@coderoftime/fints 0.2.0 → 0.3.0

package/src/util/immutable-map.ts

@@ -1,47 +1,50 @@
-/** A map that cannot be changed, also not at runtime: it has no `set`, `delete` or `clear`. */
+/**
+ * A map that cannot be changed, also not at runtime: it has no `set`, `delete` or `clear`, and no other code reaches
+ * the map that holds its entries.
+ */
 export class ImmutableMap<K, V> implements ReadonlyMap<K, V> {
-  private readonly map: Map<K, V>;
+  readonly #map: Map<K, V>;
 
   constructor(entries?: Iterable<readonly [K, V]>) {
-    this.map = new Map(entries);
+    this.#map = new Map(entries);
   }
 
   get size(): number {
-    return this.map.size;
+    return this.#map.size;
   }
 
   get(key: K): V | undefined {
-    return this.map.get(key);
+    return this.#map.get(key);
   }
 
   has(key: K): boolean {
-    return this.map.has(key);
+    return this.#map.has(key);
   }
 
   forEach(callback: (value: V, key: K, map: ReadonlyMap<K, V>) => void): void {
-    this.map.forEach((value, key) => {
+    this.#map.forEach((value, key) => {
       callback(value, key, this);
     });
   }
 
   entries(): MapIterator<[K, V]> {
-    return this.map.entries();
+    return this.#map.entries();
   }
 
   keys(): MapIterator<K> {
-    return this.map.keys();
+    return this.#map.keys();
   }
 
   values(): MapIterator<V> {
-    return this.map.values();
+    return this.#map.values();
   }
 
   [Symbol.iterator](): MapIterator<[K, V]> {
-    return this.map.entries();
+    return this.#map.entries();
   }
 
   /** A plain object of the entries, for JSON and for display. */
   toJSON(): Record<string, V> {
-    return Object.fromEntries([...this.map].map(([key, value]) => [String(key), value]));
+    return Object.fromEntries([...this.#map].map(([key, value]) => [String(key), value]));
   }
 }

package/src/util/inspect.ts

@@ -0,0 +1,14 @@
+/**
+ * The key of the method by which Node.js's `util.inspect`, and so `console.log`, shows an object, as do Deno and Bun:
+ * its registered name, so that no Node.js import is needed.
+ */
+export const inspectCustom = Symbol.for('nodejs.util.inspect.custom');
+
+/**
+ * `value` frozen, with `show` as what `util.inspect` shows of it instead of its fields. The method is no enumerable
+ * property, so that `JSON.stringify`, `structuredClone` and comparisons in tests see the same plain object as before.
+ */
+export function frozenWithInspect<T extends object>(value: T, show: (value: T) => string): Readonly<T> {
+  Object.defineProperty(value, inspectCustom, { value: () => show(value) });
+  return Object.freeze(value);
+}

package/src/util/text.ts

@@ -3,6 +3,7 @@ import { FormatError } from './errors.js';
 
 const xmlEncodingDeclaration = /encoding\s*=\s*["']([A-Za-z0-9._-]+)["']/;
 const whitespace = /\s/g;
+const whiteSpaceCharacter = /\s/;
 
 /**
  * Decodes text from the bank, which may be UTF-8 (with or without BOM) or ISO 8859-1; ASCII reads the same in both.
@@ -71,15 +72,39 @@ export function maskedId(id: string): string {
   return id.length <= 4 ? '…' : `…${id.substring(id.length - 4)}`;
 }
 
+/** `count` and `noun`, in the plural unless `count` is 1, such as `3 transactions`. */
+export function counted(count: number, noun: string): string {
+  return `${count} ${noun}${count === 1 ? '' : 's'}`;
+}
+
 /** Whether `value` fits into ISO 8859-1, the FinTS 3.0 character set. */
 export function isLatin1(value: string): boolean {
   for (let i = 0; i < value.length; i++) if (value.charCodeAt(i) > 0xff) return false;
   return true;
 }
 
-/** `text` without blanks around it; `undefined` if that leaves nothing. */
+/**
+ * Whether the UTF-16 code unit `code` is a blank: white space to `String.prototype.trim`, or U+0085 (NEL), which it
+ * keeps although Unicode counts it as white space. ISO 8859-1 bank data hold it as the byte 0x85.
+ */
+function isBlank(code: number): boolean {
+  // Below U+1680, the first white space beyond these, without a regular expression, which takes many times as long.
+  if (code < 0x1680) return code === 0x20 || (code >= 0x09 && code <= 0x0d) || code === 0x85 || code === 0xa0;
+  return whiteSpaceCharacter.test(String.fromCharCode(code));
+}
+
+/** `text` without blanks (`isBlank`) at its `start` and its `end`. */
+export function trimBlanks(text: string, { start = true, end = true } = {}): string {
+  let first = 0;
+  let last = text.length;
+  if (start) while (first < last && isBlank(text.charCodeAt(first))) first++;
+  if (end) while (last > first && isBlank(text.charCodeAt(last - 1))) last--;
+  return text.substring(first, last);
+}
+
+/** `text` without blanks around it (`trimBlanks`); `undefined` if that leaves nothing. */
 export function nonBlank(text: string | undefined): string | undefined {
-  const trimmed = text?.trim();
+  const trimmed = text === undefined ? undefined : trimBlanks(text);
   return trimmed === '' ? undefined : trimmed;
 }
 
@@ -94,6 +119,16 @@ export function characterReference(name: string): string | undefined {
   return code > 0 && (code < 0xd800 || code > 0xdfff) && code <= 0x10ffff ? String.fromCodePoint(code) : undefined;
 }
 
+/**
+ * `text` with its full-width characters, which East Asian input methods type, as their ASCII counterparts: U+FF01 to
+ * U+FF5E as U+0021 to U+007E, and the ideographic space U+3000 as a blank.
+ */
+export function withAsciiForms(text: string): string {
+  return text
+    .replace(/[\uff01-\uff5e]/g, (c) => String.fromCharCode(c.charCodeAt(0) - 0xfee0))
+    .replaceAll('\u3000', ' ');
+}
+
 /** `text` without spaces and line breaks. */
 export function withoutWhitespace(text: string): string {
   return text.replace(whitespace, '');
@@ -104,9 +139,16 @@ export function decodeBase64Lines(text: string): Uint8Array {
   return base64Decode(withoutWhitespace(text));
 }
 
-/** The integer `text` states, decimal digits with an optional sign and blanks around; `undefined` for anything else. */
+/**
+ * The integer `text` states, decimal digits with an optional sign and blanks around, `-0` as 0; `undefined` for
+ * anything else, such as hex, and for a value beyond `Number.MAX_SAFE_INTEGER`, which a number holds only
+ * approximately.
+ */
 export function tryParseInt(text: string | undefined): number | undefined {
   if (text === undefined) return undefined;
-  const match = /^\s*([+-]?\d+)\s*$/.exec(text);
-  return match ? Number(match[1]) : undefined;
+  const integer = trimBlanks(text);
+  if (!/^[+-]?\d+$/.test(integer)) return undefined;
+  const value = Number(integer);
+  if (!Number.isSafeInteger(value)) return undefined;
+  return value === 0 ? 0 : value;
 }

package/src/util/xml.ts

@@ -11,7 +11,7 @@ export class XmlElement {
   constructor(
     /** The name without namespace prefix. */
     readonly localName: string,
-    /** The attributes by name without namespace prefix; namespace declarations are left out. */
+    /** The attributes by name, namespace prefix and all. */
     readonly attributes: ReadonlyMap<string, string>,
   ) {}
 
@@ -24,8 +24,9 @@ export class XmlElement {
     return this.children.map((c) => (c instanceof XmlElement ? c.innerText : c)).join('');
   }
 
-  getAttribute(localName: string): string | undefined {
-    return this.attributes.get(localName);
+  /** The attribute called `name`: an unprefixed name finds no prefixed attribute, which is of another namespace. */
+  getAttribute(name: string): string | undefined {
+    return this.attributes.get(name);
   }
 
   /** The first child element called `localName`. */
@@ -49,8 +50,29 @@ export class XmlElement {
   }
 }
 
-const namePattern = /[^\s<>/=!?"']+/y;
-const attributePattern = /\s+([^\s<>/=!?"']+)\s*=\s*(?:"([^"<]*)"|'([^'<]*)')/y;
+/** The characters an XML name starts with (XML 1.0, production 4). */
+const nameStartCharacters = String.raw`:A-Z_a-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD\u{10000}-\u{EFFFF}`;
+/**
+ * An XML name (XML 1.0, production 5). The combining marks lead the class of the characters after the first: after
+ * another one, ESLint's `no-misleading-character-class` takes them for a combined character.
+ */
+const xmlName = String.raw`[${nameStartCharacters}][\u0300-\u036F${nameStartCharacters}\-.0-9\u00B7\u203F-\u2040]*`;
+const namePattern = new RegExp(xmlName, 'uy');
+
+/**
+ * White space to Unicode, U+0085 (NEL) among them, which separates the parts of a tag, and `<?xml` of the rest of the
+ * XML declaration, as the Dart package has it.
+ */
+const blank = String.raw`[\s\u0085]`;
+const blankPattern = new RegExp(blank);
+const attributePattern = new RegExp(
+  String.raw`${blank}+(${xmlName})${blank}*=${blank}*(?:"([^"<]*)"|'([^'<]*)')`,
+  'uy',
+);
+/** The start of the XML declaration, whose content is not read. */
+const declarationPattern = new RegExp(String.raw`<\?xml(?:${blank}|\?>)`, 'y');
+/** The text of a reference after its `&`, up to the `;` that ends it. */
+const referenceNamePattern = /[^;&\s]*/y;
 
 /** The match of the sticky `pattern` at `position` in `text`. */
 function matchAt(pattern: RegExp, text: string, position: number): RegExpExecArray | null {
@@ -66,51 +88,75 @@ const predefinedEntities = new Map([
 ]);
 
 /** Deepest nesting of elements the parser takes: camt needs fewer than 20 levels, and `innerText` recurses. */
-const maxDepth = 256;
+const maxDepth = 100;
 
 /**
- * Most elements and attributes one document may hold. Real camt spends about 20 bytes on each, so the largest answer a
- * bank can send holds fewer than 600,000, while a hostile document stays within about 150 MB of memory.
+ * Most nodes besides text a document may hold, unless it is long enough for one node per `charactersPerNode`
+ * characters: real camt spends 16 to 40 characters on each, while nodes as short as `<a/>` take a hundred times their
+ * length in memory.
  */
-const maxNodes = 1_000_000;
+const maxNodes = 500_000;
+const charactersPerNode = 16;
 
 const noAttributes: ReadonlyMap<string, string> = new Map();
 
+/** The name without namespace prefix; `:a` has none, but is no unprefixed `a` either. */
 function localNameOf(qualified: string): string {
   const colon = qualified.indexOf(':');
-  return colon < 0 ? qualified : qualified.substring(colon + 1);
+  return colon > 0 ? qualified.substring(colon + 1) : qualified;
 }
 
-/** Resolves the character and predefined entity references in `text`; throws `FormatError` for any other. */
+/**
+ * Resolves the character and predefined entity references in `text`; throws `FormatError` for any other, at the first.
+ * A global `replace` would find all of them before it looked at the first: a gigabyte for megabytes of `&`.
+ */
 function decodeEntities(text: string): string {
-  return text.replace(/&([^;&\s]*);?/g, (match, name: string) => {
-    if (!match.endsWith(';')) throw new FormatError('Invalid XML: unterminated entity reference');
-    if (name.startsWith('#')) {
-      const character = characterReference(name);
-      if (character === undefined) throw new FormatError('Invalid XML character reference', match);
-      return character;
-    }
-    const value = predefinedEntities.get(name);
-    if (value === undefined) throw new FormatError('Invalid XML: unknown entity', match);
-    return value;
-  });
+  let decoded = '';
+  let position = 0;
+  for (let ampersand = text.indexOf('&'); ampersand >= 0; ampersand = text.indexOf('&', position)) {
+    const name = matchAt(referenceNamePattern, text, ampersand + 1)![0];
+    const end = ampersand + 1 + name.length;
+    if (text.charAt(end) !== ';') throw new FormatError('Invalid XML: unterminated entity reference');
+    decoded += text.substring(position, ampersand) + resolved(name, text.substring(ampersand, end + 1));
+    position = end + 1;
+  }
+  return position === 0 ? text : decoded + text.substring(position);
+}
+
+/** The text the `reference` called `name` stands for. */
+function resolved(name: string, reference: string): string {
+  if (name.startsWith('#')) {
+    const character = characterReference(name);
+    if (character === undefined) throw new FormatError('Invalid XML character reference', reference);
+    return character;
+  }
+  const value = predefinedEntities.get(name);
+  if (value === undefined) throw new FormatError('Invalid XML: unknown entity', reference);
+  return value;
 }
 
 /**
  * Parses an XML document and returns its root element; throws `FormatError` if it is not well-formed, nests elements
- * deeper than 256 levels or holds more than a million elements and attributes.
+ * deeper than 100 levels, or holds more than 500,000 nodes besides text (elements, attributes, comments, processing
+ * instructions, the XML declaration and CDATA sections) or one per 16 characters, whichever is more.
  *
  * A document type declaration is refused: bank data have none, and its entities could expand without limit.
  */
 export function parseXml(xml: string): XmlElement {
   let position = 0;
   const stack: XmlElement[] = [];
+  const openNames: string[] = [];
   let root: XmlElement | undefined;
+  let declared = false;
   let nodes = 0;
+  const nodeLimit = Math.max(maxNodes, Math.floor(xml.length / charactersPerNode));
 
   const fail = (reason: string): never => {
     throw new FormatError(`Invalid XML: ${reason} at position ${position}`);
   };
+  const countNode = (): void => {
+    if (++nodes > nodeLimit) fail(`more than ${nodeLimit} nodes`);
+  };
   const skipPast = (terminator: string, what: string): void => {
     const end = xml.indexOf(terminator, position);
     if (end < 0) fail(`unterminated ${what}`);
@@ -122,18 +168,37 @@ export function parseXml(xml: string): XmlElement {
     const textEnd = lt < 0 ? xml.length : lt;
     if (textEnd > position) {
       const text = xml.substring(position, textEnd);
-      const parent = stack.at(-1);
-      if (parent) parent.children.push(decodeEntities(text));
-      else if (text.trim() !== '') fail('text outside the root element');
+      // Blanks are dropped only where they follow no text, as between elements: kept, they would double the nodes of a
+      // document with line breaks. Between two texts they are content, and a counted node separates the two.
+      if (nonBlank(text) !== undefined || typeof stack.at(-1)?.children.at(-1) === 'string') {
+        (stack.at(-1) ?? fail('text outside the root element')).children.push(decodeEntities(text));
+      }
       position = textEnd;
       continue;
     }
     if (xml.startsWith('<?', position)) {
+      countNode();
+      if (matchAt(declarationPattern, xml, position)) {
+        if (root) fail('XML declaration inside or after the root element');
+        if (declared) fail('a second XML declaration');
+        declared = true;
+      } else {
+        position += 2;
+        const target = matchAt(namePattern, xml, position)?.[0] ?? fail('missing processing instruction target');
+        position += target.length;
+        if (!xml.startsWith('?>', position) && !blankPattern.test(xml.charAt(position))) {
+          fail('malformed processing instruction');
+        }
+      }
       skipPast('?>', 'processing instruction');
     } else if (xml.startsWith('<!--', position)) {
+      countNode();
+      // Past the `<!--`, whose dashes end no comment: `<!-->` starts one.
+      position += 4;
       skipPast('-->', 'comment');
     } else if (xml.startsWith('<![CDATA[', position)) {
       const parent = stack.at(-1) ?? fail('CDATA outside the root element');
+      countNode();
       const start = position + 9;
       skipPast(']]>', 'CDATA section');
       parent.children.push(xml.substring(start, position - 3));
@@ -143,14 +208,14 @@ export function parseXml(xml: string): XmlElement {
       position += 2;
       const name = matchAt(namePattern, xml, position)?.[0] ?? fail('missing end tag name');
       position += name.length;
-      while (/\s/.test(xml.charAt(position))) position++;
+      while (blankPattern.test(xml.charAt(position))) position++;
       if (xml.charAt(position) !== '>') fail('malformed end tag');
       position++;
-      const open = stack.pop();
-      if (open === undefined || open.localName !== localNameOf(name)) fail(`unexpected end tag ${name}`);
+      stack.pop();
+      if (openNames.pop() !== name) fail(`unexpected end tag ${name}`);
     } else {
       if (stack.length >= maxDepth) fail(`elements nested deeper than ${maxDepth} levels`);
-      if (++nodes > maxNodes) fail(`more than ${maxNodes} elements and attributes`);
+      countNode();
       position++;
       const name = matchAt(namePattern, xml, position)?.[0] ?? fail('missing element name');
       position += name.length;
@@ -159,14 +224,13 @@ export function parseXml(xml: string): XmlElement {
         const attribute = matchAt(attributePattern, xml, position);
         if (!attribute) break;
         position += attribute[0].length;
-        if (++nodes > maxNodes) fail(`more than ${maxNodes} elements and attributes`);
+        countNode();
         const attributeName = attribute[1]!;
-        if (attributeName !== 'xmlns' && !attributeName.startsWith('xmlns:')) {
-          attributes ??= new Map();
-          attributes.set(localNameOf(attributeName), decodeEntities(attribute[2] ?? attribute[3] ?? ''));
-        }
+        attributes ??= new Map();
+        if (attributes.has(attributeName)) fail(`duplicate attribute ${attributeName}`);
+        attributes.set(attributeName, decodeEntities(attribute[2] ?? attribute[3] ?? ''));
       }
-      while (/\s/.test(xml.charAt(position))) position++;
+      while (blankPattern.test(xml.charAt(position))) position++;
       const selfClosing = xml.startsWith('/>', position);
       if (!selfClosing && xml.charAt(position) !== '>') fail(`malformed start tag ${name}`);
       position += selfClosing ? 2 : 1;
@@ -175,9 +239,12 @@ export function parseXml(xml: string): XmlElement {
       if (parent) parent.children.push(element);
       else if (root) fail('a second root element');
       else root = element;
-      if (!selfClosing) stack.push(element);
+      if (!selfClosing) {
+        stack.push(element);
+        openNames.push(name);
+      }
     }
   }
-  if (stack.length > 0) fail(`unclosed element ${stack.at(-1)!.localName}`);
+  if (stack.length > 0) fail(`unclosed element ${openNames.at(-1)!}`);
   return root ?? fail('no root element');
 }

package/src/v3/bank-connection.ts

@@ -19,9 +19,18 @@ export class BankConnection {
   /** Where the messages go, as `FinTsConfig` checked it. */
   private readonly href: string;
 
-  /** Aborts the requests on their way (`abortRequests`). */
+  /** Aborts the requests posted since the last `abortRequestsAfter`. */
   private requests = new AbortController();
 
+  /** How many requests are on their way. */
+  private onTheirWay = 0;
+
+  /** Starts the time of the requests posted after `abortRequestsAfter`, once none posted before is on its way. */
+  private startLaterRequests: (() => void) | undefined;
+
+  /** The timers of `abortRequestsAfter`, which `close` clears. */
+  private readonly deadlines: ReturnType<typeof setTimeout>[] = [];
+
   /** A connection to `url` through `transport`, an `HttpTransport` by default. */
   constructor(
     url: URL,
@@ -40,28 +49,78 @@ export class BankConnection {
    * `TypeError` where the network does, and one that throws another `FinTsError`, such as `FinTsPinError`, would pass
    * for an answer of the bank. Of such an error only the message is kept (`failureMessage`), since it may hold `body`,
    * as the errors of HTTP clients such as axios do.
+   *
+   * Once the time `abortRequestsAfter` gives is up, it fails at once, before anything reaches the transport
+   * (`checkSendable`), and a request on its way fails then without waiting for the transport, which may ignore the
+   * abort.
    */
   async post(body: Uint8Array, contentType: string): Promise<Uint8Array> {
+    this.checkSendable();
+    const signal = this.requests.signal;
+    let stopWaiting!: () => void;
+    const aborted = new Promise<never>((_, reject) => {
+      stopWaiting = () => {
+        reject(new FinTsTransportError('Request aborted'));
+      };
+    });
+    signal.addEventListener('abort', stopWaiting);
+    this.onTheirWay++;
     try {
-      return await this.transport.post(new URL(this.href), body, contentType, this.requests.signal);
+      return await Promise.race([this.transport.post(new URL(this.href), body, contentType, signal), aborted]);
     } catch (error) {
       if (error instanceof FinTsTransportError) throw error;
       throw new FinTsTransportError(failureMessage(error));
+    } finally {
+      signal.removeEventListener('abort', stopWaiting);
+      this.onTheirWay--;
+      if (this.onTheirWay === 0) this.startLaterRequests?.();
     }
   }
 
+  /**
+   * Throws the `FinTsTransportError` that `post` fails with once the time `abortRequestsAfter` gives is up; a caller
+   * checks it before it reports a message as outgoing, since such a message never goes out.
+   */
+  checkSendable(): void {
+    if (this.requests.signal.aborted) throw new FinTsTransportError('Request aborted');
+  }
+
   /** Reports a message to the logger; `message` is only built when a logger is set. */
   log(direction: MessageDirection, message: () => string): void {
     this.logger?.(direction, message());
   }
 
-  /** Aborts the requests on their way; those posted afterwards, such as the dialog ends of a closing client, go out. */
-  abortRequests(): void {
-    this.requests.abort();
-    this.requests = new AbortController();
+  /**
+   * Gives the requests on their way `graceMs` to finish, and aborts them then. Those posted later, such as the dialog
+   * ends of a closing client, have as long again from the moment the earlier ones are over or aborted, and are aborted
+   * in turn once that time is up, as is any posted after it: a bank that has stopped answering would hold them up to
+   * the transport's timeout.
+   */
+  abortRequestsAfter(graceMs: number): void {
+    const earlier = this.requests;
+    const later = new AbortController();
+    this.requests = later;
+    const afterGrace = (action: () => void): void => {
+      this.deadlines.push(setTimeout(action, graceMs));
+    };
+    this.startLaterRequests = () => {
+      this.startLaterRequests = undefined;
+      afterGrace(() => {
+        later.abort();
+      });
+    };
+    if (this.onTheirWay === 0) {
+      this.startLaterRequests();
+    } else {
+      afterGrace(() => {
+        earlier.abort();
+        this.startLaterRequests?.();
+      });
+    }
   }
 
   close(): void {
+    for (const deadline of this.deadlines) clearTimeout(deadline);
     this.transport.close();
   }
 }

package/src/v3/dialog.ts

@@ -7,7 +7,7 @@ import { TanMethod } from '../tan/tan-models.js';
 import { IncomingMessage3 } from './message.js';
 import { requireBankParameters } from './parameters.js';
 import type { FinTs3Protocol } from './protocol.js';
-import { Segments, TanResponse } from './segments.js';
+import { noReference, Segments, TanResponse } from './segments.js';
 import type { SegmentSpec } from './syntax.js';
 
 /** Dialog ID of a dialog the bank has not answered yet, and customer system ID before synchronization. */
@@ -202,6 +202,8 @@ export class FinTs3Dialog {
       throw new FinTsProtocolError('The bank asks for an app approval, which needs HKTAN version 7');
     }
     const reference = tan.reference!;
+    // The placeholder the dialog that looks up the TAN media sends, and the bank may echo, is no medium.
+    const medium = tan.mediumName ?? this.tanMedium;
     return {
       challenge: TanChallenge.create({
         method: this.method,
@@ -210,7 +212,7 @@ export class FinTs3Dialog {
         hhdUc: tan.hhdUc,
         isDecoupled: decoupled || this.method.decoupled,
         validUntil: tan.validUntil,
-        tanMediumName: tan.mediumName ?? this.tanMedium,
+        tanMediumName: medium === noReference ? undefined : medium,
       }),
       submitTan: (value) => this.sendSegments([Segments.tanProcess2(this.tanVersion, reference)], value),
       checkStatus: () => this.sendSegments([Segments.tanProcessStatus(this.tanVersion, reference)]),
@@ -225,7 +227,7 @@ export class FinTs3Dialog {
     return Segments.tanProcess4(
       this.tanVersion,
       segmentType,
-      medium === undefined ? undefined : this.protocol.parameters.tanMediumAsSent(medium),
+      medium === undefined ? undefined : this.protocol.parameters.tanMediumToSend(medium),
     );
   }
 
@@ -236,10 +238,14 @@ export class FinTs3Dialog {
    * The bank assigns the dialog ID in its answer to the first message, so the answer to another user's first message
    * passes for it (`ParameterStore.reportedUpdVersion`). Any other answer to another message fails with
    * `FinTsProtocolError` before anything of it is kept: a relay or proxy that mixes up answers would hand the client
-   * another user's data, or a page of another query.
+   * another user's data, or a page of another query. Only the bank's dialog abort message may name the dialog or the
+   * message as unknown instead (`IncomingMessage3.aborts`), so that its text reaches the user.
    *
    * The dialog ends on the client's side, without a dialog end, where it is over for the bank: after a return code that
-   * ends it, such as 9800, and after a rejected opening message (Formals C.1.2), or a broken connection (C.6).
+   * ends it, such as 9800, a dialog abort message, a rejected opening message (Formals C.1.2), or a broken connection
+   * (C.6). A request that fails while the client is closing, as one it aborts (`FinTs3Protocol.beginClose`), leaves the
+   * dialog active instead, since the bank may have received it: its end follows under the next number. Not so where
+   * the request opened the dialog, whose ID only the answer tells.
    *
    * Only an answer that does not reject the whole message starts the idle time anew (`hasEnded`): a rejection may come
    * from a bank that has ended the dialog without saying so.
@@ -258,18 +264,22 @@ export class FinTs3Dialog {
         tan,
       });
     } catch (error) {
-      if (error instanceof FinTsTransportError) this.discard();
+      if (error instanceof FinTsTransportError) {
+        if (this.protocol.isClosing && this.id !== unassigned) this.messageNumber++;
+        else this.discard();
+      }
       throw error;
     }
     this.messageNumber++;
     const response = parseBankData(() => IncomingMessage3.parse(answer));
     const assigned = this.id === unassigned ? undefined : this.id;
-    if (!response.answers(number, assigned)) {
+    const aborted = response.aborts(number, assigned);
+    if (!aborted && !response.answers(number, assigned)) {
       throw new FinTsProtocolError('The answer belongs to another message than the one sent');
     }
     if (assigned === undefined) this.id = response.dialogId ?? unassigned;
     if (!response.messageRejected) this.lastAnswer = Date.now();
-    if (endsDialog(response.feedback) || (number === 1 && response.messageRejected)) this.discard();
+    if (aborted || endsDialog(response.feedback) || (number === 1 && response.messageRejected)) this.discard();
     return response;
   }
 }