+      if (end > bytes.length) {
+        const grown = new Uint8Array(Math.min(Math.max(2 * bytes.length, end), this.maxResponseBytes));
+        grown.set(bytes.subarray(0, size));
+        bytes = grown;
       }
+      bytes.set(value, size);
+      size = end;
     }
-    return concatBytes(chunks);
+    return bytes.slice(0, size);
+  }
+
+  private tooLarge(): FinTsTransportError {
+    return new FinTsTransportError(`Response larger than ${this.maxResponseBytes} bytes`);
   }
 
   close(): void {
@@ -106,9 +190,46 @@ export class HttpTransport implements FinTsTransport {
   }
 }
 
-/** The message of a `fetch` failure, with its cause: Node.js reports `fetch failed` and the reason in the cause. */
-function describe(error: unknown): string {
+/** `url` as `Response.url` gives it: without fragment. */
+function withoutFragment(url: URL): string {
+  const copy = new URL(url);
+  copy.hash = '';
+  return copy.href;
+}
+
+/** Cancels the body of a response the transport rejects, unless it cannot be cancelled, as a Node.js stream cannot. */
+async function discard(response: Response): Promise<void> {
+  try {
+    await response.body?.cancel();
+  } catch {
+    // The response is rejected all the same.
+  }
+}
+
+function isPositive(value: number): boolean {
+  return Number.isFinite(value) && value > 0;
+}
+
+/**
+ * The message of a failed request, with the reason its cause gives: Node.js reports `fetch failed` and the reason in the
+ * cause. Only messages and codes, since the error may hold the request, PIN and TAN included.
+ */
+export function failureMessage(error: unknown): string {
   if (!(error instanceof Error)) return String(error);
-  const cause: unknown = error.cause;
-  return cause instanceof Error ? `${error.message}: ${cause.message}` : error.message;
+  const reason = error.cause instanceof Error ? reasonOf(error.cause) : '';
+  return reason ? `${error.message}: ${reason}` : error.message;
+}
+
+/**
+ * The message of `cause`, or where it has none, the distinct messages of its `errors` or its `code`: Node.js reports a
+ * failed connection to a host with IPv6 and IPv4 addresses as an `AggregateError` without a message.
+ */
+function reasonOf(cause: Error): string {
+  if (cause.message) return cause.message;
+  if (cause instanceof AggregateError) {
+    const messages = cause.errors.flatMap((error) => (error instanceof Error && error.message ? [error.message] : []));
+    if (messages.length > 0) return [...new Set(messages)].join('; ');
+  }
+  const code: unknown = (cause as { code?: unknown }).code;
+  return typeof code === 'string' ? code : '';
 }