@festapp/banksync 0.0.0-bootstrap.20260831

package/dist/cloudflare.js

@@ -0,0 +1,3768 @@
+import {
+  FioRateLimited,
+  FioTransientFailure,
+  buildWebhookEnvelope,
+  detectProvider,
+  fetchNewTransactions,
+  mapFioTransaction,
+  parseEmail,
+  resolveVariableSymbol,
+  setFioPointer,
+  signWebhook
+} from "./chunk-5QXHZGAW.js";
+
+// src/mime.ts
+import PostalMime from "postal-mime";
+async function extractEmailBody(raw) {
+  const rawString = await new Response(raw).text();
+  const parsed = await PostalMime.parse(rawString);
+  const text = parsed.text ? parsed.text : parsed.html ? parsed.html.replace(/<[^>]*>/g, " ").replace(/\s+/g, " ").trim() : "";
+  const fromAddr = parsed.from && "address" in parsed.from && parsed.from.address ? parsed.from.address.toLowerCase() : void 0;
+  const toFirst = parsed.to?.[0];
+  const toAddr = toFirst && "address" in toFirst && toFirst.address ? toFirst.address.toLowerCase() : void 0;
+  return {
+    subject: parsed.subject,
+    text,
+    fromHeader: fromAddr,
+    toHeader: toAddr,
+    messageId: parsed.messageId
+  };
+}
+
+// src/email_classify.ts
+function extractPairingCode(toAddress) {
+  const m = toAddress.match(/^([0-9a-f]{4,32})@/i);
+  return m ? m[1].toLowerCase() : null;
+}
+function parseAllowlist(raw) {
+  return (raw ?? "").split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
+}
+function senderAllowed(from, allowlist) {
+  if (!from) return false;
+  const fromLc = from.toLowerCase();
+  const fromDomain = fromLc.includes("@") ? fromLc.slice(fromLc.indexOf("@") + 1) : "";
+  for (const entry of allowlist) {
+    if (entry.startsWith("@")) {
+      const dom = entry.slice(1);
+      if (fromDomain === dom || fromDomain.endsWith("." + dom)) return true;
+    } else if (fromLc === entry) {
+      return true;
+    }
+  }
+  return false;
+}
+function classifyEmail(extracted, identity, account, allowlist) {
+  if (!senderAllowed(identity.sender, allowlist)) {
+    return { kind: "reject", reason: "sender_not_allowed", bankAccountId: null, received: false };
+  }
+  const toAddress = identity.recipient;
+  const pairingCode = extractPairingCode(toAddress);
+  if (!pairingCode) {
+    return { kind: "reject", reason: `no_pairing_code: ${toAddress}`, bankAccountId: null, received: false };
+  }
+  if (!account) {
+    return { kind: "reject", reason: `unknown_pairing_code: ${pairingCode}`, bankAccountId: null, received: false };
+  }
+  if (account.ingest_mode === "api") {
+    return { kind: "reject", reason: "email_ingest_disabled", bankAccountId: account.id, received: false };
+  }
+  const provider = detectProvider(extracted.text, account.account_number);
+  if (provider === "unknown") {
+    return { kind: "reject", reason: `unknown_provider: ${account.account_number}`, bankAccountId: account.id, received: true };
+  }
+  let parsed;
+  try {
+    parsed = parseEmail(extracted.text, provider);
+  } catch (err) {
+    return { kind: "reject", reason: `${err}`.replace(/^Error:\s*/, ""), bankAccountId: account.id, received: true };
+  }
+  if (parsed === null) {
+    const looksLikeTransaction = /\d[\s.,]\d|Kč|CZK|EUR|USD/i.test(extracted.text);
+    return looksLikeTransaction ? { kind: "reject", reason: `parse_failed: ${provider}`, bankAccountId: account.id, received: true } : { kind: "skip", reason: `not_transaction: ${provider}`, bankAccountId: account.id, received: true };
+  }
+  return { kind: "insert", account, parsed, received: true };
+}
+
+// src/email_auth.ts
+var EmailAuthenticationError = class extends Error {
+  constructor(code) {
+    super(code);
+    this.code = code;
+    this.name = "EmailAuthenticationError";
+  }
+  code;
+};
+function inspectAuthenticationResults(value) {
+  const auth = value?.trim() ?? "";
+  const separator = auth.indexOf(";");
+  const candidate = separator >= 0 ? auth.slice(0, separator).trim().toLowerCase() : "";
+  const ambiguous = auth.includes(",");
+  const observedAuthservId = !ambiguous && candidate.length > 0 && candidate.length <= 253 && /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$/.test(candidate) ? candidate : null;
+  return { observedAuthservId, ambiguous };
+}
+function normalizeAddress(value) {
+  if (!value) return null;
+  const match = /<([^<>]+)>/.exec(value);
+  const normalized = (match?.[1] ?? value).trim().toLowerCase();
+  return /^[^\s@]+@[^\s@]+$/.test(normalized) ? normalized : null;
+}
+function addressDomain(address) {
+  return address.slice(address.lastIndexOf("@") + 1);
+}
+function aligned(child, parent) {
+  return child === parent || child.endsWith(`.${parent}`);
+}
+function resultDomain(fields, mechanism) {
+  const property = mechanism === "dkim" ? "header.d" : "header.from";
+  const mechanismFields = fields.filter((value) => new RegExp(`^${mechanism}\\s*=`, "i").test(value));
+  if (mechanismFields.length !== 1) return null;
+  const field = mechanismFields[0];
+  if (!new RegExp(`^${mechanism}\\s*=\\s*pass\\b`, "i").test(field)) return null;
+  const match = new RegExp(`(?:^|\\s)${property.replace(".", "\\.")}=([^\\s;,]+)`, "i").exec(field);
+  return match?.[1]?.toLowerCase().replace(/\.$/, "") ?? null;
+}
+function authenticateEmailIdentity(evidence, mime) {
+  const sender = normalizeAddress(evidence.mailFrom);
+  const recipient = normalizeAddress(evidence.rcptTo);
+  const headerSender = normalizeAddress(mime.fromHeader);
+  const headerRecipient = normalizeAddress(mime.toHeader);
+  if (!sender || !recipient || !headerSender || !headerRecipient) {
+    throw new EmailAuthenticationError("email_identity_missing");
+  }
+  if (sender !== headerSender || recipient !== headerRecipient) {
+    throw new EmailAuthenticationError("email_identity_mismatch");
+  }
+  const trusted = evidence.trustedAuthservId.trim().toLowerCase();
+  const auth = evidence.authenticationResults?.trim() ?? "";
+  if (!trusted || !auth) throw new EmailAuthenticationError("trusted_authentication_missing");
+  const inspection = inspectAuthenticationResults(auth);
+  if (inspection.ambiguous || inspection.observedAuthservId !== trusted) {
+    throw new EmailAuthenticationError("trusted_authentication_ambiguous");
+  }
+  const fields = auth.split(";").slice(1).map((value) => value.trim()).filter(Boolean);
+  const senderDomain = addressDomain(sender);
+  const dmarcDomain = resultDomain(fields, "dmarc");
+  if (dmarcDomain && aligned(senderDomain, dmarcDomain)) {
+    return { sender, recipient, authenticatedDomain: dmarcDomain, mechanism: "dmarc" };
+  }
+  const dkimDomain = resultDomain(fields, "dkim");
+  if (dkimDomain && aligned(senderDomain, dkimDomain)) {
+    return { sender, recipient, authenticatedDomain: dkimDomain, mechanism: "dkim" };
+  }
+  throw new EmailAuthenticationError("authenticated_sender_not_aligned");
+}
+
+// src/crypto.ts
+var IV_BYTES = 12;
+var MIN_PAYLOAD = IV_BYTES + 16;
+async function importAesGcmKey(b64, label) {
+  let bytes;
+  try {
+    const std = b64.replace(/-/g, "+").replace(/_/g, "/");
+    bytes = Uint8Array.from(atob(std), (c) => c.charCodeAt(0));
+  } catch {
+    throw new Error(`${label} must be 32 bytes (256 bits) base64-encoded`);
+  }
+  if (bytes.length !== 32) {
+    throw new Error(`${label} must be 32 bytes (256 bits) base64-encoded`);
+  }
+  return crypto.subtle.importKey("raw", bytes.buffer, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+}
+function toBase64(bytes) {
+  const CHUNK = 8192;
+  let out = "";
+  for (let i = 0; i < bytes.length; i += CHUNK) {
+    out += String.fromCharCode(...bytes.subarray(i, i + CHUNK));
+  }
+  return btoa(out);
+}
+async function webhookEncrypt(plaintext, kekBase64OrRaw) {
+  const key = await importAesGcmKey(kekBase64OrRaw, "WEBHOOK_KEK");
+  const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
+  const ptBytes = new TextEncoder().encode(plaintext);
+  const ct = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, ptBytes);
+  const combined = new Uint8Array(IV_BYTES + ct.byteLength);
+  combined.set(iv, 0);
+  combined.set(new Uint8Array(ct), IV_BYTES);
+  return toBase64(combined);
+}
+async function webhookDecrypt(cipherBase64, kekBase64OrRaw) {
+  const key = await importAesGcmKey(kekBase64OrRaw, "WEBHOOK_KEK");
+  let bytes;
+  try {
+    bytes = Uint8Array.from(atob(cipherBase64), (c) => c.charCodeAt(0));
+  } catch {
+    throw new Error("cipher payload invalid base64");
+  }
+  if (bytes.length < MIN_PAYLOAD) {
+    throw new Error("cipher payload too short");
+  }
+  const iv = bytes.slice(0, IV_BYTES);
+  const ctAndTag = bytes.slice(IV_BYTES);
+  const pt = await crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, ctAndTag);
+  return new TextDecoder().decode(pt);
+}
+function parseKeyVersion(raw) {
+  const value = raw ?? "1";
+  if (!/^[1-9]\d*$/.test(value)) {
+    throw new Error("ENCRYPTION_KEY_VERSION must be a positive integer");
+  }
+  return Number(value);
+}
+function getVersionedKey(env, version) {
+  const key = env[`ENCRYPTION_KEY_V${version}`];
+  if (!key) {
+    throw new Error(`ENCRYPTION_KEY_V${version} is not configured`);
+  }
+  return key;
+}
+async function encryptWithBase64Key(plaintext, keyBase64, keyLabel) {
+  const key = await importAesGcmKey(keyBase64, keyLabel);
+  const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
+  const ptBytes = new TextEncoder().encode(plaintext);
+  const ct = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, ptBytes);
+  const combined = new Uint8Array(IV_BYTES + ct.byteLength);
+  combined.set(iv, 0);
+  combined.set(new Uint8Array(ct), IV_BYTES);
+  return toBase64(combined);
+}
+async function decryptWithBase64Key(cipherBase64, keyBase64, keyLabel) {
+  const key = await importAesGcmKey(keyBase64, keyLabel);
+  let bytes;
+  try {
+    bytes = Uint8Array.from(atob(cipherBase64), (c) => c.charCodeAt(0));
+  } catch {
+    throw new Error("cipher payload invalid base64");
+  }
+  if (bytes.length < MIN_PAYLOAD) {
+    throw new Error("cipher payload too short");
+  }
+  const iv = bytes.slice(0, IV_BYTES);
+  const ctAndTag = bytes.slice(IV_BYTES);
+  const pt = await crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, ctAndTag);
+  return new TextDecoder().decode(pt);
+}
+async function encryptSecret(plaintext, env) {
+  const keyVersion = parseKeyVersion(env.ENCRYPTION_KEY_VERSION);
+  const keyLabel = `ENCRYPTION_KEY_V${keyVersion}`;
+  const cipher = await encryptWithBase64Key(plaintext, getVersionedKey(env, keyVersion), keyLabel);
+  return { cipher, keyVersion };
+}
+async function decryptSecret(cipher, keyVersion, env) {
+  if (!Number.isInteger(keyVersion) || keyVersion <= 0) {
+    throw new Error("invalid encryption key version");
+  }
+  const keyLabel = `ENCRYPTION_KEY_V${keyVersion}`;
+  return decryptWithBase64Key(cipher, getVersionedKey(env, keyVersion), keyLabel);
+}
+
+// src/logger.ts
+var REDACTED_KEYS_RE = /^(secret|.*_secret|.*token.*|.*cipher.*|fio_secret|webhook_kek|encryption_key|.*encryption.*key.*|.*_kek|.*_key|raw_email)$/i;
+var ALLOW_LIST_KEYS = /* @__PURE__ */ new Set(["secret_prefix", "api_token_prefix", "fio_token_prefix"]);
+function redactValue(value, visited) {
+  if (value === null || value === void 0 || typeof value !== "object") {
+    return value;
+  }
+  if (visited.has(value)) {
+    return value;
+  }
+  visited.add(value);
+  if (Array.isArray(value)) {
+    return value.map((item) => redactValue(item, visited));
+  }
+  const redactedObj = {};
+  for (const [key, val] of Object.entries(value)) {
+    if (REDACTED_KEYS_RE.test(key) && !ALLOW_LIST_KEYS.has(key)) {
+      redactedObj[key] = "[REDACTED]";
+    } else {
+      redactedObj[key] = redactValue(val, visited);
+    }
+  }
+  return redactedObj;
+}
+function redact(data) {
+  const visited = /* @__PURE__ */ new Set();
+  const redactedObj = {};
+  for (const [key, val] of Object.entries(data)) {
+    if (REDACTED_KEYS_RE.test(key) && !ALLOW_LIST_KEYS.has(key)) {
+      redactedObj[key] = "[REDACTED]";
+    } else {
+      redactedObj[key] = redactValue(val, visited);
+    }
+  }
+  return redactedObj;
+}
+function log(event, data) {
+  console.log(
+    JSON.stringify({
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      event,
+      ...redact(data ?? {})
+    })
+  );
+}
+function logError(event, err, data) {
+  console.error(
+    JSON.stringify({
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      event,
+      error: String(err),
+      ...redact(data ?? {})
+    })
+  );
+}
+
+// src/db.ts
+var SUPPORTED_SCHEMA_VERSIONS = ["10"];
+var _checkedDbs = /* @__PURE__ */ new Set();
+async function assertSchemaVersion(db) {
+  if (_checkedDbs.has(db)) return;
+  const row = await db.prepare(`SELECT value FROM schema_meta WHERE key = 'version'`).first();
+  if (!row || !SUPPORTED_SCHEMA_VERSIONS.includes(row.value)) {
+    throw new Error(`schema_version_mismatch: got ${row?.value ?? "null"}, expected one of ${SUPPORTED_SCHEMA_VERSIONS.join(", ")}`);
+  }
+  _checkedDbs.add(db);
+}
+var BANK_ACCOUNT_PUBLIC_COLS = `
+  id, account_number, account_type, ingest_mode, pairing_code, label, owner_app_id, cf_rule_id,
+  (api_token_cipher IS NOT NULL) AS api_token_set,
+  api_token_prefix, api_fetch_enabled, api_last_fetch_at, api_last_success_at, api_last_error, api_backfill_done,
+  created_at
+`;
+function mapBankAccount(row) {
+  return {
+    ...row,
+    api_token_set: Boolean(row.api_token_set),
+    api_fetch_enabled: Boolean(row.api_fetch_enabled),
+    api_backfill_done: Boolean(row.api_backfill_done)
+  };
+}
+function mapApiFetchAccount(row) {
+  return {
+    ...mapBankAccount(row),
+    api_token_cipher: row.api_token_cipher,
+    api_token_key_ver: row.api_token_key_ver
+  };
+}
+var SQL_FIND_BANK_ACCOUNT_BY_PAIRING_CODE = `SELECT ${BANK_ACCOUNT_PUBLIC_COLS} FROM bank_accounts WHERE pairing_code = ?`;
+async function findBankAccountByPairingCode(db, pairingCode) {
+  const row = await db.prepare(SQL_FIND_BANK_ACCOUNT_BY_PAIRING_CODE).bind(pairingCode).first();
+  return row ? mapBankAccount(row) : null;
+}
+var SQL_PAIRING_EXISTS = `SELECT 1 FROM bank_accounts WHERE pairing_code = ? LIMIT 1`;
+async function pairingCodeExists(db, pairingCode) {
+  const r = await db.prepare(SQL_PAIRING_EXISTS).bind(pairingCode).first();
+  return r !== null;
+}
+var SQL_FIND_BANK_ACCOUNT_BY_ID = `SELECT ${BANK_ACCOUNT_PUBLIC_COLS} FROM bank_accounts WHERE id = ?`;
+async function findBankAccountById(db, id) {
+  const row = await db.prepare(SQL_FIND_BANK_ACCOUNT_BY_ID).bind(id).first();
+  return row ? mapBankAccount(row) : null;
+}
+var SQL_CREATE_BANK_ACCOUNT = `
+INSERT INTO bank_accounts (
+  account_number, account_type, ingest_mode, pairing_code, label, owner_app_id, cf_rule_id,
+  api_token_cipher, api_token_key_ver, api_token_prefix, api_fetch_enabled
+) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+RETURNING ${BANK_ACCOUNT_PUBLIC_COLS}
+`;
+async function createBankAccount(db, args) {
+  const row = await db.prepare(SQL_CREATE_BANK_ACCOUNT).bind(
+    args.account_number,
+    args.account_type ?? "FIO",
+    args.ingest_mode ?? "email",
+    args.pairing_code,
+    args.label ?? null,
+    args.owner_app_id ?? null,
+    args.cf_rule_id ?? null,
+    args.api_token_cipher ?? null,
+    args.api_token_key_ver ?? null,
+    args.api_token_prefix ?? null,
+    args.api_fetch_enabled ? 1 : 0
+  ).first();
+  if (!row) throw new Error("createBankAccount: no row returned");
+  return mapBankAccount(row);
+}
+var SQL_LIST_BANK_ACCOUNTS = `SELECT ${BANK_ACCOUNT_PUBLIC_COLS} FROM bank_accounts ORDER BY id`;
+var SQL_LIST_BANK_ACCOUNTS_BY_OWNER = `SELECT ${BANK_ACCOUNT_PUBLIC_COLS} FROM bank_accounts WHERE owner_app_id = ? ORDER BY id`;
+async function listBankAccounts(db, ownerAppId) {
+  if (ownerAppId !== void 0) {
+    const r = await db.prepare(SQL_LIST_BANK_ACCOUNTS_BY_OWNER).bind(ownerAppId).all();
+    return r.results.map(mapBankAccount);
+  }
+  const result = await db.prepare(SQL_LIST_BANK_ACCOUNTS).all();
+  return result.results.map(mapBankAccount);
+}
+var SQL_UPDATE_BANK_ACCOUNT = `
+UPDATE bank_accounts
+SET account_number = COALESCE(?, account_number),
+    account_type = COALESCE(?, account_type),
+    label = COALESCE(?, label),
+    ingest_mode = COALESCE(?, ingest_mode)
+WHERE id = ?
+RETURNING ${BANK_ACCOUNT_PUBLIC_COLS}
+`;
+async function updateBankAccount(db, id, patch) {
+  const row = await db.prepare(SQL_UPDATE_BANK_ACCOUNT).bind(patch.account_number ?? null, patch.account_type ?? null, patch.label === void 0 ? null : patch.label, patch.ingest_mode ?? null, id).first();
+  return row ? mapBankAccount(row) : null;
+}
+var SQL_UPDATE_BANK_ACCOUNT_OWNER = `
+UPDATE bank_accounts
+SET owner_app_id = ?
+WHERE id = ?
+RETURNING ${BANK_ACCOUNT_PUBLIC_COLS}
+`;
+async function updateBankAccountOwner(db, id, ownerAppId) {
+  const row = await db.prepare(SQL_UPDATE_BANK_ACCOUNT_OWNER).bind(ownerAppId, id).first();
+  return row ? mapBankAccount(row) : null;
+}
+var SQL_REGENERATE_PAIRING = `UPDATE bank_accounts SET pairing_code = ?, cf_rule_id = ? WHERE id = ? RETURNING ${BANK_ACCOUNT_PUBLIC_COLS}`;
+async function regenerateBankAccountPairing(db, id, newPairing, newCfRuleId) {
+  const row = await db.prepare(SQL_REGENERATE_PAIRING).bind(newPairing, newCfRuleId, id).first();
+  return row ? mapBankAccount(row) : null;
+}
+var SQL_SET_BANK_ACCOUNT_API_TOKEN = `
+UPDATE bank_accounts
+SET api_token_cipher = ?,
+    api_token_key_ver = ?,
+    api_token_prefix = ?,
+    api_fetch_enabled = ?,
+    ingest_mode = COALESCE(?, ingest_mode),
+    api_last_error = NULL
+WHERE id = ?
+RETURNING ${BANK_ACCOUNT_PUBLIC_COLS}
+`;
+async function setBankAccountApiToken(db, id, args) {
+  const row = await db.prepare(SQL_SET_BANK_ACCOUNT_API_TOKEN).bind(args.token_cipher, args.token_key_ver, args.token_prefix, args.fetch_enabled ? 1 : 0, args.ingest_mode ?? null, id).first();
+  return row ? mapBankAccount(row) : null;
+}
+var SQL_SET_BANK_ACCOUNT_API_FETCH_ENABLED = `
+UPDATE bank_accounts
+SET api_fetch_enabled = ?,
+    ingest_mode = COALESCE(?, ingest_mode)
+WHERE id = ?
+RETURNING ${BANK_ACCOUNT_PUBLIC_COLS}
+`;
+async function setBankAccountApiFetchEnabled(db, id, args) {
+  const row = await db.prepare(SQL_SET_BANK_ACCOUNT_API_FETCH_ENABLED).bind(args.fetch_enabled ? 1 : 0, args.ingest_mode ?? null, id).first();
+  return row ? mapBankAccount(row) : null;
+}
+var SQL_CLEAR_BANK_ACCOUNT_API_TOKEN = `
+UPDATE bank_accounts
+SET api_token_cipher = NULL,
+    api_token_key_ver = NULL,
+    api_token_prefix = NULL,
+    api_fetch_enabled = 0,
+    ingest_mode = 'email',
+    api_last_error = NULL
+WHERE id = ?
+RETURNING ${BANK_ACCOUNT_PUBLIC_COLS}
+`;
+async function clearBankAccountApiToken(db, id) {
+  const row = await db.prepare(SQL_CLEAR_BANK_ACCOUNT_API_TOKEN).bind(id).first();
+  return row ? mapBankAccount(row) : null;
+}
+var SQL_FIND_BANK_ACCOUNT_API_MATERIALS = `
+SELECT ${BANK_ACCOUNT_PUBLIC_COLS}, api_token_cipher, api_token_key_ver
+FROM bank_accounts
+WHERE id = ? AND api_token_cipher IS NOT NULL AND api_token_key_ver IS NOT NULL
+`;
+async function findBankAccountApiMaterials(db, id) {
+  const row = await db.prepare(SQL_FIND_BANK_ACCOUNT_API_MATERIALS).bind(id).first();
+  return row ? mapApiFetchAccount(row) : null;
+}
+var SQL_LIST_DUE_API_ACCOUNTS = `
+SELECT ${BANK_ACCOUNT_PUBLIC_COLS}, api_token_cipher, api_token_key_ver
+FROM bank_accounts
+WHERE api_fetch_enabled = 1
+  AND api_token_cipher IS NOT NULL
+  AND api_token_key_ver IS NOT NULL
+  AND ingest_mode IN ('api', 'both')
+  AND (api_last_fetch_at IS NULL OR (julianday('now') - julianday(api_last_fetch_at)) * 86400 >= ?)
+ORDER BY COALESCE(api_last_fetch_at, '1970-01-01T00:00:00.000Z'), id
+LIMIT ?
+`;
+async function listDueApiFetchAccounts(db, minIntervalS, limit = 20) {
+  const result = await db.prepare(SQL_LIST_DUE_API_ACCOUNTS).bind(minIntervalS, limit).all();
+  return result.results.map(mapApiFetchAccount);
+}
+async function tryAcquireApiSyncLease(db, leaseSeconds) {
+  await db.prepare(`INSERT OR IGNORE INTO schema_meta (key, value) VALUES ('api_sync_lease_until', '1970-01-01 00:00:00')`).run();
+  const result = await db.prepare(`
+      UPDATE schema_meta
+      SET value = datetime('now', ?)
+      WHERE key = 'api_sync_lease_until'
+        AND datetime(value) <= datetime('now')
+    `).bind(`+${Math.max(1, Math.floor(leaseSeconds))} seconds`).run();
+  return (result.meta.changes ?? 0) > 0;
+}
+var SQL_IS_BANK_ACCOUNT_API_DUE = `
+SELECT 1
+FROM bank_accounts
+WHERE id = ?
+  AND (api_last_fetch_at IS NULL OR (julianday('now') - julianday(api_last_fetch_at)) * 86400 >= ?)
+LIMIT 1
+`;
+async function isBankAccountApiFetchDue(db, id, minIntervalS) {
+  const row = await db.prepare(SQL_IS_BANK_ACCOUNT_API_DUE).bind(id, minIntervalS).first();
+  return row !== null;
+}
+async function markBankAccountApiFetchStarted(db, id) {
+  await db.prepare(`UPDATE bank_accounts SET api_last_fetch_at = datetime('now') WHERE id = ?`).bind(id).run();
+}
+async function markBankAccountApiPointerSet(db, id) {
+  await db.prepare(`
+      UPDATE bank_accounts
+      SET api_last_fetch_at = datetime('now'),
+          api_last_success_at = datetime('now'),
+          api_last_error = NULL,
+          api_backfill_done = 0
+      WHERE id = ?
+    `).bind(id).run();
+}
+async function markBankAccountApiFetchSuccess(db, id, args) {
+  await db.prepare(`
+      UPDATE bank_accounts
+      SET api_last_fetch_at = datetime('now'),
+          api_last_success_at = datetime('now'),
+          api_last_error = NULL,
+          api_backfill_done = ?
+      WHERE id = ?
+    `).bind(args.backfill_done ? 1 : 0, id).run();
+}
+async function markBankAccountApiFetchFailure(db, id, error) {
+  await db.prepare(`UPDATE bank_accounts SET api_last_fetch_at = datetime('now'), api_last_error = ? WHERE id = ?`).bind(error.slice(0, 500), id).run();
+}
+async function deleteBankAccount(db, id) {
+  await db.prepare(`DELETE FROM webhook_subscriptions WHERE bank_account_id = ?`).bind(id).run();
+  const r = await db.prepare(`DELETE FROM bank_accounts WHERE id = ?`).bind(id).run();
+  return r.meta.changes > 0;
+}
+var SQL_CREATE_CONSUMER = `INSERT INTO webhook_consumers (app_id, callback_url, secret_cipher, secret_hash, secret_prefix) VALUES (?, ?, ?, ?, ?) RETURNING id, app_id, callback_url, secret_cipher, secret_hash, secret_prefix, prev_secret_cipher, prev_expires_at, admin_key_hash, admin_key_prefix, created_at`;
+async function createConsumer(db, args) {
+  const row = await db.prepare(SQL_CREATE_CONSUMER).bind(args.app_id, args.callback_url, args.secret_cipher, args.secret_hash, args.secret_prefix).first();
+  if (!row) throw new Error("createConsumer: no row returned");
+  return row;
+}
+var SQL_FIND_CONSUMER_BY_APP_ID = `SELECT id, app_id, callback_url, secret_cipher, secret_hash, secret_prefix, prev_secret_cipher, prev_expires_at, admin_key_hash, admin_key_prefix, created_at FROM webhook_consumers WHERE app_id = ?`;
+var SQL_FIND_CONSUMER_BY_ADMIN_KEY_PREFIX = `SELECT id, app_id, callback_url, secret_cipher, secret_hash, secret_prefix, prev_secret_cipher, prev_expires_at, admin_key_hash, admin_key_prefix, created_at FROM webhook_consumers WHERE admin_key_prefix = ?`;
+async function findConsumerByAdminKeyPrefix(db, prefix) {
+  const row = await db.prepare(SQL_FIND_CONSUMER_BY_ADMIN_KEY_PREFIX).bind(prefix).first();
+  return row ?? null;
+}
+var SQL_SET_CONSUMER_ADMIN_KEY = `UPDATE webhook_consumers SET admin_key_hash = ?, admin_key_prefix = ? WHERE app_id = ?`;
+async function setConsumerAdminKey(db, appId, hash, prefix) {
+  await db.prepare(SQL_SET_CONSUMER_ADMIN_KEY).bind(hash, prefix, appId).run();
+}
+async function findConsumerByAppId(db, appId) {
+  const row = await db.prepare(SQL_FIND_CONSUMER_BY_APP_ID).bind(appId).first();
+  return row ?? null;
+}
+var SQL_ROTATE_SECRET = `UPDATE webhook_consumers SET prev_secret_cipher = secret_cipher, prev_expires_at = ?, secret_cipher = ?, secret_hash = ?, secret_prefix = ? WHERE app_id = ?`;
+async function rotateConsumerSecret(db, appId, rotated) {
+  const result = await db.prepare(SQL_ROTATE_SECRET).bind(rotated.prevExpiresAt, rotated.newCipher, rotated.newHash, rotated.newPrefix, appId).run();
+  if (result.meta.changes === 0) throw new Error(`rotateConsumerSecret: app_id not found: ${appId}`);
+}
+var SQL_UPDATE_CONSUMER_CALLBACK = `UPDATE webhook_consumers SET callback_url = ? WHERE app_id = ? RETURNING id, app_id, callback_url, secret_cipher, secret_hash, secret_prefix, prev_secret_cipher, prev_expires_at, admin_key_hash, admin_key_prefix, created_at`;
+async function updateConsumer(db, appId, input) {
+  const row = await db.prepare(SQL_UPDATE_CONSUMER_CALLBACK).bind(input.callback_url, appId).first();
+  return row ?? null;
+}
+var SQL_DELETE_CONSUMER = `DELETE FROM webhook_consumers WHERE app_id = ?`;
+async function deleteConsumer(db, appId) {
+  await db.prepare(SQL_DELETE_CONSUMER).bind(appId).run();
+}
+var SQL_COUNT_SUBSCRIPTIONS = `SELECT COUNT(*) as cnt FROM webhook_subscriptions WHERE bank_account_id = ? AND deleted_at IS NULL`;
+var SQL_CREATE_SUBSCRIPTION = `
+  INSERT INTO webhook_subscriptions (bank_account_id, consumer_app_id) VALUES (?, ?)
+  ON CONFLICT(bank_account_id, consumer_app_id) DO UPDATE SET deleted_at = NULL, created_at = datetime('now')
+    WHERE webhook_subscriptions.deleted_at IS NOT NULL
+  RETURNING id, bank_account_id, consumer_app_id, created_at`;
+var SQL_FIND_ACTIVE_SUBSCRIPTION = `SELECT id, bank_account_id, consumer_app_id, created_at FROM webhook_subscriptions WHERE bank_account_id = ? AND consumer_app_id = ? AND deleted_at IS NULL`;
+async function createSubscription(db, args) {
+  const countRow = await db.prepare(SQL_COUNT_SUBSCRIPTIONS).bind(args.bank_account_id).first();
+  if ((countRow?.cnt ?? 0) >= 20) throw new Error("subscription_cap_reached:20");
+  const row = await db.prepare(SQL_CREATE_SUBSCRIPTION).bind(args.bank_account_id, args.app_id).first();
+  if (row) return row;
+  const existing = await db.prepare(SQL_FIND_ACTIVE_SUBSCRIPTION).bind(args.bank_account_id, args.app_id).first();
+  if (existing) throw new Error("subscription_already_exists");
+  throw new Error("createSubscription: no row returned");
+}
+var SQL_DELETE_SUBSCRIPTION = `UPDATE webhook_subscriptions SET deleted_at = datetime('now') WHERE id = ? AND deleted_at IS NULL`;
+async function deleteSubscription(db, id) {
+  await db.prepare(SQL_DELETE_SUBSCRIPTION).bind(id).run();
+}
+var SQL_INSERT_TRANSACTION = `
+INSERT OR IGNORE INTO transactions (
+  bank_account_id, amount_cents, currency, counter_account, bank_code, bank_name,
+  vs, ks, ss, message, sender_name, user_identification, transaction_type,
+  performed_by, comment, command_id, source, date, date_offset_min,
+  transaction_id, external_id
+) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+`;
+var SQL_SELECT_TRANSACTION_BY_ID = `SELECT id, bank_account_id, amount_cents, currency, counter_account, bank_code, bank_name, vs, ks, ss, message, sender_name, user_identification, transaction_type, performed_by, comment, command_id, source, date, date_offset_min, transaction_id, external_id FROM transactions WHERE id = ?`;
+var SQL_FIND_DUPLICATE_EXT = `SELECT id FROM transactions WHERE external_id = ? AND external_id IS NOT NULL LIMIT 1`;
+var SQL_FIND_DUPLICATE_FIO = `SELECT id FROM transactions WHERE bank_account_id = ? AND transaction_id = ? AND transaction_id IS NOT NULL LIMIT 1`;
+var SQL_FIND_DUPLICATE_FUZZY = `
+SELECT id
+FROM transactions
+WHERE bank_account_id = ?
+  AND vs = ?
+  AND amount_cents = ?
+  AND currency = ?
+  AND substr(date, 1, 10) BETWEEN date(?, '-3 days') AND date(?, '+3 days')
+LIMIT 1
+`;
+function fuzzyDateDay(date) {
+  return /^\d{4}-\d{2}-\d{2}/.test(date) ? date.slice(0, 10) : null;
+}
+async function findFuzzyDuplicate(db, bankAccountId, p) {
+  if (!p.vs) return false;
+  const dateDay = fuzzyDateDay(p.date);
+  if (!dateDay) return false;
+  const hit = await db.prepare(SQL_FIND_DUPLICATE_FUZZY).bind(bankAccountId, p.vs, p.amount_cents, p.currency, dateDay, dateDay).first();
+  return hit !== null;
+}
+async function insertTransaction(db, args) {
+  const p = {
+    ...args.payload,
+    vs: resolveVariableSymbol(args.payload)
+  };
+  if (p.transaction_id != null) {
+    const hit = await db.prepare(SQL_FIND_DUPLICATE_FIO).bind(args.bank_account_id, p.transaction_id).first();
+    if (hit) return { status: "skipped", reason: "duplicate_transaction_id" };
+  }
+  if (p.external_id != null) {
+    const hit = await db.prepare(SQL_FIND_DUPLICATE_EXT).bind(p.external_id).first();
+    if (hit) return { status: "skipped", reason: "duplicate_external_id" };
+  }
+  if (await findFuzzyDuplicate(db, args.bank_account_id, p)) {
+    return { status: "skipped", reason: "fuzzy_duplicate" };
+  }
+  const result = await db.prepare(SQL_INSERT_TRANSACTION).bind(
+    args.bank_account_id,
+    p.amount_cents,
+    p.currency,
+    p.counter_account ?? null,
+    p.bank_code ?? null,
+    p.bank_name ?? null,
+    p.vs ?? null,
+    p.ks ?? null,
+    p.ss ?? null,
+    p.message ?? null,
+    p.sender_name ?? null,
+    p.user_identification ?? null,
+    p.transaction_type ?? null,
+    p.performed_by ?? null,
+    p.comment ?? null,
+    p.command_id ?? null,
+    p.source,
+    p.date,
+    p.date_offset_min ?? null,
+    p.transaction_id ?? null,
+    p.external_id ?? null
+  ).run();
+  if (result.meta.changes === 0) {
+    if (p.transaction_id != null) {
+      const hit = await db.prepare(SQL_FIND_DUPLICATE_FIO).bind(args.bank_account_id, p.transaction_id).first();
+      if (hit) return { status: "skipped", reason: "duplicate_transaction_id" };
+    }
+    if (p.external_id != null) {
+      const hit = await db.prepare(SQL_FIND_DUPLICATE_EXT).bind(p.external_id).first();
+      if (hit) return { status: "skipped", reason: "duplicate_external_id" };
+    }
+    if (await findFuzzyDuplicate(db, args.bank_account_id, p)) {
+      return { status: "skipped", reason: "fuzzy_duplicate" };
+    }
+    return { status: "skipped", reason: "fuzzy_duplicate" };
+  }
+  const rowId = result.meta.last_row_id;
+  const row = await db.prepare(SQL_SELECT_TRANSACTION_BY_ID).bind(rowId).first();
+  if (!row) throw new Error("insertTransaction: row vanished after insert");
+  return { status: "inserted", transaction: row };
+}
+var SQL_INSERT_PARSE_LOG = `INSERT INTO parse_log (bank_account_id, external_id, raw_data, error_message) VALUES (?, ?, ?, ?)`;
+async function insertParseLog(db, args) {
+  try {
+    await db.prepare(SQL_INSERT_PARSE_LOG).bind(args.bank_account_id ?? null, args.external_id ?? null, args.raw_data ?? null, args.error_message).run();
+  } catch (err) {
+    console.error(JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), event: "parse_log_write_failed", error: String(err) }));
+  }
+}
+var SQL_GET_CONSUMER_SECRET = `SELECT callback_url, secret_cipher, prev_secret_cipher, prev_expires_at FROM webhook_consumers WHERE app_id = ?`;
+async function getConsumerSecretMaterials(db, appId) {
+  const row = await db.prepare(SQL_GET_CONSUMER_SECRET).bind(appId).first();
+  if (!row) return null;
+  const inGrace = row.prev_expires_at != null && row.prev_secret_cipher != null ? row.prev_expires_at > (/* @__PURE__ */ new Date()).toISOString() : false;
+  return {
+    callback_url: row.callback_url,
+    primary_cipher: row.secret_cipher,
+    prev_cipher_in_grace: inGrace ? row.prev_secret_cipher : null
+  };
+}
+var SQL_INSERT_WEBHOOK_LOG = `INSERT INTO webhook_log (delivery_id, consumer_app_id, bank_account_id, transaction_id, attempt, http_status, error_message) VALUES (?, ?, ?, ?, ?, ?, ?)`;
+async function insertWebhookLogEntry(db, args) {
+  await db.prepare(SQL_INSERT_WEBHOOK_LOG).bind(
+    args.delivery_id,
+    args.consumer_app_id,
+    args.bank_account_id ?? null,
+    args.transaction_id ?? null,
+    args.attempt,
+    args.http_status ?? null,
+    args.error_message ?? null
+  ).run();
+}
+var SQL_WRITE_EVENT = `INSERT INTO event_log (event_type, bank_account_id, detail) VALUES (?, ?, ?)`;
+async function writeEvent(db, args) {
+  await db.prepare(SQL_WRITE_EVENT).bind(args.event_type, args.bank_account_id ?? null, args.detail != null ? JSON.stringify(args.detail) : null).run();
+}
+var SQL_LIST_CONSUMERS = `SELECT id, app_id, callback_url, secret_prefix, admin_key_prefix, created_at FROM webhook_consumers ORDER BY id`;
+async function listConsumers(db) {
+  const result = await db.prepare(SQL_LIST_CONSUMERS).all();
+  return result.results;
+}
+var SQL_LIST_SUBSCRIPTIONS_ALL = `SELECT id, bank_account_id, consumer_app_id, created_at FROM webhook_subscriptions ORDER BY id`;
+var SQL_LIST_SUBSCRIPTIONS_BY_APP = `SELECT id, bank_account_id, consumer_app_id, created_at FROM webhook_subscriptions WHERE consumer_app_id = ? ORDER BY id`;
+var SQL_LIST_SUBSCRIPTIONS_BY_ACCOUNT = `SELECT id, bank_account_id, consumer_app_id, created_at FROM webhook_subscriptions WHERE bank_account_id = ? ORDER BY id`;
+async function listSubscriptions(db, filters) {
+  if (filters?.app_id) {
+    const r2 = await db.prepare(SQL_LIST_SUBSCRIPTIONS_BY_APP).bind(filters.app_id).all();
+    return r2.results;
+  }
+  if (filters?.bank_account_id != null) {
+    const r2 = await db.prepare(SQL_LIST_SUBSCRIPTIONS_BY_ACCOUNT).bind(filters.bank_account_id).all();
+    return r2.results;
+  }
+  const r = await db.prepare(SQL_LIST_SUBSCRIPTIONS_ALL).all();
+  return r.results;
+}
+var SQL_LIST_TRANSACTIONS = `SELECT id, bank_account_id, amount_cents, currency, vs, source, date, external_id, transaction_id, sender_name, counter_account, bank_code, bank_name, message, created_at FROM transactions WHERE created_at > datetime(?) ORDER BY id LIMIT ?`;
+var SQL_LIST_TRANSACTIONS_BY_OWNER = `SELECT t.id, t.bank_account_id, t.amount_cents, t.currency, t.vs, t.source, t.date, t.external_id, t.transaction_id, t.sender_name, t.counter_account, t.bank_code, t.bank_name, t.message, t.created_at FROM transactions t JOIN bank_accounts b ON b.id = t.bank_account_id WHERE b.owner_app_id = ? AND t.created_at > datetime(?) ORDER BY t.id LIMIT ?`;
+async function listTransactions(db, since, limit, ownerAppId) {
+  const r = ownerAppId ? await db.prepare(SQL_LIST_TRANSACTIONS_BY_OWNER).bind(ownerAppId, since, limit).all() : await db.prepare(SQL_LIST_TRANSACTIONS).bind(since, limit).all();
+  return r.results;
+}
+var SQL_LIST_PARSE_LOG = `SELECT id, bank_account_id, external_id, error_message, raw_data, created_at FROM parse_log WHERE created_at > datetime(?) ORDER BY id DESC LIMIT ?`;
+var SQL_LIST_PARSE_LOG_BY_OWNER = `SELECT p.id, p.bank_account_id, p.external_id, p.error_message, p.raw_data, p.created_at FROM parse_log p JOIN bank_accounts b ON b.id = p.bank_account_id WHERE b.owner_app_id = ? AND p.created_at > datetime(?) ORDER BY p.id DESC LIMIT ?`;
+async function listParseLog(db, since, limit, ownerAppId) {
+  const r = ownerAppId ? await db.prepare(SQL_LIST_PARSE_LOG_BY_OWNER).bind(ownerAppId, since, limit).all() : await db.prepare(SQL_LIST_PARSE_LOG).bind(since, limit).all();
+  return r.results;
+}
+var SQL_LIST_UNMATCHED_MAILS = `SELECT id, external_id, error_message, raw_data, created_at FROM parse_log WHERE (error_message LIKE 'no_pairing_code:%' OR error_message LIKE 'unknown_pairing_code:%') AND created_at > datetime(?) ORDER BY id DESC LIMIT ?`;
+async function listUnmatchedMails(db, since, limit) {
+  const r = await db.prepare(SQL_LIST_UNMATCHED_MAILS).bind(since, limit).all();
+  return r.results;
+}
+var SQL_LIST_WEBHOOK_LOG = `SELECT id, delivery_id, consumer_app_id, http_status, error_message, attempt, created_at FROM webhook_log WHERE created_at > datetime(?) ORDER BY id LIMIT ?`;
+var SQL_LIST_WEBHOOK_LOG_BY_CONSUMER = `SELECT id, delivery_id, consumer_app_id, http_status, error_message, attempt, created_at FROM webhook_log WHERE consumer_app_id = ? AND created_at > datetime(?) ORDER BY id LIMIT ?`;
+async function listWebhookLog(db, since, limit, consumerAppId) {
+  const r = consumerAppId ? await db.prepare(SQL_LIST_WEBHOOK_LOG_BY_CONSUMER).bind(consumerAppId, since, limit).all() : await db.prepare(SQL_LIST_WEBHOOK_LOG).bind(since, limit).all();
+  return r.results;
+}
+var SQL_PARSE_FAILURES_24H = `SELECT COUNT(*) as cnt FROM parse_log
+  WHERE created_at > datetime('now','-1 day')
+    AND error_message NOT LIKE 'not_transaction:%'
+    AND error_message NOT IN ('email_identity_mismatch', 'email_ingest_disabled_untrusted_authserv')`;
+var SQL_NOT_TRANSACTION_24H = `SELECT COUNT(*) as cnt FROM parse_log WHERE error_message LIKE 'not_transaction:%' AND created_at > datetime('now','-1 day')`;
+var SQL_TX_INSERTED_24H = `SELECT COUNT(*) as cnt FROM event_log WHERE event_type = 'tx_inserted' AND created_at > datetime('now','-1 day')`;
+var SQL_UNKNOWN_CURRENCY_24H = `SELECT COUNT(*) as cnt FROM parse_log WHERE error_message LIKE 'unknown_currency:%' AND created_at > datetime('now','-1 day')`;
+var SQL_OUTGOING_FILTERED_24H = `SELECT COUNT(*) as cnt FROM parse_log WHERE error_message = 'outgoing_filtered' AND created_at > datetime('now','-1 day')`;
+var SQL_UNKNOWN_PROVIDER_24H = `SELECT COUNT(*) as cnt FROM parse_log WHERE error_message LIKE 'unknown_provider:%' AND created_at > datetime('now','-1 day')`;
+var SQL_UNMATCHED_24H = `SELECT COUNT(*) as cnt FROM parse_log WHERE (error_message LIKE 'no_pairing_code:%' OR error_message LIKE 'unknown_pairing_code:%') AND created_at > datetime('now','-1 day')`;
+var SQL_DELIVERY_ACTIVE = `SELECT COUNT(*) as cnt FROM webhook_delivery_jobs WHERE status IN ('pending', 'dispatching', 'queued')`;
+var SQL_DELIVERY_STALLED = `SELECT COUNT(*) as cnt FROM webhook_delivery_jobs WHERE status IN ('pending', 'dispatching', 'queued') AND julianday(created_at) <= julianday('now', '-10 minutes')`;
+var SQL_DELIVERY_TERMINAL = `SELECT COUNT(*) as cnt FROM webhook_delivery_jobs WHERE status = 'terminal'`;
+var SQL_DELIVERY_OLDEST_PENDING = `SELECT MIN(created_at) as ts FROM webhook_delivery_jobs WHERE status IN ('pending', 'dispatching', 'queued')`;
+var SQL_PENDING_DELIVERY_ALERTS = `SELECT COUNT(*) as cnt FROM webhook_delivery_alerts WHERE posted_at IS NULL`;
+var SQL_PER_ACCOUNT_TX_7D = `SELECT bank_account_id, COUNT(*) as cnt FROM transactions WHERE created_at > datetime('now','-7 days') GROUP BY bank_account_id`;
+var SQL_PER_ACCOUNT_PARSE_ERRORS_24H = `SELECT bank_account_id, COUNT(*) as cnt FROM parse_log WHERE bank_account_id IS NOT NULL AND created_at > datetime('now','-1 day') GROUP BY bank_account_id`;
+var SQL_PER_ACCOUNT_LAST_EMAIL = `SELECT bank_account_id, MAX(created_at) as ts FROM event_log WHERE event_type = 'tx_inserted' GROUP BY bank_account_id`;
+var SQL_API_RATE_LIMITED_24H = `SELECT COUNT(*) as cnt FROM event_log WHERE event_type = 'api_rate_limited' AND created_at > datetime('now','-1 day')`;
+var SQL_PER_CONSUMER_WEBHOOK_LAST = `SELECT consumer_app_id, MAX(created_at) as ts FROM webhook_log GROUP BY consumer_app_id`;
+var SQL_PER_CONSUMER_WEBHOOKS_24H = `SELECT consumer_app_id, COUNT(*) as cnt FROM webhook_log WHERE created_at > datetime('now','-1 day') GROUP BY consumer_app_id`;
+var SQL_PER_CONSUMER_ERRORS_24H = `SELECT consumer_app_id, COUNT(*) as cnt FROM webhook_log WHERE http_status IS NOT NULL AND (http_status < 200 OR http_status >= 300) AND created_at > datetime('now','-1 day') GROUP BY consumer_app_id`;
+var SQL_PER_CONSUMER_DELIVERED = `SELECT consumer_app_id, MAX(delivered_at) as ts FROM webhook_delivery_jobs WHERE delivered_at IS NOT NULL GROUP BY consumer_app_id`;
+async function getStatusData(db) {
+  const [
+    failures,
+    txInserted24h,
+    unknownCurr,
+    outgoing,
+    unknownProv,
+    unmatched,
+    deliveryActive,
+    deliveryStalled,
+    deliveryTerminal,
+    oldestUndelivered,
+    pendingAlerts,
+    notTransaction,
+    apiRateLimited,
+    accountRows,
+    txPer7d,
+    parseErrPerAcct,
+    lastEmailPerAcct,
+    consumerRows,
+    webhookLast,
+    webhooks24h,
+    webhookErrors24h,
+    deliveredPerConsumer
+  ] = await Promise.all([
+    db.prepare(SQL_PARSE_FAILURES_24H).first(),
+    db.prepare(SQL_TX_INSERTED_24H).first(),
+    db.prepare(SQL_UNKNOWN_CURRENCY_24H).first(),
+    db.prepare(SQL_OUTGOING_FILTERED_24H).first(),
+    db.prepare(SQL_UNKNOWN_PROVIDER_24H).first(),
+    db.prepare(SQL_UNMATCHED_24H).first(),
+    db.prepare(SQL_DELIVERY_ACTIVE).first(),
+    db.prepare(SQL_DELIVERY_STALLED).first(),
+    db.prepare(SQL_DELIVERY_TERMINAL).first(),
+    db.prepare(SQL_DELIVERY_OLDEST_PENDING).first(),
+    db.prepare(SQL_PENDING_DELIVERY_ALERTS).first(),
+    db.prepare(SQL_NOT_TRANSACTION_24H).first(),
+    db.prepare(SQL_API_RATE_LIMITED_24H).first(),
+    db.prepare(SQL_LIST_BANK_ACCOUNTS).all(),
+    db.prepare(SQL_PER_ACCOUNT_TX_7D).all(),
+    db.prepare(SQL_PER_ACCOUNT_PARSE_ERRORS_24H).all(),
+    db.prepare(SQL_PER_ACCOUNT_LAST_EMAIL).all(),
+    db.prepare(SQL_LIST_CONSUMERS).all(),
+    db.prepare(SQL_PER_CONSUMER_WEBHOOK_LAST).all(),
+    db.prepare(SQL_PER_CONSUMER_WEBHOOKS_24H).all(),
+    db.prepare(SQL_PER_CONSUMER_ERRORS_24H).all(),
+    db.prepare(SQL_PER_CONSUMER_DELIVERED).all()
+  ]);
+  const failuresCount = failures?.cnt ?? 0;
+  const insertedCount = txInserted24h?.cnt ?? 0;
+  const total24h = failuresCount + insertedCount;
+  const tx7dMap = new Map(txPer7d.results.map((r) => [r.bank_account_id, r.cnt]));
+  const parseErrMap = new Map(parseErrPerAcct.results.map((r) => [r.bank_account_id, r.cnt]));
+  const lastEmailMap = new Map(lastEmailPerAcct.results.map((r) => [r.bank_account_id, r.ts]));
+  const webhookLastMap = new Map(webhookLast.results.map((r) => [r.consumer_app_id, r.ts]));
+  const webhooks24hMap = new Map(webhooks24h.results.map((r) => [r.consumer_app_id, r.cnt]));
+  const webhookErrMap = new Map(webhookErrors24h.results.map((r) => [r.consumer_app_id, r.cnt]));
+  const deliveredMap = new Map(deliveredPerConsumer.results.map((r) => [r.consumer_app_id, r.ts]));
+  return {
+    service: {
+      parse_failures_24h: failuresCount,
+      parse_failure_rate_24h: total24h > 0 ? Math.round(failuresCount / total24h * 1e4) / 1e4 : 0,
+      unknown_currency_24h: unknownCurr?.cnt ?? 0,
+      outgoing_filtered_24h: outgoing?.cnt ?? 0,
+      unknown_provider_24h: unknownProv?.cnt ?? 0,
+      unmatched_24h: unmatched?.cnt ?? 0,
+      not_transaction_24h: notTransaction?.cnt ?? 0
+    },
+    bank_accounts: accountRows.results.map((a) => ({
+      id: a.id,
+      label: a.label ?? null,
+      account_type: a.account_type,
+      last_email_at: lastEmailMap.get(a.id) ?? null,
+      last_api_pull_at: a.api_last_success_at ?? null,
+      tx_count_7d: tx7dMap.get(a.id) ?? 0,
+      parse_errors_24h: parseErrMap.get(a.id) ?? 0
+    })),
+    consumers: consumerRows.results.map((c) => ({
+      app_id: c.app_id,
+      last_webhook_at: deliveredMap.get(c.app_id) ?? webhookLastMap.get(c.app_id) ?? null,
+      webhooks_24h: webhooks24hMap.get(c.app_id) ?? 0,
+      webhook_errors_24h: webhookErrMap.get(c.app_id) ?? 0
+    })),
+    queues: {
+      main_pending: 0,
+      // Cloudflare Analytics binding not available in basic setup
+      delivery_active: deliveryActive?.cnt ?? 0,
+      delivery_stalled: deliveryStalled?.cnt ?? 0,
+      delivery_terminal: deliveryTerminal?.cnt ?? 0,
+      oldest_undelivered_at: oldestUndelivered?.ts ?? null,
+      pending_delivery_alerts: pendingAlerts?.cnt ?? 0,
+      api_rate_limited_24h: apiRateLimited?.cnt ?? 0
+    }
+  };
+}
+var SQL_PRUNE_PARSE_LOG = `DELETE FROM parse_log WHERE created_at < datetime('now', '-30 days')`;
+var SQL_PRUNE_WEBHOOK_LOG = `DELETE FROM webhook_log WHERE created_at < datetime('now', '-90 days')`;
+var SQL_PRUNE_EVENT_LOG = `DELETE FROM event_log WHERE created_at < datetime('now', '-30 days')`;
+var SQL_PRUNE_TRANSACTIONS = `DELETE FROM transactions WHERE created_at < datetime('now', '-90 days')`;
+var SQL_PRUNE_IDEMPOTENCY_KEYS = `DELETE FROM idempotency_keys WHERE created_at < datetime('now', '-24 hours')`;
+var SQL_PRUNE_ADMIN_AUDIT_LOG = `DELETE FROM admin_audit_log WHERE created_at < datetime('now', '-90 days')`;
+var SQL_CLEAR_EXPIRED_PREV_SECRETS = `UPDATE webhook_consumers SET prev_secret_cipher = NULL, prev_expires_at = NULL WHERE prev_expires_at < datetime('now')`;
+async function pruneRetention(db) {
+  const parseLogResult = await db.prepare(SQL_PRUNE_PARSE_LOG).run();
+  const webhookLogResult = await db.prepare(SQL_PRUNE_WEBHOOK_LOG).run();
+  const eventLogResult = await db.prepare(SQL_PRUNE_EVENT_LOG).run();
+  const txResult = await db.prepare(SQL_PRUNE_TRANSACTIONS).run();
+  const idempotencyResult = await db.prepare(SQL_PRUNE_IDEMPOTENCY_KEYS).run();
+  const auditResult = await db.prepare(SQL_PRUNE_ADMIN_AUDIT_LOG).run();
+  const secretsResult = await db.prepare(SQL_CLEAR_EXPIRED_PREV_SECRETS).run();
+  return {
+    parse_log_deleted: parseLogResult.meta.changes,
+    webhook_log_deleted: webhookLogResult.meta.changes,
+    event_log_deleted: eventLogResult.meta.changes,
+    expired_prev_secrets_cleared: secretsResult.meta.changes,
+    transactions_deleted: txResult.meta.changes,
+    idempotency_keys_deleted: idempotencyResult.meta.changes,
+    admin_audit_log_deleted: auditResult.meta.changes
+  };
+}
+
+// src/validation.ts
+import * as v from "valibot";
+var ValidationError = class extends Error {
+  constructor(issues, message) {
+    super(message);
+    this.issues = issues;
+    this.name = "ValidationError";
+  }
+  issues;
+};
+function parseBody(schema, body) {
+  try {
+    return v.parse(schema, body);
+  } catch (err) {
+    if (err instanceof v.ValiError) {
+      const message = `validation_failed: ${err.issues[0]?.message ?? "unknown"}`;
+      throw new ValidationError(err.issues, message);
+    }
+    throw err;
+  }
+}
+var CreateBankAccountSchema = v.object({
+  account_number: v.pipe(v.string(), v.minLength(3), v.maxLength(64)),
+  account_type: v.optional(v.picklist(["FIO", "AIRBANK"])),
+  ingest_mode: v.optional(v.picklist(["email", "api", "both"])),
+  fio_api_token: v.optional(v.pipe(v.string(), v.minLength(8), v.maxLength(512))),
+  label: v.optional(v.pipe(v.string(), v.maxLength(120))),
+  /** owner consumer app_id — must already exist as a registered consumer (otherwise FK fails). */
+  owner_app_id: v.pipe(v.string(), v.regex(/^[a-z0-9][a-z0-9-_]{1,63}$/))
+});
+var UpdateBankAccountSchema = v.pipe(
+  v.object({
+    account_number: v.optional(v.pipe(v.string(), v.minLength(3), v.maxLength(64))),
+    account_type: v.optional(v.picklist(["FIO", "AIRBANK"])),
+    ingest_mode: v.optional(v.picklist(["email", "api", "both"])),
+    label: v.optional(v.union([v.pipe(v.string(), v.maxLength(120)), v.null_()]))
+  }),
+  v.check(
+    (o) => o.account_number !== void 0 || o.account_type !== void 0 || o.ingest_mode !== void 0 || o.label !== void 0,
+    "at least one of account_number, account_type, ingest_mode, label must be provided"
+  )
+);
+var UpdateBankAccountOwnerSchema = v.object({
+  owner_app_id: v.pipe(v.string(), v.regex(/^[a-z0-9][a-z0-9-_]{1,63}$/))
+});
+var UpdateFioTokenSchema = v.pipe(
+  v.object({
+    fio_api_token: v.optional(v.pipe(v.string(), v.maxLength(512))),
+    fetch_enabled: v.optional(v.boolean()),
+    ingest_mode: v.optional(v.picklist(["api", "both"]))
+  }),
+  v.check(
+    (o) => o.fio_api_token !== void 0 || o.fetch_enabled !== void 0 || o.ingest_mode !== void 0,
+    "at least one of fio_api_token, fetch_enabled, ingest_mode must be provided"
+  )
+);
+var CreateConsumerSchema = v.object({
+  app_id: v.pipe(v.string(), v.regex(/^[a-z0-9][a-z0-9-_]{1,63}$/)),
+  callback_url: v.pipe(v.string(), v.url(), v.regex(/^https:\/\//))
+});
+var UpdateConsumerSchema = v.object({
+  callback_url: v.pipe(v.string(), v.url(), v.regex(/^https:\/\//))
+});
+var SPECIAL_HOSTS = /* @__PURE__ */ new Set([
+  "localhost",
+  "localhost.localdomain",
+  "local",
+  "internal",
+  "test",
+  "invalid",
+  "example",
+  "onion",
+  "home.arpa"
+]);
+var SPECIAL_SUFFIXES = [".localhost", ".local", ".internal", ".test", ".invalid", ".example", ".onion", ".home.arpa"];
+function isIpLiteral(hostname) {
+  if (hostname.startsWith("[") || hostname.endsWith("]")) return true;
+  return /^\d{1,3}(?:\.\d{1,3}){3}$/.test(hostname);
+}
+function validateCallbackUrl(raw, options) {
+  let url2;
+  try {
+    url2 = new URL(raw);
+  } catch {
+    throw new ValidationError([], "invalid_callback_url");
+  }
+  const hostname = url2.hostname.toLowerCase().replace(/\.$/, "");
+  if (url2.protocol !== "https:" || url2.username || url2.password || url2.hash || !hostname || SPECIAL_HOSTS.has(hostname) || SPECIAL_SUFFIXES.some((suffix) => hostname.endsWith(suffix)) || isIpLiteral(hostname)) {
+    throw new ValidationError([], "invalid_callback_url");
+  }
+  url2.hostname = hostname;
+  const allowed = (options.allowlist ?? "").split(",").map((value) => value.trim().toLowerCase().replace(/\.$/, "")).filter(Boolean);
+  if (options.environment === "production" && (!allowed.length || !allowed.includes(hostname))) {
+    throw new ValidationError([], "callback_host_not_allowed");
+  }
+  return url2.toString();
+}
+var CreateSubscriptionSchema = v.object({
+  app_id: v.pipe(v.string(), v.regex(/^[a-z0-9][a-z0-9-_]{1,63}$/)),
+  bank_account_id: v.pipe(v.number(), v.integer(), v.minValue(1))
+});
+var ReplayWebhookSchema = v.pipe(
+  v.object({
+    tx_id: v.optional(v.pipe(v.number(), v.integer(), v.minValue(1))),
+    delivery_id: v.optional(v.pipe(v.string(), v.regex(/^[0-9A-HJKMNP-TV-Z]{26}$/))),
+    // A replay must carry an operator reason; it is audited with the actor. An
+    // already-delivered job is only re-driven when force=true.
+    reason: v.pipe(v.string(), v.trim(), v.minLength(3), v.maxLength(500)),
+    force: v.optional(v.boolean())
+  }),
+  v.check(
+    (obj) => obj.tx_id !== void 0 || obj.delivery_id !== void 0,
+    "tx_id or delivery_id required"
+  )
+);
+
+// src/deliveryPolicy.ts
+var MAX_AUTOMATIC_HTTP_ATTEMPTS = 32;
+function classifyHttpStatus(status) {
+  if (status >= 200 && status <= 299) return "delivered";
+  if (status >= 300 && status <= 399) return "terminal";
+  if (status === 408 || status === 429 || status >= 500) return "retryable";
+  if (status >= 400 && status <= 499) return "terminal";
+  return "retryable";
+}
+function retryDelaySeconds(httpAttempt) {
+  return Math.min(30 * 2 ** Math.max(0, httpAttempt - 1), 3600);
+}
+function backoffSeconds(attempts) {
+  return Math.min(30 * 2 ** (attempts - 1), 1800);
+}
+
+// src/webhookDelivery.ts
+import { ulid } from "ulid";
+
+// src/alertOutbox.ts
+var STALLED_GRACE_SECONDS = 10 * 60;
+var CLAIM_LEASE_SECONDS = 60;
+function incidentPayload(kind, job, service) {
+  return JSON.stringify({
+    service,
+    incident_kind: kind,
+    delivery_job_id: job.id,
+    delivery_id: job.delivery_id,
+    consumer_app_id: job.consumer_app_id,
+    status: job.status,
+    last_error: job.last_error ?? null,
+    last_http_status: job.last_http_status ?? null,
+    detected_at: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+async function enqueue(db, row) {
+  await db.prepare(`
+    INSERT OR IGNORE INTO webhook_delivery_alerts
+      (delivery_job_id, incident_kind, incident_key, payload)
+    VALUES (?, ?, ?, ?)
+  `).bind(row.deliveryJobId, row.kind, row.incidentKey, row.payload).run();
+}
+async function enqueueTerminalIncident(db, job, service) {
+  await enqueue(db, {
+    deliveryJobId: job.id,
+    kind: "terminal",
+    incidentKey: `job:${job.id}:terminal:${job.incident_version}`,
+    payload: incidentPayload("terminal", job, service)
+  });
+}
+async function enqueueRecoveryIfOpen(db, job, service) {
+  const open = await db.prepare(`
+    SELECT id FROM webhook_delivery_alerts
+    WHERE delivery_job_id = ? AND incident_kind IN ('terminal', 'stalled') AND posted_at IS NOT NULL
+      AND NOT EXISTS (
+        SELECT 1 FROM webhook_delivery_alerts r
+        WHERE r.delivery_job_id = webhook_delivery_alerts.delivery_job_id
+          AND r.incident_kind = 'recovered'
+          AND r.incident_key = 'job:' || webhook_delivery_alerts.delivery_job_id || ':recovered:' || webhook_delivery_alerts.id
+      )
+    ORDER BY id DESC LIMIT 1
+  `).bind(job.id).first();
+  if (!open) return;
+  await enqueue(db, {
+    deliveryJobId: job.id,
+    kind: "recovered",
+    incidentKey: `job:${job.id}:recovered:${open.id}`,
+    payload: incidentPayload("recovered", job, service)
+  });
+}
+async function detectStalledIncidents(db, service) {
+  const rows = await db.prepare(`
+    SELECT j.id, j.delivery_id, j.consumer_app_id, j.incident_version, j.last_error, j.last_http_status, j.status
+    FROM webhook_delivery_jobs j
+    WHERE j.status IN ('pending', 'dispatching', 'queued')
+      AND datetime(j.created_at) <= datetime('now', '-${STALLED_GRACE_SECONDS} seconds')
+      AND NOT EXISTS (
+        SELECT 1 FROM webhook_delivery_alerts a
+        WHERE a.delivery_job_id = j.id AND a.incident_kind = 'stalled'
+          AND a.incident_key = 'job:' || j.id || ':stalled:' || j.incident_version
+      )
+    LIMIT 100
+  `).all();
+  for (const job of rows.results) {
+    await enqueue(db, {
+      deliveryJobId: job.id,
+      kind: "stalled",
+      incidentKey: `job:${job.id}:stalled:${job.incident_version}`,
+      payload: incidentPayload("stalled", job, service)
+    });
+  }
+  const recovered = await db.prepare(`
+    SELECT DISTINCT j.id, j.delivery_id, j.consumer_app_id, j.incident_version,
+           j.last_error, j.last_http_status, j.status
+    FROM webhook_delivery_jobs j
+    JOIN webhook_delivery_alerts a ON a.delivery_job_id = j.id
+    WHERE j.status = 'delivered'
+      AND a.incident_kind IN ('terminal', 'stalled')
+      AND a.posted_at IS NOT NULL
+      AND NOT EXISTS (
+        SELECT 1 FROM webhook_delivery_alerts r
+        WHERE r.delivery_job_id = a.delivery_job_id
+          AND r.incident_kind = 'recovered'
+          AND r.incident_key = 'job:' || a.delivery_job_id || ':recovered:' || a.id
+      )
+    LIMIT 100
+  `).all();
+  for (const job of recovered.results) await enqueueRecoveryIfOpen(db, job, service);
+  return rows.results.length;
+}
+function backoffSeconds2(attempts) {
+  return Math.min(30 * 2 ** Math.max(0, attempts), 1800);
+}
+async function drainDeliveryAlerts(db, cfg, limit = 20) {
+  if (!cfg.webhookUrl) return { posted: 0, failed: 0 };
+  const due = await db.prepare(`
+    SELECT id, payload, post_attempts, incident_key
+    FROM webhook_delivery_alerts
+    WHERE posted_at IS NULL
+      AND datetime(next_attempt_at) <= datetime('now')
+      AND (lease_until IS NULL OR datetime(lease_until) <= datetime('now'))
+    ORDER BY next_attempt_at, id
+    LIMIT ?
+  `).bind(limit).all();
+  let posted = 0;
+  let failed = 0;
+  for (const alert of due.results) {
+    const token = crypto.randomUUID();
+    const claim = await db.prepare(`
+      UPDATE webhook_delivery_alerts
+      SET lease_until = datetime('now', '+${CLAIM_LEASE_SECONDS} seconds'), dispatch_token = ?
+      WHERE id = ? AND posted_at IS NULL
+        AND (lease_until IS NULL OR datetime(lease_until) <= datetime('now'))
+    `).bind(token, alert.id).run();
+    if (claim.meta.changes !== 1) continue;
+    let ok = false;
+    try {
+      const res = await fetch(cfg.webhookUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          ...cfg.webhookSecret ? { Authorization: `Bearer ${cfg.webhookSecret}` } : {}
+        },
+        body: alert.payload
+      });
+      ok = res.ok;
+      if (!ok) throw new Error(`HTTP ${res.status}`);
+    } catch (err) {
+      failed++;
+      await db.prepare(`
+        UPDATE webhook_delivery_alerts
+        SET post_attempts = post_attempts + 1, lease_until = NULL,
+            next_attempt_at = datetime('now', '+' || ? || ' seconds'), last_error = ?
+        WHERE id = ? AND dispatch_token = ?
+      `).bind(backoffSeconds2(alert.post_attempts + 1), String(err), alert.id, token).run();
+      continue;
+    }
+    await db.prepare(`
+      UPDATE webhook_delivery_alerts
+      SET posted_at = datetime('now'), lease_until = NULL, last_error = NULL
+      WHERE id = ? AND dispatch_token = ?
+    `).bind(alert.id, token).run();
+    posted++;
+  }
+  if (posted > 0 || failed > 0) log("delivery_alerts_drained", { posted, failed });
+  return { posted, failed };
+}
+
+// src/webhookDelivery.ts
+var QUEUE_OWNERSHIP_HORIZON_SECONDS = 2 * 60 * 60;
+async function sha256Hex(input) {
+  const bytes = new TextEncoder().encode(input);
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function newDispatchToken() {
+  return crypto.randomUUID();
+}
+async function ensureDeliveryJobs(db, transactionId) {
+  const candidates = await db.prepare(`
+    SELECT t.*, b.pairing_code, s.consumer_app_id
+    FROM transactions t
+    JOIN bank_accounts b ON b.id = t.bank_account_id
+    JOIN webhook_subscriptions s ON s.bank_account_id = t.bank_account_id
+    WHERE (? IS NULL OR t.id = ?)
+      AND NOT EXISTS (
+        SELECT 1 FROM webhook_delivery_jobs j
+        WHERE j.transaction_id = t.id AND j.consumer_app_id = s.consumer_app_id
+          AND j.event_kind = 'transaction.received'
+      )
+      -- Intent is decided by the subscription interval at ingest, not by the
+      -- current active-subscription view. Exact UTC datetime (not julianday) so
+      -- a same-second create/delete/transaction is deterministic.
+      AND datetime(s.created_at) <= datetime(t.created_at)
+      AND (s.deleted_at IS NULL OR datetime(t.created_at) < datetime(s.deleted_at))
+  `).bind(transactionId ?? null, transactionId ?? null).all();
+  let created = 0;
+  for (const row of candidates.results) {
+    const deliveryId = ulid();
+    const envelope = buildWebhookEnvelope({
+      delivery_id: deliveryId,
+      pairing_code: row.pairing_code,
+      transaction: row
+    });
+    const payload = JSON.stringify(envelope);
+    const result = await db.prepare(`
+      INSERT OR IGNORE INTO webhook_delivery_jobs
+        (transaction_id, consumer_app_id, event_kind, delivery_id, payload, payload_sha256, status, next_attempt_at)
+      VALUES (?, ?, 'transaction.received', ?, ?, ?, 'pending', datetime('now'))
+    `).bind(row.id, row.consumer_app_id, deliveryId, payload, await sha256Hex(payload)).run();
+    created += result.meta.changes;
+  }
+  return created;
+}
+async function dueJobs(db, limit) {
+  const result = await db.prepare(`
+    SELECT id, transaction_id, consumer_app_id, event_kind, delivery_id, payload,
+           payload_sha256, status, generation, dispatch_token, http_attempt_count
+    FROM webhook_delivery_jobs
+    WHERE status IN ('pending', 'dispatching', 'queued')
+      AND datetime(next_attempt_at) <= datetime('now')
+      AND (lease_until IS NULL OR datetime(lease_until) <= datetime('now'))
+    ORDER BY next_attempt_at, id
+    LIMIT ?
+  `).bind(limit).all();
+  return result.results;
+}
+async function claimJob(db, jobId) {
+  const token = newDispatchToken();
+  const result = await db.prepare(`
+    UPDATE webhook_delivery_jobs
+    SET status = 'dispatching',
+        dispatch_token = ?,
+        dispatch_count = dispatch_count + 1,
+        lease_until = datetime('now', '+${QUEUE_OWNERSHIP_HORIZON_SECONDS} seconds'),
+        last_error = NULL
+    WHERE id = ?
+      AND status IN ('pending', 'dispatching', 'queued')
+      AND datetime(next_attempt_at) <= datetime('now')
+      AND (lease_until IS NULL OR datetime(lease_until) <= datetime('now'))
+  `).bind(token, jobId).run();
+  return result.meta.changes === 1 ? token : null;
+}
+async function enqueueClaimedJob(env, jobId, token) {
+  const job = await env.DB.prepare(`
+    SELECT id, transaction_id, consumer_app_id, event_kind, delivery_id, payload,
+           payload_sha256, status, generation, dispatch_token
+    FROM webhook_delivery_jobs WHERE id = ?
+  `).bind(jobId).first();
+  if (!job || job.dispatch_token !== token) return false;
+  let envelope;
+  try {
+    if (job.payload_sha256 && await sha256Hex(job.payload) !== job.payload_sha256) {
+      throw new Error("payload_hash_mismatch");
+    }
+    envelope = JSON.parse(job.payload);
+  } catch (parseErr) {
+    await recordDeliveryOutcome(env.DB, {
+      deliveryJobId: job.id,
+      generation: job.generation,
+      dispatchToken: token,
+      kind: "terminal",
+      error: `invalid_delivery_payload:${String(parseErr)}`
+    });
+    return false;
+  }
+  try {
+    await env.WEBHOOK_QUEUE.send({
+      message_version: 2,
+      delivery_job_id: job.id,
+      delivery_id: job.delivery_id,
+      consumer_app_id: job.consumer_app_id,
+      event_kind: job.event_kind,
+      bank_account_id: envelope.data.bank_account_id,
+      transaction_id: job.transaction_id,
+      generation: job.generation,
+      dispatch_token: token,
+      envelope
+    });
+  } catch (sendErr) {
+    await env.DB.prepare(`
+      UPDATE webhook_delivery_jobs
+      SET status = 'pending', lease_until = NULL, next_attempt_at = datetime('now'),
+          last_error = ?
+      WHERE id = ? AND generation = ? AND dispatch_token = ? AND status = 'dispatching'
+    `).bind(`queue_send_failed:${String(sendErr)}`, job.id, job.generation, token).run();
+    return false;
+  }
+  try {
+    await env.DB.prepare(`
+      UPDATE webhook_delivery_jobs
+      SET status = 'queued', lease_until = NULL,
+          next_attempt_at = datetime('now', '+${QUEUE_OWNERSHIP_HORIZON_SECONDS} seconds'),
+          last_error = NULL
+      WHERE id = ? AND generation = ? AND dispatch_token = ? AND status = 'dispatching'
+    `).bind(job.id, job.generation, token).run();
+  } catch {
+  }
+  return true;
+}
+async function dispatchDeliveryJob(env, jobId) {
+  const token = await claimJob(env.DB, jobId);
+  if (!token) return false;
+  return enqueueClaimedJob(env, jobId, token);
+}
+async function dispatchDueDeliveryJobs(env, limit = 50) {
+  const jobs = await dueJobs(env.DB, limit);
+  let queued = 0;
+  let failed = 0;
+  for (const job of jobs) {
+    if (await dispatchDeliveryJob(env, job.id)) queued++;
+    else failed++;
+  }
+  return { considered: jobs.length, queued, failed };
+}
+async function recordDeliveryOutcome(db, args) {
+  const { deliveryJobId, generation, dispatchToken, kind } = args;
+  const httpStatus = args.httpStatus ?? null;
+  let changes = 0;
+  if (kind === "delivered") {
+    const res = await db.prepare(`
+      UPDATE webhook_delivery_jobs
+      SET status = 'delivered', http_attempt_count = http_attempt_count + 1,
+          lease_until = NULL, last_http_status = ?, last_error = NULL,
+          business_outcome = ?, business_outcome_version = ?, receipt_json = ?,
+          delivered_at = datetime('now')
+      WHERE id = ? AND generation = ? AND status <> 'delivered'
+    `).bind(
+      httpStatus,
+      args.receipt?.outcome ?? null,
+      args.receipt?.receipt_version ?? null,
+      args.receipt ? JSON.stringify(args.receipt) : null,
+      deliveryJobId,
+      generation
+    ).run();
+    changes = res.meta.changes;
+  } else if (kind === "queue_retry") {
+    const res = await db.prepare(`
+      UPDATE webhook_delivery_jobs
+      SET status = 'queued', http_attempt_count = http_attempt_count + 1,
+          lease_until = NULL, last_http_status = ?, last_error = ?,
+          next_attempt_at = datetime('now', '+${QUEUE_OWNERSHIP_HORIZON_SECONDS} seconds')
+      WHERE id = ? AND generation = ? AND dispatch_token = ? AND status NOT IN ('delivered', 'terminal')
+    `).bind(httpStatus, args.error ?? null, deliveryJobId, generation, dispatchToken ?? null).run();
+    changes = res.meta.changes;
+  } else {
+    const delay = args.delaySeconds ?? retryDelaySeconds(1);
+    const forceTerminal = kind === "terminal" ? 1 : 0;
+    const res = await db.prepare(`
+      UPDATE webhook_delivery_jobs
+      SET http_attempt_count = http_attempt_count + 1,
+          status = CASE WHEN ? = 1 OR http_attempt_count + 1 >= ? THEN 'terminal' ELSE 'pending' END,
+          lease_until = NULL,
+          last_http_status = ?,
+          last_error = CASE WHEN ? = 1 OR http_attempt_count + 1 >= ?
+                            THEN COALESCE(?, 'max_automatic_attempts_exhausted') ELSE ? END,
+          next_attempt_at = CASE WHEN ? = 1 OR http_attempt_count + 1 >= ?
+                                 THEN next_attempt_at ELSE datetime('now', ?) END,
+          terminal_at = CASE WHEN ? = 1 OR http_attempt_count + 1 >= ?
+                             THEN datetime('now') ELSE terminal_at END
+      WHERE id = ? AND generation = ? AND dispatch_token = ? AND status NOT IN ('delivered', 'terminal')
+    `).bind(
+      forceTerminal,
+      MAX_AUTOMATIC_HTTP_ATTEMPTS,
+      httpStatus,
+      forceTerminal,
+      MAX_AUTOMATIC_HTTP_ATTEMPTS,
+      args.error ?? null,
+      args.error ?? null,
+      forceTerminal,
+      MAX_AUTOMATIC_HTTP_ATTEMPTS,
+      `+${delay} seconds`,
+      forceTerminal,
+      MAX_AUTOMATIC_HTTP_ATTEMPTS,
+      deliveryJobId,
+      generation,
+      dispatchToken ?? null
+    ).run();
+    changes = res.meta.changes;
+  }
+  const row = await db.prepare(`
+    SELECT id, status, generation, dispatch_token, delivery_id, consumer_app_id,
+           incident_version, last_error, last_http_status
+    FROM webhook_delivery_jobs WHERE id = ?
+  `).bind(deliveryJobId).first();
+  if (!row) return { applied: false, status: "not_found" };
+  if (changes > 0) {
+    const service = args.alertService ?? "banksync";
+    if (row.status === "terminal") await enqueueTerminalIncident(db, row, service);
+    else if (row.status === "delivered") await enqueueRecoveryIfOpen(db, row, service);
+    return { applied: true, status: row.status };
+  }
+  if (row.status === "delivered") return { applied: false, status: "delivered" };
+  const generationMismatch = row.generation !== generation;
+  const tokenMismatch = dispatchToken != null && row.dispatch_token !== dispatchToken;
+  if (generationMismatch || tokenMismatch) return { applied: false, status: "stale" };
+  return { applied: false, status: row.status };
+}
+async function replayDelivery(db, queue, jobId, opts = {}) {
+  const job = await db.prepare(`
+    SELECT id, delivery_id, status FROM webhook_delivery_jobs WHERE id = ?
+  `).bind(jobId).first();
+  if (!job) return { found: false, queued: false };
+  if (job.status === "pending" || job.status === "dispatching" || job.status === "queued") {
+    return { found: true, queued: false, delivery_id: job.delivery_id, noop: "active", previous_status: job.status };
+  }
+  if (job.status === "delivered" && !opts.force) {
+    return { found: true, queued: false, delivery_id: job.delivery_id, noop: "already_delivered", previous_status: job.status };
+  }
+  const incidentBump = job.status === "delivered" && opts.force ? ", incident_version = incident_version + 1" : "";
+  await db.prepare(`
+    UPDATE webhook_delivery_jobs
+    SET status = 'pending', generation = generation + 1, dispatch_token = NULL,
+        http_attempt_count = 0, dispatch_count = 0, lease_until = NULL,
+        next_attempt_at = datetime('now'), delivered_at = NULL, terminal_at = NULL,
+        last_http_status = NULL, last_error = 'manual_replay_requested'${incidentBump}
+    WHERE id = ?
+  `).bind(jobId).run();
+  const queued = await dispatchDeliveryJob({ DB: db, WEBHOOK_QUEUE: queue }, jobId);
+  return { found: true, queued, delivery_id: job.delivery_id, previous_status: job.status };
+}
+async function findDeliveryJob(db, deliveryId) {
+  return await db.prepare(`
+    SELECT id, transaction_id, consumer_app_id, event_kind, delivery_id, status,
+           generation, dispatch_token, http_attempt_count, next_attempt_at,
+           lease_until, last_http_status, last_error, created_at, delivered_at, terminal_at
+    FROM webhook_delivery_jobs WHERE delivery_id = ?
+  `).bind(deliveryId).first();
+}
+async function findDeliveryJobsForTransaction(db, transactionId) {
+  const result = await db.prepare(`
+    SELECT id, transaction_id, consumer_app_id, event_kind, delivery_id, payload,
+           status, generation, http_attempt_count
+    FROM webhook_delivery_jobs WHERE transaction_id = ? ORDER BY id
+  `).bind(transactionId).all();
+  return result.results;
+}
+async function listDeliveryJobs(db, query) {
+  const where = [];
+  const binds = [];
+  if (query.consumerAppId !== void 0) {
+    where.push("consumer_app_id = ?");
+    binds.push(query.consumerAppId);
+  }
+  if (query.status !== void 0) {
+    where.push("status = ?");
+    binds.push(query.status);
+  }
+  if (query.cursor !== void 0) {
+    where.push("id < ?");
+    binds.push(query.cursor);
+  }
+  const whereSql = where.length ? `WHERE ${where.join(" AND ")}` : "";
+  binds.push(query.limit);
+  const result = await db.prepare(`
+    SELECT id, transaction_id, consumer_app_id, event_kind, delivery_id, status,
+           generation, http_attempt_count, next_attempt_at, lease_until,
+           last_http_status, last_error, created_at, delivered_at, terminal_at
+    FROM webhook_delivery_jobs
+    ${whereSql}
+    ORDER BY id DESC LIMIT ?
+  `).bind(...binds).all();
+  return result.results;
+}
+
+// src/webhookSender.ts
+var FETCH_TIMEOUT_MS = 1e4;
+var MAX_RECEIPT_BYTES = 8 * 1024;
+async function readReceipt(response, deliveryId) {
+  const contentLength = Number(response.headers.get("content-length"));
+  if (Number.isFinite(contentLength) && contentLength > MAX_RECEIPT_BYTES) return { error: "receipt_too_large" };
+  if (!response.body) return { error: "receipt_missing" };
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > MAX_RECEIPT_BYTES) {
+        await reader.cancel();
+        return { error: "receipt_too_large" };
+      }
+      chunks.push(value);
+    }
+  } catch {
+    return { error: "receipt_read_failed" };
+  }
+  if (total === 0) return { error: "receipt_missing" };
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  try {
+    const parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    if (parsed.ok !== true || parsed.receipt_version !== 1 || parsed.delivery_id !== deliveryId || typeof parsed.outcome !== "string" || !/^[a-z0-9_]{1,64}$/.test(parsed.outcome) || parsed.order_id !== void 0 && (typeof parsed.order_id !== "string" || parsed.order_id.length > 200)) {
+      return { error: "receipt_invalid" };
+    }
+    const receipt = {
+      receipt_version: 1,
+      delivery_id: parsed.delivery_id,
+      outcome: parsed.outcome
+    };
+    if (typeof parsed.order_id === "string") receipt.order_id = parsed.order_id;
+    return { receipt };
+  } catch {
+    return { error: "receipt_invalid" };
+  }
+}
+async function httpResult(response, deliveryId, usedPrevSecret, primaryStatus) {
+  if (response.status < 200 || response.status > 299) {
+    return { kind: "http", httpStatus: response.status, usedPrevSecret, primaryStatus };
+  }
+  const parsed = await readReceipt(response, deliveryId);
+  return "receipt" in parsed ? { kind: "http", httpStatus: response.status, usedPrevSecret, primaryStatus, receipt: parsed.receipt } : { kind: "http", httpStatus: response.status, usedPrevSecret, primaryStatus, receiptError: parsed.error };
+}
+async function postSigned(url2, envelope, secret) {
+  const signed = await signWebhook({ envelope, secret });
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  try {
+    return await fetch(url2, {
+      method: "POST",
+      body: signed.bodyBytes.buffer,
+      headers: signed.headers,
+      signal: controller.signal,
+      redirect: "manual"
+    });
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
+function createWebhookSender(env) {
+  return {
+    async send(job) {
+      const consumer = await getConsumerSecretMaterials(env.DB, job.consumer_app_id);
+      if (!consumer) return { kind: "no_consumer" };
+      let callbackUrl;
+      try {
+        callbackUrl = validateCallbackUrl(consumer.callback_url, {
+          environment: env.ENV,
+          allowlist: env.CALLBACK_HOST_ALLOWLIST
+        });
+      } catch {
+        return { kind: "configuration_error", error: "callback_url_not_allowed" };
+      }
+      let primarySecret;
+      try {
+        primarySecret = await webhookDecrypt(consumer.primary_cipher, env.WEBHOOK_KEK);
+      } catch {
+        return { kind: "configuration_error", error: "consumer_secret_decrypt_failed" };
+      }
+      let primary;
+      try {
+        primary = await postSigned(callbackUrl, job.envelope, primarySecret);
+      } catch (err) {
+        return { kind: "network_error", error: String(err), usedPrevSecret: false };
+      }
+      if ((primary.status === 401 || primary.status === 403) && consumer.prev_cipher_in_grace !== null) {
+        let prevSecret;
+        try {
+          prevSecret = await webhookDecrypt(consumer.prev_cipher_in_grace, env.WEBHOOK_KEK);
+        } catch {
+          return { kind: "configuration_error", error: "consumer_secret_decrypt_failed" };
+        }
+        let prev;
+        try {
+          prev = await postSigned(callbackUrl, job.envelope, prevSecret);
+        } catch (err) {
+          return { kind: "network_error", error: String(err), usedPrevSecret: true };
+        }
+        return httpResult(prev, job.delivery_id, true, primary.status);
+      }
+      return httpResult(primary, job.delivery_id, false, null);
+    }
+  };
+}
+
+// src/webhookDeliveryCoordinator.ts
+function decodeV2Fence(m) {
+  if (m.message_version !== 2) return null;
+  if (typeof m.generation !== "number") return null;
+  if (typeof m.dispatch_token !== "string" || m.dispatch_token.length === 0) return null;
+  return { generation: m.generation, dispatchToken: m.dispatch_token };
+}
+function retryUnlessSettled(outcome, delaySeconds) {
+  if (outcome.status === "stale" || outcome.status === "delivered") return { action: "ack" };
+  return { action: "retry", delaySeconds };
+}
+function createWebhookDeliveryCoordinator(env, deps = {}) {
+  const db = env.DB;
+  const sender = deps.sender ?? createWebhookSender(env);
+  async function deadLetter(m, fence) {
+    await recordDeliveryOutcome(db, {
+      deliveryJobId: m.delivery_job_id,
+      ...fence,
+      kind: "retryable",
+      error: "queue_max_retries_exhausted",
+      delaySeconds: 300
+    });
+    log("webhook_delivery_dead_letter_requeued", { delivery_id: m.delivery_id, consumer_app_id: m.consumer_app_id });
+    return { action: "ack" };
+  }
+  async function handlePrimary(m, attempts, fence) {
+    const logBase = {
+      delivery_id: m.delivery_id,
+      consumer_app_id: m.consumer_app_id,
+      bank_account_id: m.bank_account_id,
+      transaction_id: m.transaction_id,
+      attempt: attempts
+    };
+    const result = await sender.send({ delivery_id: m.delivery_id, consumer_app_id: m.consumer_app_id, envelope: m.envelope });
+    if (result.kind === "no_consumer") {
+      log("webhook_consumer_not_found", { delivery_id: m.delivery_id, consumer_app_id: m.consumer_app_id });
+      await insertWebhookLogEntry(db, { ...logBase, http_status: null, error_message: "consumer_not_found" });
+      await recordDeliveryOutcome(db, { deliveryJobId: m.delivery_job_id, ...fence, kind: "terminal", error: "consumer_not_found" });
+      return { action: "ack" };
+    }
+    if (result.kind === "configuration_error") {
+      log("webhook_consumer_configuration_error", { delivery_id: m.delivery_id, consumer_app_id: m.consumer_app_id });
+      await insertWebhookLogEntry(db, { ...logBase, http_status: null, error_message: result.error });
+      await recordDeliveryOutcome(db, { deliveryJobId: m.delivery_job_id, ...fence, kind: "terminal", error: result.error });
+      return { action: "ack" };
+    }
+    if (result.kind === "network_error") {
+      const delaySeconds2 = backoffSeconds(attempts);
+      const errorMessage2 = result.usedPrevSecret ? `retry_with_prev:network_error:${result.error}` : result.error;
+      await insertWebhookLogEntry(db, { ...logBase, http_status: 0, error_message: errorMessage2 });
+      const outcome2 = await recordDeliveryOutcome(db, { deliveryJobId: m.delivery_job_id, ...fence, kind: "queue_retry", httpStatus: 0, error: errorMessage2, delaySeconds: delaySeconds2 });
+      log("webhook_network_error", { delivery_id: m.delivery_id, consumer_app_id: m.consumer_app_id, attempts, delay_seconds: delaySeconds2 });
+      return retryUnlessSettled(outcome2, delaySeconds2);
+    }
+    const { httpStatus, usedPrevSecret, primaryStatus } = result;
+    const cls = classifyHttpStatus(httpStatus);
+    if (cls === "delivered") {
+      if (!result.receipt) {
+        const delaySeconds2 = backoffSeconds(attempts);
+        const errorMessage2 = result.receiptError ?? "receipt_missing";
+        await insertWebhookLogEntry(db, { ...logBase, http_status: httpStatus, error_message: errorMessage2 });
+        const outcome2 = await recordDeliveryOutcome(db, { deliveryJobId: m.delivery_job_id, ...fence, kind: "queue_retry", httpStatus, error: errorMessage2, delaySeconds: delaySeconds2 });
+        log("webhook_receipt_invalid", { delivery_id: m.delivery_id, consumer_app_id: m.consumer_app_id, reason: errorMessage2, attempts, delay_seconds: delaySeconds2 });
+        return retryUnlessSettled(outcome2, delaySeconds2);
+      }
+      await insertWebhookLogEntry(db, { ...logBase, http_status: httpStatus, error_message: usedPrevSecret ? "retry_with_prev" : null });
+      await recordDeliveryOutcome(db, { deliveryJobId: m.delivery_job_id, ...fence, kind: "delivered", httpStatus, receipt: result.receipt });
+      log(usedPrevSecret ? "webhook_delivered_with_prev_secret" : "webhook_delivered", { delivery_id: m.delivery_id, consumer_app_id: m.consumer_app_id, http_status: httpStatus });
+      return { action: "ack" };
+    }
+    if (cls === "terminal") {
+      const terminalKind = httpStatus >= 300 && httpStatus <= 399 ? "redirect_not_allowed" : "4xx_client_error";
+      const errorMessage2 = usedPrevSecret ? `retry_with_prev:${terminalKind}:primary_${primaryStatus}_prev_${httpStatus}` : terminalKind;
+      await insertWebhookLogEntry(db, { ...logBase, http_status: httpStatus, error_message: errorMessage2 });
+      await recordDeliveryOutcome(db, { deliveryJobId: m.delivery_job_id, ...fence, kind: "terminal", httpStatus, error: errorMessage2 });
+      log("webhook_4xx_ack", { delivery_id: m.delivery_id, consumer_app_id: m.consumer_app_id, http_status: httpStatus });
+      return { action: "ack" };
+    }
+    const delaySeconds = backoffSeconds(attempts);
+    const errorMessage = `http_${httpStatus}`;
+    await insertWebhookLogEntry(db, { ...logBase, http_status: httpStatus, error_message: errorMessage });
+    const outcome = await recordDeliveryOutcome(db, { deliveryJobId: m.delivery_job_id, ...fence, kind: "queue_retry", httpStatus, error: errorMessage, delaySeconds });
+    log("webhook_retry", { delivery_id: m.delivery_id, consumer_app_id: m.consumer_app_id, http_status: httpStatus, attempts, delay_seconds: delaySeconds });
+    return retryUnlessSettled(outcome, delaySeconds);
+  }
+  return {
+    async observeTransaction(transactionId) {
+      const created = await ensureDeliveryJobs(db, transactionId);
+      const jobs = await findDeliveryJobsForTransaction(db, transactionId);
+      const results = await Promise.all(jobs.map((job) => dispatchDeliveryJob(env, job.id)));
+      return { created, dispatched: results.filter(Boolean).length };
+    },
+    async sweep(options) {
+      const created = await ensureDeliveryJobs(db);
+      const dispatch2 = await dispatchDueDeliveryJobs(env, options?.limit ?? 50);
+      return { created, ...dispatch2 };
+    },
+    handleAttempt(message, ctx) {
+      const fence = decodeV2Fence(message);
+      if (!fence) {
+        log("webhook_message_protocol_error", { delivery_id: message.delivery_id, consumer_app_id: message.consumer_app_id });
+        return Promise.resolve({ action: "ack" });
+      }
+      return ctx.source === "dead_letter" ? deadLetter(message, fence) : handlePrimary(message, ctx.attempts, fence);
+    },
+    replay(jobId, opts) {
+      return replayDelivery(db, env.WEBHOOK_QUEUE, jobId, opts);
+    }
+  };
+}
+var DeliveryQueries = {
+  list(db, query) {
+    return listDeliveryJobs(db, query);
+  }
+};
+
+// src/queue.ts
+async function handleQueueBatch(batch, env) {
+  await assertSchemaVersion(env.DB);
+  const coordinator = createWebhookDeliveryCoordinator(env);
+  if (batch.queue === "banksync-webhooks") {
+    for (const raw of batch.messages) {
+      const msg = raw;
+      await applyDisposition(msg, () => coordinator.handleAttempt(msg.body, { attempts: msg.attempts, source: "primary" }));
+    }
+  } else if (batch.queue === "banksync-webhooks-dlq") {
+    for (const raw of batch.messages) {
+      const msg = raw;
+      await applyDisposition(msg, () => coordinator.handleAttempt(msg.body, { attempts: msg.attempts, source: "dead_letter" }));
+    }
+  } else {
+    logError("queue_unknown_binding", new Error(`unknown queue: ${batch.queue}`), { queue: batch.queue });
+    for (const raw of batch.messages) raw.ack();
+  }
+}
+async function applyDisposition(msg, run) {
+  try {
+    const disposition = await run();
+    if (disposition.action === "ack") msg.ack();
+    else msg.retry({ delaySeconds: disposition.delaySeconds });
+  } catch (err) {
+    logError("webhook_unexpected_error", err, { delivery_id: msg.body.delivery_id, consumer_app_id: msg.body.consumer_app_id });
+    msg.retry({ delaySeconds: 60 });
+  }
+}
+
+// src/cf_routing.ts
+var CF_API = "https://api.cloudflare.com/client/v4";
+var CfRoutingError = class extends Error {
+  constructor(status, cfErrors, summary) {
+    super(summary);
+    this.status = status;
+    this.cfErrors = cfErrors;
+    this.name = "CfRoutingError";
+  }
+  status;
+  cfErrors;
+};
+function cfRoutingEnabled(cfg) {
+  return Boolean(cfg.apiToken && cfg.apiToken.length > 0);
+}
+function pairingEmail(domain, pairingCode) {
+  return `${pairingCode}@${domain}`;
+}
+async function createRule(cfg, pairingCode) {
+  if (!cfRoutingEnabled(cfg)) {
+    log("cf_routing_skipped", { op: "create", pairing_code: pairingCode, reason: "CF_API_TOKEN unset" });
+    return null;
+  }
+  const matcherValue = pairingEmail(cfg.domain, pairingCode);
+  const body = {
+    matchers: [{ type: "literal", field: "to", value: matcherValue }],
+    actions: [{ type: "worker", value: ["banksync"] }],
+    enabled: true,
+    name: `auto: ${matcherValue}`
+  };
+  const res = await fetch(`${CF_API}/zones/${cfg.zoneId}/email/routing/rules`, {
+    method: "POST",
+    headers: {
+      "Authorization": `Bearer ${cfg.apiToken}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify(body)
+  });
+  const json = await res.json();
+  if (!res.ok || !json.success || !json.result?.id) {
+    const errs = json.errors ?? [];
+    throw new CfRoutingError(
+      res.status,
+      errs,
+      `cf_routing_create_failed: ${res.status} ${errs.map((e) => `[${e.code}]${e.message}`).join("; ") || "unknown"}`
+    );
+  }
+  log("cf_routing_rule_created", { rule_id: json.result.id, pairing_code: pairingCode });
+  return json.result.id;
+}
+async function deleteRule(cfg, ruleId) {
+  if (!cfRoutingEnabled(cfg)) {
+    log("cf_routing_skipped", { op: "delete", rule_id: ruleId, reason: "CF_API_TOKEN unset" });
+    return;
+  }
+  const res = await fetch(`${CF_API}/zones/${cfg.zoneId}/email/routing/rules/${ruleId}`, {
+    method: "DELETE",
+    headers: { "Authorization": `Bearer ${cfg.apiToken}` }
+  });
+  if (res.status === 404) {
+    log("cf_routing_rule_already_gone", { rule_id: ruleId });
+    return;
+  }
+  const json = await res.json();
+  if (!res.ok || !json.success) {
+    const errs = json.errors ?? [];
+    throw new CfRoutingError(
+      res.status,
+      errs,
+      `cf_routing_delete_failed: ${res.status} ${errs.map((e) => `[${e.code}]${e.message}`).join("; ") || "unknown"}`
+    );
+  }
+  log("cf_routing_rule_deleted", { rule_id: ruleId });
+}
+async function safeDeleteRule(cfg, ruleId) {
+  try {
+    await deleteRule(cfg, ruleId);
+    return true;
+  } catch (err) {
+    logError("cf_routing_safe_delete_failed", err, { rule_id: ruleId });
+    return false;
+  }
+}
+
+// src/auth.ts
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+}
+async function hashKey(plain) {
+  const bytes = new TextEncoder().encode(plain);
+  const buf = await crypto.subtle.digest("SHA-256", bytes);
+  return Array.from(new Uint8Array(buf)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function generateTenantAdminKey() {
+  const random = crypto.getRandomValues(new Uint8Array(32));
+  const b64 = btoa(String.fromCharCode(...random)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  const plain = `bksk_${b64}`;
+  const prefix = plain.slice(0, 12);
+  const hash = await hashKey(plain);
+  return { plain, prefix, hash };
+}
+async function resolveAuth(req, env) {
+  const adminSecret = req.headers.get("X-Admin-Secret");
+  if (adminSecret && env.ADMIN_SECRET && timingSafeEqual(adminSecret, env.ADMIN_SECRET)) {
+    return { type: "admin" };
+  }
+  const tenantKey = req.headers.get("X-Tenant-Secret");
+  if (tenantKey && tenantKey.length >= 12) {
+    const prefix = tenantKey.slice(0, 12);
+    const consumer = await findConsumerByAdminKeyPrefix(env.DB, prefix);
+    if (consumer && consumer.admin_key_hash) {
+      const candidateHash = await hashKey(tenantKey);
+      if (timingSafeEqual(candidateHash, consumer.admin_key_hash)) {
+        return { type: "tenant", app_id: consumer.app_id };
+      }
+    }
+  }
+  return { type: "unauth" };
+}
+
+// src/outbox.ts
+var MAX_ATTEMPTS = 10;
+function nextAttemptAt(attempts) {
+  const seconds = Math.min(60 * Math.pow(2, attempts - 1), 3600);
+  return new Date(Date.now() + seconds * 1e3).toISOString().replace("T", " ").replace(/\..+$/, "");
+}
+async function enqueueCreate(db, args) {
+  const row = await db.prepare(`INSERT INTO cf_routing_outbox (op, pairing_code, bank_account_id) VALUES ('create', ?, ?) RETURNING id`).bind(args.pairing_code, args.bank_account_id).first();
+  if (!row) throw new Error("enqueueCreate: no row returned");
+  return row.id;
+}
+async function enqueueDelete(db, args) {
+  const row = await db.prepare(`INSERT INTO cf_routing_outbox (op, cf_rule_id) VALUES ('delete', ?) RETURNING id`).bind(args.cf_rule_id).first();
+  if (!row) throw new Error("enqueueDelete: no row returned");
+  return row.id;
+}
+async function markCompleted(db, outboxId, cfRuleIdForCreate) {
+  const outboxUpdate = db.prepare(
+    `UPDATE cf_routing_outbox SET status = 'completed', completed_at = datetime('now'), cf_rule_id = COALESCE(?, cf_rule_id) WHERE id = ?`
+  ).bind(cfRuleIdForCreate ?? null, outboxId);
+  if (cfRuleIdForCreate) {
+    const row = await db.prepare(`SELECT bank_account_id FROM cf_routing_outbox WHERE id = ?`).bind(outboxId).first();
+    const bankAccountId = row?.bank_account_id ?? null;
+    if (bankAccountId !== null) {
+      const bankUpdate = db.prepare(
+        `UPDATE bank_accounts SET cf_rule_id = ? WHERE id = ?`
+      ).bind(cfRuleIdForCreate, bankAccountId);
+      await db.batch([outboxUpdate, bankUpdate]);
+      return;
+    }
+  }
+  await outboxUpdate.run();
+}
+async function markFailureAttempt(db, outboxId, error) {
+  const row = await db.prepare(`SELECT attempts FROM cf_routing_outbox WHERE id = ?`).bind(outboxId).first();
+  const currentAttempts = row?.attempts ?? 0;
+  const newAttempts = currentAttempts + 1;
+  const nextAt = nextAttemptAt(newAttempts);
+  const newStatus = newAttempts >= MAX_ATTEMPTS ? "failed" : "pending";
+  await db.prepare(`UPDATE cf_routing_outbox SET attempts = ?, last_error = ?, next_attempt_at = ?, status = ? WHERE id = ?`).bind(newAttempts, error, nextAt, newStatus, outboxId).run();
+}
+async function fetchDuePending(db, limit = 50) {
+  const result = await db.prepare(`SELECT * FROM cf_routing_outbox WHERE status = 'pending' AND next_attempt_at <= datetime('now') ORDER BY id LIMIT ?`).bind(limit).all();
+  return result.results;
+}
+async function currentCreateTarget(db, row) {
+  if (row.bank_account_id === null) return null;
+  return db.prepare(`SELECT pairing_code, cf_rule_id FROM bank_accounts WHERE id = ?`).bind(row.bank_account_id).first();
+}
+async function claimCreatedRule(db, row, ruleId) {
+  if (row.bank_account_id === null || !row.pairing_code) return false;
+  const claimed = await db.prepare(`UPDATE bank_accounts
+      SET cf_rule_id = ?
+      WHERE id = ? AND pairing_code = ? AND cf_rule_id IS NULL
+      RETURNING id`).bind(ruleId, row.bank_account_id, row.pairing_code).first();
+  return claimed !== null;
+}
+async function processOutbox(db, cfg) {
+  const counts = { attempted: 0, succeeded: 0, failed_attempt: 0, exhausted: 0 };
+  if (!cfRoutingEnabled(cfg)) {
+    log("outbox_skipped", { reason: "CF_API_TOKEN unset" });
+    return counts;
+  }
+  const rows = await fetchDuePending(db);
+  for (const row of rows) {
+    counts.attempted++;
+    try {
+      if (row.op === "create") {
+        if (!row.pairing_code || row.bank_account_id === null) {
+          await markFailureAttempt(db, row.id, "outbox_create_missing_pairing_code");
+          counts.failed_attempt++;
+          if (row.attempts + 1 >= MAX_ATTEMPTS) counts.exhausted++;
+          continue;
+        }
+        const target = await currentCreateTarget(db, row);
+        if (!target || target.pairing_code !== row.pairing_code) {
+          await markCompleted(db, row.id);
+          log("outbox_create_cancelled", { outbox_id: row.id, reason: "stale_target" });
+          counts.succeeded++;
+          continue;
+        }
+        if (target.cf_rule_id) {
+          await markCompleted(db, row.id, target.cf_rule_id);
+          counts.succeeded++;
+          continue;
+        }
+        const ruleId = await createRule(cfg, row.pairing_code);
+        if (!ruleId) throw new Error("outbox_create_missing_rule_id");
+        if (!await claimCreatedRule(db, row, ruleId)) {
+          await deleteRule(cfg, ruleId);
+          await markCompleted(db, row.id);
+          log("outbox_create_cancelled", { outbox_id: row.id, reason: "lost_claim" });
+          counts.succeeded++;
+          continue;
+        }
+        await markCompleted(db, row.id, ruleId);
+        log("outbox_create_succeeded", { outbox_id: row.id, pairing_code: row.pairing_code });
+        counts.succeeded++;
+      } else {
+        if (!row.cf_rule_id) {
+          await markFailureAttempt(db, row.id, "outbox_delete_missing_cf_rule_id");
+          counts.failed_attempt++;
+          if (row.attempts + 1 >= MAX_ATTEMPTS) counts.exhausted++;
+          continue;
+        }
+        await deleteRule(cfg, row.cf_rule_id);
+        await markCompleted(db, row.id);
+        log("outbox_delete_succeeded", { outbox_id: row.id, cf_rule_id: row.cf_rule_id });
+        counts.succeeded++;
+      }
+    } catch (err) {
+      const errMsg = err instanceof CfRoutingError ? `CF ${err.status}: ${err.message}` : String(err);
+      logError("outbox_op_failed", err, { outbox_id: row.id, op: row.op });
+      const prevAttempts = row.attempts;
+      await markFailureAttempt(db, row.id, errMsg);
+      counts.failed_attempt++;
+      if (prevAttempts + 1 >= MAX_ATTEMPTS) counts.exhausted++;
+    }
+  }
+  if (counts.attempted > 0) {
+    log("outbox_reconcile_done", {
+      attempted: counts.attempted,
+      succeeded: counts.succeeded,
+      failed_attempt: counts.failed_attempt,
+      exhausted: counts.exhausted
+    });
+  }
+  return counts;
+}
+
+// src/cfIntent.ts
+async function provisionRoute(db, cfg, args) {
+  await db.prepare(`UPDATE cf_routing_outbox SET bank_account_id = ? WHERE id = ?`).bind(args.bankAccountId, args.outboxId).run();
+  try {
+    const cfRuleId = await createRule(cfg, args.pairing);
+    await markCompleted(db, args.outboxId, cfRuleId);
+    return cfRuleId;
+  } catch (err) {
+    await markFailureAttempt(db, args.outboxId, String(err));
+    logError("cf_routing_create_deferred", err, { bank_account_id: args.bankAccountId });
+    return null;
+  }
+}
+async function deprovisionRoute(db, cfg, cfRuleId) {
+  await enqueueDelete(db, { cf_rule_id: cfRuleId });
+  safeDeleteRule(cfg, cfRuleId).catch((err) => {
+    logError("cf_routing_delete_deferred", err, { cf_rule_id: cfRuleId });
+  });
+}
+async function regenerateRoute(db, cfg, args) {
+  let newCfRuleId = null;
+  try {
+    newCfRuleId = await createRule(cfg, args.newPairing);
+  } catch (err) {
+    logError("cf_routing_create_failed_on_regen", err, { id: args.id, pairing_code: args.newPairing });
+    const status = err instanceof CfRoutingError ? 503 : 500;
+    return { ok: false, status, body: { error: "cf_routing_create_failed" } };
+  }
+  let account;
+  try {
+    account = await regenerateBankAccountPairing(db, args.id, args.newPairing, newCfRuleId);
+  } catch (err) {
+    if (newCfRuleId) await safeDeleteRule(cfg, newCfRuleId);
+    throw err;
+  }
+  if (!account) {
+    if (newCfRuleId) await safeDeleteRule(cfg, newCfRuleId);
+    return { ok: false, status: 404, body: { error: "not_found" } };
+  }
+  if (args.existingCfRuleId) {
+    await safeDeleteRule(cfg, args.existingCfRuleId);
+  }
+  return { ok: true, account };
+}
+async function clearStuckOutbox(db) {
+  const result = await db.prepare(
+    `DELETE FROM cf_routing_outbox
+       WHERE last_error LIKE '%409%'
+         AND attempts >= 2
+         AND status IN ('pending', 'failed')`
+  ).run();
+  return result.meta.changes ?? 0;
+}
+
+// src/idempotency.ts
+async function sha256Hex2(s) {
+  const bytes = new TextEncoder().encode(s);
+  const buf = await crypto.subtle.digest("SHA-256", bytes);
+  return Array.from(new Uint8Array(buf)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function checkIdempotency(args) {
+  const { db, request, authPrincipal, requestBodyText } = args;
+  const idemKey = request.headers.get("Idempotency-Key");
+  if (!idemKey || idemKey.length < 1 || idemKey.length > 255) {
+    return { kind: "miss", keyHash: "" };
+  }
+  const requestPath = new URL(request.url).pathname;
+  const requestMethod = request.method.toUpperCase();
+  const keyHash = await sha256Hex2(`${authPrincipal}
+${requestMethod}
+${requestPath}
+${idemKey}`);
+  const bodyHash = requestBodyText.length > 0 ? await sha256Hex2(requestBodyText) : null;
+  const reservation = await db.prepare(`
+    INSERT OR IGNORE INTO idempotency_keys
+      (key_hash, auth_principal, request_path, request_method, request_body_hash, response_status, response_body)
+    VALUES (?, ?, ?, ?, ?, 0, '')
+  `).bind(keyHash, authPrincipal, requestPath, requestMethod, bodyHash).run();
+  if (reservation.meta.changes === 1) return { kind: "miss", keyHash };
+  const row = await db.prepare(`SELECT auth_principal, request_path, request_method, request_body_hash, response_status, response_body FROM idempotency_keys WHERE key_hash = ?`).bind(keyHash).first();
+  if (!row) return { kind: "miss", keyHash };
+  if (row.auth_principal !== authPrincipal || row.request_path !== requestPath || row.request_method !== requestMethod || (row.request_body_hash ?? null) !== bodyHash) {
+    return { kind: "mismatch" };
+  }
+  if (row.response_status === 0) return { kind: "in_flight" };
+  return { kind: "hit", status: row.response_status, body: row.response_body };
+}
+async function recordIdempotency(args) {
+  const { db, keyHash, authPrincipal, requestPath, requestMethod, requestBodyHash, responseStatus, responseBody } = args;
+  if (!keyHash) return;
+  if (responseStatus >= 500) {
+    await db.prepare(`DELETE FROM idempotency_keys WHERE key_hash = ? AND response_status = 0`).bind(keyHash).run();
+    return;
+  }
+  await db.prepare(`
+      UPDATE idempotency_keys
+      SET response_status = ?, response_body = ?
+      WHERE key_hash = ? AND auth_principal = ? AND request_path = ?
+        AND request_method = ? AND request_body_hash IS ? AND response_status = 0
+    `).bind(responseStatus, responseBody, keyHash, authPrincipal, requestPath, requestMethod, requestBodyHash).run();
+}
+
+// src/audit.ts
+var REDACT_PATTERN = /^(.*secret.*|.*token.*|.*key.*|.*password.*|raw_email)$/i;
+var REDACT_ALLOWLIST = /* @__PURE__ */ new Set(["secret_prefix", "admin_key_prefix", "key_hash", "api_token_prefix", "fio_token_prefix"]);
+var MAX_BYTES = 4096;
+function truncateTo4KB(s) {
+  const encoded = new TextEncoder().encode(s);
+  if (encoded.length <= MAX_BYTES) return s;
+  return new TextDecoder().decode(encoded.slice(0, MAX_BYTES));
+}
+function redactObject(obj) {
+  if (Array.isArray(obj)) {
+    return obj.map(redactObject);
+  }
+  if (obj !== null && typeof obj === "object") {
+    const result = {};
+    for (const [k, v2] of Object.entries(obj)) {
+      if (!REDACT_ALLOWLIST.has(k) && REDACT_PATTERN.test(k)) {
+        result[k] = "[REDACTED]";
+      } else {
+        result[k] = redactObject(v2);
+      }
+    }
+    return result;
+  }
+  return obj;
+}
+function redactBodyForAudit(body) {
+  try {
+    const parsed = JSON.parse(body);
+    const redacted = redactObject(parsed);
+    return truncateTo4KB(JSON.stringify(redacted));
+  } catch {
+    return "[UNPARSEABLE BODY REDACTED]";
+  }
+}
+function shouldAuditMethod(method) {
+  return method === "POST" || method === "PUT" || method === "DELETE" || method === "PATCH";
+}
+async function recordAudit(args) {
+  const {
+    db,
+    authPrincipal,
+    httpMethod,
+    requestPath,
+    httpStatus,
+    requestBodySummary,
+    sourceIp,
+    userAgent,
+    durationMs
+  } = args;
+  const summary = requestBodySummary != null ? truncateTo4KB(requestBodySummary) : null;
+  try {
+    await db.prepare(
+      `INSERT INTO admin_audit_log
+          (auth_principal, http_method, request_path, http_status, request_body_summary, source_ip, user_agent, duration_ms)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+    ).bind(
+      authPrincipal,
+      httpMethod,
+      requestPath,
+      httpStatus,
+      summary ?? null,
+      sourceIp ?? null,
+      userAgent ?? null,
+      durationMs ?? null
+    ).run();
+  } catch (err) {
+    console.error("audit_write_failed", err);
+  }
+}
+async function listAuditLog(db, args = {}) {
+  const since = args.since ?? new Date(Date.now() - 30 * 24 * 60 * 60 * 1e3).toISOString();
+  const principal = args.authPrincipal ?? null;
+  const limit = Math.min(args.limit ?? 50, 500);
+  const result = await db.prepare(
+    `SELECT id, auth_principal, http_method, request_path, http_status,
+              request_body_summary, source_ip, user_agent, duration_ms, created_at
+       FROM admin_audit_log
+       WHERE created_at > datetime(?) AND (? IS NULL OR auth_principal = ?)
+       ORDER BY id DESC
+       LIMIT ?`
+  ).bind(since, principal, principal, limit).all();
+  return result.results;
+}
+
+// src/rate_limit.ts
+var DEFAULT_RATE_LIMIT = { windowSeconds: 60, limit: 100 };
+function bucketKey(date) {
+  return date.toISOString().slice(0, 16).replace("T", " ");
+}
+async function checkAndIncrement(db, principal, cfg = DEFAULT_RATE_LIMIT) {
+  const now = /* @__PURE__ */ new Date();
+  const windowStart = new Date(now.getTime() - cfg.windowSeconds * 1e3);
+  const currentBucket = bucketKey(now);
+  const windowStartBucket = bucketKey(windowStart);
+  await db.prepare(`
+      INSERT INTO rate_limit_buckets (principal, window_start, count)
+      VALUES (?, ?, 1)
+      ON CONFLICT(principal, window_start) DO UPDATE SET count = count + 1
+    `).bind(principal, currentBucket).run();
+  const sumRow = await db.prepare(`SELECT COALESCE(SUM(count), 0) as total FROM rate_limit_buckets WHERE principal = ? AND window_start >= ?`).bind(principal, windowStartBucket).first();
+  const currentCount = sumRow?.total ?? 0;
+  if (currentCount > cfg.limit) {
+    log("rate_limit_denied", { principal, count: currentCount, limit: cfg.limit });
+    return {
+      allowed: false,
+      count: cfg.limit,
+      limit: cfg.limit,
+      retryAfter: cfg.windowSeconds
+    };
+  }
+  return {
+    allowed: true,
+    count: currentCount,
+    limit: cfg.limit,
+    retryAfter: 0
+  };
+}
+async function pruneOldBuckets(db) {
+  const cutoff = new Date(Date.now() - 60 * 60 * 1e3);
+  const cutoffBucket = bucketKey(cutoff);
+  const result = await db.prepare(`DELETE FROM rate_limit_buckets WHERE window_start < ?`).bind(cutoffBucket).run();
+  return { deleted: result.meta.changes };
+}
+
+// src/health_deep.ts
+function probeRequiredSecrets(secrets) {
+  if (!secrets) return "green";
+  const allPresent = secrets.alertWebhookPresent && secrets.backupsPresent && secrets.emailAuthPresent && secrets.callbackPolicyPresent;
+  if (allPresent) return "green";
+  return secrets.isProduction ? "red" : "yellow";
+}
+var CF_API2 = "https://api.cloudflare.com/client/v4";
+function aggregateStatus(statuses) {
+  if (statuses.some((s) => s === "red")) return "red";
+  if (statuses.some((s) => s === "yellow")) return "yellow";
+  return "green";
+}
+async function probeDbRead(db) {
+  const t0 = Date.now();
+  try {
+    await db.prepare("SELECT 1 as ok").first();
+    const ms = Date.now() - t0;
+    const status = ms < 200 ? "green" : ms < 1e3 ? "yellow" : "red";
+    return { status, latency_ms: ms };
+  } catch {
+    return { status: "red", latency_ms: Date.now() - t0 };
+  }
+}
+async function probeDbWrite(db) {
+  const t0 = Date.now();
+  let rowId = null;
+  try {
+    const inserted = await db.prepare(`INSERT INTO event_log (event_type) VALUES ('health_probe') RETURNING id`).first();
+    rowId = inserted?.id ?? null;
+    const ms = Date.now() - t0;
+    const status = ms < 500 ? "green" : ms < 2e3 ? "yellow" : "red";
+    return { status, latency_ms: ms };
+  } catch {
+    return { status: "red", latency_ms: Date.now() - t0 };
+  } finally {
+    if (rowId !== null) {
+      try {
+        await db.prepare("DELETE FROM event_log WHERE id = ?").bind(rowId).run();
+      } catch {
+      }
+    }
+  }
+}
+function probeQueueProducer(queue) {
+  if (queue === null) return { status: "yellow", skipped: true };
+  return { status: typeof queue.send === "function" ? "green" : "yellow", skipped: false };
+}
+async function probeCfApi(cfg) {
+  if (!cfRoutingEnabled(cfg)) return { status: "green" };
+  const t0 = Date.now();
+  try {
+    const res = await fetch(`${CF_API2}/zones/${cfg.zoneId}/email/routing`, {
+      method: "GET",
+      headers: { "Authorization": `Bearer ${cfg.apiToken}` }
+    });
+    const ms = Date.now() - t0;
+    const httpStatus = res.status;
+    if (!res.ok) return { status: "red", latency_ms: ms, http_status: httpStatus };
+    const status = ms < 1e3 ? "green" : ms < 3e3 ? "yellow" : "red";
+    return { status, latency_ms: ms, http_status: httpStatus };
+  } catch {
+    return { status: "red", latency_ms: Date.now() - t0 };
+  }
+}
+async function probeOutboxDrift(db) {
+  try {
+    const [pendingRow, failedRow] = await Promise.all([
+      db.prepare(`SELECT COUNT(*) as cnt FROM cf_routing_outbox WHERE status = 'pending'`).first(),
+      db.prepare(`SELECT COUNT(*) as cnt FROM cf_routing_outbox WHERE status = 'failed'`).first()
+    ]);
+    const pending = pendingRow?.cnt ?? 0;
+    const failed = failedRow?.cnt ?? 0;
+    let status = "green";
+    if (failed > 0) status = "red";
+    else if (pending > 0) status = "yellow";
+    return { status, pending_count: pending, failed_count: failed };
+  } catch {
+    return { status: "red", pending_count: 0, failed_count: 0 };
+  }
+}
+async function deepHealth(args) {
+  const probed_at = (/* @__PURE__ */ new Date()).toISOString();
+  const [dbRead, dbWrite, cfApi, outboxDrift] = await Promise.all([
+    probeDbRead(args.db),
+    probeDbWrite(args.db),
+    probeCfApi(args.cf),
+    probeOutboxDrift(args.db)
+  ]);
+  const queueProbe = probeQueueProducer(args.queue);
+  const components = {
+    db_read: dbRead.status,
+    db_write: dbWrite.status,
+    queue_producer: queueProbe.status,
+    cf_api: cfApi.status,
+    outbox_drift: outboxDrift.status,
+    required_secrets: probeRequiredSecrets(args.secrets)
+  };
+  const status = aggregateStatus(Object.values(components));
+  const details = {
+    queue_send_skipped: queueProbe.skipped,
+    outbox_pending_count: outboxDrift.pending_count,
+    outbox_failed_count: outboxDrift.failed_count
+  };
+  if (dbRead.latency_ms !== void 0) details.db_read_latency_ms = dbRead.latency_ms;
+  if (dbWrite.latency_ms !== void 0) details.db_write_latency_ms = dbWrite.latency_ms;
+  if (cfApi.latency_ms !== void 0) details.cf_api_latency_ms = cfApi.latency_ms;
+  if (cfApi.http_status !== void 0) details.cf_api_status = cfApi.http_status;
+  return {
+    status,
+    components,
+    details,
+    probed_at
+  };
+}
+async function fetchAllCfRules(cfg) {
+  const rules = [];
+  let url2 = `${CF_API2}/zones/${cfg.zoneId}/email/routing/rules?per_page=1000`;
+  while (url2 !== null) {
+    const res = await fetch(url2, {
+      headers: { "Authorization": `Bearer ${cfg.apiToken}` }
+    });
+    if (!res.ok) throw new Error(`CF rules list failed: ${res.status}`);
+    const json = await res.json();
+    if (!json.success || !json.result) throw new Error("CF rules list: success=false");
+    rules.push(...json.result);
+    const cursor = json.result_info?.cursor;
+    url2 = cursor ? `${CF_API2}/zones/${cfg.zoneId}/email/routing/rules?per_page=1000&cursor=${encodeURIComponent(cursor)}` : null;
+  }
+  return rules;
+}
+async function auditCfRoutingDrift(args) {
+  const { db, cf } = args;
+  const outboxResult = await db.prepare(`SELECT id, op, pairing_code, cf_rule_id, bank_account_id, status, attempts, last_error, created_at FROM cf_routing_outbox WHERE status IN ('pending', 'failed') ORDER BY id`).all();
+  const outbox_pending = outboxResult.results;
+  if (!cfRoutingEnabled(cf)) {
+    return {
+      outbox_pending,
+      db_rows_missing_cf_rule: [],
+      cf_rules_orphaned: [],
+      cf_api_disabled: true
+    };
+  }
+  const dbAccountsResult = await db.prepare(`SELECT id, account_number, pairing_code, cf_rule_id FROM bank_accounts WHERE ingest_mode IN ('email', 'both') ORDER BY id`).all();
+  const dbAccounts = dbAccountsResult.results;
+  const cfRules = await fetchAllCfRules(cf);
+  const cfRuleIds = new Set(cfRules.map((r) => r.id));
+  const db_rows_missing_cf_rule = dbAccounts.filter(
+    (a) => a.cf_rule_id === null || !cfRuleIds.has(a.cf_rule_id)
+  );
+  const dbCfRuleIds = new Set(
+    dbAccounts.map((a) => a.cf_rule_id).filter((id) => id !== null)
+  );
+  const banksyncPattern = new RegExp(`^[0-9a-f]{4,32}@${escapeRegExp(cf.domain)}$`);
+  const cf_rules_orphaned = cfRules.filter((r) => {
+    const firstMatcher = r.matchers?.[0];
+    if (!firstMatcher) return false;
+    if (firstMatcher.type !== "literal") return false;
+    const val = firstMatcher.value ?? "";
+    if (!banksyncPattern.test(val)) return false;
+    return !dbCfRuleIds.has(r.id);
+  }).map((r) => ({
+    rule_id: r.id,
+    matcher_value: r.matchers[0].value ?? ""
+  }));
+  return {
+    outbox_pending,
+    db_rows_missing_cf_rule,
+    cf_rules_orphaned,
+    cf_api_disabled: false
+  };
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+// src/alerter.ts
+var DEFAULT_THRESHOLDS = {
+  parse_failure_rate_24h: 0.05,
+  unmatched_24h: 10
+};
+async function evaluateThresholds(db, cfg) {
+  const status = await getStatusData(db);
+  const triggered = [];
+  if (status.service.parse_failure_rate_24h > cfg.thresholds.parse_failure_rate_24h) {
+    triggered.push({
+      metric: "parse_failure_rate_24h",
+      value: status.service.parse_failure_rate_24h,
+      threshold: cfg.thresholds.parse_failure_rate_24h
+    });
+  }
+  if (status.service.unmatched_24h >= cfg.thresholds.unmatched_24h) {
+    triggered.push({
+      metric: "unmatched_24h",
+      value: status.service.unmatched_24h,
+      threshold: cfg.thresholds.unmatched_24h
+    });
+  }
+  if (triggered.length === 0) {
+    return null;
+  }
+  const severity = status.service.parse_failure_rate_24h > 0.5 ? "error" : "warn";
+  return {
+    service: cfg.service,
+    severity,
+    triggered_thresholds: triggered,
+    status_snapshot: {
+      parse_failure_rate_24h: status.service.parse_failure_rate_24h,
+      parse_failures_24h: status.service.parse_failures_24h,
+      unknown_currency_24h: status.service.unknown_currency_24h,
+      unknown_provider_24h: status.service.unknown_provider_24h,
+      unmatched_24h: status.service.unmatched_24h
+    },
+    probed_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function toSlackPayload(p) {
+  const lines = p.triggered_thresholds.map((t) => `\u2022 ${t.metric}: ${t.value} (threshold: ${t.threshold})`).join("\n");
+  const emoji = p.severity === "error" ? "\u{1F6A8}" : "\u26A0\uFE0F";
+  return {
+    text: `${emoji} banksync alert (${p.severity}) on ${p.service}
+${lines}`,
+    severity: p.severity,
+    service: p.service,
+    triggered_thresholds: p.triggered_thresholds,
+    status_snapshot: p.status_snapshot,
+    probed_at: p.probed_at
+  };
+}
+async function postAlert(payload, cfg) {
+  if (!cfg.webhookUrl) {
+    return false;
+  }
+  const body = toSlackPayload(payload);
+  try {
+    const response = await globalThis.fetch(cfg.webhookUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        ...cfg.webhookSecret ? { Authorization: `Bearer ${cfg.webhookSecret}` } : {}
+      },
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      logError("alert_post_failed", new Error(`HTTP ${response.status}`), {
+        metric_parse_rate: payload.status_snapshot.parse_failure_rate_24h
+      });
+      return false;
+    }
+    log("alert_posted", {
+      severity: payload.severity,
+      triggered_count: payload.triggered_thresholds.length
+    });
+    return true;
+  } catch (err) {
+    logError("alert_post_exception", err, {
+      metric_parse_rate: payload.status_snapshot.parse_failure_rate_24h
+    });
+    return false;
+  }
+}
+async function runAlerterTick(db, cfg) {
+  if (!cfg.webhookUrl) {
+    return { fired: false };
+  }
+  const payload = await evaluateThresholds(db, cfg);
+  if (!payload) {
+    const prior2 = await db.prepare(`SELECT value FROM alert_state WHERE key = 'alerter_active'`).first();
+    if (!prior2 || prior2.value !== "active") return { fired: false };
+    const status = await getStatusData(db);
+    const recovery = {
+      service: cfg.service,
+      severity: "warn",
+      triggered_thresholds: [{ metric: "delivery_recovered", value: 0, threshold: 0 }],
+      status_snapshot: {
+        parse_failure_rate_24h: status.service.parse_failure_rate_24h,
+        parse_failures_24h: status.service.parse_failures_24h,
+        unknown_currency_24h: status.service.unknown_currency_24h,
+        unknown_provider_24h: status.service.unknown_provider_24h,
+        unmatched_24h: status.service.unmatched_24h
+      },
+      probed_at: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    const posted2 = await postAlert(recovery, cfg);
+    if (posted2) {
+      await db.prepare(`INSERT INTO alert_state (key, value, updated_at) VALUES ('alerter_active', 'resolved', ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`).bind((/* @__PURE__ */ new Date()).toISOString()).run();
+    }
+    return { fired: true, payload: recovery, posted: posted2 };
+  }
+  const prior = await db.prepare(`SELECT value, updated_at FROM alert_state WHERE key = 'alerter_active'`).first();
+  const repeatAfterMs = 30 * 60 * 1e3;
+  if (prior?.value === "active" && Date.now() - new Date(prior.updated_at).getTime() < repeatAfterMs) {
+    return { fired: false };
+  }
+  const posted = await postAlert(payload, cfg);
+  if (posted) {
+    await db.prepare(`INSERT INTO alert_state (key, value, updated_at) VALUES ('alerter_active', 'active', ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`).bind((/* @__PURE__ */ new Date()).toISOString()).run();
+  }
+  return { fired: true, payload, posted };
+}
+
+// src/backup.ts
+var TABLES = [
+  "bank_accounts",
+  "transactions",
+  "webhook_consumers",
+  "webhook_subscriptions",
+  "parse_log",
+  "webhook_log",
+  "webhook_delivery_jobs",
+  "webhook_delivery_alerts",
+  "alert_state",
+  "event_log",
+  "schema_meta",
+  "cf_routing_outbox",
+  "admin_audit_log"
+];
+function base64(bytes) {
+  let value = "";
+  for (const byte of bytes) value += String.fromCharCode(byte);
+  return btoa(value);
+}
+function fromBase64(value) {
+  const decoded = atob(value);
+  return Uint8Array.from(decoded, (char) => char.charCodeAt(0));
+}
+async function importBackupKey(encoded) {
+  const bytes = fromBase64(encoded);
+  if (bytes.byteLength !== 32) throw new Error("backup_encryption_key_must_be_32_bytes");
+  return crypto.subtle.importKey("raw", bytes.buffer, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+}
+function backupAad(envelope) {
+  return new TextEncoder().encode(JSON.stringify(envelope));
+}
+async function encryptBackup(sql, encodedKey, keyVersion) {
+  if (!Number.isInteger(keyVersion) || keyVersion < 1) throw new Error("invalid_backup_key_version");
+  const metadata = {
+    format: "banksync-backup",
+    version: 1,
+    key_version: keyVersion,
+    algorithm: "AES-256-GCM",
+    created_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const ciphertext = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv: iv.buffer, additionalData: backupAad(metadata).buffer, tagLength: 128 },
+    await importBackupKey(encodedKey),
+    new TextEncoder().encode(sql)
+  );
+  const envelope = {
+    ...metadata,
+    iv: base64(iv),
+    ciphertext: base64(new Uint8Array(ciphertext))
+  };
+  return new TextEncoder().encode(JSON.stringify(envelope));
+}
+function dateKey(d = /* @__PURE__ */ new Date()) {
+  const year = d.getUTCFullYear();
+  const month = String(d.getUTCMonth() + 1).padStart(2, "0");
+  const day = String(d.getUTCDate()).padStart(2, "0");
+  return `${year}${month}${day}`;
+}
+function escapeSqlString(s) {
+  return s.replace(/'/g, "''");
+}
+function sqlValue(v2) {
+  if (v2 === null || v2 === void 0) return "NULL";
+  if (typeof v2 === "number") {
+    return Number.isFinite(v2) ? String(v2) : "NULL";
+  }
+  if (typeof v2 === "boolean") return v2 ? "1" : "0";
+  return `'${escapeSqlString(String(v2))}'`;
+}
+async function buildSqlDump(db) {
+  const lines = [];
+  lines.push(`-- banksync backup ${(/* @__PURE__ */ new Date()).toISOString()}`);
+  const versionRow = await db.prepare(`SELECT value FROM schema_meta WHERE key = 'version'`).first();
+  lines.push(`-- schema_version=${versionRow?.value ?? "unknown"}`);
+  lines.push(`-- restore: re-apply migrations then load this file`);
+  lines.push("");
+  const rowCounts = {};
+  for (const table of TABLES) {
+    const r = await db.prepare(`SELECT * FROM ${table}`).all();
+    rowCounts[table] = r.results.length;
+    if (r.results.length === 0) continue;
+    const cols = Object.keys(r.results[0]);
+    lines.push(`-- ${table} (${r.results.length} rows)`);
+    const insert = table === "schema_meta" ? "INSERT OR REPLACE INTO" : "INSERT INTO";
+    for (const row of r.results) {
+      const values = cols.map((c) => sqlValue(row[c])).join(", ");
+      lines.push(`${insert} ${table} (${cols.join(", ")}) VALUES (${values});`);
+    }
+    lines.push("");
+  }
+  return { sql: lines.join("\n"), rowCounts };
+}
+async function runBackupTick(db, cfg) {
+  if (!cfg.bucket) {
+    return { uploaded: false, skipped_reason: "r2_bucket_unbound" };
+  }
+  if (!cfg.encryptionKey || !cfg.keyVersion) {
+    return { uploaded: false, skipped_reason: "backup_encryption_not_configured" };
+  }
+  const { sql, rowCounts } = await buildSqlDump(db);
+  const key = `${cfg.prefix}-${dateKey()}.sql.enc`;
+  const buf = await encryptBackup(sql, cfg.encryptionKey, cfg.keyVersion);
+  await cfg.bucket.put(key, buf, {
+    httpMetadata: { contentType: "application/octet-stream" },
+    customMetadata: {
+      banksync_table_count: String(TABLES.length),
+      banksync_backup_format: "aes-256-gcm-v1",
+      banksync_backup_key_version: String(cfg.keyVersion),
+      banksync_total_rows: String(Object.values(rowCounts).reduce((a, b) => a + b, 0))
+    }
+  });
+  const retain = cfg.retain ?? 8;
+  const list = await cfg.bucket.list({ prefix: cfg.prefix, limit: 1e3 });
+  const sortedKeys = list.objects.map((o) => o.key).sort().reverse();
+  const toPrune = sortedKeys.slice(retain);
+  for (const k of toPrune) {
+    await cfg.bucket.delete(k);
+  }
+  return {
+    uploaded: true,
+    key,
+    size_bytes: buf.byteLength,
+    table_row_counts: rowCounts,
+    pruned_keys: toPrune
+  };
+}
+
+// src/cloudflare.ts
+function fioProxyConfig(env) {
+  const url2 = env.FIO_PROXY_URL?.trim();
+  const secret = env.FIO_PROXY_SECRET?.trim();
+  return url2 && secret ? { url: url2, secret } : void 0;
+}
+function cfRoutingConfig(env) {
+  return {
+    apiToken: env.CF_API_TOKEN,
+    zoneId: env.CF_ZONE_ID ?? "",
+    domain: env.BANKSYNC_DOMAIN ?? "banksync.festapp.net"
+  };
+}
+async function processEmail(rawStream, env, envelope) {
+  let bodyText;
+  try {
+    let extracted;
+    try {
+      extracted = await extractEmailBody(rawStream);
+      bodyText = extracted.text;
+    } catch (err) {
+      const rawText = await new Response(rawStream).text().catch(() => "(failed to read raw)");
+      await insertParseLog(env.DB, {
+        error_message: `mime_parse_failed: ${err}`,
+        raw_data: rawText === "(failed to read raw)" ? rawText : "(raw MIME omitted)"
+      });
+      log("email_rejected_mime", {});
+      return;
+    }
+    let identity;
+    try {
+      identity = authenticateEmailIdentity(envelope, extracted);
+    } catch (err) {
+      const reason = err instanceof EmailAuthenticationError ? err.code : "email_authentication_failed";
+      await insertParseLog(env.DB, { error_message: reason, raw_data: sanitizeDiagnosticRaw(extracted.text), external_id: extracted.messageId ?? null });
+      log("email_rejected_authentication", { reason });
+      return;
+    }
+    const allowlist = parseAllowlist(env.SENDER_ALLOWLIST);
+    const pairingCode = extractPairingCode(identity.recipient);
+    const account = pairingCode ? await findBankAccountByPairingCode(env.DB, pairingCode) : null;
+    const outcome = classifyEmail(extracted, identity, account, allowlist);
+    if (outcome.received) {
+      log("email_received", { pairing_code: pairingCode, message_id: extracted.messageId ?? null });
+      await writeEvent(env.DB, { event_type: "email_received", bank_account_id: account.id, detail: { message_id: extracted.messageId ?? null } });
+    }
+    if (outcome.kind === "reject" || outcome.kind === "skip") {
+      await insertParseLog(env.DB, {
+        bank_account_id: outcome.bankAccountId ?? null,
+        error_message: outcome.reason,
+        raw_data: sanitizeDiagnosticRaw(extracted.text),
+        external_id: extracted.messageId ?? null
+      });
+      return;
+    }
+    const acct = outcome.account;
+    let result;
+    try {
+      result = await insertTransaction(env.DB, {
+        bank_account_id: acct.id,
+        payload: {
+          ...outcome.parsed,
+          date: outcome.parsed.date ?? (/* @__PURE__ */ new Date()).toISOString(),
+          external_id: extracted.messageId ?? null
+        }
+      });
+    } catch (err) {
+      await insertParseLog(env.DB, {
+        bank_account_id: acct.id,
+        error_message: `db_insert_failed: ${err}`,
+        raw_data: sanitizeDiagnosticRaw(JSON.stringify({ ...outcome.parsed, external_id: extracted.messageId ?? null })),
+        external_id: extracted.messageId ?? null
+      });
+      return;
+    }
+    if (result.status === "skipped") {
+      log("tx_skipped", { reason: result.reason, bank_account_id: acct.id });
+      await writeEvent(env.DB, { event_type: "tx_skipped", bank_account_id: acct.id, detail: { reason: result.reason } });
+      return;
+    }
+    const tx = result.transaction;
+    log("tx_inserted", { bank_account_id: acct.id, tx_id: tx.id, vs: tx.vs, amount_cents: tx.amount_cents, currency: tx.currency });
+    await writeEvent(env.DB, { event_type: "tx_inserted", bank_account_id: acct.id, detail: { tx_id: tx.id } });
+    await createWebhookDeliveryCoordinator(env).observeTransaction(tx.id);
+  } catch (err) {
+    try {
+      await insertParseLog(env.DB, {
+        error_message: `unhandled: ${err}`,
+        raw_data: sanitizeDiagnosticRaw(bodyText ?? "Body read failed")
+      });
+    } catch {
+    }
+    logError("email_unhandled_exception", err, {});
+  }
+}
+function sanitizeDiagnosticRaw(value) {
+  return value.slice(0, 4096).replace(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi, "[email]").replace(/\b\d{6,}\b/g, "[number]");
+}
+function generatePairingCode() {
+  const bytes = new Uint8Array(5);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function generateUniquePairingCode(db) {
+  for (let attempt = 0; attempt < 5; attempt++) {
+    const code = generatePairingCode();
+    if (!await pairingCodeExists(db, code)) return code;
+    log("pairing_code_collision_retry", { attempt: attempt + 1 });
+  }
+  throw new Error("pairing_code_collision_exhausted: 5 consecutive collisions (entropy/RNG misconfiguration?)");
+}
+function generateConsumerSecret() {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  const b64 = btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+  return "whsec_" + b64;
+}
+function apiMinIntervalS(env) {
+  const raw = env.FIO_MIN_INTERVAL_S;
+  if (!raw) return 30;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n >= 0 ? n : 30;
+}
+function tokenPrefix(token) {
+  return token.slice(0, 6);
+}
+function yyyyMmDdDaysAgo(days) {
+  const d = /* @__PURE__ */ new Date();
+  d.setUTCDate(d.getUTCDate() - days);
+  return d.toISOString().slice(0, 10);
+}
+var API_POLL_CRON = "* * * * *";
+var MAINTENANCE_CRON = "15 3 * * *";
+var API_SYNC_LEASE_S = 30;
+function scheduledCron(event) {
+  const cron = event.cron;
+  return typeof cron === "string" ? cron : null;
+}
+function shouldRunApiPolling(event) {
+  const cron = scheduledCron(event);
+  return cron === null || cron === API_POLL_CRON;
+}
+function shouldRunMaintenance(event) {
+  const cron = scheduledCron(event);
+  return cron === null || cron === MAINTENANCE_CRON;
+}
+function apiSyncDelayS(env) {
+  return Math.max(30, apiMinIntervalS(env));
+}
+async function runBankApiSync(env, account) {
+  if (account.account_type !== "FIO") {
+    throw new Error(`unsupported_api_account_type: ${account.account_type}`);
+  }
+  const isBackfill = !account.api_backfill_done;
+  try {
+    const token = await decryptSecret(account.api_token_cipher, account.api_token_key_ver, env);
+    if (isBackfill && account.api_last_success_at === null) {
+      await markBankAccountApiFetchStarted(env.DB, account.id);
+      await setFioPointer(token, yyyyMmDdDaysAgo(90), fioProxyConfig(env));
+      await markBankAccountApiPointerSet(env.DB, account.id);
+      await writeEvent(env.DB, {
+        event_type: "api_pointer_set",
+        bank_account_id: account.id,
+        detail: { provider: account.account_type, backfill_days: 90 }
+      });
+      return {
+        bank_account_id: account.id,
+        provider: account.account_type,
+        inserted: 0,
+        skipped_duplicate: 0,
+        skipped_outgoing: 0,
+        parse_errors: 0,
+        queued_webhooks: 0,
+        backfill: true,
+        deferred: true
+      };
+    }
+    await markBankAccountApiFetchStarted(env.DB, account.id);
+    const raw = await fetchNewTransactions(token, fioProxyConfig(env));
+    let inserted = 0;
+    let skippedDuplicate = 0;
+    let skippedOutgoing = 0;
+    let parseErrors = 0;
+    let queuedWebhooks = 0;
+    for (const item of raw) {
+      let mapped;
+      try {
+        mapped = mapFioTransaction(item);
+      } catch (err) {
+        parseErrors++;
+        await insertParseLog(env.DB, {
+          bank_account_id: account.id,
+          error_message: `${err}`.replace(/^Error:\s*/, ""),
+          raw_data: JSON.stringify({ fields: Object.keys(item).sort() })
+        });
+        continue;
+      }
+      if (mapped === null) {
+        skippedOutgoing++;
+        await insertParseLog(env.DB, {
+          bank_account_id: account.id,
+          error_message: "outgoing_filtered",
+          raw_data: null
+        });
+        continue;
+      }
+      const insertResult = await insertTransaction(env.DB, {
+        bank_account_id: account.id,
+        payload: mapped
+      });
+      if (insertResult.status === "skipped") {
+        skippedDuplicate++;
+        continue;
+      }
+      inserted++;
+      await writeEvent(env.DB, {
+        event_type: "tx_inserted",
+        bank_account_id: account.id,
+        detail: { tx_id: insertResult.transaction.id, source: "api" }
+      });
+      if (!isBackfill) {
+        queuedWebhooks += (await createWebhookDeliveryCoordinator(env).observeTransaction(insertResult.transaction.id)).dispatched;
+      }
+    }
+    await markBankAccountApiFetchSuccess(env.DB, account.id, { backfill_done: true });
+    await writeEvent(env.DB, {
+      event_type: "api_pull_completed",
+      bank_account_id: account.id,
+      detail: { provider: account.account_type, inserted, skipped_duplicate: skippedDuplicate, parse_errors: parseErrors, backfill: isBackfill }
+    });
+    return {
+      bank_account_id: account.id,
+      provider: account.account_type,
+      inserted,
+      skipped_duplicate: skippedDuplicate,
+      skipped_outgoing: skippedOutgoing,
+      parse_errors: parseErrors,
+      queued_webhooks: queuedWebhooks,
+      backfill: isBackfill,
+      deferred: false
+    };
+  } catch (err) {
+    await markBankAccountApiFetchFailure(env.DB, account.id, String(err));
+    if (err instanceof FioRateLimited) {
+      await writeEvent(env.DB, {
+        event_type: "api_rate_limited",
+        bank_account_id: account.id,
+        detail: { provider: account.account_type, retry_after_s: err.retryAfterS }
+      });
+    }
+    throw err;
+  }
+}
+async function runDueBankApiSyncs(env) {
+  const accounts = await listDueApiFetchAccounts(env.DB, apiMinIntervalS(env));
+  const processedTokenPrefixes = /* @__PURE__ */ new Set();
+  for (const account of accounts) {
+    const tokenKey = account.api_token_prefix ?? `account:${account.id}`;
+    if (processedTokenPrefixes.has(tokenKey)) {
+      log("api_sync_skipped_duplicate_token_prefix", { bank_account_id: account.id, account_type: account.account_type });
+      continue;
+    }
+    processedTokenPrefixes.add(tokenKey);
+    try {
+      const result = await runBankApiSync(env, account);
+      log("api_sync_completed", {
+        bank_account_id: account.id,
+        account_type: account.account_type,
+        inserted: result.inserted,
+        skipped_duplicate: result.skipped_duplicate,
+        parse_errors: result.parse_errors,
+        backfill: result.backfill,
+        deferred: result.deferred
+      });
+    } catch (err) {
+      if (err instanceof FioRateLimited) {
+        log("api_rate_limited", { bank_account_id: account.id, account_type: account.account_type, retry_after_s: err.retryAfterS });
+        continue;
+      }
+      if (err instanceof FioTransientFailure) {
+        logError("api_transient_failure", err, { bank_account_id: account.id, account_type: account.account_type });
+        continue;
+      }
+      logError("api_sync_failed", err, { bank_account_id: account.id, account_type: account.account_type });
+    }
+  }
+}
+async function enqueueApiSyncTick(env, delaySeconds, source) {
+  if (!env.API_SYNC_QUEUE) return false;
+  await env.API_SYNC_QUEUE.send({
+    kind: "api_sync_tick",
+    source,
+    enqueued_at: (/* @__PURE__ */ new Date()).toISOString()
+  }, { delaySeconds });
+  return true;
+}
+async function handleApiSyncQueue(batch, env) {
+  await assertSchemaVersion(env.DB);
+  for (const rawMsg of batch.messages) {
+    const msg = rawMsg;
+    if (msg.body?.kind !== "api_sync_tick") {
+      logError("api_sync_queue_unknown_message", new Error("unknown api sync queue message"), { queue: batch.queue });
+      msg.ack();
+      continue;
+    }
+    try {
+      const acquired = await tryAcquireApiSyncLease(env.DB, API_SYNC_LEASE_S);
+      if (!acquired) {
+        log("api_sync_tick_skipped_lease", { source: msg.body.source });
+        msg.ack();
+        continue;
+      }
+      await runDueBankApiSyncs(env);
+      msg.ack();
+    } catch (err) {
+      logError("api_sync_tick_failed", err, { source: msg.body.source });
+      msg.retry({ delaySeconds: apiSyncDelayS(env) });
+    }
+  }
+}
+function unauthorized() {
+  return new Response("Unauthorized", { status: 401, headers: { "WWW-Authenticate": "Bearer" } });
+}
+function forbidden() {
+  return new Response(JSON.stringify({ error: "forbidden" }), { status: 403, headers: { "Content-Type": "application/json" } });
+}
+function jsonResponse(body, status = 200, extraHeaders) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json", ...extraHeaders }
+  });
+}
+function notFound() {
+  return new Response("Not found", { status: 404 });
+}
+async function healthResponse(env) {
+  try {
+    await assertSchemaVersion(env.DB);
+    return jsonResponse({ ok: true });
+  } catch {
+    return jsonResponse({ ok: false }, 503);
+  }
+}
+async function statusResponse(env) {
+  const data = await getStatusData(env.DB);
+  return jsonResponse(data);
+}
+async function runTestEmail(req, env) {
+  const raw = req.body;
+  if (!raw) return new Response("Empty body", { status: 400 });
+  const mailFrom = req.headers.get("x-test-mail-from");
+  const rcptTo = req.headers.get("x-test-rcpt-to");
+  if (!mailFrom || !rcptTo || !env.EMAIL_AUTHSERV_ID) return jsonResponse({ error: "test_envelope_required" }, 400);
+  await processEmail(raw, env, {
+    mailFrom,
+    rcptTo,
+    authenticationResults: req.headers.get("authentication-results"),
+    trustedAuthservId: env.EMAIL_AUTHSERV_ID
+  });
+  return new Response("ok", { status: 200 });
+}
+async function adminFetch(req, env) {
+  const url2 = new URL(req.url);
+  if (url2.pathname === "/health" && req.method === "GET") return healthResponse(env);
+  const isOperatorRoute = req.method === "GET" && (url2.pathname === "/status" || url2.pathname === "/health/deep");
+  if (isOperatorRoute) {
+    const candidate = req.headers.get("X-Admin-Secret") ?? "";
+    if (!candidate || !env.ADMIN_SECRET || !timingSafeEqual(candidate, env.ADMIN_SECRET)) return unauthorized();
+    await assertSchemaVersion(env.DB);
+    const probeLimit = await checkAndIncrement(env.DB, "admin:operator-probe", { windowSeconds: 60, limit: 60 });
+    if (!probeLimit.allowed) {
+      return jsonResponse({ error: "rate_limited", retry_after: probeLimit.retryAfter }, 429, { "Retry-After": String(probeLimit.retryAfter) });
+    }
+    if (url2.pathname === "/status") return statusResponse(env);
+    const result = await deepHealth({
+      db: env.DB,
+      queue: env.WEBHOOK_QUEUE ?? null,
+      cf: cfRoutingConfig(env),
+      secrets: {
+        alertWebhookPresent: Boolean(env.ALERT_WEBHOOK_URL && env.ALERT_WEBHOOK_SECRET),
+        backupsPresent: Boolean(
+          env.BACKUPS && Number.isInteger(Number(env.BACKUP_ENCRYPTION_KEY_VERSION)) && env[`BACKUP_ENCRYPTION_KEY_V${env.BACKUP_ENCRYPTION_KEY_VERSION}`]
+        ),
+        emailAuthPresent: Boolean(env.EMAIL_AUTHSERV_ID?.trim()),
+        callbackPolicyPresent: Boolean(env.CALLBACK_HOST_ALLOWLIST?.trim()),
+        isProduction: env.ENV === "production"
+      }
+    });
+    return jsonResponse(result, result.status === "red" ? 503 : 200);
+  }
+  await assertSchemaVersion(env.DB);
+  const authCtx = await resolveAuth(req, env);
+  const authPrincipal = authCtx.type === "admin" ? "admin" : authCtx.type === "tenant" ? `tenant:${authCtx.app_id}` : "unauth";
+  if (url2.pathname === "/__test/email" && req.method === "POST") {
+    if (env.ENV === "production") return notFound();
+    if (authCtx.type !== "admin") return unauthorized();
+    return runTestEmail(req, env);
+  }
+  if (authCtx.type === "unauth") {
+    const sourceIp = req.headers.get("cf-connecting-ip") ?? "unknown";
+    const failed = await checkAndIncrement(env.DB, `auth-failed:${sourceIp}`, { windowSeconds: 60, limit: 20 });
+    if (!failed.allowed) return jsonResponse({ error: "rate_limited", retry_after: failed.retryAfter }, 429, { "Retry-After": String(failed.retryAfter) });
+    return unauthorized();
+  }
+  {
+    const rl = await checkAndIncrement(env.DB, authPrincipal, authCtx.type === "admin" ? { windowSeconds: 60, limit: 1e3 } : void 0);
+    if (!rl.allowed) {
+      return jsonResponse({ error: "rate_limited", retry_after: rl.retryAfter }, 429, { "Retry-After": String(rl.retryAfter) });
+    }
+  }
+  const isMutating = req.method !== "GET" && req.method !== "HEAD";
+  let bodyText = "";
+  if (isMutating) {
+    const read = await readBoundedBody(req, 256 * 1024);
+    if (read instanceof Response) return read;
+    bodyText = read;
+  }
+  const credentialRoute = isCredentialReturningRoute(url2.pathname, req.method);
+  if (credentialRoute && req.headers.has("Idempotency-Key")) {
+    return jsonResponse({ error: "idempotency_not_supported" }, 400);
+  }
+  if (isMutating && !credentialRoute) {
+    const idem = await checkIdempotency({ db: env.DB, request: req, authPrincipal, requestBodyText: bodyText });
+    if (idem.kind === "hit") return new Response(idem.body, { status: idem.status, headers: { "Content-Type": "application/json" } });
+    if (idem.kind === "in_flight") return jsonResponse({ error: "idempotency_request_in_flight" }, 409, { "Retry-After": "1" });
+    if (idem.kind === "mismatch") return jsonResponse({ error: "idempotency_key_body_mismatch" }, 422);
+  }
+  const start = Date.now();
+  let handlerResponse;
+  try {
+    handlerResponse = await dispatch(url2, req, env, authCtx, bodyText);
+  } catch (err) {
+    const idemKey = !credentialRoute ? req.headers.get("Idempotency-Key") : null;
+    if (idemKey && idemKey.length >= 1 && idemKey.length <= 255) {
+      await recordIdempotency({
+        db: env.DB,
+        keyHash: await sha256Hex2(`${authPrincipal}
+${req.method.toUpperCase()}
+${url2.pathname}
+${idemKey}`),
+        authPrincipal,
+        requestPath: url2.pathname,
+        requestMethod: req.method,
+        requestBodyHash: bodyText.length > 0 ? await sha256Hex2(bodyText) : null,
+        responseStatus: 500,
+        responseBody: ""
+      });
+    }
+    throw err;
+  }
+  const duration = Date.now() - start;
+  const respClone = handlerResponse.clone();
+  const respBody = await respClone.text();
+  if (isMutating && !credentialRoute) {
+    const idemKey = req.headers.get("Idempotency-Key");
+    if (idemKey && idemKey.length >= 1 && idemKey.length <= 255) {
+      const keyHash = await sha256Hex2(`${authPrincipal}
+${req.method.toUpperCase()}
+${url2.pathname}
+${idemKey}`);
+      const bodyHash = bodyText.length > 0 ? await sha256Hex2(bodyText) : null;
+      await recordIdempotency({
+        db: env.DB,
+        keyHash,
+        authPrincipal,
+        requestPath: url2.pathname,
+        requestMethod: req.method,
+        requestBodyHash: bodyHash,
+        responseStatus: handlerResponse.status,
+        responseBody: respBody
+      });
+    }
+  }
+  if (shouldAuditMethod(req.method)) {
+    await recordAudit({
+      db: env.DB,
+      authPrincipal,
+      httpMethod: req.method,
+      requestPath: url2.pathname,
+      httpStatus: handlerResponse.status,
+      requestBodySummary: bodyText ? redactBodyForAudit(bodyText) : null,
+      sourceIp: req.headers.get("cf-connecting-ip"),
+      userAgent: req.headers.get("user-agent"),
+      durationMs: duration
+    });
+  }
+  return handlerResponse;
+}
+function isCredentialReturningRoute(pathname, method) {
+  if (method !== "POST") return false;
+  return pathname === "/consumers" || /^\/consumers\/[^/]+\/(?:rotate-secret|rotate-admin-key)$/.test(pathname);
+}
+async function readBoundedBody(req, maxBytes) {
+  const declared = req.headers.get("content-length");
+  if (declared && (!/^\d+$/.test(declared) || Number(declared) > maxBytes)) {
+    return jsonResponse({ error: "payload_too_large" }, 413);
+  }
+  if (!req.body) return "";
+  const reader = req.body.getReader();
+  const chunks = [];
+  let size = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > maxBytes) {
+      await reader.cancel("payload_too_large");
+      return jsonResponse({ error: "payload_too_large" }, 413);
+    }
+    chunks.push(value);
+  }
+  const all = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    all.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder("utf-8", { fatal: true }).decode(all);
+}
+async function requireOwnedAccount(env, id, authCtx) {
+  const existing = await findBankAccountById(env.DB, id);
+  if (!existing) return jsonResponse({ error: "not_found" }, 404);
+  if (authCtx.type === "tenant" && existing.owner_app_id !== authCtx.app_id) return forbidden();
+  return existing;
+}
+function parseOr400(schema, bodyText) {
+  let body;
+  try {
+    body = JSON.parse(bodyText);
+  } catch {
+    return jsonResponse({ error: "invalid JSON" }, 400);
+  }
+  try {
+    return parseBody(schema, body);
+  } catch (err) {
+    if (err instanceof ValidationError) return jsonResponse({ error: err.message, issues: err.issues }, 400);
+    throw err;
+  }
+}
+async function dispatch(url2, req, env, authCtx, bodyText) {
+  if (url2.pathname === "/bank-accounts" && req.method === "POST") {
+    const input = parseOr400(CreateBankAccountSchema, bodyText);
+    if (input instanceof Response) return input;
+    if (authCtx.type === "tenant" && input.owner_app_id !== authCtx.app_id) {
+      return jsonResponse({ error: "cannot_create_for_other_tenant" }, 403);
+    }
+    const owner = await findConsumerByAppId(env.DB, input.owner_app_id);
+    if (!owner) return jsonResponse({ error: `unknown owner_app_id: ${input.owner_app_id}` }, 422);
+    if (input.fio_api_token !== void 0 && (input.account_type ?? "FIO") !== "FIO") {
+      return jsonResponse({ error: "fio_api_token_supported_only_for_fio" }, 400);
+    }
+    const pairingCode = await generateUniquePairingCode(env.DB);
+    const ingestMode = input.ingest_mode ?? (input.fio_api_token ? "api" : "email");
+    const createEmailRoute = ingestMode === "email" || ingestMode === "both";
+    const encryptedApiToken = input.fio_api_token ? await encryptSecret(input.fio_api_token, env) : null;
+    const outboxId = createEmailRoute ? await enqueueCreate(env.DB, { pairing_code: pairingCode, bank_account_id: 0 }) : null;
+    let account;
+    try {
+      account = await createBankAccount(env.DB, {
+        account_number: input.account_number,
+        ...input.account_type !== void 0 ? { account_type: input.account_type } : {},
+        ingest_mode: ingestMode,
+        pairing_code: pairingCode,
+        ...input.label !== void 0 ? { label: input.label } : {},
+        owner_app_id: input.owner_app_id,
+        cf_rule_id: null,
+        api_token_cipher: encryptedApiToken?.cipher ?? null,
+        api_token_key_ver: encryptedApiToken?.keyVersion ?? null,
+        api_token_prefix: input.fio_api_token ? tokenPrefix(input.fio_api_token) : null,
+        api_fetch_enabled: Boolean(input.fio_api_token && ingestMode !== "email")
+      });
+    } catch (err) {
+      throw err;
+    }
+    if (outboxId !== null) {
+      const cfRuleId = await provisionRoute(env.DB, cfRoutingConfig(env), {
+        outboxId,
+        pairing: pairingCode,
+        bankAccountId: account.id
+      });
+      if (cfRuleId) account = { ...account, cf_rule_id: cfRuleId };
+    }
+    try {
+      await createSubscription(env.DB, { app_id: input.owner_app_id, bank_account_id: account.id });
+    } catch (err) {
+      logError("owner_auto_subscribe_failed", err, { app_id: input.owner_app_id, bank_account_id: account.id });
+    }
+    return jsonResponse(account, 201);
+  }
+  if (url2.pathname === "/bank-accounts" && req.method === "GET") {
+    const owner = authCtx.type === "tenant" ? authCtx.app_id : url2.searchParams.get("owner") ?? void 0;
+    const accounts = await listBankAccounts(env.DB, owner);
+    return jsonResponse(accounts);
+  }
+  const baMatch = url2.pathname.match(/^\/bank-accounts\/(\d+)$/);
+  if (baMatch && req.method === "PUT") {
+    const id = Number(baMatch[1]);
+    const existing = await requireOwnedAccount(env, id, authCtx);
+    if (existing instanceof Response) return existing;
+    const input = parseOr400(UpdateBankAccountSchema, bodyText);
+    if (input instanceof Response) return input;
+    const updated = await updateBankAccount(env.DB, id, input);
+    if (!updated) return jsonResponse({ error: "not_found" }, 404);
+    return jsonResponse(updated);
+  }
+  const ownerMatch = url2.pathname.match(/^\/bank-accounts\/(\d+)\/owner$/);
+  if (ownerMatch && req.method === "PUT") {
+    if (authCtx.type !== "admin") return forbidden();
+    const id = Number(ownerMatch[1]);
+    const existing = await findBankAccountById(env.DB, id);
+    if (!existing) return jsonResponse({ error: "not_found" }, 404);
+    const input = parseOr400(UpdateBankAccountOwnerSchema, bodyText);
+    if (input instanceof Response) return input;
+    const owner = await findConsumerByAppId(env.DB, input.owner_app_id);
+    if (!owner) return jsonResponse({ error: `unknown owner_app_id: ${input.owner_app_id}` }, 422);
+    const updated = await updateBankAccountOwner(env.DB, id, input.owner_app_id);
+    if (!updated) return jsonResponse({ error: "not_found" }, 404);
+    return jsonResponse(updated);
+  }
+  if (baMatch && req.method === "DELETE") {
+    const id = Number(baMatch[1]);
+    const existing = await requireOwnedAccount(env, id, authCtx);
+    if (existing instanceof Response) return existing;
+    if (existing.cf_rule_id) {
+      await deprovisionRoute(env.DB, cfRoutingConfig(env), existing.cf_rule_id);
+    }
+    const deleted = await deleteBankAccount(env.DB, id);
+    if (!deleted) return jsonResponse({ error: "not_found" }, 404);
+    return new Response(null, { status: 204 });
+  }
+  const fioTokenMatch = url2.pathname.match(/^\/bank-accounts\/(\d+)\/fio-token$/);
+  if (fioTokenMatch && req.method === "PUT") {
+    const id = Number(fioTokenMatch[1]);
+    const existing = await requireOwnedAccount(env, id, authCtx);
+    if (existing instanceof Response) return existing;
+    if (existing.account_type !== "FIO") return jsonResponse({ error: "fio_api_token_supported_only_for_fio" }, 400);
+    const input = parseOr400(UpdateFioTokenSchema, bodyText);
+    if (input instanceof Response) return input;
+    const rawToken = input.fio_api_token?.trim();
+    if (rawToken !== void 0 && rawToken.length > 0 && rawToken.length < 8) {
+      return jsonResponse({ error: "validation_failed: fio_api_token must be at least 8 characters" }, 400);
+    }
+    if (rawToken && rawToken.length > 0) {
+      const encrypted = await encryptSecret(rawToken, env);
+      const updated2 = await setBankAccountApiToken(env.DB, id, {
+        token_cipher: encrypted.cipher,
+        token_key_ver: encrypted.keyVersion,
+        token_prefix: tokenPrefix(rawToken),
+        fetch_enabled: input.fetch_enabled ?? true,
+        ingest_mode: input.ingest_mode ?? (existing.ingest_mode === "email" ? "api" : existing.ingest_mode)
+      });
+      if (!updated2) return jsonResponse({ error: "not_found" }, 404);
+      log("bank_account_api_token_updated", { bank_account_id: id, account_type: existing.account_type, api_token_prefix: updated2.api_token_prefix });
+      return jsonResponse(updated2);
+    }
+    if ((input.fetch_enabled ?? false) && !existing.api_token_set) {
+      return jsonResponse({ error: "api_token_not_configured" }, 422);
+    }
+    const fetchPatch = {
+      fetch_enabled: input.fetch_enabled ?? existing.api_fetch_enabled
+    };
+    if (input.ingest_mode !== void 0) fetchPatch.ingest_mode = input.ingest_mode;
+    const updated = await setBankAccountApiFetchEnabled(env.DB, id, fetchPatch);
+    if (!updated) return jsonResponse({ error: "not_found" }, 404);
+    return jsonResponse(updated);
+  }
+  if (fioTokenMatch && req.method === "DELETE") {
+    const id = Number(fioTokenMatch[1]);
+    const existing = await requireOwnedAccount(env, id, authCtx);
+    if (existing instanceof Response) return existing;
+    if (existing.account_type !== "FIO") return jsonResponse({ error: "fio_api_token_supported_only_for_fio" }, 400);
+    const updated = await clearBankAccountApiToken(env.DB, id);
+    if (!updated) return jsonResponse({ error: "not_found" }, 404);
+    log("bank_account_api_token_deleted", { bank_account_id: id, account_type: existing.account_type });
+    return jsonResponse(updated);
+  }
+  const fioSyncMatch = url2.pathname.match(/^\/bank-accounts\/(\d+)\/fio-sync$/);
+  if (fioSyncMatch && req.method === "POST") {
+    const id = Number(fioSyncMatch[1]);
+    const existing = await requireOwnedAccount(env, id, authCtx);
+    if (existing instanceof Response) return existing;
+    if (existing.account_type !== "FIO") return jsonResponse({ error: "fio_api_token_supported_only_for_fio" }, 400);
+    const minIntervalS = apiMinIntervalS(env);
+    if (!await isBankAccountApiFetchDue(env.DB, id, minIntervalS)) {
+      return jsonResponse({
+        error: "api_fetch_throttled",
+        retry_after_s: minIntervalS,
+        api_last_fetch_at: existing.api_last_fetch_at,
+        api_last_success_at: existing.api_last_success_at,
+        api_last_error: existing.api_last_error
+      }, 429, { "Retry-After": String(minIntervalS) });
+    }
+    const account = await findBankAccountApiMaterials(env.DB, id);
+    if (!account) return jsonResponse({ error: "api_token_not_configured" }, 422);
+    try {
+      const result = await runBankApiSync(env, account);
+      const updated = await findBankAccountById(env.DB, id);
+      return jsonResponse({
+        inserted: result.inserted,
+        skipped_duplicate: result.skipped_duplicate,
+        skipped_outgoing: result.skipped_outgoing,
+        parse_errors: result.parse_errors,
+        queued_webhooks: result.queued_webhooks,
+        backfill: result.backfill,
+        deferred: result.deferred,
+        api_last_fetch_at: updated?.api_last_fetch_at ?? null,
+        api_last_success_at: updated?.api_last_success_at ?? null,
+        api_last_error: updated?.api_last_error ?? null,
+        api_backfill_done: updated?.api_backfill_done ?? false
+      });
+    } catch (err) {
+      if (err instanceof FioRateLimited || err instanceof FioTransientFailure) {
+        logError("fio_api_manual_sync_failed", err, { bank_account_id: id });
+        return jsonResponse({ error: "fio_api_transient_failure" }, 503);
+      }
+      throw err;
+    }
+  }
+  const regenMatch = url2.pathname.match(/^\/bank-accounts\/(\d+)\/regenerate-pairing$/);
+  if (regenMatch && req.method === "POST") {
+    const id = Number(regenMatch[1]);
+    const existing = await requireOwnedAccount(env, id, authCtx);
+    if (existing instanceof Response) return existing;
+    const newPairing = await generateUniquePairingCode(env.DB);
+    const result = await regenerateRoute(env.DB, cfRoutingConfig(env), {
+      id,
+      existingCfRuleId: existing.cf_rule_id,
+      newPairing
+    });
+    if (!result.ok) return jsonResponse(result.body, result.status);
+    return jsonResponse(result.account);
+  }
+  if (url2.pathname === "/consumers" && req.method === "POST") {
+    if (authCtx.type === "tenant") return forbidden();
+    const input = parseOr400(CreateConsumerSchema, bodyText);
+    if (input instanceof Response) return input;
+    let callbackUrl;
+    try {
+      callbackUrl = validateCallbackUrl(input.callback_url, { environment: env.ENV, allowlist: env.CALLBACK_HOST_ALLOWLIST });
+    } catch (err) {
+      if (err instanceof ValidationError) return jsonResponse({ error: err.message }, 400);
+      throw err;
+    }
+    const plain = generateConsumerSecret();
+    const secretPrefix = plain.slice(0, 12);
+    const secretHash = await sha256Hex2(plain);
+    const secretCipher = await webhookEncrypt(plain, env.WEBHOOK_KEK);
+    const consumer = await createConsumer(env.DB, {
+      app_id: input.app_id,
+      callback_url: callbackUrl,
+      secret_cipher: secretCipher,
+      secret_hash: secretHash,
+      secret_prefix: secretPrefix
+    });
+    const { plain: adminKeyPlain, prefix: adminKeyPrefix, hash: adminKeyHash } = await generateTenantAdminKey();
+    await setConsumerAdminKey(env.DB, input.app_id, adminKeyHash, adminKeyPrefix);
+    log("tenant_admin_key_issued", { app_id: input.app_id, admin_key_prefix: adminKeyPrefix });
+    log("consumer_secret_issued", { app_id: consumer.app_id, secret_prefix: secretPrefix });
+    return jsonResponse({ app_id: consumer.app_id, callback_url: consumer.callback_url, secret: plain, admin_key: adminKeyPlain, admin_key_prefix: adminKeyPrefix }, 201, { "Cache-Control": "no-store" });
+  }
+  if (url2.pathname === "/consumers" && req.method === "GET") {
+    if (authCtx.type === "tenant") return forbidden();
+    const consumers = await listConsumers(env.DB);
+    return jsonResponse(consumers);
+  }
+  const deleteConsumerMatch = url2.pathname.match(/^\/consumers\/([^/]+)$/);
+  if (deleteConsumerMatch && req.method === "PUT") {
+    const appId = decodeURIComponent(deleteConsumerMatch[1]);
+    if (authCtx.type === "tenant" && authCtx.app_id !== appId) return forbidden();
+    const input = parseOr400(UpdateConsumerSchema, bodyText);
+    if (input instanceof Response) return input;
+    let callbackUrl;
+    try {
+      callbackUrl = validateCallbackUrl(input.callback_url, { environment: env.ENV, allowlist: env.CALLBACK_HOST_ALLOWLIST });
+    } catch (err) {
+      if (err instanceof ValidationError) return jsonResponse({ error: err.message }, 400);
+      throw err;
+    }
+    const updated = await updateConsumer(env.DB, appId, { callback_url: callbackUrl });
+    if (!updated) return jsonResponse({ error: "not_found" }, 404);
+    log("consumer_callback_updated", { app_id: appId });
+    return jsonResponse(updated);
+  }
+  if (deleteConsumerMatch && req.method === "DELETE") {
+    if (authCtx.type === "tenant") return forbidden();
+    const appId = decodeURIComponent(deleteConsumerMatch[1]);
+    await deleteConsumer(env.DB, appId);
+    return new Response(null, { status: 204 });
+  }
+  const rotateMatch = url2.pathname.match(/^\/consumers\/([^/]+)\/rotate-secret$/);
+  if (rotateMatch && req.method === "POST") {
+    if (authCtx.type === "tenant") return forbidden();
+    const appId = decodeURIComponent(rotateMatch[1]);
+    const existing = await findConsumerByAppId(env.DB, appId);
+    if (!existing) return jsonResponse({ error: "consumer not found" }, 404);
+    const newPlain = generateConsumerSecret();
+    const newPrefix = newPlain.slice(0, 12);
+    const newHash = await sha256Hex2(newPlain);
+    const newCipher = await webhookEncrypt(newPlain, env.WEBHOOK_KEK);
+    const prevExpiresAt = new Date(Date.now() + 24 * 60 * 60 * 1e3).toISOString();
+    await rotateConsumerSecret(env.DB, appId, {
+      newCipher,
+      newHash,
+      newPrefix,
+      prevExpiresAt
+    });
+    log("consumer_secret_rotated", { app_id: appId, secret_prefix: newPrefix });
+    return jsonResponse({ secret: newPlain }, 200, { "Cache-Control": "no-store" });
+  }
+  const rotateAdminMatch = url2.pathname.match(/^\/consumers\/([a-z0-9][a-z0-9-_]{1,63})\/rotate-admin-key$/);
+  if (rotateAdminMatch && req.method === "POST") {
+    const appId = rotateAdminMatch[1];
+    if (authCtx.type === "tenant" && authCtx.app_id !== appId) return forbidden();
+    const consumer = await findConsumerByAppId(env.DB, appId);
+    if (!consumer) return jsonResponse({ error: "not_found" }, 404);
+    const { plain, prefix, hash } = await generateTenantAdminKey();
+    await setConsumerAdminKey(env.DB, appId, hash, prefix);
+    log("tenant_admin_key_rotated", { app_id: appId, admin_key_prefix: prefix });
+    return jsonResponse({ admin_key: plain, admin_key_prefix: prefix }, 200, { "Cache-Control": "no-store" });
+  }
+  if (url2.pathname === "/subscriptions" && req.method === "POST") {
+    const input = parseOr400(CreateSubscriptionSchema, bodyText);
+    if (input instanceof Response) return input;
+    if (authCtx.type === "tenant") {
+      if (input.app_id !== authCtx.app_id) return forbidden();
+      const account = await findBankAccountById(env.DB, input.bank_account_id);
+      if (!account || account.owner_app_id !== authCtx.app_id) return forbidden();
+    }
+    let sub;
+    try {
+      sub = await createSubscription(env.DB, { app_id: input.app_id, bank_account_id: input.bank_account_id });
+    } catch (err) {
+      const msg = String(err);
+      if (msg.includes("subscription_cap_reached")) return jsonResponse({ error: "subscription_cap_reached" }, 422);
+      throw err;
+    }
+    return jsonResponse(sub, 201);
+  }
+  if (url2.pathname === "/subscriptions" && req.method === "GET") {
+    const appId = authCtx.type === "tenant" ? authCtx.app_id : url2.searchParams.get("app_id") ?? void 0;
+    const bankAccountIdStr = url2.searchParams.get("bank_account_id");
+    const bankAccountId = bankAccountIdStr ? parseInt(bankAccountIdStr, 10) : void 0;
+    const filters = {};
+    if (appId !== void 0) filters.app_id = appId;
+    if (bankAccountId !== void 0) filters.bank_account_id = bankAccountId;
+    const subs = await listSubscriptions(env.DB, filters);
+    return jsonResponse(subs);
+  }
+  const deleteSubMatch = url2.pathname.match(/^\/subscriptions\/(\d+)$/);
+  if (deleteSubMatch && req.method === "DELETE") {
+    const id = parseInt(deleteSubMatch[1], 10);
+    if (authCtx.type === "tenant") {
+      const sub = await env.DB.prepare(`
+        SELECT s.consumer_app_id, b.owner_app_id
+        FROM webhook_subscriptions s
+        JOIN bank_accounts b ON b.id = s.bank_account_id
+        WHERE s.id = ? AND s.deleted_at IS NULL
+      `).bind(id).first();
+      if (!sub || sub.consumer_app_id !== authCtx.app_id || sub.owner_app_id !== authCtx.app_id) return forbidden();
+    }
+    await deleteSubscription(env.DB, id);
+    return new Response(null, { status: 204 });
+  }
+  if (url2.pathname === "/webhooks/replay" && req.method === "POST") {
+    const input = parseOr400(ReplayWebhookSchema, bodyText);
+    if (input instanceof Response) return input;
+    if (input.delivery_id) {
+      const job = await findDeliveryJob(env.DB, input.delivery_id);
+      if (!job) return jsonResponse({ error: "delivery_id not found" }, 404);
+      if (authCtx.type === "tenant" && job.consumer_app_id !== authCtx.app_id) return forbidden();
+      const replay = await createWebhookDeliveryCoordinator(env).replay(job.id, { force: input.force ?? false });
+      return jsonResponse({ queued: replay.queued, noop: replay.noop ?? null, previous_status: replay.previous_status ?? null, delivery_id: input.delivery_id, job_id: job.id });
+    }
+    if (input.tx_id) {
+      const txRow = await env.DB.prepare(`SELECT t.id, b.owner_app_id FROM transactions t JOIN bank_accounts b ON b.id = t.bank_account_id WHERE t.id = ?`).bind(input.tx_id).first();
+      if (!txRow) return jsonResponse({ error: "transaction not found" }, 404);
+      if (authCtx.type === "tenant" && txRow.owner_app_id !== authCtx.app_id) return forbidden();
+      const coordinator = createWebhookDeliveryCoordinator(env);
+      await ensureDeliveryJobs(env.DB, txRow.id);
+      const jobs = (await findDeliveryJobsForTransaction(env.DB, txRow.id)).filter((job) => authCtx.type !== "tenant" || job.consumer_app_id === authCtx.app_id);
+      const replayed = await Promise.all(jobs.map((job) => coordinator.replay(job.id, { force: input.force ?? false })));
+      return jsonResponse({ queued: replayed.some((result) => result.queued), delivery_ids: replayed.flatMap((result) => result.delivery_id ? [result.delivery_id] : []), tx_id: input.tx_id });
+    }
+    return jsonResponse({ error: "unreachable" }, 500);
+  }
+  if (url2.pathname === "/webhooks/deliveries" && req.method === "GET") {
+    const limitStr = url2.searchParams.get("limit");
+    const limit = limitStr ? Math.min(parseInt(limitStr, 10), 100) : 50;
+    const cursorStr = url2.searchParams.get("cursor");
+    const cursor = cursorStr ? parseInt(cursorStr, 10) : void 0;
+    const entries = await DeliveryQueries.list(env.DB, {
+      limit,
+      ...cursor !== void 0 && !Number.isNaN(cursor) ? { cursor } : {},
+      ...authCtx.type === "tenant" ? { consumerAppId: authCtx.app_id } : {}
+    });
+    const next_cursor = entries.length === limit ? entries[entries.length - 1].id : null;
+    return jsonResponse({ jobs: entries, next_cursor });
+  }
+  if (url2.pathname === "/transactions" && req.method === "GET") {
+    const since = url2.searchParams.get("since") ?? (/* @__PURE__ */ new Date(0)).toISOString();
+    const limitStr = url2.searchParams.get("limit");
+    const limit = limitStr ? Math.min(parseInt(limitStr, 10), 200) : 50;
+    return jsonResponse(await listTransactions(env.DB, since, limit, authCtx.type === "tenant" ? authCtx.app_id : void 0));
+  }
+  if (url2.pathname === "/parse-log" && req.method === "GET") {
+    const since = url2.searchParams.get("since") ?? (/* @__PURE__ */ new Date(0)).toISOString();
+    const limitStr = url2.searchParams.get("limit");
+    const limit = limitStr ? Math.min(parseInt(limitStr, 10), 200) : 50;
+    return jsonResponse(await listParseLog(env.DB, since, limit, authCtx.type === "tenant" ? authCtx.app_id : void 0));
+  }
+  if (url2.pathname === "/webhook-log" && req.method === "GET") {
+    const since = url2.searchParams.get("since") ?? (/* @__PURE__ */ new Date(0)).toISOString();
+    const limitStr = url2.searchParams.get("limit");
+    const limit = limitStr ? Math.min(parseInt(limitStr, 10), 200) : 50;
+    return jsonResponse(await listWebhookLog(env.DB, since, limit, authCtx.type === "tenant" ? authCtx.app_id : void 0));
+  }
+  if (url2.pathname === "/unmatched-mails" && req.method === "GET") {
+    const since = url2.searchParams.get("since") ?? new Date(Date.now() - 7 * 24 * 60 * 60 * 1e3).toISOString();
+    const limitStr = url2.searchParams.get("limit");
+    const limit = limitStr ? Math.min(parseInt(limitStr, 10), 200) : 50;
+    const rows = await listUnmatchedMails(env.DB, since, limit);
+    const filtered = authCtx.type === "tenant" ? [] : rows;
+    return jsonResponse(filtered);
+  }
+  if (url2.pathname === "/admin/audit-cf-rules" && req.method === "GET") {
+    if (authCtx.type !== "admin") return forbidden();
+    const result = await auditCfRoutingDrift({ db: env.DB, cf: cfRoutingConfig(env) });
+    return jsonResponse(result);
+  }
+  if (url2.pathname === "/admin/audit-log" && req.method === "GET") {
+    if (authCtx.type !== "admin") return forbidden();
+    const sinceParam = url2.searchParams.get("since");
+    const principalParam = url2.searchParams.get("principal");
+    const limitRaw = url2.searchParams.get("limit");
+    const limit = limitRaw ? Math.min(parseInt(limitRaw, 10), 500) : 50;
+    const auditArgs = { limit };
+    if (sinceParam !== null) auditArgs.since = sinceParam;
+    if (principalParam !== null) auditArgs.authPrincipal = principalParam;
+    const rows = await listAuditLog(env.DB, auditArgs);
+    return jsonResponse(rows);
+  }
+  if (url2.pathname === "/admin/process-outbox" && req.method === "POST") {
+    if (authCtx.type !== "admin") return forbidden();
+    const result = await processOutbox(env.DB, cfRoutingConfig(env));
+    return jsonResponse(result);
+  }
+  {
+    const orphanMatch = url2.pathname.match(/^\/admin\/cf-rules\/([A-Za-z0-9]+)$/);
+    if (orphanMatch && req.method === "DELETE") {
+      if (authCtx.type !== "admin") return forbidden();
+      const ruleId = orphanMatch[1];
+      await deleteRule(cfRoutingConfig(env), ruleId);
+      return jsonResponse({ deleted: true, rule_id: ruleId });
+    }
+  }
+  if (url2.pathname === "/admin/outbox/clear-stuck" && req.method === "POST") {
+    if (authCtx.type !== "admin") return forbidden();
+    const cleared = await clearStuckOutbox(env.DB);
+    return jsonResponse({ cleared });
+  }
+  return notFound();
+}
+var cloudflare_default = {
+  async email(message, env, _ctx) {
+    await assertSchemaVersion(env.DB);
+    if (message.rawSize > 5 * 1024 * 1024) {
+      await insertParseLog(env.DB, {
+        error_message: `email_too_large: ${message.rawSize}`,
+        raw_data: "(truncated, oversized email \u2014 first 4KB unavailable, body never read)"
+      });
+      log("email_rejected_oversized", { size: message.rawSize });
+      return;
+    }
+    const trustedAuthservId = env.EMAIL_AUTHSERV_ID?.trim();
+    if (!trustedAuthservId) {
+      const inspection = inspectAuthenticationResults(message.headers.get("authentication-results"));
+      await insertParseLog(env.DB, { error_message: "email_ingest_disabled_untrusted_authserv", raw_data: null });
+      log("email_rejected_authentication", {
+        reason: "trusted_authserv_not_configured",
+        authentication_results_present: message.headers.has("authentication-results"),
+        observed_authserv_id: inspection.observedAuthservId,
+        authentication_results_ambiguous: inspection.ambiguous
+      });
+      return;
+    }
+    await processEmail(message.raw, env, {
+      mailFrom: message.from,
+      rcptTo: message.to,
+      authenticationResults: message.headers.get("authentication-results"),
+      trustedAuthservId
+    });
+  },
+  async fetch(req, env, _ctx) {
+    try {
+      return await adminFetch(req, env);
+    } catch (err) {
+      const requestId = crypto.randomUUID();
+      logError("admin_fetch_error", err, { request_id: requestId });
+      return jsonResponse({ error: "internal_error", request_id: requestId }, 500);
+    }
+  },
+  async queue(batch, env, _ctx) {
+    await assertSchemaVersion(env.DB);
+    if (batch.queue === "banksync-api-sync") {
+      await handleApiSyncQueue(batch, env);
+      return;
+    }
+    await handleQueueBatch(batch, env);
+  },
+  async scheduled(event, env, _ctx) {
+    await assertSchemaVersion(env.DB);
+    const runPolling = shouldRunApiPolling(event);
+    const runMaintenance = shouldRunMaintenance(event);
+    if (runMaintenance) {
+      try {
+        const result = await pruneRetention(env.DB);
+        log("retention_pruned", {
+          parse_log_deleted: result.parse_log_deleted,
+          webhook_log_deleted: result.webhook_log_deleted,
+          event_log_deleted: result.event_log_deleted,
+          transactions_deleted: result.transactions_deleted,
+          idempotency_keys_deleted: result.idempotency_keys_deleted,
+          admin_audit_log_deleted: result.admin_audit_log_deleted,
+          expired_prev_secrets_cleared: result.expired_prev_secrets_cleared
+        });
+      } catch (err) {
+        logError("retention_failed", err, {});
+        throw err;
+      }
+    }
+    if (runPolling) {
+      try {
+        const outboxResult = await processOutbox(env.DB, cfRoutingConfig(env));
+        log("outbox_processed", outboxResult);
+      } catch (err) {
+        logError("outbox_process_failed", err, {});
+      }
+      try {
+        const swept = await createWebhookDeliveryCoordinator(env).sweep();
+        if (swept.created > 0 || swept.considered > 0) {
+          log("webhook_delivery_sweep", { created: swept.created, considered: swept.considered, queued: swept.queued, failed: swept.failed });
+        }
+      } catch (err) {
+        logError("webhook_delivery_sweep_failed", err, {});
+      }
+    }
+    if (runMaintenance) {
+      try {
+        await pruneOldBuckets(env.DB);
+      } catch (err) {
+        logError("rate_limit_prune_failed", err, {});
+      }
+    }
+    if (runPolling) {
+      try {
+        if (await enqueueApiSyncTick(env, 0, "cron")) {
+          log("api_sync_tick_enqueued", { delay_seconds: 0, source: "cron" });
+        } else {
+          await runDueBankApiSyncs(env);
+        }
+      } catch (err) {
+        logError("api_sync_tick_failed", err, {});
+      }
+    }
+    if (runPolling && env.ALERT_WEBHOOK_URL) {
+      try {
+        const alert = await runAlerterTick(env.DB, {
+          webhookUrl: env.ALERT_WEBHOOK_URL,
+          webhookSecret: env.ALERT_WEBHOOK_SECRET,
+          service: env.BANKSYNC_DOMAIN ?? "banksync",
+          thresholds: DEFAULT_THRESHOLDS
+        });
+        if (alert.fired) log("alert_fired", { posted: alert.posted, severity: alert.payload.severity });
+      } catch (err) {
+        logError("alerter_tick_failed", err, {});
+      }
+    }
+    if (runPolling && env.ALERT_WEBHOOK_URL) {
+      try {
+        const service = env.BANKSYNC_DOMAIN ?? "banksync";
+        await detectStalledIncidents(env.DB, service);
+        await drainDeliveryAlerts(env.DB, {
+          webhookUrl: env.ALERT_WEBHOOK_URL,
+          webhookSecret: env.ALERT_WEBHOOK_SECRET,
+          service
+        });
+      } catch (err) {
+        logError("delivery_alert_drain_failed", err, {});
+      }
+    }
+    const dayOfWeek = (/* @__PURE__ */ new Date()).getUTCDay();
+    if (runMaintenance && dayOfWeek === 0 && env.BACKUPS) {
+      try {
+        const version = Number(env.BACKUP_ENCRYPTION_KEY_VERSION ?? "");
+        const encryptionKey = Number.isInteger(version) ? env[`BACKUP_ENCRYPTION_KEY_V${version}`] : void 0;
+        const backup = await runBackupTick(env.DB, { bucket: env.BACKUPS, prefix: "banksync", retain: 8, encryptionKey, keyVersion: version });
+        log("backup_tick", { uploaded: backup.uploaded, key: backup.key ?? null, size_bytes: backup.size_bytes ?? null });
+      } catch (err) {
+        logError("backup_tick_failed", err, {});
+      }
+    }
+  }
+};
+export {
+  cloudflare_default as default,
+  processEmail
+};