@festapp/banksync 0.1.6 → 0.2.1

package/dist/cloudflare.cjs

@@ -1,4 +1,4 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } async function _asyncNullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return await rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
 
 
@@ -9,7 +9,8 @@
 
 
 
-var _chunkPBN2BUNRcjs = require('./chunk-PBN2BUNR.cjs');
+
+var _chunkN7BVOSFNcjs = require('./chunk-N7BVOSFN.cjs');
 
 // src/mime.ts
 var _postalmime = require('postal-mime'); var _postalmime2 = _interopRequireDefault(_postalmime);
@@ -66,13 +67,13 @@ function classifyEmail(extracted, identity, account, allowlist) {
   if (account.ingest_mode === "api") {
     return { kind: "reject", reason: "email_ingest_disabled", bankAccountId: account.id, received: false };
   }
-  const provider = _chunkPBN2BUNRcjs.detectProvider.call(void 0, extracted.text, account.account_number);
+  const provider = _chunkN7BVOSFNcjs.detectProvider.call(void 0, extracted.text, account.account_number);
   if (provider === "unknown") {
     return { kind: "reject", reason: `unknown_provider: ${account.account_number}`, bankAccountId: account.id, received: true };
   }
   let parsed;
   try {
-    parsed = _chunkPBN2BUNRcjs.parseEmail.call(void 0, extracted.text, provider);
+    parsed = _chunkN7BVOSFNcjs.parseEmail.call(void 0, extracted.text, provider);
   } catch (err) {
     return { kind: "reject", reason: `${err}`.replace(/^Error:\s*/, ""), bankAccountId: account.id, received: true };
   }
@@ -313,7 +314,7 @@ function logError(event, err, data) {
 }
 
 // src/db.ts
-var SUPPORTED_SCHEMA_VERSIONS = ["10"];
+var SUPPORTED_SCHEMA_VERSIONS = ["10", "11"];
 var _checkedDbs = /* @__PURE__ */ new Set();
 async function assertSchemaVersion(db) {
   if (_checkedDbs.has(db)) return;
@@ -542,6 +543,7 @@ var SQL_CREATE_CONSUMER = `INSERT INTO webhook_consumers (app_id, callback_url,
 async function createConsumer(db, args) {
   const row = await db.prepare(SQL_CREATE_CONSUMER).bind(args.app_id, args.callback_url, args.secret_cipher, args.secret_hash, args.secret_prefix).first();
   if (!row) throw new Error("createConsumer: no row returned");
+  if (args.event_version === "2") await db.prepare("UPDATE webhook_consumers SET event_version='2' WHERE id=?").bind(row.id).run();
   return row;
 }
 var SQL_FIND_CONSUMER_BY_APP_ID = `SELECT id, app_id, callback_url, secret_cipher, secret_hash, secret_prefix, prev_secret_cipher, prev_expires_at, admin_key_hash, admin_key_prefix, created_at FROM webhook_consumers WHERE app_id = ?`;
@@ -601,45 +603,30 @@ INSERT OR IGNORE INTO transactions (
 ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 `;
 var SQL_SELECT_TRANSACTION_BY_ID = `SELECT id, bank_account_id, amount_cents, currency, counter_account, bank_code, bank_name, vs, ks, ss, message, sender_name, user_identification, transaction_type, performed_by, comment, command_id, source, date, date_offset_min, transaction_id, external_id FROM transactions WHERE id = ?`;
-var SQL_FIND_DUPLICATE_EXT = `SELECT id FROM transactions WHERE external_id = ? AND external_id IS NOT NULL LIMIT 1`;
-var SQL_FIND_DUPLICATE_FIO = `SELECT id FROM transactions WHERE bank_account_id = ? AND transaction_id = ? AND transaction_id IS NOT NULL LIMIT 1`;
-var SQL_FIND_DUPLICATE_FUZZY = `
-SELECT id
-FROM transactions
-WHERE bank_account_id = ?
-  AND vs = ?
-  AND amount_cents = ?
-  AND currency = ?
-  AND substr(date, 1, 10) BETWEEN date(?, '-3 days') AND date(?, '+3 days')
-LIMIT 1
-`;
-function fuzzyDateDay(date) {
-  return /^\d{4}-\d{2}-\d{2}/.test(date) ? date.slice(0, 10) : null;
-}
-async function findFuzzyDuplicate(db, bankAccountId, p) {
-  if (!p.vs) return false;
-  const dateDay = fuzzyDateDay(p.date);
-  if (!dateDay) return false;
-  const hit = await db.prepare(SQL_FIND_DUPLICATE_FUZZY).bind(bankAccountId, p.vs, p.amount_cents, p.currency, dateDay, dateDay).first();
-  return hit !== null;
-}
+var SQL_FIND_DUPLICATE_EXT = `SELECT id FROM transactions WHERE bank_account_id = ? AND external_id = ? AND external_id IS NOT NULL LIMIT 1`;
+var SQL_FIND_DUPLICATE_FIO = `SELECT * FROM transactions WHERE bank_account_id = ? AND transaction_id = ? AND transaction_id IS NOT NULL AND source='fio_api' LIMIT 1`;
 async function insertTransaction(db, args) {
+  const schema = await db.prepare(`SELECT value FROM schema_meta WHERE key='version'`).first();
+  const v2 = _optionalChain([schema, 'optionalAccess', _16 => _16.value]) === "11";
   const p = {
     ...args.payload,
-    vs: _chunkPBN2BUNRcjs.resolveVariableSymbol.call(void 0, args.payload)
+    vs: v2 ? _nullishCoalesce(_nullishCoalesce(args.payload.raw_vs, () => ( args.payload.vs)), () => ( null)) : _chunkN7BVOSFNcjs.resolveVariableSymbol.call(void 0, args.payload)
   };
-  if (p.transaction_id != null) {
+  if (p.transaction_id != null && p.source === "fio_api") {
     const hit = await db.prepare(SQL_FIND_DUPLICATE_FIO).bind(args.bank_account_id, p.transaction_id).first();
-    if (hit) return { status: "skipped", reason: "duplicate_transaction_id" };
+    if (hit) {
+      const facts = hit;
+      if (facts.amount_cents !== p.amount_cents || facts.currency !== p.currency || facts.date.slice(0, 10) !== p.date.slice(0, 10) || facts.identity_kind === "movement" && (facts.raw_vs !== (_nullishCoalesce(_nullishCoalesce(p.raw_vs, () => ( args.payload.vs)), () => ( null))) || facts.payer_reference !== (_nullishCoalesce(p.payer_reference, () => ( null))))) throw new Error("bank_movement_fact_conflict");
+      return { status: "skipped", reason: "duplicate_transaction_id" };
+    }
   }
   if (p.external_id != null) {
-    const hit = await db.prepare(SQL_FIND_DUPLICATE_EXT).bind(p.external_id).first();
+    const hit = await db.prepare(SQL_FIND_DUPLICATE_EXT).bind(args.bank_account_id, p.external_id).first();
     if (hit) return { status: "skipped", reason: "duplicate_external_id" };
   }
-  if (await findFuzzyDuplicate(db, args.bank_account_id, p)) {
-    return { status: "skipped", reason: "fuzzy_duplicate" };
-  }
-  const result = await db.prepare(SQL_INSERT_TRANSACTION).bind(
+  if (p.amount_cents <= 0 && !v2) throw new Error("signed_facts_require_schema11");
+  const sql = v2 ? SQL_INSERT_TRANSACTION.replace("external_id\n)", "external_id, payer_reference, raw_vs, direction, identity_kind, identity_provenance\n)").replace("?)\n", "?, ?, ?, ?, ?, ?)\n") : SQL_INSERT_TRANSACTION;
+  const values = [
     args.bank_account_id,
     p.amount_cents,
     p.currency,
@@ -661,23 +648,32 @@ async function insertTransaction(db, args) {
     _nullishCoalesce(p.date_offset_min, () => ( null)),
     _nullishCoalesce(p.transaction_id, () => ( null)),
     _nullishCoalesce(p.external_id, () => ( null))
-  ).run();
+  ];
+  if (v2) values.push(
+    _nullishCoalesce(p.payer_reference, () => ( null)),
+    _nullishCoalesce(_nullishCoalesce(args.payload.raw_vs, () => ( args.payload.vs)), () => ( null)),
+    p.amount_cents > 0 ? "incoming" : p.amount_cents < 0 ? "outgoing" : "zero",
+    _nullishCoalesce(p.identity_kind, () => ( (p.source === "fio_api" && p.transaction_id ? "movement" : "observation"))),
+    _nullishCoalesce(p.identity_provenance, () => ( (p.source === "fio_api" ? "fio_api_column22" : "authenticated_email_unverified_movement")))
+  );
+  const result = await db.prepare(sql).bind(...values).run();
   if (result.meta.changes === 0) {
-    if (p.transaction_id != null) {
+    if (p.transaction_id != null && p.source === "fio_api") {
       const hit = await db.prepare(SQL_FIND_DUPLICATE_FIO).bind(args.bank_account_id, p.transaction_id).first();
-      if (hit) return { status: "skipped", reason: "duplicate_transaction_id" };
+      if (hit) {
+        const facts = hit;
+        if (facts.amount_cents !== p.amount_cents || facts.currency !== p.currency || facts.date.slice(0, 10) !== p.date.slice(0, 10) || facts.identity_kind === "movement" && (facts.raw_vs !== (_nullishCoalesce(_nullishCoalesce(p.raw_vs, () => ( args.payload.vs)), () => ( null))) || facts.payer_reference !== (_nullishCoalesce(p.payer_reference, () => ( null))))) throw new Error("bank_movement_fact_conflict");
+        return { status: "skipped", reason: "duplicate_transaction_id" };
+      }
     }
     if (p.external_id != null) {
-      const hit = await db.prepare(SQL_FIND_DUPLICATE_EXT).bind(p.external_id).first();
+      const hit = await db.prepare(SQL_FIND_DUPLICATE_EXT).bind(args.bank_account_id, p.external_id).first();
       if (hit) return { status: "skipped", reason: "duplicate_external_id" };
     }
-    if (await findFuzzyDuplicate(db, args.bank_account_id, p)) {
-      return { status: "skipped", reason: "fuzzy_duplicate" };
-    }
-    return { status: "skipped", reason: "fuzzy_duplicate" };
+    throw new Error("transaction_insert_constraint_conflict");
   }
   const rowId = result.meta.last_row_id;
-  const row = await db.prepare(SQL_SELECT_TRANSACTION_BY_ID).bind(rowId).first();
+  const row = await db.prepare(v2 ? "SELECT * FROM transactions WHERE id = ?" : SQL_SELECT_TRANSACTION_BY_ID).bind(rowId).first();
   if (!row) throw new Error("insertTransaction: row vanished after insert");
   return { status: "inserted", transaction: row };
 }
@@ -725,11 +721,11 @@ var SQL_LIST_SUBSCRIPTIONS_ALL = `SELECT id, bank_account_id, consumer_app_id, c
 var SQL_LIST_SUBSCRIPTIONS_BY_APP = `SELECT id, bank_account_id, consumer_app_id, created_at FROM webhook_subscriptions WHERE consumer_app_id = ? ORDER BY id`;
 var SQL_LIST_SUBSCRIPTIONS_BY_ACCOUNT = `SELECT id, bank_account_id, consumer_app_id, created_at FROM webhook_subscriptions WHERE bank_account_id = ? ORDER BY id`;
 async function listSubscriptions(db, filters) {
-  if (_optionalChain([filters, 'optionalAccess', _16 => _16.app_id])) {
+  if (_optionalChain([filters, 'optionalAccess', _17 => _17.app_id])) {
     const r2 = await db.prepare(SQL_LIST_SUBSCRIPTIONS_BY_APP).bind(filters.app_id).all();
     return r2.results;
   }
-  if (_optionalChain([filters, 'optionalAccess', _17 => _17.bank_account_id]) != null) {
+  if (_optionalChain([filters, 'optionalAccess', _18 => _18.bank_account_id]) != null) {
     const r2 = await db.prepare(SQL_LIST_SUBSCRIPTIONS_BY_ACCOUNT).bind(filters.bank_account_id).all();
     return r2.results;
   }
@@ -830,8 +826,8 @@ async function getStatusData(db) {
     db.prepare(SQL_PER_CONSUMER_ERRORS_24H).all(),
     db.prepare(SQL_PER_CONSUMER_DELIVERED).all()
   ]);
-  const failuresCount = _nullishCoalesce(_optionalChain([failures, 'optionalAccess', _18 => _18.cnt]), () => ( 0));
-  const insertedCount = _nullishCoalesce(_optionalChain([txInserted24h, 'optionalAccess', _19 => _19.cnt]), () => ( 0));
+  const failuresCount = _nullishCoalesce(_optionalChain([failures, 'optionalAccess', _19 => _19.cnt]), () => ( 0));
+  const insertedCount = _nullishCoalesce(_optionalChain([txInserted24h, 'optionalAccess', _20 => _20.cnt]), () => ( 0));
   const total24h = failuresCount + insertedCount;
   const tx7dMap = new Map(txPer7d.results.map((r) => [r.bank_account_id, r.cnt]));
   const parseErrMap = new Map(parseErrPerAcct.results.map((r) => [r.bank_account_id, r.cnt]));
@@ -844,11 +840,11 @@ async function getStatusData(db) {
     service: {
       parse_failures_24h: failuresCount,
       parse_failure_rate_24h: total24h > 0 ? Math.round(failuresCount / total24h * 1e4) / 1e4 : 0,
-      unknown_currency_24h: _nullishCoalesce(_optionalChain([unknownCurr, 'optionalAccess', _20 => _20.cnt]), () => ( 0)),
-      outgoing_filtered_24h: _nullishCoalesce(_optionalChain([outgoing, 'optionalAccess', _21 => _21.cnt]), () => ( 0)),
-      unknown_provider_24h: _nullishCoalesce(_optionalChain([unknownProv, 'optionalAccess', _22 => _22.cnt]), () => ( 0)),
-      unmatched_24h: _nullishCoalesce(_optionalChain([unmatched, 'optionalAccess', _23 => _23.cnt]), () => ( 0)),
-      not_transaction_24h: _nullishCoalesce(_optionalChain([notTransaction, 'optionalAccess', _24 => _24.cnt]), () => ( 0))
+      unknown_currency_24h: _nullishCoalesce(_optionalChain([unknownCurr, 'optionalAccess', _21 => _21.cnt]), () => ( 0)),
+      outgoing_filtered_24h: _nullishCoalesce(_optionalChain([outgoing, 'optionalAccess', _22 => _22.cnt]), () => ( 0)),
+      unknown_provider_24h: _nullishCoalesce(_optionalChain([unknownProv, 'optionalAccess', _23 => _23.cnt]), () => ( 0)),
+      unmatched_24h: _nullishCoalesce(_optionalChain([unmatched, 'optionalAccess', _24 => _24.cnt]), () => ( 0)),
+      not_transaction_24h: _nullishCoalesce(_optionalChain([notTransaction, 'optionalAccess', _25 => _25.cnt]), () => ( 0))
     },
     bank_accounts: accountRows.results.map((a) => ({
       id: a.id,
@@ -868,20 +864,26 @@ async function getStatusData(db) {
     queues: {
       main_pending: 0,
       // Cloudflare Analytics binding not available in basic setup
-      delivery_active: _nullishCoalesce(_optionalChain([deliveryActive, 'optionalAccess', _25 => _25.cnt]), () => ( 0)),
-      delivery_stalled: _nullishCoalesce(_optionalChain([deliveryStalled, 'optionalAccess', _26 => _26.cnt]), () => ( 0)),
-      delivery_terminal: _nullishCoalesce(_optionalChain([deliveryTerminal, 'optionalAccess', _27 => _27.cnt]), () => ( 0)),
-      oldest_undelivered_at: _nullishCoalesce(_optionalChain([oldestUndelivered, 'optionalAccess', _28 => _28.ts]), () => ( null)),
-      pending_delivery_alerts: _nullishCoalesce(_optionalChain([pendingAlerts, 'optionalAccess', _29 => _29.cnt]), () => ( 0)),
-      api_rate_limited_24h: _nullishCoalesce(_optionalChain([apiRateLimited, 'optionalAccess', _30 => _30.cnt]), () => ( 0))
+      delivery_active: _nullishCoalesce(_optionalChain([deliveryActive, 'optionalAccess', _26 => _26.cnt]), () => ( 0)),
+      delivery_stalled: _nullishCoalesce(_optionalChain([deliveryStalled, 'optionalAccess', _27 => _27.cnt]), () => ( 0)),
+      delivery_terminal: _nullishCoalesce(_optionalChain([deliveryTerminal, 'optionalAccess', _28 => _28.cnt]), () => ( 0)),
+      oldest_undelivered_at: _nullishCoalesce(_optionalChain([oldestUndelivered, 'optionalAccess', _29 => _29.ts]), () => ( null)),
+      pending_delivery_alerts: _nullishCoalesce(_optionalChain([pendingAlerts, 'optionalAccess', _30 => _30.cnt]), () => ( 0)),
+      api_rate_limited_24h: _nullishCoalesce(_optionalChain([apiRateLimited, 'optionalAccess', _31 => _31.cnt]), () => ( 0))
     }
   };
 }
 var SQL_PRUNE_PARSE_LOG = `DELETE FROM parse_log WHERE created_at < datetime('now', '-30 days')`;
 var SQL_PRUNE_WEBHOOK_LOG = `DELETE FROM webhook_log WHERE created_at < datetime('now', '-90 days')`;
 var SQL_PRUNE_EVENT_LOG = `DELETE FROM event_log WHERE created_at < datetime('now', '-30 days')`;
-var SQL_PRUNE_TRANSACTIONS = `DELETE FROM transactions WHERE created_at < datetime('now', '-90 days')`;
-var SQL_PRUNE_IDEMPOTENCY_KEYS = `DELETE FROM idempotency_keys WHERE created_at < datetime('now', '-24 hours')`;
+var SQL_PRUNE_TRANSACTIONS = `DELETE FROM transactions WHERE created_at < datetime('now', '-90 days')
+  AND NOT EXISTS (SELECT 1 FROM webhook_delivery_jobs j WHERE j.transaction_id=transactions.id
+    AND (j.status<>'delivered' OR j.business_outcome LIKE 'quarantined_%'))
+  AND NOT EXISTS (SELECT 1 FROM webhook_subscriptions s WHERE s.bank_account_id=transactions.bank_account_id
+    AND datetime(s.created_at)<=datetime(transactions.created_at)
+    AND (s.deleted_at IS NULL OR datetime(transactions.created_at)<datetime(s.deleted_at))
+    AND NOT EXISTS (SELECT 1 FROM webhook_delivery_jobs j WHERE j.transaction_id=transactions.id AND j.consumer_app_id=s.consumer_app_id))`;
+var SQL_PRUNE_IDEMPOTENCY_KEYS = `DELETE FROM idempotency_keys WHERE request_path <> '/bank-accounts' AND created_at < datetime('now', '-24 hours')`;
 var SQL_PRUNE_ADMIN_AUDIT_LOG = `DELETE FROM admin_audit_log WHERE created_at < datetime('now', '-90 days')`;
 var SQL_CLEAR_EXPIRED_PREV_SECRETS = `UPDATE webhook_consumers SET prev_secret_cipher = NULL, prev_expires_at = NULL WHERE prev_expires_at < datetime('now')`;
 async function pruneRetention(db) {
@@ -918,13 +920,14 @@ function parseBody(schema, body) {
     return v.parse(schema, body);
   } catch (err) {
     if (err instanceof v.ValiError) {
-      const message = `validation_failed: ${_nullishCoalesce(_optionalChain([err, 'access', _31 => _31.issues, 'access', _32 => _32[0], 'optionalAccess', _33 => _33.message]), () => ( "unknown"))}`;
+      const message = `validation_failed: ${_nullishCoalesce(_optionalChain([err, 'access', _32 => _32.issues, 'access', _33 => _33[0], 'optionalAccess', _34 => _34.message]), () => ( "unknown"))}`;
       throw new ValidationError(err.issues, message);
     }
     throw err;
   }
 }
 var CreateBankAccountSchema = v.object({
+  ingest_enabled: v.optional(v.boolean()),
   account_number: v.pipe(v.string(), v.minLength(3), v.maxLength(64)),
   account_type: v.optional(v.picklist(["FIO", "AIRBANK"])),
   ingest_mode: v.optional(v.picklist(["email", "api", "both"])),
@@ -960,6 +963,7 @@ var UpdateFioTokenSchema = v.pipe(
   )
 );
 var CreateConsumerSchema = v.object({
+  event_version: v.optional(v.picklist(["1", "2"])),
   app_id: v.pipe(v.string(), v.regex(/^[a-z0-9][a-z0-9-_]{1,63}$/)),
   callback_url: v.pipe(v.string(), v.url(), v.regex(/^https:\/\//))
 });
@@ -1197,13 +1201,18 @@ async function sha256Hex(input) {
 function newDispatchToken() {
   return crypto.randomUUID();
 }
-async function ensureDeliveryJobs(db, transactionId) {
+async function ensureDeliveryJobs(db, transactionId, cutover) {
+  const schema = await db.prepare("SELECT value FROM schema_meta WHERE key='version'").first();
+  const expanded = _optionalChain([schema, 'optionalAccess', _35 => _35.value]) === "11";
+  if (cutover && !expanded) throw new Error("cutover_requires_schema11");
   const candidates = await db.prepare(`
-    SELECT t.*, b.pairing_code, s.consumer_app_id
+    SELECT t.*, b.pairing_code, s.consumer_app_id${expanded ? ", c.event_version" : ""}
     FROM transactions t
     JOIN bank_accounts b ON b.id = t.bank_account_id
     JOIN webhook_subscriptions s ON s.bank_account_id = t.bank_account_id
+    ${expanded ? "JOIN webhook_consumers c ON c.app_id = s.consumer_app_id" : ""}
     WHERE (? IS NULL OR t.id = ?)
+      AND ${expanded ? "(c.event_version='2' OR t.amount_cents > 0)" : "t.amount_cents > 0"}
       AND NOT EXISTS (
         SELECT 1 FROM webhook_delivery_jobs j
         WHERE j.transaction_id = t.id AND j.consumer_app_id = s.consumer_app_id
@@ -1212,16 +1221,17 @@ async function ensureDeliveryJobs(db, transactionId) {
       -- Intent is decided by the subscription interval at ingest, not by the
       -- current active-subscription view. Exact UTC datetime (not julianday) so
       -- a same-second create/delete/transaction is deterministic.
-      AND datetime(s.created_at) <= datetime(t.created_at)
-      AND (s.deleted_at IS NULL OR datetime(t.created_at) < datetime(s.deleted_at))
-  `).bind(_nullishCoalesce(transactionId, () => ( null)), _nullishCoalesce(transactionId, () => ( null))).all();
+      ${cutover ? "AND t.bank_account_id=? AND s.consumer_app_id=? AND t.id>=? AND t.id<=? AND s.deleted_at IS NULL AND c.event_version='2'" : "AND datetime(s.created_at) <= datetime(t.created_at) AND (s.deleted_at IS NULL OR datetime(t.created_at) < datetime(s.deleted_at))"}
+  `).bind(_nullishCoalesce(transactionId, () => ( null)), _nullishCoalesce(transactionId, () => ( null)), ...cutover ? [cutover.accountId, cutover.consumerAppId, cutover.fromId, cutover.throughId] : []).all();
   let created = 0;
   for (const row of candidates.results) {
+    const { pairing_code, consumer_app_id, event_version, created_at: _createdAt, ...transaction } = row;
     const deliveryId = _ulid.ulid.call(void 0, );
-    const envelope = _chunkPBN2BUNRcjs.buildWebhookEnvelope.call(void 0, {
+    const envelope = _chunkN7BVOSFNcjs.buildWebhookEnvelope.call(void 0, {
       delivery_id: deliveryId,
       pairing_code: row.pairing_code,
-      transaction: row
+      transaction,
+      event_version: _nullishCoalesce(row.event_version, () => ( "1"))
     });
     const payload = JSON.stringify(envelope);
     const result = await db.prepare(`
@@ -1348,8 +1358,8 @@ async function recordDeliveryOutcome(db, args) {
       WHERE id = ? AND generation = ? AND status <> 'delivered'
     `).bind(
       httpStatus,
-      _nullishCoalesce(_optionalChain([args, 'access', _34 => _34.receipt, 'optionalAccess', _35 => _35.outcome]), () => ( null)),
-      _nullishCoalesce(_optionalChain([args, 'access', _36 => _36.receipt, 'optionalAccess', _37 => _37.receipt_version]), () => ( null)),
+      _nullishCoalesce(_optionalChain([args, 'access', _36 => _36.receipt, 'optionalAccess', _37 => _37.outcome]), () => ( null)),
+      _nullishCoalesce(_optionalChain([args, 'access', _38 => _38.receipt, 'optionalAccess', _39 => _39.receipt_version]), () => ( null)),
       args.receipt ? JSON.stringify(args.receipt) : null,
       deliveryJobId,
       generation
@@ -1539,7 +1549,7 @@ async function httpResult(response, deliveryId, usedPrevSecret, primaryStatus) {
   return "receipt" in parsed ? { kind: "http", httpStatus: response.status, usedPrevSecret, primaryStatus, receipt: parsed.receipt } : { kind: "http", httpStatus: response.status, usedPrevSecret, primaryStatus, receiptError: parsed.error };
 }
 async function postSigned(url2, envelope, secret) {
-  const signed = await _chunkPBN2BUNRcjs.signWebhook.call(void 0, { envelope, secret });
+  const signed = await _chunkN7BVOSFNcjs.signWebhook.call(void 0, { envelope, secret });
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
   try {
@@ -1694,7 +1704,7 @@ function createWebhookDeliveryCoordinator(env, deps = {}) {
     },
     async sweep(options) {
       const created = await ensureDeliveryJobs(db);
-      const dispatch2 = await dispatchDueDeliveryJobs(env, _nullishCoalesce(_optionalChain([options, 'optionalAccess', _38 => _38.limit]), () => ( 50)));
+      const dispatch2 = await dispatchDueDeliveryJobs(env, _nullishCoalesce(_optionalChain([options, 'optionalAccess', _40 => _40.limit]), () => ( 50)));
       return { created, ...dispatch2 };
     },
     handleAttempt(message, ctx) {
@@ -1785,7 +1795,7 @@ async function createRule(cfg, pairingCode) {
     body: JSON.stringify(body)
   });
   const json = await res.json();
-  if (!res.ok || !json.success || !_optionalChain([json, 'access', _39 => _39.result, 'optionalAccess', _40 => _40.id])) {
+  if (!res.ok || !json.success || !_optionalChain([json, 'access', _41 => _41.result, 'optionalAccess', _42 => _42.id])) {
     const errs = _nullishCoalesce(json.errors, () => ( []));
     throw new CfRoutingError(
       res.status,
@@ -1893,7 +1903,7 @@ async function markCompleted(db, outboxId, cfRuleIdForCreate) {
   ).bind(_nullishCoalesce(cfRuleIdForCreate, () => ( null)), outboxId);
   if (cfRuleIdForCreate) {
     const row = await db.prepare(`SELECT bank_account_id FROM cf_routing_outbox WHERE id = ?`).bind(outboxId).first();
-    const bankAccountId = _nullishCoalesce(_optionalChain([row, 'optionalAccess', _41 => _41.bank_account_id]), () => ( null));
+    const bankAccountId = _nullishCoalesce(_optionalChain([row, 'optionalAccess', _43 => _43.bank_account_id]), () => ( null));
     if (bankAccountId !== null) {
       const bankUpdate = db.prepare(
         `UPDATE bank_accounts SET cf_rule_id = ? WHERE id = ?`
@@ -1906,7 +1916,7 @@ async function markCompleted(db, outboxId, cfRuleIdForCreate) {
 }
 async function markFailureAttempt(db, outboxId, error) {
   const row = await db.prepare(`SELECT attempts FROM cf_routing_outbox WHERE id = ?`).bind(outboxId).first();
-  const currentAttempts = _nullishCoalesce(_optionalChain([row, 'optionalAccess', _42 => _42.attempts]), () => ( 0));
+  const currentAttempts = _nullishCoalesce(_optionalChain([row, 'optionalAccess', _44 => _44.attempts]), () => ( 0));
   const newAttempts = currentAttempts + 1;
   const nextAt = nextAttemptAt(newAttempts);
   const newStatus = newAttempts >= MAX_ATTEMPTS ? "failed" : "pending";
@@ -2204,7 +2214,7 @@ async function checkAndIncrement(db, principal, cfg = DEFAULT_RATE_LIMIT) {
       ON CONFLICT(principal, window_start) DO UPDATE SET count = count + 1
     `).bind(principal, currentBucket).run();
   const sumRow = await db.prepare(`SELECT COALESCE(SUM(count), 0) as total FROM rate_limit_buckets WHERE principal = ? AND window_start >= ?`).bind(principal, windowStartBucket).first();
-  const currentCount = _nullishCoalesce(_optionalChain([sumRow, 'optionalAccess', _43 => _43.total]), () => ( 0));
+  const currentCount = _nullishCoalesce(_optionalChain([sumRow, 'optionalAccess', _45 => _45.total]), () => ( 0));
   if (currentCount > cfg.limit) {
     log("rate_limit_denied", { principal, count: currentCount, limit: cfg.limit });
     return {
@@ -2257,7 +2267,7 @@ async function probeDbWrite(db) {
   let rowId = null;
   try {
     const inserted = await db.prepare(`INSERT INTO event_log (event_type) VALUES ('health_probe') RETURNING id`).first();
-    rowId = _nullishCoalesce(_optionalChain([inserted, 'optionalAccess', _44 => _44.id]), () => ( null));
+    rowId = _nullishCoalesce(_optionalChain([inserted, 'optionalAccess', _46 => _46.id]), () => ( null));
     const ms = Date.now() - t0;
     const status = ms < 500 ? "green" : ms < 2e3 ? "yellow" : "red";
     return { status, latency_ms: ms };
@@ -2299,8 +2309,8 @@ async function probeOutboxDrift(db) {
       db.prepare(`SELECT COUNT(*) as cnt FROM cf_routing_outbox WHERE status = 'pending'`).first(),
       db.prepare(`SELECT COUNT(*) as cnt FROM cf_routing_outbox WHERE status = 'failed'`).first()
     ]);
-    const pending = _nullishCoalesce(_optionalChain([pendingRow, 'optionalAccess', _45 => _45.cnt]), () => ( 0));
-    const failed = _nullishCoalesce(_optionalChain([failedRow, 'optionalAccess', _46 => _46.cnt]), () => ( 0));
+    const pending = _nullishCoalesce(_optionalChain([pendingRow, 'optionalAccess', _47 => _47.cnt]), () => ( 0));
+    const failed = _nullishCoalesce(_optionalChain([failedRow, 'optionalAccess', _48 => _48.cnt]), () => ( 0));
     let status = "green";
     if (failed > 0) status = "red";
     else if (pending > 0) status = "yellow";
@@ -2354,7 +2364,7 @@ async function fetchAllCfRules(cfg) {
     const json = await res.json();
     if (!json.success || !json.result) throw new Error("CF rules list: success=false");
     rules.push(...json.result);
-    const cursor = _optionalChain([json, 'access', _47 => _47.result_info, 'optionalAccess', _48 => _48.cursor]);
+    const cursor = _optionalChain([json, 'access', _49 => _49.result_info, 'optionalAccess', _50 => _50.cursor]);
     url2 = cursor ? `${CF_API2}/zones/${cfg.zoneId}/email/routing/rules?per_page=1000&cursor=${encodeURIComponent(cursor)}` : null;
   }
   return rules;
@@ -2383,7 +2393,7 @@ async function auditCfRoutingDrift(args) {
   );
   const banksyncPattern = new RegExp(`^[0-9a-f]{4,32}@${escapeRegExp(cf.domain)}$`);
   const cf_rules_orphaned = cfRules.filter((r) => {
-    const firstMatcher = _optionalChain([r, 'access', _49 => _49.matchers, 'optionalAccess', _50 => _50[0]]);
+    const firstMatcher = _optionalChain([r, 'access', _51 => _51.matchers, 'optionalAccess', _52 => _52[0]]);
     if (!firstMatcher) return false;
     if (firstMatcher.type !== "literal") return false;
     const val = _nullishCoalesce(firstMatcher.value, () => ( ""));
@@ -2519,7 +2529,7 @@ async function runAlerterTick(db, cfg) {
   }
   const prior = await db.prepare(`SELECT value, updated_at FROM alert_state WHERE key = 'alerter_active'`).first();
   const repeatAfterMs = 30 * 60 * 1e3;
-  if (_optionalChain([prior, 'optionalAccess', _51 => _51.value]) === "active" && Date.now() - new Date(prior.updated_at).getTime() < repeatAfterMs) {
+  if (_optionalChain([prior, 'optionalAccess', _53 => _53.value]) === "active" && Date.now() - new Date(prior.updated_at).getTime() < repeatAfterMs) {
     return { fired: false };
   }
   const posted = await postAlert(payload, cfg);
@@ -2605,7 +2615,7 @@ async function buildSqlDump(db) {
   const lines = [];
   lines.push(`-- banksync backup ${(/* @__PURE__ */ new Date()).toISOString()}`);
   const versionRow = await db.prepare(`SELECT value FROM schema_meta WHERE key = 'version'`).first();
-  lines.push(`-- schema_version=${_nullishCoalesce(_optionalChain([versionRow, 'optionalAccess', _52 => _52.value]), () => ( "unknown"))}`);
+  lines.push(`-- schema_version=${_nullishCoalesce(_optionalChain([versionRow, 'optionalAccess', _54 => _54.value]), () => ( "unknown"))}`);
   lines.push(`-- restore: re-apply migrations then load this file`);
   lines.push("");
   const rowCounts = {};
@@ -2659,10 +2669,79 @@ async function runBackupTick(db, cfg) {
   };
 }
 
+// src/bankRecovery.ts
+async function recoverBankAccount(db, account, env, proxy) {
+  const enabled = await db.prepare("SELECT ingest_enabled FROM bank_accounts WHERE id=?").bind(account.id).first();
+  if (_optionalChain([enabled, 'optionalAccess', _55 => _55.ingest_enabled]) === 0) throw new Error("bank_connection_paused");
+  const credential = await decryptSecret(account.api_token_cipher, account.api_token_key_ver, env);
+  const keys = [await sha256Hex2(`fio-account:${account.account_number.replace(/\s/g, "").toUpperCase()}`), await sha256Hex2(`fio-token:${credential}`)].sort();
+  const fence = crypto.randomUUID();
+  const held = [];
+  try {
+    for (const key of keys) {
+      const claim = await db.prepare(`INSERT INTO bank_poll_leases (credential_hash,token,lease_until,next_allowed_at)
+        VALUES (?,?,datetime('now','+120 seconds'),datetime('now','+30 seconds'))
+        ON CONFLICT(credential_hash) DO UPDATE SET token=excluded.token, lease_until=excluded.lease_until,
+        next_allowed_at=excluded.next_allowed_at
+        WHERE datetime(bank_poll_leases.lease_until)<=datetime('now') AND datetime(bank_poll_leases.next_allowed_at)<=datetime('now')`).bind(key, fence).run();
+      if (claim.meta.changes !== 1) throw new Error("bank_poll_busy");
+      held.push(key);
+    }
+    async function renew() {
+      for (const key of held) {
+        const result = await db.prepare(`UPDATE bank_poll_leases SET lease_until=datetime('now','+120 seconds')
+          WHERE credential_hash=? AND token=? AND datetime(lease_until)>datetime('now')`).bind(key, fence).run();
+        if (result.meta.changes !== 1) throw new Error("bank_poll_lease_lost");
+      }
+    }
+    const open = await db.prepare(`SELECT id,from_date,to_date,cipher,key_version FROM bank_recovery_batches
+      WHERE bank_account_id=? AND state<>'completed' ORDER BY created_at,id LIMIT 1`).bind(account.id).first();
+    const checkpoint = await db.prepare("SELECT api_reconciled_through FROM bank_accounts WHERE id=?").bind(account.id).first();
+    const end = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+    const start = new Date(_nullishCoalesce(_optionalChain([checkpoint, 'optionalAccess', _56 => _56.api_reconciled_through]), () => ( Date.parse(end) - 86 * 864e5)));
+    start.setUTCDate(start.getUTCDate() - 3);
+    if (!open && Date.parse(end) - start.getTime() > 89 * 864e5) throw new Error("recovery_window_requires_bank_unlock");
+    const batch = _nullishCoalesce(open, () => ( { id: crypto.randomUUID(), from_date: start.toISOString().slice(0, 10), to_date: end, cipher: null, key_version: null }));
+    if (!open) await db.prepare(`INSERT INTO bank_recovery_batches(id,bank_account_id,from_date,to_date,state) VALUES(?,?,?,?,'fetching')`).bind(batch.id, account.id, batch.from_date, batch.to_date).run();
+    await db.prepare(`UPDATE bank_accounts SET api_last_fetch_at=datetime('now') WHERE id=?`).bind(account.id).run();
+    let statement;
+    if (batch.cipher !== null && batch.key_version !== null) statement = JSON.parse(await decryptSecret(batch.cipher, batch.key_version, env));
+    else {
+      statement = await _chunkN7BVOSFNcjs.fetchFioStatement.call(void 0, credential, batch.from_date, batch.to_date, proxy);
+      await renew();
+      const encrypted = await encryptSecret(JSON.stringify(statement), env);
+      await db.prepare(`UPDATE bank_recovery_batches SET cipher=?,key_version=?,state='spooled' WHERE id=?`).bind(encrypted.cipher, encrypted.keyVersion, batch.id).run();
+    }
+    const identity = String(_nullishCoalesce(_optionalChain([statement, 'access', _57 => _57.info, 'optionalAccess', _58 => _58.iban]), () => ( ""))).replace(/\s/g, "").toUpperCase();
+    const domestic = `${_nullishCoalesce(_optionalChain([statement, 'access', _59 => _59.info, 'optionalAccess', _60 => _60.accountId]), () => ( ""))}/${_nullishCoalesce(_optionalChain([statement, 'access', _61 => _61.info, 'optionalAccess', _62 => _62.bankId]), () => ( ""))}`;
+    const expected = account.account_number.replace(/\s/g, "").toUpperCase();
+    if (expected !== identity && expected !== domestic) throw new Error("fio_receiving_account_mismatch");
+    let inserted = 0, skipped = 0;
+    for (const raw of statement.transactions) {
+      await renew();
+      const mapped = _chunkN7BVOSFNcjs.mapFioTransaction.call(void 0, raw);
+      if (!mapped || mapped.identity_kind !== "movement") throw new Error("fio_unverified_movement");
+      if (mapped.currency !== String(_nullishCoalesce(_optionalChain([statement, 'access', _63 => _63.info, 'optionalAccess', _64 => _64.currency]), () => ( ""))).toUpperCase()) throw new Error("fio_statement_currency_mismatch");
+      const result = await insertTransaction(db, { bank_account_id: account.id, payload: mapped });
+      if (result.status === "inserted") inserted++;
+      else skipped++;
+    }
+    await renew();
+    await db.batch([
+      db.prepare(`UPDATE bank_recovery_batches SET state='completed',completed_at=datetime('now') WHERE id=?`).bind(batch.id),
+      db.prepare(`UPDATE bank_accounts SET api_last_success_at=datetime('now'),api_last_error=NULL,api_backfill_done=1,
+        api_reconciled_through=?,api_pointer_initialized=1 WHERE id=?`).bind(batch.to_date, account.id)
+    ]);
+    return { inserted, skipped };
+  } finally {
+    for (const key of held) await db.prepare(`UPDATE bank_poll_leases SET lease_until=datetime('now'),next_allowed_at=datetime('now','+30 seconds') WHERE credential_hash=? AND token=?`).bind(key, fence).run();
+  }
+}
+
 // src/cloudflare.ts
 function fioProxyConfig(env) {
-  const url2 = _optionalChain([env, 'access', _53 => _53.FIO_PROXY_URL, 'optionalAccess', _54 => _54.trim, 'call', _55 => _55()]);
-  const secret = _optionalChain([env, 'access', _56 => _56.FIO_PROXY_SECRET, 'optionalAccess', _57 => _57.trim, 'call', _58 => _58()]);
+  const url2 = _optionalChain([env, 'access', _65 => _65.FIO_PROXY_URL, 'optionalAccess', _66 => _66.trim, 'call', _67 => _67()]);
+  const secret = _optionalChain([env, 'access', _68 => _68.FIO_PROXY_SECRET, 'optionalAccess', _69 => _69.trim, 'call', _70 => _70()]);
   return url2 && secret ? { url: url2, secret } : void 0;
 }
 function cfRoutingConfig(env) {
@@ -2674,10 +2753,36 @@ function cfRoutingConfig(env) {
 }
 async function processEmail(rawStream, env, envelope) {
   let bodyText;
+  let spoolId;
+  const reader = rawStream.getReader();
+  const parts = [];
+  let byteCount = 0;
+  while (true) {
+    const item = await reader.read();
+    if (item.done) break;
+    byteCount += item.value.byteLength;
+    if (byteCount > 512 * 1024) {
+      await reader.cancel();
+      throw new Error("email_body_limit");
+    }
+    parts.push(item.value);
+  }
+  const rawArray = new Uint8Array(byteCount);
+  let offset = 0;
+  for (const part of parts) {
+    rawArray.set(part, offset);
+    offset += part.length;
+  }
+  const rawBytes = rawArray.buffer;
+  let binary = "";
+  for (let i = 0; i < rawArray.length; i += 8192) binary += String.fromCharCode(...rawArray.subarray(i, i + 8192));
+  const bytesBase64 = btoa(binary);
+  const rawMime = new TextDecoder().decode(rawBytes);
+  let r2SpoolKey;
   try {
     let extracted;
     try {
-      extracted = await extractEmailBody(rawStream);
+      extracted = await extractEmailBody(new Blob([rawBytes]).stream());
       bodyText = extracted.text;
     } catch (err) {
       const rawText = await new Response(rawStream).text().catch(() => "(failed to read raw)");
@@ -2697,31 +2802,59 @@ async function processEmail(rawStream, env, envelope) {
       log("email_rejected_authentication", { reason });
       return;
     }
+    if (env.AUTHENTICATED_EMAIL_SPOOL === "on") {
+      if (!env.BACKUPS) throw new Error("authenticated_spool_binding_required");
+      const encrypted = await encryptSecret(JSON.stringify({ bytesBase64, envelope }), env);
+      r2SpoolKey = `authenticated-email-pending/${await sha256Hex2(`${identity.recipient}:${bytesBase64}`)}`;
+      const existing = await env.BACKUPS.head(r2SpoolKey);
+      if (!existing) await env.BACKUPS.put(r2SpoolKey, JSON.stringify(encrypted));
+    }
     const allowlist = parseAllowlist(env.SENDER_ALLOWLIST);
     const pairingCode = extractPairingCode(identity.recipient);
     const account = pairingCode ? await findBankAccountByPairingCode(env.DB, pairingCode) : null;
+    const schema = await env.DB.prepare("SELECT value FROM schema_meta WHERE key='version'").first();
+    if (account && _optionalChain([schema, 'optionalAccess', _71 => _71.value]) === "11") {
+      spoolId = await sha256Hex2(`${account.id}:${await _asyncNullishCoalesce(extracted.messageId, async () => ( await sha256Hex2(rawMime)))}`);
+      const digest = await sha256Hex2(rawMime);
+      const encrypted = await encryptSecret(JSON.stringify({ bytesBase64, envelope }), env);
+      await env.DB.prepare(`INSERT INTO authenticated_email_spool(id,bank_account_id,body_sha256,cipher,key_version)
+        VALUES(?,?,?,?,?) ON CONFLICT(id) DO NOTHING`).bind(spoolId, account.id, digest, encrypted.cipher, encrypted.keyVersion).run();
+      const stored = await env.DB.prepare("SELECT body_sha256 FROM authenticated_email_spool WHERE id=?").bind(spoolId).first();
+      if (_optionalChain([stored, 'optionalAccess', _72 => _72.body_sha256]) !== digest) throw new Error("email_transport_body_conflict");
+    }
+    async function completeSpool() {
+      if (spoolId) await env.DB.prepare("UPDATE authenticated_email_spool SET state='completed',completed_at=datetime('now') WHERE id=?").bind(spoolId).run();
+      if (r2SpoolKey) await env.BACKUPS.delete(r2SpoolKey);
+    }
+    if (account && _optionalChain([schema, 'optionalAccess', _73 => _73.value]) === "11") {
+      const enabled = await env.DB.prepare("SELECT ingest_enabled FROM bank_accounts WHERE id=?").bind(account.id).first();
+      if (_optionalChain([enabled, 'optionalAccess', _74 => _74.ingest_enabled]) === 0) throw new Error("email_connection_paused");
+    }
     const outcome = classifyEmail(extracted, identity, account, allowlist);
     if (outcome.received) {
       log("email_received", { pairing_code: pairingCode, message_id: _nullishCoalesce(extracted.messageId, () => ( null)) });
       await writeEvent(env.DB, { event_type: "email_received", bank_account_id: account.id, detail: { message_id: _nullishCoalesce(extracted.messageId, () => ( null)) } });
     }
     if (outcome.kind === "reject" || outcome.kind === "skip") {
+      if (r2SpoolKey && (outcome.reason.startsWith("parse_failed") || outcome.reason.startsWith("unknown_") || outcome.reason.startsWith("no_pairing"))) throw new Error("authenticated_email_quarantined");
       await insertParseLog(env.DB, {
         bank_account_id: _nullishCoalesce(outcome.bankAccountId, () => ( null)),
         error_message: outcome.reason,
         raw_data: sanitizeDiagnosticRaw(extracted.text),
         external_id: _nullishCoalesce(extracted.messageId, () => ( null))
       });
+      await completeSpool();
       return;
     }
     const acct = outcome.account;
+    if (!outcome.parsed.date) throw new Error("email_missing_bank_date");
     let result;
     try {
       result = await insertTransaction(env.DB, {
         bank_account_id: acct.id,
         payload: {
           ...outcome.parsed,
-          date: _nullishCoalesce(outcome.parsed.date, () => ( (/* @__PURE__ */ new Date()).toISOString())),
+          date: outcome.parsed.date,
           external_id: _nullishCoalesce(extracted.messageId, () => ( null))
         }
       });
@@ -2732,17 +2865,19 @@ async function processEmail(rawStream, env, envelope) {
         raw_data: sanitizeDiagnosticRaw(JSON.stringify({ ...outcome.parsed, external_id: _nullishCoalesce(extracted.messageId, () => ( null)) })),
         external_id: _nullishCoalesce(extracted.messageId, () => ( null))
       });
-      return;
+      throw new Error("email_db_insert_failed");
     }
     if (result.status === "skipped") {
       log("tx_skipped", { reason: result.reason, bank_account_id: acct.id });
       await writeEvent(env.DB, { event_type: "tx_skipped", bank_account_id: acct.id, detail: { reason: result.reason } });
+      await completeSpool();
       return;
     }
     const tx = result.transaction;
     log("tx_inserted", { bank_account_id: acct.id, tx_id: tx.id, vs: tx.vs, amount_cents: tx.amount_cents, currency: tx.currency });
     await writeEvent(env.DB, { event_type: "tx_inserted", bank_account_id: acct.id, detail: { tx_id: tx.id } });
     await createWebhookDeliveryCoordinator(env).observeTransaction(tx.id);
+    await completeSpool();
   } catch (err) {
     try {
       await insertParseLog(env.DB, {
@@ -2752,6 +2887,7 @@ async function processEmail(rawStream, env, envelope) {
     } catch (e18) {
     }
     logError("email_unhandled_exception", err, {});
+    throw new Error("email_ingest_incomplete");
   }
 }
 function sanitizeDiagnosticRaw(value) {
@@ -2823,10 +2959,16 @@ async function runBankApiSync(env, account) {
   }
   const isBackfill = !account.api_backfill_done;
   try {
+    const schema = await env.DB.prepare("SELECT value FROM schema_meta WHERE key='version'").first();
+    if (_optionalChain([schema, 'optionalAccess', _75 => _75.value]) === "11") {
+      const result = await recoverBankAccount(env.DB, account, env, fioProxyConfig(env));
+      await ensureDeliveryJobs(env.DB);
+      return { bank_account_id: account.id, provider: account.account_type, inserted: result.inserted, skipped_duplicate: result.skipped, skipped_outgoing: 0, parse_errors: 0, queued_webhooks: 0, backfill: isBackfill, deferred: false };
+    }
     const token = await decryptSecret(account.api_token_cipher, account.api_token_key_ver, env);
     if (isBackfill && account.api_last_success_at === null) {
       await markBankAccountApiFetchStarted(env.DB, account.id);
-      await _chunkPBN2BUNRcjs.setFioPointer.call(void 0, token, yyyyMmDdDaysAgo(90), fioProxyConfig(env));
+      await _chunkN7BVOSFNcjs.setFioPointer.call(void 0, token, yyyyMmDdDaysAgo(90), fioProxyConfig(env));
       await markBankAccountApiPointerSet(env.DB, account.id);
       await writeEvent(env.DB, {
         event_type: "api_pointer_set",
@@ -2846,7 +2988,7 @@ async function runBankApiSync(env, account) {
       };
     }
     await markBankAccountApiFetchStarted(env.DB, account.id);
-    const raw = await _chunkPBN2BUNRcjs.fetchNewTransactions.call(void 0, token, fioProxyConfig(env));
+    const raw = await _chunkN7BVOSFNcjs.fetchNewTransactions.call(void 0, token, fioProxyConfig(env));
     let inserted = 0;
     let skippedDuplicate = 0;
     let skippedOutgoing = 0;
@@ -2855,7 +2997,7 @@ async function runBankApiSync(env, account) {
     for (const item of raw) {
       let mapped;
       try {
-        mapped = _chunkPBN2BUNRcjs.mapFioTransaction.call(void 0, item);
+        mapped = _chunkN7BVOSFNcjs.mapFioTransaction.call(void 0, item);
       } catch (err) {
         parseErrors++;
         await insertParseLog(env.DB, {
@@ -2865,7 +3007,7 @@ async function runBankApiSync(env, account) {
         });
         continue;
       }
-      if (mapped === null) {
+      if (mapped === null || mapped.amount_cents <= 0) {
         skippedOutgoing++;
         await insertParseLog(env.DB, {
           bank_account_id: account.id,
@@ -2911,7 +3053,7 @@ async function runBankApiSync(env, account) {
     };
   } catch (err) {
     await markBankAccountApiFetchFailure(env.DB, account.id, String(err));
-    if (err instanceof _chunkPBN2BUNRcjs.FioRateLimited) {
+    if (err instanceof _chunkN7BVOSFNcjs.FioRateLimited) {
       await writeEvent(env.DB, {
         event_type: "api_rate_limited",
         bank_account_id: account.id,
@@ -2923,14 +3065,7 @@ async function runBankApiSync(env, account) {
 }
 async function runDueBankApiSyncs(env) {
   const accounts = await listDueApiFetchAccounts(env.DB, apiMinIntervalS(env));
-  const processedTokenPrefixes = /* @__PURE__ */ new Set();
   for (const account of accounts) {
-    const tokenKey = _nullishCoalesce(account.api_token_prefix, () => ( `account:${account.id}`));
-    if (processedTokenPrefixes.has(tokenKey)) {
-      log("api_sync_skipped_duplicate_token_prefix", { bank_account_id: account.id, account_type: account.account_type });
-      continue;
-    }
-    processedTokenPrefixes.add(tokenKey);
     try {
       const result = await runBankApiSync(env, account);
       log("api_sync_completed", {
@@ -2943,11 +3078,11 @@ async function runDueBankApiSyncs(env) {
         deferred: result.deferred
       });
     } catch (err) {
-      if (err instanceof _chunkPBN2BUNRcjs.FioRateLimited) {
+      if (err instanceof _chunkN7BVOSFNcjs.FioRateLimited) {
         log("api_rate_limited", { bank_account_id: account.id, account_type: account.account_type, retry_after_s: err.retryAfterS });
         continue;
       }
-      if (err instanceof _chunkPBN2BUNRcjs.FioTransientFailure) {
+      if (err instanceof _chunkN7BVOSFNcjs.FioTransientFailure) {
         logError("api_transient_failure", err, { bank_account_id: account.id, account_type: account.account_type });
         continue;
       }
@@ -2968,7 +3103,7 @@ async function handleApiSyncQueue(batch, env) {
   await assertSchemaVersion(env.DB);
   for (const rawMsg of batch.messages) {
     const msg = rawMsg;
-    if (_optionalChain([msg, 'access', _59 => _59.body, 'optionalAccess', _60 => _60.kind]) !== "api_sync_tick") {
+    if (_optionalChain([msg, 'access', _76 => _76.body, 'optionalAccess', _77 => _77.kind]) !== "api_sync_tick") {
       logError("api_sync_queue_unknown_message", new Error("unknown api sync queue message"), { queue: batch.queue });
       msg.ack();
       continue;
@@ -3051,8 +3186,8 @@ async function adminFetch(req, env) {
         backupsPresent: Boolean(
           env.BACKUPS && Number.isInteger(Number(env.BACKUP_ENCRYPTION_KEY_VERSION)) && env[`BACKUP_ENCRYPTION_KEY_V${env.BACKUP_ENCRYPTION_KEY_VERSION}`]
         ),
-        emailAuthPresent: Boolean(_optionalChain([env, 'access', _61 => _61.EMAIL_AUTHSERV_ID, 'optionalAccess', _62 => _62.trim, 'call', _63 => _63()])),
-        callbackPolicyPresent: Boolean(_optionalChain([env, 'access', _64 => _64.CALLBACK_HOST_ALLOWLIST, 'optionalAccess', _65 => _65.trim, 'call', _66 => _66()])),
+        emailAuthPresent: Boolean(_optionalChain([env, 'access', _78 => _78.EMAIL_AUTHSERV_ID, 'optionalAccess', _79 => _79.trim, 'call', _80 => _80()])),
+        callbackPolicyPresent: Boolean(_optionalChain([env, 'access', _81 => _81.CALLBACK_HOST_ALLOWLIST, 'optionalAccess', _82 => _82.trim, 'call', _83 => _83()])),
         isProduction: env.ENV === "production"
       }
     });
@@ -3219,6 +3354,11 @@ async function dispatch(url2, req, env, authCtx, bodyText) {
     if (input.fio_api_token !== void 0 && (_nullishCoalesce(input.account_type, () => ( "FIO"))) !== "FIO") {
       return jsonResponse({ error: "fio_api_token_supported_only_for_fio" }, 400);
     }
+    const expanded = await env.DB.prepare("SELECT value FROM schema_meta WHERE key='version'").first();
+    if (input.ingest_enabled === false && _optionalChain([expanded, 'optionalAccess', _84 => _84.value]) !== "11") return jsonResponse({ error: "paused_ingest_requires_schema11" }, 409);
+    const capability = _optionalChain([expanded, 'optionalAccess', _85 => _85.value]) === "11" ? await env.DB.prepare("SELECT event_version FROM webhook_consumers WHERE app_id=?").bind(input.owner_app_id).first() : null;
+    if (_optionalChain([capability, 'optionalAccess', _86 => _86.event_version]) === "2" && (input.ingest_mode === "email" || input.ingest_mode === "both") && (env.AUTHENTICATED_EMAIL_SPOOL !== "on" || !env.BACKUPS)) return jsonResponse({ error: "durable_email_capability_not_configured" }, 503);
+    if (_optionalChain([capability, 'optionalAccess', _87 => _87.event_version]) === "2" && input.ingest_mode === "both") return jsonResponse({ error: "both_requires_verified_correlation" }, 409);
     const pairingCode = await generateUniquePairingCode(env.DB);
     const ingestMode = _nullishCoalesce(input.ingest_mode, () => ( (input.fio_api_token ? "api" : "email")));
     const createEmailRoute = ingestMode === "email" || ingestMode === "both";
@@ -3234,14 +3374,19 @@ async function dispatch(url2, req, env, authCtx, bodyText) {
         ...input.label !== void 0 ? { label: input.label } : {},
         owner_app_id: input.owner_app_id,
         cf_rule_id: null,
-        api_token_cipher: _nullishCoalesce(_optionalChain([encryptedApiToken, 'optionalAccess', _67 => _67.cipher]), () => ( null)),
-        api_token_key_ver: _nullishCoalesce(_optionalChain([encryptedApiToken, 'optionalAccess', _68 => _68.keyVersion]), () => ( null)),
+        api_token_cipher: _nullishCoalesce(_optionalChain([encryptedApiToken, 'optionalAccess', _88 => _88.cipher]), () => ( null)),
+        api_token_key_ver: _nullishCoalesce(_optionalChain([encryptedApiToken, 'optionalAccess', _89 => _89.keyVersion]), () => ( null)),
         api_token_prefix: input.fio_api_token ? tokenPrefix(input.fio_api_token) : null,
         api_fetch_enabled: Boolean(input.fio_api_token && ingestMode !== "email")
       });
     } catch (err) {
       throw err;
     }
+    const schemaVersion = await env.DB.prepare("SELECT value FROM schema_meta WHERE key='version'").first();
+    if (input.ingest_enabled === false) {
+      if (_optionalChain([schemaVersion, 'optionalAccess', _90 => _90.value]) !== "11") throw new Error("paused_ingest_requires_schema11");
+      await env.DB.prepare("UPDATE bank_accounts SET ingest_enabled=0,api_fetch_enabled=0 WHERE id=?").bind(account.id).run();
+    }
     if (outboxId !== null) {
       const cfRuleId = await provisionRoute(env.DB, cfRoutingConfig(env), {
         outboxId,
@@ -3269,6 +3414,7 @@ async function dispatch(url2, req, env, authCtx, bodyText) {
     if (existing instanceof Response) return existing;
     const input = parseOr400(UpdateBankAccountSchema, bodyText);
     if (input instanceof Response) return input;
+    if (input.account_number !== void 0 && input.account_number !== existing.account_number && await env.DB.prepare("SELECT 1 FROM transactions WHERE bank_account_id=? LIMIT 1").bind(id).first()) return jsonResponse({ error: "account_identity_immutable" }, 409);
     const updated = await updateBankAccount(env.DB, id, input);
     if (!updated) return jsonResponse({ error: "not_found" }, 404);
     return jsonResponse(updated);
@@ -3298,6 +3444,25 @@ async function dispatch(url2, req, env, authCtx, bodyText) {
     if (!deleted) return jsonResponse({ error: "not_found" }, 404);
     return new Response(null, { status: 204 });
   }
+  const stateMatch = url2.pathname.match(/^\/bank-accounts\/(\d+)\/ingest-state$/);
+  if (stateMatch && (req.method === "GET" || req.method === "PUT")) {
+    const id = Number(stateMatch[1]);
+    const existing = await requireOwnedAccount(env, id, authCtx);
+    if (existing instanceof Response) return existing;
+    const schema = await env.DB.prepare("SELECT value FROM schema_meta WHERE key='version'").first();
+    if (_optionalChain([schema, 'optionalAccess', _91 => _91.value]) !== "11") return jsonResponse({ error: "schema11_required" }, 409);
+    if (req.method === "PUT") {
+      let input;
+      try {
+        input = JSON.parse(bodyText);
+      } catch (e21) {
+        return jsonResponse({ error: "invalid_json" }, 400);
+      }
+      if (typeof input.enabled !== "boolean") return jsonResponse({ error: "enabled_required" }, 400);
+      await env.DB.prepare("UPDATE bank_accounts SET ingest_enabled=? WHERE id=?").bind(input.enabled ? 1 : 0, id).run();
+    }
+    return jsonResponse(await env.DB.prepare("SELECT ingest_enabled,api_token_hash FROM bank_accounts WHERE id=?").bind(id).first());
+  }
   const fioTokenMatch = url2.pathname.match(/^\/bank-accounts\/(\d+)\/fio-token$/);
   if (fioTokenMatch && req.method === "PUT") {
     const id = Number(fioTokenMatch[1]);
@@ -3306,7 +3471,7 @@ async function dispatch(url2, req, env, authCtx, bodyText) {
     if (existing.account_type !== "FIO") return jsonResponse({ error: "fio_api_token_supported_only_for_fio" }, 400);
     const input = parseOr400(UpdateFioTokenSchema, bodyText);
     if (input instanceof Response) return input;
-    const rawToken = _optionalChain([input, 'access', _69 => _69.fio_api_token, 'optionalAccess', _70 => _70.trim, 'call', _71 => _71()]);
+    const rawToken = _optionalChain([input, 'access', _92 => _92.fio_api_token, 'optionalAccess', _93 => _93.trim, 'call', _94 => _94()]);
     if (rawToken !== void 0 && rawToken.length > 0 && rawToken.length < 8) {
       return jsonResponse({ error: "validation_failed: fio_api_token must be at least 8 characters" }, 400);
     }
@@ -3320,6 +3485,8 @@ async function dispatch(url2, req, env, authCtx, bodyText) {
         ingest_mode: _nullishCoalesce(input.ingest_mode, () => ( (existing.ingest_mode === "email" ? "api" : existing.ingest_mode)))
       });
       if (!updated2) return jsonResponse({ error: "not_found" }, 404);
+      const schemaVersion = await env.DB.prepare("SELECT value FROM schema_meta WHERE key='version'").first();
+      if (_optionalChain([schemaVersion, 'optionalAccess', _95 => _95.value]) === "11") await env.DB.prepare("UPDATE bank_accounts SET api_token_hash=? WHERE id=?").bind(await sha256Hex2(rawToken), id).run();
       log("bank_account_api_token_updated", { bank_account_id: id, account_type: existing.account_type, api_token_prefix: updated2.api_token_prefix });
       return jsonResponse(updated2);
     }
@@ -3373,13 +3540,13 @@ async function dispatch(url2, req, env, authCtx, bodyText) {
         queued_webhooks: result.queued_webhooks,
         backfill: result.backfill,
         deferred: result.deferred,
-        api_last_fetch_at: _nullishCoalesce(_optionalChain([updated, 'optionalAccess', _72 => _72.api_last_fetch_at]), () => ( null)),
-        api_last_success_at: _nullishCoalesce(_optionalChain([updated, 'optionalAccess', _73 => _73.api_last_success_at]), () => ( null)),
-        api_last_error: _nullishCoalesce(_optionalChain([updated, 'optionalAccess', _74 => _74.api_last_error]), () => ( null)),
-        api_backfill_done: _nullishCoalesce(_optionalChain([updated, 'optionalAccess', _75 => _75.api_backfill_done]), () => ( false))
+        api_last_fetch_at: _nullishCoalesce(_optionalChain([updated, 'optionalAccess', _96 => _96.api_last_fetch_at]), () => ( null)),
+        api_last_success_at: _nullishCoalesce(_optionalChain([updated, 'optionalAccess', _97 => _97.api_last_success_at]), () => ( null)),
+        api_last_error: _nullishCoalesce(_optionalChain([updated, 'optionalAccess', _98 => _98.api_last_error]), () => ( null)),
+        api_backfill_done: _nullishCoalesce(_optionalChain([updated, 'optionalAccess', _99 => _99.api_backfill_done]), () => ( false))
       });
     } catch (err) {
-      if (err instanceof _chunkPBN2BUNRcjs.FioRateLimited || err instanceof _chunkPBN2BUNRcjs.FioTransientFailure) {
+      if (err instanceof _chunkN7BVOSFNcjs.FioRateLimited || err instanceof _chunkN7BVOSFNcjs.FioTransientFailure) {
         logError("fio_api_manual_sync_failed", err, { bank_account_id: id });
         return jsonResponse({ error: "fio_api_transient_failure" }, 503);
       }
@@ -3404,6 +3571,8 @@ async function dispatch(url2, req, env, authCtx, bodyText) {
     if (authCtx.type === "tenant") return forbidden();
     const input = parseOr400(CreateConsumerSchema, bodyText);
     if (input instanceof Response) return input;
+    const schemaVersion = await env.DB.prepare("SELECT value FROM schema_meta WHERE key='version'").first();
+    if (input.event_version === "2" && _optionalChain([schemaVersion, 'optionalAccess', _100 => _100.value]) !== "11") return jsonResponse({ error: "v2_requires_schema11" }, 409);
     let callbackUrl;
     try {
       callbackUrl = validateCallbackUrl(input.callback_url, { environment: env.ENV, allowlist: env.CALLBACK_HOST_ALLOWLIST });
@@ -3417,6 +3586,7 @@ async function dispatch(url2, req, env, authCtx, bodyText) {
     const secretCipher = await webhookEncrypt(plain, env.WEBHOOK_KEK);
     const consumer = await createConsumer(env.DB, {
       app_id: input.app_id,
+      event_version: _nullishCoalesce(input.event_version, () => ( "1")),
       callback_url: callbackUrl,
       secret_cipher: secretCipher,
       secret_hash: secretHash,
@@ -3566,6 +3736,34 @@ async function dispatch(url2, req, env, authCtx, bodyText) {
     const next_cursor = entries.length === limit ? entries[entries.length - 1].id : null;
     return jsonResponse({ jobs: entries, next_cursor });
   }
+  const exportMatch = url2.pathname.match(/^\/bank-accounts\/(\d+)\/transaction-export$/);
+  if (exportMatch && req.method === "GET") {
+    const id = Number(exportMatch[1]);
+    const account = await requireOwnedAccount(env, id, authCtx);
+    if (account instanceof Response) return account;
+    const maximum = await env.DB.prepare("SELECT COALESCE(MAX(id),0) AS id FROM transactions WHERE bank_account_id=?").bind(id).first();
+    const high = Number(_nullishCoalesce(_nullishCoalesce(url2.searchParams.get("high_water"), () => ( _optionalChain([maximum, 'optionalAccess', _101 => _101.id]))), () => ( 0)));
+    const cursor = Number(_nullishCoalesce(url2.searchParams.get("cursor"), () => ( 0)));
+    const limit = Number(_nullishCoalesce(url2.searchParams.get("limit"), () => ( 200)));
+    if (!Number.isSafeInteger(high) || high < 0 || !Number.isSafeInteger(cursor) || cursor < 0 || !Number.isSafeInteger(limit) || limit < 1 || limit > 200) return jsonResponse({ error: "invalid_cursor" }, 400);
+    const rows = await env.DB.prepare("SELECT * FROM transactions WHERE bank_account_id=? AND id>? AND id<=? ORDER BY id LIMIT ?").bind(id, cursor, high, limit).all();
+    return jsonResponse({ bank_account_id: id, high_water: high, cursor: _nullishCoalesce(_optionalChain([rows, 'access', _102 => _102.results, 'access', _103 => _103.at, 'call', _104 => _104(-1), 'optionalAccess', _105 => _105.id]), () => ( cursor)), complete: rows.results.length < limit, transactions: rows.results });
+  }
+  if (url2.pathname === "/admin/cutover-reconcile" && req.method === "POST") {
+    if (authCtx.type !== "admin") return forbidden();
+    let input;
+    try {
+      input = JSON.parse(bodyText);
+    } catch (e22) {
+      return jsonResponse({ error: "invalid_json" }, 400);
+    }
+    if (typeof input.manifest_sha256 !== "string" || !/^[0-9a-f]{64}$/.test(input.manifest_sha256) || typeof input.consumer_app_id !== "string" || ![input.account_id, input.from_id, input.through_id].every((n) => Number.isSafeInteger(n) && n > 0) || input.through_id < input.from_id) return jsonResponse({ error: "invalid_manifest_window" }, 400);
+    const account = await findBankAccountById(env.DB, input.account_id);
+    if (_optionalChain([account, 'optionalAccess', _106 => _106.owner_app_id]) !== input.consumer_app_id) return forbidden();
+    const created = await ensureDeliveryJobs(env.DB, void 0, { accountId: input.account_id, consumerAppId: input.consumer_app_id, fromId: input.from_id, throughId: input.through_id });
+    await writeEvent(env.DB, { event_type: "cutover_reconcile", bank_account_id: input.account_id, detail: { consumer: input.consumer_app_id, manifest_sha256: input.manifest_sha256, from_id: input.from_id, through_id: input.through_id, created } });
+    return jsonResponse({ created });
+  }
   if (url2.pathname === "/transactions" && req.method === "GET") {
     const since = _nullishCoalesce(url2.searchParams.get("since"), () => ( (/* @__PURE__ */ new Date(0)).toISOString()));
     const limitStr = url2.searchParams.get("limit");
@@ -3641,7 +3839,7 @@ var cloudflare_default = {
       log("email_rejected_oversized", { size: message.rawSize });
       return;
     }
-    const trustedAuthservId = _optionalChain([env, 'access', _76 => _76.EMAIL_AUTHSERV_ID, 'optionalAccess', _77 => _77.trim, 'call', _78 => _78()]);
+    const trustedAuthservId = _optionalChain([env, 'access', _107 => _107.EMAIL_AUTHSERV_ID, 'optionalAccess', _108 => _108.trim, 'call', _109 => _109()]);
     if (!trustedAuthservId) {
       const inspection = inspectAuthenticationResults(message.headers.get("authentication-results"));
       await insertParseLog(env.DB, { error_message: "email_ingest_disabled_untrusted_authserv", raw_data: null });
@@ -3708,6 +3906,37 @@ var cloudflare_default = {
       }
     }
     if (runReconciliation) {
+      if (env.AUTHENTICATED_EMAIL_SPOOL === "on" && env.BACKUPS) {
+        const cursor = await env.DB.prepare("SELECT value FROM schema_meta WHERE key='email_spool_cursor'").first();
+        const page = await env.BACKUPS.list({ prefix: "authenticated-email-pending/", limit: 10, ..._optionalChain([cursor, 'optionalAccess', _110 => _110.value]) ? { cursor: cursor.value } : {} });
+        for (const object2 of page.objects) {
+          try {
+            const stored = await env.BACKUPS.get(object2.key);
+            if (!stored) continue;
+            const encrypted = JSON.parse(await stored.text());
+            const message = JSON.parse(await decryptSecret(encrypted.cipher, encrypted.keyVersion, env));
+            const bytes = Uint8Array.from(atob(message.bytesBase64), (c) => c.charCodeAt(0));
+            await processEmail(new Blob([bytes]).stream(), env, message.envelope);
+          } catch (e23) {
+            log("authenticated_email_recovery_pending", { spool_key: object2.key });
+          }
+        }
+        await env.DB.prepare("INSERT INTO schema_meta(key,value) VALUES('email_spool_cursor',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value").bind(page.truncated ? page.cursor : "").run();
+      }
+      const schema = await env.DB.prepare("SELECT value FROM schema_meta WHERE key='version'").first();
+      if (_optionalChain([schema, 'optionalAccess', _111 => _111.value]) === "11") {
+        const pending = await env.DB.prepare("SELECT id,cipher,key_version FROM authenticated_email_spool WHERE state='pending' ORDER BY attempts,created_at LIMIT 10").all();
+        for (const row of pending.results) {
+          try {
+            await env.DB.prepare("UPDATE authenticated_email_spool SET attempts=attempts+1 WHERE id=?").bind(row.id).run();
+            const message = JSON.parse(await decryptSecret(row.cipher, row.key_version, env));
+            const restored = Uint8Array.from(atob(message.bytesBase64), (c) => c.charCodeAt(0));
+            await processEmail(new Blob([restored]).stream(), env, message.envelope);
+          } catch (e24) {
+            log("email_recovery_pending", { spool_id: row.id });
+          }
+        }
+      }
       try {
         const swept = await createWebhookDeliveryCoordinator(env).sweep();
         if (swept.created > 0 || swept.considered > 0) {