@festapp/banksync 0.2.1 → 0.2.3

package/README.md

@@ -279,3 +279,19 @@ Publishing this package does not deploy the shared Worker, mutate D1, enable ban
 polling, or authorize replay of another consumer's history.
 
 Canonical v2 transactions preserve bank-provided VS and payer reference without inferring an order identifier. Each consumer (Festapp, Mendelio, or another application) owns payment matching and business rules. The existing v1 RF-to-VS projection remains only as an explicit backwards-compatible adapter.
+
+Successful schema 11 Fio imports immediately sweep the canonical webhook outbox into the delivery queue, including retryable dispatch failures from earlier imports. Periodic reconciliation remains recovery; consumers do not wait for its next tick in the normal path.
+
+
+### Fio token authorization failures
+
+A newly created Fio token must also be authorized in Internetbanking; creating
+or copying it alone does not activate it. Fio documents HTTP 500 as a nonexistent
+or inactive token ([Fio API documentation](https://www.fio.cz/docs/cz/API_Bankovnictvi.pdf),
+section 8). An observed inactive token returned that response after 30.4 seconds.
+The client allows 55 seconds; an egress proxy should allow at least 45 seconds
+upstream and mark forwarded responses with `x-fio-upstream-status`. Only a direct
+or explicitly forwarded bank 500 becomes `fio_token_invalid_or_inactive`.
+Transport timeouts and proxy failures remain transient, not token diagnoses.
+Manual sync returns HTTP 422 with that stable error code, which is also stored
+in `api_last_error` and exposed by the owner-scoped account status endpoint.

package/dist/{chunk-N7BVOSFN.cjs → chunk-6TJITWUF.cjs}

@@ -1,4 +1,4 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }// src/normalize.ts
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; } var _class;// src/normalize.ts
 var ISO_ALIASES = {
   "k\u010D": "CZK",
   "kc": "CZK",
@@ -568,6 +568,13 @@ var FioApiError = class extends Error {
   }
   
 };
+var FioTokenInvalidOrInactive = (_class = class extends FioApiError {
+  __init() {this.code = "fio_token_invalid_or_inactive"}
+  constructor() {
+    super("fio_token_invalid_or_inactive", 500);_class.prototype.__init.call(this);;
+    this.name = "FioTokenInvalidOrInactive";
+  }
+}, _class);
 var FioRateLimited = class extends FioApiError {
   constructor(status, retryAfterS) {
     super(`Fio API ${status}`, status);
@@ -591,10 +598,10 @@ async function fioRequest(op, token, directUrl, proxy, date, toDate) {
       method: "POST",
       headers: { "content-type": "application/json", "x-fio-proxy-secret": proxy.secret },
       body: JSON.stringify(date === void 0 ? { op, token } : { op, token, date, ...toDate ? { toDate } : {} }),
-      signal: AbortSignal.timeout(2e4)
+      signal: AbortSignal.timeout(55e3)
     });
   }
-  return fetch(directUrl, { signal: AbortSignal.timeout(2e4) });
+  return fetch(directUrl, { signal: AbortSignal.timeout(55e3) });
 }
 function retryAfterSeconds(headers) {
   const raw = headers.get("Retry-After");
@@ -602,7 +609,10 @@ function retryAfterSeconds(headers) {
   const n = Number.parseInt(raw, 10);
   return Number.isFinite(n) && n >= 0 ? n : null;
 }
-async function ensureFioResponse(res) {
+async function ensureFioResponse(res, proxy) {
+  if (res.status === 500 && (!proxy || res.headers.get("x-fio-upstream-status") === "500")) {
+    throw new FioTokenInvalidOrInactive();
+  }
   if (res.status === 429 || res.status === 409) {
     throw new FioRateLimited(res.status, retryAfterSeconds(res.headers));
   }
@@ -615,7 +625,7 @@ async function ensureFioResponse(res) {
 }
 async function fetchNewTransactions(token, proxy) {
   const res = await fioRequest("transactions", token, `${endpoint("last", token)}/transactions.json`, proxy);
-  await ensureFioResponse(res);
+  await ensureFioResponse(res, proxy);
   const json = await res.json();
   const transactions = _nullishCoalesce(_optionalChain([json, 'access', _4 => _4.accountStatement, 'optionalAccess', _5 => _5.transactionList, 'optionalAccess', _6 => _6.transaction]), () => ( []));
   return Array.isArray(transactions) ? transactions : [transactions];
@@ -625,7 +635,7 @@ async function setFioPointer(token, yyyyMmDd, proxy) {
     throw new Error("invalid_fio_pointer_date");
   }
   const res = await fioRequest("set-last-date", token, `${endpoint("set-last-date", token)}/${yyyyMmDd}/`, proxy, yyyyMmDd);
-  await ensureFioResponse(res);
+  await ensureFioResponse(res, proxy);
 }
 function column(raw, idx) {
   const value = _optionalChain([raw, 'access', _7 => _7[`column${idx}`], 'optionalAccess', _8 => _8.value]);
@@ -702,7 +712,7 @@ async function fetchFioStatement(token, from, to, proxy) {
   for (const date of [from, to]) if (!/^\d{4}-\d{2}-\d{2}$/.test(date) || !Number.isFinite(Date.parse(date))) throw new Error("invalid_statement_window");
   if (from > to || Date.parse(to) - Date.parse(from) > 90 * 864e5) throw new Error("unbounded_statement_window");
   const response = await fioRequest("periods", token, `${endpoint("periods", token)}/${from}/${to}/transactions.json`, proxy, from, to);
-  await ensureFioResponse(response);
+  await ensureFioResponse(response, proxy);
   const document = await response.json();
   const statement = document.accountStatement;
   if (!_optionalChain([statement, 'optionalAccess', _9 => _9.info])) throw new Error("missing_statement_info");
@@ -732,4 +742,5 @@ async function fetchFioStatement(token, from, to, proxy) {
 
 
 
-exports.normalizeCurrency = normalizeCurrency; exports.toCents = toCents; exports.decimalToCents = decimalToCents; exports.BANK_CODES = BANK_CODES; exports.detectProvider = detectProvider; exports.parseEmail = parseEmail; exports.encodeRf = encodeRf; exports.decodeRf = decodeRf; exports.resolveVariableSymbol = resolveVariableSymbol; exports.extractReferenceCandidates = extractReferenceCandidates; exports.buildWebhookEnvelope = buildWebhookEnvelope; exports.signWebhook = signWebhook; exports.WebhookVerificationError = WebhookVerificationError; exports.verifyWebhook = verifyWebhook; exports.FioApiError = FioApiError; exports.FioRateLimited = FioRateLimited; exports.FioTransientFailure = FioTransientFailure; exports.fetchNewTransactions = fetchNewTransactions; exports.setFioPointer = setFioPointer; exports.mapFioTransaction = mapFioTransaction; exports.fetchFioStatement = fetchFioStatement;
+
+exports.normalizeCurrency = normalizeCurrency; exports.toCents = toCents; exports.decimalToCents = decimalToCents; exports.BANK_CODES = BANK_CODES; exports.detectProvider = detectProvider; exports.parseEmail = parseEmail; exports.encodeRf = encodeRf; exports.decodeRf = decodeRf; exports.resolveVariableSymbol = resolveVariableSymbol; exports.extractReferenceCandidates = extractReferenceCandidates; exports.buildWebhookEnvelope = buildWebhookEnvelope; exports.signWebhook = signWebhook; exports.WebhookVerificationError = WebhookVerificationError; exports.verifyWebhook = verifyWebhook; exports.FioApiError = FioApiError; exports.FioTokenInvalidOrInactive = FioTokenInvalidOrInactive; exports.FioRateLimited = FioRateLimited; exports.FioTransientFailure = FioTransientFailure; exports.fetchNewTransactions = fetchNewTransactions; exports.setFioPointer = setFioPointer; exports.mapFioTransaction = mapFioTransaction; exports.fetchFioStatement = fetchFioStatement;

package/dist/{chunk-3WM2GGFL.js → chunk-PIBCQAMQ.js}

@@ -568,6 +568,13 @@ var FioApiError = class extends Error {
   }
   status;
 };
+var FioTokenInvalidOrInactive = class extends FioApiError {
+  code = "fio_token_invalid_or_inactive";
+  constructor() {
+    super("fio_token_invalid_or_inactive", 500);
+    this.name = "FioTokenInvalidOrInactive";
+  }
+};
 var FioRateLimited = class extends FioApiError {
   constructor(status, retryAfterS) {
     super(`Fio API ${status}`, status);
@@ -591,10 +598,10 @@ async function fioRequest(op, token, directUrl, proxy, date, toDate) {
       method: "POST",
       headers: { "content-type": "application/json", "x-fio-proxy-secret": proxy.secret },
       body: JSON.stringify(date === void 0 ? { op, token } : { op, token, date, ...toDate ? { toDate } : {} }),
-      signal: AbortSignal.timeout(2e4)
+      signal: AbortSignal.timeout(55e3)
     });
   }
-  return fetch(directUrl, { signal: AbortSignal.timeout(2e4) });
+  return fetch(directUrl, { signal: AbortSignal.timeout(55e3) });
 }
 function retryAfterSeconds(headers) {
   const raw = headers.get("Retry-After");
@@ -602,7 +609,10 @@ function retryAfterSeconds(headers) {
   const n = Number.parseInt(raw, 10);
   return Number.isFinite(n) && n >= 0 ? n : null;
 }
-async function ensureFioResponse(res) {
+async function ensureFioResponse(res, proxy) {
+  if (res.status === 500 && (!proxy || res.headers.get("x-fio-upstream-status") === "500")) {
+    throw new FioTokenInvalidOrInactive();
+  }
   if (res.status === 429 || res.status === 409) {
     throw new FioRateLimited(res.status, retryAfterSeconds(res.headers));
   }
@@ -615,7 +625,7 @@ async function ensureFioResponse(res) {
 }
 async function fetchNewTransactions(token, proxy) {
   const res = await fioRequest("transactions", token, `${endpoint("last", token)}/transactions.json`, proxy);
-  await ensureFioResponse(res);
+  await ensureFioResponse(res, proxy);
   const json = await res.json();
   const transactions = json.accountStatement?.transactionList?.transaction ?? [];
   return Array.isArray(transactions) ? transactions : [transactions];
@@ -625,7 +635,7 @@ async function setFioPointer(token, yyyyMmDd, proxy) {
     throw new Error("invalid_fio_pointer_date");
   }
   const res = await fioRequest("set-last-date", token, `${endpoint("set-last-date", token)}/${yyyyMmDd}/`, proxy, yyyyMmDd);
-  await ensureFioResponse(res);
+  await ensureFioResponse(res, proxy);
 }
 function column(raw, idx) {
   const value = raw[`column${idx}`]?.value;
@@ -702,7 +712,7 @@ async function fetchFioStatement(token, from, to, proxy) {
   for (const date of [from, to]) if (!/^\d{4}-\d{2}-\d{2}$/.test(date) || !Number.isFinite(Date.parse(date))) throw new Error("invalid_statement_window");
   if (from > to || Date.parse(to) - Date.parse(from) > 90 * 864e5) throw new Error("unbounded_statement_window");
   const response = await fioRequest("periods", token, `${endpoint("periods", token)}/${from}/${to}/transactions.json`, proxy, from, to);
-  await ensureFioResponse(response);
+  await ensureFioResponse(response, proxy);
   const document = await response.json();
   const statement = document.accountStatement;
   if (!statement?.info) throw new Error("missing_statement_info");
@@ -726,6 +736,7 @@ export {
   WebhookVerificationError,
   verifyWebhook,
   FioApiError,
+  FioTokenInvalidOrInactive,
   FioRateLimited,
   FioTransientFailure,
   fetchNewTransactions,

package/dist/cloudflare.cjs

@@ -10,7 +10,8 @@
 
 
 
-var _chunkN7BVOSFNcjs = require('./chunk-N7BVOSFN.cjs');
+
+var _chunk6TJITWUFcjs = require('./chunk-6TJITWUF.cjs');
 
 // src/mime.ts
 var _postalmime = require('postal-mime'); var _postalmime2 = _interopRequireDefault(_postalmime);
@@ -67,13 +68,13 @@ function classifyEmail(extracted, identity, account, allowlist) {
   if (account.ingest_mode === "api") {
     return { kind: "reject", reason: "email_ingest_disabled", bankAccountId: account.id, received: false };
   }
-  const provider = _chunkN7BVOSFNcjs.detectProvider.call(void 0, extracted.text, account.account_number);
+  const provider = _chunk6TJITWUFcjs.detectProvider.call(void 0, extracted.text, account.account_number);
   if (provider === "unknown") {
     return { kind: "reject", reason: `unknown_provider: ${account.account_number}`, bankAccountId: account.id, received: true };
   }
   let parsed;
   try {
-    parsed = _chunkN7BVOSFNcjs.parseEmail.call(void 0, extracted.text, provider);
+    parsed = _chunk6TJITWUFcjs.parseEmail.call(void 0, extracted.text, provider);
   } catch (err) {
     return { kind: "reject", reason: `${err}`.replace(/^Error:\s*/, ""), bankAccountId: account.id, received: true };
   }
@@ -610,7 +611,7 @@ async function insertTransaction(db, args) {
   const v2 = _optionalChain([schema, 'optionalAccess', _16 => _16.value]) === "11";
   const p = {
     ...args.payload,
-    vs: v2 ? _nullishCoalesce(_nullishCoalesce(args.payload.raw_vs, () => ( args.payload.vs)), () => ( null)) : _chunkN7BVOSFNcjs.resolveVariableSymbol.call(void 0, args.payload)
+    vs: v2 ? _nullishCoalesce(_nullishCoalesce(args.payload.raw_vs, () => ( args.payload.vs)), () => ( null)) : _chunk6TJITWUFcjs.resolveVariableSymbol.call(void 0, args.payload)
   };
   if (p.transaction_id != null && p.source === "fio_api") {
     const hit = await db.prepare(SQL_FIND_DUPLICATE_FIO).bind(args.bank_account_id, p.transaction_id).first();
@@ -1227,7 +1228,7 @@ async function ensureDeliveryJobs(db, transactionId, cutover) {
   for (const row of candidates.results) {
     const { pairing_code, consumer_app_id, event_version, created_at: _createdAt, ...transaction } = row;
     const deliveryId = _ulid.ulid.call(void 0, );
-    const envelope = _chunkN7BVOSFNcjs.buildWebhookEnvelope.call(void 0, {
+    const envelope = _chunk6TJITWUFcjs.buildWebhookEnvelope.call(void 0, {
       delivery_id: deliveryId,
       pairing_code: row.pairing_code,
       transaction,
@@ -1549,7 +1550,7 @@ async function httpResult(response, deliveryId, usedPrevSecret, primaryStatus) {
   return "receipt" in parsed ? { kind: "http", httpStatus: response.status, usedPrevSecret, primaryStatus, receipt: parsed.receipt } : { kind: "http", httpStatus: response.status, usedPrevSecret, primaryStatus, receiptError: parsed.error };
 }
 async function postSigned(url2, envelope, secret) {
-  const signed = await _chunkN7BVOSFNcjs.signWebhook.call(void 0, { envelope, secret });
+  const signed = await _chunk6TJITWUFcjs.signWebhook.call(void 0, { envelope, secret });
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
   try {
@@ -2707,7 +2708,7 @@ async function recoverBankAccount(db, account, env, proxy) {
     let statement;
     if (batch.cipher !== null && batch.key_version !== null) statement = JSON.parse(await decryptSecret(batch.cipher, batch.key_version, env));
     else {
-      statement = await _chunkN7BVOSFNcjs.fetchFioStatement.call(void 0, credential, batch.from_date, batch.to_date, proxy);
+      statement = await _chunk6TJITWUFcjs.fetchFioStatement.call(void 0, credential, batch.from_date, batch.to_date, proxy);
       await renew();
       const encrypted = await encryptSecret(JSON.stringify(statement), env);
       await db.prepare(`UPDATE bank_recovery_batches SET cipher=?,key_version=?,state='spooled' WHERE id=?`).bind(encrypted.cipher, encrypted.keyVersion, batch.id).run();
@@ -2719,7 +2720,7 @@ async function recoverBankAccount(db, account, env, proxy) {
     let inserted = 0, skipped = 0;
     for (const raw of statement.transactions) {
       await renew();
-      const mapped = _chunkN7BVOSFNcjs.mapFioTransaction.call(void 0, raw);
+      const mapped = _chunk6TJITWUFcjs.mapFioTransaction.call(void 0, raw);
       if (!mapped || mapped.identity_kind !== "movement") throw new Error("fio_unverified_movement");
       if (mapped.currency !== String(_nullishCoalesce(_optionalChain([statement, 'access', _63 => _63.info, 'optionalAccess', _64 => _64.currency]), () => ( ""))).toUpperCase()) throw new Error("fio_statement_currency_mismatch");
       const result = await insertTransaction(db, { bank_account_id: account.id, payload: mapped });
@@ -2962,13 +2963,13 @@ async function runBankApiSync(env, account) {
     const schema = await env.DB.prepare("SELECT value FROM schema_meta WHERE key='version'").first();
     if (_optionalChain([schema, 'optionalAccess', _75 => _75.value]) === "11") {
       const result = await recoverBankAccount(env.DB, account, env, fioProxyConfig(env));
-      await ensureDeliveryJobs(env.DB);
-      return { bank_account_id: account.id, provider: account.account_type, inserted: result.inserted, skipped_duplicate: result.skipped, skipped_outgoing: 0, parse_errors: 0, queued_webhooks: 0, backfill: isBackfill, deferred: false };
+      const delivery = await createWebhookDeliveryCoordinator(env).sweep();
+      return { bank_account_id: account.id, provider: account.account_type, inserted: result.inserted, skipped_duplicate: result.skipped, skipped_outgoing: 0, parse_errors: 0, queued_webhooks: delivery.queued, backfill: isBackfill, deferred: false };
     }
     const token = await decryptSecret(account.api_token_cipher, account.api_token_key_ver, env);
     if (isBackfill && account.api_last_success_at === null) {
       await markBankAccountApiFetchStarted(env.DB, account.id);
-      await _chunkN7BVOSFNcjs.setFioPointer.call(void 0, token, yyyyMmDdDaysAgo(90), fioProxyConfig(env));
+      await _chunk6TJITWUFcjs.setFioPointer.call(void 0, token, yyyyMmDdDaysAgo(90), fioProxyConfig(env));
       await markBankAccountApiPointerSet(env.DB, account.id);
       await writeEvent(env.DB, {
         event_type: "api_pointer_set",
@@ -2988,7 +2989,7 @@ async function runBankApiSync(env, account) {
       };
     }
     await markBankAccountApiFetchStarted(env.DB, account.id);
-    const raw = await _chunkN7BVOSFNcjs.fetchNewTransactions.call(void 0, token, fioProxyConfig(env));
+    const raw = await _chunk6TJITWUFcjs.fetchNewTransactions.call(void 0, token, fioProxyConfig(env));
     let inserted = 0;
     let skippedDuplicate = 0;
     let skippedOutgoing = 0;
@@ -2997,7 +2998,7 @@ async function runBankApiSync(env, account) {
     for (const item of raw) {
       let mapped;
       try {
-        mapped = _chunkN7BVOSFNcjs.mapFioTransaction.call(void 0, item);
+        mapped = _chunk6TJITWUFcjs.mapFioTransaction.call(void 0, item);
       } catch (err) {
         parseErrors++;
         await insertParseLog(env.DB, {
@@ -3052,8 +3053,8 @@ async function runBankApiSync(env, account) {
       deferred: false
     };
   } catch (err) {
-    await markBankAccountApiFetchFailure(env.DB, account.id, String(err));
-    if (err instanceof _chunkN7BVOSFNcjs.FioRateLimited) {
+    await markBankAccountApiFetchFailure(env.DB, account.id, err instanceof _chunk6TJITWUFcjs.FioTokenInvalidOrInactive ? err.code : String(err));
+    if (err instanceof _chunk6TJITWUFcjs.FioRateLimited) {
       await writeEvent(env.DB, {
         event_type: "api_rate_limited",
         bank_account_id: account.id,
@@ -3078,11 +3079,11 @@ async function runDueBankApiSyncs(env) {
         deferred: result.deferred
       });
     } catch (err) {
-      if (err instanceof _chunkN7BVOSFNcjs.FioRateLimited) {
+      if (err instanceof _chunk6TJITWUFcjs.FioRateLimited) {
         log("api_rate_limited", { bank_account_id: account.id, account_type: account.account_type, retry_after_s: err.retryAfterS });
         continue;
       }
-      if (err instanceof _chunkN7BVOSFNcjs.FioTransientFailure) {
+      if (err instanceof _chunk6TJITWUFcjs.FioTransientFailure) {
         logError("api_transient_failure", err, { bank_account_id: account.id, account_type: account.account_type });
         continue;
       }
@@ -3408,6 +3409,10 @@ async function dispatch(url2, req, env, authCtx, bodyText) {
     return jsonResponse(accounts);
   }
   const baMatch = url2.pathname.match(/^\/bank-accounts\/(\d+)$/);
+  if (baMatch && req.method === "GET") {
+    const account = await requireOwnedAccount(env, Number(baMatch[1]), authCtx);
+    return account instanceof Response ? account : jsonResponse(account);
+  }
   if (baMatch && req.method === "PUT") {
     const id = Number(baMatch[1]);
     const existing = await requireOwnedAccount(env, id, authCtx);
@@ -3546,7 +3551,10 @@ async function dispatch(url2, req, env, authCtx, bodyText) {
         api_backfill_done: _nullishCoalesce(_optionalChain([updated, 'optionalAccess', _99 => _99.api_backfill_done]), () => ( false))
       });
     } catch (err) {
-      if (err instanceof _chunkN7BVOSFNcjs.FioRateLimited || err instanceof _chunkN7BVOSFNcjs.FioTransientFailure) {
+      if (err instanceof _chunk6TJITWUFcjs.FioTokenInvalidOrInactive) {
+        return jsonResponse({ error: err.code, bank_http_status: err.status }, 422);
+      }
+      if (err instanceof _chunk6TJITWUFcjs.FioRateLimited || err instanceof _chunk6TJITWUFcjs.FioTransientFailure) {
         logError("fio_api_manual_sync_failed", err, { bank_account_id: id });
         return jsonResponse({ error: "fio_api_transient_failure" }, 503);
       }

package/dist/cloudflare.js

@@ -1,5 +1,6 @@
 import {
   FioRateLimited,
+  FioTokenInvalidOrInactive,
   FioTransientFailure,
   buildWebhookEnvelope,
   detectProvider,
@@ -10,7 +11,7 @@ import {
   resolveVariableSymbol,
   setFioPointer,
   signWebhook
-} from "./chunk-3WM2GGFL.js";
+} from "./chunk-PIBCQAMQ.js";
 
 // src/mime.ts
 import PostalMime from "postal-mime";
@@ -2962,8 +2963,8 @@ async function runBankApiSync(env, account) {
     const schema = await env.DB.prepare("SELECT value FROM schema_meta WHERE key='version'").first();
     if (schema?.value === "11") {
       const result = await recoverBankAccount(env.DB, account, env, fioProxyConfig(env));
-      await ensureDeliveryJobs(env.DB);
-      return { bank_account_id: account.id, provider: account.account_type, inserted: result.inserted, skipped_duplicate: result.skipped, skipped_outgoing: 0, parse_errors: 0, queued_webhooks: 0, backfill: isBackfill, deferred: false };
+      const delivery = await createWebhookDeliveryCoordinator(env).sweep();
+      return { bank_account_id: account.id, provider: account.account_type, inserted: result.inserted, skipped_duplicate: result.skipped, skipped_outgoing: 0, parse_errors: 0, queued_webhooks: delivery.queued, backfill: isBackfill, deferred: false };
     }
     const token = await decryptSecret(account.api_token_cipher, account.api_token_key_ver, env);
     if (isBackfill && account.api_last_success_at === null) {
@@ -3052,7 +3053,7 @@ async function runBankApiSync(env, account) {
       deferred: false
     };
   } catch (err) {
-    await markBankAccountApiFetchFailure(env.DB, account.id, String(err));
+    await markBankAccountApiFetchFailure(env.DB, account.id, err instanceof FioTokenInvalidOrInactive ? err.code : String(err));
     if (err instanceof FioRateLimited) {
       await writeEvent(env.DB, {
         event_type: "api_rate_limited",
@@ -3408,6 +3409,10 @@ async function dispatch(url2, req, env, authCtx, bodyText) {
     return jsonResponse(accounts);
   }
   const baMatch = url2.pathname.match(/^\/bank-accounts\/(\d+)$/);
+  if (baMatch && req.method === "GET") {
+    const account = await requireOwnedAccount(env, Number(baMatch[1]), authCtx);
+    return account instanceof Response ? account : jsonResponse(account);
+  }
   if (baMatch && req.method === "PUT") {
     const id = Number(baMatch[1]);
     const existing = await requireOwnedAccount(env, id, authCtx);
@@ -3546,6 +3551,9 @@ async function dispatch(url2, req, env, authCtx, bodyText) {
         api_backfill_done: updated?.api_backfill_done ?? false
       });
     } catch (err) {
+      if (err instanceof FioTokenInvalidOrInactive) {
+        return jsonResponse({ error: err.code, bank_http_status: err.status }, 422);
+      }
       if (err instanceof FioRateLimited || err instanceof FioTransientFailure) {
         logError("fio_api_manual_sync_failed", err, { bank_account_id: id });
         return jsonResponse({ error: "fio_api_transient_failure" }, 503);

package/dist/index.cjs

@@ -19,8 +19,8 @@
 
 
 
-var _chunkN7BVOSFNcjs = require('./chunk-N7BVOSFN.cjs');
 
+var _chunk6TJITWUFcjs = require('./chunk-6TJITWUF.cjs');
 
 
 
@@ -41,4 +41,6 @@ var _chunkN7BVOSFNcjs = require('./chunk-N7BVOSFN.cjs');
 
 
 
-exports.BANK_CODES = _chunkN7BVOSFNcjs.BANK_CODES; exports.FioApiError = _chunkN7BVOSFNcjs.FioApiError; exports.FioRateLimited = _chunkN7BVOSFNcjs.FioRateLimited; exports.FioTransientFailure = _chunkN7BVOSFNcjs.FioTransientFailure; exports.WebhookVerificationError = _chunkN7BVOSFNcjs.WebhookVerificationError; exports.buildWebhookEnvelope = _chunkN7BVOSFNcjs.buildWebhookEnvelope; exports.decimalToCents = _chunkN7BVOSFNcjs.decimalToCents; exports.decodeRf = _chunkN7BVOSFNcjs.decodeRf; exports.detectProvider = _chunkN7BVOSFNcjs.detectProvider; exports.encodeRf = _chunkN7BVOSFNcjs.encodeRf; exports.extractReferenceCandidates = _chunkN7BVOSFNcjs.extractReferenceCandidates; exports.fetchNewTransactions = _chunkN7BVOSFNcjs.fetchNewTransactions; exports.mapFioTransaction = _chunkN7BVOSFNcjs.mapFioTransaction; exports.normalizeCurrency = _chunkN7BVOSFNcjs.normalizeCurrency; exports.parseEmail = _chunkN7BVOSFNcjs.parseEmail; exports.resolveVariableSymbol = _chunkN7BVOSFNcjs.resolveVariableSymbol; exports.setFioPointer = _chunkN7BVOSFNcjs.setFioPointer; exports.signWebhook = _chunkN7BVOSFNcjs.signWebhook; exports.toCents = _chunkN7BVOSFNcjs.toCents; exports.verifyWebhook = _chunkN7BVOSFNcjs.verifyWebhook;
+
+
+exports.BANK_CODES = _chunk6TJITWUFcjs.BANK_CODES; exports.FioApiError = _chunk6TJITWUFcjs.FioApiError; exports.FioRateLimited = _chunk6TJITWUFcjs.FioRateLimited; exports.FioTokenInvalidOrInactive = _chunk6TJITWUFcjs.FioTokenInvalidOrInactive; exports.FioTransientFailure = _chunk6TJITWUFcjs.FioTransientFailure; exports.WebhookVerificationError = _chunk6TJITWUFcjs.WebhookVerificationError; exports.buildWebhookEnvelope = _chunk6TJITWUFcjs.buildWebhookEnvelope; exports.decimalToCents = _chunk6TJITWUFcjs.decimalToCents; exports.decodeRf = _chunk6TJITWUFcjs.decodeRf; exports.detectProvider = _chunk6TJITWUFcjs.detectProvider; exports.encodeRf = _chunk6TJITWUFcjs.encodeRf; exports.extractReferenceCandidates = _chunk6TJITWUFcjs.extractReferenceCandidates; exports.fetchNewTransactions = _chunk6TJITWUFcjs.fetchNewTransactions; exports.mapFioTransaction = _chunk6TJITWUFcjs.mapFioTransaction; exports.normalizeCurrency = _chunk6TJITWUFcjs.normalizeCurrency; exports.parseEmail = _chunk6TJITWUFcjs.parseEmail; exports.resolveVariableSymbol = _chunk6TJITWUFcjs.resolveVariableSymbol; exports.setFioPointer = _chunk6TJITWUFcjs.setFioPointer; exports.signWebhook = _chunk6TJITWUFcjs.signWebhook; exports.toCents = _chunk6TJITWUFcjs.toCents; exports.verifyWebhook = _chunk6TJITWUFcjs.verifyWebhook;

package/dist/index.d.cts

@@ -88,6 +88,13 @@ declare class FioApiError extends Error {
     readonly status: number;
     constructor(message: string, status: number);
 }
+/** Fio documents HTTP 500 as a nonexistent/inactive token, including one
+ * created but not yet authorized in Internetbanking. Never infer this from
+ * a proxy-generated 500 or a transport timeout. */
+declare class FioTokenInvalidOrInactive extends FioApiError {
+    readonly code = "fio_token_invalid_or_inactive";
+    constructor();
+}
 declare class FioRateLimited extends FioApiError {
     readonly retryAfterS: number | null;
     constructor(status: number, retryAfterS: number | null);
@@ -111,4 +118,4 @@ declare function fetchNewTransactions(token: string, proxy?: FioProxyConfig): Pr
 declare function setFioPointer(token: string, yyyyMmDd: string, proxy?: FioProxyConfig): Promise<void>;
 declare function mapFioTransaction(raw: FioTransaction): Omit<Transaction, 'id' | 'bank_account_id'> | null;
 
-export { BANK_CODES, type EmailProvider, FioApiError, type FioColumn, type FioProxyConfig, FioRateLimited, type FioTransaction, FioTransientFailure, type ParsedEmailTransaction, type ReferenceSource, type SignedWebhook, Transaction, type VerifyWebhookArgs, WebhookEnvelope, type WebhookVerificationCode, WebhookVerificationError, buildWebhookEnvelope, decimalToCents, decodeRf, detectProvider, encodeRf, extractReferenceCandidates, fetchNewTransactions, mapFioTransaction, normalizeCurrency, parseEmail, resolveVariableSymbol, setFioPointer, signWebhook, toCents, verifyWebhook };
+export { BANK_CODES, type EmailProvider, FioApiError, type FioColumn, type FioProxyConfig, FioRateLimited, FioTokenInvalidOrInactive, type FioTransaction, FioTransientFailure, type ParsedEmailTransaction, type ReferenceSource, type SignedWebhook, Transaction, type VerifyWebhookArgs, WebhookEnvelope, type WebhookVerificationCode, WebhookVerificationError, buildWebhookEnvelope, decimalToCents, decodeRf, detectProvider, encodeRf, extractReferenceCandidates, fetchNewTransactions, mapFioTransaction, normalizeCurrency, parseEmail, resolveVariableSymbol, setFioPointer, signWebhook, toCents, verifyWebhook };

package/dist/index.d.ts

@@ -88,6 +88,13 @@ declare class FioApiError extends Error {
     readonly status: number;
     constructor(message: string, status: number);
 }
+/** Fio documents HTTP 500 as a nonexistent/inactive token, including one
+ * created but not yet authorized in Internetbanking. Never infer this from
+ * a proxy-generated 500 or a transport timeout. */
+declare class FioTokenInvalidOrInactive extends FioApiError {
+    readonly code = "fio_token_invalid_or_inactive";
+    constructor();
+}
 declare class FioRateLimited extends FioApiError {
     readonly retryAfterS: number | null;
     constructor(status: number, retryAfterS: number | null);
@@ -111,4 +118,4 @@ declare function fetchNewTransactions(token: string, proxy?: FioProxyConfig): Pr
 declare function setFioPointer(token: string, yyyyMmDd: string, proxy?: FioProxyConfig): Promise<void>;
 declare function mapFioTransaction(raw: FioTransaction): Omit<Transaction, 'id' | 'bank_account_id'> | null;
 
-export { BANK_CODES, type EmailProvider, FioApiError, type FioColumn, type FioProxyConfig, FioRateLimited, type FioTransaction, FioTransientFailure, type ParsedEmailTransaction, type ReferenceSource, type SignedWebhook, Transaction, type VerifyWebhookArgs, WebhookEnvelope, type WebhookVerificationCode, WebhookVerificationError, buildWebhookEnvelope, decimalToCents, decodeRf, detectProvider, encodeRf, extractReferenceCandidates, fetchNewTransactions, mapFioTransaction, normalizeCurrency, parseEmail, resolveVariableSymbol, setFioPointer, signWebhook, toCents, verifyWebhook };
+export { BANK_CODES, type EmailProvider, FioApiError, type FioColumn, type FioProxyConfig, FioRateLimited, FioTokenInvalidOrInactive, type FioTransaction, FioTransientFailure, type ParsedEmailTransaction, type ReferenceSource, type SignedWebhook, Transaction, type VerifyWebhookArgs, WebhookEnvelope, type WebhookVerificationCode, WebhookVerificationError, buildWebhookEnvelope, decimalToCents, decodeRf, detectProvider, encodeRf, extractReferenceCandidates, fetchNewTransactions, mapFioTransaction, normalizeCurrency, parseEmail, resolveVariableSymbol, setFioPointer, signWebhook, toCents, verifyWebhook };

package/dist/index.js

@@ -2,6 +2,7 @@ import {
   BANK_CODES,
   FioApiError,
   FioRateLimited,
+  FioTokenInvalidOrInactive,
   FioTransientFailure,
   WebhookVerificationError,
   buildWebhookEnvelope,
@@ -19,11 +20,12 @@ import {
   signWebhook,
   toCents,
   verifyWebhook
-} from "./chunk-3WM2GGFL.js";
+} from "./chunk-PIBCQAMQ.js";
 export {
   BANK_CODES,
   FioApiError,
   FioRateLimited,
+  FioTokenInvalidOrInactive,
   FioTransientFailure,
   WebhookVerificationError,
   buildWebhookEnvelope,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@festapp/banksync",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Bank transaction ingestion for Cloudflare Workers: Czech bank email and Fio API parsing, durable deduplication, and signed webhook delivery.",
   "type": "module",
   "packageManager": "pnpm@11.24.0",