@recur-tw/cli 0.1.0

package/dist/cli.mjs

@@ -0,0 +1,2552 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+import pc from "picocolors";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import readline from "node:readline";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+//#region src/config.ts
+const CONFIG_DIR = path.join(os.homedir(), ".recur");
+const CREDENTIALS_FILE = path.join(CONFIG_DIR, "credentials.json");
+function ensureConfigDir() {
+	if (!fs.existsSync(CONFIG_DIR)) fs.mkdirSync(CONFIG_DIR, {
+		mode: 448,
+		recursive: true
+	});
+	else if ((fs.statSync(CONFIG_DIR).mode & 511) !== 448) fs.chmodSync(CONFIG_DIR, 448);
+}
+function readCredentials() {
+	if (!fs.existsSync(CREDENTIALS_FILE)) return {
+		profiles: {},
+		activeProfile: "default"
+	};
+	const raw = fs.readFileSync(CREDENTIALS_FILE, "utf-8");
+	try {
+		return JSON.parse(raw);
+	} catch {
+		throw new Error(`Credentials file is corrupted: ${CREDENTIALS_FILE}\nDelete it and run "recur login" to re-authenticate.`);
+	}
+}
+function writeCredentials(creds) {
+	ensureConfigDir();
+	fs.writeFileSync(CREDENTIALS_FILE, JSON.stringify(creds, null, 2), { mode: 384 });
+}
+function getProfile(profileName) {
+	const creds = readCredentials();
+	const name = profileName ?? creds.activeProfile ?? "default";
+	return creds.profiles[name] ?? null;
+}
+function saveProfile(name, profile) {
+	const creds = readCredentials();
+	creds.profiles[name] = profile;
+	if (!creds.activeProfile) creds.activeProfile = name;
+	writeCredentials(creds);
+}
+function setActiveProfile(name) {
+	const creds = readCredentials();
+	if (!creds.profiles[name]) throw new Error(`Profile "${name}" not found`);
+	creds.activeProfile = name;
+	writeCredentials(creds);
+}
+function listProfiles() {
+	const creds = readCredentials();
+	return Object.entries(creds.profiles).map(([name, profile]) => ({
+		name,
+		active: name === creds.activeProfile,
+		environment: profile.environment
+	}));
+}
+function deleteProfile(name) {
+	const creds = readCredentials();
+	delete creds.profiles[name];
+	if (creds.activeProfile === name) creds.activeProfile = Object.keys(creds.profiles)[0] ?? "default";
+	writeCredentials(creds);
+}
+/**
+* Resolve the secret key from (in priority order):
+* 1. --key flag
+* 2. RECUR_SECRET_KEY env var
+* 3. Active profile in ~/.recur/credentials.json
+*
+* Validates format before returning.
+*/
+function resolveSecretKey(opts) {
+	let key;
+	if (opts.key) key = opts.key;
+	else {
+		const envKey = process.env["RECUR_SECRET_KEY"];
+		if (envKey) key = envKey;
+		else {
+			const profile = getProfile(opts.profile);
+			if (profile?.secretKey) key = profile.secretKey;
+		}
+	}
+	if (!key) throw new Error("No API key found. Provide one via:\n  --key sk_test_xxx\n  RECUR_SECRET_KEY environment variable\n  recur login");
+	if (!/^sk_(test|live)_[a-zA-Z0-9]+$/.test(key)) {
+		if (/^pk_(test|live)_[a-zA-Z0-9]+$/.test(key)) throw new Error("CLI requires a Secret Key (sk_*). Publishable keys (pk_*) are for client-side SDKs only.");
+		throw new Error("Invalid API key format.\nExpected sk_test_* or sk_live_*");
+	}
+	return key;
+}
+/**
+* Validate a URL uses HTTPS (or HTTP for localhost in development).
+* Rejects non-http(s) schemes like file://, javascript://, data://.
+*/
+function validateUrl(url, label) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new Error(`Invalid ${label}: "${url}" is not a valid URL`);
+	}
+	if (parsed.protocol !== "https:" && parsed.protocol !== "http:") throw new Error(`Invalid ${label}: only http/https allowed, got ${parsed.protocol}`);
+	if (parsed.protocol === "http:" && !isLocalhost(parsed.hostname)) console.error(`Warning: ${label} uses HTTP (${url}). API keys will be sent in plaintext. Use HTTPS in production.`);
+	return url;
+}
+function isLocalhost(hostname) {
+	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+}
+/**
+* Resolve the base URL for API calls.
+*/
+function resolveBaseUrl(opts) {
+	if (opts.baseUrl) return validateUrl(opts.baseUrl, "base URL");
+	const envUrl = process.env["RECUR_BASE_URL"];
+	if (envUrl) return validateUrl(envUrl, "RECUR_BASE_URL");
+	const profile = getProfile(opts.profile);
+	if (profile?.baseUrl) return validateUrl(profile.baseUrl, "profile base URL");
+	return "https://api.recur.tw";
+}
+//#endregion
+//#region src/errors.ts
+var CLIError = class extends Error {
+	constructor(message, statusCode) {
+		super(message);
+		this.statusCode = statusCode;
+		this.name = "CLIError";
+	}
+};
+/**
+* Top-level error handler for CLI commands.
+* Prints a clean message and exits with code 1.
+*/
+function handleError(err) {
+	if (err instanceof CLIError) console.error(pc.red(`Error: ${err.message}`));
+	else if (err instanceof Error) {
+		console.error(pc.red(`Error: ${err.message}`));
+		if (process.env["RECUR_DEBUG"]) console.error(err.stack);
+	} else console.error(pc.red("An unexpected error occurred"));
+	process.exit(1);
+}
+//#endregion
+//#region ../core/src/api/resources.ts
+/** Shorthand constructors for response field definitions */
+const f = {
+	str: (name, description, nullable) => ({
+		name,
+		type: "string",
+		description,
+		nullable
+	}),
+	num: (name, description, nullable) => ({
+		name,
+		type: "number",
+		description,
+		nullable
+	}),
+	bool: (name, description) => ({
+		name,
+		type: "boolean",
+		description
+	}),
+	dt: (name, description, nullable) => ({
+		name,
+		type: "datetime",
+		description,
+		nullable
+	}),
+	obj: (name, description, nullable) => ({
+		name,
+		type: "object",
+		description,
+		nullable
+	}),
+	arr: (name, description) => ({
+		name,
+		type: "array",
+		description
+	})
+};
+const ProductType = [
+	"SUBSCRIPTION",
+	"ONE_TIME",
+	"CREDITS",
+	"DONATION"
+];
+const ProductStatus = ["active", "archived"];
+const BillingInterval = ["monthly", "yearly"];
+const SubscriptionStatus = [
+	"active",
+	"canceled",
+	"expired",
+	"past_due",
+	"trialing"
+];
+const OrderStatus = [
+	"pending",
+	"paid",
+	"failed",
+	"refunded"
+];
+const InvoiceStatus = [
+	"draft",
+	"open",
+	"paid",
+	"void",
+	"uncollectible"
+];
+const cursorPagination = {
+	cursor: "starting_after",
+	defaultLimit: 10,
+	maxLimit: 100
+};
+/** All API resources in registration order */
+const allResources = [
+	{
+		resource: "products",
+		description: "Manage subscription and one-time products",
+		actions: {
+			list: {
+				method: "GET",
+				path: "/v1/products",
+				description: "List all products",
+				params: {
+					status: {
+						type: "string",
+						description: "Filter by status",
+						enum: ProductStatus
+					},
+					limit: {
+						type: "number",
+						description: "Max results",
+						default: 20
+					}
+				},
+				responseFields: [
+					f.str("id", "Product ID (CUID)"),
+					f.str("name", "Product name"),
+					f.str("slug", "URL-friendly slug", true),
+					f.str("description", "Product description", true),
+					f.str("type", "SUBSCRIPTION, ONE_TIME, CREDITS, or DONATION"),
+					f.str("interval", "Billing interval: month or year", true),
+					f.num("interval_count", "Billing interval multiplier", true),
+					f.num("price", "Price in TWD (integer, e.g. 299 = NT$299)"),
+					f.str("currency", "Always TWD"),
+					f.num("trial_days", "Free trial days", true),
+					f.num("display_order", "Sort order for UI", true),
+					f.obj("metadata", "Custom key-value data", true),
+					f.bool("active", "Whether the product is active"),
+					f.dt("created_at", "Creation timestamp")
+				]
+			},
+			get: {
+				method: "GET",
+				path: "/v1/products/:id",
+				description: "Get a product by ID (CUID) or slug (contains hyphen)",
+				responseFields: [
+					f.str("id"),
+					f.str("name"),
+					f.str("slug", void 0, true),
+					f.str("description", void 0, true),
+					f.str("type"),
+					f.str("interval", void 0, true),
+					f.num("interval_count", void 0, true),
+					f.num("price", "Price in TWD (integer)"),
+					f.str("currency"),
+					f.num("trial_days", void 0, true),
+					f.num("display_order", void 0, true),
+					f.obj("metadata", void 0, true),
+					f.bool("active"),
+					f.dt("created_at"),
+					f.dt("updated_at")
+				]
+			},
+			create: {
+				method: "POST",
+				path: "/v1/products",
+				description: "Create a new product",
+				bodySchema: {
+					name: {
+						type: "string",
+						description: "Product name",
+						required: true
+					},
+					price: {
+						type: "number",
+						description: "Price in TWD (integer, e.g. 299 = NT$299)",
+						required: true
+					},
+					interval: {
+						type: "string",
+						description: "Billing interval",
+						enum: BillingInterval
+					},
+					type: {
+						type: "string",
+						description: "Product type",
+						enum: ProductType
+					},
+					description: {
+						type: "string",
+						description: "Product description"
+					}
+				},
+				responseFields: [
+					f.str("id"),
+					f.str("name"),
+					f.str("slug", void 0, true),
+					f.num("price"),
+					f.str("interval", void 0, true),
+					f.str("type"),
+					f.bool("active"),
+					f.dt("created_at")
+				],
+				supportsDryRun: true
+			},
+			update: {
+				method: "PATCH",
+				path: "/v1/products/:id",
+				description: "Update a product",
+				bodySchema: {
+					name: {
+						type: "string",
+						description: "Product name"
+					},
+					description: {
+						type: "string",
+						description: "Product description"
+					},
+					price: {
+						type: "number",
+						description: "Price in TWD (integer)"
+					}
+				},
+				responseFields: [
+					f.str("id"),
+					f.str("name"),
+					f.str("slug", void 0, true),
+					f.num("price"),
+					f.dt("updated_at")
+				],
+				supportsDryRun: true
+			},
+			archive: {
+				method: "POST",
+				path: "/v1/products/:id/archive",
+				description: "Archive a product",
+				responseFields: [f.str("id"), f.bool("active")],
+				supportsDryRun: true
+			}
+		}
+	},
+	{
+		resource: "customers",
+		description: "Manage customers",
+		actions: {
+			list: {
+				method: "GET",
+				path: "/v1/customers",
+				description: "List all customers",
+				params: {
+					email: {
+						type: "string",
+						description: "Filter by email"
+					},
+					status: {
+						type: "string",
+						description: "Filter by status",
+						enum: [
+							"ACTIVE",
+							"SUSPENDED",
+							"BANNED"
+						]
+					},
+					limit: {
+						type: "number",
+						description: "Max results (1-100)",
+						default: 10
+					},
+					startingAfter: {
+						type: "string",
+						description: "Cursor: ID of last item from previous page",
+						cliFlag: "--starting-after"
+					}
+				},
+				responseFields: [
+					f.str("id", "Customer ID (CUID)"),
+					f.str("email", "Customer email"),
+					f.str("name", "Customer name", true),
+					f.str("external_id", "External system ID", true),
+					f.bool("email_verified", "Whether email is verified"),
+					f.str("status", "ACTIVE, SUSPENDED, or BANNED"),
+					f.dt("created_at", "Creation timestamp"),
+					f.dt("updated_at", "Last update timestamp"),
+					f.num("subscriptions_count", "Number of subscriptions"),
+					f.num("orders_count", "Number of orders")
+				],
+				pagination: cursorPagination
+			},
+			get: {
+				method: "GET",
+				path: "/v1/customers/:id",
+				description: "Get a customer by ID",
+				responseFields: [
+					f.str("id"),
+					f.str("email"),
+					f.str("name", void 0, true),
+					f.str("external_id", void 0, true),
+					f.bool("email_verified"),
+					f.str("status"),
+					f.arr("subscriptions", "Customer subscriptions"),
+					f.dt("created_at"),
+					f.dt("updated_at")
+				]
+			},
+			update: {
+				method: "PATCH",
+				path: "/v1/customers/:id",
+				description: "Update a customer",
+				bodySchema: {
+					name: {
+						type: "string",
+						description: "Customer name"
+					},
+					externalId: {
+						type: "string",
+						description: "External system ID",
+						cliFlag: "--external-id"
+					}
+				},
+				responseFields: [
+					f.str("id"),
+					f.str("email"),
+					f.str("name", void 0, true),
+					f.str("external_id", void 0, true)
+				],
+				supportsDryRun: true
+			}
+		}
+	},
+	{
+		resource: "subscriptions",
+		description: "Manage subscriptions",
+		actions: {
+			list: {
+				method: "GET",
+				path: "/v1/subscriptions",
+				description: "List subscriptions",
+				params: {
+					status: {
+						type: "string",
+						description: "Filter by status",
+						enum: SubscriptionStatus
+					},
+					customerId: {
+						type: "string",
+						description: "Filter by customer ID",
+						cliFlag: "--customer-id"
+					},
+					email: {
+						type: "string",
+						description: "Filter by customer email"
+					},
+					limit: {
+						type: "number",
+						description: "Max results (1-100)",
+						default: 10
+					},
+					startingAfter: {
+						type: "string",
+						description: "Cursor: ID of last item from previous page",
+						cliFlag: "--starting-after"
+					}
+				},
+				responseFields: [
+					f.str("id", "Subscription ID"),
+					f.str("status", "active, canceled, expired, past_due, or trialing"),
+					f.str("product_id", "Product ID"),
+					f.str("product_slug", "Product slug", true),
+					f.str("product_name", "Product name"),
+					f.num("amount", "Billing amount in TWD (integer)"),
+					f.str("interval", "Billing interval: month or year"),
+					f.num("interval_count", "Interval multiplier"),
+					f.dt("current_period_start", "Current billing period start"),
+					f.dt("current_period_end", "Current billing period end"),
+					f.dt("canceled_at", "When subscription was canceled", true),
+					f.dt("started_at", "When subscription started", true),
+					f.obj("customer", "Customer object (id, email, name)", true)
+				],
+				pagination: cursorPagination
+			},
+			get: {
+				method: "GET",
+				path: "/v1/subscriptions/:id",
+				description: "Get subscription details",
+				responseFields: [
+					f.str("id"),
+					f.str("status"),
+					f.obj("product", "Product details (id, slug, name, price, interval)"),
+					f.obj("customer", "Customer details (id, email, name, external_id)"),
+					f.num("amount", "Billing amount in TWD"),
+					f.str("interval"),
+					f.num("interval_count"),
+					f.dt("current_period_start"),
+					f.dt("current_period_end"),
+					f.bool("cancel_at_period_end", "Whether subscription cancels at period end"),
+					f.dt("canceled_at", void 0, true),
+					f.dt("started_at", void 0, true),
+					f.dt("trial_start", void 0, true),
+					f.dt("trial_end", void 0, true),
+					f.arr("invoices", "Invoice history"),
+					f.obj("metadata", void 0, true),
+					f.dt("created_at")
+				]
+			},
+			cancel: {
+				method: "POST",
+				path: "/v1/subscriptions/:id/cancel",
+				description: "Cancel a subscription",
+				bodySchema: { immediately: {
+					type: "boolean",
+					description: "Cancel immediately (flag, no value). Omit for safe period-end cancel. Do NOT pass --immediately false.",
+					default: false
+				} },
+				responseFields: [
+					f.str("id"),
+					f.str("status"),
+					f.bool("cancel_at_period_end"),
+					f.dt("canceled_at", void 0, true)
+				],
+				supportsDryRun: true
+			}
+		}
+	},
+	{
+		resource: "orders",
+		description: "View orders",
+		actions: {
+			list: {
+				method: "GET",
+				path: "/v1/orders",
+				description: "List orders",
+				params: {
+					status: {
+						type: "string",
+						description: "Filter by status",
+						enum: OrderStatus
+					},
+					customerId: {
+						type: "string",
+						description: "Filter by customer ID",
+						cliFlag: "--customer-id"
+					},
+					limit: {
+						type: "number",
+						description: "Max results (1-100)",
+						default: 10
+					},
+					startingAfter: {
+						type: "string",
+						description: "Cursor: ID of last item from previous page",
+						cliFlag: "--starting-after"
+					}
+				},
+				responseFields: [
+					f.str("id", "Order ID"),
+					f.str("status", "pending, paid, failed, or refunded"),
+					f.num("total", "Total amount in TWD (integer)"),
+					f.num("subtotal", "Subtotal before discounts"),
+					f.str("currency", "Always TWD"),
+					f.str("customer_id", "Customer ID", true),
+					f.num("items_count", "Number of line items"),
+					f.dt("created_at", "Creation timestamp")
+				],
+				pagination: cursorPagination
+			},
+			get: {
+				method: "GET",
+				path: "/v1/orders/:id",
+				description: "Get order details",
+				responseFields: [
+					f.str("id"),
+					f.str("status"),
+					f.num("total"),
+					f.num("subtotal"),
+					f.num("discount_amount", "Discount applied"),
+					f.str("currency"),
+					f.obj("customer", "Customer details (id, email, name)"),
+					f.arr("items", "Line items (id, productId, productName, price, quantity)"),
+					f.dt("created_at")
+				]
+			}
+		}
+	},
+	{
+		resource: "invoices",
+		description: "View invoices",
+		actions: {
+			list: {
+				method: "GET",
+				path: "/v1/invoices",
+				description: "List invoices",
+				params: {
+					subscriptionId: {
+						type: "string",
+						description: "Filter by subscription ID",
+						cliFlag: "--subscription-id"
+					},
+					customerId: {
+						type: "string",
+						description: "Filter by customer ID",
+						cliFlag: "--customer-id"
+					},
+					status: {
+						type: "string",
+						description: "Filter by status",
+						enum: InvoiceStatus
+					},
+					limit: {
+						type: "number",
+						description: "Max results (1-100)",
+						default: 10
+					},
+					startingAfter: {
+						type: "string",
+						description: "Cursor: ID of last item from previous page",
+						cliFlag: "--starting-after"
+					}
+				},
+				responseFields: [
+					f.str("id", "Invoice ID"),
+					f.str("status", "draft, open, paid, void, or uncollectible"),
+					f.num("amount", "Invoice amount in TWD (integer)"),
+					f.str("currency", "Always TWD"),
+					f.str("subscription_id", "Associated subscription ID"),
+					f.str("customer_id", "Customer ID"),
+					f.dt("period_start", "Billing period start"),
+					f.dt("period_end", "Billing period end"),
+					f.dt("paid_at", "When invoice was paid", true),
+					f.dt("created_at", "Creation timestamp")
+				],
+				pagination: cursorPagination
+			},
+			get: {
+				method: "GET",
+				path: "/v1/invoices/:id",
+				description: "Get invoice details",
+				responseFields: [
+					f.str("id"),
+					f.str("status"),
+					f.num("amount"),
+					f.str("currency"),
+					f.str("subscription_id"),
+					f.obj("subscription", "Subscription details (id, productId, status)"),
+					f.str("customer_id"),
+					f.dt("period_start"),
+					f.dt("period_end"),
+					f.dt("paid_at", void 0, true),
+					f.dt("created_at")
+				]
+			}
+		}
+	},
+	{
+		resource: "webhooks",
+		description: "Manage webhook endpoints",
+		actions: {
+			list: {
+				method: "GET",
+				path: "/v1/webhooks",
+				description: "List webhook endpoints",
+				params: { limit: {
+					type: "number",
+					description: "Max results",
+					default: 20
+				} },
+				responseFields: [
+					f.str("id", "Webhook ID"),
+					f.str("url", "Endpoint URL"),
+					f.arr("events", "Subscribed event types"),
+					f.bool("is_active", "Whether the webhook is active"),
+					f.dt("created_at", "Creation timestamp")
+				]
+			},
+			create: {
+				method: "POST",
+				path: "/v1/webhooks",
+				description: "Create a webhook endpoint",
+				bodySchema: {
+					url: {
+						type: "string",
+						description: "Webhook URL",
+						required: true
+					},
+					events: {
+						type: "string",
+						description: "Comma-separated event types (default: essential events)"
+					}
+				},
+				responseFields: [
+					f.str("id"),
+					f.str("url"),
+					f.str("secret", "Signing secret (shown once)"),
+					f.arr("events"),
+					f.bool("is_active")
+				],
+				supportsDryRun: true
+			},
+			test: {
+				method: "POST",
+				path: "/v1/webhooks/:id/test",
+				description: "Send a test event to verify webhook endpoint",
+				bodySchema: { eventType: {
+					type: "string",
+					description: "Event type to send",
+					default: "checkout.completed",
+					cliFlag: "--event"
+				} },
+				responseFields: [
+					f.bool("success", "Whether the test delivery succeeded"),
+					f.num("status_code", "HTTP status code from endpoint"),
+					f.num("response_time", "Response time in ms")
+				]
+			},
+			delete: {
+				method: "DELETE",
+				path: "/v1/webhooks/:id",
+				description: "Delete a webhook endpoint",
+				responseFields: [f.str("id")],
+				supportsDryRun: true
+			}
+		}
+	},
+	{
+		resource: "checkouts",
+		description: "Create checkout sessions",
+		actions: {
+			create: {
+				method: "POST",
+				path: "/v1/checkouts",
+				description: "Create a checkout session",
+				bodySchema: {
+					productId: {
+						type: "string",
+						description: "Product ID",
+						required: true,
+						cliFlag: "--product-id"
+					},
+					customerEmail: {
+						type: "string",
+						description: "Customer email",
+						cliFlag: "--customer-email"
+					},
+					successUrl: {
+						type: "string",
+						description: "Redirect URL on success",
+						cliFlag: "--success-url"
+					},
+					cancelUrl: {
+						type: "string",
+						description: "Redirect URL on cancel",
+						cliFlag: "--cancel-url"
+					}
+				},
+				responseFields: [
+					f.str("id", "Checkout session ID"),
+					f.str("url", "Hosted checkout URL"),
+					f.str("status", "Session status"),
+					f.dt("expires_at", "Session expiration")
+				],
+				supportsDryRun: true
+			},
+			get: {
+				method: "GET",
+				path: "/v1/checkouts/:id",
+				description: "Get checkout session status",
+				responseFields: [
+					f.str("id"),
+					f.str("url", void 0, true),
+					f.str("status"),
+					f.str("customer_id", void 0, true),
+					f.str("product_id"),
+					f.dt("created_at")
+				]
+			}
+		}
+	}
+];
+//#endregion
+//#region src/schema.ts
+/**
+* Schema registry for runtime introspection.
+* Resource definitions are imported from @workspace/core/api (canonical source).
+* Enables `recur schema <resource>.<action>` for agents to discover
+* available parameters, fields, and request bodies.
+*/
+var SchemaError = class extends CLIError {
+	available;
+	constructor(message, available) {
+		super(`${message}\nAvailable: ${available.join(", ")}`);
+		this.available = available;
+	}
+};
+const registry = {};
+for (const def of allResources) registry[def.resource] = def;
+function getAction(resourceAction) {
+	const [resource, action] = resourceAction.split(".");
+	if (!resource || !action) return void 0;
+	return registry[resource]?.actions[action];
+}
+/**
+* Dump schema as machine-readable JSON for agents.
+* Throws CLIError for unknown resources/actions (non-zero exit).
+*/
+function dumpSchema(resourceAction) {
+	if (resourceAction) {
+		const [resourceName, actionName] = resourceAction.split(".");
+		if (!resourceName) throw new SchemaError("Invalid format. Use: <resource> or <resource>.<action>", Object.keys(registry));
+		const resource = registry[resourceName];
+		if (!resource) throw new SchemaError(`Unknown resource: ${resourceName}`, Object.keys(registry));
+		if (!actionName) return resource;
+		const action = resource.actions[actionName];
+		if (!action) throw new SchemaError(`Unknown action: ${actionName} on ${resourceName}`, Object.keys(resource.actions));
+		return {
+			resource: resourceName,
+			action: actionName,
+			...action
+		};
+	}
+	return Object.values(registry).map((r) => ({
+		resource: r.resource,
+		description: r.description,
+		actions: Object.entries(r.actions).map(([name, def]) => ({
+			name,
+			method: def.method,
+			path: def.path,
+			description: def.description
+		}))
+	}));
+}
+//#endregion
+//#region src/validator.ts
+/**
+* Validate a resource ID or slug against dangerous input patterns.
+* Rejects path traversals, embedded query params, control chars.
+*
+* Does NOT enforce ID prefixes — Recur uses CUID-format IDs (e.g.
+* "ro91zsticf41uwq8bungmklk") without a prefix like "cus_".
+*/
+function validateResourceId(id) {
+	if (!id || typeof id !== "string") throw new CLIError("Resource ID is required");
+	if (id.includes("..") || id.includes("/") || id.includes("\\")) throw new CLIError(`Invalid resource ID: path traversal detected in "${id}"`);
+	if (id.includes("?") || id.includes("#") || id.includes("%")) throw new CLIError(`Invalid resource ID: special characters not allowed in "${id}"`);
+	for (let i = 0; i < id.length; i++) {
+		const code = id.charCodeAt(i);
+		if (code < 32 || code === 127) throw new CLIError(`Invalid resource ID: control character at position ${i}`);
+	}
+	if (/[\u200B-\u200F\u2028\u2029\uFEFF]/.test(id)) throw new CLIError("Invalid resource ID: invisible Unicode characters detected");
+	return id;
+}
+/**
+* Parse and validate a raw JSON payload from --json flag.
+*/
+function parseJsonPayload(raw) {
+	try {
+		const parsed = JSON.parse(raw);
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new CLIError("JSON payload must be an object");
+		return parsed;
+	} catch (err) {
+		if (err instanceof CLIError) throw err;
+		throw new CLIError(`Invalid JSON payload: ${err.message}`);
+	}
+}
+/**
+* Validate that a string looks like a valid API key.
+*/
+function validateApiKey(key) {
+	if (!/^sk_(test|live)_[a-zA-Z0-9]+$/.test(key)) {
+		if (/^pk_(test|live)_[a-zA-Z0-9]+$/.test(key)) throw new CLIError("CLI requires a Secret Key (sk_*). Publishable keys (pk_*) are for client-side SDKs only.");
+		throw new CLIError("Invalid API key format. Expected sk_test_* or sk_live_*");
+	}
+	return key;
+}
+/**
+* Validate fields from schema definition during dry-run.
+* Checks required fields, enum values, and numeric types.
+* Returns list of error messages, or empty array if valid.
+*/
+function validateRequiredFields(body, schemaAction) {
+	const action = getAction(schemaAction);
+	if (!action?.bodySchema) return [];
+	const errors = [];
+	for (const [field, def] of Object.entries(action.bodySchema)) {
+		const val = body[field];
+		if (def.required && (val === void 0 || val === null)) {
+			errors.push(field);
+			continue;
+		}
+		if (val === void 0 || val === null) continue;
+		if (def.enum && !def.enum.includes(String(val))) errors.push(`${field}: invalid value "${val}" (expected: ${def.enum.join(", ")})`);
+		if (def.type === "number" && typeof val === "number" && isNaN(val)) errors.push(`${field}: must be a valid number`);
+	}
+	return errors;
+}
+//#endregion
+//#region src/client.ts
+var RecurClient = class {
+	baseUrl;
+	secretKey;
+	constructor(opts) {
+		this.baseUrl = opts.baseUrl.replace(/\/$/, "");
+		this.secretKey = opts.secretKey;
+	}
+	async request(method, path, opts) {
+		const url = new URL(path, this.baseUrl);
+		if (opts?.params) {
+			for (const [key, value] of Object.entries(opts.params)) if (value !== void 0) url.searchParams.set(key, value);
+		}
+		const headers = {
+			Authorization: `Bearer ${this.secretKey}`,
+			"User-Agent": `@recur-tw/cli/0.1.0`
+		};
+		const hasBody = opts?.body !== void 0;
+		if (hasBody) headers["Content-Type"] = "application/json";
+		const response = await fetch(url.toString(), {
+			method,
+			headers,
+			body: hasBody ? JSON.stringify(opts.body) : void 0,
+			signal: AbortSignal.timeout(3e4)
+		});
+		let data;
+		if ((response.headers.get("content-type") ?? "").includes("application/json")) data = await response.json();
+		else data = await response.text();
+		data = sanitizeResponse(data);
+		if (!response.ok) {
+			const errorBody = data;
+			const msg = errorBody?.error?.message ?? `HTTP ${response.status}`;
+			let detail = `[${errorBody?.error?.code ?? "unknown"}] ${msg}`;
+			if (response.status === 404) {
+				const resource = path.split("/").filter(Boolean).pop() ?? "";
+				detail += `\nThe resource "${resource}" was not found. Check the ID or slug is correct.`;
+			}
+			throw new CLIError(detail, response.status);
+		}
+		return data;
+	}
+	get(path, params) {
+		return this.request("GET", path, { params });
+	}
+	post(path, body) {
+		return this.request("POST", path, { body });
+	}
+	patch(path, body) {
+		return this.request("PATCH", path, { body });
+	}
+	delete(path) {
+		return this.request("DELETE", path);
+	}
+};
+/**
+* Strip a single string of dangerous characters:
+* - ASCII control chars (0x00-0x08, 0x0B, 0x0C, 0x0E-0x1F) — keep \t \n \r
+* - DEL (0x7F)
+* - Zero-width / invisible Unicode (U+200B-200F, U+FEFF)
+* - Line/paragraph separators (U+2028-2029)
+* - ANSI escape sequences (CSI + OSC patterns)
+*/
+function sanitizeString(str) {
+	return str.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, "").replace(/[\u200B-\u200F\u2028\u2029\uFEFF]/g, "").replace(/\x1B\[[0-9;]*[A-Za-z]/g, "").replace(/\x1B\][^\x07]*\x07/g, "");
+}
+/**
+* Recursively sanitize all string values (and keys) in API responses.
+* Defends against prompt injection via invisible characters or ANSI
+* escape sequences embedded in user-generated data.
+*/
+function sanitizeResponse(data) {
+	if (typeof data === "string") return sanitizeString(data);
+	if (Array.isArray(data)) return data.map(sanitizeResponse);
+	if (data !== null && typeof data === "object") {
+		const obj = data;
+		const result = {};
+		for (const [key, value] of Object.entries(obj)) result[sanitizeString(key)] = sanitizeResponse(value);
+		return result;
+	}
+	return data;
+}
+//#endregion
+//#region src/output.ts
+/**
+* Render data in the specified format.
+* Agent-optimized: --output json produces clean, parseable JSON to stdout.
+* Human-optimized: table format with colors to stderr-safe stdout.
+*/
+function render(data, opts = { format: "table" }) {
+	switch (opts.format) {
+		case "json":
+			renderJson(data);
+			break;
+		case "ndjson":
+			renderNdjson(data);
+			break;
+		case "csv":
+			renderCsv(data, opts);
+			break;
+		default:
+			renderTable(data, opts);
+			break;
+	}
+}
+function renderJson(data) {
+	console.log(JSON.stringify(data, null, 2));
+}
+/**
+* NDJSON: one JSON object per line, no array wrapper.
+* Enables stream processing without buffering entire response.
+*/
+function renderNdjson(data) {
+	const rows = Array.isArray(data) ? data : [data];
+	for (const row of rows) console.log(JSON.stringify(row));
+}
+function renderCsv(data, opts) {
+	const rows = Array.isArray(data) ? data : [data];
+	if (rows.length === 0) return;
+	const fields = opts.fields ?? Object.keys(rows[0]);
+	if (!opts.noHeaders) console.log(fields.join(","));
+	for (const row of rows) {
+		const record = row;
+		const values = fields.map((f) => {
+			const val = record[f];
+			if (val === null || val === void 0) return "";
+			const str = typeof val === "object" ? JSON.stringify(val) : String(val);
+			if (str.includes(",") || str.includes("\"") || str.includes("\n") || /^[=+\-@]/.test(str)) return `"${str.replace(/"/g, "\"\"")}"`;
+			return str;
+		});
+		console.log(values.join(","));
+	}
+}
+function renderTable(data, opts) {
+	const rows = Array.isArray(data) ? data : [data];
+	if (rows.length === 0) {
+		console.log(pc.dim("No results"));
+		return;
+	}
+	const fields = opts.fields ?? Object.keys(rows[0]);
+	const widths = {};
+	for (const field of fields) widths[field] = field.length;
+	for (const row of rows) {
+		const record = row;
+		for (const field of fields) {
+			const val = formatValue(record[field]);
+			widths[field] = Math.min(Math.max(widths[field] ?? 0, val.length), 50);
+		}
+	}
+	const header = fields.map((f) => pc.bold(f.padEnd(widths[f] ?? 0))).join("  ");
+	console.log(header);
+	console.log(fields.map((f) => "─".repeat(widths[f] ?? 0)).join("  "));
+	for (const row of rows) {
+		const record = row;
+		const line = fields.map((f) => {
+			const val = formatValue(record[f]);
+			const maxWidth = widths[f] ?? 50;
+			const padded = val.padEnd(maxWidth);
+			return padded.length > maxWidth ? padded.slice(0, maxWidth - 1) + "…" : padded;
+		}).join("  ");
+		console.log(line);
+	}
+	console.log(pc.dim(`\n${rows.length} result${rows.length === 1 ? "" : "s"}`));
+}
+function formatValue(val) {
+	if (val === null || val === void 0) return pc.dim("—");
+	if (typeof val === "boolean") return val ? pc.green("true") : pc.dim("false");
+	if (typeof val === "object") return sanitizeString(JSON.stringify(val));
+	return sanitizeString(String(val));
+}
+/**
+* Pick specific fields from data (for --fields flag).
+*/
+function pickFields(data, fields) {
+	warnUnknownFields(data, fields);
+	if (Array.isArray(data)) return data.map((item) => pick(item, fields));
+	return pick(data, fields);
+}
+function pick(obj, fields) {
+	const result = {};
+	for (const field of fields) if (field in obj) result[field] = obj[field];
+	return result;
+}
+/**
+* Warn about --fields that don't exist in the data.
+* Called once per render to avoid repeated warnings.
+*/
+function warnUnknownFields(data, fields) {
+	const sample = Array.isArray(data) ? data[0] : data;
+	if (!sample || typeof sample !== "object") return;
+	const available = Object.keys(sample);
+	const unknown = fields.filter((f) => !available.includes(f));
+	if (unknown.length > 0) console.error(pc.yellow(`Warning: unknown fields: ${unknown.map(sanitizeString).join(", ")}. Available: ${available.map(sanitizeString).join(", ")}`));
+}
+//#endregion
+//#region src/commands/login.ts
+function promptSecret(question) {
+	return new Promise((resolve) => {
+		process.stderr.write(question);
+		let input = "";
+		const stdin = process.stdin;
+		if (!stdin.isTTY) {
+			const rl = readline.createInterface({
+				input: stdin,
+				output: process.stderr
+			});
+			rl.question("", (answer) => {
+				rl.close();
+				resolve(answer.trim());
+			});
+			return;
+		}
+		stdin.setRawMode(true);
+		stdin.resume();
+		stdin.setEncoding("utf8");
+		const onData = (ch) => {
+			if (ch === "\r" || ch === "\n") {
+				stdin.setRawMode(false);
+				stdin.pause();
+				stdin.removeListener("data", onData);
+				process.stderr.write("\n");
+				resolve(input.trim());
+			} else if (ch === "") {
+				stdin.setRawMode(false);
+				stdin.pause();
+				stdin.removeListener("data", onData);
+				process.stderr.write("\n");
+				process.exit(130);
+			} else if (ch === "" || ch === "\b") {
+				if (input.length > 0) {
+					input = input.slice(0, -1);
+					process.stderr.write("\b \b");
+				}
+			} else {
+				input += ch;
+				process.stderr.write("*");
+			}
+		};
+		stdin.on("data", onData);
+	});
+}
+function registerLoginCommand(program) {
+	program.command("login").description("Configure API key credentials").option("--name <profile>", "Profile name", "default").action(async (cmdOpts) => {
+		try {
+			const globalOpts = program.opts();
+			let key = globalOpts.key;
+			if (!key) key = await promptSecret(`${pc.bold("Secret Key")} (sk_test_* or sk_live_*): `);
+			key = validateApiKey(key);
+			const environment = key.startsWith("sk_live_") ? "production" : "sandbox";
+			const baseUrl = globalOpts.baseUrl ?? "https://api.recur.tw";
+			const client = new RecurClient({
+				baseUrl,
+				secretKey: key
+			});
+			try {
+				await client.get("/v1/products");
+				console.error(pc.green("✓ API key verified"));
+			} catch {
+				console.error(pc.yellow("⚠ Could not verify API key (saved anyway)"));
+			}
+			saveProfile(cmdOpts.name, {
+				secretKey: key,
+				environment,
+				baseUrl
+			});
+			console.error(pc.green(`✓ Saved profile "${cmdOpts.name}" (${environment})`));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+	program.command("logout").description("Remove a saved profile").argument("[profile]", "Profile name to remove", "default").action((profileName) => {
+		try {
+			if (!getProfile(profileName)) {
+				console.error(pc.red(`Profile "${profileName}" not found`));
+				process.exit(1);
+			}
+			deleteProfile(profileName);
+			console.error(pc.green(`✓ Removed profile "${profileName}"`));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+	program.command("whoami").description("Show current profile and verify API key").action(async () => {
+		try {
+			const opts = program.opts();
+			const active = listProfiles().find((p) => p.active);
+			if (!active) {
+				console.error(pc.yellow("No profiles configured. Run: recur login"));
+				process.exit(1);
+			}
+			const globalOpts = program.opts();
+			let maskedKey;
+			try {
+				const key = resolveSecretKey(globalOpts);
+				maskedKey = key.slice(0, key.lastIndexOf("_") + 1) + "..." + key.slice(-4);
+			} catch {}
+			render({
+				profile: active.name,
+				environment: active.environment,
+				...maskedKey && { key: maskedKey }
+			}, { format: opts.output });
+		} catch (err) {
+			handleError(err);
+		}
+	});
+	program.command("profiles").description("List all saved profiles").action(() => {
+		try {
+			const opts = program.opts();
+			const profiles = listProfiles();
+			if (profiles.length === 0) {
+				console.error(pc.dim("No profiles. Run: recur login"));
+				return;
+			}
+			render(profiles, { format: opts.output });
+		} catch (err) {
+			handleError(err);
+		}
+	});
+	program.command("use").description("Switch active profile").argument("<profile>", "Profile name").action((profileName) => {
+		try {
+			setActiveProfile(profileName);
+			console.error(pc.green(`✓ Switched to profile "${profileName}"`));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+}
+//#endregion
+//#region src/extract.ts
+/**
+* Extract list data from API responses.
+*
+* All list endpoints return a standard envelope: { object: 'list', data: [...] }.
+* This function also handles legacy shapes and direct arrays as fallback.
+*/
+function extractList(response) {
+	if (Array.isArray(response)) return response;
+	if (typeof response === "object" && response !== null) {
+		const obj = response;
+		if (Array.isArray(obj["data"])) return obj["data"];
+		for (const value of Object.values(obj)) if (Array.isArray(value)) return value;
+	}
+	return [response];
+}
+/**
+* Extract list data with pagination metadata.
+*
+* API responses include:
+* - has_more: boolean — whether more pages exist
+* - next_cursor: string | null — ID to pass as starting_after for next page
+*/
+function extractPaginatedList(response) {
+	const data = extractList(response);
+	if (typeof response === "object" && response !== null) {
+		const obj = response;
+		return {
+			data,
+			hasMore: obj["has_more"] === true,
+			nextCursor: typeof obj["next_cursor"] === "string" ? obj["next_cursor"] : null
+		};
+	}
+	return {
+		data,
+		hasMore: false,
+		nextCursor: null
+	};
+}
+//#endregion
+//#region src/commands/products.ts
+function getClient$6(opts) {
+	return new RecurClient({
+		baseUrl: resolveBaseUrl(opts),
+		secretKey: resolveSecretKey(opts)
+	});
+}
+function getOutputOpts$6(opts) {
+	return {
+		format: opts.output,
+		fields: opts.fields?.split(",")
+	};
+}
+function registerProductsCommand(program) {
+	const products = program.command("products").description("Manage products (SUBSCRIPTION, ONE_TIME, CREDITS, DONATION)");
+	products.addHelpText("after", `
+Fields: id, name, slug, description, type, interval, interval_count, price, currency, trial_days, display_order, metadata, active, created_at, updated_at
+Price is in TWD as integer (e.g. 299 = NT$299). Never divide by 100.
+IDs are CUID format (e.g. k672i1kd6zgrw5b6w39xwpx3). Slugs contain hyphens (e.g. master-monthly).
+
+Examples:
+  $ recur products list --output json
+  $ recur products list --fields name,price,type
+  $ recur products get master-monthly              # by slug (contains hyphen)
+  $ recur products get k672i1kd6zgrw5b6w39xwpx3   # by ID (CUID)
+  $ recur products create --name "Pro" --price 299 --interval monthly --type SUBSCRIPTION
+  $ recur products create --json '{"name":"Pro","price":299,"interval":"monthly","type":"SUBSCRIPTION"}'
+  $ recur products update <id> --price 399 --dry-run
+  $ recur products archive <id>
+`);
+	products.command("list").description("List all active products. Use --status archived to see archived.").option("--status <status>", "Filter: active (default) or archived").option("--limit <n>", "Max results per page (default: 20)", "20").action(async (cmdOpts) => {
+		try {
+			const opts = products.optsWithGlobals();
+			const result = extractList(await getClient$6(opts).get("/v1/products", {
+				status: cmdOpts.status,
+				limit: cmdOpts.limit
+			}));
+			render(opts.fields ? pickFields(result, opts.fields.split(",")) : result, getOutputOpts$6(opts));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+	products.command("get").description("Get a product by ID (CUID) or by slug (e.g. \"master-monthly\")").argument("<id>", "Product ID (CUID) or slug").action(async (id) => {
+		try {
+			const opts = products.optsWithGlobals();
+			const client = getClient$6(opts);
+			const validId = validateResourceId(id);
+			const path = id.includes("-") ? `/v1/products/by-slug/${validId}` : `/v1/products/${validId}`;
+			const data = await client.get(path);
+			render(opts.fields ? pickFields(data, opts.fields.split(",")) : data, getOutputOpts$6(opts));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+	products.command("create").description("Create a new product. Use --json for full payload or individual flags.").option("--name <name>", "Product name (required)").option("--price <price>", "Price in TWD integer (e.g. 299 = NT$299, required)").option("--interval <interval>", "Billing interval: monthly or yearly").option("--type <type>", "Product type: SUBSCRIPTION, ONE_TIME, CREDITS, DONATION").option("--description <desc>", "Product description").action(async (cmdOpts) => {
+		try {
+			const opts = products.optsWithGlobals();
+			let body;
+			if (opts.json) {
+				const flagsUsed = [
+					"name",
+					"price",
+					"interval",
+					"type",
+					"description"
+				].filter((f) => cmdOpts[f]);
+				if (flagsUsed.length > 0) console.error(pc.yellow(`Warning: --json provided, ignoring flags: --${flagsUsed.join(", --")}`));
+				body = parseJsonPayload(opts.json);
+			} else {
+				body = {};
+				if (cmdOpts.name) body["name"] = cmdOpts.name;
+				if (cmdOpts.price) {
+					const price = parseInt(cmdOpts.price, 10);
+					if (isNaN(price)) throw new CLIError(`Invalid price: "${cmdOpts.price}" is not a number`);
+					body["price"] = price;
+				}
+				if (cmdOpts.interval) body["interval"] = cmdOpts.interval;
+				if (cmdOpts.type) body["type"] = cmdOpts.type;
+				if (cmdOpts.description) body["description"] = cmdOpts.description;
+			}
+			if (opts.dryRun) {
+				const errors = validateRequiredFields(body, "products.create");
+				if (errors.length > 0) {
+					console.error(pc.red(`Validation errors:\n  ${errors.join("\n  ")}`));
+					process.exit(1);
+				}
+				console.error(pc.yellow("[dry-run] Would create product:"));
+				render(body, { format: "json" });
+				return;
+			}
+			render(await getClient$6(opts).post("/v1/products", body), getOutputOpts$6(opts));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+	products.command("update").description("Update a product by ID. Only provided fields are changed.").argument("<id>", "Product ID (CUID)").option("--name <name>", "New product name").option("--price <price>", "New price in TWD integer").option("--description <desc>", "New product description").action(async (id, cmdOpts) => {
+		try {
+			const opts = products.optsWithGlobals();
+			const validId = validateResourceId(id);
+			let body;
+			if (opts.json) {
+				const flagsUsed = [
+					"name",
+					"price",
+					"description"
+				].filter((f) => cmdOpts[f]);
+				if (flagsUsed.length > 0) console.error(pc.yellow(`Warning: --json provided, ignoring flags: --${flagsUsed.join(", --")}`));
+				body = parseJsonPayload(opts.json);
+			} else {
+				body = {};
+				if (cmdOpts.name) body["name"] = cmdOpts.name;
+				if (cmdOpts.price) {
+					const price = parseInt(cmdOpts.price, 10);
+					if (isNaN(price)) throw new CLIError(`Invalid price: "${cmdOpts.price}" is not a number`);
+					body["price"] = price;
+				}
+				if (cmdOpts.description) body["description"] = cmdOpts.description;
+			}
+			if (opts.dryRun) {
+				console.error(pc.yellow(`[dry-run] Would update product ${validId}:`));
+				render(body, { format: "json" });
+				return;
+			}
+			render(await getClient$6(opts).patch(`/v1/products/${validId}`, body), getOutputOpts$6(opts));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+	products.command("archive").description("Archive a product (soft delete, can be restored from dashboard)").argument("<id>", "Product ID (CUID)").action(async (id) => {
+		try {
+			const opts = products.optsWithGlobals();
+			const validId = validateResourceId(id);
+			if (opts.dryRun) {
+				console.error(pc.yellow(`[dry-run] Would archive product ${validId}`));
+				return;
+			}
+			render(await getClient$6(opts).post(`/v1/products/${validId}/archive`), getOutputOpts$6(opts));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+}
+//#endregion
+//#region src/paginate.ts
+const MAX_PAGES = 100;
+/**
+* Auto-paginate through all pages using cursor-based pagination.
+* Outputs each page as NDJSON lines for streaming consumption.
+*/
+async function paginateAll(opts) {
+	let cursor = opts.params["startingAfter"];
+	let page = 0;
+	let totalItems = 0;
+	while (page < MAX_PAGES) {
+		const params = { ...opts.params };
+		if (cursor) params["startingAfter"] = cursor;
+		const result = extractPaginatedList(await opts.client.get(opts.path, params));
+		if (result.data.length === 0) break;
+		const output = opts.fields ? pickFields(result.data, opts.fields) : result.data;
+		const rows = Array.isArray(output) ? output : [output];
+		for (const row of rows) console.log(JSON.stringify(row));
+		totalItems += result.data.length;
+		page++;
+		if (!result.hasMore || !result.nextCursor) break;
+		cursor = result.nextCursor;
+	}
+	if (page >= MAX_PAGES) console.error(pc.yellow(`Warning: reached max page limit (${MAX_PAGES}). ${totalItems} items fetched.`));
+	else console.error(pc.dim(`${totalItems} item${totalItems === 1 ? "" : "s"} total (${page} page${page === 1 ? "" : "s"})`));
+}
+//#endregion
+//#region src/commands/customers.ts
+function getClient$5(opts) {
+	return new RecurClient({
+		baseUrl: resolveBaseUrl(opts),
+		secretKey: resolveSecretKey(opts)
+	});
+}
+function getOutputOpts$5(opts) {
+	return {
+		format: opts.output,
+		fields: opts.fields?.split(",")
+	};
+}
+function registerCustomersCommand(program) {
+	const customers = program.command("customers").description("Manage customers (subscribers to your products)");
+	customers.addHelpText("after", `
+Fields: id, email, name, external_id, email_verified, status, created_at, updated_at, subscriptions_count, orders_count
+IDs are CUID format (e.g. z5gwawfqbh5zcw6si568j4cu).
+
+Examples:
+  $ recur customers list --output json
+  $ recur customers list --email user@example.com
+  $ recur customers list --fields email,name
+  $ recur customers list --starting-after <last-id> --limit 10
+  $ recur customers list --page-all --fields id,email    # Fetch all pages (NDJSON)
+  $ recur customers get <id> --output json
+  $ recur customers update <id> --name "New Name"
+`);
+	customers.command("list").description("List all customers with optional email filter and pagination").option("--email <email>", "Filter by exact email address").option("--status <status>", "Filter: ACTIVE, SUSPENDED, BANNED").option("--limit <n>", "Max results per page (1-100, default: 10)", "10").option("--starting-after <id>", "Cursor: ID of last item from previous page").option("--page-all", "Auto-paginate through all pages (outputs NDJSON)").action(async (cmdOpts) => {
+		try {
+			const opts = customers.optsWithGlobals();
+			const client = getClient$5(opts);
+			const params = {
+				email: cmdOpts.email,
+				status: cmdOpts.status,
+				limit: cmdOpts.limit,
+				startingAfter: cmdOpts.startingAfter
+			};
+			if (cmdOpts.pageAll) {
+				await paginateAll({
+					client,
+					path: "/v1/customers",
+					params,
+					outputFormat: opts.output,
+					fields: opts.fields?.split(",")
+				});
+				return;
+			}
+			const result = extractList(await client.get("/v1/customers", params));
+			render(opts.fields ? pickFields(result, opts.fields.split(",")) : result, getOutputOpts$5(opts));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+	customers.command("get").description("Get a single customer by ID. Returns subscriptions and order counts.").argument("<id>", "Customer ID (CUID)").action(async (id) => {
+		try {
+			const opts = customers.optsWithGlobals();
+			const validId = validateResourceId(id);
+			const data = await getClient$5(opts).get(`/v1/customers/${validId}`);
+			render(opts.fields ? pickFields(data, opts.fields.split(",")) : data, getOutputOpts$5(opts));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+	customers.command("update").description("Update a customer. Only provided fields are changed.").argument("<id>", "Customer ID (CUID)").option("--name <name>", "Customer display name").option("--external-id <externalId>", "Your application's user ID").action(async (id, cmdOpts) => {
+		try {
+			const opts = customers.optsWithGlobals();
+			const validId = validateResourceId(id);
+			let body;
+			if (opts.json) {
+				const flagsUsed = ["name", "externalId"].filter((f) => cmdOpts[f]);
+				if (flagsUsed.length > 0) console.error(pc.yellow(`Warning: --json provided, ignoring flags: --${flagsUsed.map((f) => f.replace(/([A-Z])/g, "-$1").toLowerCase()).join(", --")}`));
+				body = parseJsonPayload(opts.json);
+			} else {
+				body = {};
+				if (cmdOpts.name) body["name"] = cmdOpts.name;
+				if (cmdOpts.externalId) body["externalId"] = cmdOpts.externalId;
+			}
+			if (opts.dryRun) {
+				console.error(pc.yellow(`[dry-run] Would update customer ${validId}:`));
+				render(body, { format: "json" });
+				return;
+			}
+			render(await getClient$5(opts).patch(`/v1/customers/${validId}`, body), getOutputOpts$5(opts));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+}
+//#endregion
+//#region src/commands/subscriptions.ts
+function getClient$4(opts) {
+	return new RecurClient({
+		baseUrl: resolveBaseUrl(opts),
+		secretKey: resolveSecretKey(opts)
+	});
+}
+function getOutputOpts$4(opts) {
+	return {
+		format: opts.output,
+		fields: opts.fields?.split(",")
+	};
+}
+function registerSubscriptionsCommand(program) {
+	const subscriptions = program.command("subscriptions").description("Manage subscriptions (recurring billing)");
+	subscriptions.addHelpText("after", `
+Fields: id, status, product_id, product_slug, product_name, amount, interval, interval_count, current_period_start, current_period_end, canceled_at, started_at, customer
+Statuses: active, canceled, expired, past_due, trialing
+IDs are CUID format (e.g. v1bmt2pkfcwtxw0yxrjgzsly).
+
+Examples:
+  $ recur subscriptions list --output json
+  $ recur subscriptions list --status active --limit 10
+  $ recur subscriptions list --email user@example.com
+  $ recur subscriptions list --customer-id <customer-id>
+  $ recur subscriptions get <id> --output json
+  $ recur subscriptions cancel <id>                    # Cancel at period end (safe default)
+  $ recur subscriptions cancel <id> --immediately      # Cancel now (irreversible)
+  $ recur subscriptions cancel <id> --dry-run          # Preview without canceling
+
+Note: --immediately is a flag (no value). Do NOT use --immediately false; omit the flag instead.
+`);
+	subscriptions.command("list").description("List subscriptions. Filter by status, customer ID, or email.").option("--status <status>", "Filter: active, canceled, expired, past_due, trialing").option("--customer-id <id>", "Filter by customer ID").option("--email <email>", "Filter by customer email").option("--limit <n>", "Max results per page (1-100, default: 10)", "10").option("--starting-after <id>", "Cursor: ID of last item from previous page").option("--page-all", "Auto-paginate through all pages (outputs NDJSON)").action(async (cmdOpts) => {
+		try {
+			const opts = subscriptions.optsWithGlobals();
+			const client = getClient$4(opts);
+			const params = {
+				status: cmdOpts.status,
+				email: cmdOpts.email,
+				limit: cmdOpts.limit,
+				startingAfter: cmdOpts.startingAfter
+			};
+			if (cmdOpts.customerId) params["customerId"] = validateResourceId(cmdOpts.customerId);
+			if (cmdOpts.pageAll) {
+				await paginateAll({
+					client,
+					path: "/v1/subscriptions",
+					params,
+					outputFormat: opts.output,
+					fields: opts.fields?.split(",")
+				});
+				return;
+			}
+			const result = extractList(await client.get("/v1/subscriptions", params));
+			render(opts.fields ? pickFields(result, opts.fields.split(",")) : result, getOutputOpts$4(opts));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+	subscriptions.command("get").description("Get subscription details including customer, product, and invoices").argument("<id>", "Subscription ID (CUID)").action(async (id) => {
+		try {
+			const opts = subscriptions.optsWithGlobals();
+			const validId = validateResourceId(id);
+			const data = await getClient$4(opts).get(`/v1/subscriptions/${validId}`);
+			render(opts.fields ? pickFields(data, opts.fields.split(",")) : data, getOutputOpts$4(opts));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+	subscriptions.command("cancel").description("Cancel a subscription. Defaults to cancel at period end (safe).").argument("<id>", "Subscription ID (CUID)").option("--immediately", "Cancel immediately instead of at period end (flag, no value — omit for period-end cancel)").action(async (id, cmdOpts) => {
+		try {
+			const opts = subscriptions.optsWithGlobals();
+			const validId = validateResourceId(id);
+			let body;
+			if (opts.json) {
+				if (cmdOpts.immediately) console.error(pc.yellow("Warning: --json provided, ignoring flag: --immediately"));
+				body = parseJsonPayload(opts.json);
+			} else body = { immediately: cmdOpts.immediately ?? false };
+			if (opts.dryRun) {
+				console.error(pc.yellow(`[dry-run] Would cancel subscription ${validId}:`));
+				render(body, { format: "json" });
+				return;
+			}
+			render(await getClient$4(opts).post(`/v1/subscriptions/${validId}/cancel`, body), getOutputOpts$4(opts));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+}
+//#endregion
+//#region src/commands/listen.ts
+const DEFAULT_RELAY_URL = "https://recur-cli-relay.kaik.workers.dev";
+function resolveRelayUrl(opts) {
+	if (opts.relayUrl) return validateUrl(opts.relayUrl, "relay URL");
+	const envUrl = process.env["RECUR_RELAY_URL"];
+	if (envUrl) return validateUrl(envUrl, "RECUR_RELAY_URL");
+	return DEFAULT_RELAY_URL;
+}
+function formatTime() {
+	const now = /* @__PURE__ */ new Date();
+	return pc.dim(`${now.getHours().toString().padStart(2, "0")}:${now.getMinutes().toString().padStart(2, "0")}:${now.getSeconds().toString().padStart(2, "0")}`);
+}
+function formatStatus(status, duration) {
+	const statusText = `${status} (${duration}ms)`;
+	if (status >= 200 && status < 300) return pc.green(statusText);
+	return pc.red(statusText);
+}
+/**
+* Parse SSE stream from a ReadableStream.
+* Handles line buffering across chunks.
+*/
+async function parseSSEStream(body, handlers, signal) {
+	const reader = body.pipeThrough(new TextDecoderStream()).getReader();
+	let buffer = "";
+	let currentEvent = "";
+	let currentData = "";
+	let currentId;
+	try {
+		while (!signal.aborted) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			buffer += value;
+			const lines = buffer.split("\n");
+			buffer = lines.pop() || "";
+			for (const line of lines) if (line === "") {
+				if (currentData) handlers.onEvent({
+					event: currentEvent || "message",
+					data: currentData,
+					id: currentId
+				});
+				currentEvent = "";
+				currentData = "";
+				currentId = void 0;
+			} else if (line.startsWith("event:")) currentEvent = line.slice(6).trim();
+			else if (line.startsWith("data:")) currentData = line.slice(5).trim();
+			else if (line.startsWith("id:")) currentId = line.slice(3).trim();
+		}
+	} catch (err) {
+		if (!signal.aborted) handlers.onError(err instanceof Error ? err : new Error(String(err)));
+	} finally {
+		reader.releaseLock();
+	}
+}
+function registerListenSubcommand(webhooksCmd) {
+	const listenCmd = webhooksCmd.command("listen").description("Forward webhook events from Recur to your local server in real-time (similar to stripe listen)").argument("<url>", "Local URL to forward events to (e.g. http://localhost:3000/api/webhooks)").option("--events <types>", "Comma-separated event types to filter (e.g. checkout.completed,order.paid)").option("--relay-url <url>", "Override relay server URL (for development)");
+	listenCmd.addHelpText("after", `
+Connects to Recur's SSE relay and forwards webhook events to your local server.
+Each session gets a unique signing secret (whsec_*) for verifying event signatures.
+
+Forwarded requests include these headers:
+  X-Recur-Signature    HMAC-SHA256 signature (base64)
+  X-Recur-Event-Type   Event type (e.g. checkout.completed)
+  X-Recur-Event-Id     Unique event identifier
+  X-Recur-Timestamp    ISO 8601 timestamp
+
+Auto-reconnects on disconnect (max 10 consecutive failures). Ctrl+C to stop.
+
+Examples:
+  $ recur webhooks listen http://localhost:3000/api/webhooks
+  $ recur webhooks listen http://localhost:3000/api/webhooks --events checkout.completed,order.paid
+  $ RECUR_RELAY_URL=http://localhost:8787 recur webhooks listen http://localhost:3000/hook
+`);
+	listenCmd.action(async (forwardUrl, cmdOpts) => {
+		try {
+			validateUrl(forwardUrl, "forward URL");
+			const secretKey = resolveSecretKey(webhooksCmd.optsWithGlobals());
+			const relayUrl = resolveRelayUrl(cmdOpts);
+			const eventFilter = cmdOpts.events ? new Set(cmdOpts.events.split(",").map((e) => e.trim())) : null;
+			const ac = new AbortController();
+			let consecutiveFailures = 0;
+			const maxFailures = 10;
+			const shutdown = () => {
+				console.error(pc.dim("\nShutting down..."));
+				ac.abort();
+				process.exit(0);
+			};
+			process.on("SIGINT", shutdown);
+			process.on("SIGTERM", shutdown);
+			async function connect() {
+				while (!ac.signal.aborted && consecutiveFailures < maxFailures) try {
+					console.error(pc.dim("Connecting to relay..."));
+					const res = await fetch(`${relayUrl}/listen`, {
+						headers: {
+							Authorization: `Bearer ${secretKey}`,
+							Accept: "text/event-stream"
+						},
+						signal: ac.signal
+					});
+					if (!res.ok) {
+						const text = await res.text();
+						throw new Error(`Relay returned ${res.status}: ${text.slice(0, 200)}`);
+					}
+					if (!res.body) throw new Error("No response body from relay");
+					const contentType = res.headers.get("content-type") ?? "";
+					if (!contentType.includes("text/event-stream")) throw new Error(`Expected text/event-stream from relay, got: ${contentType}`);
+					consecutiveFailures = 0;
+					await parseSSEStream(res.body, {
+						onEvent: (sseEvent) => {
+							try {
+								if (sseEvent.event === "connected") {
+									const data = JSON.parse(sseEvent.data);
+									console.error("");
+									console.error(pc.bold("  Ready! Listening for webhook events..."));
+									console.error("");
+									console.error(`  Signing secret: ${pc.cyan(data.secret)}`);
+									console.error(`  Forwarding to:  ${pc.cyan(forwardUrl)}`);
+									console.error(`  Environment:    ${pc.cyan(data.environment.toLowerCase())}`);
+									if (eventFilter) console.error(`  Filtering:      ${pc.cyan(Array.from(eventFilter).join(", "))}`);
+									console.error("");
+								} else if (sseEvent.event === "webhook") {
+									const data = JSON.parse(sseEvent.data);
+									if (eventFilter && !eventFilter.has(data.type)) return;
+									const start = Date.now();
+									const fwdAc = new AbortController();
+									const fwdTimeout = setTimeout(() => fwdAc.abort(), 3e4);
+									fetch(forwardUrl, {
+										method: "POST",
+										headers: {
+											"Content-Type": "application/json",
+											"X-Recur-Signature": data.signature,
+											"X-Recur-Event-Type": data.type,
+											"X-Recur-Event-Id": data.id,
+											"X-Recur-Timestamp": data.timestamp
+										},
+										body: JSON.stringify(data.data),
+										signal: fwdAc.signal
+									}).then((fwdRes) => {
+										clearTimeout(fwdTimeout);
+										const duration = Date.now() - start;
+										console.error(`${formatTime()}  ${pc.dim("->")}  ${data.type} ${pc.dim(`[${data.id}]`)}  ${formatStatus(fwdRes.status, duration)}`);
+										if (fwdRes.status >= 400) fwdRes.text().then((body) => {
+											if (body) console.error(pc.dim(`    ${body.slice(0, 200)}`));
+										});
+									}).catch((err) => {
+										clearTimeout(fwdTimeout);
+										const duration = Date.now() - start;
+										const msg = err.name === "AbortError" ? "Timed out after 30s" : err.message;
+										console.error(`${formatTime()}  ${pc.dim("->")}  ${data.type} ${pc.dim(`[${data.id}]`)}  ${pc.red(`FAILED (${duration}ms)`)}`);
+										console.error(pc.dim(`    ${msg}`));
+									});
+								}
+							} catch (parseErr) {
+								console.error(pc.yellow(`Failed to parse SSE event: ${parseErr.message}`));
+							}
+						},
+						onError: (err) => {
+							if (!ac.signal.aborted) console.error(pc.yellow(`Stream error: ${err.message}`));
+						}
+					}, ac.signal);
+					if (!ac.signal.aborted) {
+						console.error(pc.yellow("Connection lost. Reconnecting in 3s..."));
+						consecutiveFailures++;
+						await new Promise((r) => setTimeout(r, 3e3));
+					}
+				} catch (err) {
+					if (ac.signal.aborted) return;
+					consecutiveFailures++;
+					const msg = err instanceof Error ? err.message : String(err);
+					console.error(pc.red(`Connection error: ${msg}`));
+					if (consecutiveFailures < maxFailures) {
+						console.error(pc.dim(`Retrying in 3s... (${consecutiveFailures}/${maxFailures})`));
+						await new Promise((r) => setTimeout(r, 3e3));
+					}
+				}
+				if (consecutiveFailures >= maxFailures) {
+					console.error(pc.red(`\nGave up after ${maxFailures} consecutive failures.`));
+					process.exit(1);
+				}
+			}
+			await connect();
+		} catch (err) {
+			handleError(err);
+		}
+	});
+}
+//#endregion
+//#region src/commands/webhooks.ts
+function getClient$3(opts) {
+	return new RecurClient({
+		baseUrl: resolveBaseUrl(opts),
+		secretKey: resolveSecretKey(opts)
+	});
+}
+function getOutputOpts$3(opts) {
+	return {
+		format: opts.output,
+		fields: opts.fields?.split(",")
+	};
+}
+function registerWebhooksCommand(program) {
+	const webhooks = program.command("webhooks").description("Manage webhook endpoints for receiving payment event notifications");
+	webhooks.addHelpText("after", `
+Fields: id, url, events, is_active, secret, created_at
+IDs are CUID format. Default events: checkout.completed, subscription.activated,
+  subscription.canceled, subscription.expired, invoice.paid, invoice.payment_failed, order.paid
+
+Examples:
+  $ recur webhooks list --output json
+  $ recur webhooks create --url https://example.com/webhooks
+  $ recur webhooks create --json '{"url":"https://...","events":["checkout.completed"]}'
+  $ recur webhooks test <id>                             # Send test checkout.completed
+  $ recur webhooks test <id> --event subscription.canceled
+  $ recur webhooks delete <id>
+  $ recur webhooks listen http://localhost:3000/api/webhooks
+  $ recur webhooks listen http://localhost:3000/api/webhooks --events checkout.completed,order.paid
+`);
+	registerListenSubcommand(webhooks);
+	webhooks.command("list").description("List all configured webhook endpoints").option("--limit <n>", "Max results per page (default: 20)", "20").action(async (cmdOpts) => {
+		try {
+			const opts = webhooks.optsWithGlobals();
+			const result = extractList(await getClient$3(opts).get("/v1/webhooks", { limit: cmdOpts.limit }));
+			render(opts.fields ? pickFields(result, opts.fields.split(",")) : result, getOutputOpts$3(opts));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+	webhooks.command("create").description("Create a webhook endpoint. Defaults to 7 essential event types.").option("--url <url>", "Webhook URL (required)").option("--events <events>", "Comma-separated event types (optional, defaults to essentials)").action(async (cmdOpts) => {
+		try {
+			const opts = webhooks.optsWithGlobals();
+			let body;
+			if (opts.json) {
+				const flagsUsed = ["url", "events"].filter((f) => cmdOpts[f]);
+				if (flagsUsed.length > 0) console.error(pc.yellow(`Warning: --json provided, ignoring flags: --${flagsUsed.join(", --")}`));
+				body = parseJsonPayload(opts.json);
+			} else {
+				body = {};
+				if (cmdOpts.url) body["url"] = cmdOpts.url;
+				if (cmdOpts.events) body["events"] = cmdOpts.events.split(",").map((e) => e.trim());
+			}
+			if (opts.dryRun) {
+				const errors = validateRequiredFields(body, "webhooks.create");
+				if (errors.length > 0) {
+					console.error(pc.red(`Validation errors:\n  ${errors.join("\n  ")}`));
+					process.exit(1);
+				}
+				console.error(pc.yellow("[dry-run] Would create webhook:"));
+				render(body, { format: "json" });
+				return;
+			}
+			render(await getClient$3(opts).post("/v1/webhooks", body), getOutputOpts$3(opts));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+	webhooks.command("test").description("Send a test event to a webhook endpoint to verify it works").argument("<id>", "Webhook ID (CUID)").option("--event <type>", "Event type to send (default: checkout.completed)", "checkout.completed").action(async (id, cmdOpts) => {
+		try {
+			const opts = webhooks.optsWithGlobals();
+			const validId = validateResourceId(id);
+			if (opts.dryRun) {
+				console.error(pc.yellow(`[dry-run] Would send test event "${cmdOpts.event}" to webhook ${validId}`));
+				return;
+			}
+			render(await getClient$3(opts).post(`/v1/webhooks/${validId}/test`, { eventType: cmdOpts.event }), getOutputOpts$3(opts));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+	webhooks.command("delete").description("Delete a webhook endpoint permanently").argument("<id>", "Webhook ID (CUID)").action(async (id) => {
+		try {
+			const opts = webhooks.optsWithGlobals();
+			const validId = validateResourceId(id);
+			if (opts.dryRun) {
+				console.error(pc.yellow(`[dry-run] Would delete webhook ${validId}`));
+				return;
+			}
+			await getClient$3(opts).delete(`/v1/webhooks/${validId}`);
+			console.error(pc.green(`Deleted webhook ${validId}`));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+}
+//#endregion
+//#region src/commands/orders.ts
+function getClient$2(opts) {
+	return new RecurClient({
+		baseUrl: resolveBaseUrl(opts),
+		secretKey: resolveSecretKey(opts)
+	});
+}
+function getOutputOpts$2(opts) {
+	return {
+		format: opts.output,
+		fields: opts.fields?.split(",")
+	};
+}
+function registerOrdersCommand(program) {
+	const orders = program.command("orders").description("View orders (payment records for products)");
+	orders.addHelpText("after", `
+Fields: id, status, total, subtotal, currency, customer_id, items_count, created_at
+Statuses: pending, paid, failed, refunded
+IDs are CUID format.
+
+Examples:
+  $ recur orders list --output json
+  $ recur orders list --status paid
+  $ recur orders list --customer-id <customer-id>
+  $ recur orders list --limit 50
+  $ recur orders get <id> --output json
+`);
+	orders.command("list").description("List orders with optional status and customer filters").option("--status <status>", "Filter: pending, paid, failed, refunded").option("--customer-id <id>", "Filter by customer ID").option("--limit <n>", "Max results per page (1-100, default: 10)", "10").option("--starting-after <id>", "Cursor: ID of last item from previous page").option("--page-all", "Auto-paginate through all pages (outputs NDJSON)").action(async (cmdOpts) => {
+		try {
+			const opts = orders.optsWithGlobals();
+			const client = getClient$2(opts);
+			const params = {
+				status: cmdOpts.status,
+				limit: cmdOpts.limit,
+				startingAfter: cmdOpts.startingAfter
+			};
+			if (cmdOpts.customerId) params["customerId"] = validateResourceId(cmdOpts.customerId);
+			if (cmdOpts.pageAll) {
+				await paginateAll({
+					client,
+					path: "/v1/orders",
+					params,
+					outputFormat: opts.output,
+					fields: opts.fields?.split(",")
+				});
+				return;
+			}
+			const result = extractList(await client.get("/v1/orders", params));
+			render(opts.fields ? pickFields(result, opts.fields.split(",")) : result, getOutputOpts$2(opts));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+	orders.command("get").description("Get order details including items and charge history").argument("<id>", "Order ID (CUID)").action(async (id) => {
+		try {
+			const opts = orders.optsWithGlobals();
+			const validId = validateResourceId(id);
+			const data = await getClient$2(opts).get(`/v1/orders/${validId}`);
+			render(opts.fields ? pickFields(data, opts.fields.split(",")) : data, getOutputOpts$2(opts));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+}
+//#endregion
+//#region src/commands/invoices.ts
+function getClient$1(opts) {
+	return new RecurClient({
+		baseUrl: resolveBaseUrl(opts),
+		secretKey: resolveSecretKey(opts)
+	});
+}
+function getOutputOpts$1(opts) {
+	return {
+		format: opts.output,
+		fields: opts.fields?.split(",")
+	};
+}
+function registerInvoicesCommand(program) {
+	const invoices = program.command("invoices").description("View invoices (billing records for subscriptions)");
+	invoices.addHelpText("after", `
+Fields: id, status, amount, currency, subscription_id, subscription, customer_id, period_start, period_end, paid_at, created_at
+Statuses: draft, open, paid, void, uncollectible
+IDs are CUID format.
+
+Examples:
+  $ recur invoices list --output json
+  $ recur invoices list --subscription-id <subscription-id>
+  $ recur invoices list --customer-id <customer-id>
+  $ recur invoices list --status paid
+  $ recur invoices get <id> --output json
+`);
+	invoices.command("list").description("List invoices. Filter by subscription, customer, or status.").option("--subscription-id <id>", "Filter by subscription ID").option("--customer-id <id>", "Filter by customer ID").option("--status <status>", "Filter: draft, open, paid, void, uncollectible").option("--limit <n>", "Max results per page (1-100, default: 10)", "10").option("--starting-after <id>", "Cursor: ID of last item from previous page").option("--page-all", "Auto-paginate through all pages (outputs NDJSON)").action(async (cmdOpts) => {
+		try {
+			const opts = invoices.optsWithGlobals();
+			const client = getClient$1(opts);
+			const params = {
+				status: cmdOpts.status,
+				limit: cmdOpts.limit,
+				startingAfter: cmdOpts.startingAfter
+			};
+			if (cmdOpts.subscriptionId) params["subscriptionId"] = validateResourceId(cmdOpts.subscriptionId);
+			if (cmdOpts.customerId) params["customerId"] = validateResourceId(cmdOpts.customerId);
+			if (cmdOpts.pageAll) {
+				await paginateAll({
+					client,
+					path: "/v1/invoices",
+					params,
+					outputFormat: opts.output,
+					fields: opts.fields?.split(",")
+				});
+				return;
+			}
+			const result = extractList(await client.get("/v1/invoices", params));
+			render(opts.fields ? pickFields(result, opts.fields.split(",")) : result, getOutputOpts$1(opts));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+	invoices.command("get").description("Get invoice details including line items and payment info").argument("<id>", "Invoice ID (CUID)").action(async (id) => {
+		try {
+			const opts = invoices.optsWithGlobals();
+			const validId = validateResourceId(id);
+			const data = await getClient$1(opts).get(`/v1/invoices/${validId}`);
+			render(opts.fields ? pickFields(data, opts.fields.split(",")) : data, getOutputOpts$1(opts));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+}
+//#endregion
+//#region src/commands/checkouts.ts
+function getClient(opts) {
+	return new RecurClient({
+		baseUrl: resolveBaseUrl(opts),
+		secretKey: resolveSecretKey(opts)
+	});
+}
+function getOutputOpts(opts) {
+	return {
+		format: opts.output,
+		fields: opts.fields?.split(",")
+	};
+}
+function registerCheckoutsCommand(program) {
+	const checkouts = program.command("checkouts").description("Create and inspect checkout sessions (payment pages)");
+	checkouts.addHelpText("after", `
+Fields: id, url, status, customer_id, product_id, expires_at, created_at
+IDs are CUID format. The returned "url" is the hosted checkout page URL.
+
+Examples:
+  $ recur checkouts create --product-id <product-id> --customer-email user@example.com
+  $ recur checkouts create --json '{"productId":"<product-id>","successUrl":"https://..."}'
+  $ recur checkouts create --dry-run --product-id <product-id>
+  $ recur checkouts get <id> --output json
+`);
+	checkouts.command("create").description("Create a checkout session. Returns a URL for the hosted payment page.").option("--product-id <id>", "Product ID (CUID, required)").option("--customer-email <email>", "Pre-fill customer email").option("--success-url <url>", "Redirect URL after successful payment").option("--cancel-url <url>", "Redirect URL if customer cancels").action(async (cmdOpts) => {
+		try {
+			const opts = checkouts.optsWithGlobals();
+			let body;
+			if (opts.json) {
+				const flagsUsed = [
+					"productId",
+					"customerEmail",
+					"successUrl",
+					"cancelUrl"
+				].filter((f) => cmdOpts[f]);
+				if (flagsUsed.length > 0) console.error(pc.yellow(`Warning: --json provided, ignoring flags: --${flagsUsed.map((f) => f.replace(/([A-Z])/g, "-$1").toLowerCase()).join(", --")}`));
+				body = parseJsonPayload(opts.json);
+			} else {
+				body = {};
+				if (cmdOpts.productId) body["productId"] = validateResourceId(cmdOpts.productId);
+				if (cmdOpts.customerEmail) body["customerEmail"] = cmdOpts.customerEmail;
+				if (cmdOpts.successUrl) body["successUrl"] = cmdOpts.successUrl;
+				if (cmdOpts.cancelUrl) body["cancelUrl"] = cmdOpts.cancelUrl;
+			}
+			if (opts.dryRun) {
+				const errors = validateRequiredFields(body, "checkouts.create");
+				if (errors.length > 0) {
+					console.error(pc.red(`Validation errors:\n  ${errors.join("\n  ")}`));
+					process.exit(1);
+				}
+				console.error(pc.yellow("[dry-run] Would create checkout session:"));
+				render(body, { format: "json" });
+				return;
+			}
+			render(await getClient(opts).post("/v1/checkouts", body), getOutputOpts(opts));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+	checkouts.command("get").description("Get checkout session status (pending, completed, expired)").argument("<id>", "Checkout session ID (CUID)").action(async (id) => {
+		try {
+			const opts = checkouts.optsWithGlobals();
+			const validId = validateResourceId(id);
+			const data = await getClient(opts).get(`/v1/checkouts/${validId}`);
+			render(opts.fields ? pickFields(data, opts.fields.split(",")) : data, getOutputOpts(opts));
+		} catch (err) {
+			handleError(err);
+		}
+	});
+}
+//#endregion
+//#region src/commands/schema.ts
+function registerSchemaCommand(program) {
+	const schema = program.command("schema").description("Dump machine-readable API schema (for AI agents and automation)").argument("[resource.action]", "Resource name or resource.action (e.g. products, products.create)");
+	schema.addHelpText("after", `
+Returns JSON describing available API resources, actions, parameters, and response fields.
+Agents can use this to discover the API without reading documentation.
+No authentication required.
+
+Examples:
+  $ recur schema                    # List all resources and their actions
+  $ recur schema products           # Show all actions for products
+  $ recur schema products.create    # Show params, body schema, response fields for create
+
+Output includes: method, path, params, bodySchema, responseFields, supportsDryRun
+`);
+	schema.action((resourceAction) => {
+		try {
+			const opts = program.opts();
+			const result = dumpSchema(resourceAction);
+			const fields = opts.fields?.split(",");
+			render(fields ? pickFields(result, fields) : result, { format: opts.output });
+		} catch (err) {
+			handleError(err);
+		}
+	});
+}
+//#endregion
+//#region src/commands/mcp.ts
+const READ_ONLY = {
+	readOnlyHint: true,
+	destructiveHint: false,
+	idempotentHint: true
+};
+const WRITE = {
+	readOnlyHint: false,
+	destructiveHint: false,
+	idempotentHint: false
+};
+const DESTRUCTIVE = {
+	readOnlyHint: false,
+	destructiveHint: true,
+	idempotentHint: false
+};
+function text(data) {
+	return { content: [{
+		type: "text",
+		text: JSON.stringify(data, null, 2)
+	}] };
+}
+function toolError(message) {
+	return {
+		content: [{
+			type: "text",
+			text: message
+		}],
+		isError: true
+	};
+}
+function registerTools(server, client) {
+	server.registerTool("get_schema", {
+		title: "Get API Schema",
+		description: "Discover available API resources, actions, parameters, and response fields. Call without arguments to list all resources, or specify resource.action for details.",
+		inputSchema: { resource_action: z.string().optional().describe("Resource name or resource.action (e.g. \"products\", \"products.create\"). Omit to list all.") },
+		annotations: READ_ONLY
+	}, async (args) => {
+		try {
+			return text(dumpSchema(args.resource_action));
+		} catch (err) {
+			return toolError(err.message);
+		}
+	});
+	server.registerTool("list_products", {
+		title: "List Products",
+		description: "List all products. Supports filtering by type and active status.",
+		inputSchema: {
+			type: z.enum([
+				"SUBSCRIPTION",
+				"ONE_TIME",
+				"CREDITS",
+				"DONATION"
+			]).optional().describe("Filter by product type"),
+			active: z.enum(["true", "false"]).optional().describe("Filter by active status"),
+			limit: z.string().optional().describe("Max results to return")
+		},
+		annotations: READ_ONLY
+	}, async (args) => {
+		return text(await client.get("/v1/products", {
+			type: args.type,
+			active: args.active,
+			limit: args.limit
+		}));
+	});
+	server.registerTool("get_product", {
+		title: "Get Product",
+		description: "Get a product by ID or slug.",
+		inputSchema: { id: z.string().describe("Product ID (CUID) or slug") },
+		annotations: READ_ONLY
+	}, async (args) => {
+		const path = args.id.includes("-") ? `/v1/products/slug/${args.id}` : `/v1/products/${args.id}`;
+		return text(await client.get(path));
+	});
+	server.registerTool("create_product", {
+		title: "Create Product",
+		description: "Create a new product. Prices are TWD integers (299 = NT$299).",
+		inputSchema: {
+			name: z.string().describe("Product name"),
+			price: z.number().describe("Price in TWD (integer)"),
+			interval: z.enum(["monthly", "yearly"]).optional().describe("Billing interval"),
+			type: z.enum([
+				"SUBSCRIPTION",
+				"ONE_TIME",
+				"CREDITS",
+				"DONATION"
+			]).optional().describe("Product type"),
+			description: z.string().optional().describe("Product description")
+		},
+		annotations: WRITE
+	}, async (args) => {
+		return text(await client.post("/v1/products", args));
+	});
+	server.registerTool("update_product", {
+		title: "Update Product",
+		description: "Update an existing product. Only provided fields are changed.",
+		inputSchema: {
+			id: z.string().describe("Product ID (CUID)"),
+			name: z.string().optional().describe("New product name"),
+			price: z.number().optional().describe("New price in TWD (integer)"),
+			description: z.string().optional().describe("New product description")
+		},
+		annotations: WRITE
+	}, async (args) => {
+		const { id, ...body } = args;
+		return text(await client.patch(`/v1/products/${id}`, body));
+	});
+	server.registerTool("archive_product", {
+		title: "Archive Product",
+		description: "Archive a product (soft-delete). This is destructive.",
+		inputSchema: { id: z.string().describe("Product ID (CUID)") },
+		annotations: DESTRUCTIVE
+	}, async (args) => {
+		return text(await client.post(`/v1/products/${args.id}/archive`));
+	});
+	server.registerTool("list_customers", {
+		title: "List Customers",
+		description: "List customers with optional filters.",
+		inputSchema: {
+			email: z.string().optional().describe("Filter by email"),
+			limit: z.string().optional().describe("Max results"),
+			starting_after: z.string().optional().describe("Cursor for pagination")
+		},
+		annotations: READ_ONLY
+	}, async (args) => {
+		return text(await client.get("/v1/customers", {
+			email: args.email,
+			limit: args.limit,
+			startingAfter: args.starting_after
+		}));
+	});
+	server.registerTool("get_customer", {
+		title: "Get Customer",
+		description: "Get a customer by ID.",
+		inputSchema: { id: z.string().describe("Customer ID (CUID)") },
+		annotations: READ_ONLY
+	}, async (args) => {
+		return text(await client.get(`/v1/customers/${args.id}`));
+	});
+	server.registerTool("update_customer", {
+		title: "Update Customer",
+		description: "Update customer details.",
+		inputSchema: {
+			id: z.string().describe("Customer ID (CUID)"),
+			name: z.string().optional().describe("Customer name"),
+			email: z.string().optional().describe("Customer email")
+		},
+		annotations: WRITE
+	}, async (args) => {
+		const { id, ...body } = args;
+		return text(await client.patch(`/v1/customers/${id}`, body));
+	});
+	server.registerTool("list_subscriptions", {
+		title: "List Subscriptions",
+		description: "List subscriptions with optional filters.",
+		inputSchema: {
+			status: z.string().optional().describe("Filter by status (active, canceled, past_due, trialing)"),
+			customer_id: z.string().optional().describe("Filter by customer ID"),
+			product_id: z.string().optional().describe("Filter by product ID"),
+			limit: z.string().optional().describe("Max results"),
+			starting_after: z.string().optional().describe("Cursor for pagination")
+		},
+		annotations: READ_ONLY
+	}, async (args) => {
+		return text(await client.get("/v1/subscriptions", {
+			status: args.status,
+			customerId: args.customer_id,
+			productId: args.product_id,
+			limit: args.limit,
+			startingAfter: args.starting_after
+		}));
+	});
+	server.registerTool("get_subscription", {
+		title: "Get Subscription",
+		description: "Get a subscription by ID.",
+		inputSchema: { id: z.string().describe("Subscription ID (CUID)") },
+		annotations: READ_ONLY
+	}, async (args) => {
+		return text(await client.get(`/v1/subscriptions/${args.id}`));
+	});
+	server.registerTool("cancel_subscription", {
+		title: "Cancel Subscription",
+		description: "Cancel a subscription. By default cancels at period end. Use immediately=true to cancel now.",
+		inputSchema: {
+			id: z.string().describe("Subscription ID (CUID)"),
+			immediately: z.boolean().optional().describe("Cancel immediately instead of at period end (default: false)"),
+			reason: z.string().optional().describe("Cancellation reason")
+		},
+		annotations: DESTRUCTIVE
+	}, async (args) => {
+		const { id, ...body } = args;
+		return text(await client.post(`/v1/subscriptions/${id}/cancel`, body));
+	});
+	server.registerTool("list_orders", {
+		title: "List Orders",
+		description: "List orders with optional filters.",
+		inputSchema: {
+			status: z.string().optional().describe("Filter by status"),
+			customer_id: z.string().optional().describe("Filter by customer ID"),
+			limit: z.string().optional().describe("Max results"),
+			starting_after: z.string().optional().describe("Cursor for pagination")
+		},
+		annotations: READ_ONLY
+	}, async (args) => {
+		return text(await client.get("/v1/orders", {
+			status: args.status,
+			customerId: args.customer_id,
+			limit: args.limit,
+			startingAfter: args.starting_after
+		}));
+	});
+	server.registerTool("get_order", {
+		title: "Get Order",
+		description: "Get an order by ID.",
+		inputSchema: { id: z.string().describe("Order ID (CUID)") },
+		annotations: READ_ONLY
+	}, async (args) => {
+		return text(await client.get(`/v1/orders/${args.id}`));
+	});
+	server.registerTool("list_invoices", {
+		title: "List Invoices",
+		description: "List invoices with optional filters.",
+		inputSchema: {
+			status: z.string().optional().describe("Filter by status"),
+			customer_id: z.string().optional().describe("Filter by customer ID"),
+			subscription_id: z.string().optional().describe("Filter by subscription ID"),
+			limit: z.string().optional().describe("Max results"),
+			starting_after: z.string().optional().describe("Cursor for pagination")
+		},
+		annotations: READ_ONLY
+	}, async (args) => {
+		return text(await client.get("/v1/invoices", {
+			status: args.status,
+			customerId: args.customer_id,
+			subscriptionId: args.subscription_id,
+			limit: args.limit,
+			startingAfter: args.starting_after
+		}));
+	});
+	server.registerTool("get_invoice", {
+		title: "Get Invoice",
+		description: "Get an invoice by ID.",
+		inputSchema: { id: z.string().describe("Invoice ID (CUID)") },
+		annotations: READ_ONLY
+	}, async (args) => {
+		return text(await client.get(`/v1/invoices/${args.id}`));
+	});
+	server.registerTool("list_webhooks", {
+		title: "List Webhooks",
+		description: "List all webhook endpoints.",
+		inputSchema: { limit: z.string().optional().describe("Max results") },
+		annotations: READ_ONLY
+	}, async (args) => {
+		return text(await client.get("/v1/webhooks", { limit: args.limit }));
+	});
+	server.registerTool("create_webhook", {
+		title: "Create Webhook",
+		description: "Create a new webhook endpoint.",
+		inputSchema: {
+			url: z.string().describe("Webhook endpoint URL (must be HTTPS)"),
+			events: z.array(z.string()).optional().describe("Event types to subscribe to")
+		},
+		annotations: WRITE
+	}, async (args) => {
+		return text(await client.post("/v1/webhooks", args));
+	});
+	server.registerTool("test_webhook", {
+		title: "Test Webhook",
+		description: "Send a test event to a webhook endpoint.",
+		inputSchema: {
+			id: z.string().describe("Webhook ID (CUID)"),
+			event_type: z.string().optional().describe("Event type to test (e.g. checkout.completed)")
+		},
+		annotations: WRITE
+	}, async (args) => {
+		return text(await client.post(`/v1/webhooks/${args.id}/test`, { eventType: args.event_type }));
+	});
+	server.registerTool("delete_webhook", {
+		title: "Delete Webhook",
+		description: "Delete a webhook endpoint.",
+		inputSchema: { id: z.string().describe("Webhook ID (CUID)") },
+		annotations: DESTRUCTIVE
+	}, async (args) => {
+		await client.delete(`/v1/webhooks/${args.id}`);
+		return text({
+			success: true,
+			message: `Webhook ${args.id} deleted`
+		});
+	});
+	server.registerTool("create_checkout", {
+		title: "Create Checkout Session",
+		description: "Create a checkout session for a product.",
+		inputSchema: {
+			product_id: z.string().describe("Product ID (CUID)"),
+			customer_email: z.string().optional().describe("Customer email for pre-fill"),
+			success_url: z.string().optional().describe("Redirect URL after successful payment"),
+			cancel_url: z.string().optional().describe("Redirect URL if customer cancels")
+		},
+		annotations: WRITE
+	}, async (args) => {
+		return text(await client.post("/v1/checkouts", {
+			productId: args.product_id,
+			customerEmail: args.customer_email,
+			successUrl: args.success_url,
+			cancelUrl: args.cancel_url
+		}));
+	});
+	server.registerTool("get_checkout", {
+		title: "Get Checkout Session",
+		description: "Get a checkout session by ID.",
+		inputSchema: { id: z.string().describe("Checkout session ID") },
+		annotations: READ_ONLY
+	}, async (args) => {
+		return text(await client.get(`/v1/checkouts/${args.id}`));
+	});
+}
+function registerMcpCommand(program) {
+	program.command("mcp").description("Start a local MCP server over stdio (for AI agents like Claude, Cursor, etc.)").addHelpText("after", `
+Starts a Model Context Protocol server that exposes Recur API operations as tools.
+Agents connect via stdio transport — no network required beyond API calls.
+
+Setup in Claude Desktop (claude_desktop_config.json):
+  {
+    "mcpServers": {
+      "recur": {
+        "command": "npx",
+        "args": ["recur-tw", "mcp"],
+        "env": { "RECUR_SECRET_KEY": "sk_test_xxx" }
+      }
+    }
+  }
+
+Setup in Claude Code (.mcp.json):
+  {
+    "mcpServers": {
+      "recur": {
+        "command": "npx",
+        "args": ["recur-tw", "mcp"],
+        "env": { "RECUR_SECRET_KEY": "sk_test_xxx" }
+      }
+    }
+  }
+
+Requires a Secret Key (sk_test_* or sk_live_*) via --key, RECUR_SECRET_KEY, or recur login.
+`).action(async () => {
+		try {
+			const opts = program.opts();
+			const secretKey = resolveSecretKey(opts);
+			const client = new RecurClient({
+				baseUrl: resolveBaseUrl(opts),
+				secretKey
+			});
+			const server = new McpServer({
+				name: "recur",
+				version: "0.1.0"
+			}, { capabilities: { tools: {} } });
+			registerTools(server, client);
+			const transport = new StdioServerTransport();
+			await server.connect(transport);
+			transport.onclose = () => {
+				process.exit(0);
+			};
+		} catch (err) {
+			handleError(err);
+		}
+	});
+}
+//#endregion
+//#region src/cli.ts
+const program = new Command();
+program.name("recur").description("Recur CLI — Taiwan subscription payment platform.\nManage products, customers, subscriptions, webhooks, and more.\nAll commands require a Secret Key (sk_test_* or sk_live_*).").version("0.1.0").option("--key <secret-key>", "API secret key (sk_test_* or sk_live_*)").option("--profile <name>", "Use a named profile from ~/.recur/credentials.json").option("--base-url <url>", "API base URL (default: https://api.recur.tw)").option("--output <format>", "Output format: json, table, csv, ndjson (default: json when piped, table otherwise)").hook("preAction", (thisCommand) => {
+	const opts = thisCommand.opts();
+	if (!opts.output) opts.output = process.stdout.isTTY ? "table" : "json";
+	if (![
+		"json",
+		"table",
+		"csv",
+		"ndjson"
+	].includes(opts.output)) {
+		console.error(`Error: unsupported output format "${opts.output}". Use json, table, csv, or ndjson.`);
+		process.exit(1);
+	}
+}).option("--fields <fields>", "Comma-separated fields to include (e.g. id,name,price)").option("--dry-run", "Validate locally without making API calls (write commands only)").option("--json <payload>", "Raw JSON request body, maps directly to API (e.g. '{\"name\":\"Pro\"}')");
+program.addHelpText("after", `
+Global options (--output, --fields, --json, --dry-run) work with ALL subcommands.
+
+Examples:
+  $ recur login                            Save API key interactively (recommended)
+  $ recur products list                    List all products (table format)
+  $ recur products list --output json      List all products (JSON for piping)
+  $ recur products list --fields name,price Show only name and price columns
+  $ recur subscriptions list --status active
+  $ recur customers list --email user@example.com
+  $ recur products create --json '{"name":"Pro","price":299,"interval":"monthly"}'
+  $ recur products create --dry-run --name "Test" --price 99
+  $ recur schema products.create           Show API schema for agents
+
+Auth priority: --key flag > RECUR_SECRET_KEY env var > ~/.recur/credentials.json
+Tip: prefer "recur login" or RECUR_SECRET_KEY env var over --key to avoid exposing keys in shell history.
+`);
+registerLoginCommand(program);
+registerProductsCommand(program);
+registerCustomersCommand(program);
+registerSubscriptionsCommand(program);
+registerWebhooksCommand(program);
+registerOrdersCommand(program);
+registerInvoicesCommand(program);
+registerCheckoutsCommand(program);
+registerSchemaCommand(program);
+registerMcpCommand(program);
+program.parse();
+//#endregion
+export {};
+
+//# sourceMappingURL=cli.mjs.map