@vonpay/checkout-cli 0.17.0 → 0.19.0

package/dist/index.js

@@ -1,10 +1,24 @@
 #!/usr/bin/env node
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
 
-// src/index.ts
-import { Command as Command13 } from "commander";
-import { readFileSync as readFileSync4 } from "fs";
-import { dirname as dirname2, join as join3 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+// src/program.ts
+import { Command as Command14 } from "commander";
 
 // src/commands/login.ts
 import { Command, Option } from "commander";
@@ -12,9 +26,9 @@ import { createInterface } from "readline";
 import chalk from "chalk";
 
 // src/config.ts
-import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { chmodSync as chmodSync2, existsSync, mkdirSync as mkdirSync2, readFileSync, rmSync, writeFileSync } from "fs";
 import { homedir } from "os";
-import { join } from "path";
+import { join as join2 } from "path";
 
 // src/utils/json-errors.ts
 var jsonErrors = false;
@@ -34,25 +48,362 @@ function emitCliError(json, text) {
 }
 
 // src/utils/key-mode.ts
-import { isLiveKey } from "@vonpay/checkout-node";
-var TEST_SECRET_KEY_PREFIX = "vp_sk_test_";
-function requiresLiveConfirmation(key) {
-  if (typeof key !== "string") return true;
-  if (key.startsWith(TEST_SECRET_KEY_PREFIX)) return false;
-  if (key.startsWith("vp_pk_")) return false;
-  return true;
-}
+import { keyMode } from "@vonpay/checkout-node";
 function secretKeyMode(key) {
-  if (typeof key !== "string") return null;
-  if (isLiveKey(key)) return "live";
-  if (key.startsWith(TEST_SECRET_KEY_PREFIX)) return "test";
-  return null;
+  const mode = keyMode(key);
+  return mode === "test" || mode === "live" ? mode : null;
 }
 var NOT_A_SECRET_KEY_MESSAGE = "This is not a Von Payments secret key: it must start with vp_sk_test_ (sandbox) or vp_sk_live_ (live). Publishable keys (vp_pk_\u2026) and keys from other services cannot be used with this CLI.";
 
+// src/utils/audit-log.ts
+var audit_log_exports = {};
+__export(audit_log_exports, {
+  AUDIT_FIELDS: () => AUDIT_FIELDS,
+  COMMAND_KIND: () => COMMAND_KIND,
+  MONEY: () => MONEY,
+  UNKNOWN_COMMAND: () => UNKNOWN_COMMAND,
+  _resetAuditForTests: () => _resetAuditForTests,
+  _resetAuditWarningsForTests: () => _resetAuditWarningsForTests,
+  auditError: () => auditError,
+  auditFinish: () => auditFinish,
+  auditIntent: () => auditIntent,
+  auditLine: () => auditLine,
+  auditNote: () => auditNote,
+  auditSignalHandledByCommand: () => auditSignalHandledByCommand,
+  auditStart: () => auditStart,
+  auditUsageError: () => auditUsageError,
+  fullRecordLine: () => fullRecordLine,
+  isMoneyCommand: () => isMoneyCommand,
+  pruneAuditFiles: () => pruneAuditFiles,
+  writeAuditLine: () => writeAuditLine
+});
+__reExport(audit_log_exports, audit_log_star);
+import {
+  chmodSync,
+  closeSync,
+  fchmodSync,
+  fstatSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readdirSync,
+  readSync,
+  unlinkSync,
+  writeSync
+} from "fs";
+import { join } from "path";
+import {
+  AUDIT_DIR_ENV,
+  AUDIT_SWITCH_ENV,
+  DEFAULT_AUDIT_LIMITS,
+  FULL_RECORD_SUFFIX,
+  auditAppendFlags,
+  auditErrorCodeOf,
+  auditFileExpired,
+  auditKeyFields,
+  auditLineFormat,
+  auditSettingsFromEnv,
+  auditSpaceWarnings,
+  checkAuditDirStats,
+  checkAuditFileStats,
+  isReservedLine,
+  spaceDecision,
+  stderrWarn
+} from "@vonpay/checkout-node/internal/audit-log";
+import * as audit_log_star from "@vonpay/checkout-node/internal/audit-log";
+var UNKNOWN_COMMAND = "[unknown command]";
+var FORMAT = auditLineFormat({ nameField: "command", namePattern: /^[a-z0-9-]+( [a-z0-9-]+){0,3}$/, unknownName: UNKNOWN_COMMAND });
+var AUDIT_FIELDS = FORMAT.fields;
+var auditLine = FORMAT.line;
+var fullRecordLine = FORMAT.fullRecordLine;
+function checkDir(dir, st) {
+  if (checkAuditDirStats(st)) chmodSync(dir, 448);
+}
+var FILE_NAME = /^cli-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
+var warned = false;
+var warnedFull = false;
+var warnedReserve = false;
+var warnedTooLong = false;
+function _resetAuditWarningsForTests() {
+  warned = false;
+  warnedFull = false;
+  warnedReserve = false;
+  warnedTooLong = false;
+}
+function warnOnce(dir, err, warn) {
+  if (warned) return;
+  warned = true;
+  warn(
+    `[vonpay] The local audit log cannot be written (${auditErrorCodeOf(err)}) in ${dir}; the command went on without it. Set ${AUDIT_DIR_ENV} to a writable directory of your own, or ${AUDIT_SWITCH_ENV}=off.`
+  );
+}
+function pruneAuditFiles(dir, retentionDays, now = /* @__PURE__ */ new Date(), warn = stderrWarn) {
+  let names;
+  try {
+    checkDir(dir, lstatSync(dir));
+    names = readdirSync(dir);
+  } catch (err) {
+    if (auditErrorCodeOf(err) !== "ENOENT") warnOnce(dir, err, warn);
+    return 0;
+  }
+  let removed = 0;
+  let skipped = 0;
+  for (const name of names) {
+    const m = FILE_NAME.exec(name);
+    if (!m) continue;
+    if (!auditFileExpired(`${m[1]}-${m[2]}-${m[3]}`, now, retentionDays)) continue;
+    const path = join(dir, name);
+    try {
+      if (!lstatSync(path).isFile()) {
+        skipped++;
+        continue;
+      }
+      unlinkSync(path);
+      removed++;
+    } catch {
+      skipped++;
+    }
+  }
+  if (skipped > 0) warn(auditSpaceWarnings.notPruned(skipped, dir));
+  return removed;
+}
+function endsWithFullRecord(fd, size) {
+  const n = Buffer.byteLength(FULL_RECORD_SUFFIX);
+  if (size < n) return false;
+  const buf = Buffer.alloc(n);
+  readSync(fd, buf, 0, n, size - n);
+  return buf.toString("utf8") === FULL_RECORD_SUFFIX;
+}
+function appendSecure(file, line, reserved, record, now, limits, dir, warn) {
+  const fd = openSync(file, auditAppendFlags(), 384);
+  try {
+    const st = fstatSync(fd);
+    if (checkAuditFileStats(st)) fchmodSync(fd, 384);
+    const decision = spaceDecision(st.size, Buffer.byteLength(line), reserved, limits);
+    if (decision === "write") {
+      writeSync(fd, line);
+    } else if (decision === "too_long") {
+      if (!warnedTooLong) {
+        warnedTooLong = true;
+        warn(auditSpaceWarnings.tooLong(limits.maxLineBytes, dir));
+      }
+    } else if (decision === "drop") {
+      if (!warnedReserve) {
+        warnedReserve = true;
+        warn(auditSpaceWarnings.nearlyFull(dir));
+      }
+    } else {
+      const full = fullRecordLine(record.surface, record.version, now);
+      if (!endsWithFullRecord(fd, st.size) && st.size + Buffer.byteLength(full) <= limits.maxFileBytes) writeSync(fd, full);
+      if (!warnedFull) {
+        warnedFull = true;
+        warn(auditSpaceWarnings.full(dir));
+      }
+    }
+  } finally {
+    closeSync(fd);
+  }
+}
+function writeAuditLine(dir, record, now = /* @__PURE__ */ new Date(), warn = stderrWarn, limits = DEFAULT_AUDIT_LIMITS) {
+  const file = join(dir, `cli-${now.toISOString().slice(0, 10)}.jsonl`);
+  try {
+    const line = auditLine(record);
+    const reserved = isReservedLine(record, typeof record.command === "string" && isMoneyCommand(record.command));
+    const attempt = () => {
+      mkdirSync(dir, { recursive: true, mode: 448 });
+      checkDir(dir, lstatSync(dir));
+      appendSecure(file, line, reserved, record, now, limits, dir, warn);
+    };
+    try {
+      attempt();
+    } catch (err) {
+      if (auditErrorCodeOf(err) !== "ENOENT") throw err;
+      attempt();
+    }
+    return true;
+  } catch (err) {
+    warnOnce(dir, err, warn);
+    return false;
+  }
+}
+var COMMAND_KIND = {
+  "checkout login": "local",
+  "checkout logout": "local",
+  "checkout init": "local",
+  "checkout trigger": "local",
+  // signs a synthetic event and sends it to YOUR endpoint, not the API
+  "checkout sessions create": "api",
+  "checkout sessions get": "api",
+  "checkout payment-intents create": "api",
+  "checkout payment-intents get": "api",
+  "checkout payment-intents capture": "api",
+  "checkout payment-intents void": "api",
+  "checkout payment-intents list": "api",
+  "checkout payment-intents summary": "api",
+  "checkout refunds create": "api",
+  "checkout refunds list": "api",
+  "checkout tokens create": "api",
+  "checkout subscription-products list": "api",
+  "checkout subscription-products terms": "api",
+  "checkout capabilities": "api",
+  "checkout listen": "api",
+  "checkout health": "api",
+  "checkout doctor": "api"
+};
+var MONEY = {
+  "checkout payment-intents create": (o) => ({ amount: wholeNumber(o.amount), currency: o.currency, target: o.sessionId }),
+  "checkout payment-intents capture": (o, a) => ({ amount: wholeNumber(o.amountToCapture), target: a[0] }),
+  "checkout payment-intents void": (_o, a) => ({ target: a[0] }),
+  "checkout refunds create": (o) => ({ amount: wholeNumber(o.amount), currency: o.currency, target: o.paymentIntent ?? o.transaction }),
+  "checkout sessions create": (o) => ({ amount: wholeNumber(o.amount), currency: o.currency })
+};
+function isMoneyCommand(command) {
+  return Object.prototype.hasOwnProperty.call(MONEY, command);
+}
+function wholeNumber(v) {
+  return typeof v === "string" && /^[0-9]{1,15}$/.test(v.trim()) ? Number(v.trim()) : typeof v === "number" ? v : void 0;
+}
+var pending = null;
+var hooked = false;
+var SIGNAL_EXIT = { SIGINT: 130, SIGTERM: 143 };
+var processHandlers = [];
+var signalsHandledByCommand = false;
+function auditSignalHandledByCommand() {
+  signalsHandledByCommand = true;
+}
+function hookProcess() {
+  if (hooked) return;
+  hooked = true;
+  const onExit = (code) => auditFinish(code);
+  const onCrash = () => auditNote({ crashed: true });
+  process.on("exit", onExit);
+  process.on("uncaughtExceptionMonitor", onCrash);
+  processHandlers.push(["exit", onExit], ["uncaughtExceptionMonitor", onCrash]);
+  for (const sig of ["SIGINT", "SIGTERM"]) {
+    const handler = () => {
+      if (signalsHandledByCommand) return;
+      auditNote({ interrupted: true });
+      auditFinish(SIGNAL_EXIT[sig]);
+      process.exit(SIGNAL_EXIT[sig]);
+    };
+    processHandlers.push([sig, handler]);
+    process.on(sig, handler);
+  }
+}
+function auditStart(command, version, opts = {}, args = []) {
+  const settings = auditSettingsFromEnv();
+  if (settings.dir === null) {
+    pending = null;
+    return;
+  }
+  pruneAuditFiles(settings.dir, settings.retentionDays);
+  let money2 = {};
+  try {
+    money2 = Object.prototype.hasOwnProperty.call(MONEY, command) ? MONEY[command](opts, args) : {};
+  } catch {
+    money2 = {};
+  }
+  pending = { command, money: money2, settings, version, intentWritten: false, written: false };
+  if (typeof opts.apiKey === "string") pending.apiKey = opts.apiKey;
+  hookProcess();
+}
+function auditNote(note, onlyIfUnset = false) {
+  if (!pending) return;
+  if (onlyIfUnset && pending.outcome !== void 0 && note.outcome !== void 0) return;
+  Object.assign(pending, note);
+}
+function auditError(err) {
+  if (err === null || typeof err !== "object") return;
+  const e = err;
+  if (typeof e.status === "number" && typeof e.code === "string") {
+    auditNote({ apiCode: e.code, ...typeof e.requestId === "string" ? { requestId: e.requestId } : {} });
+  } else if (e.cause !== void 0 && err instanceof TypeError) {
+    auditNote({ networkError: true });
+  }
+}
+function auditIntent(now = /* @__PURE__ */ new Date()) {
+  const p = pending;
+  if (!p || p.intentWritten || p.settings.dir === null || !Object.prototype.hasOwnProperty.call(MONEY, p.command)) return;
+  p.intentWritten = true;
+  writeAuditLine(p.settings.dir, { command: p.command, ts: now.toISOString(), surface: "cli", version: p.version, ...auditKeyFields(p.apiKey), outcome: "pending", ...p.money }, now);
+}
+function auditFinish(exitCode, now = /* @__PURE__ */ new Date()) {
+  const p = pending;
+  if (!p || p.written || p.settings.dir === null) return;
+  p.written = true;
+  try {
+    let outcome;
+    let code = p.code;
+    if (p.crashed) [outcome, code] = ["error", "internal_error"];
+    else if (p.interrupted) [outcome, code] = ["error", "interrupted"];
+    else if (p.outcome) outcome = p.outcome;
+    else if (p.apiCode) [outcome, code] = ["error", p.apiCode];
+    else if (p.networkError) [outcome, code] = ["error", "network_error"];
+    else if (exitCode === 0) outcome = p.approved ? "approved" : COMMAND_KIND[p.command] === "local" ? "local" : "sent";
+    else [outcome, code] = ["refused_local", code ?? "local_refusal"];
+    writeAuditLine(
+      p.settings.dir,
+      {
+        command: p.command,
+        ts: now.toISOString(),
+        surface: "cli",
+        version: p.version,
+        ...auditKeyFields(p.apiKey),
+        outcome,
+        ...code ? { error_code: code } : {},
+        ...p.requestId ? { request_id: p.requestId } : {},
+        ...p.money
+      },
+      now
+    );
+  } catch (err) {
+    warnOnce(p.settings.dir, err, stderrWarn);
+  }
+}
+function usageReason(commanderCode) {
+  switch (commanderCode) {
+    case "commander.unknownCommand":
+      return "unknown_command";
+    case "commander.unknownOption":
+      return "unknown_option";
+    case "commander.missingArgument":
+    case "commander.optionMissingArgument":
+    case "commander.missingMandatoryOptionValue":
+      return "missing_argument";
+    case "commander.invalidArgument":
+      return "invalid_argument";
+    case "commander.excessArguments":
+      return "excess_arguments";
+    default:
+      return "usage_error";
+  }
+}
+function auditUsageError(command, version, commanderCode, exitCode, now = /* @__PURE__ */ new Date()) {
+  try {
+    if (exitCode === 0) return;
+    const reason = usageReason(commanderCode);
+    if (pending) {
+      auditNote({ outcome: "refused_local", code: reason }, true);
+      return;
+    }
+    const settings = auditSettingsFromEnv();
+    if (settings.dir === null) return;
+    const name = reason === "unknown_command" || command === "" ? UNKNOWN_COMMAND : command;
+    writeAuditLine(settings.dir, { command: name, ts: now.toISOString(), surface: "cli", version, outcome: "refused_local", error_code: reason }, now);
+  } catch (err) {
+    void err;
+  }
+}
+function _resetAuditForTests() {
+  pending = null;
+  for (const [event, h] of processHandlers.splice(0)) process.removeListener(event, h);
+  hooked = false;
+  signalsHandledByCommand = false;
+}
+
 // src/config.ts
-var CONFIG_DIR = join(homedir(), ".vonpay");
-var CONFIG_FILE = join(CONFIG_DIR, "config.json");
+var CONFIG_DIR = join2(homedir(), ".vonpay");
+var CONFIG_FILE = join2(CONFIG_DIR, "config.json");
 function loadConfig() {
   if (!existsSync(CONFIG_FILE)) return {};
   try {
@@ -79,13 +430,13 @@ function saveConfig(config) {
     warnStoredLiveKey();
   }
   if (!existsSync(CONFIG_DIR)) {
-    mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
+    mkdirSync2(CONFIG_DIR, { recursive: true, mode: 448 });
   }
   writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2) + "\n", {
     encoding: "utf-8",
     mode: 384
   });
-  chmodSync(CONFIG_FILE, 384);
+  chmodSync2(CONFIG_FILE, 384);
 }
 function clearStoredApiKey() {
   const config = loadConfig();
@@ -124,6 +475,7 @@ function requireApiKey() {
   if (secretKeyMode(key) === null) {
     emitCliError({ error: NOT_A_SECRET_KEY_MESSAGE, code: null }, NOT_A_SECRET_KEY_MESSAGE);
   }
+  auditNote({ apiKey: key });
   return key;
 }
 
@@ -222,7 +574,7 @@ function logoutCommand() {
 
 // src/commands/init.ts
 import { Command as Command3 } from "commander";
-import { appendFileSync, chmodSync as chmodSync2, existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { appendFileSync, chmodSync as chmodSync3, existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { resolve } from "path";
 import chalk3 from "chalk";
 var LIVE_KEY_NOT_WRITTEN_MESSAGE = "Refusing to write a live key (vp_sk_live_\u2026) to .env: live keys are never written to disk. Run `init` with a sandbox key (vp_sk_test_\u2026), and give your app its live key through your deployment's secret store or the environment when you go live.";
@@ -299,7 +651,7 @@ function initCommand() {
       ""
     ].join("\n");
     writeFileSync2(envFile, content, { encoding: "utf-8", mode: 384 });
-    chmodSync2(envFile, 384);
+    chmodSync3(envFile, 384);
     console.log(chalk3.green(`\u2713 .env created (${mode} mode) \u2192 ${absPath}`));
     const gitignoreState = ensureGitignoreBlocksEnv();
     if (gitignoreState === "added") {
@@ -318,7 +670,7 @@ function initCommand() {
 
 // src/commands/sessions.ts
 import { Command as Command4 } from "commander";
-import chalk5 from "chalk";
+import chalk6 from "chalk";
 
 // src/utils/spinner.ts
 import ora from "ora";
@@ -334,10 +686,10 @@ import { VonPayCheckout } from "@vonpay/checkout-node";
 
 // src/app-info.ts
 import { readFileSync as readFileSync3 } from "fs";
-import { dirname, join as join2 } from "path";
+import { dirname, join as join3 } from "path";
 import { fileURLToPath } from "url";
 var pkg = JSON.parse(
-  readFileSync3(join2(dirname(fileURLToPath(import.meta.url)), "..", "package.json"), "utf-8")
+  readFileSync3(join3(dirname(fileURLToPath(import.meta.url)), "..", "package.json"), "utf-8")
 );
 var CLI_VERSION = pkg.version;
 var CLI_APP_INFO = { name: "vonpay-cli", version: CLI_VERSION };
@@ -347,12 +699,18 @@ var SILENT_ERROR_REPORTER = () => {
 // src/utils/base-url.ts
 import { keyDestinationProblem as sdkKeyDestinationProblem } from "@vonpay/checkout-node";
 var ALLOW_CUSTOM_BASE_URL_ENV = "VONPAY_ALLOW_CUSTOM_BASE_URL";
-function customBaseUrlAllowed(env = process.env) {
-  return env[ALLOW_CUSTOM_BASE_URL_ENV] === "1";
+var ALLOW_CUSTOM_BASE_URL_FLAG = "--allow-custom-base-url";
+var flagGiven = false;
+function setAllowCustomBaseUrlFlag(given) {
+  flagGiven = given === true;
+}
+function customBaseUrlAllowed(env = process.env, flag = flagGiven) {
+  return env[ALLOW_CUSTOM_BASE_URL_ENV] === "1" && flag === true;
 }
 var UNSAFE_URL_CHARS = /[\s\x00-\x1f\x7f\\]/;
 var WHERE = "It comes from VONPAY_BASE_URL or baseUrl in ~/.vonpay/config.json; fix it, or unset it to use https://checkout.vonpay.com.";
-function keyDestinationProblem(apiKey, baseUrl, env = process.env) {
+var CLI_OPT_IN = `For a proxy you run yourself, set ${ALLOW_CUSTOM_BASE_URL_ENV}=1 AND pass ${ALLOW_CUSTOM_BASE_URL_FLAG} on the command; either alone is not enough.`;
+function keyDestinationProblem(apiKey, baseUrl, env = process.env, flag = flagGiven) {
   if (baseUrl === void 0) return null;
   if (UNSAFE_URL_CHARS.test(baseUrl)) {
     return `Refusing to use the base URL: it contains spaces, control characters or backslashes. ${WHERE}`;
@@ -366,11 +724,11 @@ function keyDestinationProblem(apiKey, baseUrl, env = process.env) {
   if (url.username !== "" || url.password !== "") {
     return `Refusing to use the base URL: it contains a user name or password, which would be sent with every request. ${WHERE}`;
   }
-  const problem = sdkKeyDestinationProblem(apiKey, baseUrl, { allowCustom: customBaseUrlAllowed(env) });
-  return problem === null ? null : `${problem} ${WHERE}`;
+  const problem = sdkKeyDestinationProblem(apiKey, baseUrl, { allowCustom: customBaseUrlAllowed(env, flag) });
+  return problem === null ? null : `${problem} ${WHERE} ${CLI_OPT_IN}`;
 }
-function allowCustomBaseUrl(env = process.env) {
-  return customBaseUrlAllowed(env);
+function allowCustomBaseUrl(env = process.env, flag = flagGiven) {
+  return customBaseUrlAllowed(env, flag);
 }
 
 // src/utils/errors.ts
@@ -404,10 +762,14 @@ function scrubSecrets(s) {
 }
 
 // src/utils/sanitize.ts
+import { stripHiddenCharacters } from "@vonpay/checkout-node";
 var ANSI_PATTERN = /\x1B\[[0-9;?]*[A-Za-z]/g;
-var C0_CONTROL_PATTERN = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g;
+var C1_CSI_PATTERN = /\u{9B}[0-9;?]*[A-Za-z]/gu;
+var CONTROL_PATTERN = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F\u{80}-\u{9F}]/gu;
+var LINE_SEPARATOR_PATTERN = /[\u{2028}\u{2029}]/gu;
+var PLAIN_TEXT_PATTERN = /^[\x20-\x7e]*$/;
 function stripAnsi(s) {
-  return s.replace(ANSI_PATTERN, "").replace(C0_CONTROL_PATTERN, "");
+  return stripHiddenCharacters(s.replace(ANSI_PATTERN, "").replace(C1_CSI_PATTERN, "").replace(CONTROL_PATTERN, ""));
 }
 function truncate(s, max) {
   if (s.length <= max) return s;
@@ -417,7 +779,43 @@ function safeDisplay(s, max = 200) {
   return truncate(stripAnsi(s), max);
 }
 function safeInline(s, max = 200) {
-  return safeDisplay(s.replace(/[\r\n]+/g, " "), max);
+  return safeDisplay(s.replace(/[\r\n]+/g, " ").replace(LINE_SEPARATOR_PATTERN, " "), max);
+}
+var READ_SECRET_PATTERNS = SECRET_PATTERNS.map(
+  ([re, replacement]) => [new RegExp(`(?<![A-Za-z0-9])(?:${re.source})`, re.flags), replacement]
+);
+function redactSecretShapes(s) {
+  let out = s;
+  for (const [re, replacement] of READ_SECRET_PATTERNS) out = out.replace(re, replacement);
+  return out;
+}
+function uniqueKey(cleaned, taken) {
+  let key = cleaned;
+  for (let n = 2; taken.has(key); n++) key = `${cleaned}#${n}`;
+  taken.add(key);
+  return key;
+}
+function cleanJsonValue(value, options = {}) {
+  const { lines = "keep", maxChars = Number.MAX_SAFE_INTEGER, redact = redactSecretShapes, exactKeys } = options;
+  const text = (s) => {
+    if (PLAIN_TEXT_PATTERN.test(s)) return truncate(s, maxChars);
+    return lines === "join" ? safeInline(s, maxChars) : truncate(stripAnsi(s.replace(LINE_SEPARATOR_PATTERN, " ")), maxChars);
+  };
+  const walk = (v, exact) => {
+    if (typeof v === "string") return exact ? text(v) : redact(text(v));
+    if (v === null || typeof v !== "object") return v;
+    const toJSON = v.toJSON;
+    if (typeof toJSON === "function") return walk(toJSON.call(v), exact);
+    if (Array.isArray(v)) return v.map((item) => walk(item, exact));
+    const taken = /* @__PURE__ */ new Set();
+    return Object.fromEntries(
+      Object.entries(v).map(([k, item]) => [uniqueKey(text(k), taken), walk(item, exact || exactKeys?.has(k) === true)])
+    );
+  };
+  return walk(value, false);
+}
+function jsonOutput(value, options) {
+  return JSON.stringify(cleanJsonValue(value, options), null, 2);
 }
 
 // src/utils/errors.ts
@@ -425,6 +823,12 @@ var CLI_READ_BACK = "From this CLI: `vonpay checkout payment-intents get <id>` (
 var READ_BACK_FIRST = "Check the payment first: read it back (`vonpay checkout payment-intents get <id>` for a charge, capture or void; `vonpay checkout refunds list --payment-intent <id>` (or `--transaction <id>`) for a refund; `sessions get <id>` for a checkout session) and act only on what it shows.";
 var UNKNOWN_OUTCOME_GUIDANCE = `${READ_BACK_FIRST} If you then retry, reuse the SAME --idempotency-key as the first attempt, never a new one: a new key is a new action and can move money twice.`;
 var str = (v) => v === void 0 || v === null ? null : String(v);
+var ONE_LINE_MAX_CHARS = 2e3;
+var oneLine = (s) => safeInline(s, ONE_LINE_MAX_CHARS);
+function paramFlagHint(param) {
+  const flag = param.startsWith("metadata") ? "--metadata" : `--${param.replace(/\[(gte|lt)\]$/, "-$1").replace(/_/g, "-")}`;
+  return /^--[a-z-]+$/.test(flag) ? ` (the ${flag} flag)` : "";
+}
 var FIELD_PRINTERS = {
   code: (e) => `Code: ${str(e.code)}`,
   fix: (e) => `Fix:  ${str(e.fix)}`,
@@ -464,8 +868,8 @@ var FIELD_PRINTERS = {
   usedMinor: (e) => typeof e.usedMinor === "number" ? `Used in the last 24 hours: ${safeInline(String(e.usedMinor))} (minor units)` : null,
   limitCurrency: (e) => e.limitCurrency ? `Key limit currency: ${safeInline(String(e.limitCurrency))}` : null,
   refusedFields: (e) => Array.isArray(e.refusedFields) && e.refusedFields.length > 0 ? `Fields this key may not send: ${e.refusedFields.map((f) => safeInline(String(f), 128)).join(", ")}` : null,
-  // A refused payment-only settle (mirror_settle_only_*; built ahead of the
-  // API's production release): the charge asked for and the store order's
+  // A refused payment-only settle (mirror_settle_only_*; served in production
+  // since 2026-10-27): the charge asked for and the store order's
   // facts. Validated by the SDK, printed through safeInline all the same.
   chargeAmount: (e) => typeof e.chargeAmount === "number" ? `Charge asked for: ${safeInline(String(e.chargeAmount))} (minor units)` : null,
   chargeCurrency: (e) => e.chargeCurrency ? `Charge currency: ${safeInline(String(e.chargeCurrency))}` : null,
@@ -474,7 +878,7 @@ var FIELD_PRINTERS = {
   orderCurrency: (e) => e.orderCurrency ? `Store order currency: ${safeInline(String(e.orderCurrency))}` : null,
   orderStatus: (e) => e.orderStatus ? `Store order status: ${safeInline(String(e.orderStatus))}` : null,
   orderPaymentStatus: (e) => e.orderPaymentStatus ? `Store order payment status: ${safeInline(String(e.orderPaymentStatus))}` : null,
-  // A refused subscription change (built ahead of the API's production release). Validated by
+  // A refused subscription change (served in production since 2026-10-30). Validated by
   // the SDK, printed through safeInline all the same.
   subscriptionStatus: (e) => e.subscriptionStatus ? `Subscription status: ${safeInline(String(e.subscriptionStatus))}` : null,
   refusalReason: (e) => e.refusalReason ? `Refused because: ${safeInline(String(e.refusalReason))}` : null,
@@ -484,14 +888,23 @@ var FIELD_PRINTERS = {
   maxAmount: (e) => typeof e.maxAmount === "number" ? `Most this key may make a renewal charge: ${safeInline(String(e.maxAmount))} (minor units)` : e.maxAmount === null ? "Most this key may make a renewal charge: none \u2014 this key may only lower the price" : null,
   amountCurrency: (e) => e.amountCurrency ? `Renewal charge currency: ${safeInline(String(e.amountCurrency))}` : null,
   pendingKind: (e) => e.pendingKind ? `Schedule change waiting for its customer notice: ${safeInline(String(e.pendingKind))}` : null,
-  // A charge the payment provider refused before any money moved (built ahead
-  // of the API's production release): the failed payment intent that records
+  nextChangeAllowedOn: (e) => e.nextChangeAllowedOn ? `Customer's next schedule change allowed from: ${safeInline(String(e.nextChangeAllowedOn))}` : null,
+  // A charge the payment provider refused before any money moved (served in
+  // production since 2026-10-30): the failed payment intent that records
   // the attempt. The SDK has checked it is a vpi_* id; printed through
   // safeInline all the same. The next step depends on the code: a card the
   // processor is still storing (payment_method_unvaulted) is retried as is
   // after a short wait; every other refusal needs the request or card fixed.
   // Both under a NEW key: the refused record does not hold the key, and the
   // processor may refuse a resend under the same one.
+  // A refused payment list / summary filter (`payment-intents list` / `summary`): the ONE
+  // query parameter at fault, a plain parameter name the SDK has checked. The flag that sets it
+  // is named alongside, so the fix is obvious.
+  param: (e) => e.param ? `Refused parameter: ${safeInline(String(e.param))}${paramFlagHint(String(e.param))}` : null,
+  // A payment report too large to answer (report_too_large): which limit refused it. The SDK
+  // validates both as positive whole numbers.
+  maxGroups: (e) => typeof e.maxGroups === "number" ? `Most groups one summary returns: ${e.maxGroups} \u2014 group by fewer dimensions or a coarser time unit, or add filters` : null,
+  timeoutMs: (e) => typeof e.timeoutMs === "number" ? `Time limit exceeded: ${e.timeoutMs} ms \u2014 use a shorter window or add filters (retrying unchanged fails the same way)` : null,
   paymentIntentId: (e) => e.paymentIntentId ? `Refused attempt recorded as: ${safeInline(String(e.paymentIntentId))} (status failed, nothing was charged; ` + (e.code === "payment_method_unvaulted" ? "wait a few seconds, then send the same charge again with a NEW --idempotency-key)" : "fix the request or the card, then charge with a NEW --idempotency-key)") : null,
   // On a withheld retry the SDK sets this to RETRY_WITHHELD_HELP.llmHint — the
   // one wording for every surface — so it is printed as is.
@@ -507,20 +920,11 @@ function errorDetailLines(err) {
   const lines = [];
   for (const print of Object.values(FIELD_PRINTERS)) {
     const line = print(source);
-    if (line !== null) lines.push(`  ${scrubSecrets(line)}`);
+    if (line !== null) lines.push(`  ${scrubSecrets(oneLine(line))}`);
   }
   return lines;
 }
-function scrubDeep(value) {
-  if (typeof value === "string") return scrubSecrets(value);
-  if (Array.isArray(value)) return value.map(scrubDeep);
-  if (value !== null && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) out[k] = scrubDeep(v);
-    return out;
-  }
-  return value;
-}
+var ERROR_JSON_CLEANING = { lines: "join", maxChars: ONE_LINE_MAX_CHARS, redact: scrubSecrets };
 function errorJson(err) {
   if (err instanceof VonPayError) {
     const out = { error: err.message };
@@ -529,26 +933,28 @@ function errorJson(err) {
       const value = source[field];
       if (value !== void 0) out[field] = value;
     }
-    return scrubDeep(out);
+    return cleanJsonValue(out, ERROR_JSON_CLEANING);
   }
   const message = err instanceof Error ? err.message : String(err);
-  return { error: scrubSecrets(message), code: null };
+  return { error: scrubSecrets(oneLine(message)), code: null };
 }
 function exitWithCliError(message, text) {
-  return emitCliError({ error: scrubSecrets(message), code: null }, text);
+  auditNote({ outcome: "refused_local", code: "local_refusal" }, true);
+  return emitCliError({ error: cleanJsonValue(message, ERROR_JSON_CLEANING), code: null }, text);
 }
 function handleError(err) {
+  auditError(err);
   if (jsonErrorsEnabled()) {
     printJsonError(errorJson(err));
     process.exit(1);
   }
   if (err instanceof VonPayError) {
-    console.error(chalk4.red(`Error: ${scrubSecrets(err.message)}`));
+    console.error(chalk4.red(`Error: ${scrubSecrets(oneLine(err.message))}`));
     for (const line of errorDetailLines(err)) console.error(chalk4.dim(line));
     process.exit(1);
   }
   const message = err instanceof Error ? err.message : String(err);
-  console.error(chalk4.red(`Error: ${scrubSecrets(message)}`));
+  console.error(chalk4.red(`Error: ${scrubSecrets(oneLine(message))}`));
   process.exit(1);
 }
 
@@ -573,11 +979,30 @@ function apiHostDetail() {
   }
   return origin === "https://checkout.vonpay.com" ? [] : [["API host", origin]];
 }
+var MONEY_METHODS = {
+  paymentIntents: ["create", "capture", "void"],
+  refunds: ["create"],
+  sessions: ["create"]
+};
+function withAuditIntent(client) {
+  for (const [resource, methods] of Object.entries(MONEY_METHODS)) {
+    const target = client[resource];
+    for (const method of methods) {
+      const original = target?.[method];
+      if (typeof original !== "function") continue;
+      target[method] = (...args) => {
+        auditIntent();
+        return original.apply(target, args);
+      };
+    }
+  }
+  return client;
+}
 function makeCheckoutClient() {
   const apiKey = requireApiKey();
   const baseUrl = getBaseUrl();
   refuseUnsafeLiveDestination(apiKey);
-  return new VonPayCheckout({
+  return withAuditIntent(new VonPayCheckout({
     apiKey,
     ...baseUrl ? { baseUrl } : {},
     // The SDK applies the same host rule at construction; the opt-in is the
@@ -587,7 +1012,86 @@ function makeCheckoutClient() {
     // The CLI prints every error itself (handleError / --json). Without this the SDK's fallback
     // reporter adds its own `[vonpay] …` line to stderr on EVERY API error, live key included.
     errorReporter: SILENT_ERROR_REPORTER
-  });
+  }));
+}
+
+// src/utils/live-key.ts
+import { createInterface as createInterface2 } from "readline";
+import chalk5 from "chalk";
+import { Option as Option2 } from "commander";
+import { heldAsLive, isLiveKey } from "@vonpay/checkout-node";
+var CONFIRM_WORD = "confirm";
+var terminal = {
+  /**
+   * Both stdin and stdout are a terminal. A command run by a script, a CI job or
+   * an AI agent's shell tool has at least one of them piped.
+   */
+  isInteractive() {
+    return process.stdin.isTTY === true && process.stdout.isTTY === true;
+  },
+  /** Ask one line on the terminal. End of input or Ctrl-C answers "" (cancel). */
+  ask(prompt) {
+    return new Promise((resolve2) => {
+      const rl = createInterface2({ input: process.stdin, output: process.stdout });
+      let answered = false;
+      rl.on("SIGINT", () => rl.close());
+      rl.on("close", () => {
+        if (!answered) resolve2("");
+      });
+      rl.question(prompt, (answer) => {
+        answered = true;
+        rl.close();
+        resolve2(answer);
+      });
+    });
+  }
+};
+function keyFingerprint(key) {
+  const m = key.match(/^(vp_sk_live_)([A-Za-z0-9_-]{0,4})/);
+  return m ? `${m[1]}${m[2]}\u2026` : "a key that is not a sandbox key";
+}
+async function confirmLiveAction(key, summary, opts = {}) {
+  if (!heldAsLive(key)) return;
+  if (!terminal.isInteractive()) {
+    const message = `Refusing to ${summary.action} with a live key: no person is at an interactive terminal to confirm it. A live-key action must be confirmed by a person typing at a terminal (stdin and stdout both a terminal); scripts, CI jobs and AI agents cannot confirm it, and --confirm-live is no longer enough. Use a sandbox key (vp_sk_test_\u2026) for automation, or run the command yourself in a terminal. Nothing was sent.`;
+    auditNote({ outcome: "withheld", code: "no_terminal" });
+    exitWithCliError(message, chalk5.red(message));
+  }
+  if (opts.confirmLive) {
+    console.warn(
+      chalk5.yellow(
+        "Note: --confirm-live no longer confirms a live action by itself. A person confirms it at the terminal."
+      )
+    );
+  }
+  const lines = [
+    chalk5.bold.red(`You are about to ${summary.action} with a LIVE key (${keyFingerprint(key)}).`),
+    // At least one space after the label, however long it is.
+    ...(summary.details ?? []).map(([label, value]) => `  ${`${label}:`.padEnd(Math.max(17, label.length + 2))}${safeInline(value)}`),
+    chalk5.yellow(summary.consequence ?? "This moves real money and cannot be undone from here.")
+  ];
+  for (const line of lines) console.log(line);
+  const answer = await terminal.ask(`Type "${CONFIRM_WORD}" to proceed, anything else to cancel: `);
+  if (answer.trim() !== CONFIRM_WORD) {
+    auditNote({ outcome: "declined", code: "declined" });
+    const message = `Cancelled: you did not type "${CONFIRM_WORD}". Nothing was sent.`;
+    exitWithCliError(message, chalk5.red(message));
+  }
+  auditNote({ approved: true });
+}
+function retiredConfirmLiveOption() {
+  return new Option2(
+    "--confirm-live",
+    "No longer confirms anything: a live-key action is confirmed by a person at the terminal"
+  ).hideHelp();
+}
+function warnLiveSecretFlag(key, flag) {
+  if (!heldAsLive(key)) return;
+  console.warn(
+    chalk5.yellow(
+      `Warning: passing ${flag} as a command argument with a live key exposes it to shell history and process-list (\`ps\`). Consider piping or env-injecting the value instead.`
+    )
+  );
 }
 
 // src/utils/amount.ts
@@ -603,6 +1107,11 @@ function parseMinorUnits(raw, flag) {
   }
   return { ok: true, value };
 }
+function positiveWholeNumber(raw, flag) {
+  const parsed = parseMinorUnits(raw, flag);
+  if (!parsed.ok || parsed.value < 1) throw new Error(`${flag} must be a whole number of at least 1; got ${JSON.stringify(raw)}.`);
+  return parsed.value;
+}
 function minorUnitsOrExit(raw, flag) {
   const parsed = parseMinorUnits(raw, flag);
   if (!parsed.ok) exitWithCliError(parsed.message, `Error: ${parsed.message}`);
@@ -613,9 +1122,7 @@ function optionalMinorUnitsOrExit(raw, flag) {
 }
 
 // src/utils/mask-secrets.ts
-function maskSecretsInJson(json) {
-  return scrubSecrets(json);
-}
+var SHOW_SECRETS_CLEANING = { exactKeys: /* @__PURE__ */ new Set(["clientSecret"]) };
 var SHOW_SECRETS_HELP = "With --json, print the session's client secret in full. \u26A0 The output then contains a secret: do not paste it or let it reach a log";
 function withClientSecret(session) {
   if (session === null || typeof session !== "object" || Array.isArray(session)) return session;
@@ -623,26 +1130,26 @@ function withClientSecret(session) {
   return { ...session, clientSecret: session.clientSecret };
 }
 function sessionJson(session, showSecrets) {
-  const json = JSON.stringify(withClientSecret(session), null, 2);
-  if (json === void 0) return String(json);
-  return showSecrets === true ? json : maskSecretsInJson(json);
+  const body = cleanJsonValue(withClientSecret(session), showSecrets === true ? SHOW_SECRETS_CLEANING : {});
+  const json = JSON.stringify(body, null, 2);
+  return json === void 0 ? String(json) : json;
 }
 
 // src/commands/sessions.ts
 var makeClient = makeCheckoutClient;
 function sessionLines(session) {
-  const statusColor = session.status === "succeeded" ? chalk5.green : session.status === "failed" ? chalk5.red : session.status === "expired" ? chalk5.gray : chalk5.yellow;
+  const statusColor = session.status === "succeeded" ? chalk6.green : session.status === "failed" ? chalk6.red : session.status === "expired" ? chalk6.gray : chalk6.yellow;
   const lines = [
     `  ID:          ${session.id}`,
     `  Status:      ${statusColor(session.status)}`,
     `  Amount:      ${formatMinorUnits(session.amount, session.currency)}`
   ];
   if (session.paymentStatus) {
-    const paymentColor = session.paymentStatus === "paid" ? chalk5.green : session.paymentStatus === "held" ? chalk5.yellow : chalk5.gray;
+    const paymentColor = session.paymentStatus === "paid" ? chalk6.green : session.paymentStatus === "held" ? chalk6.yellow : chalk6.gray;
     lines.push(`  Payment:     ${paymentColor(session.paymentStatus)}`);
     if (session.paymentStatus === "held") {
       lines.push(
-        chalk5.yellow(
+        chalk6.yellow(
           "               Held, not taken: capture it to take the money, or void it. Do not ship on a hold alone."
         )
       );
@@ -661,7 +1168,7 @@ function sessionLines(session) {
     lines.push(`  Payments:    ${session.vp_tx_count}`);
     if (session.vp_tx_count >= 2) {
       lines.push(
-        chalk5.red(
+        chalk6.red(
           `  \u26A0 Charged ${session.vp_tx_count} times: there is no single refund id. Have a person check the payments before refunding or fulfilling.`
         )
       );
@@ -671,12 +1178,44 @@ function sessionLines(session) {
   lines.push(`  Expires:     ${session.expiresAt}`);
   return lines;
 }
+function redirectHost(url) {
+  if (url === void 0) return "none given (the account default)";
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return "[not a valid address]";
+  }
+  const host = parsed.hostname;
+  if (host === "") return "[not a web address]";
+  if (host.length > 253) return "[host too long]";
+  if (!/^([a-z0-9-]{1,63}\.)*[a-z0-9-]{1,63}$/.test(host) && !/^\[[0-9a-f:.]+\]$/.test(host)) return "[unrecognised host withheld]";
+  return parsed.port ? `${host}:${parsed.port}` : host;
+}
 function sessionsCommand() {
   const sessions = new Command4("sessions").description(
     "Create and manage checkout sessions"
   );
-  sessions.command("create").description("Create a new checkout session").requiredOption("--amount <cents>", "Amount in minor units, a whole number (e.g. 1499 = $14.99)").requiredOption("--currency <code>", "Currency code (e.g. USD)").option("--country <code>", "Country code (e.g. US)").option("--description <text>", "Session description").option("--success-url <url>", "Redirect URL on success").option("--cancel-url <url>", "Redirect URL on cancel").option("--idempotency-key <key>", "Idempotency key for safe retries").option("--dry-run", "Validate without creating a session").option("--json", "Output raw JSON (the session's client secret masked, see --show-secrets)").option("--show-secrets", SHOW_SECRETS_HELP).action(async (opts) => {
+  sessions.command("create").description("Create a new checkout session").requiredOption("--amount <cents>", "Amount in minor units, a whole number (e.g. 1499 = $14.99)").requiredOption("--currency <code>", "Currency code (e.g. USD)").option("--country <code>", "Country code (e.g. US)").option("--description <text>", "Session description").option("--success-url <url>", "Redirect URL on success").option("--cancel-url <url>", "Redirect URL on cancel").option("--idempotency-key <key>", "Idempotency key for safe retries").option("--dry-run", "Validate without creating a session").addOption(retiredConfirmLiveOption()).option("--json", "Output raw JSON (the session's client secret masked, see --show-secrets)").option("--show-secrets", SHOW_SECRETS_HELP).action(async (opts) => {
     const amount = minorUnitsOrExit(String(opts.amount), "--amount");
+    if (!opts.dryRun) {
+      const apiKey = requireApiKey();
+      refuseUnsafeLiveDestination(apiKey);
+      await confirmLiveAction(
+        apiKey,
+        {
+          action: "create a checkout session (a payment page a buyer can pay)",
+          details: [
+            ...apiHostDetail(),
+            ["Amount", formatMinorUnits(amount, String(opts.currency).toUpperCase())],
+            ["After paying, to", redirectHost(opts.successUrl)],
+            ["If cancelled, to", redirectHost(opts.cancelUrl)]
+          ],
+          consequence: "A buyer can pay real money on this page until it expires."
+        },
+        opts
+      );
+    }
     const client = makeClient();
     const spinner = startSpinner("Creating session...");
     try {
@@ -693,16 +1232,16 @@ function sessionsCommand() {
         const result = await client.sessions.validate(params);
         spinner.stop();
         if (opts.json) {
-          console.log(JSON.stringify(result, null, 2));
+          console.log(jsonOutput(result));
         } else if (result.valid) {
-          console.log(chalk5.green("\u2713 Valid request"));
+          console.log(chalk6.green("\u2713 Valid request"));
           if (result.warnings.length > 0) {
             for (const w of result.warnings) {
-              console.log(chalk5.yellow(`  \u26A0 ${w}`));
+              console.log(chalk6.yellow(`  \u26A0 ${w}`));
             }
           }
         } else {
-          console.log(chalk5.red("\u2717 Invalid request"));
+          console.log(chalk6.red("\u2717 Invalid request"));
         }
         return;
       }
@@ -714,9 +1253,9 @@ function sessionsCommand() {
       if (opts.json) {
         console.log(sessionJson(session, opts.showSecrets));
       } else {
-        console.log(chalk5.green("\u2713 Session created"));
+        console.log(chalk6.green("\u2713 Session created"));
         console.log(`  ID:       ${session.id}`);
-        console.log(`  URL:      ${chalk5.cyan(session.checkoutUrl)}`);
+        console.log(`  URL:      ${chalk6.cyan(session.checkoutUrl)}`);
         console.log(`  Expires:  ${session.expiresAt}`);
       }
     } catch (err) {
@@ -745,28 +1284,38 @@ function sessionsCommand() {
 
 // src/commands/payment-intents.ts
 import { Command as Command5 } from "commander";
-import chalk8 from "chalk";
-import { formatMinorUnits as formatMinorUnits2 } from "@vonpay/checkout-node";
+import chalk9 from "chalk";
+import { formatMinorUnits as formatMinorUnits3 } from "@vonpay/checkout-node";
 
 // src/utils/idempotency.ts
 import { randomUUID } from "crypto";
-import chalk6 from "chalk";
+import chalk7 from "chalk";
+import { heldAsLive as heldAsLive2 } from "@vonpay/checkout-node";
 function resolveIdempotencyKey(flag) {
   const given = flag?.trim();
   if (given) return { key: given, generated: false };
   return { key: `cli-${randomUUID()}`, generated: true };
 }
-function idempotencyKeyFor(flag, what) {
+function idempotencyKeyFor(flag, what, apiKey) {
   const { key, generated } = resolveIdempotencyKey(flag);
+  if (generated && apiKey !== void 0 && heldAsLive2(apiKey)) {
+    const message = `Refusing to send this ${what} with a live key without --idempotency-key. Choose one key for this ${what} (for example your order id plus the action, such as "order_1042:${what}") and pass the SAME key if you ever run the command again: a new key is a new action and can move money twice. Nothing was sent.`;
+    auditNote({ outcome: "refused_local", code: "idempotency_key_required" });
+    exitWithCliError(message, chalk7.red(message));
+  }
   if (generated) {
     console.error(
-      chalk6.dim(
+      chalk7.dim(
         `Idempotency key: ${key} (to retry this same ${what}, re-run with --idempotency-key ${key})`
       )
     );
   }
   return key;
 }
+var DISPLAYABLE_KEY = /^[A-Za-z0-9_:.-]{1,64}$/;
+function displayIdempotencyKey(key) {
+  return DISPLAYABLE_KEY.test(key) ? key : "[custom key withheld]";
+}
 
 // src/utils/metadata.ts
 var MAX_LEN = 256;
@@ -807,80 +1356,266 @@ function parseMetadata(pairs) {
   }
   return out;
 }
-
-// src/utils/live-key.ts
-import { createInterface as createInterface2 } from "readline";
-import chalk7 from "chalk";
-import { Option as Option2 } from "commander";
-import { isLiveKey as isLiveKey2 } from "@vonpay/checkout-node";
-var CONFIRM_WORD = "confirm";
-var terminal = {
-  /**
-   * Both stdin and stdout are a terminal. A command run by a script, a CI job or
-   * an AI agent's shell tool has at least one of them piped.
-   */
-  isInteractive() {
-    return process.stdin.isTTY === true && process.stdout.isTTY === true;
-  },
-  /** Ask one line on the terminal. End of input or Ctrl-C answers "" (cancel). */
-  ask(prompt) {
-    return new Promise((resolve2) => {
-      const rl = createInterface2({ input: process.stdin, output: process.stdout });
-      let answered = false;
-      rl.on("SIGINT", () => rl.close());
-      rl.on("close", () => {
-        if (!answered) resolve2("");
-      });
-      rl.question(prompt, (answer) => {
-        answered = true;
-        rl.close();
-        resolve2(answer);
-      });
-    });
+var METADATA_FILTER_KEY = /^[A-Za-z0-9_.:-]{1,64}$/;
+var METADATA_FILTER_VALUE_MAX = 500;
+function assertMetadataFilterKey(key, flag) {
+  if (!METADATA_FILTER_KEY.test(key)) {
+    throw new Error(
+      `${flag}: the metadata key must be 1-64 letters, digits, _ . : or - (the API's pattern ^[A-Za-z0-9_.:-]{1,64}$); got ${JSON.stringify(key.slice(0, 80))}.`
+    );
   }
-};
-function keyFingerprint(key) {
-  const m = key.match(/^(vp_sk_live_)([A-Za-z0-9_-]{0,4})/);
-  return m ? `${m[1]}${m[2]}\u2026` : "a key that is not a sandbox key";
+  return key;
 }
-async function confirmLiveAction(key, summary, opts = {}) {
-  if (!requiresLiveConfirmation(key)) return;
-  if (!terminal.isInteractive()) {
-    const message = `Refusing to ${summary.action} with a live key: no person is at an interactive terminal to confirm it. A live-key action must be confirmed by a person typing at a terminal (stdin and stdout both a terminal); scripts, CI jobs and AI agents cannot confirm it, and --confirm-live is no longer enough. Use a sandbox key (vp_sk_test_\u2026) for automation, or run the command yourself in a terminal. Nothing was sent.`;
-    exitWithCliError(message, chalk7.red(message));
+function parseMetadataFilter(raw, flag) {
+  const idx = raw.indexOf("=");
+  if (idx === -1) throw new Error(`${flag}: expected key=value (ONE tag); got ${JSON.stringify(raw.slice(0, 80))}.`);
+  const key = assertMetadataFilterKey(raw.slice(0, idx), flag);
+  const value = raw.slice(idx + 1);
+  if (value.length < 1 || value.length > METADATA_FILTER_VALUE_MAX) {
+    throw new Error(`${flag}: the value must be 1-${METADATA_FILTER_VALUE_MAX} characters; got ${value.length}.`);
   }
-  if (opts.confirmLive) {
-    console.warn(
-      chalk7.yellow(
-        "Note: --confirm-live no longer confirms a live action by itself. A person confirms it at the terminal."
-      )
+  return { [key]: value };
+}
+
+// src/commands/payment-reports.ts
+import chalk8 from "chalk";
+import { formatMinorUnits as formatMinorUnits2 } from "@vonpay/checkout-node";
+
+// src/utils/list-flag.ts
+function parseListFlag(raw, flag, options = {}) {
+  const items = raw.split(",").map((s) => options.lowercase ? s.trim().toLowerCase() : s.trim());
+  if (items.length === 0 || items.some((s) => s.length === 0)) {
+    throw new Error(`${flag} must be a comma-separated list with no empty items; got ${JSON.stringify(raw)}.`);
+  }
+  return [...new Set(items)];
+}
+
+// src/commands/payment-reports.ts
+function buildFilters(opts) {
+  const filters = {};
+  if (opts.createdGte !== void 0) filters.createdGte = opts.createdGte;
+  if (opts.createdLt !== void 0) filters.createdLt = opts.createdLt;
+  if (opts.outcome !== void 0) filters.outcome = parseListFlag(opts.outcome, "--outcome", { lowercase: true });
+  if (opts.store !== void 0) filters.store = opts.store;
+  if (opts.metadata !== void 0) filters.metadata = parseMetadataFilter(opts.metadata, "--metadata");
+  if (opts.cardBrand !== void 0) {
+    filters.cardBrand = parseListFlag(opts.cardBrand, "--card-brand", { lowercase: true });
+  }
+  if (opts.currency !== void 0) filters.currency = opts.currency.toUpperCase();
+  if (opts.initiator !== void 0) {
+    const initiator = opts.initiator.toLowerCase();
+    if (initiator !== "customer" && initiator !== "merchant") {
+      throw new Error(`--initiator must be customer or merchant; got ${JSON.stringify(opts.initiator)}.`);
+    }
+    filters.initiator = initiator;
+  }
+  if (opts.declineCode !== void 0) {
+    filters.declineCode = parseListFlag(opts.declineCode, "--decline-code", { lowercase: true });
+  }
+  return filters;
+}
+var PAYMENT_LIST_JSON_FIELDS = [
+  "id",
+  "status",
+  "outcome",
+  "failureClass",
+  "amount",
+  "currency",
+  "captureMethod",
+  "createdAt",
+  "updatedAt",
+  "store",
+  "card",
+  "declineCode",
+  "action",
+  "ruleCode",
+  "networkAdvice"
+];
+function listItemJson(pi, includeMetadata) {
+  if (includeMetadata) return pi;
+  const src = pi;
+  return Object.fromEntries(PAYMENT_LIST_JSON_FIELDS.filter((k) => src[k] !== void 0).map((k) => [k, src[k]]));
+}
+var ALL_DEFAULT_MAX_ITEMS = 1e4;
+function stoppedAtDefaultCap() {
+  return `Stopped at ${ALL_DEFAULT_MAX_ITEMS} payments (the --all default); there may be more. Pass --max-items to read more, or narrow the window.`;
+}
+function buildListParams(opts) {
+  const params = buildFilters(opts);
+  if (opts.status !== void 0) {
+    params.status = parseListFlag(opts.status, "--status", { lowercase: true });
+  }
+  if (opts.limit !== void 0) params.limit = positiveWholeNumber(opts.limit, "--limit");
+  if (opts.startingAfter !== void 0) params.startingAfter = opts.startingAfter;
+  if (opts.maxItems !== void 0 && !opts.all) throw new Error("--max-items is used with --all.");
+  if (opts.includeMetadata && !opts.json) throw new Error("--include-metadata is used with --json.");
+  const maxItems = opts.maxItems !== void 0 ? positiveWholeNumber(opts.maxItems, "--max-items") : opts.all ? ALL_DEFAULT_MAX_ITEMS : void 0;
+  return { params, ...maxItems !== void 0 ? { maxItems } : {} };
+}
+function buildSummaryParams(opts) {
+  const params = buildFilters(opts);
+  if (opts.groupBy !== void 0) {
+    params.groupBy = parseListFlag(opts.groupBy, "--group-by", { lowercase: true });
+  }
+  if (opts.groupByMetadataKey !== void 0) {
+    params.groupByMetadataKey = assertMetadataFilterKey(opts.groupByMetadataKey, "--group-by-metadata-key");
+  }
+  if (opts.timeZone !== void 0) params.timeZone = opts.timeZone;
+  return params;
+}
+function outcomeTone(outcome) {
+  if (outcome === "approved") return chalk8.green(outcome);
+  if (outcome === "authorized" || outcome === "in_progress" || outcome === "voided") return chalk8.yellow(outcome);
+  return chalk8.red(outcome);
+}
+function paymentListItemLine(pi) {
+  const card = pi.card.brand || pi.card.last4 ? `  ${safeInline(pi.card.brand ?? "card")} ${pi.card.last4 ? `\u2022\u2022\u2022\u2022 ${safeInline(pi.card.last4)}` : ""}`.trimEnd() : "";
+  return `  ${safeInline(pi.id)}  ${outcomeTone(safeInline(pi.outcome))}  ${safeInline(formatMinorUnits2(pi.amount, pi.currency))}  ${safeInline(pi.createdAt)}` + (pi.store ? `  ${safeInline(pi.store)}` : "") + card + (pi.declineCode ? `  ${safeInline(pi.declineCode)}` : "");
+}
+function paymentListLines(page) {
+  const lines = [`  Window: ${safeInline(page.created.gte)} to ${safeInline(page.created.lt)} (end exclusive)`];
+  if (page.data.length === 0) lines.push("  No payments match.");
+  for (const pi of page.data) lines.push(paymentListItemLine(pi));
+  if (page.hasMore && page.nextCursor) {
+    lines.push(
+      `  More: re-run with exactly the same filters (and window, or none if you gave none) and --starting-after ${safeInline(page.nextCursor, 1100)} \u2014 the cursor lasts 24 hours; or use --all`
     );
   }
+  return lines;
+}
+function formatRate(rate) {
+  return rate === null ? "no data" : `${(rate * 100).toFixed(1)}%`;
+}
+function metricsLine(m) {
+  return `attempts ${m.counts.attempts}  approved ${m.counts.approved}  declined ${m.counts.declined}  approval ${formatRate(m.rates.approvalRate)}  bank decline ${formatRate(m.rates.bankDeclineRate)}  decline ${formatRate(m.rates.declineRate)}`;
+}
+function summaryLines(s) {
+  const age = typeof s.ageSeconds === "number" ? `, ${s.ageSeconds} s ago` : "";
   const lines = [
-    chalk7.bold.red(`You are about to ${summary.action} with a LIVE key (${keyFingerprint(key)}).`),
-    ...(summary.details ?? []).map(([label, value]) => `  ${`${label}:`.padEnd(17)}${safeDisplay(value)}`),
-    chalk7.yellow(summary.consequence ?? "This moves real money and cannot be undone from here.")
+    `  Payment attempts (as the dashboard counts them), ${safeInline(s.created.gte)} to ${safeInline(s.created.lt)}, time zone ${safeInline(s.timeZone)}`,
+    `  Computed at ${safeInline(s.generatedAt)}${age} (a summary is kept 45 s: for fresh numbers change the window or wait)`,
+    `  Total: ${metricsLine(s.totals)}`
   ];
-  for (const line of lines) console.log(line);
-  const answer = await terminal.ask(`Type "${CONFIRM_WORD}" to proceed, anything else to cancel: `);
-  if (answer.trim() !== CONFIRM_WORD) {
-    const message = `Cancelled: you did not type "${CONFIRM_WORD}". Nothing was sent.`;
-    exitWithCliError(message, chalk7.red(message));
+  for (const a of s.totals.amounts) {
+    lines.push(
+      `    ${safeInline(a.currency)}: approved ${safeInline(formatMinorUnits2(a.approved, a.currency))}, declined ${safeInline(formatMinorUnits2(a.declined, a.currency))}`
+    );
+  }
+  for (const g of s.groups) {
+    const key = Object.entries(g.key).map(([dimension, value]) => `${safeInline(dimension)}=${value === null ? "(none)" : safeInline(value, 80)}`).join(" ");
+    lines.push(`  ${key}: ${metricsLine(g)}`);
   }
+  if (s.groupBy.length > 0) lines.push("  Only groups with at least one attempt are shown. Add counts to combine groups; never average rates.");
+  return lines;
 }
-function retiredConfirmLiveOption() {
-  return new Option2(
-    "--confirm-live",
-    "No longer confirms anything: a live-key action is confirmed by a person at the terminal"
-  ).hideHelp();
+var FILTER_HELP = {
+  createdGte: "Start of the window, inclusive: Unix seconds or an ISO-8601 time with a zone (default: 31 days before the end; 7 with summary --group-by hour)",
+  createdLt: "End of the window, exclusive (default: now). At most 31 days after the start (7 with summary --group-by hour)",
+  outcome: "Only these outcomes, comma-separated (e.g. bank_declined,refused_before_bank)",
+  store: "Only payments for this connected store hostname (e.g. shop.example.com)",
+  metadata: "Only payments with this metadata tag, key=value (ONE tag; key 1-64 of letters, digits, _ . : -; value 1-500 characters)",
+  cardBrand: "Only these card brands, comma-separated (visa, mastercard, amex, discover, unionpay, jcb, diners, unknown)",
+  currency: "Only payments in this currency (e.g. USD)",
+  initiator: "merchant (merchant-initiated charges on a saved card) or customer",
+  declineCode: "Only declined payments with these decline codes, comma-separated (e.g. insufficient_funds)"
+};
+function addFilterOptions(cmd) {
+  return cmd.option("--created-gte <time>", FILTER_HELP.createdGte).option("--created-lt <time>", FILTER_HELP.createdLt).option("--outcome <list>", FILTER_HELP.outcome).option("--store <hostname>", FILTER_HELP.store).option("--metadata <key=value>", FILTER_HELP.metadata).option("--card-brand <list>", FILTER_HELP.cardBrand).option("--currency <code>", FILTER_HELP.currency).option("--initiator <who>", FILTER_HELP.initiator).option("--decline-code <list>", FILTER_HELP.declineCode);
 }
-function warnLiveSecretFlag(key, flag) {
-  if (!requiresLiveConfirmation(key)) return;
-  console.warn(
-    chalk7.yellow(
-      `Warning: passing ${flag} as a command argument with a live key exposes it to shell history and process-list (\`ps\`). Consider piping or env-injecting the value instead.`
+function exitOnBadFlag(err) {
+  const message = err.message;
+  exitWithCliError(message, chalk8.red(`Error: ${message}`));
+}
+function addPaymentReportCommands(intents) {
+  addFilterOptions(
+    intents.command("list").description(
+      "List payment intents, newest first, with filters \u2014 raw data. For approval and decline rates use `payment-intents summary`"
     )
-  );
+  ).option("--status <list>", "Only these statuses, comma-separated (e.g. failed,succeeded)").option("--limit <n>", "Page size, up to 100 per page (default 25; larger values are treated as 100)").option(
+    "--starting-after <cursor>",
+    "The next-page cursor printed by a previous run, unchanged, with exactly the same filters and window (it lasts 24 hours)"
+  ).option(
+    "--all",
+    `Read every page, one request at a time, up to ${ALL_DEFAULT_MAX_ITEMS} payments unless --max-items says otherwise (text: printed as each payment arrives)`
+  ).option("--max-items <n>", `With --all: stop after this many payments (default ${ALL_DEFAULT_MAX_ITEMS})`).option(
+    "--json",
+    "Output JSON: each payment's status, outcome, amount, card, store and decline fields \u2014 not your metadata (with --all: one JSON array)"
+  ).option("--include-metadata", "With --json: print every field of each payment, your metadata included").action(async (opts) => {
+    let built;
+    try {
+      built = buildListParams(opts);
+    } catch (err) {
+      exitOnBadFlag(err);
+    }
+    const client = makeCheckoutClient();
+    const spinner = startSpinner("Listing payment intents...");
+    try {
+      if (opts.all) {
+        const pager = client.paymentIntents.listAutoPaging({
+          ...built.params,
+          ...built.maxItems ? { maxItems: built.maxItems } : {}
+        });
+        if (opts.json) {
+          const items = [];
+          for await (const pi of pager) items.push(listItemJson(pi, opts.includeMetadata));
+          spinner.stop();
+          console.log(jsonOutput(items));
+          if (opts.maxItems === void 0 && items.length >= ALL_DEFAULT_MAX_ITEMS) console.error(stoppedAtDefaultCap());
+          return;
+        }
+        let count = 0;
+        for await (const pi of pager) {
+          if (count === 0) spinner.stop();
+          console.log(paymentListItemLine(pi));
+          count += 1;
+        }
+        spinner.stop();
+        if (count === 0) console.log("  No payments match.");
+        console.log(`  ${count} payment(s).`);
+        if (opts.maxItems === void 0 && count >= ALL_DEFAULT_MAX_ITEMS) console.error(stoppedAtDefaultCap());
+        return;
+      }
+      const page = await client.paymentIntents.list(built.params);
+      spinner.stop();
+      if (opts.json) {
+        console.log(jsonOutput({ ...page, data: page.data.map((pi) => listItemJson(pi, opts.includeMetadata)) }));
+        return;
+      }
+      for (const line of paymentListLines(page)) console.log(line);
+    } catch (err) {
+      spinner.stop();
+      handleError(err);
+    }
+  });
+  addFilterOptions(
+    intents.command("summary").description(
+      "Approval and decline rates, counts and amounts for a window, as the dashboard counts payment attempts. A rate with no traffic shows as no data, never 0%. A summary is kept 45 s: for fresh numbers, change the window or wait"
+    )
+  ).option("--group-by <list>", "Up to 3 of hour, day, week, store, metadata, card_brand, currency, outcome, decline_code (one time unit)").option(
+    "--group-by-metadata-key <key>",
+    "With --group-by metadata: the metadata key whose values become groups (1-64 of letters, digits, _ . : -)"
+  ).option("--time-zone <iana>", "Time zone for hour / day / week buckets (default UTC), e.g. America/New_York").option("--json", "Output raw JSON").action(async (opts) => {
+    let params;
+    try {
+      params = buildSummaryParams(opts);
+    } catch (err) {
+      exitOnBadFlag(err);
+    }
+    const client = makeCheckoutClient();
+    const spinner = startSpinner("Summarizing payments...");
+    try {
+      const summary = await client.paymentIntents.summary(params);
+      spinner.stop();
+      if (opts.json) {
+        console.log(jsonOutput(summary));
+        return;
+      }
+      for (const line of summaryLines(summary)) console.log(line);
+    } catch (err) {
+      spinner.stop();
+      handleError(err);
+    }
+  });
 }
 
 // src/commands/payment-intents.ts
@@ -959,28 +1694,28 @@ function statusTone(status) {
   return "gray";
 }
 function printPaymentIntent(intent) {
-  const statusColor = chalk8[statusTone(intent.status)];
+  const statusColor = chalk9[statusTone(intent.status)];
   console.log(`  ID:           ${intent.id}`);
   console.log(`  Status:       ${statusColor(intent.status)}`);
   console.log(
-    `  Amount:       ${formatMinorUnits2(intent.amount, intent.currency)}`
+    `  Amount:       ${formatMinorUnits3(intent.amount, intent.currency)}`
   );
   console.log(`  Capture:      ${intent.captureMethod}`);
   if (intent.nextAction) {
     console.log(
-      `  Next action:  ${chalk8.yellow(safeDisplay(intent.nextAction.type))}`
+      `  Next action:  ${chalk9.yellow(safeDisplay(intent.nextAction.type))}`
     );
     if (intent.nextAction.type === "redirect_to_url") {
       console.log(
-        `  Redirect:     ${chalk8.yellow(safeDisplay(intent.nextAction.redirectToUrl.url))}`
+        `  Redirect:     ${chalk9.yellow(safeDisplay(intent.nextAction.redirectToUrl.url))}`
       );
     }
   }
   if (intent.declineCode) {
-    console.log(`  Decline code: ${chalk8.red(safeDisplay(intent.declineCode))}`);
+    console.log(`  Decline code: ${chalk9.red(safeDisplay(intent.declineCode))}`);
   }
   if (intent.networkAdvice) {
-    console.log(`  Network advice: ${chalk8.red(safeInline(intent.networkAdvice))}`);
+    console.log(`  Network advice: ${chalk9.red(safeInline(intent.networkAdvice))}`);
     if (typeof intent.networkAdviceRetryAfterMs === "number") {
       console.log(`  Retry after:  ${intent.networkAdviceRetryAfterMs} ms (earliest)`);
     }
@@ -1018,14 +1753,14 @@ function paymentIntentsCommand() {
     "Your customer reference. Send on EVERY saved-card charge \u2014 it is what makes the server reject a charge against the wrong customer's stored card"
   ).option("--buyer-email <email>", "Buyer email for this charge").option(
     "--idempotency-key <key>",
-    "Idempotency key for this charge. Reuse the SAME key to retry the same charge safely. Generated (and printed) when omitted"
+    "Idempotency key for this charge. Reuse the SAME key to retry the same charge safely. REQUIRED on a live key; on a sandbox key generated (and printed) when omitted"
   ).addOption(retiredConfirmLiveOption()).option("--json", "Output raw JSON").action(async (raw) => {
     const apiKey = requireApiKey();
     const opts = { ...raw, amount: minorUnitsOrExit(raw.amount, "--amount") };
     const captureMethod = opts.captureMethod?.toLowerCase();
     if (captureMethod !== void 0 && captureMethod !== "automatic" && captureMethod !== "manual") {
       const message = `Invalid --capture-method "${opts.captureMethod}". Expected automatic or manual.`;
-      exitWithCliError(message, chalk8.red(message));
+      exitWithCliError(message, chalk9.red(message));
     }
     let params;
     try {
@@ -1036,19 +1771,19 @@ function paymentIntentsCommand() {
       handleError(err);
     }
     refuseUnsafeLiveDestination(apiKey);
-    const idempotencyKey = idempotencyKeyFor(opts.idempotencyKey, "charge");
+    const idempotencyKey = idempotencyKeyFor(opts.idempotencyKey, "charge", apiKey);
     await confirmLiveAction(
       apiKey,
       {
         action: "create a payment intent (charge a payment)",
         details: [
           ...apiHostDetail(),
-          ["Amount", formatMinorUnits2(params.amount, params.currency)],
+          ["Amount", formatMinorUnits3(params.amount, params.currency)],
           ["Capture", params.captureMethod ?? "automatic"],
           ...params.paymentMethod ? [["Saved card", params.paymentMethod.id]] : [],
           ...params.buyerId ? [["Buyer", params.buyerId]] : [],
           ...params.sessionId ? [["Session", params.sessionId]] : [],
-          ["Idempotency key", idempotencyKey]
+          ["Idempotency key", displayIdempotencyKey(idempotencyKey)]
         ]
       },
       opts
@@ -1061,9 +1796,9 @@ function paymentIntentsCommand() {
       });
       spinner.stop();
       if (opts.json) {
-        console.log(JSON.stringify(intent, null, 2));
+        console.log(jsonOutput(intent));
       } else {
-        console.log(chalk8.green("\u2713 Payment intent created"));
+        console.log(chalk9.green("\u2713 Payment intent created"));
         printPaymentIntent(intent);
       }
     } catch (err) {
@@ -1080,7 +1815,7 @@ function paymentIntentsCommand() {
       const intent = await client.paymentIntents.retrieve(id);
       spinner.stop();
       if (opts.json) {
-        console.log(JSON.stringify(intent, null, 2));
+        console.log(jsonOutput(intent));
       } else {
         printPaymentIntent(intent);
       }
@@ -1094,7 +1829,7 @@ function paymentIntentsCommand() {
     "Partial capture amount in minor units, a whole number (omit for full)"
   ).option(
     "--idempotency-key <key>",
-    "Idempotency key. Reuse the SAME key to retry safely. Generated (and printed) when omitted"
+    "Idempotency key. Reuse the SAME key to retry safely. REQUIRED on a live key; on a sandbox key generated (and printed) when omitted"
   ).addOption(retiredConfirmLiveOption()).option("--json", "Output raw JSON").action(
     async (id, opts) => {
       const apiKey = requireApiKey();
@@ -1103,7 +1838,7 @@ function paymentIntentsCommand() {
         "--amount-to-capture"
       );
       refuseUnsafeLiveDestination(apiKey);
-      const idempotencyKey = idempotencyKeyFor(opts.idempotencyKey, "capture");
+      const idempotencyKey = idempotencyKeyFor(opts.idempotencyKey, "capture", apiKey);
       await confirmLiveAction(
         apiKey,
         {
@@ -1115,7 +1850,7 @@ function paymentIntentsCommand() {
               "Amount",
               amountToCapture !== void 0 ? `${amountToCapture} in minor units (partial capture)` : "the full authorized amount"
             ],
-            ["Idempotency key", idempotencyKey]
+            ["Idempotency key", displayIdempotencyKey(idempotencyKey)]
           ]
         },
         opts
@@ -1130,10 +1865,10 @@ function paymentIntentsCommand() {
         );
         spinner.stop();
         if (opts.json) {
-          console.log(JSON.stringify(intent, null, 2));
+          console.log(jsonOutput(intent));
         } else {
-          const captureLabel = amountToCapture !== void 0 ? ` (partial: ${formatMinorUnits2(amountToCapture, intent.currency)})` : "";
-          console.log(chalk8.green(`\u2713 Payment intent captured${captureLabel}`));
+          const captureLabel = amountToCapture !== void 0 ? ` (partial: ${formatMinorUnits3(amountToCapture, intent.currency)})` : "";
+          console.log(chalk9.green(`\u2713 Payment intent captured${captureLabel}`));
           printPaymentIntent(intent);
         }
       } catch (err) {
@@ -1144,12 +1879,12 @@ function paymentIntentsCommand() {
   );
   intents.command("void").description("Void an authorized (uncaptured) payment intent").argument("<id>", "Payment intent ID (vpi_*)").option(
     "--idempotency-key <key>",
-    "Idempotency key. Reuse the SAME key to retry safely. Generated (and printed) when omitted"
+    "Idempotency key. Reuse the SAME key to retry safely. REQUIRED on a live key; on a sandbox key generated (and printed) when omitted"
   ).addOption(retiredConfirmLiveOption()).option("--json", "Output raw JSON").action(
     async (id, opts) => {
       const apiKey = requireApiKey();
       refuseUnsafeLiveDestination(apiKey);
-      const idempotencyKey = idempotencyKeyFor(opts.idempotencyKey, "void");
+      const idempotencyKey = idempotencyKeyFor(opts.idempotencyKey, "void", apiKey);
       await confirmLiveAction(
         apiKey,
         {
@@ -1157,7 +1892,7 @@ function paymentIntentsCommand() {
           details: [
             ...apiHostDetail(),
             ["Payment intent", id],
-            ["Idempotency key", idempotencyKey]
+            ["Idempotency key", displayIdempotencyKey(idempotencyKey)]
           ],
           consequence: "A voided payment cannot be captured afterwards; this cannot be undone from here."
         },
@@ -1169,9 +1904,9 @@ function paymentIntentsCommand() {
         const intent = await client.paymentIntents.void(id, { idempotencyKey });
         spinner.stop();
         if (opts.json) {
-          console.log(JSON.stringify(intent, null, 2));
+          console.log(jsonOutput(intent));
         } else {
-          console.log(chalk8.green("\u2713 Payment intent voided"));
+          console.log(chalk9.green("\u2713 Payment intent voided"));
           printPaymentIntent(intent);
         }
       } catch (err) {
@@ -1180,13 +1915,14 @@ function paymentIntentsCommand() {
       }
     }
   );
+  addPaymentReportCommands(intents);
   return intents;
 }
 
 // src/commands/refunds.ts
 import { Command as Command6 } from "commander";
-import chalk9 from "chalk";
-import { formatMinorUnits as formatMinorUnits3 } from "@vonpay/checkout-node";
+import chalk10 from "chalk";
+import { formatMinorUnits as formatMinorUnits4, heldAsLive as heldAsLive3, VonPayError as VonPayError2 } from "@vonpay/checkout-node";
 function present(v) {
   return v !== void 0 && v.trim() !== "";
 }
@@ -1214,8 +1950,83 @@ function buildRefundParams(opts, metadata) {
   if (metadata !== void 0) params.metadata = metadata;
   return params;
 }
+var TRANSACTION_NEEDS_SESSION_MESSAGE = "Refusing a live-key refund by --transaction without --session-id: the transaction is checked against the session it belongs to (it must be that session's single payment) before you are asked to confirm. Prefer --payment-intent when the payment has one. Nothing was sent.";
+var SESSION_WITH_PAYMENT_INTENT_MESSAGE = "--session-id is only used with --transaction. Refund a payment intent with --payment-intent alone. Nothing was sent.";
+function refundSessionProblem(target, sessionId, live) {
+  const hasSession = present(sessionId);
+  if ("paymentIntent" in target && hasSession) return SESSION_WITH_PAYMENT_INTENT_MESSAGE;
+  if ("transaction" in target && live && !hasSession) return TRANSACTION_NEEDS_SESSION_MESSAGE;
+  return null;
+}
+function errorCodeSuffix(err) {
+  const code = err instanceof VonPayError2 ? err.code : void 0;
+  return typeof code === "string" && /^[a-z_]{1,64}$/.test(code) ? ` (error code: ${code})` : "";
+}
+function refuseLookup(message) {
+  auditNote({ outcome: "lookup_refused", code: "lookup_failed" });
+  return exitWithCliError(message, chalk10.red(message));
+}
+async function refundLookupDetails(client, target, sessionId, amount, namedCurrency) {
+  const lines = [];
+  let currency;
+  if ("paymentIntent" in target) {
+    let intent;
+    try {
+      intent = await client.paymentIntents.retrieve(target.paymentIntent);
+    } catch (err) {
+      refuseLookup(`Refusing the refund: the payment intent could not be looked up${errorCodeSuffix(err)}, so it cannot be shown to you before you confirm. Nothing was sent.`);
+    }
+    currency = intent.currency;
+    lines.push(
+      ["Original payment", formatMinorUnits4(intent.amount, intent.currency)],
+      ["Status", String(intent.status)],
+      ["Created", String(intent.createdAt)]
+    );
+  } else {
+    let session;
+    try {
+      session = await client.sessions.get(sessionId);
+    } catch (err) {
+      refuseLookup(`Refusing the refund: the session could not be looked up${errorCodeSuffix(err)}, so the transaction cannot be checked against it. Nothing was sent.`);
+    }
+    if (session.vp_tx_count !== 1) {
+      refuseLookup(
+        typeof session.vp_tx_count === "number" && session.vp_tx_count >= 2 ? "Refusing the refund: this session has more than one payment \u2014 the buyer may have been charged more than once. Do not refund anything; have a person check the payments. Nothing was sent." : "Refusing the refund: the session does not show exactly one captured payment, so the transaction cannot be checked against it. Nothing was sent."
+      );
+    }
+    if (session.vp_tx_id !== target.transaction) {
+      refuseLookup("Refusing the refund: that transaction is not this session's payment. Check the order in your own records. Nothing was sent.");
+    }
+    currency = session.currency;
+    lines.push(
+      ["Session total", formatMinorUnits4(session.amount, session.currency)],
+      ["Payment", String(session.paymentStatus ?? "not reported")],
+      ["Created", String(session.createdAt)]
+    );
+  }
+  let totals;
+  try {
+    totals = await client.refunds.list(target, { limit: 1 });
+  } catch (err) {
+    refuseLookup(`Refusing the refund: the payment's earlier refunds could not be looked up${errorCodeSuffix(err)}, so what was already refunded cannot be shown to you. Nothing was sent.`);
+  }
+  lines.push(
+    ["Already refunded", formatMinorUnits4(totals.amountRefunded, currency)],
+    [
+      "Still refundable",
+      `${formatMinorUnits4(totals.remainingRefundable, currency)}${totals.refundable ? "" : " \u2014 Von Payments says this payment cannot be refunded now"}`
+    ]
+  );
+  if (amount !== void 0 && amount > totals.remainingRefundable) {
+    lines.push(["\u26A0 Check", "the amount to refund is MORE than what is still refundable"]);
+  }
+  if (namedCurrency !== void 0 && typeof currency === "string" && namedCurrency.toUpperCase() !== currency.toUpperCase()) {
+    lines.push(["\u26A0 Check", "the currency named for this refund is NOT the payment's currency looked up above"]);
+  }
+  return lines;
+}
 function printRefund(refund) {
-  const statusColor = refund.status === "succeeded" ? chalk9.green : refund.status === "failed" ? chalk9.red : chalk9.yellow;
+  const statusColor = refund.status === "succeeded" ? chalk10.green : refund.status === "failed" ? chalk10.red : chalk10.yellow;
   console.log(`  ID:             ${refund.id}`);
   if (refund.transaction !== null) {
     console.log(`  Transaction:    ${refund.transaction}`);
@@ -1224,7 +2035,7 @@ function printRefund(refund) {
   }
   console.log(`  Status:         ${statusColor(refund.status)}`);
   console.log(
-    `  Amount:         ${formatMinorUnits3(refund.amount, refund.currency)}`
+    `  Amount:         ${formatMinorUnits4(refund.amount, refund.currency)}`
   );
   if (refund.reason) {
     console.log(`  Reason:         ${safeDisplay(refund.reason)}`);
@@ -1248,15 +2059,18 @@ function refundsCommand() {
   ).option("--currency <code>", "ISO 4217 currency code").option("--reason <text>", "Free-form reason (mirrored back on the record)").option(
     "--metadata <pair...>",
     "Metadata key=value (repeat flag for multiple pairs)"
+  ).option(
+    "--session-id <id>",
+    "With --transaction: the checkout session this payment belongs to (vp_cs_*). REQUIRED with --transaction on a live key: the transaction is checked against it (the session's single payment) before you are asked to confirm"
   ).option(
     "--idempotency-key <key>",
-    "Idempotency key. Reuse the SAME key to retry safely. Generated (and printed) when omitted"
+    "Idempotency key. Reuse the SAME key to retry safely. REQUIRED on a live key; on a sandbox key generated (and printed) when omitted"
   ).addOption(retiredConfirmLiveOption()).option("--json", "Output raw JSON").action(async (raw) => {
     try {
       resolveRefundTarget(raw);
     } catch (err) {
       const message = err.message;
-      exitWithCliError(message, chalk9.red(`Error: ${message}`));
+      exitWithCliError(message, chalk10.red(`Error: ${message}`));
     }
     const apiKey = requireApiKey();
     const opts = {
@@ -1270,8 +2084,11 @@ function refundsCommand() {
       handleError(err);
     }
     const target = resolveRefundTarget(opts);
+    const sessionProblem = refundSessionProblem(target, opts.sessionId, heldAsLive3(apiKey));
+    if (sessionProblem) exitWithCliError(sessionProblem, chalk10.red(sessionProblem));
     refuseUnsafeLiveDestination(apiKey);
-    const idempotencyKey = idempotencyKeyFor(opts.idempotencyKey, "refund");
+    const idempotencyKey = idempotencyKeyFor(opts.idempotencyKey, "refund", apiKey);
+    const lookedUp = heldAsLive3(apiKey) && terminal.isInteractive() ? await refundLookupDetails(makeCheckoutClient(), target, opts.sessionId?.trim(), params.amount, params.currency) : [];
     await confirmLiveAction(
       apiKey,
       {
@@ -1281,9 +2098,10 @@ function refundsCommand() {
           "transaction" in target ? ["Transaction", target.transaction] : ["Payment intent", target.paymentIntent],
           [
             "Amount",
-            params.amount === void 0 ? "the full remaining balance" : params.currency ? formatMinorUnits3(params.amount, params.currency) : `${params.amount} in minor units`
+            params.amount === void 0 ? "the full remaining balance" : params.currency ? formatMinorUnits4(params.amount, params.currency) : `${params.amount} in minor units`
           ],
-          ["Idempotency key", idempotencyKey]
+          ...lookedUp,
+          ["Idempotency key", displayIdempotencyKey(idempotencyKey)]
         ],
         consequence: "This pays money back out of the merchant's balance and cannot be reversed once settled."
       },
@@ -1295,9 +2113,9 @@ function refundsCommand() {
       const refund = await client.refunds.create(params, { idempotencyKey });
       spinner.stop();
       if (opts.json) {
-        console.log(JSON.stringify(refund, null, 2));
+        console.log(jsonOutput(refund));
       } else {
-        console.log(chalk9.green("\u2713 Refund created"));
+        console.log(chalk10.green("\u2713 Refund created"));
         printRefund(refund);
       }
     } catch (err) {
@@ -1307,23 +2125,23 @@ function refundsCommand() {
   });
   refunds.command("list").description(
     "List the refunds of ONE payment and its refund totals \u2014 the way to check a refund whose outcome was unclear"
-  ).option("--payment-intent <id>", "The payment's payment intent ID (vpi_*). Use this OR --transaction").option("--transaction <id>", "The payment's transaction ID (vp_tx_*), instead of --payment-intent").option("--limit <n>", "How many refunds to show (default 25, at most 100)").option("--starting-after <cursor>", "The next-page cursor printed by a previous run").option("--json", "Output raw JSON").action(
+  ).option("--payment-intent <id>", "The payment's payment intent ID (vpi_*). Use this OR --transaction").option("--transaction <id>", "The payment's transaction ID (vp_tx_*), instead of --payment-intent").option("--limit <n>", "How many refunds to show (default 25; the API allows at most 100)").option("--starting-after <cursor>", "The next-page cursor printed by a previous run").option("--json", "Output raw JSON").action(
     async (opts) => {
       let target;
       try {
         target = resolveRefundTarget(opts);
       } catch (err) {
         const message = err.message.replace("A refund target is required", "A payment is required");
-        exitWithCliError(message, chalk9.red(`Error: ${message}`));
+        exitWithCliError(message, chalk10.red(`Error: ${message}`));
       }
       let limit;
       if (opts.limit !== void 0) {
-        const parsed = parseMinorUnits(opts.limit, "--limit");
-        if (!parsed.ok || parsed.value < 1) {
-          const message = `--limit must be a whole number from 1 to 100; got ${JSON.stringify(opts.limit)}.`;
-          exitWithCliError(message, chalk9.red(`Error: ${message}`));
+        try {
+          limit = positiveWholeNumber(opts.limit, "--limit");
+        } catch (err) {
+          const message = err.message;
+          exitWithCliError(message, chalk10.red(`Error: ${message}`));
         }
-        limit = parsed.value;
       }
       const client = makeCheckoutClient();
       const spinner = startSpinner("Listing refunds...");
@@ -1334,7 +2152,7 @@ function refundsCommand() {
         });
         spinner.stop();
         if (opts.json) {
-          console.log(JSON.stringify(list, null, 2));
+          console.log(jsonOutput(list));
           return;
         }
         for (const line of refundListLines(list)) console.log(line);
@@ -1348,22 +2166,22 @@ function refundsCommand() {
 }
 function refundListLines(list) {
   const currency = list.data[0]?.currency;
-  const money = (n) => currency ? formatMinorUnits3(n, currency) : `${n} in minor units`;
+  const money2 = (n) => currency ? formatMinorUnits4(n, currency) : `${n} in minor units`;
   const lines = [
-    `  Refunded so far:  ${money(list.amountRefunded)} (succeeded + still in progress)`,
-    `  Still refundable: ${money(list.remainingRefundable)}${list.refundable ? "" : " \u2014 this payment cannot be refunded now"}`
+    `  Refunded so far:  ${money2(list.amountRefunded)} (succeeded + still in progress)`,
+    `  Still refundable: ${money2(list.remainingRefundable)}${list.refundable ? "" : " \u2014 this payment cannot be refunded now"}`
   ];
   if (list.data.length === 0) {
     lines.push("  No refunds on this payment.");
   }
   for (const r of list.data) {
-    const status = r.status === "succeeded" ? chalk9.green(r.status) : r.status === "failed" ? chalk9.red(r.status) : chalk9.yellow(r.status);
+    const status = r.status === "succeeded" ? chalk10.green(r.status) : r.status === "failed" ? chalk10.red(r.status) : chalk10.yellow(r.status);
     lines.push(
-      `  ${r.id}  ${status}  ${formatMinorUnits3(r.amount, r.currency)}` + (r.createdAt ? `  ${r.createdAt}` : "") + (r.idempotencyKey ? `  key ${safeDisplay(r.idempotencyKey)}` : "")
+      `  ${r.id}  ${status}  ${formatMinorUnits4(r.amount, r.currency)}` + (r.createdAt ? `  ${r.createdAt}` : "") + (r.idempotencyKey ? `  key ${safeDisplay(r.idempotencyKey)}` : "")
     );
   }
   if (list.data.some((r) => r.status === "requested")) {
-    lines.push(chalk9.yellow("  A refund marked requested is still in progress and can still fail: do not refund again."));
+    lines.push(chalk10.yellow("  A refund marked requested is still in progress and can still fail: do not refund again."));
   }
   if (list.hasMore && list.nextCursor) {
     lines.push(`  More: re-run with --starting-after ${safeDisplay(list.nextCursor)}`);
@@ -1373,9 +2191,9 @@ function refundListLines(list) {
 
 // src/commands/tokens.ts
 import { Command as Command7 } from "commander";
-import chalk10 from "chalk";
+import chalk11 from "chalk";
 function printToken(token) {
-  const statusColor = token.status === "active" ? chalk10.green : token.status === "expired" ? chalk10.yellow : chalk10.red;
+  const statusColor = token.status === "active" ? chalk11.green : token.status === "expired" ? chalk11.yellow : chalk11.red;
   console.log(`  ID:        ${token.id}`);
   console.log(`  Status:    ${statusColor(token.status)}`);
   const card = formatTokenCard(token.card);
@@ -1397,7 +2215,7 @@ function tokensCommand() {
       const apiKey = requireApiKey();
       if (!opts.buyerId && !opts.providerReference) {
         console.warn(
-          chalk10.yellow(
+          chalk11.yellow(
             "Warning: no --buyer-id or --provider-reference supplied. Providers with an iframe vault (sandbox and live alike) will fail with a 422 validation_error."
           )
         );
@@ -1421,9 +2239,9 @@ function tokensCommand() {
         );
         spinner.stop();
         if (opts.json) {
-          console.log(JSON.stringify(token, null, 2));
+          console.log(jsonOutput(token));
         } else {
-          console.log(chalk10.green("\u2713 Token created"));
+          console.log(chalk11.green("\u2713 Token created"));
           printToken(token);
         }
       } catch (err) {
@@ -1440,35 +2258,166 @@ function formatTokenCard(card) {
   return { card: cardLine, expires };
 }
 
-// src/commands/capabilities.ts
+// src/commands/subscription-products.ts
 import { Command as Command8 } from "commander";
-import chalk11 from "chalk";
+import chalk12 from "chalk";
+import { formatMinorUnits as formatMinorUnits5 } from "@vonpay/checkout-node";
+var STATUSES = ["active", "archived"];
+function buildListParams2(opts) {
+  const params = {};
+  if (opts.productRef !== void 0) params.productRef = opts.productRef;
+  if (opts.status !== void 0) {
+    const status = opts.status.trim().toLowerCase();
+    if (!STATUSES.includes(status)) {
+      throw new Error(`--status must be active or archived; got ${JSON.stringify(opts.status)}.`);
+    }
+    params.status = status;
+  }
+  if (opts.limit !== void 0) params.limit = positiveWholeNumber(opts.limit, "--limit");
+  if (opts.startingAfter !== void 0) params.startingAfter = opts.startingAfter;
+  return params;
+}
+function buildTermsParams(opts) {
+  if (opts.amount === void 0) return void 0;
+  const parsed = parseMinorUnits(opts.amount, "--amount");
+  if (!parsed.ok) throw new Error(parsed.message);
+  if (parsed.value < 1) throw new Error(`--amount must be at least 1 (minor units); got ${JSON.stringify(opts.amount)}.`);
+  return { amount: parsed.value };
+}
+var LEGAL_TEXT_MAX_CHARS = 500;
+var CUT_MARK = "\u2026 [CUT: not the full text; use --json to read all of it]";
+function legalText(raw) {
+  const clean = safeInline(raw, Number.MAX_SAFE_INTEGER);
+  return clean.length > LEGAL_TEXT_MAX_CHARS ? { text: `${clean.slice(0, LEGAL_TEXT_MAX_CHARS)}${CUT_MARK}`, cut: true } : { text: clean, cut: false };
+}
+function money(amount, currency) {
+  if (typeof amount !== "number") return "?";
+  return currency ? safeInline(formatMinorUnits5(amount, currency)) : `${amount} in minor units`;
+}
+function every(count, interval) {
+  if (!interval) return "";
+  const unit = safeInline(interval);
+  return typeof count === "number" && count !== 1 ? `every ${count} ${unit}s` : `every ${unit}`;
+}
+function statusTone2(status) {
+  return status === "active" ? chalk12.green(status) : chalk12.yellow(status);
+}
+function productLines(p) {
+  const head = `  ${safeInline(p.id)}  ${statusTone2(safeInline(p.status))}  ${safeInline(p.name, 120)}  (ref ${safeInline(p.productRef, 128)})`;
+  const schedule = p.interval ? `first payment ${money(p.firstPrice, p.currency)}, then ${money(p.renewalPrice, p.currency)} ${every(p.intervalCount, p.interval)}` : `${money(p.renewalPrice, p.currency)} \u2014 no renewal schedule yet (it cannot start a subscription)`;
+  const lines = [head, `    ${schedule}`];
+  const terms = p.terms;
+  if (terms && typeof terms.disclosure === "string") lines.push(`    Disclosure: ${legalText(terms.disclosure).text}`);
+  return lines;
+}
+function productListLines(page) {
+  const lines = [];
+  if (page.data.length === 0) lines.push("  No subscription products match.");
+  for (const p of page.data) lines.push(...productLines(p));
+  if (page.hasMore && page.nextCursor) {
+    lines.push(`  More: re-run with the same filters and --starting-after ${safeInline(page.nextCursor)}`);
+  }
+  return lines;
+}
+function termsLines(t) {
+  const disclosure = legalText(t.disclosure);
+  const phrase = legalText(t.pricePhrase);
+  return [
+    `  Product:       ${safeInline(t.product)} (ref ${safeInline(t.productRef, 128)})`,
+    `  Disclosure:    ${disclosure.text}`,
+    `  Price phrase:  ${phrase.text}`,
+    `  First payment: ${money(t.firstAmount, t.currency)}`,
+    `  Renewal:       ${money(t.amount, t.currency)} ${every(t.intervalCount, t.interval)}`,
+    `  Terms version: ${safeInline(t.termsVersion)}`,
+    disclosure.cut || phrase.cut ? "  The text above was cut. Read all of it with --json before you show it next to the order button." : "  Show the disclosure, or your own words containing the price phrase, with your business name and how to cancel."
+  ];
+}
+function exitOnBadFlag2(err) {
+  const message = err.message;
+  exitWithCliError(message, chalk12.red(`Error: ${message}`));
+}
+function subscriptionProductsCommand() {
+  const products = new Command8("subscription-products").description(
+    "Read your subscription products and the renewal terms a sign-up states (read-only; products are created and changed in the dashboard)"
+  );
+  products.command("list").description("List your subscription products, newest first, each with the terms a sign-up on it states").option("--product-ref <ref>", "Only the product with this reference (your store's product number), matched exactly").option("--status <status>", "Only products with this status: active or archived").option("--limit <n>", "Page size, 1 to 100 (default 10)").option("--starting-after <id>", "The id of the last product on the previous page (printed by a previous run)").option("--json", "Output raw JSON").action(async (opts) => {
+    let params;
+    try {
+      params = buildListParams2(opts);
+    } catch (err) {
+      exitOnBadFlag2(err);
+    }
+    const client = makeCheckoutClient();
+    const spinner = startSpinner("Listing subscription products...");
+    try {
+      const page = await client.subscriptionProducts.list(params);
+      spinner.stop();
+      if (opts.json) {
+        console.log(jsonOutput(page));
+        return;
+      }
+      for (const line of productListLines(page)) console.log(line);
+    } catch (err) {
+      spinner.stop();
+      handleError(err);
+    }
+  });
+  products.command("terms <product>").description(
+    "Read one subscription product's renewal terms, to show next to the order button before the sign-up charge. <product> is the product's id (vsprod_*) or its reference"
+  ).option("--amount <minor>", "An intro first payment in minor units (e.g. 100 = 1.00 USD), at or below the product's price").option("--json", "Output raw JSON").action(async (product, opts) => {
+    let params;
+    try {
+      params = buildTermsParams(opts);
+    } catch (err) {
+      exitOnBadFlag2(err);
+    }
+    const client = makeCheckoutClient();
+    const spinner = startSpinner("Reading subscription product terms...");
+    try {
+      const terms = await client.subscriptionProducts.terms(product, params);
+      spinner.stop();
+      if (opts.json) {
+        console.log(jsonOutput(terms));
+        return;
+      }
+      for (const line of termsLines(terms)) console.log(line);
+    } catch (err) {
+      spinner.stop();
+      handleError(err);
+    }
+  });
+  return products;
+}
+
+// src/commands/capabilities.ts
+import { Command as Command9 } from "commander";
+import chalk13 from "chalk";
 function fmtBool(v) {
-  return v ? chalk11.green("yes") : chalk11.dim("no");
+  return v ? chalk13.green("yes") : chalk13.dim("no");
 }
 function fmtVoidPolicy(v) {
   switch (v) {
     case "supported":
-      return chalk11.green(v);
+      return chalk13.green(v);
     case "rerouted_to_refund":
-      return chalk11.yellow(v);
+      return chalk13.yellow(v);
     case "not_supported":
-      return chalk11.dim(v);
+      return chalk13.dim(v);
     default:
-      return chalk11.dim(String(v));
+      return chalk13.dim(String(v));
   }
 }
 function fmtDisputeReporting(v) {
-  return v === "tracked" ? chalk11.green(v) : chalk11.yellow(v);
+  return v === "tracked" ? chalk13.green(v) : chalk13.yellow(v);
 }
 function fmtSubscriptionBilling(v) {
-  if (v === true) return chalk11.yellow("yes");
-  if (v === false) return chalk11.green("no");
-  return chalk11.yellow("unknown");
+  if (v === true) return chalk13.yellow("yes");
+  if (v === false) return chalk13.green("no");
+  return chalk13.yellow("unknown");
 }
 function printCapabilities(caps) {
   const ops = caps.supportedOperations;
-  console.log(chalk11.bold("Supported operations"));
+  console.log(chalk13.bold("Supported operations"));
   console.log(`  auth/capture separation:  ${fmtBool(ops.authCaptureSeparation)}`);
   console.log(`  partial capture:          ${fmtBool(ops.partialCapture)}`);
   console.log(`  partial refund:           ${fmtBool(ops.partialRefund)}`);
@@ -1483,17 +2432,17 @@ function printCapabilities(caps) {
   console.log();
   if (ops.disputeReporting !== "tracked") {
     console.log(
-      chalk11.yellow(
+      chalk13.yellow(
         "  \u26A0 Chargebacks on this connection do NOT reach Von Payments.\n    A `succeeded` payment is not evidence it was never disputed.\n    Monitor and answer disputes in your processor's own dashboard \u2014\n    they carry a deadline we cannot see or report."
       )
     );
     console.log();
   }
-  console.log(chalk11.bold("Subscription billing"));
+  console.log(chalk13.bold("Subscription billing"));
   console.log(`  Von Pay renews for you:   ${fmtSubscriptionBilling(caps.subscriptionBilling?.enabled)}`);
   if (caps.subscriptionBilling?.enabled !== false) {
     console.log(
-      chalk11.yellow(
+      chalk13.yellow(
         `  \u26A0 Do not run renewals from your own system while this is not "no":
     Von Pay may be charging these customers' renewals itself, and both
     would charge them. Check again at the moment you renew.`
@@ -1501,25 +2450,25 @@ function printCapabilities(caps) {
     );
   }
   console.log();
-  console.log(chalk11.bold("Settlement currencies"));
+  console.log(chalk13.bold("Settlement currencies"));
   console.log(
-    `  ${caps.settlementCurrencies.length ? caps.settlementCurrencies.join(", ") : chalk11.dim("(none reported)")}`
+    `  ${caps.settlementCurrencies.length ? caps.settlementCurrencies.join(", ") : chalk13.dim("(none reported)")}`
   );
   console.log();
-  console.log(chalk11.bold("Rate limits"));
+  console.log(chalk13.bold("Rate limits"));
   console.log(
     `  payment intents / minute: ${caps.rateLimits.paymentIntentsPerMinute}`
   );
 }
 function capabilitiesCommand() {
-  return new Command8("capabilities").description("Show what this merchant's binder supports").option("--json", "Output raw JSON").action(async (opts) => {
+  return new Command9("capabilities").description("Show what this merchant's binder supports").option("--json", "Output raw JSON").action(async (opts) => {
     const client = makeCheckoutClient();
     const spinner = startSpinner("Fetching capabilities...");
     try {
       const caps = await client.capabilities.get();
       spinner.stop();
       if (opts.json) {
-        console.log(JSON.stringify(caps, null, 2));
+        console.log(jsonOutput(caps));
       } else {
         printCapabilities(caps);
       }
@@ -1531,11 +2480,43 @@ function capabilitiesCommand() {
 }
 
 // src/commands/trigger.ts
-import { Command as Command9 } from "commander";
+import { Command as Command10 } from "commander";
 import { createHmac as createHmac2, randomUUID as randomUUID2 } from "crypto";
-import chalk12 from "chalk";
+import chalk14 from "chalk";
 import ora2 from "ora";
 
+// src/utils/signing-secret.ts
+import { randomBytes } from "crypto";
+var SIGNING_SECRET_ENV = "VONPAY_CLI_SIGNING_SECRET";
+var SIGNING_SECRET_FLAG = "--signing-secret <secret>";
+function generateSigningSecret() {
+  return `whsec_${randomBytes(32).toString("base64url")}`;
+}
+function pinnedSecretProblem(value, from, apiKey) {
+  if (apiKey !== void 0 && apiKey !== "" && value === apiKey || /^(vp_sk_|vp_pk_|vp_key_|sk_|rk_)/.test(value)) {
+    return `${from} looks like an API key. Local deliveries are never signed with an API key: use a separate secret (for example the one this command prints when you leave ${from} out).`;
+  }
+  if (value.length < 16 || /[\s\x00-\x1f\x7f]/.test(value)) {
+    return `${from} must be at least 16 characters with no spaces or control characters.`;
+  }
+  return null;
+}
+function resolveSigningSecret(flag, env = process.env, apiKey) {
+  if (flag !== void 0) {
+    const problem = pinnedSecretProblem(flag, "--signing-secret", apiKey);
+    return problem ? { error: problem } : { secret: flag, source: "flag" };
+  }
+  const fromEnv = env[SIGNING_SECRET_ENV];
+  if (fromEnv !== void 0 && fromEnv !== "") {
+    const problem = pinnedSecretProblem(fromEnv, SIGNING_SECRET_ENV, apiKey);
+    return problem ? { error: problem } : { secret: fromEnv, source: "env" };
+  }
+  return { secret: generateSigningSecret(), source: "generated" };
+}
+function signingSecretNotice(s) {
+  return s.source === "generated" ? `Signing secret for this run: ${s.secret} \u2014 verify the events with it (constructEvent(rawBody, signatureHeader, secret)). It changes every run; to keep one, pass --signing-secret or set ${SIGNING_SECRET_ENV}.` : `Signing with the secret from ${s.source === "flag" ? "--signing-secret" : SIGNING_SECRET_ENV} \u2014 verify the events with the same value.`;
+}
+
 // src/utils/forward-to.ts
 var LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
   "localhost",
@@ -1719,7 +2700,7 @@ function warnIfUnsubscribable(event, write = (m) => console.warn(m)) {
   if (!UNSUBSCRIBABLE_EVENTS.includes(event)) return false;
   const suggestion = event === "session.succeeded" ? "charge.succeeded" : "charge.failed";
   write(
-    chalk12.yellow(
+    chalk14.yellow(
       `\u26A0  ${event} is emitted internally but is NOT subscribable.
    The subscription API accepts the key, stores nothing and returns success, so a
    real endpoint receives this event NEVER \u2014 a handler tested only against it is
@@ -1914,13 +2895,16 @@ function buildPayload(event, opts) {
   };
 }
 function triggerCommand() {
-  return new Command9("trigger").description("Send a test webhook event to a local URL").argument("<event>", `Event type (${SUPPORTED_EVENTS.join(", ")})`).requiredOption("--url <url>", "Local webhook URL (e.g. http://localhost:3000/webhooks)").option("--session-id <id>", "Custom session ID").option("--amount <cents>", "Amount in minor units, a whole number").option("--currency <code>", "Currency code").option(
+  return new Command10("trigger").description("Send a test webhook event to a local URL").argument("<event>", `Event type (${SUPPORTED_EVENTS.join(", ")})`).requiredOption("--url <url>", "Local webhook URL (e.g. http://localhost:3000/webhooks)").option("--session-id <id>", "Custom session ID").option("--amount <cents>", "Amount in minor units, a whole number").option("--currency <code>", "Currency code").option(
     "--url-tunnel",
     "Allow a non-loopback --url (ngrok / Cloudflare Tunnel). Without it, --url must be this machine"
+  ).option(
+    SIGNING_SECRET_FLAG,
+    `Sign the event with this secret instead of a new random one for this run (or set ${SIGNING_SECRET_ENV}); your handler verifies with the same value`
   ).addOption(retiredConfirmLiveOption()).action(async (event, opts) => {
     if (!SUPPORTED_EVENTS.includes(event)) {
       console.error(
-        chalk12.red(
+        chalk14.red(
           `Unknown event: ${event}
 Supported: ${SUPPORTED_EVENTS.join(", ")}`
         )
@@ -1934,15 +2918,20 @@ Supported: ${SUPPORTED_EVENTS.join(", ")}`
       tunnelFlag: "--url-tunnel"
     });
     if (!destination.ok) {
-      console.error(chalk12.red(destination.reason));
+      console.error(chalk14.red(destination.reason));
       process.exit(1);
     }
-    if (destination.warning) console.warn(chalk12.yellow(destination.warning));
+    if (destination.warning) console.warn(chalk14.yellow(destination.warning));
     const amount = optionalMinorUnitsOrExit(
       opts.amount === void 0 ? void 0 : String(opts.amount),
       "--amount"
     );
     const apiKey = requireApiKey();
+    const signing = resolveSigningSecret(opts.signingSecret, process.env, apiKey);
+    if ("error" in signing) {
+      console.error(chalk14.red(signing.error));
+      process.exit(1);
+    }
     await confirmLiveAction(
       apiKey,
       {
@@ -1951,14 +2940,15 @@ Supported: ${SUPPORTED_EVENTS.join(", ")}`
           ["Event", event],
           ["Sent to", String(opts.url)]
         ],
-        consequence: "The event is signed with your LIVE key: a receiver that verifies with that key will accept it as a genuine event."
+        consequence: "A synthetic event is sent to this URL, signed with this run's signing secret (never your API key)."
       },
       opts
     );
     const payload = buildPayload(event, { ...opts, amount });
     const body = JSON.stringify(payload);
+    console.log(chalk14.dim(signingSecretNotice(signing)));
     const t = Math.floor(Date.now() / 1e3);
-    const v1 = createHmac2("sha256", apiKey).update(`${t}.${body}`).digest("hex");
+    const v1 = createHmac2("sha256", signing.secret).update(`${t}.${body}`).digest("hex");
     const signatureHeader = `t=${t},v1=${v1}`;
     const spinner = ora2(`Sending ${event} to ${opts.url}...`).start();
     try {
@@ -1978,45 +2968,45 @@ Supported: ${SUPPORTED_EVENTS.join(", ")}`
       spinner.stop();
       if (isRedirect(response)) {
         console.error(
-          chalk12.red(
+          chalk14.red(
             `\u2717 ${event} not delivered: ${safeDisplay(String(opts.url))} answered with a redirect (HTTP ${response.status}). It was not followed, and the signed event was not sent anywhere else. Point --url at the endpoint itself.`
           )
         );
         process.exit(1);
       }
       if (response.ok) {
-        console.log(chalk12.green(`\u2713 ${event} delivered \u2192 ${response.status}`));
+        console.log(chalk14.green(`\u2713 ${event} delivered \u2192 ${response.status}`));
       } else {
         console.log(
-          chalk12.yellow(
+          chalk14.yellow(
             `\u26A0 ${event} delivered but got ${response.status} response`
           )
         );
       }
-      console.log(chalk12.dim(`  Event:   ${payload.id} (${payload.type})`));
+      console.log(chalk14.dim(`  Event:   ${payload.id} (${payload.type})`));
       console.log(
-        chalk12.dim(
+        chalk14.dim(
           `  Amount:  ${payload.data.amount} ${payload.data.currency}`
         )
       );
       console.log(
-        chalk12.dim(
+        chalk14.dim(
           `
   Verify with: vonpay.webhooks.constructEvent(rawBody, signatureHeader, secret)`
         )
       );
       console.log(
-        chalk12.dim(
-          `  (local dev: 'secret' is your API key here \u2014 production webhooks are signed with your endpoint's whsec_\u2026 secret, NOT your API key)`
+        chalk14.dim(
+          `  ('secret' is this run's signing secret, printed above \u2014 production webhooks are signed with your endpoint's whsec_\u2026 secret, and never with your API key)`
         )
       );
     } catch (err) {
       spinner.stop();
       if (err instanceof Error && err.name === "TimeoutError") {
-        console.error(chalk12.red(`Timeout: ${opts.url} did not respond within 10s`));
+        console.error(chalk14.red(`Timeout: ${opts.url} did not respond within 10s`));
       } else {
         console.error(
-          chalk12.red(
+          chalk14.red(
             `Failed to deliver: ${err instanceof Error ? err.message : err}`
           )
         );
@@ -2027,7 +3017,7 @@ Supported: ${SUPPORTED_EVENTS.join(", ")}`
 }
 
 // src/commands/listen.ts
-import { Command as Command10 } from "commander";
+import { Command as Command11 } from "commander";
 import { VonPayCheckout as VonPayCheckout2 } from "@vonpay/checkout-node";
 
 // ../sse-parser/dist/index.js
@@ -2128,9 +3118,9 @@ function resumeId(lastId) {
 async function* consumeSse(opts) {
   const initialBackoffMs = opts.initialBackoffMs ?? 1e3;
   const maxBackoffMs = opts.maxBackoffMs ?? 3e4;
-  const pending = [];
+  const pending2 = [];
   const parser = new SseParser(
-    (type, data) => pending.push({ type, data, lastEventId: parser.lastId || void 0 }),
+    (type, data) => pending2.push({ type, data, lastEventId: parser.lastId || void 0 }),
     { maxPending: MAX_PENDING_CHARS, maxIdLength: MAX_EVENT_ID_LENGTH }
   );
   let backoffMs = initialBackoffMs;
@@ -2153,7 +3143,10 @@ async function* consumeSse(opts) {
       response = await fetch(opts.url, {
         method: "GET",
         headers,
-        signal: opts.signal
+        signal: opts.signal,
+        // Never follow a redirect: the request carries the API key, and a 3xx
+        // would re-send it to wherever the answer points.
+        redirect: "manual"
       });
     } catch (err) {
       if (opts.signal.aborted) return;
@@ -2163,6 +3156,11 @@ async function* consumeSse(opts) {
       backoffMs = Math.min(backoffMs * 2, maxBackoffMs);
       continue;
     }
+    if (response.status >= 300 && response.status < 400) {
+      const error = new SseRedirectError(response.status);
+      onLifecycle({ kind: "fatal", error });
+      throw error;
+    }
     if (response.status === 401 || response.status === 403) {
       const body = await safeReadText(response);
       onLifecycle({ kind: "auth_failed", status: response.status, body });
@@ -2206,7 +3204,7 @@ async function* consumeSse(opts) {
         } catch (err) {
           feedError = err;
         }
-        for (const ev of pending.splice(0)) {
+        for (const ev of pending2.splice(0)) {
           if (ev.type === "timeout") {
             serverInitiatedReconnect = true;
           } else {
@@ -2274,6 +3272,16 @@ var SseAuthError = class extends Error {
   status;
   body;
 };
+var SseRedirectError = class extends Error {
+  constructor(status) {
+    super(
+      `The event stream answered with a redirect (HTTP ${status}). It was not followed, so your API key was not sent anywhere else. Check VONPAY_BASE_URL.`
+    );
+    this.status = status;
+    this.name = "SseRedirectError";
+  }
+  status;
+};
 function sleep(ms, signal) {
   return new Promise((resolve2) => {
     const timer = setTimeout(() => {
@@ -2301,24 +3309,38 @@ function noop() {
 }
 
 // src/utils/listen-output.ts
-import chalk13 from "chalk";
+import chalk15 from "chalk";
+function parseAttemptPayload(data) {
+  let raw;
+  try {
+    raw = JSON.parse(data);
+  } catch {
+    return null;
+  }
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const r = raw;
+  const str2 = (k) => typeof r[k] === "string";
+  const num = (k) => typeof r[k] === "number" && Number.isFinite(r[k]);
+  const ok = str2("event_id") && str2("event_type") && str2("subscription_id") && str2("timestamp") && num("attempt") && num("latency_ms") && typeof r["succeeded"] === "boolean" && typeof r["livemode"] === "boolean" && (r["response_status"] === null || num("response_status"));
+  return ok ? r : null;
+}
 function formatAttemptHuman(payload, forward) {
   const ts = formatTimestamp(payload.timestamp);
-  const eventType = chalk13.cyan(payload.event_type.padEnd(24));
-  const eventId = chalk13.gray(payload.event_id.padEnd(28));
-  const attempt = chalk13.gray(`attempt ${payload.attempt}`);
-  const arrow = chalk13.gray("\u2192");
+  const eventType = chalk15.cyan(safeInline(payload.event_type, 64).padEnd(24));
+  const eventId = chalk15.gray(safeInline(payload.event_id, 64).padEnd(28));
+  const attempt = chalk15.gray(`attempt ${payload.attempt}`);
+  const arrow = chalk15.gray("\u2192");
   const upstream = formatUpstream(payload);
-  const latency = chalk13.gray(`${payload.latency_ms}ms`);
-  const liveBadge = payload.livemode ? chalk13.red(" [LIVE]") : "";
+  const latency = chalk15.gray(`${payload.latency_ms}ms`);
+  const liveBadge = payload.livemode ? chalk15.red(" [LIVE]") : "";
   let line = `[${ts}] ${eventType} ${eventId} ${attempt}  ${arrow} ${upstream}  ${latency}${liveBadge}`;
   if (forward && forward.attempted) {
-    const fwdArrow = chalk13.gray("\u2192 local");
+    const fwdArrow = chalk15.gray("\u2192 local");
     if (forward.error) {
-      line += `  ${fwdArrow} ${chalk13.red(forward.error)}`;
+      line += `  ${fwdArrow} ${chalk15.red(safeInline(forward.error))}`;
     } else if (forward.status !== null) {
       const fwdStatus = formatStatus(forward.status);
-      const fwdLatency = chalk13.gray(`${forward.latencyMs}ms`);
+      const fwdLatency = chalk15.gray(`${forward.latencyMs}ms`);
       line += `  ${fwdArrow} ${fwdStatus} ${fwdLatency}`;
     }
   }
@@ -2327,47 +3349,50 @@ function formatAttemptHuman(payload, forward) {
 function formatAttemptJson(payload, forward) {
   const body = {
     type: "webhook.attempt",
-    event_id: payload.event_id,
-    event_type: payload.event_type,
-    subscription_id: payload.subscription_id,
+    event_id: safeInline(payload.event_id, 200),
+    event_type: safeInline(payload.event_type, 200),
+    subscription_id: safeInline(payload.subscription_id, 200),
     attempt: payload.attempt,
     succeeded: payload.succeeded,
     response_status: payload.response_status,
     latency_ms: payload.latency_ms,
-    timestamp: payload.timestamp,
+    timestamp: safeInline(payload.timestamp, 64),
     livemode: payload.livemode
   };
   if (forward && forward.attempted) {
     body.forward = {
       status: forward.status,
       latency_ms: forward.latencyMs,
-      error: forward.error
+      error: forward.error === null ? null : safeInline(forward.error)
     };
   }
-  return JSON.stringify(body);
+  return JSON.stringify(cleanJsonValue(body));
 }
+var LIFECYCLE_EXACT_KEYS = /* @__PURE__ */ new Set(["signing_secret"]);
 function formatLifecycleHuman(message, kind) {
-  const tag = kind === "info" ? chalk13.cyan("[vonpay]") : kind === "warn" ? chalk13.yellow("[vonpay]") : chalk13.red("[vonpay]");
+  const tag = kind === "info" ? chalk15.cyan("[vonpay]") : kind === "warn" ? chalk15.yellow("[vonpay]") : chalk15.red("[vonpay]");
   return `${tag} ${message}`;
 }
 function formatLifecycleJson(kind, extra = {}) {
-  return JSON.stringify({ type: `cli.${kind}`, ...extra, timestamp: (/* @__PURE__ */ new Date()).toISOString() });
+  return JSON.stringify(
+    cleanJsonValue({ type: `cli.${kind}`, ...extra, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, { exactKeys: LIFECYCLE_EXACT_KEYS })
+  );
 }
 function formatStatus(status) {
-  if (status >= 200 && status < 300) return chalk13.green(String(status));
-  if (status >= 400 && status < 500) return chalk13.yellow(String(status));
-  if (status >= 500) return chalk13.red(String(status));
-  return chalk13.gray(String(status));
+  if (status >= 200 && status < 300) return chalk15.green(String(status));
+  if (status >= 400 && status < 500) return chalk15.yellow(String(status));
+  if (status >= 500) return chalk15.red(String(status));
+  return chalk15.gray(String(status));
 }
 function formatUpstream(payload) {
   if (payload.response_status === null) {
-    return chalk13.red("timeout");
+    return chalk15.red("timeout");
   }
   return formatStatus(payload.response_status);
 }
 function formatTimestamp(iso) {
   const date = new Date(iso);
-  if (isNaN(date.getTime())) return iso.slice(0, 19);
+  if (isNaN(date.getTime())) return safeInline(iso, 19);
   const h = String(date.getHours()).padStart(2, "0");
   const m = String(date.getMinutes()).padStart(2, "0");
   const s = String(date.getSeconds()).padStart(2, "0");
@@ -2376,7 +3401,7 @@ function formatTimestamp(iso) {
 
 // src/commands/listen.ts
 function listenCommand() {
-  return new Command10("listen").description(
+  return new Command11("listen").description(
     "Watch webhook delivery attempts in real time. Optionally re-forward each event to a local URL for development."
   ).option(
     "--forward-to <url>",
@@ -2388,7 +3413,10 @@ function listenCommand() {
     "--events <type>",
     "Only stream attempts for the given event type. Repeat the flag for multiple types.",
     (value, prev) => prev ? [...prev, value] : [value]
-  ).option("--json", "Emit one JSON object per line on stdout instead of the colored transcript").option("--api-key <key>", "Override the API key from env / config").addOption(retiredConfirmLiveOption()).action(async (opts) => {
+  ).option("--json", "Emit one JSON object per line on stdout instead of the colored transcript").option("--api-key <key>", "Override the API key from env / config").option(
+    SIGNING_SECRET_FLAG,
+    `With --forward-to: sign forwarded events with this secret instead of a new random one for this run (or set ${SIGNING_SECRET_ENV})`
+  ).addOption(retiredConfirmLiveOption()).action(async (opts) => {
     const apiKey = opts.apiKey ?? requireApiKey();
     if (opts.apiKey !== void 0) warnLiveSecretFlag(opts.apiKey, "--api-key");
     const refuse = (message) => {
@@ -2411,6 +3439,12 @@ function listenCommand() {
       forwardUrl = verdict.url;
       forwardWarning = verdict.warning;
     }
+    let signing;
+    if (forwardUrl) {
+      const resolved = resolveSigningSecret(opts.signingSecret, process.env, apiKey);
+      if ("error" in resolved) refuse(resolved.error);
+      signing = resolved;
+    }
     const configuredBaseUrl = getBaseUrl();
     const destinationProblem = keyDestinationProblem(apiKey, configuredBaseUrl);
     if (destinationProblem) refuse(destinationProblem);
@@ -2426,7 +3460,7 @@ function listenCommand() {
           ["Stream from", baseUrl],
           ...forwardUrl ? [["Forward to", forwardUrl.toString()]] : []
         ],
-        consequence: forwardUrl ? "Live payment events, with buyer and order details, will be shown here, and each one is signed with your LIVE key and sent to the forward URL." : "Live payment events, with buyer and order details, will be shown here."
+        consequence: forwardUrl ? "Live payment events, with buyer and order details, will be shown here, and each one is sent to the forward URL (signed with this run's signing secret, never your API key)." : "Live payment events, with buyer and order details, will be shown here."
       },
       opts
     );
@@ -2465,6 +3499,7 @@ function listenCommand() {
       }
       controller.abort();
     };
+    auditSignalHandledByCommand();
     process.once("SIGINT", () => onSignal("SIGINT"));
     process.once("SIGTERM", () => onSignal("SIGTERM"));
     const onLifecycle = (event) => {
@@ -2487,12 +3522,16 @@ function listenCommand() {
       process.stderr.write(
         formatLifecycleHuman(`Ready! Listening for webhook delivery attempts${filterNote}${fwdNote}.`, "info") + "\n"
       );
+      if (signing) process.stderr.write(formatLifecycleHuman(signingSecretNotice(signing), "info") + "\n");
     } else {
       process.stderr.write(
         formatLifecycleJson("ready", {
           base_url: baseUrl,
           filter: opts.events ?? null,
-          forward_to: forwardUrl?.toString() ?? null
+          forward_to: forwardUrl?.toString() ?? null,
+          // The generated secret in full (the local receiver needs it); a pinned one by source only.
+          signing_secret: signing?.source === "generated" ? signing.secret : null,
+          signing_secret_source: signing?.source ?? null
         }) + "\n"
       );
     }
@@ -2514,12 +3553,8 @@ function listenCommand() {
         if (sseEvent.type !== "webhook.attempt") {
           continue;
         }
-        let payload;
-        try {
-          payload = JSON.parse(sseEvent.data);
-        } catch {
-          continue;
-        }
+        const payload = parseAttemptPayload(sseEvent.data);
+        if (payload === null) continue;
         eventCount += 1;
         let forwardOutcome = null;
         if (forwardUrl && sdk) {
@@ -2527,7 +3562,7 @@ function listenCommand() {
             const eventRecord = await sdk.webhookEvents.retrieve(payload.event_id);
             forwardOutcome = await forwardPayload(eventRecord.payload, {
               url: forwardUrl,
-              signingSecret: apiKey,
+              signingSecret: signing.secret,
               signal: controller.signal
             });
           } catch (err) {
@@ -2548,6 +3583,7 @@ function listenCommand() {
       }
     } catch (err) {
       if (err instanceof SseAuthError) {
+        auditNote({ outcome: "error", code: "auth_failed" });
         if (mode === "human") {
           process.stderr.write(
             formatLifecycleHuman(
@@ -2562,6 +3598,10 @@ function listenCommand() {
         }
         process.exit(1);
       }
+      if (err instanceof SseRedirectError) {
+        if (jsonErrorsEnabled()) exitWithCliError(err.message, err.message);
+        process.exit(1);
+      }
       if (jsonErrorsEnabled()) handleError(err);
       throw err;
     }
@@ -2570,29 +3610,29 @@ function listenCommand() {
 function lifecyclePayload(event) {
   switch (event.kind) {
     case "connecting":
-      return { last_event_id: event.lastEventId ?? null };
+      return { last_event_id: event.lastEventId === void 0 ? null : safeInline(event.lastEventId, 200) };
     case "connected":
       return {};
     case "disconnected":
-      return { reason: event.reason, will_retry_in_ms: event.willRetryInMs };
+      return { reason: safeInline(event.reason, 400), will_retry_in_ms: event.willRetryInMs };
     case "auth_failed":
       return { status: event.status };
     case "fatal":
-      return { error: event.error.message };
+      return { error: safeInline(event.error.message, 400) };
   }
 }
 function lifecycleHumanMessage(event) {
   switch (event.kind) {
     case "connecting":
-      return event.lastEventId ? `Reconnecting (resume from ${event.lastEventId})` : "Connecting...";
+      return event.lastEventId ? `Reconnecting (resume from ${safeInline(event.lastEventId, 200)})` : "Connecting...";
     case "connected":
       return "Connected.";
     case "disconnected":
-      return `Disconnected: ${event.reason}. Retrying in ${event.willRetryInMs}ms.`;
+      return `Disconnected: ${safeInline(event.reason, 400)}. Retrying in ${event.willRetryInMs}ms.`;
     case "auth_failed":
       return `Authentication failed (HTTP ${event.status}).`;
     case "fatal":
-      return `Fatal: ${event.error.message}`;
+      return `Fatal: ${safeInline(event.error.message, 400)}`;
   }
 }
 function lifecycleSeverity(kind) {
@@ -2609,36 +3649,37 @@ function lifecycleSeverity(kind) {
 }
 
 // src/commands/health.ts
-import { Command as Command11 } from "commander";
-import chalk14 from "chalk";
-import { VonPayError as VonPayError2 } from "@vonpay/checkout-node";
+import { Command as Command12 } from "commander";
+import chalk16 from "chalk";
+import { VonPayError as VonPayError3 } from "@vonpay/checkout-node";
 function healthCommand() {
-  return new Command11("health").description("Check checkout API health").option("--json", "Output raw JSON").action(async (opts) => {
+  return new Command12("health").description("Check checkout API health").option("--json", "Output raw JSON").action(async (opts) => {
     const client = makeCheckoutClient();
     const spinner = startSpinner("Checking API health...");
     try {
       const health = await client.health();
       spinner.stop();
       if (opts.json) {
-        console.log(JSON.stringify(health, null, 2));
+        console.log(jsonOutput(health));
       } else {
-        const statusColor = health.status === "ok" ? chalk14.green : health.status === "degraded" ? chalk14.yellow : chalk14.red;
-        console.log(`  Status:   ${statusColor(health.status)}`);
-        console.log(`  Latency:  ${health.latencyMs}ms`);
+        const statusColor = health.status === "ok" ? chalk16.green : health.status === "degraded" ? chalk16.yellow : chalk16.red;
+        console.log(`  Status:   ${statusColor(safeInline(String(health.status)))}`);
+        console.log(`  Latency:  ${safeInline(String(health.latencyMs))}ms`);
         if (health.version) {
-          console.log(`  Version:  ${health.version}`);
+          console.log(`  Version:  ${safeInline(String(health.version))}`);
         }
       }
     } catch (err) {
       spinner.stop();
+      auditError(err);
       if (jsonErrorsEnabled()) handleError(err);
-      if (err instanceof VonPayError2) {
-        console.error(chalk14.red(`API error: ${scrubSecrets(err.message)}`));
-        console.error(chalk14.dim(`  Code: ${err.code}`));
+      if (err instanceof VonPayError3) {
+        console.error(chalk16.red(`API error: ${scrubSecrets(safeInline(err.message, 2e3))}`));
+        console.error(chalk16.dim(`  Code: ${safeInline(String(err.code))}`));
       } else {
         console.error(
-          chalk14.red(
-            `Cannot reach API: ${scrubSecrets(err instanceof Error ? err.message : String(err))}`
+          chalk16.red(
+            `Cannot reach API: ${scrubSecrets(safeInline(err instanceof Error ? err.message : String(err), 2e3))}`
           )
         );
       }
@@ -2648,14 +3689,14 @@ function healthCommand() {
 }
 
 // src/commands/doctor.ts
-import { Command as Command12 } from "commander";
-import chalk15 from "chalk";
+import { Command as Command13 } from "commander";
+import chalk17 from "chalk";
 import ora3 from "ora";
 import { homedir as homedir2 } from "os";
 import { existsSync as existsSync3 } from "fs";
 import {
   VonPayCheckout as VonPayCheckout3,
-  VonPayError as VonPayError3,
+  VonPayError as VonPayError4,
   helpFor
 } from "@vonpay/checkout-node";
 var RELEVANT_ENV_VARS = [
@@ -2679,7 +3720,8 @@ function maskPrefix(key) {
   if (!m) return void 0;
   return `${m[1]}${m[3]}\u2026`;
 }
-function keyMode(key) {
+var DOCTOR_JSON_CLEANING = { exactKeys: /* @__PURE__ */ new Set(["apiKeyPrefix"]) };
+function keyMode2(key) {
   if (!key) return void 0;
   return secretKeyMode(key) ?? "not_a_secret_key";
 }
@@ -2705,10 +3747,10 @@ async function gather() {
       present: existsSync3(
         `${process.env.HOME ?? process.env.USERPROFILE ?? ""}/.vonpay/config.json`
       ),
-      keyType: config.checkout?.apiKey ? keyMode(config.checkout?.apiKey) : void 0
+      keyType: config.checkout?.apiKey ? keyMode2(config.checkout?.apiKey) : void 0
     },
     apiKeyPrefix: maskPrefix(apiKey),
-    apiKeyMode: keyMode(apiKey),
+    apiKeyMode: keyMode2(apiKey),
     health: { baseUrl, reachable: false },
     hints: []
   };
@@ -2802,7 +3844,7 @@ async function gather() {
         );
       }
     } catch (err) {
-      if (err instanceof VonPayError3) {
+      if (err instanceof VonPayError4) {
         const help = helpFor(err.code);
         report.validateProbe = {
           ok: false,
@@ -2833,47 +3875,47 @@ async function gather() {
 }
 function renderHuman(r) {
   const lines = [];
-  lines.push(chalk15.bold.blue("vonpay doctor \u2014 diagnostic report"));
-  lines.push(chalk15.dim(`generated ${r.generatedAt}`));
+  lines.push(chalk17.bold.blue("vonpay doctor \u2014 diagnostic report"));
+  lines.push(chalk17.dim(`generated ${r.generatedAt}`));
   lines.push("");
-  lines.push(chalk15.bold("Runtime"));
+  lines.push(chalk17.bold("Runtime"));
   lines.push(`  CLI:       ${r.cli.version}`);
   lines.push(`  Node:      ${r.runtime.node}`);
   lines.push(`  Platform:  ${r.runtime.platform} (${r.runtime.arch})`);
   lines.push(`  CWD:       ${r.runtime.cwd}`);
   lines.push("");
-  lines.push(chalk15.bold("API key"));
+  lines.push(chalk17.bold("API key"));
   if (r.apiKeyPrefix) {
     lines.push(`  Prefix:    ${r.apiKeyPrefix}`);
     lines.push(`  Mode:      ${r.apiKeyMode}`);
   } else {
-    lines.push(chalk15.dim("  (no key found in env or ~/.vonpay/config.json)"));
+    lines.push(chalk17.dim("  (no key found in env or ~/.vonpay/config.json)"));
   }
   lines.push("");
-  lines.push(chalk15.bold("Env vars present (names only)"));
+  lines.push(chalk17.bold("Env vars present (names only)"));
   if (r.envVarsPresent.length === 0) {
-    lines.push(chalk15.dim("  (none of the expected vonpay env vars are set)"));
+    lines.push(chalk17.dim("  (none of the expected vonpay env vars are set)"));
   } else {
     for (const n of r.envVarsPresent) lines.push(`  \u2713 ${n}`);
   }
   lines.push("");
-  lines.push(chalk15.bold("Health probe"));
+  lines.push(chalk17.bold("Health probe"));
   if (r.health.reachable) {
-    const statusColor = r.health.status === "ok" ? chalk15.green : r.health.status === "degraded" ? chalk15.yellow : chalk15.red;
-    lines.push(`  Reachable: ${chalk15.green("yes")}`);
+    const statusColor = r.health.status === "ok" ? chalk17.green : r.health.status === "degraded" ? chalk17.yellow : chalk17.red;
+    lines.push(`  Reachable: ${chalk17.green("yes")}`);
     lines.push(`  Status:    ${statusColor(r.health.status ?? "?")}`);
     lines.push(`  Latency:   ${r.health.latencyMs}ms`);
   } else {
-    lines.push(`  Reachable: ${chalk15.red("no")}`);
+    lines.push(`  Reachable: ${chalk17.red("no")}`);
     lines.push(`  Error:     ${r.health.error}`);
   }
   lines.push("");
   if (r.validateProbe) {
-    lines.push(chalk15.bold("sessions.validate probe ($14.99 USD dry-run)"));
+    lines.push(chalk17.bold("sessions.validate probe ($14.99 USD dry-run)"));
     if (r.validateProbe.ok) {
-      lines.push(`  Result:    ${chalk15.green("valid")}`);
+      lines.push(`  Result:    ${chalk17.green("valid")}`);
     } else {
-      lines.push(`  Result:    ${chalk15.red("invalid")}`);
+      lines.push(`  Result:    ${chalk17.red("invalid")}`);
       if (r.validateProbe.error) {
         lines.push(`  Code:      ${r.validateProbe.error.code}`);
         lines.push(`  Action:    ${r.validateProbe.error.nextAction}`);
@@ -2886,7 +3928,7 @@ function renderHuman(r) {
     lines.push("");
   }
   if (r.hints.length > 0) {
-    lines.push(chalk15.bold("Hints"));
+    lines.push(chalk17.bold("Hints"));
     for (const h of r.hints) lines.push(`  \u2022 ${h}`);
     lines.push("");
   }
@@ -2963,7 +4005,7 @@ function renderForLlm(r) {
   return out.join("\n");
 }
 function doctorCommand() {
-  return new Command12("doctor").description(
+  return new Command13("doctor").description(
     "Diagnose your Von Payments environment \u2014 runtime, env vars, live API probe; outputs human / JSON / LLM-readable formats"
   ).option("--json", "Output JSON (machine-parseable)").option(
     "--for-llm",
@@ -2978,7 +4020,7 @@ function doctorCommand() {
     const report = await gather();
     spinner.stop();
     if (opts.json) {
-      console.log(JSON.stringify(report, null, 2));
+      console.log(jsonOutput(report, DOCTOR_JSON_CLEANING));
     } else if (opts.forLlm) {
       console.log(renderForLlm(report));
     } else {
@@ -2988,8 +4030,8 @@ function doctorCommand() {
 }
 
 // src/commands/checkout.ts
-function registerCheckout(program2) {
-  const checkout = program2.command("checkout").description("Checkout integration tools");
+function registerCheckout(program) {
+  const checkout = program.command("checkout").description("Checkout integration tools");
   checkout.hook("preAction", (_checkout, actionCommand) => {
     setJsonErrors(actionCommand.opts().json === true);
   });
@@ -3000,6 +4042,7 @@ function registerCheckout(program2) {
   checkout.addCommand(paymentIntentsCommand());
   checkout.addCommand(refundsCommand());
   checkout.addCommand(tokensCommand());
+  checkout.addCommand(subscriptionProductsCommand());
   checkout.addCommand(capabilitiesCommand());
   checkout.addCommand(triggerCommand());
   checkout.addCommand(listenCommand());
@@ -3007,12 +4050,32 @@ function registerCheckout(program2) {
   checkout.addCommand(doctorCommand());
 }
 
+// src/program.ts
+function commandPath(cmd) {
+  const names = [];
+  for (let c = cmd; c && c.parent; c = c.parent) names.unshift(c.name());
+  return names.join(" ");
+}
+function buildProgram() {
+  const program = new Command14();
+  program.name("vonpay").description("Von Payments developer tools").version(CLI_VERSION).option(
+    ALLOW_CUSTOM_BASE_URL_FLAG,
+    "With VONPAY_ALLOW_CUSTOM_BASE_URL=1: send a live key to a base URL that is not a Von Payments host (a proxy you run)"
+  ).hook("preAction", (_root, actionCommand) => {
+    setAllowCustomBaseUrlFlag(program.opts().allowCustomBaseUrl === true);
+    try {
+      auditStart(commandPath(actionCommand), CLI_VERSION, actionCommand.opts(), actionCommand.args);
+    } catch {
+    }
+  });
+  registerCheckout(program);
+  const withUsageAudit = (cmd) => {
+    cmd.exitOverride((err) => auditUsageError(commandPath(cmd), CLI_VERSION, err.code, err.exitCode));
+    cmd.commands.forEach(withUsageAudit);
+  };
+  withUsageAudit(program);
+  return program;
+}
+
 // src/index.ts
-var __dirname = dirname2(fileURLToPath2(import.meta.url));
-var pkg2 = JSON.parse(
-  readFileSync4(join3(__dirname, "..", "package.json"), "utf-8")
-);
-var program = new Command13();
-program.name("vonpay").description("Von Payments developer tools").version(pkg2.version);
-registerCheckout(program);
-program.parse();
+buildProgram().parse();