@festapp/banksync 0.1.5 → 0.2.1

package/dist/cloudflare.js

@@ -3,13 +3,14 @@ import {
   FioTransientFailure,
   buildWebhookEnvelope,
   detectProvider,
+  fetchFioStatement,
   fetchNewTransactions,
   mapFioTransaction,
   parseEmail,
   resolveVariableSymbol,
   setFioPointer,
   signWebhook
-} from "./chunk-5QXHZGAW.js";
+} from "./chunk-3WM2GGFL.js";
 
 // src/mime.ts
 import PostalMime from "postal-mime";
@@ -313,7 +314,7 @@ function logError(event, err, data) {
 }
 
 // src/db.ts
-var SUPPORTED_SCHEMA_VERSIONS = ["10"];
+var SUPPORTED_SCHEMA_VERSIONS = ["10", "11"];
 var _checkedDbs = /* @__PURE__ */ new Set();
 async function assertSchemaVersion(db) {
   if (_checkedDbs.has(db)) return;
@@ -542,6 +543,7 @@ var SQL_CREATE_CONSUMER = `INSERT INTO webhook_consumers (app_id, callback_url,
 async function createConsumer(db, args) {
   const row = await db.prepare(SQL_CREATE_CONSUMER).bind(args.app_id, args.callback_url, args.secret_cipher, args.secret_hash, args.secret_prefix).first();
   if (!row) throw new Error("createConsumer: no row returned");
+  if (args.event_version === "2") await db.prepare("UPDATE webhook_consumers SET event_version='2' WHERE id=?").bind(row.id).run();
   return row;
 }
 var SQL_FIND_CONSUMER_BY_APP_ID = `SELECT id, app_id, callback_url, secret_cipher, secret_hash, secret_prefix, prev_secret_cipher, prev_expires_at, admin_key_hash, admin_key_prefix, created_at FROM webhook_consumers WHERE app_id = ?`;
@@ -601,45 +603,30 @@ INSERT OR IGNORE INTO transactions (
 ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 `;
 var SQL_SELECT_TRANSACTION_BY_ID = `SELECT id, bank_account_id, amount_cents, currency, counter_account, bank_code, bank_name, vs, ks, ss, message, sender_name, user_identification, transaction_type, performed_by, comment, command_id, source, date, date_offset_min, transaction_id, external_id FROM transactions WHERE id = ?`;
-var SQL_FIND_DUPLICATE_EXT = `SELECT id FROM transactions WHERE external_id = ? AND external_id IS NOT NULL LIMIT 1`;
-var SQL_FIND_DUPLICATE_FIO = `SELECT id FROM transactions WHERE bank_account_id = ? AND transaction_id = ? AND transaction_id IS NOT NULL LIMIT 1`;
-var SQL_FIND_DUPLICATE_FUZZY = `
-SELECT id
-FROM transactions
-WHERE bank_account_id = ?
-  AND vs = ?
-  AND amount_cents = ?
-  AND currency = ?
-  AND substr(date, 1, 10) BETWEEN date(?, '-3 days') AND date(?, '+3 days')
-LIMIT 1
-`;
-function fuzzyDateDay(date) {
-  return /^\d{4}-\d{2}-\d{2}/.test(date) ? date.slice(0, 10) : null;
-}
-async function findFuzzyDuplicate(db, bankAccountId, p) {
-  if (!p.vs) return false;
-  const dateDay = fuzzyDateDay(p.date);
-  if (!dateDay) return false;
-  const hit = await db.prepare(SQL_FIND_DUPLICATE_FUZZY).bind(bankAccountId, p.vs, p.amount_cents, p.currency, dateDay, dateDay).first();
-  return hit !== null;
-}
+var SQL_FIND_DUPLICATE_EXT = `SELECT id FROM transactions WHERE bank_account_id = ? AND external_id = ? AND external_id IS NOT NULL LIMIT 1`;
+var SQL_FIND_DUPLICATE_FIO = `SELECT * FROM transactions WHERE bank_account_id = ? AND transaction_id = ? AND transaction_id IS NOT NULL AND source='fio_api' LIMIT 1`;
 async function insertTransaction(db, args) {
+  const schema = await db.prepare(`SELECT value FROM schema_meta WHERE key='version'`).first();
+  const v2 = schema?.value === "11";
   const p = {
     ...args.payload,
-    vs: resolveVariableSymbol(args.payload)
+    vs: v2 ? args.payload.raw_vs ?? args.payload.vs ?? null : resolveVariableSymbol(args.payload)
   };
-  if (p.transaction_id != null) {
+  if (p.transaction_id != null && p.source === "fio_api") {
     const hit = await db.prepare(SQL_FIND_DUPLICATE_FIO).bind(args.bank_account_id, p.transaction_id).first();
-    if (hit) return { status: "skipped", reason: "duplicate_transaction_id" };
+    if (hit) {
+      const facts = hit;
+      if (facts.amount_cents !== p.amount_cents || facts.currency !== p.currency || facts.date.slice(0, 10) !== p.date.slice(0, 10) || facts.identity_kind === "movement" && (facts.raw_vs !== (p.raw_vs ?? args.payload.vs ?? null) || facts.payer_reference !== (p.payer_reference ?? null))) throw new Error("bank_movement_fact_conflict");
+      return { status: "skipped", reason: "duplicate_transaction_id" };
+    }
   }
   if (p.external_id != null) {
-    const hit = await db.prepare(SQL_FIND_DUPLICATE_EXT).bind(p.external_id).first();
+    const hit = await db.prepare(SQL_FIND_DUPLICATE_EXT).bind(args.bank_account_id, p.external_id).first();
     if (hit) return { status: "skipped", reason: "duplicate_external_id" };
   }
-  if (await findFuzzyDuplicate(db, args.bank_account_id, p)) {
-    return { status: "skipped", reason: "fuzzy_duplicate" };
-  }
-  const result = await db.prepare(SQL_INSERT_TRANSACTION).bind(
+  if (p.amount_cents <= 0 && !v2) throw new Error("signed_facts_require_schema11");
+  const sql = v2 ? SQL_INSERT_TRANSACTION.replace("external_id\n)", "external_id, payer_reference, raw_vs, direction, identity_kind, identity_provenance\n)").replace("?)\n", "?, ?, ?, ?, ?, ?)\n") : SQL_INSERT_TRANSACTION;
+  const values = [
     args.bank_account_id,
     p.amount_cents,
     p.currency,
@@ -661,23 +648,32 @@ async function insertTransaction(db, args) {
     p.date_offset_min ?? null,
     p.transaction_id ?? null,
     p.external_id ?? null
-  ).run();
+  ];
+  if (v2) values.push(
+    p.payer_reference ?? null,
+    args.payload.raw_vs ?? args.payload.vs ?? null,
+    p.amount_cents > 0 ? "incoming" : p.amount_cents < 0 ? "outgoing" : "zero",
+    p.identity_kind ?? (p.source === "fio_api" && p.transaction_id ? "movement" : "observation"),
+    p.identity_provenance ?? (p.source === "fio_api" ? "fio_api_column22" : "authenticated_email_unverified_movement")
+  );
+  const result = await db.prepare(sql).bind(...values).run();
   if (result.meta.changes === 0) {
-    if (p.transaction_id != null) {
+    if (p.transaction_id != null && p.source === "fio_api") {
       const hit = await db.prepare(SQL_FIND_DUPLICATE_FIO).bind(args.bank_account_id, p.transaction_id).first();
-      if (hit) return { status: "skipped", reason: "duplicate_transaction_id" };
+      if (hit) {
+        const facts = hit;
+        if (facts.amount_cents !== p.amount_cents || facts.currency !== p.currency || facts.date.slice(0, 10) !== p.date.slice(0, 10) || facts.identity_kind === "movement" && (facts.raw_vs !== (p.raw_vs ?? args.payload.vs ?? null) || facts.payer_reference !== (p.payer_reference ?? null))) throw new Error("bank_movement_fact_conflict");
+        return { status: "skipped", reason: "duplicate_transaction_id" };
+      }
     }
     if (p.external_id != null) {
-      const hit = await db.prepare(SQL_FIND_DUPLICATE_EXT).bind(p.external_id).first();
+      const hit = await db.prepare(SQL_FIND_DUPLICATE_EXT).bind(args.bank_account_id, p.external_id).first();
       if (hit) return { status: "skipped", reason: "duplicate_external_id" };
     }
-    if (await findFuzzyDuplicate(db, args.bank_account_id, p)) {
-      return { status: "skipped", reason: "fuzzy_duplicate" };
-    }
-    return { status: "skipped", reason: "fuzzy_duplicate" };
+    throw new Error("transaction_insert_constraint_conflict");
   }
   const rowId = result.meta.last_row_id;
-  const row = await db.prepare(SQL_SELECT_TRANSACTION_BY_ID).bind(rowId).first();
+  const row = await db.prepare(v2 ? "SELECT * FROM transactions WHERE id = ?" : SQL_SELECT_TRANSACTION_BY_ID).bind(rowId).first();
   if (!row) throw new Error("insertTransaction: row vanished after insert");
   return { status: "inserted", transaction: row };
 }
@@ -880,8 +876,14 @@ async function getStatusData(db) {
 var SQL_PRUNE_PARSE_LOG = `DELETE FROM parse_log WHERE created_at < datetime('now', '-30 days')`;
 var SQL_PRUNE_WEBHOOK_LOG = `DELETE FROM webhook_log WHERE created_at < datetime('now', '-90 days')`;
 var SQL_PRUNE_EVENT_LOG = `DELETE FROM event_log WHERE created_at < datetime('now', '-30 days')`;
-var SQL_PRUNE_TRANSACTIONS = `DELETE FROM transactions WHERE created_at < datetime('now', '-90 days')`;
-var SQL_PRUNE_IDEMPOTENCY_KEYS = `DELETE FROM idempotency_keys WHERE created_at < datetime('now', '-24 hours')`;
+var SQL_PRUNE_TRANSACTIONS = `DELETE FROM transactions WHERE created_at < datetime('now', '-90 days')
+  AND NOT EXISTS (SELECT 1 FROM webhook_delivery_jobs j WHERE j.transaction_id=transactions.id
+    AND (j.status<>'delivered' OR j.business_outcome LIKE 'quarantined_%'))
+  AND NOT EXISTS (SELECT 1 FROM webhook_subscriptions s WHERE s.bank_account_id=transactions.bank_account_id
+    AND datetime(s.created_at)<=datetime(transactions.created_at)
+    AND (s.deleted_at IS NULL OR datetime(transactions.created_at)<datetime(s.deleted_at))
+    AND NOT EXISTS (SELECT 1 FROM webhook_delivery_jobs j WHERE j.transaction_id=transactions.id AND j.consumer_app_id=s.consumer_app_id))`;
+var SQL_PRUNE_IDEMPOTENCY_KEYS = `DELETE FROM idempotency_keys WHERE request_path <> '/bank-accounts' AND created_at < datetime('now', '-24 hours')`;
 var SQL_PRUNE_ADMIN_AUDIT_LOG = `DELETE FROM admin_audit_log WHERE created_at < datetime('now', '-90 days')`;
 var SQL_CLEAR_EXPIRED_PREV_SECRETS = `UPDATE webhook_consumers SET prev_secret_cipher = NULL, prev_expires_at = NULL WHERE prev_expires_at < datetime('now')`;
 async function pruneRetention(db) {
@@ -925,6 +927,7 @@ function parseBody(schema, body) {
   }
 }
 var CreateBankAccountSchema = v.object({
+  ingest_enabled: v.optional(v.boolean()),
   account_number: v.pipe(v.string(), v.minLength(3), v.maxLength(64)),
   account_type: v.optional(v.picklist(["FIO", "AIRBANK"])),
   ingest_mode: v.optional(v.picklist(["email", "api", "both"])),
@@ -960,6 +963,7 @@ var UpdateFioTokenSchema = v.pipe(
   )
 );
 var CreateConsumerSchema = v.object({
+  event_version: v.optional(v.picklist(["1", "2"])),
   app_id: v.pipe(v.string(), v.regex(/^[a-z0-9][a-z0-9-_]{1,63}$/)),
   callback_url: v.pipe(v.string(), v.url(), v.regex(/^https:\/\//))
 });
@@ -1197,13 +1201,18 @@ async function sha256Hex(input) {
 function newDispatchToken() {
   return crypto.randomUUID();
 }
-async function ensureDeliveryJobs(db, transactionId) {
+async function ensureDeliveryJobs(db, transactionId, cutover) {
+  const schema = await db.prepare("SELECT value FROM schema_meta WHERE key='version'").first();
+  const expanded = schema?.value === "11";
+  if (cutover && !expanded) throw new Error("cutover_requires_schema11");
   const candidates = await db.prepare(`
-    SELECT t.*, b.pairing_code, s.consumer_app_id
+    SELECT t.*, b.pairing_code, s.consumer_app_id${expanded ? ", c.event_version" : ""}
     FROM transactions t
     JOIN bank_accounts b ON b.id = t.bank_account_id
     JOIN webhook_subscriptions s ON s.bank_account_id = t.bank_account_id
+    ${expanded ? "JOIN webhook_consumers c ON c.app_id = s.consumer_app_id" : ""}
     WHERE (? IS NULL OR t.id = ?)
+      AND ${expanded ? "(c.event_version='2' OR t.amount_cents > 0)" : "t.amount_cents > 0"}
       AND NOT EXISTS (
         SELECT 1 FROM webhook_delivery_jobs j
         WHERE j.transaction_id = t.id AND j.consumer_app_id = s.consumer_app_id
@@ -1212,16 +1221,17 @@ async function ensureDeliveryJobs(db, transactionId) {
       -- Intent is decided by the subscription interval at ingest, not by the
       -- current active-subscription view. Exact UTC datetime (not julianday) so
       -- a same-second create/delete/transaction is deterministic.
-      AND datetime(s.created_at) <= datetime(t.created_at)
-      AND (s.deleted_at IS NULL OR datetime(t.created_at) < datetime(s.deleted_at))
-  `).bind(transactionId ?? null, transactionId ?? null).all();
+      ${cutover ? "AND t.bank_account_id=? AND s.consumer_app_id=? AND t.id>=? AND t.id<=? AND s.deleted_at IS NULL AND c.event_version='2'" : "AND datetime(s.created_at) <= datetime(t.created_at) AND (s.deleted_at IS NULL OR datetime(t.created_at) < datetime(s.deleted_at))"}
+  `).bind(transactionId ?? null, transactionId ?? null, ...cutover ? [cutover.accountId, cutover.consumerAppId, cutover.fromId, cutover.throughId] : []).all();
   let created = 0;
   for (const row of candidates.results) {
+    const { pairing_code, consumer_app_id, event_version, created_at: _createdAt, ...transaction } = row;
     const deliveryId = ulid();
     const envelope = buildWebhookEnvelope({
       delivery_id: deliveryId,
       pairing_code: row.pairing_code,
-      transaction: row
+      transaction,
+      event_version: row.event_version ?? "1"
     });
     const payload = JSON.stringify(envelope);
     const result = await db.prepare(`
@@ -2659,6 +2669,75 @@ async function runBackupTick(db, cfg) {
   };
 }
 
+// src/bankRecovery.ts
+async function recoverBankAccount(db, account, env, proxy) {
+  const enabled = await db.prepare("SELECT ingest_enabled FROM bank_accounts WHERE id=?").bind(account.id).first();
+  if (enabled?.ingest_enabled === 0) throw new Error("bank_connection_paused");
+  const credential = await decryptSecret(account.api_token_cipher, account.api_token_key_ver, env);
+  const keys = [await sha256Hex2(`fio-account:${account.account_number.replace(/\s/g, "").toUpperCase()}`), await sha256Hex2(`fio-token:${credential}`)].sort();
+  const fence = crypto.randomUUID();
+  const held = [];
+  try {
+    for (const key of keys) {
+      const claim = await db.prepare(`INSERT INTO bank_poll_leases (credential_hash,token,lease_until,next_allowed_at)
+        VALUES (?,?,datetime('now','+120 seconds'),datetime('now','+30 seconds'))
+        ON CONFLICT(credential_hash) DO UPDATE SET token=excluded.token, lease_until=excluded.lease_until,
+        next_allowed_at=excluded.next_allowed_at
+        WHERE datetime(bank_poll_leases.lease_until)<=datetime('now') AND datetime(bank_poll_leases.next_allowed_at)<=datetime('now')`).bind(key, fence).run();
+      if (claim.meta.changes !== 1) throw new Error("bank_poll_busy");
+      held.push(key);
+    }
+    async function renew() {
+      for (const key of held) {
+        const result = await db.prepare(`UPDATE bank_poll_leases SET lease_until=datetime('now','+120 seconds')
+          WHERE credential_hash=? AND token=? AND datetime(lease_until)>datetime('now')`).bind(key, fence).run();
+        if (result.meta.changes !== 1) throw new Error("bank_poll_lease_lost");
+      }
+    }
+    const open = await db.prepare(`SELECT id,from_date,to_date,cipher,key_version FROM bank_recovery_batches
+      WHERE bank_account_id=? AND state<>'completed' ORDER BY created_at,id LIMIT 1`).bind(account.id).first();
+    const checkpoint = await db.prepare("SELECT api_reconciled_through FROM bank_accounts WHERE id=?").bind(account.id).first();
+    const end = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+    const start = new Date(checkpoint?.api_reconciled_through ?? Date.parse(end) - 86 * 864e5);
+    start.setUTCDate(start.getUTCDate() - 3);
+    if (!open && Date.parse(end) - start.getTime() > 89 * 864e5) throw new Error("recovery_window_requires_bank_unlock");
+    const batch = open ?? { id: crypto.randomUUID(), from_date: start.toISOString().slice(0, 10), to_date: end, cipher: null, key_version: null };
+    if (!open) await db.prepare(`INSERT INTO bank_recovery_batches(id,bank_account_id,from_date,to_date,state) VALUES(?,?,?,?,'fetching')`).bind(batch.id, account.id, batch.from_date, batch.to_date).run();
+    await db.prepare(`UPDATE bank_accounts SET api_last_fetch_at=datetime('now') WHERE id=?`).bind(account.id).run();
+    let statement;
+    if (batch.cipher !== null && batch.key_version !== null) statement = JSON.parse(await decryptSecret(batch.cipher, batch.key_version, env));
+    else {
+      statement = await fetchFioStatement(credential, batch.from_date, batch.to_date, proxy);
+      await renew();
+      const encrypted = await encryptSecret(JSON.stringify(statement), env);
+      await db.prepare(`UPDATE bank_recovery_batches SET cipher=?,key_version=?,state='spooled' WHERE id=?`).bind(encrypted.cipher, encrypted.keyVersion, batch.id).run();
+    }
+    const identity = String(statement.info?.iban ?? "").replace(/\s/g, "").toUpperCase();
+    const domestic = `${statement.info?.accountId ?? ""}/${statement.info?.bankId ?? ""}`;
+    const expected = account.account_number.replace(/\s/g, "").toUpperCase();
+    if (expected !== identity && expected !== domestic) throw new Error("fio_receiving_account_mismatch");
+    let inserted = 0, skipped = 0;
+    for (const raw of statement.transactions) {
+      await renew();
+      const mapped = mapFioTransaction(raw);
+      if (!mapped || mapped.identity_kind !== "movement") throw new Error("fio_unverified_movement");
+      if (mapped.currency !== String(statement.info?.currency ?? "").toUpperCase()) throw new Error("fio_statement_currency_mismatch");
+      const result = await insertTransaction(db, { bank_account_id: account.id, payload: mapped });
+      if (result.status === "inserted") inserted++;
+      else skipped++;
+    }
+    await renew();
+    await db.batch([
+      db.prepare(`UPDATE bank_recovery_batches SET state='completed',completed_at=datetime('now') WHERE id=?`).bind(batch.id),
+      db.prepare(`UPDATE bank_accounts SET api_last_success_at=datetime('now'),api_last_error=NULL,api_backfill_done=1,
+        api_reconciled_through=?,api_pointer_initialized=1 WHERE id=?`).bind(batch.to_date, account.id)
+    ]);
+    return { inserted, skipped };
+  } finally {
+    for (const key of held) await db.prepare(`UPDATE bank_poll_leases SET lease_until=datetime('now'),next_allowed_at=datetime('now','+30 seconds') WHERE credential_hash=? AND token=?`).bind(key, fence).run();
+  }
+}
+
 // src/cloudflare.ts
 function fioProxyConfig(env) {
   const url2 = env.FIO_PROXY_URL?.trim();
@@ -2674,10 +2753,36 @@ function cfRoutingConfig(env) {
 }
 async function processEmail(rawStream, env, envelope) {
   let bodyText;
+  let spoolId;
+  const reader = rawStream.getReader();
+  const parts = [];
+  let byteCount = 0;
+  while (true) {
+    const item = await reader.read();
+    if (item.done) break;
+    byteCount += item.value.byteLength;
+    if (byteCount > 512 * 1024) {
+      await reader.cancel();
+      throw new Error("email_body_limit");
+    }
+    parts.push(item.value);
+  }
+  const rawArray = new Uint8Array(byteCount);
+  let offset = 0;
+  for (const part of parts) {
+    rawArray.set(part, offset);
+    offset += part.length;
+  }
+  const rawBytes = rawArray.buffer;
+  let binary = "";
+  for (let i = 0; i < rawArray.length; i += 8192) binary += String.fromCharCode(...rawArray.subarray(i, i + 8192));
+  const bytesBase64 = btoa(binary);
+  const rawMime = new TextDecoder().decode(rawBytes);
+  let r2SpoolKey;
   try {
     let extracted;
     try {
-      extracted = await extractEmailBody(rawStream);
+      extracted = await extractEmailBody(new Blob([rawBytes]).stream());
       bodyText = extracted.text;
     } catch (err) {
       const rawText = await new Response(rawStream).text().catch(() => "(failed to read raw)");
@@ -2697,31 +2802,59 @@ async function processEmail(rawStream, env, envelope) {
       log("email_rejected_authentication", { reason });
       return;
     }
+    if (env.AUTHENTICATED_EMAIL_SPOOL === "on") {
+      if (!env.BACKUPS) throw new Error("authenticated_spool_binding_required");
+      const encrypted = await encryptSecret(JSON.stringify({ bytesBase64, envelope }), env);
+      r2SpoolKey = `authenticated-email-pending/${await sha256Hex2(`${identity.recipient}:${bytesBase64}`)}`;
+      const existing = await env.BACKUPS.head(r2SpoolKey);
+      if (!existing) await env.BACKUPS.put(r2SpoolKey, JSON.stringify(encrypted));
+    }
     const allowlist = parseAllowlist(env.SENDER_ALLOWLIST);
     const pairingCode = extractPairingCode(identity.recipient);
     const account = pairingCode ? await findBankAccountByPairingCode(env.DB, pairingCode) : null;
+    const schema = await env.DB.prepare("SELECT value FROM schema_meta WHERE key='version'").first();
+    if (account && schema?.value === "11") {
+      spoolId = await sha256Hex2(`${account.id}:${extracted.messageId ?? await sha256Hex2(rawMime)}`);
+      const digest = await sha256Hex2(rawMime);
+      const encrypted = await encryptSecret(JSON.stringify({ bytesBase64, envelope }), env);
+      await env.DB.prepare(`INSERT INTO authenticated_email_spool(id,bank_account_id,body_sha256,cipher,key_version)
+        VALUES(?,?,?,?,?) ON CONFLICT(id) DO NOTHING`).bind(spoolId, account.id, digest, encrypted.cipher, encrypted.keyVersion).run();
+      const stored = await env.DB.prepare("SELECT body_sha256 FROM authenticated_email_spool WHERE id=?").bind(spoolId).first();
+      if (stored?.body_sha256 !== digest) throw new Error("email_transport_body_conflict");
+    }
+    async function completeSpool() {
+      if (spoolId) await env.DB.prepare("UPDATE authenticated_email_spool SET state='completed',completed_at=datetime('now') WHERE id=?").bind(spoolId).run();
+      if (r2SpoolKey) await env.BACKUPS.delete(r2SpoolKey);
+    }
+    if (account && schema?.value === "11") {
+      const enabled = await env.DB.prepare("SELECT ingest_enabled FROM bank_accounts WHERE id=?").bind(account.id).first();
+      if (enabled?.ingest_enabled === 0) throw new Error("email_connection_paused");
+    }
     const outcome = classifyEmail(extracted, identity, account, allowlist);
     if (outcome.received) {
       log("email_received", { pairing_code: pairingCode, message_id: extracted.messageId ?? null });
       await writeEvent(env.DB, { event_type: "email_received", bank_account_id: account.id, detail: { message_id: extracted.messageId ?? null } });
     }
     if (outcome.kind === "reject" || outcome.kind === "skip") {
+      if (r2SpoolKey && (outcome.reason.startsWith("parse_failed") || outcome.reason.startsWith("unknown_") || outcome.reason.startsWith("no_pairing"))) throw new Error("authenticated_email_quarantined");
       await insertParseLog(env.DB, {
         bank_account_id: outcome.bankAccountId ?? null,
         error_message: outcome.reason,
         raw_data: sanitizeDiagnosticRaw(extracted.text),
         external_id: extracted.messageId ?? null
       });
+      await completeSpool();
       return;
     }
     const acct = outcome.account;
+    if (!outcome.parsed.date) throw new Error("email_missing_bank_date");
     let result;
     try {
       result = await insertTransaction(env.DB, {
         bank_account_id: acct.id,
         payload: {
           ...outcome.parsed,
-          date: outcome.parsed.date ?? (/* @__PURE__ */ new Date()).toISOString(),
+          date: outcome.parsed.date,
           external_id: extracted.messageId ?? null
         }
       });
@@ -2732,17 +2865,19 @@ async function processEmail(rawStream, env, envelope) {
         raw_data: sanitizeDiagnosticRaw(JSON.stringify({ ...outcome.parsed, external_id: extracted.messageId ?? null })),
         external_id: extracted.messageId ?? null
       });
-      return;
+      throw new Error("email_db_insert_failed");
     }
     if (result.status === "skipped") {
       log("tx_skipped", { reason: result.reason, bank_account_id: acct.id });
       await writeEvent(env.DB, { event_type: "tx_skipped", bank_account_id: acct.id, detail: { reason: result.reason } });
+      await completeSpool();
       return;
     }
     const tx = result.transaction;
     log("tx_inserted", { bank_account_id: acct.id, tx_id: tx.id, vs: tx.vs, amount_cents: tx.amount_cents, currency: tx.currency });
     await writeEvent(env.DB, { event_type: "tx_inserted", bank_account_id: acct.id, detail: { tx_id: tx.id } });
     await createWebhookDeliveryCoordinator(env).observeTransaction(tx.id);
+    await completeSpool();
   } catch (err) {
     try {
       await insertParseLog(env.DB, {
@@ -2752,6 +2887,7 @@ async function processEmail(rawStream, env, envelope) {
     } catch {
     }
     logError("email_unhandled_exception", err, {});
+    throw new Error("email_ingest_incomplete");
   }
 }
 function sanitizeDiagnosticRaw(value) {
@@ -2793,6 +2929,7 @@ function yyyyMmDdDaysAgo(days) {
 var API_POLL_CRON = "* * * * *";
 var MAINTENANCE_CRON = "15 3 * * *";
 var API_SYNC_LEASE_S = 30;
+var RECONCILIATION_INTERVAL_MINUTES = 5;
 function scheduledCron(event) {
   const cron = event.cron;
   return typeof cron === "string" ? cron : null;
@@ -2805,6 +2942,14 @@ function shouldRunMaintenance(event) {
   const cron = scheduledCron(event);
   return cron === null || cron === MAINTENANCE_CRON;
 }
+function shouldRunReconciliation(event) {
+  const cron = scheduledCron(event);
+  if (cron === null) return true;
+  if (cron !== API_POLL_CRON) return false;
+  const scheduledTime = event.scheduledTime;
+  if (typeof scheduledTime !== "number" || !Number.isFinite(scheduledTime)) return true;
+  return Math.floor(scheduledTime / 6e4) % RECONCILIATION_INTERVAL_MINUTES === 0;
+}
 function apiSyncDelayS(env) {
   return Math.max(30, apiMinIntervalS(env));
 }
@@ -2814,6 +2959,12 @@ async function runBankApiSync(env, account) {
   }
   const isBackfill = !account.api_backfill_done;
   try {
+    const schema = await env.DB.prepare("SELECT value FROM schema_meta WHERE key='version'").first();
+    if (schema?.value === "11") {
+      const result = await recoverBankAccount(env.DB, account, env, fioProxyConfig(env));
+      await ensureDeliveryJobs(env.DB);
+      return { bank_account_id: account.id, provider: account.account_type, inserted: result.inserted, skipped_duplicate: result.skipped, skipped_outgoing: 0, parse_errors: 0, queued_webhooks: 0, backfill: isBackfill, deferred: false };
+    }
     const token = await decryptSecret(account.api_token_cipher, account.api_token_key_ver, env);
     if (isBackfill && account.api_last_success_at === null) {
       await markBankAccountApiFetchStarted(env.DB, account.id);
@@ -2856,7 +3007,7 @@ async function runBankApiSync(env, account) {
         });
         continue;
       }
-      if (mapped === null) {
+      if (mapped === null || mapped.amount_cents <= 0) {
         skippedOutgoing++;
         await insertParseLog(env.DB, {
           bank_account_id: account.id,
@@ -2914,14 +3065,7 @@ async function runBankApiSync(env, account) {
 }
 async function runDueBankApiSyncs(env) {
   const accounts = await listDueApiFetchAccounts(env.DB, apiMinIntervalS(env));
-  const processedTokenPrefixes = /* @__PURE__ */ new Set();
   for (const account of accounts) {
-    const tokenKey = account.api_token_prefix ?? `account:${account.id}`;
-    if (processedTokenPrefixes.has(tokenKey)) {
-      log("api_sync_skipped_duplicate_token_prefix", { bank_account_id: account.id, account_type: account.account_type });
-      continue;
-    }
-    processedTokenPrefixes.add(tokenKey);
     try {
       const result = await runBankApiSync(env, account);
       log("api_sync_completed", {
@@ -3210,6 +3354,11 @@ async function dispatch(url2, req, env, authCtx, bodyText) {
     if (input.fio_api_token !== void 0 && (input.account_type ?? "FIO") !== "FIO") {
       return jsonResponse({ error: "fio_api_token_supported_only_for_fio" }, 400);
     }
+    const expanded = await env.DB.prepare("SELECT value FROM schema_meta WHERE key='version'").first();
+    if (input.ingest_enabled === false && expanded?.value !== "11") return jsonResponse({ error: "paused_ingest_requires_schema11" }, 409);
+    const capability = expanded?.value === "11" ? await env.DB.prepare("SELECT event_version FROM webhook_consumers WHERE app_id=?").bind(input.owner_app_id).first() : null;
+    if (capability?.event_version === "2" && (input.ingest_mode === "email" || input.ingest_mode === "both") && (env.AUTHENTICATED_EMAIL_SPOOL !== "on" || !env.BACKUPS)) return jsonResponse({ error: "durable_email_capability_not_configured" }, 503);
+    if (capability?.event_version === "2" && input.ingest_mode === "both") return jsonResponse({ error: "both_requires_verified_correlation" }, 409);
     const pairingCode = await generateUniquePairingCode(env.DB);
     const ingestMode = input.ingest_mode ?? (input.fio_api_token ? "api" : "email");
     const createEmailRoute = ingestMode === "email" || ingestMode === "both";
@@ -3233,6 +3382,11 @@ async function dispatch(url2, req, env, authCtx, bodyText) {
     } catch (err) {
       throw err;
     }
+    const schemaVersion = await env.DB.prepare("SELECT value FROM schema_meta WHERE key='version'").first();
+    if (input.ingest_enabled === false) {
+      if (schemaVersion?.value !== "11") throw new Error("paused_ingest_requires_schema11");
+      await env.DB.prepare("UPDATE bank_accounts SET ingest_enabled=0,api_fetch_enabled=0 WHERE id=?").bind(account.id).run();
+    }
     if (outboxId !== null) {
       const cfRuleId = await provisionRoute(env.DB, cfRoutingConfig(env), {
         outboxId,
@@ -3260,6 +3414,7 @@ async function dispatch(url2, req, env, authCtx, bodyText) {
     if (existing instanceof Response) return existing;
     const input = parseOr400(UpdateBankAccountSchema, bodyText);
     if (input instanceof Response) return input;
+    if (input.account_number !== void 0 && input.account_number !== existing.account_number && await env.DB.prepare("SELECT 1 FROM transactions WHERE bank_account_id=? LIMIT 1").bind(id).first()) return jsonResponse({ error: "account_identity_immutable" }, 409);
     const updated = await updateBankAccount(env.DB, id, input);
     if (!updated) return jsonResponse({ error: "not_found" }, 404);
     return jsonResponse(updated);
@@ -3289,6 +3444,25 @@ async function dispatch(url2, req, env, authCtx, bodyText) {
     if (!deleted) return jsonResponse({ error: "not_found" }, 404);
     return new Response(null, { status: 204 });
   }
+  const stateMatch = url2.pathname.match(/^\/bank-accounts\/(\d+)\/ingest-state$/);
+  if (stateMatch && (req.method === "GET" || req.method === "PUT")) {
+    const id = Number(stateMatch[1]);
+    const existing = await requireOwnedAccount(env, id, authCtx);
+    if (existing instanceof Response) return existing;
+    const schema = await env.DB.prepare("SELECT value FROM schema_meta WHERE key='version'").first();
+    if (schema?.value !== "11") return jsonResponse({ error: "schema11_required" }, 409);
+    if (req.method === "PUT") {
+      let input;
+      try {
+        input = JSON.parse(bodyText);
+      } catch {
+        return jsonResponse({ error: "invalid_json" }, 400);
+      }
+      if (typeof input.enabled !== "boolean") return jsonResponse({ error: "enabled_required" }, 400);
+      await env.DB.prepare("UPDATE bank_accounts SET ingest_enabled=? WHERE id=?").bind(input.enabled ? 1 : 0, id).run();
+    }
+    return jsonResponse(await env.DB.prepare("SELECT ingest_enabled,api_token_hash FROM bank_accounts WHERE id=?").bind(id).first());
+  }
   const fioTokenMatch = url2.pathname.match(/^\/bank-accounts\/(\d+)\/fio-token$/);
   if (fioTokenMatch && req.method === "PUT") {
     const id = Number(fioTokenMatch[1]);
@@ -3311,6 +3485,8 @@ async function dispatch(url2, req, env, authCtx, bodyText) {
         ingest_mode: input.ingest_mode ?? (existing.ingest_mode === "email" ? "api" : existing.ingest_mode)
       });
       if (!updated2) return jsonResponse({ error: "not_found" }, 404);
+      const schemaVersion = await env.DB.prepare("SELECT value FROM schema_meta WHERE key='version'").first();
+      if (schemaVersion?.value === "11") await env.DB.prepare("UPDATE bank_accounts SET api_token_hash=? WHERE id=?").bind(await sha256Hex2(rawToken), id).run();
       log("bank_account_api_token_updated", { bank_account_id: id, account_type: existing.account_type, api_token_prefix: updated2.api_token_prefix });
       return jsonResponse(updated2);
     }
@@ -3395,6 +3571,8 @@ async function dispatch(url2, req, env, authCtx, bodyText) {
     if (authCtx.type === "tenant") return forbidden();
     const input = parseOr400(CreateConsumerSchema, bodyText);
     if (input instanceof Response) return input;
+    const schemaVersion = await env.DB.prepare("SELECT value FROM schema_meta WHERE key='version'").first();
+    if (input.event_version === "2" && schemaVersion?.value !== "11") return jsonResponse({ error: "v2_requires_schema11" }, 409);
     let callbackUrl;
     try {
       callbackUrl = validateCallbackUrl(input.callback_url, { environment: env.ENV, allowlist: env.CALLBACK_HOST_ALLOWLIST });
@@ -3408,6 +3586,7 @@ async function dispatch(url2, req, env, authCtx, bodyText) {
     const secretCipher = await webhookEncrypt(plain, env.WEBHOOK_KEK);
     const consumer = await createConsumer(env.DB, {
       app_id: input.app_id,
+      event_version: input.event_version ?? "1",
       callback_url: callbackUrl,
       secret_cipher: secretCipher,
       secret_hash: secretHash,
@@ -3557,6 +3736,34 @@ async function dispatch(url2, req, env, authCtx, bodyText) {
     const next_cursor = entries.length === limit ? entries[entries.length - 1].id : null;
     return jsonResponse({ jobs: entries, next_cursor });
   }
+  const exportMatch = url2.pathname.match(/^\/bank-accounts\/(\d+)\/transaction-export$/);
+  if (exportMatch && req.method === "GET") {
+    const id = Number(exportMatch[1]);
+    const account = await requireOwnedAccount(env, id, authCtx);
+    if (account instanceof Response) return account;
+    const maximum = await env.DB.prepare("SELECT COALESCE(MAX(id),0) AS id FROM transactions WHERE bank_account_id=?").bind(id).first();
+    const high = Number(url2.searchParams.get("high_water") ?? maximum?.id ?? 0);
+    const cursor = Number(url2.searchParams.get("cursor") ?? 0);
+    const limit = Number(url2.searchParams.get("limit") ?? 200);
+    if (!Number.isSafeInteger(high) || high < 0 || !Number.isSafeInteger(cursor) || cursor < 0 || !Number.isSafeInteger(limit) || limit < 1 || limit > 200) return jsonResponse({ error: "invalid_cursor" }, 400);
+    const rows = await env.DB.prepare("SELECT * FROM transactions WHERE bank_account_id=? AND id>? AND id<=? ORDER BY id LIMIT ?").bind(id, cursor, high, limit).all();
+    return jsonResponse({ bank_account_id: id, high_water: high, cursor: rows.results.at(-1)?.id ?? cursor, complete: rows.results.length < limit, transactions: rows.results });
+  }
+  if (url2.pathname === "/admin/cutover-reconcile" && req.method === "POST") {
+    if (authCtx.type !== "admin") return forbidden();
+    let input;
+    try {
+      input = JSON.parse(bodyText);
+    } catch {
+      return jsonResponse({ error: "invalid_json" }, 400);
+    }
+    if (typeof input.manifest_sha256 !== "string" || !/^[0-9a-f]{64}$/.test(input.manifest_sha256) || typeof input.consumer_app_id !== "string" || ![input.account_id, input.from_id, input.through_id].every((n) => Number.isSafeInteger(n) && n > 0) || input.through_id < input.from_id) return jsonResponse({ error: "invalid_manifest_window" }, 400);
+    const account = await findBankAccountById(env.DB, input.account_id);
+    if (account?.owner_app_id !== input.consumer_app_id) return forbidden();
+    const created = await ensureDeliveryJobs(env.DB, void 0, { accountId: input.account_id, consumerAppId: input.consumer_app_id, fromId: input.from_id, throughId: input.through_id });
+    await writeEvent(env.DB, { event_type: "cutover_reconcile", bank_account_id: input.account_id, detail: { consumer: input.consumer_app_id, manifest_sha256: input.manifest_sha256, from_id: input.from_id, through_id: input.through_id, created } });
+    return jsonResponse({ created });
+  }
   if (url2.pathname === "/transactions" && req.method === "GET") {
     const since = url2.searchParams.get("since") ?? (/* @__PURE__ */ new Date(0)).toISOString();
     const limitStr = url2.searchParams.get("limit");
@@ -3672,6 +3879,7 @@ var cloudflare_default = {
     await assertSchemaVersion(env.DB);
     const runPolling = shouldRunApiPolling(event);
     const runMaintenance = shouldRunMaintenance(event);
+    const runReconciliation = runPolling && shouldRunReconciliation(event);
     if (runMaintenance) {
       try {
         const result = await pruneRetention(env.DB);
@@ -3696,6 +3904,39 @@ var cloudflare_default = {
       } catch (err) {
         logError("outbox_process_failed", err, {});
       }
+    }
+    if (runReconciliation) {
+      if (env.AUTHENTICATED_EMAIL_SPOOL === "on" && env.BACKUPS) {
+        const cursor = await env.DB.prepare("SELECT value FROM schema_meta WHERE key='email_spool_cursor'").first();
+        const page = await env.BACKUPS.list({ prefix: "authenticated-email-pending/", limit: 10, ...cursor?.value ? { cursor: cursor.value } : {} });
+        for (const object2 of page.objects) {
+          try {
+            const stored = await env.BACKUPS.get(object2.key);
+            if (!stored) continue;
+            const encrypted = JSON.parse(await stored.text());
+            const message = JSON.parse(await decryptSecret(encrypted.cipher, encrypted.keyVersion, env));
+            const bytes = Uint8Array.from(atob(message.bytesBase64), (c) => c.charCodeAt(0));
+            await processEmail(new Blob([bytes]).stream(), env, message.envelope);
+          } catch {
+            log("authenticated_email_recovery_pending", { spool_key: object2.key });
+          }
+        }
+        await env.DB.prepare("INSERT INTO schema_meta(key,value) VALUES('email_spool_cursor',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value").bind(page.truncated ? page.cursor : "").run();
+      }
+      const schema = await env.DB.prepare("SELECT value FROM schema_meta WHERE key='version'").first();
+      if (schema?.value === "11") {
+        const pending = await env.DB.prepare("SELECT id,cipher,key_version FROM authenticated_email_spool WHERE state='pending' ORDER BY attempts,created_at LIMIT 10").all();
+        for (const row of pending.results) {
+          try {
+            await env.DB.prepare("UPDATE authenticated_email_spool SET attempts=attempts+1 WHERE id=?").bind(row.id).run();
+            const message = JSON.parse(await decryptSecret(row.cipher, row.key_version, env));
+            const restored = Uint8Array.from(atob(message.bytesBase64), (c) => c.charCodeAt(0));
+            await processEmail(new Blob([restored]).stream(), env, message.envelope);
+          } catch {
+            log("email_recovery_pending", { spool_id: row.id });
+          }
+        }
+      }
       try {
         const swept = await createWebhookDeliveryCoordinator(env).sweep();
         if (swept.created > 0 || swept.considered > 0) {
@@ -3723,7 +3964,7 @@ var cloudflare_default = {
         logError("api_sync_tick_failed", err, {});
       }
     }
-    if (runPolling && env.ALERT_WEBHOOK_URL) {
+    if (runReconciliation && env.ALERT_WEBHOOK_URL) {
       try {
         const alert = await runAlerterTick(env.DB, {
           webhookUrl: env.ALERT_WEBHOOK_URL,
@@ -3736,7 +3977,7 @@ var cloudflare_default = {
         logError("alerter_tick_failed", err, {});
       }
     }
-    if (runPolling && env.ALERT_WEBHOOK_URL) {
+    if (runReconciliation && env.ALERT_WEBHOOK_URL) {
       try {
         const service = env.BANKSYNC_DOMAIN ?? "banksync";
         await detectStalledIncidents(env.DB, service);