orla-il-banks 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Digital Flow Pte. Ltd.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,204 @@
+# orla-il-banks
+
+Israeli bank and card transactions into your [Orla](https://orla.finance) books.
+It runs on your machine, or in a private GitHub repository of your own. Your
+bank passwords stay there: Orla only receives the rows.
+
+It is a thin layer over [israeli-bank-scrapers](https://github.com/eshaham/israeli-bank-scrapers),
+which logs into the bank's website the way you would, with a real browser. What
+this package adds is the part that decides what the rows mean in your books,
+and the delivery to Orla.
+
+> **Status: early.** The mapping is covered by tests against the library's data
+> shapes. The maintainers have not yet run it live against every bank below. If
+> yours misbehaves, open an issue with what the run printed (it prints no
+> passwords and no account numbers).
+
+## Why it works this way
+
+Orla does not connect Israeli banks itself, and will not ask for your bank
+password: a password to online banking can do everything you can do there,
+including sending money, and no service should hold that for thousands of
+people. This runner keeps the password with you and sends Orla only what a
+statement would show.
+
+## Supported
+
+| Id | Institution | Kind in Orla |
+|---|---|---|
+| `hapoalim` | Bank Hapoalim | bank, **from your own computer**, after `trust` once (see below) |
+| `leumi` | Bank Leumi | bank |
+| `mizrahi` | Mizrahi Tefahot | bank |
+| `discount` | Discount Bank | bank |
+| `mercantile` | Mercantile Bank | bank |
+| `otsarHahayal` | Bank Otsar Hahayal | bank |
+| `union` | Union Bank | bank |
+| `beinleumi` | First International (Beinleumi) | bank |
+| `massad` | Bank Massad | bank |
+| `yahav` | Bank Yahav | bank |
+| `pagi` | Bank Pagi | bank |
+| `oneZero` | One Zero | bank, **from a terminal only**: it asks for a code at every login |
+| `isracard` | Isracard | card |
+| `amex` | American Express Israel | card |
+| `max` | Max | card |
+| `visaCal` | Visa Cal | card |
+| `beyahadBishvilha` | Beyahad Bishvilha | card (prepaid) |
+
+`orla-il-banks companies` prints the fields each one needs.
+
+### Bank Hapoalim and a new computer
+
+Since March 2026 Bank Hapoalim sends an SMS code when a login comes from a
+device it has not seen, and the scraping library has no way through that page
+(upstream [#1077](https://github.com/eshaham/israeli-bank-scrapers/issues/1077)).
+A browser started fresh is a new device every time, so the runner keeps one
+browser profile per Hapoalim login on your computer, and you introduce it to
+the bank once:
+
+```bash
+npx orla-il-banks@0.1.0 trust hapoalim --config ~/.orla-il-banks.json
+```
+
+A browser window opens on the bank's own login page. Log in there, with the
+code the bank sends; the window closes by itself when the bank shows your
+accounts. Your password and the code go into the bank's page, not into this
+program. From then on `run` logs in from that profile.
+
+- The profile lives in `~/.orla-il-banks/profiles` (move it with
+  `--profile-dir` or `ORLA_IL_PROFILE_DIR`), readable by you only. It holds a
+  bank session: delete the folder to make this computer a stranger again.
+- Not in GitHub Actions and not in Docker: a runner is a new device on every
+  run, and keeping the profile there would put a bank session in a cache. The
+  runner skips Hapoalim there and says so.
+- Whether the bank keeps recognising the profile, and for how long, is the
+  bank's call. If a run fails with a hint to trust again, do.
+
+Not supported: **Behatsdaa**. It is the order history of a benefits shop, and
+each order there was paid with a card; with that card connected too, every
+order would count twice.
+
+## Set up
+
+1. **In Orla**, open Integrations, then **Israeli banks**, and issue a key. It
+   is shown once. It can only add transactions to this one source, and it
+   expires (you choose when, up to a year).
+2. **Check the browser** on the machine that will run this:
+
+   ```bash
+   npx orla-il-banks@0.1.0 check-browser
+   ```
+
+   It starts the browser on an empty page and closes it. It touches no bank.
+
+3. Pick one of the three ways to run it below.
+
+### On your computer
+
+Write a config file and make it readable by you only; the runner refuses a file
+anyone else can read.
+
+```bash
+cp examples/orla-il-banks.example.json ~/.orla-il-banks.json
+chmod 600 ~/.orla-il-banks.json
+# edit it: your Orla key, then one entry per bank or card
+npx orla-il-banks@0.1.0 run --config ~/.orla-il-banks.json --dry-run
+npx orla-il-banks@0.1.0 run --config ~/.orla-il-banks.json
+```
+
+`--dry-run` logs into the banks and prints what it would send, without
+sending. Run it daily with cron or launchd. The first time, `--days 365` brings
+a year of history.
+
+### In a private GitHub repository
+
+The machine does not have to be on. Create a **private** repository, copy
+[`templates/github-actions/orla-il-banks.yml`](templates/github-actions/orla-il-banks.yml)
+to `.github/workflows/` in it, and add two secrets:
+
+- `ORLA_TOKEN`: the key from Orla.
+- `ORLA_IL_ACCOUNTS`: your logins, as one JSON list:
+
+  ```json
+  [{"company": "hapoalim", "userCode": "AB12345", "password": "..."},
+   {"company": "max", "username": "...", "password": "..."}]
+  ```
+
+Bank Hapoalim does not run here (see above): the runner skips it with the
+reason. The runner checks that the repository is private and stops if it is not:
+public repositories have public run logs. It also masks every password in the
+log one by one, since GitHub masks the whole secret but not the values inside
+it.
+
+Your passwords then live in GitHub's secret store and the logins come from
+GitHub's servers, outside Israel. We have not measured whether any bank treats
+that differently; if yours starts asking for extra verification, run it from
+your own computer instead.
+
+### In Docker
+
+```bash
+docker build -t orla-il-banks .
+docker run --rm orla-il-banks check-browser
+docker run --rm --env-file ~/.orla-il-banks.env orla-il-banks run
+```
+
+with `ORLA_TOKEN=...` and `ORLA_IL_ACCOUNTS=[...]` in the env file (`chmod 600`
+it). The image runs Debian's Chromium as a non-root user, with the browser's
+sandbox off: containers usually lack what the sandbox needs.
+
+## What lands in your books
+
+- **Completed rows only.** A pending row has no stable id and comes back as a
+  completed one later; sending both would book it twice.
+- **A purchase on the day it was made, an installment on the day it was
+  charged**, for the amount charged that month. The note says
+  `Installment 3 of 12, purchase total 1200.00 ILS`.
+- **The amount charged**, in the currency charged. A purchase abroad keeps its
+  original amount in the note.
+- **Israeli days.** A purchase at 00:30 in Tel Aviv books on that day, wherever
+  the runner runs.
+- **One money-in row per billing cycle on each credit card.** Your bank pays
+  the card's month in one line, and the card lists the same purchases one by
+  one. Without a counterpart both would count as spending. So on each billing
+  day the card account gets `Billing cycle payment`, equal to what the card
+  charged. Orla then suggests linking it with the bank's line for that day as
+  a transfer: one click per card per month. If the two amounts differ (a fee,
+  a card billed in two currencies), there is no suggestion and you link them
+  by hand. A cycle row is sent only once its billing day has come.
+- **Account numbers do not travel.** Orla gets a hash to recognise the account
+  and a name like `Bank Hapoalim ••8901`.
+- **One delivery per login.** Orla links a move between two accounts of the same
+  login as a transfer by itself, the way it does for a bank it connects. Across
+  banks and cards it only suggests: a card refund and an unrelated bank payment
+  of the same amount on the same day must never be glued into a transfer. It
+  also means Orla's Connections page lists each bank's run on its own, and you
+  can undo one without the others.
+
+Every row has its own id, so running twice, or re-running after a failure,
+files nothing twice. For the same reason **undoing a delivery in Orla is final
+for its rows**: later runs recognise them and do not file them again.
+
+## When something fails
+
+| It says | Do |
+|---|---|
+| `the browser did not start` | Run `check-browser`. On Ubuntu 24.04, see the `sysctl` line in the template. |
+| `Bank Hapoalim: ... this computer is new to it` | Run `orla-il-banks trust hapoalim` once and log in on the bank's page. |
+| `Orla refused the key` | The key expired or was revoked. Issue a new one on the Israeli banks card. |
+| `<bank>: failed. invalidPassword` | Log in on the bank's site by hand once; banks lock after a few failures. |
+| `<bank>: failed. changePassword` | The bank wants a new password. Change it on the site, then in your config. |
+| `N refused` | Orla named the field for each refused row. Open an issue with the message. |
+
+Exit status: `0` everything went through, `1` a bank or the delivery failed,
+`2` the command line or the config is wrong.
+
+## Updating
+
+Banks change their sites, and israeli-bank-scrapers follows. Each release of
+this package pins one version of it, and one exact set of everything beneath
+it. Raise the version in your workflow on purpose, after reading the release
+notes, not by pointing it at `latest`.
+
+## License
+
+MIT. See [SECURITY.md](SECURITY.md) to report a vulnerability.

package/dist/args.js

@@ -0,0 +1,44 @@
+/**
+ * The grammar, on its own so a test can read it back. Two commands and a
+ * handful of flags; what breaks here is the quiet case, a flag that takes a
+ * value swallowing the next flag as that value.
+ */
+export function parse(argv) {
+    const words = [];
+    const flags = {};
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (!arg.startsWith("--")) {
+            words.push(arg);
+            continue;
+        }
+        const name = arg.slice(2);
+        const next = argv[i + 1];
+        if (next === undefined || next.startsWith("--")) {
+            flags[name] = true;
+        }
+        else {
+            flags[name] = next;
+            i += 1;
+        }
+    }
+    return { words, flags };
+}
+export function optional(flags, name) {
+    const value = flags[name];
+    return typeof value === "string" ? value : undefined;
+}
+//: Every flag `run` understands. Anything else is a typo, and a typo in
+//: `--dry-run` would otherwise send the rows the person meant to preview.
+export const RUN_FLAGS = new Set([
+    "config",
+    "days",
+    "dry-run",
+    "only",
+    "from-json",
+    "save-json",
+    "show-browser",
+    "profile-dir",
+]);
+//: What `trust` understands. It reads the config only to name the profile.
+export const TRUST_FLAGS = new Set(["config", "profile-dir"]);

package/dist/browser.js

@@ -0,0 +1,10 @@
+/**
+ * Browser flags shared by the scrape and the trust flow, on their own so that
+ * neither the command line nor the trust flow loads the scraping library to get
+ * them.
+ */
+export function browserArgs(env) {
+    // Chromium's sandbox needs kernel features a container or a hardened CI
+    // runner often lacks. Turned off only when asked, and the Docker image asks.
+    return env["ORLA_IL_NO_SANDBOX"] === "1" ? ["--no-sandbox", "--disable-setuid-sandbox"] : [];
+}

package/dist/cli.js

@@ -0,0 +1,360 @@
+#!/usr/bin/env node
+/**
+ * orla-il-banks: read Israeli bank and card accounts on this machine and file
+ * the rows into Orla through the push door.
+ *
+ * The order of a run is the order of trust: everything that can be checked
+ * without a bank is checked first (config, file permissions, the repository
+ * being private), then the banks are read one by one, then the rows are sent.
+ * A bank that fails does not stop the others, and nothing is sent for it.
+ */
+import { chmodSync, readFileSync, writeFileSync } from "node:fs";
+import { createInterface } from "node:readline/promises";
+import { optional, parse, RUN_FLAGS, TRUST_FLAGS } from "./args.js";
+import { COMPANIES, isCompany, LEFT_OUT } from "./companies.js";
+import { ConfigError, guardActions, loadConfig, redact, secretsOf } from "./config.js";
+import { israelDay, mapAccount } from "./map.js";
+import { defaultProfileBase, profileDir } from "./profile.js";
+import { push, PushError } from "./push.js";
+import { needsTrustHint, trustDevice } from "./trust.js";
+// The library reads the banks' dates in the process's zone. Pinned before any
+// bank is read, so a run on a UTC server books the same days as one in Haifa.
+process.env["TZ"] = "Asia/Jerusalem";
+const EXIT = { ok: 0, failure: 1, usage: 2 };
+//: Every password and key of this run, once the config is read, so that even
+//: an error nobody expected is printed without them.
+let SECRETS = [];
+const VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"))
+    .version;
+const HELP = `orla-il-banks ${VERSION}
+
+Reads Israeli bank and card accounts on this machine and files the rows into
+Orla. Your bank passwords stay here; Orla only receives the rows.
+
+Usage:
+  orla-il-banks run [--config <file>] [--days <n>] [--dry-run] [--only <ids>]
+  orla-il-banks companies
+  orla-il-banks check-browser
+  orla-il-banks trust <company> [--config <file>]
+
+run:
+  --config <file>     JSON with orla.url, orla.token, days and accounts.
+                      Must be readable by you only (chmod 600).
+                      Without it: ORLA_TOKEN, ORLA_IL_ACCOUNTS, ORLA_URL, ORLA_IL_DAYS.
+  --days <n>          how far back to read, 1 to 730 (default 90)
+  --dry-run           read the banks and show what would be sent; send nothing
+  --only <ids>        only these companies, comma separated (e.g. isracard,max)
+  --save-json <file>  also save what the banks returned (readable by you only)
+  --from-json <file>  send a saved file instead of reading the banks
+  --show-browser      show the browser while it logs in, for debugging
+  --profile-dir <dir> where kept browser profiles live (default ~/.orla-il-banks/profiles)
+
+check-browser starts the browser on an empty page and closes it. Run it
+first on a new machine, container or CI runner: it touches no bank.
+
+trust opens a bank's own login page on the browser profile later runs use.
+Log in there yourself, with the code the bank sends; the window closes when
+the bank shows your accounts. Needed once per computer for Bank Hapoalim,
+which asks for a code whenever a login comes from a device it does not know.
+
+Exit status: 0 everything went through, 1 a bank or the delivery failed,
+2 the command line or the config is wrong.
+`;
+function fail(message, code) {
+    process.stderr.write(`orla-il-banks: ${message}\n`);
+    process.exit(code);
+}
+function companiesText() {
+    const lines = Object.entries(COMPANIES).map(([id, spec]) => {
+        const note = "otp" in spec
+            ? "  (asks for a code at every login: run it from a terminal)"
+            : "trustedDevice" in spec
+                ? `  (once per computer: orla-il-banks trust ${id})`
+                : "";
+        return `  ${id.padEnd(18)} ${spec.name.padEnd(20)} ${spec.fields.join(", ")}${note}`;
+    });
+    const out = Object.entries(LEFT_OUT).map(([id, why]) => `  ${id.padEnd(18)} not supported: ${why}`);
+    return `Company id          Name                 Config fields\n${lines.join("\n")}\n\n${out.join("\n")}\n`;
+}
+function readSaved(path) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        throw new ConfigError(`${path} is not a file saved by --save-json`);
+    }
+    if (!Array.isArray(parsed))
+        throw new ConfigError(`${path} is not a file saved by --save-json`);
+    return parsed;
+}
+function onlyList(raw) {
+    if (!raw)
+        return null;
+    const ids = raw.split(",").map((id) => id.trim()).filter(Boolean);
+    for (const id of ids) {
+        if (!isCompany(id))
+            throw new ConfigError(`--only: unknown company "${id}"`);
+    }
+    return new Set(ids);
+}
+async function ask(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        return (await rl.question(question)).trim();
+    }
+    finally {
+        rl.close();
+    }
+}
+async function readBanks(config, only, showBrowser, secrets, profileBase) {
+    const { scrape } = await import("./scrape.js");
+    const startDate = new Date(Date.now() - config.days * 24 * 3600 * 1000);
+    const read = [];
+    let failed = 0;
+    for (const account of config.accounts) {
+        if (only && !only.has(account.company))
+            continue;
+        const spec = COMPANIES[account.company];
+        const name = spec.name;
+        if ("otp" in spec && !process.stdin.isTTY) {
+            process.stderr.write(`${name}: skipped. It asks for a code at every login, so it only runs from a terminal.\n`);
+            failed += 1;
+            continue;
+        }
+        let kept;
+        if ("trustedDevice" in spec) {
+            if (process.env["GITHUB_ACTIONS"] === "true" || process.env["ORLA_IL_EPHEMERAL"] === "1") {
+                // A runner or a container is a new device every time, and keeping the
+                // profile there would mean a bank session in a cache or an image.
+                const where = process.env["GITHUB_ACTIONS"] === "true" ? "a GitHub runner" : "this container";
+                process.stderr.write(`${name}: skipped. It asks for a code whenever a login comes from a device it does not know, and ${where} is new every time. Run it from your own computer.\n`);
+                failed += 1;
+                continue;
+            }
+            try {
+                kept = profileDir(profileBase, account.company, account.credentials);
+            }
+            catch (error) {
+                if (!(error instanceof ConfigError))
+                    throw error;
+                process.stderr.write(`${name}: skipped. ${error.message}\n`);
+                failed += 1;
+                continue;
+            }
+        }
+        process.stdout.write(`${name}: logging in\n`);
+        const outcome = await scrape(account, { startDate, showBrowser, ask, env: process.env, profileDir: kept });
+        if (!outcome.ok) {
+            process.stderr.write(`${name}: failed. ${redact(outcome.error, secrets)}\n`);
+            if (needsTrustHint(account.company, outcome.error)) {
+                process.stderr.write(`${name}: if the bank asked for a code, this computer is new to it. Run \`orla-il-banks trust ${account.company}\` once, log in on the bank's page, then run again.\n`);
+            }
+            failed += 1;
+            continue;
+        }
+        read.push({ company: account.company, accounts: outcome.accounts });
+    }
+    return { read, failed };
+}
+async function run(flags) {
+    const unknown = Object.keys(flags).filter((flag) => !RUN_FLAGS.has(flag));
+    if (unknown.length)
+        fail(`unknown flag ${unknown.map((f) => `--${f}`).join(", ")}. See --help.`, EXIT.usage);
+    const dryRun = flags["dry-run"] === true;
+    const fromJson = optional(flags, "from-json");
+    const saveJson = optional(flags, "save-json");
+    let config;
+    let only;
+    try {
+        config = loadConfig({
+            file: optional(flags, "config"),
+            env: process.env,
+            needToken: !dryRun,
+            needAccounts: !fromJson,
+            days: optional(flags, "days"),
+        });
+        only = onlyList(optional(flags, "only"));
+        guardActions(config, process.env, (line) => process.stdout.write(`${line}\n`));
+    }
+    catch (error) {
+        if (error instanceof ConfigError)
+            fail(error.message, EXIT.usage);
+        throw error;
+    }
+    const secrets = secretsOf(config);
+    SECRETS = secrets;
+    let read;
+    let failed = 0;
+    if (fromJson) {
+        try {
+            read = readSaved(fromJson).filter((saved) => !only || only.has(saved.company));
+        }
+        catch (error) {
+            if (error instanceof ConfigError)
+                fail(error.message, EXIT.usage);
+            throw error;
+        }
+    }
+    else {
+        const profileBase = optional(flags, "profile-dir") ?? defaultProfileBase(process.env);
+        ({ read, failed } = await readBanks(config, only, flags["show-browser"] === true, secrets, profileBase));
+    }
+    if (saveJson && !fromJson) {
+        // A bank statement on disk: readable by this user only, like the config.
+        // `mode` applies only to a file being created, so an existing one is
+        // narrowed before it is written.
+        writeFileSync(saveJson, "", { mode: 0o600 });
+        chmodSync(saveJson, 0o600);
+        writeFileSync(saveJson, `${JSON.stringify(read, null, 2)}\n`);
+        process.stdout.write(`saved what the banks returned to ${saveJson}\n`);
+    }
+    const today = israelDay(new Date());
+    //: One delivery per login, never one for everything. Orla links two rows of
+    //: one delivery as a transfer by itself (same day, same amount, one each
+    //: way), a rule written for one login at one institution. Across
+    //: institutions it would take a card refund and an unrelated bank debit of
+    //: the same amount for a transfer and hide the expense. Per login, the card's
+    //: cycle row and the bank's line meet as a suggestion instead: one click.
+    const deliveries = [];
+    for (const saved of read) {
+        if (!isCompany(saved.company)) {
+            process.stderr.write(`${saved.company}: not a company this runner knows, left out\n`);
+            failed += 1;
+            continue;
+        }
+        const company = saved.company;
+        const rows = [];
+        deliveries.push({ name: COMPANIES[company].name, rows });
+        for (const account of saved.accounts) {
+            const mapped = mapAccount(company, account, today);
+            rows.push(...mapped.rows);
+            const name = mapped.rows[0]?.account_name ?? COMPANIES[company].name;
+            const left = Object.entries(mapped.skipped)
+                .filter(([, count]) => count > 0)
+                .map(([why, count]) => `${count} ${why}`);
+            const cycles = mapped.cycles ? `, ${mapped.cycles} billing cycles` : "";
+            process.stdout.write(`${name}: ${mapped.rows.length - mapped.cycles} rows${cycles}${left.length ? ` (left out: ${left.join(", ")})` : ""}\n`);
+        }
+    }
+    const count = deliveries.reduce((sum, d) => sum + d.rows.length, 0);
+    if (dryRun) {
+        process.stdout.write(`dry run: ${count} rows ready, nothing sent\n`);
+        return failed ? EXIT.failure : EXIT.ok;
+    }
+    if (!count) {
+        process.stdout.write("nothing to send\n");
+        return failed ? EXIT.failure : EXIT.ok;
+    }
+    try {
+        const totals = { booked: 0, duplicates: 0, skipped_closed: 0, rejected: [] };
+        for (const delivery of deliveries) {
+            if (!delivery.rows.length)
+                continue;
+            const out = await push(config.url, config.token, delivery.rows);
+            totals.booked += out.booked;
+            totals.duplicates += out.duplicates;
+            totals.skipped_closed += out.skipped_closed;
+            totals.rejected.push(...out.rejected);
+        }
+        process.stdout.write(`Orla: ${totals.booked} new, ${totals.duplicates} already there` +
+            (totals.skipped_closed ? `, ${totals.skipped_closed} in closed months` : "") +
+            (totals.rejected.length ? `, ${totals.rejected.length} refused` : "") +
+            "\n");
+        for (const refusal of totals.rejected) {
+            process.stderr.write(`refused ${refusal["external_id"] ?? "a row"}: ${refusal["reason"] ?? JSON.stringify(refusal)}\n`);
+        }
+        if (totals.rejected.length)
+            failed += 1;
+    }
+    catch (error) {
+        if (error instanceof PushError) {
+            process.stderr.write(`orla-il-banks: ${redact(error.message, secrets)}\n`);
+            return EXIT.failure;
+        }
+        throw error;
+    }
+    return failed ? EXIT.failure : EXIT.ok;
+}
+async function trust(company, flags) {
+    const unknown = Object.keys(flags).filter((flag) => !TRUST_FLAGS.has(flag));
+    if (unknown.length)
+        fail(`unknown flag ${unknown.map((f) => `--${f}`).join(", ")}. See --help.`, EXIT.usage);
+    if (!company || !isCompany(company))
+        fail(`trust needs a company id. See \`orla-il-banks companies\`.`, EXIT.usage);
+    const spec = COMPANIES[company];
+    if (!("trustedDevice" in spec)) {
+        fail(`${spec.name} does not need a trusted computer; \`orla-il-banks run\` logs in on its own.`, EXIT.usage);
+    }
+    if (process.env["GITHUB_ACTIONS"] === "true") {
+        fail("trust needs a person at a screen and a browser profile kept on this computer; it does not run in GitHub Actions.", EXIT.usage);
+    }
+    let config;
+    let dirs;
+    try {
+        // the config only names the profile: one per login, as `run` will use it
+        config = loadConfig({ file: optional(flags, "config"), env: process.env, needToken: false });
+        const base = optional(flags, "profile-dir") ?? defaultProfileBase(process.env);
+        dirs = config.accounts
+            .filter((account) => account.company === company)
+            .map((account) => profileDir(base, company, account.credentials));
+    }
+    catch (error) {
+        if (error instanceof ConfigError)
+            fail(error.message, EXIT.usage);
+        throw error;
+    }
+    SECRETS = secretsOf(config);
+    if (!dirs.length)
+        fail(`no ${spec.name} login in the config: add it first, then run trust.`, EXIT.usage);
+    let failed = 0;
+    for (const [index, dir] of dirs.entries()) {
+        const which = dirs.length > 1 ? ` (login ${index + 1} of ${dirs.length})` : "";
+        process.stdout.write(`${spec.name}${which}: a browser window opens on the bank's own login page. Log in there with the code the bank sends. The window closes by itself when the bank shows your accounts; you have 10 minutes.\n`);
+        const outcome = await trustDevice(company, { profileDir: dir, env: process.env });
+        if (outcome === "trusted") {
+            process.stdout.write(`${spec.name}${which}: this computer is known to the bank now. \`orla-il-banks run\` logs in from it.\n`);
+        }
+        else {
+            process.stderr.write(`${spec.name}${which}: ${outcome === "closed" ? "the window was closed before the bank showed your accounts" : "no login within 10 minutes"}. Run trust again when ready.\n`);
+            failed += 1;
+        }
+    }
+    return failed ? EXIT.failure : EXIT.ok;
+}
+async function main(argv) {
+    const { words, flags } = parse(argv);
+    if (flags["version"]) {
+        process.stdout.write(`${VERSION}\n`);
+        return EXIT.ok;
+    }
+    const command = words[0];
+    if (!command || flags["help"] || command === "help") {
+        process.stdout.write(HELP);
+        return command || flags["help"] ? EXIT.ok : EXIT.usage;
+    }
+    if (command === "companies") {
+        process.stdout.write(companiesText());
+        return EXIT.ok;
+    }
+    if (command === "check-browser") {
+        const { checkBrowser } = await import("./scrape.js");
+        try {
+            process.stdout.write(`browser ok: ${await checkBrowser(process.env)}\n`);
+            return EXIT.ok;
+        }
+        catch (error) {
+            fail(`the browser did not start: ${error instanceof Error ? error.message : String(error)}`, EXIT.failure);
+        }
+    }
+    if (command === "run")
+        return run(flags);
+    if (command === "trust")
+        return trust(words[1], flags);
+    fail(`unknown command "${command}". See --help.`, EXIT.usage);
+}
+main(process.argv.slice(2)).then((code) => process.exit(code), (error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    process.stderr.write(`orla-il-banks: ${redact(message, SECRETS)}\n`);
+    process.exit(EXIT.failure);
+});