@iovdin/bunk 1.0.2 → 1.0.5

package/README.md

@@ -1,11 +1,11 @@
 # bunk — bunq CLI
 
-A command-line tool to authenticate with [bunq](https://www.bunq.com) via OAuth2, download all your events and index payments locally into SQLite for fast offline querying.
+A command-line tool to authenticate with [bunq](https://www.bunq.com) via OAuth2 and index Payments locally into SQLite for fast offline querying.
 
 ## Installation
 
 ```bash
-npm install -g bunk
+npm install -g @iovdin/bunk
 ```
 
 Or for local dev:
@@ -19,20 +19,18 @@ npm link   # makes `bunk` available on your PATH
 
 ## Configuration
 
-Config is stored at `~/.config/bunk/config.json` and is managed automatically by `bunk auth`.
-
-```json
-{
-  "clientId": "...",
-  "clientSecret": "...",
-  "accessToken": "...",
-  "installationToken": "...",
-  "sessionToken": "...",
-  "userId": 12345678,
-  "publicKey": "-----BEGIN PUBLIC KEY-----\n...",
-  "privateKey": "-----BEGIN PRIVATE KEY-----\n..."
-}
-```
+Credentials are stored securely in the system keychain (macOS Keychain, GNOME Keyring, KWallet, Windows Credential Manager) and are managed automatically by `bunk auth`. The following items are stored under the service name `bunk`:
+
+| Item | Description |
+|------|-------------|
+| `BUNQ_CLIENT_ID` | OAuth2 client ID from bunq Developer settings |
+| `BUNQ_CLIENT_SECRET` | OAuth2 client secret |
+| `BUNQ_ACCESS_TOKEN` | OAuth2 access token |
+| `BUNQ_INSTALLATION_TOKEN` | bunq installation token |
+| `BUNQ_SESSION_TOKEN` | bunq session token |
+| `BUNQ_USER_ID` | Your bunq user ID |
+| `BUNQ_PUBLIC_KEY` | RSA public key for bunq API |
+| `BUNQ_PRIVATE_KEY` | RSA private key for bunq API |
 
 ## Usage
 
@@ -50,13 +48,13 @@ This will:
 3. Start a local HTTP server to capture the OAuth2 callback
 4. Exchange the code for an `access_token`
 5. Register an RSA key pair, an installation and a device-server with the bunq API
-6. Create a session and save `sessionToken` + `userId` to config
+6. Create a session and save `sessionToken` + `userId` to keychain
 
-All credentials are persisted to `~/.config/bunk/config.json` (mode `0600`) so subsequent runs skip steps already completed.
+All credentials are persisted to your system keychain so subsequent runs skip steps already completed.
 
 ---
 
-### 2. Fetch events
+### 2. Fetch payments
 
 ```bash
 bunk fetch
@@ -68,46 +66,31 @@ bunk fetch --verbose
 bunk fetch --clean
 ```
 
-Downloads all bunq events (payments, card actions, etc.) from the API and stores the raw JSON in a local SQLite database.
+Downloads Payments for each monetary account and stores a normalized row per payment in a local SQLite database. The tool only fetches the `payment` collection (no other event types).
 
-- On the **first run** (empty database) it performs a full backfill, paginating back in time until there are no more events.
-- On **subsequent runs** it only fetches events newer than the highest `id` already stored.
+On the **first run** (empty database) it performs a full backfill, paginating back in time until there are no more payments. On **subsequent runs** it only fetches payments newer than the highest `id` already stored.
 
-Events are stored in the `events` table:
+Payments are stored in the `payment` table with a normalized schema:
 
 ```sql
-CREATE TABLE events (
-  id      INTEGER PRIMARY KEY,
-  content TEXT NOT NULL        -- raw bunq event JSON
+CREATE TABLE payment (
+  id INTEGER PRIMARY KEY,
+  monetary_account_id INTEGER NOT NULL,
+  created TEXT,
+  amount_value TEXT,
+  amount_currency TEXT,
+  alias_iban TEXT,
+  alias_name TEXT,
+  counterparty_alias_iban TEXT,
+  counterparty_alias_name TEXT,
+  description TEXT,
+  type TEXT,
+  sub_type TEXT,
+  balance_value TEXT,
+  balance_currency TEXT
 );
-```
 
----
-
-### 3. Index payments
-
-```bash
-bunk index
-# or specify a custom database path
-bunk index --output ~/bunq/index.sqlite
-```
-
-Extracts structured payment data from the raw `events` table into a `payments` table for easy querying. Supports both **Payment** and **MasterCardAction** event types.
-
-```sql
-CREATE TABLE payments (
-  event_id          INTEGER PRIMARY KEY,
-  created_at        TEXT,
-  account_id        TEXT,
-  amount_value      REAL,      -- negative for card payments / debits
-  amount_currency   TEXT,
-  status            TEXT,
-  description       TEXT,
-  counterparty_name TEXT,
-  counterparty_iban TEXT,
-  my_name           TEXT,
-  my_iban           TEXT
-);
+CREATE INDEX IF NOT EXISTS idx_payment_account ON payment (monetary_account_id);
 ```
 
 ---
@@ -115,39 +98,37 @@ CREATE TABLE payments (
 ## Example queries
 
 ```sql
--- Last 20 transactions
-SELECT event_id, created_at, amount_value, amount_currency, counterparty_name, description
-FROM payments
-ORDER BY created_at DESC
+-- Last 20 payments
+SELECT id, created, amount_value, amount_currency, counterparty_alias_name AS counterparty_name, description
+FROM payment
+ORDER BY created DESC
 LIMIT 20;
 
--- Total spent per counterparty (debits only)
-SELECT counterparty_name, ROUND(SUM(amount_value), 2) AS total
-FROM payments
-WHERE amount_value < 0
-GROUP BY counterparty_name
+-- Total spent per counterparty (outgoing payments have negative amounts relative to the account)
+SELECT counterparty_alias_name AS counterparty_name, ROUND(SUM(CAST(amount_value AS REAL)), 2) AS total
+FROM payment
+WHERE CAST(amount_value AS REAL) < 0
+GROUP BY counterparty_alias_name
 ORDER BY total ASC
 LIMIT 20;
 
--- All card payments this month
-SELECT created_at, amount_value, description, counterparty_name
-FROM payments
-WHERE status != 'COMPLETED'   -- MasterCardAction statuses differ
-  AND created_at >= date('now', 'start of month')
-ORDER BY created_at DESC;
+-- Payments this month
+SELECT created, amount_value, description, counterparty_alias_name
+FROM payment
+WHERE created >= date('now', 'start of month')
+ORDER BY created DESC;
 ```
 
 ---
 
 ## crontab
 
-To keep your local database up to date automatically, add the following to your crontab (`crontab -e`).  
-Adjust the Node.js path to match your environment (`node --version` to check):
+To keep your local database up to date automatically, add the following to your crontab (`crontab -e`).  Adjust the Node.js path to match your environment (`node --version` to check):
 
 ```crontab
 HOME=/Users/your_username
 PATH=/Users/your_username/.nvm/versions/node/v22.20.0/bin:/usr/local/bin:/usr/bin:/bin
 
-# Fetch new bunq events and index payments every 15 minutes
-*/15 * * * * bunk fetch && bunk index >> $HOME/bunk.log 2>&1
+# Fetch new bunq payments every 15 minutes
+*/15 * * * * bunk fetch >> $HOME/bunk.log 2>&1
 ```

package/bin/bunk.js

@@ -3,7 +3,6 @@
 const { Command } = require('commander');
 const { auth } = require('../lib/auth');
 const { fetchEvents } = require('../lib/fetch');
-const { indexPayments } = require('../lib/index');
 
 const program = new Command();
 
@@ -14,7 +13,7 @@ program
 
 program
   .command('auth')
-  .description('Authenticate with bunq using OAuth2 and store tokens in ~/.config/bunk/config.txt')
+  .description('Authenticate with bunq using OAuth2 and store tokens in keyring')
   .option('-p, --port <port>', 'Local callback server port', (v) => parseInt(v, 10), 4589)
   .option('--host <host>', 'Local callback server host', '127.0.0.1')
   .action(async (opts) => {
@@ -31,15 +30,7 @@ program
     await fetchEvents(opts);
   });
 
-program
-  .command('index')
-  .description('Index latest events into payments table')
-  .option('-o, --output <path>', 'Output SQLite database path', '~/bunq/index.sqlite')
-  .action(async (opts) => {
-    await indexPayments(opts);
-  });
-
 program.parseAsync(process.argv).catch((err) => {
   console.error(err?.stack || String(err));
   process.exit(1);
-});
+});

package/lib/auth.js

@@ -4,8 +4,10 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const crypto = require("crypto");
+const { Entry } = require("@napi-rs/keyring")
 
 const environment = 'production'
+// const environment = 'sandbox'
 
 const domains = {
   sandbox: { 
@@ -21,38 +23,20 @@ const domains = {
 }
 
 
-function configDir() {
-  return path.join(os.homedir(), '.config', 'bunk');
-}
-
-function configPath() {
-  return path.join(configDir(), 'config.json');
-}
-
-function ensureDir(p) {
-  fs.mkdirSync(p, { recursive: true });
-}
-
-// config is stored as JSON; parsing/serialization is done inline in readExistingConfig/writeConfig
-
-function readExistingConfig() {
+function getSecret(name) {
   try {
-    const text = fs.readFileSync(configPath(), 'utf8');
-    const trimmed = String(text || '').trim();
-    if (!trimmed) return {};
-    const obj = JSON.parse(trimmed);
-    return obj && typeof obj === 'object' ? obj : {};
-  } catch {
-    return {};
+    return new Entry(name, 'personal').getPassword() || null;
+  } catch (e) {
+    console.error(e)
+    return null;
   }
 }
 
-function writeConfig(obj) {
-  ensureDir(configDir());
-  const text = JSON.stringify(obj || {}, null, 2) + '\n';
-  fs.writeFileSync(configPath(), text, { mode: 0o600 });
+function setSecret(name, value) {
+  new Entry(name, 'personal').setPassword(value);
 }
 
+
 function question(prompt) {
   return new Promise((resolve) => {
     process.stdout.write(prompt);
@@ -121,89 +105,30 @@ function signBody(body, privateKey) {
   return signer.sign(privateKey, "base64");
 }
 
-/*
-async function createSession({ access_token }) {
-  const res = await fetch(`https://${domains[environment].api}/v1/session-server`, {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/json',
-      'X-Bunq-Client-Authentication': access_token,
-      'X-Bunq-Language': 'en_US',
-      'X-Bunq-Region': 'nl_NL',
-      'X-Bunq-Client-Request-Id': Date.now().toString(),
-      'Cache-Control': 'no-cache'
-      // Authorization: `Bearer ${access_token}`,
-      // Accept: 'application/json',
-      // 'Content-Type': 'application/json',
-    },
-    body: JSON.stringify({}),
-  });
-
-  const text = await res.text();
-  let json;
-  try {
-    json = text ? JSON.parse(text) : {};
-  } catch {
-    json = { raw: text };
-  }
-
-  if (!res.ok) {
-    throw new Error(
-      `bunq session-server error (${res.status}): ${typeof text === 'string' ? text : JSON.stringify(json)}`,
-    );
-  }
-
-  const sessionToken = res.headers.get('x-bunq-client-authentication');
-  if (!sessionToken) {
-    throw new Error(
-      `Missing x-bunq-client-authentication header from session-server response. Body: ${text}`,
-    );
-  }
-
-  // Try to find user id in response payload.
-  // bunq responses are typically arrays of objects like {UserPerson:{...}} wrapped in Response.
-  let userId;
-  try {
-    const responses = Array.isArray(json.Response) ? json.Response : [];
-    for (const item of responses) {
-      if (!item || typeof item !== 'object') continue;
-      const v = item.UserPerson || item.UserCompany || item.UserLight || item.UserApiKey;
-      if (v && v.id) {
-        userId = v.id;
-        break;
-      }
-    }
-  } catch {
-    // ignore
-  }
-
-  return { sessionToken, session: json, userId };
-}
-*/
-
 async function auth({ host = '127.0.0.1', port = 4589 }) {
   const redirectUri = `http://${host}:${port}/callback`;
 
-  const existing = readExistingConfig();
-  let { 
-    clientId, clientSecret, 
-    accessToken, 
-    publicKey, privateKey, 
-    installationToken,
-    sessionToken,
-    userId
-  } = existing;
+  let userId = getSecret('BUNQ_USER_ID');
+  let clientId = getSecret('BUNQ_CLIENT_ID');
+  let clientSecret = getSecret('BUNQ_CLIENT_SECRET');
+  let accessToken = getSecret('BUNQ_ACCESS_TOKEN');
+  let publicKey = getSecret('BUNQ_PUBLIC_KEY');
+  let privateKey = getSecret('BUNQ_PRIVATE_KEY');
+  let installationToken = getSecret('BUNQ_INSTALLATION_TOKEN');
+  let sessionToken = getSecret('BUNQ_SESSION_TOKEN');
 
   if (!publicKey || !privateKey) {
-    const res = generateBunqKeyPair()
-    writeConfig({ ...existing, ...res });
-
+    const res = generateBunqKeyPair();
+    publicKey = res.publicKey;
+    privateKey = res.privateKey;
+    setSecret('BUNQ_PUBLIC_KEY', publicKey);
+    setSecret('BUNQ_PRIVATE_KEY', privateKey);
   }
   if (!clientId || !clientSecret) {
     console.log(`\nThis command will start a local HTTP server to capture bunq OAuth redirect.`);
     console.log(`1) In bunq Developer settings create an OAuth app (or edit existing).`);
     console.log(`2) Set Redirect URL to: ${redirectUri}`);
-    console.log(`\nThen paste the OAuth credentials here (they will be stored in ${configPath()}):\n`);
+    console.log(`\nThen paste the OAuth credentials here (they will be stored in your keychain):\n`);
 
     clientId = clientId || (await question(`client_id: `));
     clientSecret = clientSecret || (await question(`client_secret: `));
@@ -212,8 +137,8 @@ async function auth({ host = '127.0.0.1', port = 4589 }) {
       throw new Error('client_id and client_secret are required');
     }
 
-    // Save immediately
-    writeConfig({ ...readExistingConfig(), clientId, clientSecret, redirectUri });
+    setSecret('BUNQ_CLIENT_ID', clientId);
+    setSecret('BUNQ_CLIENT_SECRET', clientSecret);
   }
 
   if (!accessToken) {
@@ -222,8 +147,6 @@ async function auth({ host = '127.0.0.1', port = 4589 }) {
     authUrl.searchParams.set('response_type', 'code');
     authUrl.searchParams.set('client_id', clientId);
     authUrl.searchParams.set('redirect_uri', redirectUri);
-    // Keep scope optional; bunq may allow empty or require specific.
-    if (existing.scope) authUrl.searchParams.set('scope', existing.scope);
 
     const finalAuthUrl = authUrl.toString();
     console.log(`\nAuthorization URL (open in your browser):\n${finalAuthUrl}\n`);
@@ -298,11 +221,8 @@ async function auth({ host = '127.0.0.1', port = 4589 }) {
       throw new Error(`Token response missing access_token:\n${JSON.stringify(tokenRes)}`);
     }
 
-    accessToken = access_token
-    writeConfig({
-      ...readExistingConfig(),
-      accessToken: access_token
-    });
+    accessToken = access_token;
+    setSecret('BUNQ_ACCESS_TOKEN', accessToken);
   }
 
   if (!installationToken) {
@@ -328,14 +248,10 @@ async function auth({ host = '127.0.0.1', port = 4589 }) {
       throw new Error(`bunq installation token error (${res.status}): ${text}`);
     }
     res = await res.json();
-    console.log(JSON.stringify(res, null, "  "))
     installationToken = res.Response[1].Token.token;
 
 
-    writeConfig({
-      ...readExistingConfig(),
-      installationToken
-    });
+    setSecret('BUNQ_INSTALLATION_TOKEN', installationToken);
     console.log('Registering bunq device');
 
     const body = JSON.stringify({
@@ -386,7 +302,6 @@ async function auth({ host = '127.0.0.1', port = 4589 }) {
       throw new Error(`bunq device registration error (${res.status}): ${text}`);
     }
     res = await res.json()
-    console.log(JSON.stringify(res, null, "  "))
 
     const response = res?.Response ?? [];
 
@@ -398,16 +313,14 @@ async function auth({ host = '127.0.0.1', port = 4589 }) {
         response.find(x => x?.UserApiKey?.id != null)?.UserApiKey?.id ??
         null;
 
-    writeConfig({
-      ...readExistingConfig(),
-      sessionToken,
-      userId
-    });
+    setSecret('BUNQ_SESSION_TOKEN', sessionToken);
+    setSecret('BUNQ_USER_ID', String(userId));
 
   }
 
 
-  console.log(`\nSaved tokens + session to ${configPath()}`);
+  console.log(`\nSaved tokens + session to keychain`);
+  process.exit(0)
 }
 
-module.exports = { auth, configPath };
+module.exports = { auth, getSecret, setSecret };

package/lib/fetch.js

@@ -5,13 +5,13 @@ const path = require('path');
 // Node.js v25+ built-in SQLite
 const sqlite = require('node:sqlite');
 
-const { configPath } = require('./auth');
+const { getSecret, configPath } = require('./auth');
 
 const environment = 'production';
 const domains = {
   sandbox: {
     oauthApi: 'api-oauth.sandbox.bunq.com',
-    oauth: 'oauth.sandbox.bunq.com',
+    oauth: 'oauth.sanbox.bunq.com',
     api: 'public-api.sandbox.bunq.com',
   },
   production: {
@@ -21,6 +21,11 @@ const domains = {
   },
 };
 
+// Only fetch payments
+const COLLECTIONS = [
+  { name: 'payment', endpoint: 'payment' },
+];
+
 function expandHome(p) {
   if (!p) return p;
   if (p === '~') return os.homedir();
@@ -61,16 +66,35 @@ function getDb(dbPath) {
 }
 
 function ensureSchema(db) {
+  // Create a normalized table for payments. If the table already exists with other
+  // columns, attempt to add missing columns. This keeps compatibility with existing DBs.
   db.exec(`
-    CREATE TABLE IF NOT EXISTS events (
+    CREATE TABLE IF NOT EXISTS payment (
       id INTEGER PRIMARY KEY,
-      content TEXT NOT NULL
+      monetary_account_id INTEGER NOT NULL,
+      created TEXT,
+      amount_value TEXT,
+      amount_currency TEXT,
+      alias_iban TEXT,
+      alias_name TEXT,
+      counterparty_alias_iban TEXT,
+      counterparty_alias_name TEXT,
+      description TEXT,
+      type TEXT,
+      sub_type TEXT,
+      balance_value TEXT,
+      balance_currency TEXT
     );
   `);
+
+  // Index for faster lookups by account
+  db.exec(`
+    CREATE INDEX IF NOT EXISTS idx_payment_account ON payment (monetary_account_id);
+  `);
 }
 
-function getMaxId(db) {
-  const row = db.prepare('SELECT MAX(id) AS max_id FROM events').get();
+function getMaxId(db, tableName) {
+  const row = db.prepare(`SELECT MAX(id) AS max_id FROM ${tableName}`).get();
   return row && row.max_id ? Number(row.max_id) : 0;
 }
 
@@ -106,32 +130,96 @@ async function bunqGetJson(urlPath, { sessionToken } = {}) {
   return res.json();
 }
 
-function extractEvents(payload) {
+// Extract items from response based on collection type
+// bunq wraps items like { Response: [ { Payment: {...} }, ... ] }
+function extractItems(payload, collectionName) {
   const out = [];
   const arr = Array.isArray(payload?.Response) ? payload.Response : [];
   for (const item of arr) {
-    const ev = item?.Event;
-    if (ev && ev.id != null) out.push(ev);
+    // The key is the singular/capitalized version of the collection name
+    // e.g., 'payment' -> 'Payment'
+    const key = Object.keys(item || {}).find(k => k !== 'Pagination');
+    if (key && item[key] && item[key].id != null) {
+      out.push(item[key]);
+    }
   }
   return out;
 }
 
-async function fetchEvents(opts = {}) {
+function fetchMonetaryAccounts(userId, sessionToken) {
+  // Keep as async wrapper that calls bunqGetJson to match original signature
+  return bunqGetJson(`/v1/user/${userId}/monetary-account`, { sessionToken })
+    .then(json => {
+      const accounts = [];
+      const arr = Array.isArray(json?.Response) ? json.Response : [];
+      for (const item of arr) {
+        const key = Object.keys(item || {}).find(k => k.startsWith('MonetaryAccount'));
+        if (key && item[key] && item[key].id != null) {
+          accounts.push({
+            id: item[key].id,
+            type: key,
+            currency: item[key].currency,
+            balance: item[key].balance,
+          });
+        }
+      }
+      return accounts;
+    });
+}
+
+function normalizePayment(item, accountId) {
+  const created = item.created || null;
+  const amount_value = item.amount?.value ?? null;
+  const amount_currency = item.amount?.currency ?? null;
+
+  // alias: prefer top-level display_name, fallback to label_user.display_name
+  const alias_iban = item.alias?.iban ?? null;
+  const alias_name = item.alias?.display_name ?? item.alias?.label_user?.display_name ?? null;
+
+  const counterparty_alias_iban = item.counterparty_alias?.iban ?? null;
+  const counterparty_alias_name = item.counterparty_alias?.display_name ?? item.counterparty_alias?.label_user?.display_name ?? null;
+
+  const description = item.description ?? null;
+  const type = item.type ?? null;
+  const sub_type = item.sub_type ?? null;
+
+  const balance_value = item.balance_after_mutation?.value ?? null;
+  const balance_currency = item.balance_after_mutation?.currency ?? null;
+
+  return {
+    id: Number(item.id),
+    monetary_account_id: Number(accountId),
+    created,
+    amount_value,
+    amount_currency,
+    alias_iban,
+    alias_name,
+    counterparty_alias_iban,
+    counterparty_alias_name,
+    description,
+    type,
+    sub_type,
+    balance_value,
+    balance_currency,
+  };
+}
+
+// Fetch items for a specific collection from a monetary account
+async function fetchCollection(opts = {}) {
   const verbose = !!opts.verbose;
   const clean = !!opts.clean;
 
-  const cfg = readExistingConfig();
-  const sessionToken = cfg.sessionToken;
-  const userId = cfg.userId;
+  const sessionToken = getSecret('BUNQ_SESSION_TOKEN');
+  const userId = getSecret('BUNQ_USER_ID');
 
   if (!sessionToken) {
-    throw new Error(`Missing sessionToken in ${configPath()}. Run: bunk auth`);
+    throw new Error(`Missing sessionToken in keychain. Run: bunk auth`);
   }
   if (!userId) {
-    throw new Error(`Missing userId in ${configPath()}. Run: bunk auth`);
+    throw new Error(`Missing userId in keychain. Run: bunk auth`);
   }
 
-  const dbPath = resolveDbPath(opts, cfg);
+  const dbPath = resolveDbPath(opts);
 
   if (clean) {
     if (verbose) console.log(`--clean: removing ${dbPath} (and -wal/-shm)`);
@@ -142,19 +230,61 @@ async function fetchEvents(opts = {}) {
   try {
     ensureSchema(db);
 
-    const maxId = getMaxId(db);
-    const isEmpty = maxId === 0;
+    // Get monetary accounts
+    if (verbose) console.log('Fetching monetary accounts...');
+    const accounts = await fetchMonetaryAccounts(userId, sessionToken);
+    console.log(`Found ${accounts.length} monetary account(s): ${accounts.map(a => a.id).join(', ')}`);
 
-    // per your comment: if collection is empty behave like --all
-    const modeAll = isEmpty;
+    const count = 200;
+    let totalInserted = 0;
+    let totalPages = 0;
+
+    // Prepare insert statements for payment only
+    const inserters = {};
+    for (const col of COLLECTIONS) {
+      if (col.name === 'payment') {
+        inserters[col.name] = db.prepare(
+          `INSERT OR REPLACE INTO payment (
+            id, monetary_account_id, created,
+            amount_value, amount_currency,
+            alias_iban, alias_name,
+            counterparty_alias_iban, counterparty_alias_name,
+            description, type, sub_type,
+            balance_value, balance_currency
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+        );
+      } else {
+        inserters[col.name] = db.prepare(
+          `INSERT OR REPLACE INTO ${col.name} (id, monetary_account_id, content) VALUES (?, ?, ?)`
+        );
+      }
+    }
 
-    // Insert/upsert (node:sqlite does not provide db.transaction like better-sqlite3)
-    const ins = db.prepare('INSERT OR REPLACE INTO events (id, content) VALUES (?, ?)');
-    const insertMany = (events) => {
+    const insertMany = (tableName, items, accountId) => {
       db.exec('BEGIN');
       try {
-        for (const ev of events) {
-          ins.run(Number(ev.id), JSON.stringify(ev));
+        for (const item of items) {
+          if (tableName === 'payment') {
+            const p = normalizePayment(item, accountId);
+            inserters.payment.run(
+              p.id,
+              p.monetary_account_id,
+              p.created,
+              p.amount_value,
+              p.amount_currency,
+              p.alias_iban,
+              p.alias_name,
+              p.counterparty_alias_iban,
+              p.counterparty_alias_name,
+              p.description,
+              p.type,
+              p.sub_type,
+              p.balance_value,
+              p.balance_currency
+            );
+          } else {
+            inserters[tableName].run(Number(item.id), Number(accountId), JSON.stringify(item));
+          }
         }
         db.exec('COMMIT');
       } catch (e) {
@@ -165,68 +295,81 @@ async function fetchEvents(opts = {}) {
       }
     };
 
-    const count = 200;
-
-    let nextPath;
-    if (modeAll) {
-      nextPath = `/v1/user/${userId}/event?count=${count}`;
-      console.log(`Database: ${dbPath}`);
-      console.log(`events table empty -> full backfill mode (count=${count})`);
-    } else {
-      // Only fetch newer than current max id
-      nextPath = `/v1/user/${userId}/event?count=${count}&newer_id=${encodeURIComponent(String(maxId))}`;
-      console.log(`Database: ${dbPath}`);
-      console.log(`Fetching newer events since id=${maxId} (count=${count})`);
-    }
-
-    let pages = 0;
-    let inserted = 0;
-
-    let lastPath = null;
-    while (nextPath) {
-      // Detect non-advancing pagination
-      if (nextPath === lastPath) {
-        if (verbose) console.warn(`Pagination did not advance (stuck on ${nextPath}). Stopping.`);
-        break;
-      }
-      lastPath = nextPath;
-
-      pages++;
-      if (verbose) console.log(`GET ${nextPath}`);
-      const json = await bunqGetJson(nextPath, { sessionToken });
+    // Process each monetary account
+    for (const account of accounts) {
+      console.log(`\nProcessing monetary account ${account.id} (${account.type})...`);
+
+      // Process each collection for this account (only payment)
+      for (const col of COLLECTIONS) {
+        const isEmpty = getMaxId(db, col.name) === 0;
+        const modeAll = isEmpty;
+
+        let nextPath;
+        if (modeAll) {
+          nextPath = `/v1/user/${userId}/monetary-account/${account.id}/${col.endpoint}?count=${count}`;
+        } else {
+          const maxId = getMaxId(db, col.name);
+          nextPath = `/v1/user/${userId}/monetary-account/${account.id}/${col.endpoint}?count=${count}&newer_id=${maxId}`;
+        }
 
-      const events = extractEvents(json);
-      if (events.length) {
-        insertMany(events);
-        inserted += events.length;
-      }
+        if (verbose) {
+          console.log(`  [${col.name}] ${modeAll ? 'full backfill' : 'incremental (since id=' + getMaxId(db, col.name) + ')'} `);
+        }
 
-      const pag = json?.Pagination || {};
-      if (modeAll) {
-        // walk back in time until older_url is null
-        nextPath = pag.older_url || null;
-      } else {
-        // When using newer_id, bunq may keep returning future_url=null.
-        // In that case, stop after the first page.
-        nextPath = pag.future_url || null;
-        if (!nextPath) {
-          break;
+        let pages = 0;
+        let inserted = 0;
+        let lastPath = null;
+
+        while (nextPath) {
+          if (nextPath === lastPath) {
+            if (verbose) console.warn(`    Pagination did not advance. Stopping.`);
+            break;
+          }
+          lastPath = nextPath;
+
+          pages++;
+          if (verbose) console.log(`    GET ${nextPath}`);
+          const json = await bunqGetJson(nextPath, { sessionToken });
+
+          const items = extractItems(json, col.name);
+          if (items.length) {
+            insertMany(col.name, items, account.id);
+            inserted += items.length;
+          }
+
+          const pag = json?.Pagination || {};
+          if (modeAll) {
+            // Walk back in time until older_url is null
+            nextPath = pag.older_url || null;
+          } else {
+            // Incremental: use future_url for newer items
+            nextPath = pag.future_url || null;
+            if (!nextPath) break;
+          }
+
+          if (!verbose) {
+            process.stdout.write(`\r  [${col.name}] pages=${pages} inserted=${inserted}    `);
+          }
+
+          if (pages > 100_000) throw new Error(`Too many pages for ${col.name}; aborting`);
         }
-      }
 
-      if (!verbose) {
-        process.stdout.write(`\rpages=${pages} inserted=${inserted}`);
+        if (!verbose) process.stdout.write('\n');
+        if (verbose || inserted > 0) {
+          console.log(`  [${col.name}] Done: ${inserted} items in ${pages} pages`);
+        }
+        totalInserted += inserted;
+        totalPages += pages;
       }
-
-      // Safety: prevent infinite loops if API misbehaves
-      if (pages > 1_000_000) throw new Error('too many pages; aborting');
     }
 
-    if (!verbose) process.stdout.write('\n');
-    console.log(`Done. pages=${pages}, inserted=${inserted}, maxId(now)=${getMaxId(db)}`);
+    console.log(`\nAll done. Total inserted: ${totalInserted} items across ${accounts.length} account(s)`);
   } finally {
     db.close();
   }
 }
 
-module.exports = { fetchEvents };
+// For backwards compatibility, alias fetchEvents to fetchCollection
+const fetchEvents = fetchCollection;
+
+module.exports = { fetchEvents, fetchCollection, COLLECTIONS };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iovdin/bunk",
-  "version": "1.0.2",
+  "version": "1.0.5",
   "homepage": "https://github.com/iovdin/bunk#readme",
   "description": "bunq CLI download and index transactions into sqlite database",
   "type": "commonjs",
@@ -18,6 +18,7 @@
     "start": "node bin/bunk.js"
   },
   "dependencies": {
+    "@napi-rs/keyring": "^1.1.0",
     "commander": "^14.0.3"
   },
   "author": "Ilya Ovdin <iovdin@gmail.com>",

package/lib/index.js

@@ -1,116 +0,0 @@
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const sqlite = require('node:sqlite');
-
-function expandHome(p) {
-  if (!p) return p;
-  if (p === '~') return os.homedir();
-  if (p.startsWith('~/') || p.startsWith('~\\')) return path.join(os.homedir(), p.slice(2));
-  return p;
-}
-
-function ensureDir(p) {
-  fs.mkdirSync(p, { recursive: true });
-}
-
-function getDb(dbPath) {
-  ensureDir(path.dirname(dbPath));
-  const db = new sqlite.DatabaseSync(dbPath);
-  db.exec('PRAGMA journal_mode = WAL;');
-  db.exec('PRAGMA synchronous = NORMAL;');
-  return db;
-}
-
-function ensurePaymentsSchema(db) {
-  db.exec(`
-    CREATE TABLE IF NOT EXISTS payments (
-      event_id INTEGER PRIMARY KEY,
-      created_at TEXT,
-      account_id TEXT,
-      amount_value REAL,
-      amount_currency TEXT,
-      status TEXT,
-      description TEXT,
-      counterparty_name TEXT,
-      counterparty_iban TEXT,
-      my_name TEXT,
-      my_iban TEXT
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_payments_created_at ON payments(created_at);
-    CREATE INDEX IF NOT EXISTS idx_payments_status ON payments(status);
-    CREATE INDEX IF NOT EXISTS idx_payments_counterparty_name ON payments(counterparty_name);
-  `);
-}
-
-function indexPayments(opts = {}) {
-  const dbPath = expandHome(opts.output || '~/bunq/index.sqlite');
-  const db = getDb(dbPath);
-
-  try {
-    ensurePaymentsSchema(db);
-
-    const row = db.prepare('SELECT COALESCE(MAX(event_id), 0) AS max_event_id FROM payments').get();
-    const maxEventId = Number(row?.max_event_id || 0);
-
-    const sql = `
-      INSERT OR IGNORE INTO payments (
-        event_id,
-        created_at,
-        account_id,
-        amount_value,
-        amount_currency,
-        status,
-        description,
-        counterparty_name,
-        counterparty_iban,
-        my_name,
-        my_iban
-      )
-      SELECT
-        json_extract(content, '$.id') AS event_id,
-        json_extract(content, '$.created') AS created_at,
-        json_extract(content, '$.monetary_account_id') AS account_id,
-        CAST(json_extract(content, '$.object.Payment.amount.value') AS REAL) AS amount_value,
-        json_extract(content, '$.object.Payment.amount.currency') AS amount_currency,
-        json_extract(content, '$.status') AS status,
-        json_extract(content, '$.object.Payment.description') AS description,
-        json_extract(content, '$.object.Payment.counterparty_alias.display_name') AS counterparty_name,
-        json_extract(content, '$.object.Payment.counterparty_alias.iban') AS counterparty_iban,
-        json_extract(content, '$.object.Payment.alias.display_name') AS my_name,
-        json_extract(content, '$.object.Payment.alias.iban') AS my_iban
-      FROM events
-      WHERE json_type(content, '$.object.Payment') = 'object'
-        AND CAST(json_extract(content, '$.id') AS INTEGER) > ?
-
-      UNION ALL
-
-      SELECT
-        json_extract(content, '$.id') AS event_id,
-        json_extract(content, '$.created') AS created_at,
-        json_extract(content, '$.monetary_account_id') AS account_id,
-        -ABS(CAST(json_extract(content, '$.object.MasterCardAction.amount_local.value') AS REAL)) AS amount_value,
-        json_extract(content, '$.object.MasterCardAction.amount_local.currency') AS amount_currency,
-        json_extract(content, '$.object.MasterCardAction.payment_status') AS status,
-        json_extract(content, '$.object.MasterCardAction.description') AS description,
-        json_extract(content, '$.object.MasterCardAction.counterparty_alias.display_name') AS counterparty_name,
-        json_extract(content, '$.object.MasterCardAction.counterparty_alias.iban') AS counterparty_iban,
-        json_extract(content, '$.object.MasterCardAction.alias.display_name') AS my_name,
-        json_extract(content, '$.object.MasterCardAction.alias.iban') AS my_iban
-      FROM events
-      WHERE json_type(content, '$.object.MasterCardAction') = 'object'
-        AND CAST(json_extract(content, '$.id') AS INTEGER) > ?
-    `;
-
-    const before = db.prepare('SELECT COUNT(*) AS n FROM payments').get().n;
-    db.prepare(sql).run(maxEventId, maxEventId);
-    const after = db.prepare('SELECT COUNT(*) AS n FROM payments').get().n;
-
-    console.log(`Indexed payments: +${after - before} (total=${after}) from events newer than event_id=${maxEventId}`);
-  } finally {
-    db.close();
-  }
-}
-
-module.exports = { indexPayments };