@festapp/banksync 0.0.0-bootstrap.20260831

package/dist/cloudflare.d.cts

@@ -0,0 +1,84 @@
+import { D1Database, Queue, R2Bucket, ForwardableEmailMessage, ExecutionContext, MessageBatch, ScheduledEvent } from '@cloudflare/workers-types';
+import { W as WebhookEnvelope } from './types-Cb5l2lXq.cjs';
+
+interface EmailEnvelopeEvidence {
+    mailFrom: string;
+    rcptTo: string;
+    authenticationResults: string | null;
+    trustedAuthservId: string;
+}
+
+interface VersionedSecretEnv {
+    ENCRYPTION_KEY_VERSION?: string;
+    [key: `ENCRYPTION_KEY_V${number}`]: string | undefined;
+}
+
+interface WebhookQueueMessage {
+    message_version: 2;
+    delivery_job_id: number;
+    delivery_id: string;
+    consumer_app_id: string;
+    event_kind?: string;
+    bank_account_id: number;
+    transaction_id: number;
+    generation: number;
+    dispatch_token: string;
+    envelope: WebhookEnvelope;
+}
+
+interface Env extends VersionedSecretEnv {
+    DB: D1Database;
+    WEBHOOK_QUEUE: Queue<WebhookQueueMessage>;
+    API_SYNC_QUEUE?: Queue<ApiSyncQueueMessage>;
+    ADMIN_SECRET: string;
+    WEBHOOK_KEK: string;
+    ENCRYPTION_KEY_VERSION?: string;
+    ENCRYPTION_KEY_V1?: string;
+    FIO_MIN_INTERVAL_S?: string;
+    /**
+     * Fio egress proxy. Cloudflare Workers cannot reach fioapi.fio.cz (HTTP 525
+     * TLS handshake fail). When set, Fio pulls are relayed through this edge
+     * function (running on a non-Cloudflare fixed IP). FIO_PROXY_URL is a plain
+     * var; FIO_PROXY_SECRET is a wrangler secret. Both unset → direct Fio fetch.
+     */
+    FIO_PROXY_URL?: string;
+    FIO_PROXY_SECRET?: string;
+    /** comma-separated emails like 'noreply@fio.cz,info@airbank.cz' */
+    SENDER_ALLOWLIST: string;
+    /** 'production' | 'development' — gates POST /__test/email */
+    ENV?: string;
+    /** CF API token w/ Zone:Email Routing Rules:Edit. When unset, banksync skips CF sync (dev mode). */
+    CF_API_TOKEN?: string;
+    /** CF zone id where Email Routing rules live. */
+    CF_ZONE_ID?: string;
+    /** Subdomain hosting bank-* receivers (e.g. banksync.festapp.net). */
+    BANKSYNC_DOMAIN?: string;
+    /** Slack/Discord incoming webhook for alerter. Undefined → alerter disabled. Set via wrangler secret put. */
+    ALERT_WEBHOOK_URL?: string;
+    /** Bearer credential for an internal alert-ingest endpoint. */
+    ALERT_WEBHOOK_SECRET?: string;
+    /** R2 bucket binding for weekly SQL backup. Undefined → backup disabled. */
+    BACKUPS?: R2Bucket;
+    /** Trusted authserv-id observed and verified from Cloudflare Email Routing. */
+    EMAIL_AUTHSERV_ID?: string;
+    /** Exact comma-separated callback hostnames allowed in production. */
+    CALLBACK_HOST_ALLOWLIST?: string;
+    /** Active application-layer backup key version. */
+    BACKUP_ENCRYPTION_KEY_VERSION?: string;
+    BACKUP_ENCRYPTION_KEY_V1?: string;
+    BACKUP_ENCRYPTION_KEY_V2?: string;
+}
+interface ApiSyncQueueMessage {
+    kind: 'api_sync_tick';
+    source: 'cron' | 'self';
+    enqueued_at: string;
+}
+declare function processEmail(rawStream: ReadableStream<Uint8Array>, env: Env, envelope: EmailEnvelopeEvidence): Promise<void>;
+declare const _default: {
+    email(message: ForwardableEmailMessage, env: Env, _ctx: ExecutionContext): Promise<void>;
+    fetch(req: Request, env: Env, _ctx: ExecutionContext): Promise<Response>;
+    queue(batch: MessageBatch<unknown>, env: Env, _ctx: ExecutionContext): Promise<void>;
+    scheduled(event: ScheduledEvent, env: Env, _ctx: ExecutionContext): Promise<void>;
+};
+
+export { type Env, _default as default, processEmail };

package/dist/cloudflare.d.ts

@@ -0,0 +1,84 @@
+import { D1Database, Queue, R2Bucket, ForwardableEmailMessage, ExecutionContext, MessageBatch, ScheduledEvent } from '@cloudflare/workers-types';
+import { W as WebhookEnvelope } from './types-Cb5l2lXq.js';
+
+interface EmailEnvelopeEvidence {
+    mailFrom: string;
+    rcptTo: string;
+    authenticationResults: string | null;
+    trustedAuthservId: string;
+}
+
+interface VersionedSecretEnv {
+    ENCRYPTION_KEY_VERSION?: string;
+    [key: `ENCRYPTION_KEY_V${number}`]: string | undefined;
+}
+
+interface WebhookQueueMessage {
+    message_version: 2;
+    delivery_job_id: number;
+    delivery_id: string;
+    consumer_app_id: string;
+    event_kind?: string;
+    bank_account_id: number;
+    transaction_id: number;
+    generation: number;
+    dispatch_token: string;
+    envelope: WebhookEnvelope;
+}
+
+interface Env extends VersionedSecretEnv {
+    DB: D1Database;
+    WEBHOOK_QUEUE: Queue<WebhookQueueMessage>;
+    API_SYNC_QUEUE?: Queue<ApiSyncQueueMessage>;
+    ADMIN_SECRET: string;
+    WEBHOOK_KEK: string;
+    ENCRYPTION_KEY_VERSION?: string;
+    ENCRYPTION_KEY_V1?: string;
+    FIO_MIN_INTERVAL_S?: string;
+    /**
+     * Fio egress proxy. Cloudflare Workers cannot reach fioapi.fio.cz (HTTP 525
+     * TLS handshake fail). When set, Fio pulls are relayed through this edge
+     * function (running on a non-Cloudflare fixed IP). FIO_PROXY_URL is a plain
+     * var; FIO_PROXY_SECRET is a wrangler secret. Both unset → direct Fio fetch.
+     */
+    FIO_PROXY_URL?: string;
+    FIO_PROXY_SECRET?: string;
+    /** comma-separated emails like 'noreply@fio.cz,info@airbank.cz' */
+    SENDER_ALLOWLIST: string;
+    /** 'production' | 'development' — gates POST /__test/email */
+    ENV?: string;
+    /** CF API token w/ Zone:Email Routing Rules:Edit. When unset, banksync skips CF sync (dev mode). */
+    CF_API_TOKEN?: string;
+    /** CF zone id where Email Routing rules live. */
+    CF_ZONE_ID?: string;
+    /** Subdomain hosting bank-* receivers (e.g. banksync.festapp.net). */
+    BANKSYNC_DOMAIN?: string;
+    /** Slack/Discord incoming webhook for alerter. Undefined → alerter disabled. Set via wrangler secret put. */
+    ALERT_WEBHOOK_URL?: string;
+    /** Bearer credential for an internal alert-ingest endpoint. */
+    ALERT_WEBHOOK_SECRET?: string;
+    /** R2 bucket binding for weekly SQL backup. Undefined → backup disabled. */
+    BACKUPS?: R2Bucket;
+    /** Trusted authserv-id observed and verified from Cloudflare Email Routing. */
+    EMAIL_AUTHSERV_ID?: string;
+    /** Exact comma-separated callback hostnames allowed in production. */
+    CALLBACK_HOST_ALLOWLIST?: string;
+    /** Active application-layer backup key version. */
+    BACKUP_ENCRYPTION_KEY_VERSION?: string;
+    BACKUP_ENCRYPTION_KEY_V1?: string;
+    BACKUP_ENCRYPTION_KEY_V2?: string;
+}
+interface ApiSyncQueueMessage {
+    kind: 'api_sync_tick';
+    source: 'cron' | 'self';
+    enqueued_at: string;
+}
+declare function processEmail(rawStream: ReadableStream<Uint8Array>, env: Env, envelope: EmailEnvelopeEvidence): Promise<void>;
+declare const _default: {
+    email(message: ForwardableEmailMessage, env: Env, _ctx: ExecutionContext): Promise<void>;
+    fetch(req: Request, env: Env, _ctx: ExecutionContext): Promise<Response>;
+    queue(batch: MessageBatch<unknown>, env: Env, _ctx: ExecutionContext): Promise<void>;
+    scheduled(event: ScheduledEvent, env: Env, _ctx: ExecutionContext): Promise<void>;
+};
+
+export { type Env, _default as default, processEmail };