lib-fints 1.4.8 → 1.5.1

package/README.md

@@ -85,14 +85,17 @@ Finally you can start fetching balances or statements:
 // for simplicity, use the first account
 const account = syncResponse.bankingInformation.upd.bankAccounts[0];
 
+// Account-specific methods accept either an account number or a BankAccount.
+// Pass the account object when multiple accounts share the same number.
+
 // fetch the current balance
-const balanceResponse = await client.getAccountBalance(account.accountNumber);
+const balanceResponse = await client.getAccountBalance(account);
 
 // fetch all available statements
-const statementResponse = await client.getAccountStatements(account.accountNumber);
+const statementResponse = await client.getAccountStatements(account);
 
 // or fetch portfolio from a securities account
-client.getPortfolio(account.accountNumber);
+client.getPortfolio(account);
 ```
 
 These are only the most basic steps needed to retrieve information from the bank. There are still some unanswered questions like "how to handle TANs" or "how to avoid synchronizations every time you start a new session". These are explained in the corresponding sections below.
@@ -110,7 +113,7 @@ const rl = readline.createInterface({
   output: process.stdout,
 });
 
-let response = await client.getAccountStatements(account.accountNumber);
+let response = await client.getAccountStatements(account);
 
 if (!response.success) {
   return;
@@ -197,10 +200,11 @@ The following table shows all transactions supported by the FinTSClient interfac
 | Transaction                | Method                                                               | Description                                                                     | FinTS Segment(s)           | TAN Support | Account-Specific |
 | -------------------------- | -------------------------------------------------------------------- | ------------------------------------------------------------------------------- | -------------------------- | ----------- | ---------------- |
 | **Synchronization**        | `synchronize()`                                                      | Synchronizes bank and account information, updating config.bankingInformation   | HKIDN, HKVVB, HKSYN, HKTAB | ✓           | ❌               |
-| **Account Balance**        | `getAccountBalance(accountNumber)`                                   | Fetches the current balance for a specific account                              | HKSAL                      | ✓           | ✓                |
-| **Account Statements**     | `getAccountStatements(accountNumber, from?, to?)`                    | Fetches account transactions/statements for a date range (MT940 or CAMT format) | HKKAZ, HKCAZ               | ✓           | ✓                |
-| **Portfolio**              | `getPortfolio(accountNumber, currency?, priceQuality?, maxEntries?)` | Fetches securities portfolio information for depot accounts                     | HKWPD                      | ✓           | ✓                |
-| **Credit Card Statements** | `getCreditCardStatements(accountNumber, from?)`                      | Fetches credit card statements for credit card accounts                         | DKKKU                      | ✓           | ✓                |
+| **Account Balance**        | `getAccountBalance(account: AccountRef)`                              | Fetches the current balance for a specific account                              | HKSAL                      | ✓           | ✓                |
+| **Account Statements**     | `getAccountStatements(account: AccountRef, from?, to?)`               | Fetches account transactions/statements for a date range (MT940 or CAMT format) | HKKAZ, HKCAZ               | ✓           | ✓                |
+| **Portfolio**              | `getPortfolio(account: AccountRef, currency?, priceQuality?, maxEntries?)` | Fetches securities portfolio information for depot accounts                  | HKWPD                      | ✓           | ✓                |
+| **Credit Card Statements** | `getCreditCardStatements(account: AccountRef, from?)`                 | Fetches credit card statements for credit card accounts                         | DKKKU                      | ✓           | ✓                |
+| **Electronic Statements**  | `getElectronicStatements(account: AccountRef, options?)`              | Fetches the statement document from the electronic mailbox, usually a PDF       | HKEKA                      | ✓           | ✓                |
 | **TAN Method Selection**   | `selectTanMethod(tanMethodId)`                                       | Selects a TAN method by ID from available methods                               | -                          | ❌          | ❌               |
 | **TAN Media Selection**    | `selectTanMedia(tanMediaName)`                                       | Selects a specific TAN media device by name                                     | -                          | ❌          | ❌               |
 
@@ -210,10 +214,11 @@ For each account-specific transaction, the client provides corresponding `can*`
 
 | Support Check Method                         | Purpose                                                         |
 | -------------------------------------------- | --------------------------------------------------------------- |
-| `canGetAccountBalance(accountNumber?)`       | Checks if account balance fetching is supported                 |
-| `canGetAccountStatements(accountNumber?)`    | Checks if account statements fetching is supported (MT940/CAMT) |
-| `canGetPortfolio(accountNumber?)`            | Checks if portfolio information fetching is supported           |
-| `canGetCreditCardStatements(accountNumber?)` | Checks if credit card statements fetching is supported          |
+| `canGetAccountBalance(account?: AccountRef)`       | Checks if account balance fetching is supported                 |
+| `canGetAccountStatements(account?: AccountRef)`    | Checks if account statements fetching is supported (MT940/CAMT) |
+| `canGetPortfolio(account?: AccountRef)`            | Checks if portfolio information fetching is supported           |
+| `canGetCreditCardStatements(account?: AccountRef)` | Checks if credit card statements fetching is supported          |
+| `canGetElectronicStatements(account?: AccountRef)` | Checks if electronic account statements fetching is supported   |
 
 ### Transaction Parameters
 
@@ -244,12 +249,12 @@ if (config.isTransactionSupported('HKWPD')) {
 }
 ```
 
-#### `config.isAccountTransactionSupported(accountNumber: string, transId: string): boolean`
+#### `config.isAccountTransactionSupported(account: AccountRef, transId: string): boolean`
 
 Checks whether a specific transaction type is supported for a particular account.
 
 ```typescript
-if (config.isAccountTransactionSupported('1234567890', 'HKWPD')) {
+if (config.isAccountTransactionSupported(account, 'HKWPD')) {
   console.log('Account supports portfolio requests');
 }
 ```
@@ -278,6 +283,7 @@ Implementing further transactions should be straight forward and contributions a
 
 ### Successfully tested with the following banks
 
+- comdirect
 - DKB
 - ING-DiBa
 - Renault Bank Direkt
@@ -299,7 +305,7 @@ As this is a free-time project, a lot of things are still remaining which could
 
 ## License
 
-This project is licensed under the LGPL 3.0 License - see the [LICENSE](LICENSE) file for details
+This project is licensed under the LGPL-2.1-or-later License - see the [LICENSE](LICENSE) file for details
 
 ## References
 

package/dist/accountDescriptor.js

@@ -0,0 +1,65 @@
+import { HKSPA } from './segments/HKSPA.js';
+/**
+ * Builds the account connection ("Kontoverbindung") a segment carries.
+ *
+ * FinTS has two forms, and segments pick one by version: the national form (KTV,
+ * account number + sub-account + bank) and the international one (KTI, which adds
+ * IBAN and BIC and makes every field optional). The international form allows the
+ * national fields to be present as well, but only where the bank permits it — and
+ * the bank says so in the HISPAS parameters, in `nationalAccountAllowed`.
+ *
+ * Filling both halves regardless is rejected by banks that set the flag to false.
+ * Measured at comdirect (BLZ 2004xxxx), same account, same range, same session:
+ *
+ *   IBAN + BIC + number + sub-account + bank   →  3010 "Kontonummer ist ungültig", 0 statements
+ *   IBAN + BIC                                 →  0020 "Auftrag ausgeführt", 19 statements
+ *   IBAN                                       →  0020 "Auftrag ausgeführt", 19 statements
+ *   number + sub-account + bank                →  3010 "Kontonummer ist ungültig", 0 statements
+ *
+ * The last line is why this is a rule about the national *fields* rather than about
+ * the combination: the bank rejects them in a KTI even when no IBAN accompanies
+ * them.
+ */
+/**
+ * The national form. Built field by field rather than by spreading the account and
+ * blanking what does not belong: the data group has exactly these three fields, and
+ * saying so is clearer than relying on the encoder to ignore the rest.
+ */
+export function nationalAccount(account) {
+    return {
+        accountNumber: account.accountNumber,
+        subAccountId: account.subAccountId,
+        bank: account.bank,
+    };
+}
+/**
+ * The international form. IBAN and BIC always; the national fields only where the
+ * bank's HISPAS parameters allow them.
+ *
+ * An account without an IBAN — a securities account, typically — has nothing else
+ * to identify it with, so it keeps the national fields whatever the flag says. A
+ * request the bank refuses is more useful than one it cannot resolve at all.
+ *
+ * A bank that announces no HISPAS at all keeps both halves, exactly as before. The
+ * specification would read absent permission as no permission, but this library has
+ * already been round that loop: #20 reduced the CAMT descriptor to IBAN and BIC for
+ * comdirect, #25 reported Postbank answering "Angaben zur nationalen Kontoverbindung
+ * für Identifikation erforderlich", and the reduction was reverted. Only a bank that
+ * says `false` gets the shorter form, so no bank that works today can regress on a
+ * rule it never stated.
+ */
+export function internationalAccount(config, account) {
+    if (!account.iban) {
+        return nationalAccount(account);
+    }
+    const hispas = config.getTransactionParameters(HKSPA.Id);
+    return hispas?.nationalAccountAllowed === false
+        ? { iban: account.iban, bic: account.bic }
+        : {
+            iban: account.iban,
+            bic: account.bic,
+            accountNumber: account.accountNumber,
+            subAccountId: account.subAccountId,
+            bank: account.bank,
+        };
+}

package/dist/bankAccount.js

@@ -11,6 +11,14 @@ export var AccountType;
     AccountType["InsurancePolicy"] = "InsurancePolicy";
     AccountType["Miscellaneous"] = "Miscellaneous";
 })(AccountType || (AccountType = {}));
+/** How an account reference reads in an error message. */
+export function describeAccount(account) {
+    if (typeof account === 'string')
+        return account;
+    return account.subAccountId
+        ? `${account.accountNumber} (${account.subAccountId})`
+        : account.accountNumber;
+}
 export function finTsAccountTypeToEnum(accountType) {
     if (accountType >= 1 && accountType <= 9)
         return AccountType.CheckingAccount;

package/dist/client.js

@@ -1,12 +1,15 @@
+import { describeAccount } from './bankAccount.js';
 import { FinTSConfig } from './config.js';
 import { Dialog } from './dialog.js';
 import { BalanceInteraction, } from './interactions/balanceInteraction.js';
 import { CreditCardStatementInteraction } from './interactions/creditcardStatementInteraction.js';
+import { ElectronicStatementInteraction, } from './interactions/electronicStatementInteraction.js';
 import { PortfolioInteraction, } from './interactions/portfolioInteraction.js';
 import { StatementInteractionCAMT } from './interactions/statementInteractionCAMT.js';
 import { StatementInteractionMT940 } from './interactions/statementInteractionMT940.js';
 import { DKKKU } from './segments/DKKKU.js';
 import { HKCAZ } from './segments/HKCAZ.js';
+import { HKEKA } from './segments/HKEKA.js';
 import { HKIDN } from './segments/HKIDN.js';
 import { HKKAZ } from './segments/HKKAZ.js';
 import { HKSAL } from './segments/HKSAL.js';
@@ -65,21 +68,21 @@ export class FinTSClient {
     }
     /**
      * Checks if the bank supports fetching an account balance in general or for the given account number when provided
-     * @param accountNumber when the account number is provided, checks if the account supports fetching the balance
+     * @param account when the account number is provided, checks if the account supports fetching the balance
      * @returns true if the bank (and account) supports fetching the account balance
      */
-    canGetAccountBalance(accountNumber) {
-        return accountNumber
-            ? this.config.isAccountTransactionSupported(accountNumber, HKSAL.Id)
+    canGetAccountBalance(account) {
+        return account
+            ? this.config.isAccountTransactionSupported(account, HKSAL.Id)
             : this.config.isTransactionSupported(HKSAL.Id);
     }
     /**
      * Fetches the account balance for the given account number
-     * @param accountNumber - the account number to fetch the balance for, must be an account available in the config.baningInformation.UPD.accounts
+     * @param account - the account number to fetch the balance for, must be an account available in the config.baningInformation.UPD.accounts
      * @returns the account balance response
      */
-    async getAccountBalance(accountNumber) {
-        const response = await this.startCustomerOrderInteraction(new BalanceInteraction(accountNumber));
+    async getAccountBalance(account) {
+        const response = await this.startCustomerOrderInteraction(new BalanceInteraction(account));
         return response;
     }
     /**
@@ -93,14 +96,14 @@ export class FinTSClient {
     }
     /**
      * Checks if the bank supports fetching account statements in general or for the given account number when provided
-     * @param accountNumber when the account number is provided, checks if the account supports fetching of statements
+     * @param account when the account number is provided, checks if the account supports fetching of statements
      * @returns true if the bank (and account) supports fetching account statements
      */
-    canGetAccountStatements(accountNumber) {
-        if (accountNumber) {
+    canGetAccountStatements(account) {
+        if (account) {
             // Check if either CAMT or MT940 is supported for this account
-            return (this.config.isAccountTransactionSupported(accountNumber, HKCAZ.Id) ||
-                this.config.isAccountTransactionSupported(accountNumber, HKKAZ.Id));
+            return (this.config.isAccountTransactionSupported(account, HKCAZ.Id) ||
+                this.config.isAccountTransactionSupported(account, HKKAZ.Id));
         }
         else {
             // Check if either CAMT or MT940 is supported by the bank
@@ -109,26 +112,26 @@ export class FinTSClient {
     }
     /**
      * Fetches the account statements for the given account number
-     * @param accountNumber - the account number to fetch the statements for, must be an account available in the config.baningInformation.UPD.accounts
+     * @param account - the account number to fetch the statements for, must be an account available in the config.baningInformation.UPD.accounts
      * @param from - an optional start date of the period to fetch the statements for
      * @param to - an optional end date of the period to fetch the statements for
      * @param preferCamt - whether to prefer CAMT format over MT940 when both are supported (default: true)
      * @returns an account statements response containing an array of statements
      */
-    async getAccountStatements(accountNumber, from, to, preferCamt = true) {
+    async getAccountStatements(account, from, to, preferCamt = true) {
         // Check what formats the bank supports
-        const camtSupported = this.config.isAccountTransactionSupported(accountNumber, 'HKCAZ');
-        const mt940Supported = this.config.isAccountTransactionSupported(accountNumber, 'HKKAZ');
+        const camtSupported = this.config.isAccountTransactionSupported(account, 'HKCAZ');
+        const mt940Supported = this.config.isAccountTransactionSupported(account, 'HKKAZ');
         if (!camtSupported && !mt940Supported) {
-            throw Error(`Account ${accountNumber} does not support account statements`);
+            throw Error(`Account ${describeAccount(account)} does not support account statements`);
         }
         // Choose format based on support and preference
         const useCAMT = (preferCamt && camtSupported) || (!mt940Supported && camtSupported);
         if (useCAMT) {
-            return (await this.startCustomerOrderInteraction(new StatementInteractionCAMT(accountNumber, from, to)));
+            return (await this.startCustomerOrderInteraction(new StatementInteractionCAMT(account, from, to)));
         }
         else {
-            return (await this.startCustomerOrderInteraction(new StatementInteractionMT940(accountNumber, from, to)));
+            return (await this.startCustomerOrderInteraction(new StatementInteractionMT940(account, from, to)));
         }
     }
     /**
@@ -142,24 +145,24 @@ export class FinTSClient {
     }
     /**
      * Checks if the bank supports fetching portfolio information in general or for the given account number when provided
-     * @param accountNumber when the account number is provided, checks if the account supports fetching of portfolio information
+     * @param account when the account number is provided, checks if the account supports fetching of portfolio information
      * @returns true if the bank (and account) supports fetching portfolio information
      */
-    canGetPortfolio(accountNumber) {
-        return accountNumber
-            ? this.config.isAccountTransactionSupported(accountNumber, HKWPD.Id)
+    canGetPortfolio(account) {
+        return account
+            ? this.config.isAccountTransactionSupported(account, HKWPD.Id)
             : this.config.isTransactionSupported(HKWPD.Id);
     }
     /**
      * Fetches the portfolio information for the given depot account number
-     * @param accountNumber - the depot account number to fetch the portfolio for, must be an account available in the config.bankingInformation.UPD.accounts
+     * @param account - the depot account number to fetch the portfolio for, must be an account available in the config.bankingInformation.UPD.accounts
      * @param currency - optional currency filter for the portfolio statement
      * @param priceQuality - optional price quality filter ('1' for real-time, '2' for delayed)
      * @param maxEntries - optional maximum number of entries to retrieve
      * @returns a portfolio response containing holdings and total value
      */
-    async getPortfolio(accountNumber, currency, priceQuality, maxEntries) {
-        return (await this.startCustomerOrderInteraction(new PortfolioInteraction(accountNumber, currency, priceQuality, maxEntries)));
+    async getPortfolio(account, currency, priceQuality, maxEntries) {
+        return (await this.startCustomerOrderInteraction(new PortfolioInteraction(account, currency, priceQuality, maxEntries)));
     }
     /**
      * Continues the portfolio fetching when a TAN is required
@@ -173,24 +176,24 @@ export class FinTSClient {
     }
     /**
      * Checks if the bank supports fetching credit card statements in general or for the given account number
-     * @param accountNumber when the account number is provided, checks if the account supports fetching of statements
+     * @param account when the account number is provided, checks if the account supports fetching of statements
      * @returns true if the bank (and account) supports fetching credit card statements
      */
-    canGetCreditCardStatements(accountNumber) {
-        return accountNumber
-            ? this.config.isAccountTransactionSupported(accountNumber, DKKKU.Id)
+    canGetCreditCardStatements(account) {
+        return account
+            ? this.config.isAccountTransactionSupported(account, DKKKU.Id)
             : this.config.isTransactionSupported(DKKKU.Id);
     }
     /**
      * Fetches the credit card statements for the given account number
-     * @param accountNumber - the account number to fetch the statements for, must be a credit card account available
+     * @param account - the account number to fetch the statements for, must be a credit card account available
      * in the config.baningInformation.UPD.accounts
      * @param from - an optional start date of the period to fetch the statements for
      * @param to - an optional end date of the period to fetch the statements for
      * @returns an account statements response containing an array of statements
      */
-    async getCreditCardStatements(accountNumber, from) {
-        return (await this.startCustomerOrderInteraction(new CreditCardStatementInteraction(accountNumber, from)));
+    async getCreditCardStatements(account, from) {
+        return (await this.startCustomerOrderInteraction(new CreditCardStatementInteraction(account, from)));
     }
     /**
      * Continues the credit card statements fetching when a TAN is required
@@ -201,6 +204,41 @@ export class FinTSClient {
     async getCreditCardStatementsWithTan(tanReference, tan) {
         return (await this.continueCustomerInteractionWithTan([DKKKU.Id], tanReference, tan));
     }
+    /**
+     * Checks if the bank supports fetching electronic account statements in general or for the given account number
+     * @param account when the account number is provided, checks if the account supports fetching of electronic statements
+     * @returns true if the bank (and account) supports fetching electronic account statements
+     */
+    canGetElectronicStatements(account) {
+        return account
+            ? this.config.isAccountTransactionSupported(account, HKEKA.Id)
+            : this.config.isTransactionSupported(HKEKA.Id);
+    }
+    /**
+     * Fetches an electronic account statement (Elektronischer Kontoauszug) for the given account number
+     *
+     * This returns the statement document the bank files in the customer's electronic mailbox,
+     * usually a PDF, not a list of transactions. The bank hands out one statement per call and
+     * announces a waiting successor in `nextOffset`; pass that value back in `options.offset` to
+     * fetch the next one. Banks that set `receiptRequired` in their HIEKAS parameters keep
+     * offering a statement until it has been acknowledged with its receipt.
+     *
+     * @param account - the account number to fetch the statement for, must be an account available in the config.bankingInformation.upd.accounts
+     * @param options - optional format, statement number and year, entry limit and offset
+     * @returns a response containing the statement documents and the offset of a waiting successor
+     */
+    async getElectronicStatements(account, options) {
+        return (await this.startCustomerOrderInteraction(new ElectronicStatementInteraction(account, options)));
+    }
+    /**
+     * Continues the electronic account statement fetching when a TAN is required
+     * @param tanReference The TAN reference provided in the first call's response
+     * @param tan The TAN entered by the user, can be omitted if a decoupled TAN method is used
+     * @returns a response containing the statement documents
+     */
+    async getElectronicStatementsWithTan(tanReference, tan) {
+        return (await this.continueCustomerInteractionWithTan([HKEKA.Id], tanReference, tan));
+    }
     async startCustomerOrderInteraction(interaction) {
         this.currentDialog = new Dialog(this.config, false);
         this.currentDialog.addCustomerInteraction(interaction);

package/dist/config.js

@@ -157,13 +157,36 @@ export class FinTSConfig {
         return (this.bankingInformation.bpd?.allowedTransactions.find((t) => t.transId === transId) !==
             undefined);
     }
+    /**
+     * The account the bank meant, without demanding that it be unambiguous.
+     *
+     * For entries the *bank* supplied — a SEPA account from HISPA, say — rather than
+     * ones a caller asked for. A caller who names an ambiguous account has made a
+     * mistake worth an exception; a bank listing its own accounts has not, and
+     * throwing there would break every dialog at an institution that shares numbers.
+     *
+     * @param account An account number with, where the bank gave one, its sub-account id
+     */
+    matchBankAccount(account) {
+        const accounts = this.bankingInformation.upd?.bankAccounts ?? [];
+        const exactMatch = accounts.find((a) => a.accountNumber === account.accountNumber && a.subAccountId === account.subAccountId);
+        if (exactMatch)
+            return exactMatch;
+        // A tolerance, not a rule: B.3.1 requires the sub-account id to appear the same
+        // way in the UPD and in HKSPA/HISPA, and a bank that omits it here has not kept
+        // to that. Refusing would cost the IBAN for an account that is otherwise
+        // perfectly identified, so a number only one account has still identifies it.
+        // One that several share does not, and guessing is what this change exists to stop.
+        const matches = accounts.filter((a) => a.accountNumber === account.accountNumber);
+        return matches.length === 1 ? matches[0] : undefined;
+    }
     /**
      * Checks if a transaction is supported for a specific account
-     * @param accountNumber The account number
+     * @param account An account number, or an account from `bankingInformation.upd.bankAccounts`
      * @param transId The transaction ID
      */
-    isAccountTransactionSupported(accountNumber, transId) {
-        const bankAccount = this.getBankAccount(accountNumber);
+    isAccountTransactionSupported(account, transId) {
+        const bankAccount = this.getBankAccount(account);
         return !!bankAccount.allowedTransactions?.find((t) => t.transId === transId);
     }
     /**
@@ -181,14 +204,38 @@ export class FinTSConfig {
         return maxSupportedversion;
     }
     /**
-     * Gets the bank account information for a specific account number
-     * @param accountNumber The account number
+     * Resolves an account reference against the accounts the bank reported.
+     *
+     * A number alone is enough wherever it is unique, which is the usual case. Where
+     * it is not, this throws instead of picking one: FinTS identifies an account by
+     * number *and* sub-account id, so a number that matches two accounts does not say
+     * which one is meant, and answering for the wrong one produces a balance or a list
+     * of transactions that belongs to a different account with nothing to indicate it.
+     *
+     * @param account An account number, or an account from `bankingInformation.upd.bankAccounts`
      */
-    getBankAccount(accountNumber) {
-        const bankAccount = this.bankingInformation.upd?.bankAccounts.find((a) => a.accountNumber === accountNumber);
-        if (!bankAccount) {
-            throw Error(`Account ${accountNumber} not found in UPD`);
+    getBankAccount(account) {
+        const accounts = this.bankingInformation.upd?.bankAccounts ?? [];
+        if (typeof account !== 'string') {
+            // Resolved against the UPD rather than trusted as given: the caller may hold
+            // an account from an earlier session, and the entry the bank sent this time
+            // is the one carrying the current allowed transactions.
+            const matchedAccount = accounts.find((a) => a.accountNumber === account.accountNumber && a.subAccountId === account.subAccountId);
+            if (!matchedAccount) {
+                throw Error(`Account ${account.accountNumber}${account.subAccountId ? ` (${account.subAccountId})` : ''} not found in UPD`);
+            }
+            return matchedAccount;
+        }
+        const matches = accounts.filter((a) => a.accountNumber === account);
+        if (matches.length === 0) {
+            throw Error(`Account ${account} not found in UPD`);
+        }
+        if (matches.length > 1) {
+            const subAccountIds = matches.map((a) => a.subAccountId ?? '(none)').join(', ');
+            throw Error(`Account number ${account} is not unique in UPD: ${matches.length} accounts share it, ` +
+                `with sub-account ids ${subAccountIds}. Pass the account itself instead of its number, ` +
+                `from bankingInformation.upd.bankAccounts.`);
         }
-        return bankAccount;
+        return matches[0];
     }
 }

package/dist/dataElements/Binary.js

@@ -14,7 +14,24 @@ export class Binary extends DataElement {
         }
         return `@${value.length}@${value}`;
     }
+    /**
+     * A binary value arrives as `@<length>@<data>`. The length is authoritative: it is the
+     * only thing that tells data apart from the separators and escape characters that a
+     * binary payload — a PDF, for instance — is full of. Returning everything after the
+     * second `@` instead would hand out whatever the bank appended between the end of the
+     * data and the next separator.
+     */
     decode(text) {
-        return text.slice(text.indexOf('@', 1) + 1);
+        if (text[0] !== '@') {
+            // Not length-prefixed — nothing to go by, take it as it is.
+            return text;
+        }
+        const lengthEnd = text.indexOf('@', 1);
+        if (lengthEnd < 0) {
+            return text;
+        }
+        const dataStart = lengthEnd + 1;
+        const length = Number.parseInt(text.slice(1, lengthEnd), 10);
+        return Number.isNaN(length) ? text.slice(dataStart) : text.slice(dataStart, dataStart + length);
     }
 }

package/dist/dialog.js

@@ -180,39 +180,60 @@ export class Dialog {
         }
         return this.config.tanMediaName;
     }
+    /**
+     * Collects a response that the bank spreads over several messages.
+     *
+     * When the bank cannot fit a response into one message it answers with code 3040 plus
+     * a continuation mark. Repeating the order with that mark yields the next portion —
+     * as a COMPLETE, self-contained response segment, not as a byte-wise continuation of
+     * the previous one. A HICAZ follow-up, for example, repeats the account and the CAMT
+     * descriptor before carrying its own share of the statements.
+     *
+     * Every portion is therefore decoded on its own and all of them are placed into the
+     * response message the caller holds. Combining their payloads needs to know what the
+     * payload means — one MT940 stream continues, a list of CAMT documents is appended —
+     * so that step belongs to the interaction, which does it via `findAllSegments`.
+     */
     async handlePartedMessages(message, responseMessage, interaction) {
-        let partedSegment = responseMessage.findSegment(PARTED.Id);
-        if (partedSegment) {
-            while (responseMessage.hasReturnCode(3040)) {
-                const answers = responseMessage.getBankAnswers();
-                const segmentWithContinuation = message.segments.find((s) => s.header.segId === interaction.segId);
-                if (!segmentWithContinuation) {
-                    throw new Error(`Response contains segment with further information, but corresponding segment could not be found or is not specified`);
-                }
-                const answer = answers.find((a) => a.code === 3040);
-                if (!answer || !answer.params || answer.params.length === 0) {
-                    throw new Error('Expected bank answer to contain continuation mark parameters (code 3040)');
-                }
-                segmentWithContinuation.continuationMark = answer.params[0];
-                const hnhbkSegment = message.findSegment(HNHBK.Id);
-                if (!hnhbkSegment) {
-                    throw new Error('HNHBK segment not found in message');
-                }
-                hnhbkSegment.msgNr = ++this.lastMessageNumber;
-                const nextResponseMessage = await this.httpClient.sendMessage(message);
-                const nextPartedSegment = nextResponseMessage.findSegment(PARTED.Id);
-                if (nextPartedSegment) {
-                    nextPartedSegment.rawData =
-                        partedSegment.rawData +
-                            nextPartedSegment.rawData.slice(nextPartedSegment.rawData.indexOf('+') + 1);
-                    partedSegment = nextPartedSegment;
-                }
-                responseMessage = nextResponseMessage;
-            }
-            const completeSegment = decode(partedSegment.rawData);
-            const index = responseMessage.segments.indexOf(partedSegment);
-            responseMessage.segments.splice(index, 1, completeSegment);
+        // ALL of them, not just the first: one bank message may well carry several
+        // response segments. Taking only the first left the rest sitting in the tree as
+        // PARTED, where `findAllSegments` cannot see them — lost without a trace.
+        const partedSegments = responseMessage.findAllSegments(PARTED.Id);
+        if (partedSegments.length === 0) {
+            return;
         }
+        // The message the caller holds — every portion has to end up in THIS one, not in
+        // the last one we happen to receive.
+        const callersMessage = responseMessage;
+        const rawPortions = partedSegments.map((segment) => segment.rawData);
+        while (responseMessage.hasReturnCode(3040)) {
+            const answers = responseMessage.getBankAnswers();
+            const segmentWithContinuation = message.segments.find((s) => s.header.segId === interaction.segId);
+            if (!segmentWithContinuation) {
+                throw new Error(`Response contains segment with further information, but corresponding segment could not be found or is not specified`);
+            }
+            const answer = answers.find((a) => a.code === 3040);
+            if (!answer || !answer.params || answer.params.length === 0) {
+                throw new Error('Expected bank answer to contain continuation mark parameters (code 3040)');
+            }
+            segmentWithContinuation.continuationMark = answer.params[0];
+            const hnhbkSegment = message.findSegment(HNHBK.Id);
+            if (!hnhbkSegment) {
+                throw new Error('HNHBK segment not found in message');
+            }
+            hnhbkSegment.msgNr = ++this.lastMessageNumber;
+            const nextResponseMessage = await this.httpClient.sendMessage(message);
+            rawPortions.push(...nextResponseMessage
+                .findAllSegments(PARTED.Id)
+                .map((segment) => segment.rawData));
+            responseMessage = nextResponseMessage;
+        }
+        // Every PARTED placeholder gives way to the decoded portions, at the position of
+        // the first one so the segment order stays intact.
+        const index = callersMessage.segments.indexOf(partedSegments[0]);
+        const withoutPlaceholders = callersMessage.segments.filter((segment) => segment.header.segId !== PARTED.Id);
+        withoutPlaceholders.splice(index, 0, ...rawPortions.map((raw) => decode(raw)));
+        callersMessage.segments = withoutPlaceholders;
     }
     checkEnded(response) {
         if (response.bankAnswers.some((answer) => answer.code === 100) ||

package/dist/electronicStatement.js

@@ -0,0 +1 @@
+export {};

package/dist/httpClient.js

@@ -10,7 +10,7 @@ export class HttpClient {
     }
     async sendMessage(message) {
         const encodedMessage = message.encode();
-        const requestBuffer = Buffer.from(encodedMessage);
+        const requestBuffer = Buffer.from(encodedMessage, 'latin1');
         if (this.debug) {
             console.log('Request Message:\n');
             if (this.debugRaw) {

package/dist/index.js

@@ -8,10 +8,12 @@ export * from './bpd.js';
 export * from './client.js';
 export * from './config.js';
 export * from './dialog.js';
+export * from './electronicStatement.js';
 export * from './httpClient.js';
 export * from './message.js';
 export * from './mt535parser.js';
 export * from './mt940parser.js';
 export * from './segment.js';
+export { StatementFormat } from './segments/HKEKA.js';
 export * from './statement.js';
 export * from './upd.js';