lib-fints 1.4.8 → 1.5.1

package/dist/tests/HKEKA.test.js

@@ -0,0 +1,198 @@
+import { describe, expect, it } from 'vitest';
+import { ElectronicStatementInteraction, } from '../interactions/electronicStatementInteraction.js';
+import { Message } from '../message.js';
+import { decode, encode } from '../segment.js';
+import { HKEKA, StatementFormat } from '../segments/HKEKA.js';
+import { registerSegments } from '../segments/registry.js';
+registerSegments();
+describe('HKEKA v5', () => {
+    it('encode', () => {
+        const segment = {
+            header: { segId: HKEKA.Id, segNr: 3, version: 5 },
+            account: {
+                iban: 'DE991234567123456',
+                bic: 'BANK12',
+            },
+            statementFormat: StatementFormat.PDF,
+        };
+        expect(encode(segment)).toBe("HKEKA:3:5+DE991234567123456:BANK12+3'");
+    });
+    it('encode with statement number, year and offset', () => {
+        const segment = {
+            header: { segId: HKEKA.Id, segNr: 3, version: 5 },
+            account: {
+                iban: 'DE991234567123456',
+                bic: 'BANK12',
+            },
+            statementFormat: StatementFormat.PDF,
+            statementNumber: 7,
+            statementYear: 2026,
+            offset: '20260530120235141058000_0',
+        };
+        expect(encode(segment)).toBe("HKEKA:3:5+DE991234567123456:BANK12+3+7+2026++20260530120235141058000_0'");
+    });
+    it('decode and encode roundtrip matches', () => {
+        const text = "HKEKA:0:5+DE991234567123456:BANK12+3+7+2026++20260530120235141058000_0'";
+        const segment = decode(text);
+        expect(encode(segment)).toBe(text);
+    });
+});
+describe('HIEKA v5', () => {
+    // The element order is the whole risk of this segment: `booked` comes AFTER
+    // date/year/number, unlike HIEKP v2 where it comes first.
+    const text = "HIEKA:5:5:3+3+20260601:20260630+20260701+2026+7+@9@%PDF-1.7 +Abschluss+Konditionen+Werbung+DE991234567123456+BANK12+Muster+GmbH+i?:G?:+@4@abcd'";
+    it('decode', () => {
+        const segment = decode(text);
+        expect(segment.format).toBe(StatementFormat.PDF);
+        expect(segment.timeRange?.from).toEqual(new Date('2026-06-01'));
+        expect(segment.timeRange?.to).toEqual(new Date('2026-06-30'));
+        expect(segment.date).toEqual(new Date('2026-07-01'));
+        expect(segment.year).toBe(2026);
+        expect(segment.number).toBe(7);
+        expect(segment.booked).toBe('%PDF-1.7 ');
+        expect(segment.closingInfo).toBe('Abschluss');
+        expect(segment.conditionsInfo).toBe('Konditionen');
+        expect(segment.advertisement).toBe('Werbung');
+        expect(segment.iban).toBe('DE991234567123456');
+        expect(segment.bic).toBe('BANK12');
+        expect(segment.name).toBe('Muster');
+        expect(segment.name2).toBe('GmbH');
+        expect(segment.name3).toBe('i:G:');
+        expect(segment.receipt).toBe('abcd');
+    });
+    it('decode and encode roundtrip matches', () => {
+        expect(encode(decode(text))).toBe(text);
+    });
+    it('decode without the optional elements', () => {
+        const segment = decode("HIEKA:5:5:3+3+20260601:20260630++++@9@%PDF-1.7 '");
+        expect(segment.format).toBe(StatementFormat.PDF);
+        expect(segment.timeRange?.from).toEqual(new Date('2026-06-01'));
+        expect(segment.date).toBeUndefined();
+        expect(segment.number).toBeUndefined();
+        expect(segment.booked).toBe('%PDF-1.7 ');
+        expect(segment.receipt).toBeUndefined();
+    });
+});
+describe('HKEKA / HIEKA older versions', () => {
+    // Up to version 3 the request carries the national account connection, from version 4
+    // on the international one; `year` does not exist before version 3. Getting this wrong
+    // puts an IBAN into the slot the bank reads as an account number.
+    it('encodes version 3 with the national account connection and no year', () => {
+        const segment = {
+            header: { segId: HKEKA.Id, segNr: 3, version: 3 },
+            account: { accountNumber: '2759161761', bank: { country: 280, bankId: '10090000' } },
+            statementFormat: StatementFormat.PDF,
+            statementNumber: 7,
+        };
+        expect(encode(segment)).toBe("HKEKA:3:3+2759161761::280:10090000+3+7'");
+    });
+    it('encodes version 5 with the international account connection', () => {
+        const segment = {
+            header: { segId: HKEKA.Id, segNr: 3, version: 5 },
+            account: { iban: 'DE991234567123456', bic: 'BANK12' },
+            statementFormat: StatementFormat.PDF,
+            statementNumber: 7,
+        };
+        expect(encode(segment)).toBe("HKEKA:3:5+DE991234567123456:BANK12+3+7'");
+    });
+    // Up to version 4 the response has no date/year/number — `booked` follows the time
+    // range directly. Decoded with the version 5 layout this does not throw, it hands out
+    // the advertisement text as the statement document.
+    it('decodes a version 4 response without shifting the document', () => {
+        const segment = decode("HIEKA:5:4+3+20260601:20260630+@9@%PDF-1.7 +Abschluss+Konditionen+Werbung+DE991234567123456+BANK12+Muster+++@4@abcd'");
+        expect(segment.booked).toBe('%PDF-1.7 ');
+        expect(segment.closingInfo).toBe('Abschluss');
+        expect(segment.advertisement).toBe('Werbung');
+        expect(segment.iban).toBe('DE991234567123456');
+        expect(segment.date).toBeUndefined();
+        expect(segment.year).toBeUndefined();
+        expect(segment.number).toBeUndefined();
+        expect(segment.receipt).toBe('abcd');
+    });
+    it('decodes a version 1 response, which has no iban/bic/name', () => {
+        const segment = decode("HIEKA:5:1+3+20260601:20260630+@9@%PDF-1.7 +Abschluss+Konditionen+Werbung+@4@abcd'");
+        expect(segment.booked).toBe('%PDF-1.7 ');
+        expect(segment.advertisement).toBe('Werbung');
+        expect(segment.iban).toBeUndefined();
+        expect(segment.receipt).toBe('abcd');
+    });
+});
+describe('HIEKAS v5', () => {
+    it('decode and encode roundtrip matches', () => {
+        const text = "HIEKAS:4:5:4+1+1+0+J:N:J:1:3'";
+        const segment = decode(text);
+        expect(segment.params.indexAllowed).toBe(true);
+        expect(segment.params.receiptRequired).toBe(false);
+        expect(segment.params.maxEntryCountAllowed).toBe(true);
+        expect(segment.params.supportedFormats).toEqual(['1', '3']);
+        expect(encode(segment)).toBe(text);
+    });
+});
+describe('binary payloads', () => {
+    // A PDF contains every character FinTS uses structurally: + and ' as separators,
+    // @ for binary markers, ? for escaping. Only the declared length keeps them apart
+    // from real syntax.
+    it('carries a payload containing FinTS control characters through unharmed', () => {
+        const pdf = "%PDF-1.7\n+ ' @ ? +++ '''\nstartxref\n%%EOF";
+        const text = `HIEKA:5:5:3+3+20260601:20260630+20260701+2026+7+@${pdf.length}@${pdf}+++++++++`;
+        const segment = decode(`${text}'`);
+        expect(segment.booked).toBe(pdf);
+        expect(segment.number).toBe(7);
+    });
+    it('honours the declared length instead of reading to the end of the field', () => {
+        // Some banks pad a binary field; the declared length is what counts.
+        const pdf = '%PDF-1.7 ';
+        const segment = decode(`HIEKA:5:5:3+3+20260601:20260630+20260701+2026+7+@${pdf.length}@${pdf}\u0000+++++++++'`);
+        expect(segment.booked).toBe(pdf);
+        expect(segment.booked).not.toContain('\u0000');
+    });
+});
+describe('ElectronicStatementInteraction', () => {
+    const pdf = '%PDF-1.7 fake';
+    function messageWith(hieka, continuation) {
+        const answers = continuation
+            ? `HIRMG:3:2+0010::Entgegengenommen.+3040::Es liegen weitere Dokumente vor.:${continuation}'`
+            : "HIRMG:3:2+0010::Entgegengenommen.'";
+        return Message.decode(`${answers}${hieka}`);
+    }
+    function hiekaText(booked) {
+        return (`HIEKA:5:5:3+3+20260601:20260630+20260701+2026+7+@${booked.length}@${booked}` +
+            `+Abschluss+Konditionen+Werbung+DE991234567123456+BANK12+Muster+GmbH++@4@abcd'`);
+    }
+    function handle(message) {
+        const interaction = new ElectronicStatementInteraction('123');
+        const clientResponse = { bankAnswers: message.getBankAnswers() };
+        interaction.handleResponse(message, clientResponse);
+        return clientResponse;
+    }
+    it('maps the response onto a statement', () => {
+        const response = handle(messageWith(hiekaText(pdf)));
+        expect(response.statements).toHaveLength(1);
+        const statement = response.statements[0];
+        expect(statement.format).toBe(StatementFormat.PDF);
+        expect(statement.year).toBe(2026);
+        expect(statement.number).toBe(7);
+        expect(statement.from).toEqual(new Date('2026-06-01'));
+        expect(statement.iban).toBe('DE991234567123456');
+        expect(statement.accountName).toBe('Muster GmbH');
+        expect(statement.receipt).toBe('abcd');
+        expect(Buffer.from(statement.document).toString('latin1')).toBe(pdf);
+    });
+    it('reports the offset of a waiting successor and nothing otherwise', () => {
+        expect(handle(messageWith(hiekaText(pdf), 'AUFSETZ_1')).nextOffset).toBe('AUFSETZ_1');
+        expect(handle(messageWith(hiekaText(pdf))).nextOffset).toBeUndefined();
+    });
+    it('collects every statement the response carries', () => {
+        const message = messageWith(`${hiekaText(pdf)}${hiekaText('%PDF-1.7 second')}`);
+        expect(handle(message).statements).toHaveLength(2);
+    });
+    it('unwraps a base64 wrapped document, but only when it proves to be one', () => {
+        const wrapped = Buffer.from(pdf, 'latin1').toString('base64');
+        const unwrapped = handle(messageWith(hiekaText(wrapped))).statements[0].document;
+        expect(Buffer.from(unwrapped).toString('latin1')).toBe(pdf);
+        // Base64-looking text that does NOT decode to a document must survive untouched.
+        const notADocument = 'SGVsbG8gV29ybGQ=';
+        const kept = handle(messageWith(hiekaText(notADocument))).statements[0].document;
+        expect(Buffer.from(kept).toString('latin1')).toBe(notADocument);
+    });
+});

package/dist/tests/accountDescriptor.test.js

@@ -0,0 +1,99 @@
+import { describe, expect, it } from 'vitest';
+import { internationalAccount, nationalAccount } from '../accountDescriptor.js';
+import { AccountType } from '../bankAccount.js';
+import { Language } from '../codes.js';
+import { FinTSConfig } from '../config.js';
+const account = {
+    accountNumber: '1234567890',
+    subAccountId: 'Girokonto',
+    bank: { country: 280, bankId: '10020030' },
+    iban: 'DE89370400440532013000',
+    bic: 'BANKDEFFXXX',
+    customerId: 'customer1',
+    accountType: AccountType.CheckingAccount,
+    currency: 'EUR',
+    holder1: 'Test User',
+};
+const depot = {
+    ...account,
+    accountNumber: '9876543210',
+    iban: undefined,
+    bic: undefined,
+};
+function configWith(allowedTransactions) {
+    return FinTSConfig.fromBankingInformation('product', '1.0', {
+        systemId: 'SYSTEM01',
+        bpd: {
+            version: 1,
+            url: 'https://bank.example.com/fints',
+            countryCode: 280,
+            bankId: '10020030',
+            bankName: 'Example Bank',
+            allowedTransactions,
+            maxTransactionsPerMessage: 1,
+            supportedLanguages: [Language.German],
+            supportedHbciVersions: [300],
+            supportedTanMethods: [],
+            availableTanMethodIds: [],
+        },
+        upd: { version: 1, usage: 0, bankAccounts: [account, depot] },
+        bankMessages: [],
+    });
+}
+const hispas = (nationalAccountAllowed) => ({
+    transId: 'HKSPA',
+    versions: [1],
+    tanRequired: false,
+    params: {
+        individualAccountRetrievalAllowed: false,
+        nationalAccountAllowed,
+        structuredPurposeAllowed: false,
+    },
+});
+describe('nationalAccount', () => {
+    it('carries the three fields the data group has, and nothing else', () => {
+        expect(nationalAccount(account)).toEqual({
+            accountNumber: '1234567890',
+            subAccountId: 'Girokonto',
+            bank: { country: 280, bankId: '10020030' },
+        });
+    });
+});
+describe('internationalAccount', () => {
+    it('leaves the national fields out when the bank forbids them', () => {
+        const descriptor = internationalAccount(configWith([hispas(false)]), account);
+        expect(descriptor).toEqual({ iban: 'DE89370400440532013000', bic: 'BANKDEFFXXX' });
+    });
+    it('includes the national fields when the bank allows them', () => {
+        const descriptor = internationalAccount(configWith([hispas(true)]), account);
+        expect(descriptor).toEqual({
+            iban: 'DE89370400440532013000',
+            bic: 'BANKDEFFXXX',
+            accountNumber: '1234567890',
+            subAccountId: 'Girokonto',
+            bank: { country: 280, bankId: '10020030' },
+        });
+    });
+    it('keeps them when the bank announces no HISPAS at all', () => {
+        // Silence is not a refusal. Only a bank that says false gets the shorter form,
+        // so a bank working today cannot regress on a rule it never stated — see #25,
+        // where Postbank required the national fields for identification.
+        const descriptor = internationalAccount(configWith([]), account);
+        expect(descriptor).toEqual({
+            iban: 'DE89370400440532013000',
+            bic: 'BANKDEFFXXX',
+            accountNumber: '1234567890',
+            subAccountId: 'Girokonto',
+            bank: { country: 280, bankId: '10020030' },
+        });
+    });
+    it('keeps the national fields for an account without an IBAN, whatever the flag says', () => {
+        // A securities account typically has none, and nothing else identifies it.
+        const descriptor = internationalAccount(configWith([hispas(false)]), depot);
+        expect(descriptor).toEqual({
+            accountNumber: '9876543210',
+            subAccountId: 'Girokonto',
+            bank: { country: 280, bankId: '10020030' },
+        });
+    });
+});

package/dist/tests/accountReference.test.js

@@ -0,0 +1,126 @@
+import { describe, expect, it } from 'vitest';
+import { AccountType, describeAccount } from '../bankAccount.js';
+import { Language } from '../codes.js';
+import { FinTSConfig } from '../config.js';
+import { HKSAL } from '../segments/HKSAL.js';
+import { HKWPD } from '../segments/HKWPD.js';
+// A bank that gives a securities account and the current account it settles through
+// the same number, distinguishing them only by sub-account id. That is within the
+// specification: FinTS identifies an account by both together.
+const checkingAccount = {
+    accountNumber: '1234567890',
+    subAccountId: 'Girokonto',
+    bank: { country: 280, bankId: '10020030' },
+    iban: 'DE89370400440532013000',
+    bic: 'BANKDEFFXXX',
+    customerId: 'customer1',
+    accountType: AccountType.Miscellaneous,
+    currency: 'EUR',
+    holder1: 'Test User',
+    allowedTransactions: [{ transId: HKSAL.Id, numSignatures: 0 }],
+};
+const securitiesAccount = {
+    ...checkingAccount,
+    subAccountId: 'Depot',
+    iban: undefined,
+    bic: undefined,
+    allowedTransactions: [{ transId: HKWPD.Id, numSignatures: 0 }],
+};
+const singleAccount = {
+    ...checkingAccount,
+    accountNumber: '5555555555',
+    subAccountId: undefined,
+};
+function configWith(accounts) {
+    return FinTSConfig.fromBankingInformation('product', '1.0', {
+        systemId: 'SYSTEM01',
+        bpd: {
+            version: 1,
+            url: 'https://bank.example.com/fints',
+            countryCode: 280,
+            bankId: '10020030',
+            bankName: 'Example Bank',
+            allowedTransactions: [],
+            maxTransactionsPerMessage: 1,
+            supportedLanguages: [Language.German],
+            supportedHbciVersions: [300],
+            supportedTanMethods: [],
+            availableTanMethodIds: [],
+        },
+        upd: { version: 1, usage: 0, bankAccounts: accounts },
+        bankMessages: [],
+    });
+}
+describe('addressing an account by number', () => {
+    it('resolves a number that only one account has', () => {
+        const config = configWith([checkingAccount, singleAccount]);
+        expect(config.getBankAccount('5555555555').subAccountId).toBeUndefined();
+    });
+    it('refuses a number two accounts share, instead of picking one', () => {
+        // Picking the first is what makes the failure invisible: a balance comes back,
+        // it is the other account's, and nothing in the response says so.
+        const config = configWith([checkingAccount, securitiesAccount]);
+        expect(() => config.getBankAccount('1234567890')).toThrow(/not unique/);
+    });
+    it('names the sub-account ids, so the caller can tell them apart', () => {
+        const config = configWith([checkingAccount, securitiesAccount]);
+        expect(() => config.getBankAccount('1234567890')).toThrow(/Girokonto, Depot/);
+    });
+    it('still says so when the number matches nothing', () => {
+        expect(() => configWith([checkingAccount]).getBankAccount('0000000000')).toThrow(/not found in UPD/);
+    });
+});
+describe('addressing an account by the account itself', () => {
+    it('reaches the one a shared number cannot', () => {
+        const config = configWith([checkingAccount, securitiesAccount]);
+        expect(config.getBankAccount(securitiesAccount).subAccountId).toBe('Depot');
+        expect(config.getBankAccount(checkingAccount).subAccountId).toBe('Girokonto');
+    });
+    it('decides what that account may do, not what the other one may', () => {
+        const config = configWith([checkingAccount, securitiesAccount]);
+        expect(config.isAccountTransactionSupported(securitiesAccount, HKWPD.Id)).toBe(true);
+        expect(config.isAccountTransactionSupported(checkingAccount, HKWPD.Id)).toBe(false);
+        expect(config.isAccountTransactionSupported(checkingAccount, HKSAL.Id)).toBe(true);
+    });
+    it('resolves against the UPD rather than trusting what it was handed', () => {
+        // A caller may hold an account from a persisted earlier session. The entry the
+        // bank sent this time is the one carrying the current allowed transactions.
+        const staleAccount = { ...securitiesAccount, allowedTransactions: [] };
+        const config = configWith([checkingAccount, securitiesAccount]);
+        expect(config.isAccountTransactionSupported(staleAccount, HKWPD.Id)).toBe(true);
+    });
+    it('refuses an account the bank did not report', () => {
+        const config = configWith([checkingAccount]);
+        const unreportedAccount = { ...checkingAccount, subAccountId: 'Sparkonto' };
+        expect(() => config.getBankAccount(unreportedAccount)).toThrow(/not found in UPD/);
+    });
+});
+describe('naming an account in an error', () => {
+    it('reads as the number alone where that is all there is', () => {
+        expect(describeAccount('1234567890')).toBe('1234567890');
+        expect(describeAccount(singleAccount)).toBe('5555555555');
+    });
+    it('adds the sub-account id where there is one', () => {
+        // Otherwise an account passed as an object prints as [object Object].
+        expect(describeAccount(securitiesAccount)).toBe('1234567890 (Depot)');
+    });
+});
+describe('matching an account the bank itself named', () => {
+    it('uses the sub-account id where the bank repeated it', () => {
+        const config = configWith([checkingAccount, securitiesAccount]);
+        expect(config.matchBankAccount({ accountNumber: '1234567890', subAccountId: 'Depot' })?.subAccountId).toBe('Depot');
+    });
+    it('still finds an account whose number only it has, sub-account id or not', () => {
+        // Banks are not consistent about repeating it, and a number only one account
+        // has identifies that account either way.
+        const config = configWith([checkingAccount, singleAccount]);
+        expect(config.matchBankAccount({ accountNumber: '5555555555' })?.accountNumber).toBe('5555555555');
+    });
+    it('gives up quietly where it cannot tell, rather than throwing', () => {
+        // This runs for entries the bank supplied — HISPA travels with every dialog —
+        // so throwing here would fail every request at a bank that shares numbers,
+        // before any of them reached its order. That is exactly what happened once.
+        const config = configWith([checkingAccount, securitiesAccount]);
+        expect(config.matchBankAccount({ accountNumber: '1234567890' })).toBeUndefined();
+    });
+});

package/dist/tests/interactionAccountDescriptor.test.js

@@ -0,0 +1,153 @@
+import { describe, expect, it } from 'vitest';
+import { AccountType } from '../bankAccount.js';
+import { Language } from '../codes.js';
+import { FinTSConfig } from '../config.js';
+import { BalanceInteraction } from '../interactions/balanceInteraction.js';
+import { ElectronicStatementInteraction } from '../interactions/electronicStatementInteraction.js';
+import { PortfolioInteraction } from '../interactions/portfolioInteraction.js';
+import { StatementInteractionCAMT } from '../interactions/statementInteractionCAMT.js';
+import { StatementInteractionMT940 } from '../interactions/statementInteractionMT940.js';
+import { registerSegments } from '../segments/registry.js';
+registerSegments();
+// The layer between "the segment encodes correctly" and "the client picks the right
+// interaction": what an interaction puts into the account connection. Nothing
+// covered it before — the segment tests build their account by hand, and the client
+// tests mock `Dialog.start`, which throws the built request away.
+const GIRO = '1234567890';
+const DEPOT = '9876543210';
+const BANK = { country: 280, bankId: '10020030' };
+const IBAN = 'DE89370400440532013000';
+const konto = (accountNumber, transIds, iban) => ({
+    accountNumber,
+    subAccountId: 'Girokonto',
+    bank: BANK,
+    iban,
+    bic: iban ? 'BANKDEFFXXX' : undefined,
+    customerId: 'customer1',
+    accountType: AccountType.CheckingAccount,
+    currency: 'EUR',
+    holder1: 'Test User',
+    allowedTransactions: transIds.map((transId) => ({ transId, numSignatures: 1 })),
+});
+function configFor(transactions, nationalAccountAllowed) {
+    const allowedTransactions = Object.entries(transactions).map(([transId, versions]) => ({ transId, versions, tanRequired: false }));
+    if (nationalAccountAllowed !== undefined) {
+        allowedTransactions.push({
+            transId: 'HKSPA',
+            versions: [1],
+            tanRequired: false,
+            params: {
+                individualAccountRetrievalAllowed: false,
+                nationalAccountAllowed,
+                structuredPurposeAllowed: false,
+            },
+        });
+    }
+    return FinTSConfig.fromBankingInformation('product', '1.0', {
+        systemId: 'SYSTEM01',
+        bpd: {
+            version: 1,
+            url: 'https://bank.example.com/fints',
+            countryCode: 280,
+            bankId: '10020030',
+            bankName: 'Example Bank',
+            allowedTransactions,
+            maxTransactionsPerMessage: 1,
+            supportedLanguages: [Language.German],
+            supportedHbciVersions: [300],
+            supportedTanMethods: [],
+            availableTanMethodIds: [],
+        },
+        upd: {
+            version: 1,
+            usage: 0,
+            bankAccounts: [
+                konto(GIRO, ['HKSAL', 'HKKAZ', 'HKCAZ', 'HKEKA'], IBAN),
+                konto(DEPOT, ['HKWPD'], undefined),
+            ],
+        },
+        bankMessages: [],
+    });
+}
+// biome-ignore lint/suspicious/noExplicitAny: reading one field off a built segment
+const account = (segment) => segment.account;
+describe('HKCAZ — international at every version', () => {
+    it('sends IBAN and BIC only when the bank forbids the national fields', () => {
+        const config = configFor({ HKCAZ: [1] }, false);
+        const [hkcaz] = new StatementInteractionCAMT(GIRO).createSegments(config);
+        expect(account(hkcaz)).toEqual({ iban: IBAN, bic: 'BANKDEFFXXX' });
+    });
+    it('sends both halves when the bank allows them', () => {
+        const config = configFor({ HKCAZ: [1] }, true);
+        const [hkcaz] = new StatementInteractionCAMT(GIRO).createSegments(config);
+        expect(account(hkcaz)).toEqual({
+            iban: IBAN,
+            bic: 'BANKDEFFXXX',
+            accountNumber: GIRO,
+            subAccountId: 'Girokonto',
+            bank: BANK,
+        });
+    });
+});
+describe('HKSAL — national up to version 6, international from 7', () => {
+    it('sends the national form at version 6, with no IBAN', () => {
+        const [hksal] = new BalanceInteraction(GIRO).createSegments(configFor({ HKSAL: [6] }, false));
+        expect(account(hksal)).toEqual({ accountNumber: GIRO, subAccountId: 'Girokonto', bank: BANK });
+    });
+    it('honours the flag at version 7 instead of filling both halves', () => {
+        const [hksal] = new BalanceInteraction(GIRO).createSegments(configFor({ HKSAL: [7] }, false));
+        expect(account(hksal)).toEqual({ iban: IBAN, bic: 'BANKDEFFXXX' });
+    });
+});
+describe('HKKAZ — national up to version 6, international from 7', () => {
+    it('sends the national form at version 6', () => {
+        const [hkkaz] = new StatementInteractionMT940(GIRO).createSegments(configFor({ HKKAZ: [6] }, false));
+        expect(account(hkkaz)).toEqual({ accountNumber: GIRO, subAccountId: 'Girokonto', bank: BANK });
+    });
+    it('honours the flag at version 7', () => {
+        const [hkkaz] = new StatementInteractionMT940(GIRO).createSegments(configFor({ HKKAZ: [7] }, false));
+        expect(account(hkkaz)).toEqual({ iban: IBAN, bic: 'BANKDEFFXXX' });
+    });
+});
+describe('HKEKA — national up to version 3, international from 4', () => {
+    it('sends the national form at version 3', () => {
+        const [hkeka] = new ElectronicStatementInteraction(GIRO, {}).createSegments(configFor({ HKEKA: [3] }, false));
+        expect(account(hkeka)).toEqual({ accountNumber: GIRO, subAccountId: 'Girokonto', bank: BANK });
+    });
+    it('honours the flag at version 4', () => {
+        const [hkeka] = new ElectronicStatementInteraction(GIRO, {}).createSegments(configFor({ HKEKA: [4] }, false));
+        expect(account(hkeka)).toEqual({ iban: IBAN, bic: 'BANKDEFFXXX' });
+    });
+});
+describe('HKWPD — national at every version', () => {
+    it('sends the national form, and the depot has no IBAN to send anyway', () => {
+        const [hkwpd] = new PortfolioInteraction(DEPOT).createSegments(configFor({ HKWPD: [5] }, false));
+        // biome-ignore lint/suspicious/noExplicitAny: reading one field off a built segment
+        expect(hkwpd.depot).toEqual({
+            accountNumber: DEPOT,
+            subAccountId: 'Girokonto',
+            bank: BANK,
+        });
+    });
+});
+// The two banks that pulled this in opposite directions. #19/#20 reduced the CAMT
+// descriptor to IBAN and BIC because comdirect rejects anything more; #25 reported
+// Postbank answering "Angaben zur nationalen Kontoverbindung für Identifikation
+// erforderlich", and the reduction was reverted. Neither bank was wrong, and neither
+// fix could hold, because the choice was hard-coded either way. It is data now.
+describe('the two banks that pulled this in opposite directions', () => {
+    it('a bank refusing the national fields gets IBAN and BIC only', () => {
+        const [hkcaz] = new StatementInteractionCAMT(GIRO).createSegments(configFor({ HKCAZ: [1] }, false));
+        expect(account(hkcaz)).toEqual({ iban: IBAN, bic: 'BANKDEFFXXX' });
+    });
+    it('a bank that says nothing keeps them, so nothing working today regresses', () => {
+        const [hkcaz] = new StatementInteractionCAMT(GIRO).createSegments(configFor({ HKCAZ: [1] }));
+        expect(account(hkcaz)).toEqual({
+            iban: IBAN,
+            bic: 'BANKDEFFXXX',
+            accountNumber: GIRO,
+            subAccountId: 'Girokonto',
+            bank: BANK,
+        });
+    });
+});

package/dist/tests/message.test.js

@@ -77,4 +77,22 @@ describe('CustomerMessage', () => {
         const encodedMessage = customerMessage.encode();
         const _message = Message.decode(encodedMessage);
     });
+    it('encrypts with the security profile version of the signature (two-step: PIN:2)', () => {
+        const customerMessage = new CustomerMessage('0', 1);
+        customerMessage.addSegment(hkidn);
+        customerMessage.addSegment(hkvvb);
+        customerMessage.sign(280, '12030000', '12345678', '123', '0', 900, '12345');
+        const encodedMessage = customerMessage.encode();
+        expect(encodedMessage).toContain("'HNVSK:998:3+PIN:2+998+");
+        expect(encodedMessage).toContain('HNSHK:2:4+PIN:2+900+');
+    });
+    it('encrypts with the security profile version of the signature (one-step: PIN:1)', () => {
+        const customerMessage = new CustomerMessage('0', 1);
+        customerMessage.addSegment(hkidn);
+        customerMessage.addSegment(hkvvb);
+        customerMessage.sign(280, '12030000', '12345678', '123', '0');
+        const encodedMessage = customerMessage.encode();
+        expect(encodedMessage).toContain("'HNVSK:998:3+PIN:1+998+");
+        expect(encodedMessage).toContain('HNSHK:2:4+PIN:1+999+');
+    });
 });