@coderoftime/fints 0.2.0 → 0.3.0

package/src/core/bank-info.ts

@@ -1,4 +1,9 @@
-/** General bank information from the bank parameter data (BPD). */
+import { inspectCustom } from '../util/inspect.js';
+
+/**
+ * General bank information from the bank parameter data (BPD). The maximum message size and the timeouts are
+ * `undefined` where the bank states none, or more than 9999, the four digits HIBPA allows.
+ */
 export class BankInfo {
   /** German bank code (BLZ). */
   readonly bankCode: string;
@@ -15,7 +20,7 @@ export class BankInfo {
   /** Languages the bank's messages come in, as codes the bank defines. */
   readonly languages: readonly string[];
 
-  /** Largest message in kilobytes (1024 bytes) the bank accepts; the client sends nothing larger. */
+  /** Largest message in kilobytes (1024 bytes) the bank accepts, `0` for no limit; the client sends nothing larger. */
   readonly maxMessageSize: number | undefined;
 
   /**
@@ -49,9 +54,19 @@ export class BankInfo {
     this.minTimeout = init.minTimeout;
     this.maxTimeout = init.maxTimeout;
   }
+
+  /** What Node.js's `util.inspect` and `console.log` show: the bank code and the version of the parameter data. */
+  [inspectCustom](): string {
+    return `BankInfo(${this.bankCode}, BPD version ${this.bpdVersion})`;
+  }
 }
 
-/** Free-text message sent by the bank during login. */
+/**
+ * Free-text message sent by the bank during login.
+ *
+ * Subject and text are the bank's, of any length: show them as text only, never as HTML (`innerHTML`, `v-html`), since
+ * they are no markup to trust.
+ */
 export class BankMessage {
   constructor(
     /** What the message is about. */
@@ -60,7 +75,16 @@ export class BankMessage {
     readonly text: string,
   ) {}
 
+  /**
+   * Neither subject nor text, which may address the user, so that logs and crash reports do not collect them; show
+   * `subject` and `text` to the user.
+   */
   toString(): string {
-    return `${this.subject}: ${this.text}`;
+    return 'BankMessage(…)';
+  }
+
+  /** What Node.js's `util.inspect` and `console.log` show: `toString`, not the fields. */
+  [inspectCustom](): string {
+    return this.toString();
   }
 }

package/src/core/client.ts

@@ -26,6 +26,11 @@ export type WarningHandler = (warning: FinTsFeedback) => void;
  * An error thrown by a callback that only informs the app (`onBankMessage`, `onWarning`, `logger`) fails the call once
  * the call's exchange with the bank is over, so that it cannot break off a dialog half-way; an error of the call itself
  * takes precedence.
+ *
+ * The client reads the options once, when it is built: changing them later changes nothing. Its constructor throws
+ * `TypeError` for a `tanCallback` that is no function, another callback that is neither a function nor `undefined` or
+ * `null`, which mean none, a `state` that is neither a string nor either of these, and a `transport` without the
+ * functions `post` and `close`.
  */
 export interface FinTsClientOptions {
   /** Called whenever the bank asks for a TAN or an app approval. */
@@ -37,12 +42,17 @@ export interface FinTsClientOptions {
   /** Picks the TAN medium when the method needs one and the user has several; the first is used without it. */
   tanMediumSelector?: TanMediumSelector;
 
-  /** Receives the free-text messages the bank sends during login. */
+  /**
+   * Receives the free-text messages the bank sends during login. How many there are and how long they are is the
+   * bank's choice, without a limit, so bound what the app shows of them; show their text as text, never as markup.
+   */
   onBankMessage?: BankMessageHandler;
 
   /**
    * Receives the bank's warnings, such as 3951 (switch to another TAN method), but not those the client acts on itself,
-   * such as 3040 (more data follow). Show them to the user with code and text, as the specification asks.
+   * such as 3040 (more data follow). Show them to the user with code and text, as the specification asks. How many
+   * there are and how long they are is the bank's choice, without a limit, so bound what the app shows of them; show
+   * their text as text, never as markup.
    */
   onWarning?: WarningHandler;
 
@@ -58,7 +68,8 @@ export interface FinTsClientOptions {
    * refused login the other client saved.
    *
    * A state saved for another user or bank is ignored, and of one saved for another server of the bank, such as before
-   * the bank moved its FinTS URL, only the refused login holds.
+   * the bank moved its FinTS URL, or for FinTS 4.1 by the Dart package, only the refused login and the count of logins
+   * whose answer was lost hold.
    */
   state?: string | undefined;
 
@@ -97,10 +108,13 @@ export interface TransactionQuery {
 export interface FinTsClient {
   /**
    * Serialized session data: bank and user parameters, customer system ID, the TAN methods the user may use, the chosen
-   * TAN method and medium, the SEPA account list, and a refused login (`loginRefusal`).
+   * TAN method and medium, the SEPA account list, and a refused login (`loginRefusal`) with the count of logins whose
+   * answer was lost.
    *
-   * Contains no PIN or TAN, but account details, so store it encrypted. It holds what this client knows, and replaces
-   * the state it was restored from: one client at a time per state (`FinTsClientOptions.state`).
+   * Contains no PIN or TAN, but the user ID and customer ID, the customer system ID, the account holders' names and
+   * account details, and after a refused login the texts and parameters of the bank's return codes as the bank sent
+   * them, which for return code 3072 are the new login data; so store it encrypted. It holds what this client knows,
+   * and replaces the state it was restored from: one client at a time per state (`FinTsClientOptions.state`).
    */
   readonly state: string;
 
@@ -113,14 +127,19 @@ export interface FinTsClient {
   /** Security function code of the TAN method in use, for example `942`; `undefined` before the first login. */
   readonly selectedTanMethod: string | undefined;
 
-  /** Name of the TAN medium sent to the bank, if the method needs one. */
+  /**
+   * Name of the TAN medium in use, if the method needs one, as the app passed it or the bank listed it; one the app
+   * passed goes out without blanks at either end.
+   */
   readonly selectedTanMedium: string | undefined;
 
   /**
    * Switches to another TAN method, and optionally TAN medium, for the following calls.
    *
    * Ends the current dialog, so the next call logs in again with the new method. If the bank does not offer
-   * `securityFunction`, the client picks another method at that login.
+   * `securityFunction`, the client picks another method at that login. Without `tanMedium`, also for `null`, that login
+   * looks the TAN media up where the method needs one. Rejects with `TypeError`, before it ends the dialog, for a
+   * `securityFunction` or `tanMedium` that is no string.
    */
   selectTanMethod(securityFunction: string, tanMedium?: string): Promise<void>;
 
@@ -158,7 +177,8 @@ export interface FinTsClient {
    * comes from there without a query; `Balance.bookedAsOf` tells the day it states.
    *
    * Rejects with `FinTsUnsupportedError` where the parameter data rule the query out, without sending it; the login,
-   * which delivers them, may have gone out.
+   * which delivers them, may have gone out. Rejects with `TypeError`, before it waits for other calls, for an `account`
+   * that is no `Account`, such as one written to JSON and read back.
    */
   getBalance(account: Account): Promise<Balance>;
 
@@ -168,8 +188,9 @@ export interface FinTsClient {
    *
    * Only the local calendar day counts, and a day in the future counts as today. Banks typically ask for a TAN when
    * `from` is more than 90 days ago; see also `Account.dataStatus`. Rejects with `TypeError`, before it waits for other
-   * calls, if `from` or `to` is no valid `Date` or `from` lies on a day after `to`, and with `FinTsUnsupportedError`,
-   * without sending the query, where the parameter data rule it out; the login may have gone out.
+   * calls, if `account` is no `Account`, `from` or `to` is no valid `Date`, `from` lies on a day after `to` or `format`
+   * is no `TransactionFormat`, and with `FinTsUnsupportedError`, without sending the query, where the parameter data
+   * rule it out; the login may have gone out.
    */
   getTransactions(account: Account, query?: TransactionQuery): Promise<Transaction[]>;
 
@@ -177,10 +198,16 @@ export interface FinTsClient {
    * Ends the bank dialog, releases the connection and forgets the PIN.
    *
    * A running call stops at its next step, also while it waits for a TAN, an app approval or a selection, and fails with
-   * `FinTsStateError`, as do all later calls. A request already on its way is aborted where the transport supports it,
-   * as `HttpTransport` does: the call fails with `FinTsTransportError` then, as after a broken connection, and an aborted
-   * login counts as one whose answer was lost. Another transport is awaited, at most for its timeout; after the
-   * request, the call sends nothing but the end of its dialogs.
+   * `FinTsStateError`, as do all later calls. A request already on its way has five seconds to bring its answer, which
+   * counts as any other: the logger gets it, and the client keeps what it brings, such as the parameter data or the
+   * customer system ID. The call fails with `FinTsStateError` all the same, also where that answer completes it, unless
+   * the answer brings an error, such as a rejected PIN, which the call fails with instead. After those five seconds the
+   * client stops waiting for the request, whatever the transport, and aborts it where the transport supports that, as
+   * `HttpTransport` does: the call fails with `FinTsTransportError` then, as after a broken connection, and an aborted
+   * login counts as one whose answer was lost. After the request, the call sends nothing but the end of its
+   * dialogs, that of an aborted message included, unless the message opened it. These dialog ends have five seconds
+   * once that request, if any, is over: then they are aborted the same way, and none goes out later, so that a bank
+   * that has stopped answering holds up neither `close` nor the call for longer.
    */
   close(): Promise<void>;
 }

package/src/core/config.ts

@@ -1,5 +1,7 @@
+import { optionalBoolean, optionalString, requireString } from '../util/arguments.js';
 import { invalidArgument } from '../util/errors.js';
-import { isLatin1 } from '../util/text.js';
+import { inspectCustom } from '../util/inspect.js';
+import { isLatin1, trimBlanks } from '../util/text.js';
 
 /**
  * The country code FinTS gives Germany, where FinTS banks are: the ISO 3166 code of the Federal Republic before 1990,
@@ -7,8 +9,12 @@ import { isLatin1 } from '../util/text.js';
  */
 export const defaultCountryCode = '280';
 
-/** Longest bank code (Kreditinstitutscode), product ID (Produktbezeichnung) and product version FinTS 3.0 takes. */
+/**
+ * Longest bank code (Kreditinstitutscode), user or customer ID (data type `id`), product ID (Produktbezeichnung) and
+ * product version FinTS 3.0 takes.
+ */
 const maxBankCodeLength = 30;
+const maxIdLength = 30;
 const maxProductIdLength = 25;
 const maxProductVersionLength = 5;
 
@@ -18,9 +24,9 @@ export interface FinTsConfigInit {
   url: string | URL;
   /** Bank code: for a German bank its BLZ, eight digits. */
   bankCode: string;
-  /** Login name (Benutzerkennung / Legitimations-ID). */
+  /** Login name (Benutzerkennung / Legitimations-ID); at most 30 characters. */
   userId: string;
-  /** Customer ID; defaults to `userId`. */
+  /** Customer ID, at most 30 characters; defaults to `userId`. */
   customerId?: string | undefined;
   /** FinTS product registration number from the Deutsche Kreditwirtschaft; at most 25 characters. */
   productId: string;
@@ -31,12 +37,15 @@ export interface FinTsConfigInit {
   /**
    * Allows plain http for the loopback addresses `localhost`, `127.x.x.x` and `::1`, for tests against a local server.
    *
-   * Any other host must use https, whatever this says: the PIN travels with every message.
+   * Any other host must use https, whatever this says: the PIN travels with every message. The default `HttpTransport`
+   * sends plain http wherever the global `fetch` sends it, though, as it sends https: a replacement of that `fetch` and
+   * a global dispatcher get the PIN, and a proxy that `fetch` takes from the environment sees it unencrypted. See
+   * `HttpTransport`.
    */
   allowInsecureUrl?: boolean;
 }
 
-/** Connection and login data for one bank user. */
+/** Connection and login data for one bank user; frozen, so that the client sends what the constructor has checked. */
 export class FinTsConfig {
   /** The country code FinTS gives Germany, where FinTS banks are: `280`, not today's ISO 3166 code `276`. */
   static readonly defaultCountryCode = defaultCountryCode;
@@ -54,9 +63,11 @@ export class FinTsConfig {
    * Throws `TypeError` if `url` is not a valid URL, has no host, holds a user name or password, or is not https, unless
    * `allowInsecureUrl` is set and `url` is a loopback address. Throws as well where the bank would refuse the login: for
    * a login or product detail that is empty, has characters FinTS 3.0 cannot send (it uses ISO 8859-1, so `€` and most
-   * non-Latin letters are not possible) or is longer than its field (30 characters for the bank code, 25 for the
-   * product ID, 5 for its version), for a country code of other than three digits, and for a German bank code of other
-   * than eight. The message leaves out the value.
+   * non-Latin letters are not possible) or is longer than its field (30 characters for the bank code, the user ID and
+   * the customer ID, 25 for the product ID, 5 for its version), for a country code of other than three digits, and for
+   * a German bank code of other than eight. Throws as well for a detail of another type than `FinTsConfigInit` names,
+   * such as a number as `bankCode` or the string `'false'` as `allowInsecureUrl`; `null` counts as a detail not given.
+   * The message leaves out the value.
    *
    * Drops leading and trailing blanks of the login details and the product, as FinTS sends them without (Formals
    * B.4.1): `'alice '` is the user `alice`, also for a saved state.
@@ -73,7 +84,7 @@ export class FinTsConfig {
       throw invalidArgument('Not a valid URL', 'url');
     }
     this.href = url.href;
-    this.allowInsecureUrl = init.allowInsecureUrl ?? false;
+    this.allowInsecureUrl = optionalBoolean(init.allowInsecureUrl, 'allowInsecureUrl') ?? false;
     requireSecureUrl(url, this.allowInsecureUrl);
     this.countryCode = requireValue(init.countryCode ?? defaultCountryCode, 'countryCode');
     if (!/^\d{3}$/.test(this.countryCode)) {
@@ -83,10 +94,13 @@ export class FinTsConfig {
     if (this.countryCode === defaultCountryCode && !/^\d{8}$/.test(this.bankCode)) {
       throw invalidArgument('A German bank code (BLZ) has eight digits', 'bankCode');
     }
-    this.userId = requireValue(init.userId, 'userId');
-    this.explicitCustomerId = init.customerId === undefined ? undefined : requireValue(init.customerId, 'customerId');
+    this.userId = requireValue(init.userId, 'userId', maxIdLength);
+    const customerId = optionalString(init.customerId, 'customerId');
+    this.explicitCustomerId =
+      customerId === undefined ? undefined : requireValue(customerId, 'customerId', maxIdLength);
     this.productId = requireValue(init.productId, 'productId', maxProductIdLength);
     this.productVersion = requireValue(init.productVersion ?? '1.0', 'productVersion', maxProductVersionLength);
+    Object.freeze(this);
   }
 
   /**
@@ -101,14 +115,19 @@ export class FinTsConfig {
   get customerId(): string {
     return this.explicitCustomerId ?? this.userId;
   }
+
+  /** What Node.js's `util.inspect` and `console.log` show: the bank code, neither the login data nor the product ID. */
+  [inspectCustom](): string {
+    return `FinTsConfig(${this.bankCode})`;
+  }
 }
 
 /**
- * `value` without leading and trailing blanks; throws `TypeError` if nothing is left, or what is left is not sendable
- * (`requireLatin1`) or longer than `maxLength`: cut short, a value would be one the bank does not know.
+ * `value` without leading and trailing blanks; throws `TypeError` if it is no string, nothing is left, or what is left
+ * is not sendable (`requireLatin1`) or longer than `maxLength`: cut short, a value would be one the bank does not know.
  */
-function requireValue(value: string, name: string, maxLength = Number.POSITIVE_INFINITY): string {
-  const trimmed = value.trim();
+function requireValue(value: unknown, name: string, maxLength = Number.POSITIVE_INFINITY): string {
+  const trimmed = trimBlanks(requireString(value, name));
   if (trimmed === '') throw invalidArgument('Must not be empty', name);
   requireLatin1(trimmed, name);
   if (trimmed.length > maxLength) throw invalidArgument(`At most ${maxLength} characters in FinTS 3.0`, name);
@@ -148,8 +167,8 @@ function requireSecureUrl(url: URL, allowInsecure = false): void {
  * The message leaves out the value.
  */
 export function requirePin(pin: string): string {
-  if (pin.trim() === '') throw invalidArgument('The PIN is empty', 'pin');
-  if (pin.trim() !== pin) throw invalidArgument('The PIN begins or ends with a blank', 'pin');
+  if (trimBlanks(pin) === '') throw invalidArgument('The PIN is empty', 'pin');
+  if (trimBlanks(pin) !== pin) throw invalidArgument('The PIN begins or ends with a blank', 'pin');
   return requireLatin1(pin, 'pin');
 }
 

package/src/core/errors.ts

@@ -53,23 +53,37 @@ export class FinTsTanSetupError extends FinTsError {
   override name = 'FinTsTanSetupError';
 }
 
-/** The bank rejected the request; `feedback` holds all return codes. A refused login is a `FinTsLoginRefusedError`. */
+/**
+ * The bank rejected the request; `feedback` holds all return codes. A refused login is a `FinTsLoginRefusedError`.
+ *
+ * The message is not safe to log: by default it holds the code, text and parameters of each error the bank names, such
+ * as an IBAN or a login name, and so does `stack`. Log `codes` instead. `feedback` is a getter, not a field, so that
+ * `JSON.stringify` and Node.js's report of an uncaught error, which show an error's fields as they are, leave out at
+ * least the warnings and successes, such as the new login data of return code 3072.
+ */
 export class FinTsBankError extends FinTsError {
   override name = 'FinTsBankError';
 
-  /** All return codes of the response, warnings and successes included. */
-  readonly feedback: readonly FinTsFeedback[];
+  readonly #feedback: readonly FinTsFeedback[];
 
-  /** A rejection with the return codes in `feedback`; `message` defaults to the errors among them. */
+  /**
+   * A rejection with the return codes in `feedback`; `message` defaults to the errors among them, with the bank's texts
+   * and parameters, such as `9010: Konto gesperrt [DE89370400440532013000]`, so it is not safe to log.
+   */
   constructor(feedback: readonly FinTsFeedback[], message?: string) {
     super(
       message ??
         feedback
           .filter((f) => f.isError)
-          .map((f) => f.toString())
+          .map(withText)
           .join('; '),
     );
-    this.feedback = Object.freeze([...feedback]);
+    this.#feedback = Object.freeze([...feedback]);
+  }
+
+  /** All return codes of the response, warnings and successes included. */
+  get feedback(): readonly FinTsFeedback[] {
+    return this.#feedback;
   }
 
   /** The return codes of `feedback`. */
@@ -106,7 +120,8 @@ export class FinTsTanError extends FinTsBankError {
 }
 
 /**
- * The bank has changed the user's login data and expects the new ones from now on (return code 3072).
+ * The bank has changed the user's login data and expects the new ones from now on (return code 3072), also where it
+ * names an error next to them, but for a rejected PIN, which is a `FinTsPinError`.
  *
  * The client has ended the dialog, where the bank opened one, and logs in with the old data no more. Create a new
  * client with the new data; a `loginName` replaces user ID and customer ID: pass it as `userId`, without a customer ID.
@@ -214,6 +229,11 @@ function isPinError(f: FinTsFeedback): boolean {
   }
 }
 
+/** `f` with the bank's text and parameters, which `FinTsFeedback.toString` leaves out. */
+function withText(f: FinTsFeedback): string {
+  return `${f.code}: ${f.text}${f.parameters.length === 0 ? '' : ` [${f.parameters.join(', ')}]`}`;
+}
+
 /**
  * The most specific error for the errors in `feedback`, the answer to a message that `completesApproval` or not.
  *

package/src/core/feedback.ts

@@ -1,3 +1,5 @@
+import { inspectCustom } from '../util/inspect.js';
+
 /** A return code with text from the bank, for example `0020: Auftrag ausgeführt`. */
 export class FinTsFeedback {
   /** The four-digit return code; `0…` reports success, `3…` a warning and `9…` an error. */
@@ -37,8 +39,17 @@ export class FinTsFeedback {
     return this.code.startsWith('9');
   }
 
+  /**
+   * The code only, not the text and parameters, which may name the account or hold login data, such as those of return
+   * code 3072, so that logs and crash reports do not collect them; show `text` to the user.
+   */
   toString(): string {
-    return `${this.code}: ${this.text}${this.parameters.length === 0 ? '' : ` [${this.parameters.join(', ')}]`}`;
+    return `FinTsFeedback(${this.code})`;
+  }
+
+  /** What Node.js's `util.inspect` and `console.log` show: `toString`, not the fields. */
+  [inspectCustom](): string {
+    return this.toString();
   }
 }
 

package/src/core/transaction.ts

@@ -1,10 +1,18 @@
 import { copyDate, formatIsoDate } from '../util/dates.js';
+import { invalidArgument } from '../util/errors.js';
 import { ImmutableMap } from '../util/immutable-map.js';
+import { inspectCustom } from '../util/inspect.js';
 import type { Amount } from './amount.js';
 
 /** Whether a transaction is booked or still pending. */
 export type TransactionStatus = 'booked' | 'pending';
 
+/** `status`; throws `TypeError` unless it is a `TransactionStatus`. */
+export function requireStatus(status: unknown): TransactionStatus {
+  if (status === 'booked' || status === 'pending') return status;
+  throw invalidArgument("Must be 'booked' or 'pending'", 'status');
+}
+
 /** Transaction format to request; `auto` prefers camt.052 when the bank supports it. */
 export type TransactionFormat =
   /** camt.052 where the bank offers it, otherwise MT940. */
@@ -158,4 +166,9 @@ export class Transaction {
   toString(): string {
     return `Transaction(${formatIsoDate(this.bookingDate ?? this.valueDate)}, ${this.status}${this.isReversal ? ', reversal' : ''})`;
   }
+
+  /** What Node.js's `util.inspect` and `console.log` show: `toString`, not the fields. */
+  [inspectCustom](): string {
+    return this.toString();
+  }
 }

package/src/core/transport.ts

@@ -1,5 +1,5 @@
-import { concatBytes } from '../util/bytes.js';
 import { invalidArgument } from '../util/errors.js';
+import { trimBlanks } from '../util/text.js';
 import { FinTsTransportError } from './errors.js';
 
 /** Sends one FinTS message and returns the bank's reply; replace it for a relay, proxies, pinning or tests. */
@@ -7,14 +7,20 @@ export interface FinTsTransport {
   /**
    * Posts `body` to `url` and returns the response body.
    *
-   * The client aborts `signal` once it is closed: a transport that stops the request then keeps `close` from waiting
-   * for the answer.
+   * Once the client is closed, it aborts `signal` five seconds later, and that of the dialog ends it then sends five
+   * seconds after the request on its way, if any, is over: the client no longer waits for the answer then, and the
+   * transport should stop the request, since the dialog end may go out while it still runs.
+   *
+   * The client bounds neither the time of the exchange nor the size of the answer: do so in the transport, as
+   * `HttpTransport` does, so that a server that stops answering cannot hold up a call and one that sends without end
+   * cannot exhaust the memory.
    *
    * Implementations report failures as `FinTsTransportError`, with the HTTP status as `statusCode` where the bank
    * answered with an HTTP error: an anonymous request for the bank parameter data that fails so goes out once more,
    * without the announcement of strong authentication, which some banks fail on. Of any other error, another
-   * `FinTsError` included, the client keeps only its message and that of its cause, as a `FinTsTransportError` without
-   * `statusCode`. `body` holds PIN and TAN in plain text: keep it out of error messages and logs.
+   * `FinTsError` included, the client keeps only its message and the reason its cause gives (its message, or else the
+   * messages of its errors or its code), as a `FinTsTransportError` without `statusCode`. `body` holds PIN and TAN in
+   * plain text: keep it out of error messages and logs.
    */
   post(url: URL, body: Uint8Array, contentType: string, signal: AbortSignal): Promise<Uint8Array>;
 
@@ -25,7 +31,8 @@ export interface FinTsTransport {
 /** What `HttpTransport` takes; all optional. */
 export interface HttpTransportOptions {
   /**
-   * The `fetch` to send with, for example one with a proxy agent; the global `fetch` by default.
+   * The `fetch` to send with, for example one with a proxy agent; the global `fetch` by default, as it is at each
+   * request.
    *
    * It must post to the URL it is given: an answer from another URL counts as a redirect, which fails the request. Of
    * an answer whose `body` is no `ReadableStream`, as with node-fetch, the size can only be checked once it is read
@@ -47,6 +54,14 @@ const maxTimeoutMs = 2 ** 31 - 1;
 /**
  * Default `FinTsTransport`: HTTP POST with `fetch`.
  *
+ * Without the `fetch` option it sends with the global `fetch` as it is at each request, and cannot bypass what that
+ * does, for plain http to a local server (`FinTsConfig.allowInsecureUrl`) as for https: whatever replaces that `fetch`
+ * or handles its requests, such as a test's stub of `globalThis.fetch` or on Node.js a global dispatcher (undici's
+ * `setGlobalDispatcher`), gets every message, PIN and TAN included, and a proxy that the runtime takes from the
+ * environment, as Node.js does with `NODE_USE_ENV_PROXY=1`, and Deno and Bun do from `HTTP_PROXY`, sees the PIN of
+ * plain http unencrypted. Exempt the host with `NO_PROXY`, such as `localhost,127.0.0.1,::1`, or pass a `fetch` that
+ * connects directly.
+ *
  * In a browser it only reaches servers that allow the page's origin (CORS), which bank servers do not: a web app needs
  * a server of its own between browser and bank, reached with a `FinTsTransport` of its own.
  */
@@ -106,6 +121,10 @@ export class HttpTransport implements FinTsTransport {
       headers: { 'Content-Type': contentType, 'Cache-Control': 'no-cache', Pragma: 'no-cache' },
       // The PIN travels in the body: never let the request be repeated at another address.
       redirect: 'manual',
+      // In a browser: no cookies of the page and no referrer go with the PIN, and no cache keeps the exchange.
+      credentials: 'omit',
+      referrerPolicy: 'no-referrer',
+      cache: 'no-store',
       signal,
     });
     if (response.type === 'opaqueredirect') {
@@ -118,10 +137,15 @@ export class HttpTransport implements FinTsTransport {
     }
     if (response.status < 200 || response.status > 299) {
       await discard(response);
-      throw new FinTsTransportError(`HTTP ${response.status} ${response.statusText}`.trim(), {
+      throw new FinTsTransportError(trimBlanks(`HTTP ${response.status} ${response.statusText}`), {
         statusCode: response.status,
       });
     }
+    const announced = response.headers.get('Content-Length');
+    if (announced !== null && /^\d+$/.test(announced) && Number(announced) > this.maxResponseBytes) {
+      await discard(response);
+      throw this.tooLarge();
+    }
     return this.readBody(response);
   }
 
@@ -134,19 +158,27 @@ export class HttpTransport implements FinTsTransport {
       return bytes;
     }
     const reader = body.getReader();
-    const chunks: Uint8Array[] = [];
+    // Copied as they arrive: many tiny chunks kept as they are would take many times the bytes they hold, and a `fetch`
+    // may refill the chunk it handed out.
+    let bytes = new Uint8Array(0);
     let size = 0;
     for (;;) {
       const { done, value } = await reader.read();
       if (done) break;
-      chunks.push(value);
-      size += value.length;
-      if (size > this.maxResponseBytes) {
+      const end = size + value.length;
+      if (end > this.maxResponseBytes) {
         await reader.cancel().catch(() => undefined);
         throw this.tooLarge();
       }
+      if (end > bytes.length) {
+        const grown = new Uint8Array(Math.min(Math.max(2 * bytes.length, end), this.maxResponseBytes));
+        grown.set(bytes.subarray(0, size));
+        bytes = grown;
+      }
+      bytes.set(value, size);
+      size = end;
     }
-    return concatBytes(chunks);
+    return bytes.slice(0, size);
   }
 
   private tooLarge(): FinTsTransportError {
@@ -179,11 +211,25 @@ function isPositive(value: number): boolean {
 }
 
 /**
- * The message of a failed request, with the message of its cause: Node.js reports `fetch failed` and the reason in the
- * cause. Only the messages, since the error may hold the request, PIN and TAN included.
+ * The message of a failed request, with the reason its cause gives: Node.js reports `fetch failed` and the reason in the
+ * cause. Only messages and codes, since the error may hold the request, PIN and TAN included.
  */
 export function failureMessage(error: unknown): string {
   if (!(error instanceof Error)) return String(error);
-  const cause: unknown = error.cause;
-  return cause instanceof Error ? `${error.message}: ${cause.message}` : error.message;
+  const reason = error.cause instanceof Error ? reasonOf(error.cause) : '';
+  return reason ? `${error.message}: ${reason}` : error.message;
+}
+
+/**
+ * The message of `cause`, or where it has none, the distinct messages of its `errors` or its `code`: Node.js reports a
+ * failed connection to a host with IPv6 and IPv4 addresses as an `AggregateError` without a message.
+ */
+function reasonOf(cause: Error): string {
+  if (cause.message) return cause.message;
+  if (cause instanceof AggregateError) {
+    const messages = cause.errors.flatMap((error) => (error instanceof Error && error.message ? [error.message] : []));
+    if (messages.length > 0) return [...new Set(messages)].join('; ');
+  }
+  const code: unknown = (cause as { code?: unknown }).code;
+  return typeof code === 'string' ? code : '';
 }