@coderoftime/fints 0.1.0 → 0.3.0

package/src/tan/flicker.ts

@@ -1,5 +1,6 @@
 import { FormatError } from '../util/errors.js';
-import { withoutWhitespace } from '../util/text.js';
+import { inspectCustom } from '../util/inspect.js';
+import { trimBlanks, withoutWhitespace } from '../util/text.js';
 
 /** Version of the chipTAN HHD specification a flicker code follows: 1.3, or 1.4, which adds control bytes. */
 export type HhdVersion = 'hhd13' | 'hhd14';
@@ -10,23 +11,36 @@ const codeMarker = 'CHLGUC';
 const textMarker = 'CHLGTEXT';
 const markerLengthDigits = 4;
 
+/**
+ * The flicker code and the instruction text of a combined challenge; `undefined` unless `message` starts with
+ * `CHLGUC`, after blanks, and states the length of the code. White space in the code wraps lines and is dropped.
+ */
+function splitCombined(message: string): { code: string; instruction: string } | undefined {
+  const text = trimBlanks(message, { end: false });
+  const end = text.indexOf(textMarker);
+  if (!text.startsWith(codeMarker) || end < 0) return undefined;
+  const lengthAndCode = withoutWhitespace(text.substring(codeMarker.length, end));
+  const code = lengthAndCode.substring(markerLengthDigits);
+  const length = lengthAndCode.substring(0, markerLengthDigits);
+  if (!/^[0-9]{4}$/.test(length) || parseInt(length, 10) !== code.length) return undefined;
+  return { code, instruction: text.substring(end + textMarker.length + markerLengthDigits) };
+}
+
 /** Whether `message` is a combined challenge with an embedded flicker code. */
 export function hasEmbeddedFlickerCode(message: string): boolean {
-  return message.includes(codeMarker);
+  return splitCombined(message) !== undefined;
 }
 
 /** The instruction text of a combined challenge; `message` itself if it is none. */
 export function challengeInstruction(message: string): string {
-  const start = message.indexOf(textMarker);
-  if (start < 0) return message;
-  const textStart = start + textMarker.length + markerLengthDigits;
-  return textStart < message.length ? message.substring(textStart) : '';
+  return splitCombined(message)?.instruction ?? message;
 }
 
 /**
  * Digit counts of the challenge length (LC) and of the data element lengths (LDE) to try when parsing.
  *
- * HHD 1.4 states the LC with three digits, HHD 1.3 with two.
+ * HHD 1.4 states the LC with three digits, HHD 1.3 with two. Some banks state the LDE of HHD 1.4 with three digits;
+ * a code that both LDE widths read is taken with two, as the specification has it.
  */
 const layouts = [
   { lcDigits: 3, lengthDigits: 2 },
@@ -34,6 +48,15 @@ const layouts = [
   { lcDigits: 2, lengthDigits: 2 },
 ];
 
+/** The most bytes a length field states: HHD 1.3 flags ASCII data in bit 4 of it, HHD 1.4 in bit 6. */
+const maxElementLength: Readonly<Record<HhdVersion, number>> = { hhd13: 0x0f, hhd14: 0x3f };
+
+/** The most bytes of a rendered code, which its one-byte length (LC) states. */
+const maxCodeLength = 0xff;
+
+/** The characters a TAN generator shows; one byte each. */
+const printableAscii = /^[\x20-\x7E]*$/;
+
 function hex(value: number, width: number): string {
   return value.toString(16).toUpperCase().padStart(width, '0');
 }
@@ -49,12 +72,17 @@ export class FlickerCode {
     private readonly dataElements: readonly DataElement[],
   ) {}
 
-  /** Parses the challenge data sent by the bank; throws `FormatError` if it is not a flicker code. */
+  /**
+   * Parses the challenge data sent by the bank, the code itself or a combined challenge, which embeds it in the
+   * challenge text (`CHLGUC`), wrapped into lines; throws `FormatError` if it is not a flicker code a TAN generator can
+   * take: one with characters after the length it states, an empty data element, data other than printable ASCII, or
+   * more data than its length fields can state, such as more than 15 bytes in an element in HHD 1.3 or 255 bytes in all.
+   */
   static parse(code: string): FlickerCode {
-    const cleaned = extractCode(code);
+    const embedded = splitCombined(code)?.code ?? trimBlanks(code);
     for (const layout of layouts) {
       try {
-        return FlickerCode.parseLayout(new Reader(cleaned), layout.lcDigits, layout.lengthDigits);
+        return FlickerCode.parseLayout(new Reader(embedded), layout.lcDigits, layout.lengthDigits);
       } catch (error) {
         // Not this layout; try the next one.
         if (!(error instanceof FormatError)) throw error;
@@ -82,19 +110,28 @@ export class FlickerCode {
     const controlBytes: number[] = [];
     if ((startLength & 0x80) !== 0) {
       do {
+        if (controlBytes.length === 10) throw new FormatError('Too many control bytes in flicker code');
         controlBytes.push(challenge.hex(2));
-      } while ((controlBytes.at(-1)! & 0x80) !== 0 && controlBytes.length < 10);
+      } while ((controlBytes.at(-1)! & 0x80) !== 0);
     }
-    const startCode = new StartCode(challenge.take(startLength & 0x3f), controlBytes);
+    const startCode = new StartCode(challenge.take(elementLength(startLength & 0x7f)), controlBytes);
     const dataElements: DataElement[] = [];
     for (let i = 0; i < 3; i++) {
       dataElements.push(
-        new DataElement(challenge.isAtEnd ? undefined : challenge.take(challenge.decimal(lengthDigits) & 0x3f)),
+        new DataElement(challenge.isAtEnd ? undefined : challenge.take(elementLength(challenge.decimal(lengthDigits)))),
       );
     }
-    // The fields fill exactly the LC characters; a layout that reads them otherwise is the wrong one.
-    if (!challenge.isAtEnd) throw new FormatError('Flicker code fields do not match its length');
-    return new FlickerCode(controlBytes.length === 0 ? 'hhd13' : 'hhd14', lc, startCode, dataElements);
+    // Only a layout whose fields fill exactly the LC characters, which end the code, can be the right one.
+    if (!challenge.isAtEnd || !code.isAtEnd) throw new FormatError('Flicker code fields do not match its length');
+    const flicker = new FlickerCode(controlBytes.length === 0 ? 'hhd13' : 'hhd14', lc, startCode, dataElements);
+    if (!flicker.fitsTanGenerator) throw new FormatError('Flicker code data the TAN generator cannot take');
+    return flicker;
+  }
+
+  /** Whether the code renders as the bank sent it: its data printable ASCII, every length within its field. */
+  private get fitsTanGenerator(): boolean {
+    const elements = [this.startCode, ...this.dataElements];
+    return elements.every((element) => element.fits(this.version)) && this.payload().length <= 2 * maxCodeLength;
   }
 
   /** The data of the start code, which opens the challenge. */
@@ -161,15 +198,21 @@ export class FlickerCode {
     }
     return result;
   }
+
+  /** What Node.js's `util.inspect` and `console.log` show: the version, not the data, which may hold IBAN and amount. */
+  [inspectCustom](): string {
+    return `FlickerCode(${this.version})`;
+  }
 }
 
-/** The code of a combined challenge, or `code` itself without whitespace. */
-function extractCode(code: string): string {
-  const compact = withoutWhitespace(code);
-  const start = compact.indexOf(codeMarker);
-  const codeStart = start + codeMarker.length + markerLengthDigits;
-  const end = compact.indexOf(textMarker);
-  return start >= 0 && end >= codeStart ? compact.substring(codeStart, end) : compact;
+/**
+ * The length a field of the challenge states for the start code or a data element: 1 to 63 characters. The challenge
+ * leaves out an element without data and sets no flag in bit 6, which only the rendered code carries; bit 7 of the start
+ * code, which announces control bytes, is masked off before.
+ */
+function elementLength(length: number): number {
+  if (length === 0 || length > 0x3f) throw new FormatError('Invalid data element length');
+  return length;
 }
 
 function xorChecksum(payload: string): string {
@@ -233,6 +276,12 @@ class DataElement {
     return this.data === undefined || /^[0-9]+$/.test(this.data);
   }
 
+  /** Whether the data are printable ASCII, and no more bytes than the length field of `version` can state. */
+  fits(version: HhdVersion): boolean {
+    const d = this.data;
+    return d === undefined || (printableAscii.test(d) && this.renderData().length / 2 <= maxElementLength[version]);
+  }
+
   renderData(): string {
     const d = this.data;
     if (d === undefined) return '';

package/src/tan/tan-image.ts

@@ -1,6 +1,9 @@
 import { base64Encode, latin1Decode } from '../util/bytes.js';
+import { inspectCustom } from '../util/inspect.js';
+import { counted } from '../util/text.js';
 
-const imageMimeType = /^image\/[a-zA-Z0-9.+-]+$/;
+/** The formats of photoTAN and QR-TAN images: raster images, which unlike SVG cannot carry scripts. */
+const imageMimeTypes = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp', 'image/bmp']);
 
 /** An image challenge (photoTAN, QR-TAN) with its MIME type. */
 export class TanImage {
@@ -14,23 +17,29 @@ export class TanImage {
   /**
    * Reads the bank's image container: a two-byte length and the MIME type, then a two-byte length and the image.
    *
-   * `undefined` unless the MIME type is an image type and the container holds the whole image.
+   * `undefined` unless the MIME type, in any case, is that of a PNG, JPEG, GIF, WebP or BMP image, and the container
+   * holds the whole image, of at least one byte.
    */
   static tryParse(data: Uint8Array): TanImage | undefined {
     if (data.length < 4) return undefined;
     const mimeLength = (data[0]! << 8) | data[1]!;
     if (mimeLength === 0 || data.length < 2 + mimeLength + 2) return undefined;
-    const mime = latin1Decode(data.subarray(2, 2 + mimeLength));
-    if (!imageMimeType.test(mime)) return undefined;
+    const mime = latin1Decode(data.subarray(2, 2 + mimeLength)).toLowerCase();
+    if (!imageMimeTypes.has(mime)) return undefined;
     const offset = 2 + mimeLength;
     const imageLength = (data[offset]! << 8) | data[offset + 1]!;
     const start = offset + 2;
-    if (start + imageLength > data.length) return undefined;
+    if (imageLength === 0 || start + imageLength > data.length) return undefined;
     return new TanImage(mime, data.subarray(start, start + imageLength));
   }
 
-  /** The image as a `data:` URL, ready for the `src` of an `<img>`. */
+  /** The image as a `data:` URL, for the `src` of an `<img>` only: the bytes are the bank's, whatever their type says. */
   toDataUrl(): string {
     return `data:${this.mimeType};base64,${base64Encode(this.bytes)}`;
   }
+
+  /** What Node.js's `util.inspect` and `console.log` show: type and size, not the image, which shows the order. */
+  [inspectCustom](): string {
+    return `TanImage(${this.mimeType}, ${counted(this.bytes.length, 'byte')})`;
+  }
 }

package/src/tan/tan-models.ts

@@ -1,3 +1,5 @@
+import { copyDate } from '../util/dates.js';
+import { inspectCustom } from '../util/inspect.js';
 import { maskedId } from '../util/text.js';
 
 /** Whether a TAN method needs the name of a TAN medium. */
@@ -82,7 +84,10 @@ export class TanMethod {
   /** Whether approval happens in a separate app instead of entering a TAN. */
   readonly decoupled: boolean;
 
-  /** Most status requests the bank allows for a decoupled approval; 0 allows any number. */
+  /**
+   * Most status requests the bank allows for a decoupled approval, 0 for any number. The client sends 60 where the bank
+   * states none, and polls for 10 minutes at most.
+   */
   readonly decoupledMaxPolls: number | undefined;
 
   /** How long to wait before the first status request of a decoupled approval, in seconds. */
@@ -134,6 +139,11 @@ export class TanMethod {
   toString(): string {
     return `TanMethod(${this.securityFunction}, ${this.name})`;
   }
+
+  /** What Node.js's `util.inspect` and `console.log` show: `toString`, not the fields. */
+  [inspectCustom](): string {
+    return this.toString();
+  }
 }
 
 /** State of a TAN medium as reported by the bank. */
@@ -219,6 +229,7 @@ export class TanMedium {
   /** When the medium was activated. */
   readonly activatedOn: Date | undefined;
 
+  /** Takes copies of the dates of `init`: each medium has its own, which no other one shares. */
   constructor(init: TanMediumInit) {
     this.mediumClass = init.mediumClass;
     this.status = init.status;
@@ -228,10 +239,10 @@ export class TanMedium {
     this.cardSequenceNumber = init.cardSequenceNumber;
     this.mobileNumber = init.mobileNumber;
     this.mobileNumberMasked = init.mobileNumberMasked;
-    this.validFrom = init.validFrom;
-    this.validUntil = init.validUntil;
-    this.lastUsed = init.lastUsed;
-    this.activatedOn = init.activatedOn;
+    this.validFrom = copyDate(init.validFrom);
+    this.validUntil = copyDate(init.validUntil);
+    this.lastUsed = copyDate(init.lastUsed);
+    this.activatedOn = copyDate(init.activatedOn);
   }
 
   /** Whether the medium is the one in use. */
@@ -239,9 +250,17 @@ export class TanMedium {
     return this.status === 'active' || this.status === 'activeFollowUpCard';
   }
 
-  /** The name, or the last digits of the card number, so that logs and crash reports do not collect the number. */
+  /**
+   * The medium class, or the last digits of the card number, and the status: no name, which the user may have given the
+   * medium after themselves, such as `Max’s iPhone`, so that logs and crash reports collect neither.
+   */
   toString(): string {
-    const label = this.name ?? (this.cardNumber === undefined ? this.mediumClass : maskedId(this.cardNumber));
+    const label = this.cardNumber === undefined ? this.mediumClass : maskedId(this.cardNumber);
     return `TanMedium(${label}, ${this.status})`;
   }
+
+  /** What Node.js's `util.inspect` and `console.log` show: `toString`, not the fields. */
+  [inspectCustom](): string {
+    return this.toString();
+  }
 }

package/src/util/arguments.ts

@@ -0,0 +1,40 @@
+import { invalidArgument } from './errors.js';
+
+// Plain JavaScript passes arguments of types the declarations rule out, which the Dart package's types refuse. These
+// checks refuse them as well, with messages that leave out the value.
+
+/** `value`; throws `TypeError` unless it is a string. */
+export function requireString(value: unknown, name: string): string {
+  if (typeof value !== 'string') throw invalidArgument('Must be a string', name);
+  return value;
+}
+
+/** `value`, `undefined` for `null`; throws `TypeError` unless it is a string or neither. */
+export function optionalString(value: unknown, name: string): string | undefined {
+  return value === undefined || value === null ? undefined : requireString(value, name);
+}
+
+/** `value`, `undefined` for `null`; throws `TypeError` unless it is an integer or neither. */
+export function optionalInteger(value: unknown, name: string): number | undefined {
+  if (value === undefined || value === null) return undefined;
+  if (!Number.isInteger(value)) throw invalidArgument('Must be an integer', name);
+  return value as number;
+}
+
+/** `value`, `undefined` for `null`; throws `TypeError` unless it is a boolean or neither. */
+export function optionalBoolean(value: unknown, name: string): boolean | undefined {
+  if (value === undefined || value === null) return undefined;
+  if (typeof value !== 'boolean') throw invalidArgument('Must be a boolean', name);
+  return value;
+}
+
+/** `value`; throws `TypeError` unless it is a function. */
+export function requireFunction<F>(value: F, name: string): F {
+  if (typeof value !== 'function') throw invalidArgument('Must be a function', name);
+  return value;
+}
+
+/** `value`, `undefined` for `null`; throws `TypeError` unless it is a function or neither. */
+export function optionalFunction<F>(value: F | null | undefined, name: string): F | undefined {
+  return value === undefined || value === null ? undefined : requireFunction(value, name);
+}

package/src/util/async.ts

@@ -37,17 +37,18 @@ export class Deferred<T> {
  * A failing action does not stop the ones queued after it.
  */
 export class SerialExecutor {
-  private last: Promise<unknown> = Promise.resolve();
+  private last: Promise<void> = Promise.resolve();
 
-  /** Runs `action` once the actions submitted before have finished; the result is that of `action`. */
+  /**
+   * Runs `action` once the actions submitted before have finished; the result is that of `action`, which the executor
+   * does not keep.
+   */
   run<T>(action: () => Promise<T>): Promise<T> {
-    const result = this.last.then(action);
-    this.last = result.catch(() => undefined);
+    const result = this.last.then(() => action());
+    this.last = result.then(
+      () => undefined,
+      () => undefined,
+    );
     return result;
   }
 }
-
-/** Waits for `promise` and ignores its result, so that neither a value nor an error goes unhandled. */
-export function ignoreOutcome(promise: Promise<unknown>): void {
-  promise.catch(() => undefined);
-}

package/src/util/bytes.ts

@@ -16,16 +16,9 @@ export function concatBytes(parts: readonly Uint8Array[]): Uint8Array {
 /** Collects bytes, like a growing buffer. */
 export class BytesBuilder {
   private readonly parts: Uint8Array[] = [];
-  private size = 0;
-
-  get length(): number {
-    return this.size;
-  }
 
   add(bytes: Uint8Array | readonly number[]): void {
-    const part = bytes instanceof Uint8Array ? bytes : Uint8Array.from(bytes);
-    this.parts.push(part);
-    this.size += part.length;
+    this.parts.push(bytes instanceof Uint8Array ? bytes : Uint8Array.from(bytes));
   }
 
   addByte(byte: number): void {
@@ -35,7 +28,6 @@ export class BytesBuilder {
   takeBytes(): Uint8Array {
     const result = concatBytes(this.parts);
     this.parts.length = 0;
-    this.size = 0;
     return result;
   }
 }
@@ -49,24 +41,32 @@ export function latin1Encode(text: string): Uint8Array {
 
 /** The text of ISO 8859-1 `bytes`. */
 export function latin1Decode(bytes: Uint8Array): string {
+  return fromCharCodes(bytes);
+}
+
+/** The text of the UTF-16 code units `codes`. */
+export function fromCharCodes(codes: Uint8Array | Uint16Array): string {
   let text = '';
-  // In chunks, since a spread of a large array exceeds the argument limit of some engines.
-  for (let i = 0; i < bytes.length; i += 0x8000) {
-    text += String.fromCharCode(...bytes.subarray(i, i + 0x8000));
+  // In chunks, since a large array exceeds the argument limit of some engines. `apply` takes the array as it is, where a
+  // spread would iterate over it.
+  for (let i = 0; i < codes.length; i += 0x8000) {
+    text += Reflect.apply(String.fromCharCode, undefined, codes.subarray(i, i + 0x8000)) as string;
   }
   return text;
 }
 
 const utf8Encoder = new TextEncoder();
+const utf8Decoder = new TextDecoder('utf-8', { fatal: true });
+const lenientUtf8Decoder = new TextDecoder('utf-8');
 
 export function utf8Encode(text: string): Uint8Array {
   return utf8Encoder.encode(text);
 }
 
-/** Decodes UTF-8; throws `FormatError` for malformed data unless `allowMalformed`. */
+/** Decodes UTF-8, without a leading BOM; throws `FormatError` for malformed data unless `allowMalformed`. */
 export function utf8Decode(bytes: Uint8Array, allowMalformed = false): string {
   try {
-    return new TextDecoder('utf-8', { fatal: !allowMalformed, ignoreBOM: true }).decode(bytes);
+    return (allowMalformed ? lenientUtf8Decoder : utf8Decoder).decode(bytes);
   } catch {
     throw new FormatError('Invalid UTF-8');
   }
@@ -127,9 +127,3 @@ export function base64Decode(text: string): Uint8Array {
   }
   return out;
 }
-
-export function bytesEqual(a: Uint8Array, b: Uint8Array): boolean {
-  if (a.length !== b.length) return false;
-  for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
-  return true;
-}

package/src/util/call-context.ts

@@ -7,8 +7,9 @@ interface AsyncStorage<T> {
 type AsyncStorageConstructor = new <T>() => AsyncStorage<T>;
 
 /**
- * `AsyncLocalStorage` where the runtime has it (Node.js, Deno, Bun), found without importing `node:async_hooks`, so that
- * bundlers for the browser have nothing to resolve.
+ * `AsyncLocalStorage` where the runtime has it, found through `process.getBuiltinModule` (Node.js 22.3, Deno 2.1 and
+ * Bun 1.2.6 or later) rather than by importing `node:async_hooks`, so that bundlers for the browser have nothing to
+ * resolve.
  */
 const AsyncStorageClass: AsyncStorageConstructor | undefined = (() => {
   const runtime = globalThis as {

package/src/util/dates.ts

@@ -1,6 +1,7 @@
 // A value is either a calendar date, a local `Date` at midnight of which only the day counts, or the exact moment of a
-// date with a time of day, which the bank states in German time (see `germanTime`). The parsers keep the two apart: a
-// date without a valid time of day is not a moment.
+// date with a time of day, which the bank states in German time (see `germanTime`) unless it gives the UTC offset. The
+// parsers keep the two apart: a date without a valid time of day is not a moment. A time of day runs from 00:00:00 to
+// 23:59:59, and 24:00:00, which ISO 8601 and XML Schema allow for the end of a day, is midnight of the next.
 
 const hourMs = 3_600_000;
 
@@ -30,7 +31,11 @@ export function formatIsoDate(d: Date): string {
 const fintsDate = /^(\d{4})(\d{2})(\d{2})$/;
 const fintsTime = /^(\d{2})(\d{2})(\d{2})/;
 const isoDate = /^(\d{4})-(\d{2})-(\d{2})/;
-const isoTime = /^(\d{2}):(\d{2}):(\d{2})/;
+// The time of an XML Schema `dateTime`, whose UTC offset lies between -14:00 and +14:00.
+const isoTime = /^(\d{2}):(\d{2}):(\d{2})(\.\d+)?(Z|[+-](?:(?:0\d|1[0-3]):[0-5]\d|14:00))?$/;
+
+/** A date and time of day as a clock shows them, the month counted from 1. */
+type Clock = [year: number, month: number, day: number, hour: number, minute: number, second: number];
 
 /** Parses a FinTS 3.0 date `YYYYMMDD` as a calendar date; `undefined` if it is missing or invalid. */
 export function parseFintsDate(date: string | undefined): Date | undefined {
@@ -42,34 +47,64 @@ export function parseFintsDate(date: string | undefined): Date | undefined {
  * invalid.
  */
 export function parseFintsDateTime(date: string | undefined, time: string | undefined): Date | undefined {
-  return moment(parseDate(fintsDate, date), fintsTime, time);
+  const clock = clockOn(parseDate(fintsDate, date), match(fintsTime, time));
+  return clock && germanTime(...clock);
 }
 
 /**
- * Parses an ISO 8601 date `YYYY-MM-DD` as a calendar date, ignoring extra characters such as a time part; `undefined`
- * if it is missing or invalid.
+ * Parses an ISO 8601 date `YYYY-MM-DD` as a calendar date, ignoring what follows it, such as a time zone; `undefined`
+ * if it is missing or invalid. A `T` right after the date makes it a date and time, which must be one `parseIsoMoment`
+ * reads, and the date the day in Germany at that moment: for a time in UTC late in the evening, the next day.
  */
 export function parseIsoDate(date: string | undefined): Date | undefined {
-  return parseDate(isoDate, date);
+  if (date?.charAt(10) !== 'T') return parseDate(isoDate, date);
+  const moment = parseIsoMoment(date);
+  return moment && germanDay(moment);
+}
+
+/**
+ * Parses an ISO 8601 date and time as XML Schema writes it, `YYYY-MM-DDThh:mm:ss` with optional fractional seconds and
+ * UTC offset (`Z` or `±hh:mm` up to ±14:00), as the moment it names, to the second: in German time where it states no
+ * offset. `undefined` if it is invalid.
+ */
+function parseIsoMoment(dateTime: string): Date | undefined {
+  const t = isoTime.exec(dateTime.slice(11));
+  const clock = clockOn(parseDate(isoDate, dateTime), t);
+  if (clock === undefined) return undefined;
+  const zone = t?.[5];
+  return zone === undefined ? germanTime(...clock) : new Date(utc(...clock) - offsetMs(zone));
+}
+
+/** The UTC offset `Z` or `±hh:mm` in milliseconds. */
+function offsetMs(zone: string): number {
+  if (zone === 'Z') return 0;
+  const ms = (Number(zone.slice(1, 3)) * 60 + Number(zone.slice(4))) * 60_000;
+  return zone.startsWith('-') ? -ms : ms;
 }
 
-/** Parses an ISO 8601 date `YYYY-MM-DD` and time `HH:MM:SS` as the moment they name. */
-export function parseIsoDateTime(date: string | undefined, time: string | undefined): Date | undefined {
-  return moment(parseDate(isoDate, date), isoTime, time);
+function match(pattern: RegExp, text: string | undefined): RegExpExecArray | null {
+  return text === undefined ? null : pattern.exec(text);
 }
 
 function parseDate(pattern: RegExp, date: string | undefined): Date | undefined {
-  const d = date === undefined ? null : pattern.exec(date);
+  const d = match(pattern, date);
   return d ? validDate(Number(d[1]), Number(d[2]), Number(d[3])) : undefined;
 }
 
-/** The moment of the German time matched by `timePattern` in `time` on `day`. */
-function moment(day: Date | undefined, timePattern: RegExp, time: string | undefined): Date | undefined {
-  const t = time === undefined ? null : timePattern.exec(time);
+/**
+ * The time of day `t` on `day`, where `t` matched hour, minute and second, and maybe a fraction of a second after them;
+ * `undefined` if either is missing or the time is invalid.
+ */
+function clockOn(day: Date | undefined, t: RegExpExecArray | null): Clock | undefined {
   if (day === undefined || !t) return undefined;
   const [hour, minute, second] = [Number(t[1]), Number(t[2]), Number(t[3])];
+  // The fraction counts only here: 24:00:00.5 lies past the end of the day.
+  if (hour === 24 && minute === 0 && second === 0 && !/[1-9]/.test(t[4] ?? '')) {
+    const next = localDate(day.getFullYear(), day.getMonth() + 1, day.getDate() + 1);
+    return [next.getFullYear(), next.getMonth() + 1, next.getDate(), 0, 0, 0];
+  }
   if (hour > 23 || minute > 59 || second > 59) return undefined;
-  return germanTime(day.getFullYear(), day.getMonth() + 1, day.getDate(), hour, minute, second);
+  return [day.getFullYear(), day.getMonth() + 1, day.getDate(), hour, minute, second];
 }
 
 /**
@@ -78,12 +113,8 @@ function moment(day: Date | undefined, timePattern: RegExp, time: string | undef
  * fewer than six digits lost its leading zeros as a JSON number.
  */
 export function parseUtcPlusOneDateTime(date: string | undefined, time: string | undefined): Date | undefined {
-  const day = parseDate(fintsDate, date);
-  const t = time === undefined ? null : fintsTime.exec(time.padStart(6, '0'));
-  if (day === undefined || !t) return undefined;
-  const [hour, minute, second] = [Number(t[1]), Number(t[2]), Number(t[3])];
-  if (hour > 23 || minute > 59 || second > 59) return undefined;
-  return new Date(utc(day.getFullYear(), day.getMonth() + 1, day.getDate(), hour, minute, second) - hourMs);
+  const clock = clockOn(parseDate(fintsDate, date), match(fintsTime, time?.padStart(6, '0')));
+  return clock && new Date(utc(...clock) - hourMs);
 }
 
 /**
@@ -93,21 +124,14 @@ export function parseUtcPlusOneDateTime(date: string | undefined, time: string |
  * Sunday of October (the EU rule). The hour the clocks show twice in October counts as CEST; a time in the hour that is
  * skipped in March counts as CET.
  */
-export function germanTime(
-  year: number,
-  month: number,
-  day: number,
-  hour: number,
-  minute: number,
-  second: number,
-): Date {
+function germanTime(year: number, month: number, day: number, hour: number, minute: number, second: number): Date {
   const clock = utc(year, month, day, hour, minute, second);
   const summer = clock - 2 * hourMs;
   return new Date(isSummerTime(summer) ? summer : clock - hourMs);
 }
 
 /** The calendar day a German clock shows at `moment`, as a local `Date` at midnight like every calendar date. */
-export function germanDay(moment: Date): Date {
+function germanDay(moment: Date): Date {
   const utcMs = moment.getTime();
   const clock = new Date(utcMs + (isSummerTime(utcMs) ? 2 : 1) * hourMs);
   return localDate(clock.getUTCFullYear(), clock.getUTCMonth() + 1, clock.getUTCDate());
@@ -134,7 +158,7 @@ function utc(year: number, month: number, day: number, hour: number, minute: num
 }
 
 /** Local midnight of the day; `month` counts from 1, and years below 100 are not moved to 19xx. */
-export function localDate(year: number, month: number, day: number): Date {
+function localDate(year: number, month: number, day: number): Date {
   const d = new Date(0);
   d.setFullYear(year, month - 1, day);
   d.setHours(0, 0, 0, 0);
@@ -142,7 +166,7 @@ export function localDate(year: number, month: number, day: number): Date {
 }
 
 /** The date, or `undefined` if `month` or `day` is out of range; `Date` would roll it over into another date. */
-export function validDate(year: number, month: number, day: number): Date | undefined {
+function validDate(year: number, month: number, day: number): Date | undefined {
   if (month < 1 || month > 12 || day < 1 || day > daysInMonth(year, month)) return undefined;
   return localDate(year, month, day);
 }
@@ -170,11 +194,18 @@ export function parseSwiftDate(yymmdd: string): Date | undefined {
 }
 
 /** Number of days the `month` (1 to 12) of `year` has. */
-export function daysInMonth(year: number, month: number): number {
+function daysInMonth(year: number, month: number): number {
   if (month === 2) return (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0 ? 29 : 28;
   return [4, 6, 9, 11].includes(month) ? 30 : 31;
 }
 
+/** A copy of `d`, so that a model keeps dates of its own: a `Date` can be changed in place. */
+export function copyDate(d: Date): Date;
+export function copyDate(d: Date | undefined): Date | undefined;
+export function copyDate(d: Date | undefined): Date | undefined {
+  return d && new Date(d.getTime());
+}
+
 /** The calendar day `moment` falls on in local time, as a local `Date` at midnight. */
 export function calendarDay(moment: Date): Date {
   return localDate(moment.getFullYear(), moment.getMonth() + 1, moment.getDate());

package/src/util/errors.ts

@@ -1,13 +1,29 @@
-/** Data that do not have the expected format, such as a malformed MT940 line or amount. */
+/**
+ * Data that do not have the expected format, such as a malformed MT940 line or amount.
+ *
+ * The message leaves out `source`, which may hold account data, such as amounts, names and IBANs, so that logs and
+ * crash reports do not collect them. For the same reason `source` is a getter, not a field: `JSON.stringify` and
+ * Node.js's report of an uncaught error show an error's fields as they are.
+ */
 export class FormatError extends Error {
-  /** The part of the data that is malformed, where the parser can tell it. */
-  readonly source: string | undefined;
+  override name = 'FormatError';
+
+  readonly #source: string | undefined;
 
   constructor(message: string, source?: string) {
-    super(source === undefined ? message : `${message}: ${source}`);
-    this.name = 'FormatError';
-    this.source = source;
+    super(message);
+    this.#source = source;
   }
+
+  /** The part of the data that is malformed, where the parser can tell it. */
+  get source(): string | undefined {
+    return this.#source;
+  }
+}
+
+/** Throws a `FormatError`, where an expression is expected, such as `value ?? fail('…')`. */
+export function fail(message: string, source?: string): never {
+  throw new FormatError(message, source);
 }
 
 /** An argument the function cannot work with, such as an empty PIN. The message never contains a PIN. */