fix: HKWPD v6 depot requests use IBAN-based account format + add FinTS 4 holdings support

[Copilot]

Two related changes: a bug fix for ING-DiBa depot queries failing with 9050/9210 errors, and new depot/holdings support in the FinTS 4 XML client.

Bug fix: HKWPD version 6 account format

HKWPD (Depotaufstellung) used the legacy KTV format (accountNumber::280:blz) for both v5 and v6. The FinTS 3.0 spec requires version 6 to use the KTIN international format (iban:bic:accountNumber::280:blz) — the same pattern HKSAL v7 and HKKAZ v7 already follow.

ING-DiBa advertises HIWPDS v6. Sending KTV to a v6 endpoint caused:

[9050] Nachrichtensignatur fehlerhaft oder fehlt
[9210] Diese Auftragsart ist mit diesem Konto nicht möglich

Fix in hkwpd.ts:

const serializedAccount =
    version === 6
        ? [iban, bic, accountNumber, subAccount, String(COUNTRY_CODE), blz]  // KTIN
        : [accountNumber, subAccount, String(COUNTRY_CODE), blz];             // KTV

New test-hkwpd.ts covers both serialization paths.

FinTS 4 holdings support

The FinTS 4 XML client (FinTS4Client) had no equivalent of the v3 holdings() method — supportsHoldings was hardcoded false.

• buildHoldingsSegment() — new XML segment builder (type Holdings, analogous to v3 HKWPD)
• FinTS4Response.mt535Data — populated from <Mt535Data> in a Holdings response segment
• FinTS4Dialog — new supportsHoldings / holdingsVersion properties; updateCapabilities() detects Holdings or HIWPDS in BPD
• FinTS4Client.holdings(account) — pagination-aware, reuses the existing MT535Parser, throws when capability is absent
• Mock bank server and test data extended with Holdings handler + synthetic MT535 depot fixture

[Copilot]

Pull request overview

Fixes FinTS 3 HKWPD v6 depot-request serialization for IBAN-based KTIN accounts and adds end-to-end holdings (MT535) support to the FinTS 4.1 XML client, including mock server + tests.

Changes:

• Adjust HKWPD v6 account serialization to KTIN (IBAN/BIC-based) and add coverage for v5 vs v6 serialization.
• Add FinTS 4.1 holdings support: segment builder, capability detection, response parsing (mt535Data), and a new FinTS4Client.holdings() API.
• Extend FinTS 4.1 mock server/test data and update docs formatting.

Reviewed changes

Copilot reviewed 15 out of 16 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
packages/fints/src/v4/xml-parser.ts	Parses <Mt535Data> from Holdings response segments into mt535Data.
packages/fints/src/v4/types.ts	Adds mt535Data?: string to FinTS4Response.
packages/fints/src/v4/test-server/test-data.ts	Adds depot account fixtures, holdings capabilities, and an MT535 fixture generator.
packages/fints/src/v4/test-server/mock-bank-server.ts	Adds Holdings request handling and returns MT535 payloads.
packages/fints/src/v4/segments/index.ts	Adds buildHoldingsSegment() request builder.
packages/fints/src/v4/index.ts	Exports buildHoldingsSegment.
packages/fints/src/v4/dialog.ts	Tracks holdings support/version via segment capabilities and exposes via capabilities.
packages/fints/src/v4/client.ts	Introduces FinTS4Client.holdings() with touchdown pagination and MT535 parsing.
packages/fints/src/v4/tests/test-segments.ts	Unit tests for the new Holdings segment builder.
packages/fints/src/v4/tests/test-mock-bank-integration.ts	Integration tests covering holdings response parsing + capabilities.
packages/fints/src/v4/tests/test-client.ts	Client-level tests for holdings parsing and unsupported-bank behavior.
packages/fints/src/segments/hkwpd.ts	Switches HKWPD v6 to KTIN serialization while keeping v5 as KTV.
packages/fints/src/segments/tests/test-hkwpd.ts	New tests verifying HKWPD v5 vs v6 serialization formats.
packages/fints/README.md	Formatting tweaks to code examples.
README.md	Formatting tweaks to code examples and troubleshooting section spacing.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The holdings integration test uses TEST_ACCOUNTS[0] (a giro account) as the target for a depot/holdings query. Since this feature is explicitly for depot accounts and you introduced TEST_DEPOT_ACCOUNTS, it would be better to use a depot account fixture here to ensure the test exercises the intended account type and the new depot data path.

[larsdecker]

@copilot apply changes based on the comments in this thread

[Copilot]

@copilot apply changes based on the comments in this thread

Both review comments addressed in commit 541f7f2:

1. TAN segment in holdings() — added buildTanSegment (process "4", segmentReference "Holdings") on the first request when dialog.tanVersion >= 1 && dialog.tanMethods.length > 0, matching the pattern in camtStatements().

2. Depot account fixture in integration test — switched TEST_ACCOUNTS[0] to TEST_DEPOT_ACCOUNTS[0] (Wertpapierdepot, IBAN DE12345678901234567890) and imported TEST_DEPOT_ACCOUNTS in the test file.