@recur-tw/cli 0.1.0

package/dist/index.mjs

@@ -0,0 +1,1095 @@
+import pc from "picocolors";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+//#region src/errors.ts
+var CLIError = class extends Error {
+	constructor(message, statusCode) {
+		super(message);
+		this.statusCode = statusCode;
+		this.name = "CLIError";
+	}
+};
+//#endregion
+//#region src/client.ts
+var RecurClient = class {
+	baseUrl;
+	secretKey;
+	constructor(opts) {
+		this.baseUrl = opts.baseUrl.replace(/\/$/, "");
+		this.secretKey = opts.secretKey;
+	}
+	async request(method, path, opts) {
+		const url = new URL(path, this.baseUrl);
+		if (opts?.params) {
+			for (const [key, value] of Object.entries(opts.params)) if (value !== void 0) url.searchParams.set(key, value);
+		}
+		const headers = {
+			Authorization: `Bearer ${this.secretKey}`,
+			"User-Agent": `@recur-tw/cli/${__CLI_VERSION__}`
+		};
+		const hasBody = opts?.body !== void 0;
+		if (hasBody) headers["Content-Type"] = "application/json";
+		const response = await fetch(url.toString(), {
+			method,
+			headers,
+			body: hasBody ? JSON.stringify(opts.body) : void 0,
+			signal: AbortSignal.timeout(3e4)
+		});
+		let data;
+		if ((response.headers.get("content-type") ?? "").includes("application/json")) data = await response.json();
+		else data = await response.text();
+		data = sanitizeResponse(data);
+		if (!response.ok) {
+			const errorBody = data;
+			const msg = errorBody?.error?.message ?? `HTTP ${response.status}`;
+			let detail = `[${errorBody?.error?.code ?? "unknown"}] ${msg}`;
+			if (response.status === 404) {
+				const resource = path.split("/").filter(Boolean).pop() ?? "";
+				detail += `\nThe resource "${resource}" was not found. Check the ID or slug is correct.`;
+			}
+			throw new CLIError(detail, response.status);
+		}
+		return data;
+	}
+	get(path, params) {
+		return this.request("GET", path, { params });
+	}
+	post(path, body) {
+		return this.request("POST", path, { body });
+	}
+	patch(path, body) {
+		return this.request("PATCH", path, { body });
+	}
+	delete(path) {
+		return this.request("DELETE", path);
+	}
+};
+/**
+* Strip a single string of dangerous characters:
+* - ASCII control chars (0x00-0x08, 0x0B, 0x0C, 0x0E-0x1F) — keep \t \n \r
+* - DEL (0x7F)
+* - Zero-width / invisible Unicode (U+200B-200F, U+FEFF)
+* - Line/paragraph separators (U+2028-2029)
+* - ANSI escape sequences (CSI + OSC patterns)
+*/
+function sanitizeString(str) {
+	return str.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, "").replace(/[\u200B-\u200F\u2028\u2029\uFEFF]/g, "").replace(/\x1B\[[0-9;]*[A-Za-z]/g, "").replace(/\x1B\][^\x07]*\x07/g, "");
+}
+/**
+* Recursively sanitize all string values (and keys) in API responses.
+* Defends against prompt injection via invisible characters or ANSI
+* escape sequences embedded in user-generated data.
+*/
+function sanitizeResponse(data) {
+	if (typeof data === "string") return sanitizeString(data);
+	if (Array.isArray(data)) return data.map(sanitizeResponse);
+	if (data !== null && typeof data === "object") {
+		const obj = data;
+		const result = {};
+		for (const [key, value] of Object.entries(obj)) result[sanitizeString(key)] = sanitizeResponse(value);
+		return result;
+	}
+	return data;
+}
+//#endregion
+//#region src/config.ts
+const CONFIG_DIR = path.join(os.homedir(), ".recur");
+const CREDENTIALS_FILE = path.join(CONFIG_DIR, "credentials.json");
+function ensureConfigDir() {
+	if (!fs.existsSync(CONFIG_DIR)) fs.mkdirSync(CONFIG_DIR, {
+		mode: 448,
+		recursive: true
+	});
+	else if ((fs.statSync(CONFIG_DIR).mode & 511) !== 448) fs.chmodSync(CONFIG_DIR, 448);
+}
+function readCredentials() {
+	if (!fs.existsSync(CREDENTIALS_FILE)) return {
+		profiles: {},
+		activeProfile: "default"
+	};
+	const raw = fs.readFileSync(CREDENTIALS_FILE, "utf-8");
+	try {
+		return JSON.parse(raw);
+	} catch {
+		throw new Error(`Credentials file is corrupted: ${CREDENTIALS_FILE}\nDelete it and run "recur login" to re-authenticate.`);
+	}
+}
+function writeCredentials(creds) {
+	ensureConfigDir();
+	fs.writeFileSync(CREDENTIALS_FILE, JSON.stringify(creds, null, 2), { mode: 384 });
+}
+function getProfile(profileName) {
+	const creds = readCredentials();
+	const name = profileName ?? creds.activeProfile ?? "default";
+	return creds.profiles[name] ?? null;
+}
+function saveProfile(name, profile) {
+	const creds = readCredentials();
+	creds.profiles[name] = profile;
+	if (!creds.activeProfile) creds.activeProfile = name;
+	writeCredentials(creds);
+}
+/**
+* Resolve the secret key from (in priority order):
+* 1. --key flag
+* 2. RECUR_SECRET_KEY env var
+* 3. Active profile in ~/.recur/credentials.json
+*
+* Validates format before returning.
+*/
+function resolveSecretKey(opts) {
+	let key;
+	if (opts.key) key = opts.key;
+	else {
+		const envKey = process.env["RECUR_SECRET_KEY"];
+		if (envKey) key = envKey;
+		else {
+			const profile = getProfile(opts.profile);
+			if (profile?.secretKey) key = profile.secretKey;
+		}
+	}
+	if (!key) throw new Error("No API key found. Provide one via:\n  --key sk_test_xxx\n  RECUR_SECRET_KEY environment variable\n  recur login");
+	if (!/^sk_(test|live)_[a-zA-Z0-9]+$/.test(key)) {
+		if (/^pk_(test|live)_[a-zA-Z0-9]+$/.test(key)) throw new Error("CLI requires a Secret Key (sk_*). Publishable keys (pk_*) are for client-side SDKs only.");
+		throw new Error("Invalid API key format.\nExpected sk_test_* or sk_live_*");
+	}
+	return key;
+}
+/**
+* Validate a URL uses HTTPS (or HTTP for localhost in development).
+* Rejects non-http(s) schemes like file://, javascript://, data://.
+*/
+function validateUrl(url, label) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new Error(`Invalid ${label}: "${url}" is not a valid URL`);
+	}
+	if (parsed.protocol !== "https:" && parsed.protocol !== "http:") throw new Error(`Invalid ${label}: only http/https allowed, got ${parsed.protocol}`);
+	if (parsed.protocol === "http:" && !isLocalhost(parsed.hostname)) console.error(`Warning: ${label} uses HTTP (${url}). API keys will be sent in plaintext. Use HTTPS in production.`);
+	return url;
+}
+function isLocalhost(hostname) {
+	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+}
+/**
+* Resolve the base URL for API calls.
+*/
+function resolveBaseUrl(opts) {
+	if (opts.baseUrl) return validateUrl(opts.baseUrl, "base URL");
+	const envUrl = process.env["RECUR_BASE_URL"];
+	if (envUrl) return validateUrl(envUrl, "RECUR_BASE_URL");
+	const profile = getProfile(opts.profile);
+	if (profile?.baseUrl) return validateUrl(profile.baseUrl, "profile base URL");
+	return "https://api.recur.tw";
+}
+//#endregion
+//#region src/output.ts
+/**
+* Render data in the specified format.
+* Agent-optimized: --output json produces clean, parseable JSON to stdout.
+* Human-optimized: table format with colors to stderr-safe stdout.
+*/
+function render(data, opts = { format: "table" }) {
+	switch (opts.format) {
+		case "json":
+			renderJson(data);
+			break;
+		case "ndjson":
+			renderNdjson(data);
+			break;
+		case "csv":
+			renderCsv(data, opts);
+			break;
+		default:
+			renderTable(data, opts);
+			break;
+	}
+}
+function renderJson(data) {
+	console.log(JSON.stringify(data, null, 2));
+}
+/**
+* NDJSON: one JSON object per line, no array wrapper.
+* Enables stream processing without buffering entire response.
+*/
+function renderNdjson(data) {
+	const rows = Array.isArray(data) ? data : [data];
+	for (const row of rows) console.log(JSON.stringify(row));
+}
+function renderCsv(data, opts) {
+	const rows = Array.isArray(data) ? data : [data];
+	if (rows.length === 0) return;
+	const fields = opts.fields ?? Object.keys(rows[0]);
+	if (!opts.noHeaders) console.log(fields.join(","));
+	for (const row of rows) {
+		const record = row;
+		const values = fields.map((f) => {
+			const val = record[f];
+			if (val === null || val === void 0) return "";
+			const str = typeof val === "object" ? JSON.stringify(val) : String(val);
+			if (str.includes(",") || str.includes("\"") || str.includes("\n") || /^[=+\-@]/.test(str)) return `"${str.replace(/"/g, "\"\"")}"`;
+			return str;
+		});
+		console.log(values.join(","));
+	}
+}
+function renderTable(data, opts) {
+	const rows = Array.isArray(data) ? data : [data];
+	if (rows.length === 0) {
+		console.log(pc.dim("No results"));
+		return;
+	}
+	const fields = opts.fields ?? Object.keys(rows[0]);
+	const widths = {};
+	for (const field of fields) widths[field] = field.length;
+	for (const row of rows) {
+		const record = row;
+		for (const field of fields) {
+			const val = formatValue(record[field]);
+			widths[field] = Math.min(Math.max(widths[field] ?? 0, val.length), 50);
+		}
+	}
+	const header = fields.map((f) => pc.bold(f.padEnd(widths[f] ?? 0))).join("  ");
+	console.log(header);
+	console.log(fields.map((f) => "─".repeat(widths[f] ?? 0)).join("  "));
+	for (const row of rows) {
+		const record = row;
+		const line = fields.map((f) => {
+			const val = formatValue(record[f]);
+			const maxWidth = widths[f] ?? 50;
+			const padded = val.padEnd(maxWidth);
+			return padded.length > maxWidth ? padded.slice(0, maxWidth - 1) + "…" : padded;
+		}).join("  ");
+		console.log(line);
+	}
+	console.log(pc.dim(`\n${rows.length} result${rows.length === 1 ? "" : "s"}`));
+}
+function formatValue(val) {
+	if (val === null || val === void 0) return pc.dim("—");
+	if (typeof val === "boolean") return val ? pc.green("true") : pc.dim("false");
+	if (typeof val === "object") return sanitizeString(JSON.stringify(val));
+	return sanitizeString(String(val));
+}
+/**
+* Pick specific fields from data (for --fields flag).
+*/
+function pickFields(data, fields) {
+	warnUnknownFields(data, fields);
+	if (Array.isArray(data)) return data.map((item) => pick(item, fields));
+	return pick(data, fields);
+}
+function pick(obj, fields) {
+	const result = {};
+	for (const field of fields) if (field in obj) result[field] = obj[field];
+	return result;
+}
+/**
+* Warn about --fields that don't exist in the data.
+* Called once per render to avoid repeated warnings.
+*/
+function warnUnknownFields(data, fields) {
+	const sample = Array.isArray(data) ? data[0] : data;
+	if (!sample || typeof sample !== "object") return;
+	const available = Object.keys(sample);
+	const unknown = fields.filter((f) => !available.includes(f));
+	if (unknown.length > 0) console.error(pc.yellow(`Warning: unknown fields: ${unknown.map(sanitizeString).join(", ")}. Available: ${available.map(sanitizeString).join(", ")}`));
+}
+//#endregion
+//#region ../core/src/api/resources.ts
+/** Shorthand constructors for response field definitions */
+const f = {
+	str: (name, description, nullable) => ({
+		name,
+		type: "string",
+		description,
+		nullable
+	}),
+	num: (name, description, nullable) => ({
+		name,
+		type: "number",
+		description,
+		nullable
+	}),
+	bool: (name, description) => ({
+		name,
+		type: "boolean",
+		description
+	}),
+	dt: (name, description, nullable) => ({
+		name,
+		type: "datetime",
+		description,
+		nullable
+	}),
+	obj: (name, description, nullable) => ({
+		name,
+		type: "object",
+		description,
+		nullable
+	}),
+	arr: (name, description) => ({
+		name,
+		type: "array",
+		description
+	})
+};
+/** Extract field names from ResponseFieldDef[] (for --fields validation) */
+function fieldNames(fields) {
+	return fields.map((f) => f.name);
+}
+const ProductType = [
+	"SUBSCRIPTION",
+	"ONE_TIME",
+	"CREDITS",
+	"DONATION"
+];
+const ProductStatus = ["active", "archived"];
+const BillingInterval = ["monthly", "yearly"];
+const SubscriptionStatus = [
+	"active",
+	"canceled",
+	"expired",
+	"past_due",
+	"trialing"
+];
+const OrderStatus = [
+	"pending",
+	"paid",
+	"failed",
+	"refunded"
+];
+const InvoiceStatus = [
+	"draft",
+	"open",
+	"paid",
+	"void",
+	"uncollectible"
+];
+const cursorPagination = {
+	cursor: "starting_after",
+	defaultLimit: 10,
+	maxLimit: 100
+};
+/** All API resources in registration order */
+const allResources = [
+	{
+		resource: "products",
+		description: "Manage subscription and one-time products",
+		actions: {
+			list: {
+				method: "GET",
+				path: "/v1/products",
+				description: "List all products",
+				params: {
+					status: {
+						type: "string",
+						description: "Filter by status",
+						enum: ProductStatus
+					},
+					limit: {
+						type: "number",
+						description: "Max results",
+						default: 20
+					}
+				},
+				responseFields: [
+					f.str("id", "Product ID (CUID)"),
+					f.str("name", "Product name"),
+					f.str("slug", "URL-friendly slug", true),
+					f.str("description", "Product description", true),
+					f.str("type", "SUBSCRIPTION, ONE_TIME, CREDITS, or DONATION"),
+					f.str("interval", "Billing interval: month or year", true),
+					f.num("interval_count", "Billing interval multiplier", true),
+					f.num("price", "Price in TWD (integer, e.g. 299 = NT$299)"),
+					f.str("currency", "Always TWD"),
+					f.num("trial_days", "Free trial days", true),
+					f.num("display_order", "Sort order for UI", true),
+					f.obj("metadata", "Custom key-value data", true),
+					f.bool("active", "Whether the product is active"),
+					f.dt("created_at", "Creation timestamp")
+				]
+			},
+			get: {
+				method: "GET",
+				path: "/v1/products/:id",
+				description: "Get a product by ID (CUID) or slug (contains hyphen)",
+				responseFields: [
+					f.str("id"),
+					f.str("name"),
+					f.str("slug", void 0, true),
+					f.str("description", void 0, true),
+					f.str("type"),
+					f.str("interval", void 0, true),
+					f.num("interval_count", void 0, true),
+					f.num("price", "Price in TWD (integer)"),
+					f.str("currency"),
+					f.num("trial_days", void 0, true),
+					f.num("display_order", void 0, true),
+					f.obj("metadata", void 0, true),
+					f.bool("active"),
+					f.dt("created_at"),
+					f.dt("updated_at")
+				]
+			},
+			create: {
+				method: "POST",
+				path: "/v1/products",
+				description: "Create a new product",
+				bodySchema: {
+					name: {
+						type: "string",
+						description: "Product name",
+						required: true
+					},
+					price: {
+						type: "number",
+						description: "Price in TWD (integer, e.g. 299 = NT$299)",
+						required: true
+					},
+					interval: {
+						type: "string",
+						description: "Billing interval",
+						enum: BillingInterval
+					},
+					type: {
+						type: "string",
+						description: "Product type",
+						enum: ProductType
+					},
+					description: {
+						type: "string",
+						description: "Product description"
+					}
+				},
+				responseFields: [
+					f.str("id"),
+					f.str("name"),
+					f.str("slug", void 0, true),
+					f.num("price"),
+					f.str("interval", void 0, true),
+					f.str("type"),
+					f.bool("active"),
+					f.dt("created_at")
+				],
+				supportsDryRun: true
+			},
+			update: {
+				method: "PATCH",
+				path: "/v1/products/:id",
+				description: "Update a product",
+				bodySchema: {
+					name: {
+						type: "string",
+						description: "Product name"
+					},
+					description: {
+						type: "string",
+						description: "Product description"
+					},
+					price: {
+						type: "number",
+						description: "Price in TWD (integer)"
+					}
+				},
+				responseFields: [
+					f.str("id"),
+					f.str("name"),
+					f.str("slug", void 0, true),
+					f.num("price"),
+					f.dt("updated_at")
+				],
+				supportsDryRun: true
+			},
+			archive: {
+				method: "POST",
+				path: "/v1/products/:id/archive",
+				description: "Archive a product",
+				responseFields: [f.str("id"), f.bool("active")],
+				supportsDryRun: true
+			}
+		}
+	},
+	{
+		resource: "customers",
+		description: "Manage customers",
+		actions: {
+			list: {
+				method: "GET",
+				path: "/v1/customers",
+				description: "List all customers",
+				params: {
+					email: {
+						type: "string",
+						description: "Filter by email"
+					},
+					status: {
+						type: "string",
+						description: "Filter by status",
+						enum: [
+							"ACTIVE",
+							"SUSPENDED",
+							"BANNED"
+						]
+					},
+					limit: {
+						type: "number",
+						description: "Max results (1-100)",
+						default: 10
+					},
+					startingAfter: {
+						type: "string",
+						description: "Cursor: ID of last item from previous page",
+						cliFlag: "--starting-after"
+					}
+				},
+				responseFields: [
+					f.str("id", "Customer ID (CUID)"),
+					f.str("email", "Customer email"),
+					f.str("name", "Customer name", true),
+					f.str("external_id", "External system ID", true),
+					f.bool("email_verified", "Whether email is verified"),
+					f.str("status", "ACTIVE, SUSPENDED, or BANNED"),
+					f.dt("created_at", "Creation timestamp"),
+					f.dt("updated_at", "Last update timestamp"),
+					f.num("subscriptions_count", "Number of subscriptions"),
+					f.num("orders_count", "Number of orders")
+				],
+				pagination: cursorPagination
+			},
+			get: {
+				method: "GET",
+				path: "/v1/customers/:id",
+				description: "Get a customer by ID",
+				responseFields: [
+					f.str("id"),
+					f.str("email"),
+					f.str("name", void 0, true),
+					f.str("external_id", void 0, true),
+					f.bool("email_verified"),
+					f.str("status"),
+					f.arr("subscriptions", "Customer subscriptions"),
+					f.dt("created_at"),
+					f.dt("updated_at")
+				]
+			},
+			update: {
+				method: "PATCH",
+				path: "/v1/customers/:id",
+				description: "Update a customer",
+				bodySchema: {
+					name: {
+						type: "string",
+						description: "Customer name"
+					},
+					externalId: {
+						type: "string",
+						description: "External system ID",
+						cliFlag: "--external-id"
+					}
+				},
+				responseFields: [
+					f.str("id"),
+					f.str("email"),
+					f.str("name", void 0, true),
+					f.str("external_id", void 0, true)
+				],
+				supportsDryRun: true
+			}
+		}
+	},
+	{
+		resource: "subscriptions",
+		description: "Manage subscriptions",
+		actions: {
+			list: {
+				method: "GET",
+				path: "/v1/subscriptions",
+				description: "List subscriptions",
+				params: {
+					status: {
+						type: "string",
+						description: "Filter by status",
+						enum: SubscriptionStatus
+					},
+					customerId: {
+						type: "string",
+						description: "Filter by customer ID",
+						cliFlag: "--customer-id"
+					},
+					email: {
+						type: "string",
+						description: "Filter by customer email"
+					},
+					limit: {
+						type: "number",
+						description: "Max results (1-100)",
+						default: 10
+					},
+					startingAfter: {
+						type: "string",
+						description: "Cursor: ID of last item from previous page",
+						cliFlag: "--starting-after"
+					}
+				},
+				responseFields: [
+					f.str("id", "Subscription ID"),
+					f.str("status", "active, canceled, expired, past_due, or trialing"),
+					f.str("product_id", "Product ID"),
+					f.str("product_slug", "Product slug", true),
+					f.str("product_name", "Product name"),
+					f.num("amount", "Billing amount in TWD (integer)"),
+					f.str("interval", "Billing interval: month or year"),
+					f.num("interval_count", "Interval multiplier"),
+					f.dt("current_period_start", "Current billing period start"),
+					f.dt("current_period_end", "Current billing period end"),
+					f.dt("canceled_at", "When subscription was canceled", true),
+					f.dt("started_at", "When subscription started", true),
+					f.obj("customer", "Customer object (id, email, name)", true)
+				],
+				pagination: cursorPagination
+			},
+			get: {
+				method: "GET",
+				path: "/v1/subscriptions/:id",
+				description: "Get subscription details",
+				responseFields: [
+					f.str("id"),
+					f.str("status"),
+					f.obj("product", "Product details (id, slug, name, price, interval)"),
+					f.obj("customer", "Customer details (id, email, name, external_id)"),
+					f.num("amount", "Billing amount in TWD"),
+					f.str("interval"),
+					f.num("interval_count"),
+					f.dt("current_period_start"),
+					f.dt("current_period_end"),
+					f.bool("cancel_at_period_end", "Whether subscription cancels at period end"),
+					f.dt("canceled_at", void 0, true),
+					f.dt("started_at", void 0, true),
+					f.dt("trial_start", void 0, true),
+					f.dt("trial_end", void 0, true),
+					f.arr("invoices", "Invoice history"),
+					f.obj("metadata", void 0, true),
+					f.dt("created_at")
+				]
+			},
+			cancel: {
+				method: "POST",
+				path: "/v1/subscriptions/:id/cancel",
+				description: "Cancel a subscription",
+				bodySchema: { immediately: {
+					type: "boolean",
+					description: "Cancel immediately (flag, no value). Omit for safe period-end cancel. Do NOT pass --immediately false.",
+					default: false
+				} },
+				responseFields: [
+					f.str("id"),
+					f.str("status"),
+					f.bool("cancel_at_period_end"),
+					f.dt("canceled_at", void 0, true)
+				],
+				supportsDryRun: true
+			}
+		}
+	},
+	{
+		resource: "orders",
+		description: "View orders",
+		actions: {
+			list: {
+				method: "GET",
+				path: "/v1/orders",
+				description: "List orders",
+				params: {
+					status: {
+						type: "string",
+						description: "Filter by status",
+						enum: OrderStatus
+					},
+					customerId: {
+						type: "string",
+						description: "Filter by customer ID",
+						cliFlag: "--customer-id"
+					},
+					limit: {
+						type: "number",
+						description: "Max results (1-100)",
+						default: 10
+					},
+					startingAfter: {
+						type: "string",
+						description: "Cursor: ID of last item from previous page",
+						cliFlag: "--starting-after"
+					}
+				},
+				responseFields: [
+					f.str("id", "Order ID"),
+					f.str("status", "pending, paid, failed, or refunded"),
+					f.num("total", "Total amount in TWD (integer)"),
+					f.num("subtotal", "Subtotal before discounts"),
+					f.str("currency", "Always TWD"),
+					f.str("customer_id", "Customer ID", true),
+					f.num("items_count", "Number of line items"),
+					f.dt("created_at", "Creation timestamp")
+				],
+				pagination: cursorPagination
+			},
+			get: {
+				method: "GET",
+				path: "/v1/orders/:id",
+				description: "Get order details",
+				responseFields: [
+					f.str("id"),
+					f.str("status"),
+					f.num("total"),
+					f.num("subtotal"),
+					f.num("discount_amount", "Discount applied"),
+					f.str("currency"),
+					f.obj("customer", "Customer details (id, email, name)"),
+					f.arr("items", "Line items (id, productId, productName, price, quantity)"),
+					f.dt("created_at")
+				]
+			}
+		}
+	},
+	{
+		resource: "invoices",
+		description: "View invoices",
+		actions: {
+			list: {
+				method: "GET",
+				path: "/v1/invoices",
+				description: "List invoices",
+				params: {
+					subscriptionId: {
+						type: "string",
+						description: "Filter by subscription ID",
+						cliFlag: "--subscription-id"
+					},
+					customerId: {
+						type: "string",
+						description: "Filter by customer ID",
+						cliFlag: "--customer-id"
+					},
+					status: {
+						type: "string",
+						description: "Filter by status",
+						enum: InvoiceStatus
+					},
+					limit: {
+						type: "number",
+						description: "Max results (1-100)",
+						default: 10
+					},
+					startingAfter: {
+						type: "string",
+						description: "Cursor: ID of last item from previous page",
+						cliFlag: "--starting-after"
+					}
+				},
+				responseFields: [
+					f.str("id", "Invoice ID"),
+					f.str("status", "draft, open, paid, void, or uncollectible"),
+					f.num("amount", "Invoice amount in TWD (integer)"),
+					f.str("currency", "Always TWD"),
+					f.str("subscription_id", "Associated subscription ID"),
+					f.str("customer_id", "Customer ID"),
+					f.dt("period_start", "Billing period start"),
+					f.dt("period_end", "Billing period end"),
+					f.dt("paid_at", "When invoice was paid", true),
+					f.dt("created_at", "Creation timestamp")
+				],
+				pagination: cursorPagination
+			},
+			get: {
+				method: "GET",
+				path: "/v1/invoices/:id",
+				description: "Get invoice details",
+				responseFields: [
+					f.str("id"),
+					f.str("status"),
+					f.num("amount"),
+					f.str("currency"),
+					f.str("subscription_id"),
+					f.obj("subscription", "Subscription details (id, productId, status)"),
+					f.str("customer_id"),
+					f.dt("period_start"),
+					f.dt("period_end"),
+					f.dt("paid_at", void 0, true),
+					f.dt("created_at")
+				]
+			}
+		}
+	},
+	{
+		resource: "webhooks",
+		description: "Manage webhook endpoints",
+		actions: {
+			list: {
+				method: "GET",
+				path: "/v1/webhooks",
+				description: "List webhook endpoints",
+				params: { limit: {
+					type: "number",
+					description: "Max results",
+					default: 20
+				} },
+				responseFields: [
+					f.str("id", "Webhook ID"),
+					f.str("url", "Endpoint URL"),
+					f.arr("events", "Subscribed event types"),
+					f.bool("is_active", "Whether the webhook is active"),
+					f.dt("created_at", "Creation timestamp")
+				]
+			},
+			create: {
+				method: "POST",
+				path: "/v1/webhooks",
+				description: "Create a webhook endpoint",
+				bodySchema: {
+					url: {
+						type: "string",
+						description: "Webhook URL",
+						required: true
+					},
+					events: {
+						type: "string",
+						description: "Comma-separated event types (default: essential events)"
+					}
+				},
+				responseFields: [
+					f.str("id"),
+					f.str("url"),
+					f.str("secret", "Signing secret (shown once)"),
+					f.arr("events"),
+					f.bool("is_active")
+				],
+				supportsDryRun: true
+			},
+			test: {
+				method: "POST",
+				path: "/v1/webhooks/:id/test",
+				description: "Send a test event to verify webhook endpoint",
+				bodySchema: { eventType: {
+					type: "string",
+					description: "Event type to send",
+					default: "checkout.completed",
+					cliFlag: "--event"
+				} },
+				responseFields: [
+					f.bool("success", "Whether the test delivery succeeded"),
+					f.num("status_code", "HTTP status code from endpoint"),
+					f.num("response_time", "Response time in ms")
+				]
+			},
+			delete: {
+				method: "DELETE",
+				path: "/v1/webhooks/:id",
+				description: "Delete a webhook endpoint",
+				responseFields: [f.str("id")],
+				supportsDryRun: true
+			}
+		}
+	},
+	{
+		resource: "checkouts",
+		description: "Create checkout sessions",
+		actions: {
+			create: {
+				method: "POST",
+				path: "/v1/checkouts",
+				description: "Create a checkout session",
+				bodySchema: {
+					productId: {
+						type: "string",
+						description: "Product ID",
+						required: true,
+						cliFlag: "--product-id"
+					},
+					customerEmail: {
+						type: "string",
+						description: "Customer email",
+						cliFlag: "--customer-email"
+					},
+					successUrl: {
+						type: "string",
+						description: "Redirect URL on success",
+						cliFlag: "--success-url"
+					},
+					cancelUrl: {
+						type: "string",
+						description: "Redirect URL on cancel",
+						cliFlag: "--cancel-url"
+					}
+				},
+				responseFields: [
+					f.str("id", "Checkout session ID"),
+					f.str("url", "Hosted checkout URL"),
+					f.str("status", "Session status"),
+					f.dt("expires_at", "Session expiration")
+				],
+				supportsDryRun: true
+			},
+			get: {
+				method: "GET",
+				path: "/v1/checkouts/:id",
+				description: "Get checkout session status",
+				responseFields: [
+					f.str("id"),
+					f.str("url", void 0, true),
+					f.str("status"),
+					f.str("customer_id", void 0, true),
+					f.str("product_id"),
+					f.dt("created_at")
+				]
+			}
+		}
+	}
+];
+//#endregion
+//#region src/schema.ts
+/**
+* Schema registry for runtime introspection.
+* Resource definitions are imported from @workspace/core/api (canonical source).
+* Enables `recur schema <resource>.<action>` for agents to discover
+* available parameters, fields, and request bodies.
+*/
+var SchemaError = class extends CLIError {
+	available;
+	constructor(message, available) {
+		super(`${message}\nAvailable: ${available.join(", ")}`);
+		this.available = available;
+	}
+};
+const registry = {};
+for (const def of allResources) registry[def.resource] = def;
+function getResource(name) {
+	return registry[name];
+}
+function getAllResources() {
+	return Object.values(registry);
+}
+function getAction(resourceAction) {
+	const [resource, action] = resourceAction.split(".");
+	if (!resource || !action) return void 0;
+	return registry[resource]?.actions[action];
+}
+/**
+* Dump schema as machine-readable JSON for agents.
+* Throws CLIError for unknown resources/actions (non-zero exit).
+*/
+function dumpSchema(resourceAction) {
+	if (resourceAction) {
+		const [resourceName, actionName] = resourceAction.split(".");
+		if (!resourceName) throw new SchemaError("Invalid format. Use: <resource> or <resource>.<action>", Object.keys(registry));
+		const resource = registry[resourceName];
+		if (!resource) throw new SchemaError(`Unknown resource: ${resourceName}`, Object.keys(registry));
+		if (!actionName) return resource;
+		const action = resource.actions[actionName];
+		if (!action) throw new SchemaError(`Unknown action: ${actionName} on ${resourceName}`, Object.keys(resource.actions));
+		return {
+			resource: resourceName,
+			action: actionName,
+			...action
+		};
+	}
+	return Object.values(registry).map((r) => ({
+		resource: r.resource,
+		description: r.description,
+		actions: Object.entries(r.actions).map(([name, def]) => ({
+			name,
+			method: def.method,
+			path: def.path,
+			description: def.description
+		}))
+	}));
+}
+//#endregion
+//#region src/validator.ts
+/**
+* Validate a resource ID or slug against dangerous input patterns.
+* Rejects path traversals, embedded query params, control chars.
+*
+* Does NOT enforce ID prefixes — Recur uses CUID-format IDs (e.g.
+* "ro91zsticf41uwq8bungmklk") without a prefix like "cus_".
+*/
+function validateResourceId(id) {
+	if (!id || typeof id !== "string") throw new CLIError("Resource ID is required");
+	if (id.includes("..") || id.includes("/") || id.includes("\\")) throw new CLIError(`Invalid resource ID: path traversal detected in "${id}"`);
+	if (id.includes("?") || id.includes("#") || id.includes("%")) throw new CLIError(`Invalid resource ID: special characters not allowed in "${id}"`);
+	for (let i = 0; i < id.length; i++) {
+		const code = id.charCodeAt(i);
+		if (code < 32 || code === 127) throw new CLIError(`Invalid resource ID: control character at position ${i}`);
+	}
+	if (/[\u200B-\u200F\u2028\u2029\uFEFF]/.test(id)) throw new CLIError("Invalid resource ID: invisible Unicode characters detected");
+	return id;
+}
+/**
+* Parse and validate a raw JSON payload from --json flag.
+*/
+function parseJsonPayload(raw) {
+	try {
+		const parsed = JSON.parse(raw);
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new CLIError("JSON payload must be an object");
+		return parsed;
+	} catch (err) {
+		if (err instanceof CLIError) throw err;
+		throw new CLIError(`Invalid JSON payload: ${err.message}`);
+	}
+}
+/**
+* Validate that a string looks like a valid API key.
+*/
+function validateApiKey(key) {
+	if (!/^sk_(test|live)_[a-zA-Z0-9]+$/.test(key)) {
+		if (/^pk_(test|live)_[a-zA-Z0-9]+$/.test(key)) throw new CLIError("CLI requires a Secret Key (sk_*). Publishable keys (pk_*) are for client-side SDKs only.");
+		throw new CLIError("Invalid API key format. Expected sk_test_* or sk_live_*");
+	}
+	return key;
+}
+//#endregion
+//#region src/extract.ts
+/**
+* Extract list data from API responses.
+*
+* All list endpoints return a standard envelope: { object: 'list', data: [...] }.
+* This function also handles legacy shapes and direct arrays as fallback.
+*/
+function extractList(response) {
+	if (Array.isArray(response)) return response;
+	if (typeof response === "object" && response !== null) {
+		const obj = response;
+		if (Array.isArray(obj["data"])) return obj["data"];
+		for (const value of Object.values(obj)) if (Array.isArray(value)) return value;
+	}
+	return [response];
+}
+/**
+* Extract list data with pagination metadata.
+*
+* API responses include:
+* - has_more: boolean — whether more pages exist
+* - next_cursor: string | null — ID to pass as starting_after for next page
+*/
+function extractPaginatedList(response) {
+	const data = extractList(response);
+	if (typeof response === "object" && response !== null) {
+		const obj = response;
+		return {
+			data,
+			hasMore: obj["has_more"] === true,
+			nextCursor: typeof obj["next_cursor"] === "string" ? obj["next_cursor"] : null
+		};
+	}
+	return {
+		data,
+		hasMore: false,
+		nextCursor: null
+	};
+}
+//#endregion
+export { CLIError, RecurClient, dumpSchema, extractList, extractPaginatedList, fieldNames, getAction, getAllResources, getProfile, getResource, parseJsonPayload, pickFields, render, resolveBaseUrl, resolveSecretKey, sanitizeString, saveProfile, validateApiKey, validateResourceId, validateUrl };
+
+//# sourceMappingURL=index.mjs.map