@vonpay/checkout-cli 0.18.0 → 0.19.0

package/dist/index.js

@@ -1,7 +1,24 @@
 #!/usr/bin/env node
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
 
 // src/program.ts
-import { Command as Command13 } from "commander";
+import { Command as Command14 } from "commander";
 
 // src/commands/login.ts
 import { Command, Option } from "commander";
@@ -10,7 +27,7 @@ import chalk from "chalk";
 
 // src/config.ts
 import { chmodSync as chmodSync2, existsSync, mkdirSync as mkdirSync2, readFileSync, rmSync, writeFileSync } from "fs";
-import { homedir as homedir2 } from "os";
+import { homedir } from "os";
 import { join as join2 } from "path";
 
 // src/utils/json-errors.ts
@@ -31,218 +48,93 @@ function emitCliError(json, text) {
 }
 
 // src/utils/key-mode.ts
-import { isLiveKey } from "@vonpay/checkout-node";
-var TEST_SECRET_KEY_PREFIX = "vp_sk_test_";
-function requiresLiveConfirmation(key) {
-  if (typeof key !== "string") return true;
-  if (key.startsWith(TEST_SECRET_KEY_PREFIX)) return false;
-  if (key.startsWith("vp_pk_")) return false;
-  return true;
-}
+import { keyMode } from "@vonpay/checkout-node";
 function secretKeyMode(key) {
-  if (typeof key !== "string") return null;
-  if (isLiveKey(key)) return "live";
-  if (key.startsWith(TEST_SECRET_KEY_PREFIX)) return "test";
-  return null;
+  const mode = keyMode(key);
+  return mode === "test" || mode === "live" ? mode : null;
 }
 var NOT_A_SECRET_KEY_MESSAGE = "This is not a Von Payments secret key: it must start with vp_sk_test_ (sandbox) or vp_sk_live_ (live). Publishable keys (vp_pk_\u2026) and keys from other services cannot be used with this CLI.";
 
 // src/utils/audit-log.ts
+var audit_log_exports = {};
+__export(audit_log_exports, {
+  AUDIT_FIELDS: () => AUDIT_FIELDS,
+  COMMAND_KIND: () => COMMAND_KIND,
+  MONEY: () => MONEY,
+  UNKNOWN_COMMAND: () => UNKNOWN_COMMAND,
+  _resetAuditForTests: () => _resetAuditForTests,
+  _resetAuditWarningsForTests: () => _resetAuditWarningsForTests,
+  auditError: () => auditError,
+  auditFinish: () => auditFinish,
+  auditIntent: () => auditIntent,
+  auditLine: () => auditLine,
+  auditNote: () => auditNote,
+  auditSignalHandledByCommand: () => auditSignalHandledByCommand,
+  auditStart: () => auditStart,
+  auditUsageError: () => auditUsageError,
+  fullRecordLine: () => fullRecordLine,
+  isMoneyCommand: () => isMoneyCommand,
+  pruneAuditFiles: () => pruneAuditFiles,
+  writeAuditLine: () => writeAuditLine
+});
+__reExport(audit_log_exports, audit_log_star);
 import {
   chmodSync,
   closeSync,
-  constants as FS,
   fchmodSync,
   fstatSync,
   lstatSync,
   mkdirSync,
   openSync,
   readdirSync,
+  readSync,
   unlinkSync,
   writeSync
 } from "fs";
-import { homedir } from "os";
-import { join, resolve } from "path";
-import { isErrorCode, stripHiddenCharacters } from "@vonpay/checkout-node";
-var AUDIT_FIELDS = [
-  "ts",
-  "surface",
-  "version",
-  "command",
-  "key_mode",
-  "key_fingerprint",
-  "outcome",
-  "error_code",
-  "request_id",
-  "amount",
-  "currency",
-  "target"
-];
-var AUDIT_OUTCOMES = [
-  "pending",
-  // a money command is about to send; the command's final line follows
-  "sent",
-  // an API command ran to the end (sent and answered); no person was asked
-  "local",
-  // a command that sends nothing to the API (login, logout, init, trigger) ran to the end
-  "approved",
-  // a person confirmed it at the terminal, and it ran to the end
-  "declined",
-  // the person did not type "confirm"
-  "budget_refused",
-  // (the MCP server's spending budget; the CLI has none)
-  "read_mode_blocked",
-  // (the MCP server's read-only mode; the CLI has none)
-  "withheld",
-  // a live action with no person at an interactive terminal to confirm it
-  "lookup_refused",
-  // the check before the confirmation failed (a refund's payment could not be looked up or did not match)
-  "refused_local",
-  // refused by the CLI before anything was sent (a flag, a key rule, an unsafe base URL, a command line it cannot parse, …)
-  "error"
-  // the API (or the network) answered with an error, the run was interrupted, or the CLI crashed (internal_error)
-];
-var LOCAL_ERROR_CODES = [
-  "auth_failed",
-  "budget",
-  "cancelled",
-  "confirm_live_required",
-  "currency_mismatch",
-  "declined",
-  "dismissed",
-  "excess_arguments",
-  "idempotency_key_required",
-  "internal_error",
-  "interrupted",
-  "invalid_argument",
-  "invalid_input",
-  "live_loopback_url",
-  "local_refusal",
-  "lookup_failed",
-  "missing_argument",
-  "network_error",
-  "no_approval_channel",
-  "no_terminal",
-  "not_ticked",
-  "prompt_failed",
-  "read_mode",
-  "unknown_command",
-  "unknown_option",
-  "unknown_tool",
-  "usage_error"
-];
-var LOCAL_CODES = new Set(LOCAL_ERROR_CODES);
-var AUDIT_DIR_ENV = "VONPAY_AUDIT_DIR";
-var AUDIT_SWITCH_ENV = "VONPAY_AUDIT_LOG";
-var AUDIT_RETENTION_ENV = "VONPAY_AUDIT_RETENTION_DAYS";
-var DEFAULT_RETENTION_DAYS = 30;
-var MAX_FILE_BYTES = 50 * 1024 * 1024;
-function auditText(s, max) {
-  const line = stripHiddenCharacters(s).replace(/[\p{Cc}\u{2028}\u{2029}]/gu, " ").trim();
-  return line.length > max ? line.slice(0, max) : line;
-}
-function keyFingerprint(key) {
-  if (key.length >= 24) return `${key.slice(0, 12)}\u2026${key.slice(-4)}`;
-  const head = Math.min(12, Math.floor(key.length / 3));
-  const tail = Math.min(4, Math.floor(key.length / 4));
-  return `${key.slice(0, head)}\u2026${key.slice(key.length - tail)}`;
-}
-var TARGET_ID = /^(vpi|vp_tx|vsub|vp_cs)_(live|test)_[A-Za-z0-9_-]{16}$/;
-var REQUEST_ID = /^[A-Za-z0-9_-]{12}$/;
-var CURRENCY = /^[A-Za-z]{3}$/;
-var COMMAND = /^[a-z0-9-]+( [a-z0-9-]+){0,3}$/;
+import { join } from "path";
+import {
+  AUDIT_DIR_ENV,
+  AUDIT_SWITCH_ENV,
+  DEFAULT_AUDIT_LIMITS,
+  FULL_RECORD_SUFFIX,
+  auditAppendFlags,
+  auditErrorCodeOf,
+  auditFileExpired,
+  auditKeyFields,
+  auditLineFormat,
+  auditSettingsFromEnv,
+  auditSpaceWarnings,
+  checkAuditDirStats,
+  checkAuditFileStats,
+  isReservedLine,
+  spaceDecision,
+  stderrWarn
+} from "@vonpay/checkout-node/internal/audit-log";
+import * as audit_log_star from "@vonpay/checkout-node/internal/audit-log";
 var UNKNOWN_COMMAND = "[unknown command]";
-var UNRECOGNISED_ID = "[unrecognised id]";
-var UNRECOGNISED_REQUEST_ID = "[unrecognised request id]";
-function knownErrorCode(code) {
-  return typeof code === "string" && (isErrorCode(code) || LOCAL_CODES.has(code));
-}
-function auditLine(record) {
-  const out = {};
-  for (const field of AUDIT_FIELDS) {
-    const v = record[field];
-    if (v === void 0 || v === null) continue;
-    switch (field) {
-      case "amount":
-        if (typeof v === "number" && Number.isSafeInteger(v) && v >= 0) out[field] = v;
-        break;
-      case "currency":
-        if (typeof v === "string" && CURRENCY.test(v)) out[field] = v.toUpperCase();
-        break;
-      case "target":
-        if (typeof v === "string") out[field] = TARGET_ID.test(v) ? v : UNRECOGNISED_ID;
-        break;
-      case "error_code":
-        if (typeof v === "string") out[field] = knownErrorCode(v) ? v : "unrecognised_code";
-        break;
-      case "request_id":
-        if (typeof v === "string") out[field] = REQUEST_ID.test(v) ? v : UNRECOGNISED_REQUEST_ID;
-        break;
-      case "outcome":
-        if (typeof v === "string" && AUDIT_OUTCOMES.includes(v)) out[field] = v;
-        break;
-      case "key_mode":
-        if (v === "test" || v === "live") out[field] = v;
-        break;
-      case "command":
-        if (typeof v === "string") out[field] = COMMAND.test(v) ? v : UNKNOWN_COMMAND;
-        break;
-      default:
-        if (typeof v === "string") out[field] = auditText(v, field === "ts" ? 40 : 80);
-    }
-  }
-  return `${JSON.stringify(out)}
-`;
-}
-function auditSettingsFromEnv(env = process.env, warn = stderrWarn) {
-  const off = ["off", "0", "false", "no"].includes((env[AUDIT_SWITCH_ENV] ?? "").trim().toLowerCase());
-  const raw = (env[AUDIT_RETENTION_ENV] ?? "").trim();
-  let retentionDays = DEFAULT_RETENTION_DAYS;
-  if (raw !== "") {
-    const n = Number(raw);
-    if (/^[0-9]{1,3}$/.test(raw) && n >= 1 && n <= 365) retentionDays = n;
-    else warn(`[vonpay] ${AUDIT_RETENTION_ENV} must be a whole number from 1 to 365; keeping audit files ${DEFAULT_RETENTION_DAYS} days.`);
-  }
-  const dir = env[AUDIT_DIR_ENV]?.trim() ? resolve(env[AUDIT_DIR_ENV].trim()) : join(homedir(), ".vonpay", "audit");
-  return { dir: off ? null : dir, retentionDays };
-}
-function stderrWarn(m) {
-  try {
-    process.stderr.write(`${m}
-`);
-  } catch (err) {
-    void err;
-  }
-}
-function errorCodeOf(err) {
-  return err !== null && typeof err === "object" && typeof err.code === "string" ? err.code : "error";
-}
-var AuditPlaceRefused = class extends Error {
-  constructor(code) {
-    super(code);
-    this.code = code;
-  }
-  code;
-};
-function myUid() {
-  return typeof process.getuid === "function" ? process.getuid() : void 0;
-}
+var FORMAT = auditLineFormat({ nameField: "command", namePattern: /^[a-z0-9-]+( [a-z0-9-]+){0,3}$/, unknownName: UNKNOWN_COMMAND });
+var AUDIT_FIELDS = FORMAT.fields;
+var auditLine = FORMAT.line;
+var fullRecordLine = FORMAT.fullRecordLine;
 function checkDir(dir, st) {
-  if (st.isSymbolicLink()) throw new AuditPlaceRefused("directory_is_a_symlink");
-  if (!st.isDirectory()) throw new AuditPlaceRefused("not_a_directory");
-  const uid = myUid();
-  if (uid !== void 0 && st.uid !== uid) throw new AuditPlaceRefused("directory_owned_by_another_user");
-  if (uid !== void 0 && (st.mode & 63) !== 0) chmodSync(dir, 448);
+  if (checkAuditDirStats(st)) chmodSync(dir, 448);
 }
 var FILE_NAME = /^cli-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
-var appendFlags = () => FS.O_APPEND | FS.O_CREAT | FS.O_WRONLY | (FS.O_NOFOLLOW ?? 0);
 var warned = false;
 var warnedFull = false;
+var warnedReserve = false;
+var warnedTooLong = false;
+function _resetAuditWarningsForTests() {
+  warned = false;
+  warnedFull = false;
+  warnedReserve = false;
+  warnedTooLong = false;
+}
 function warnOnce(dir, err, warn) {
   if (warned) return;
   warned = true;
   warn(
-    `[vonpay] The local audit log cannot be written (${errorCodeOf(err)}) in ${dir}; the command went on without it. Set ${AUDIT_DIR_ENV} to a writable directory of your own, or ${AUDIT_SWITCH_ENV}=off.`
+    `[vonpay] The local audit log cannot be written (${auditErrorCodeOf(err)}) in ${dir}; the command went on without it. Set ${AUDIT_DIR_ENV} to a writable directory of your own, or ${AUDIT_SWITCH_ENV}=off.`
   );
 }
 function pruneAuditFiles(dir, retentionDays, now = /* @__PURE__ */ new Date(), warn = stderrWarn) {
@@ -251,17 +143,15 @@ function pruneAuditFiles(dir, retentionDays, now = /* @__PURE__ */ new Date(), w
     checkDir(dir, lstatSync(dir));
     names = readdirSync(dir);
   } catch (err) {
-    if (errorCodeOf(err) !== "ENOENT") warnOnce(dir, err, warn);
+    if (auditErrorCodeOf(err) !== "ENOENT") warnOnce(dir, err, warn);
     return 0;
   }
-  const today = Date.parse(`${now.toISOString().slice(0, 10)}T00:00:00Z`);
   let removed = 0;
   let skipped = 0;
   for (const name of names) {
     const m = FILE_NAME.exec(name);
     if (!m) continue;
-    const day = Date.parse(`${m[1]}-${m[2]}-${m[3]}T00:00:00Z`);
-    if (!Number.isFinite(day) || (today - day) / 864e5 <= retentionDays) continue;
+    if (!auditFileExpired(`${m[1]}-${m[2]}-${m[3]}`, now, retentionDays)) continue;
     const path = join(dir, name);
     try {
       if (!lstatSync(path).isFile()) {
@@ -274,42 +164,60 @@ function pruneAuditFiles(dir, retentionDays, now = /* @__PURE__ */ new Date(), w
       skipped++;
     }
   }
-  if (skipped > 0) warn(`[vonpay] ${skipped} old audit file(s) in ${dir} were not deleted (not a regular file, or could not be removed).`);
+  if (skipped > 0) warn(auditSpaceWarnings.notPruned(skipped, dir));
   return removed;
 }
-function appendSecure(file, line, maxBytes, dir, warn) {
-  const fd = openSync(file, appendFlags(), 384);
+function endsWithFullRecord(fd, size) {
+  const n = Buffer.byteLength(FULL_RECORD_SUFFIX);
+  if (size < n) return false;
+  const buf = Buffer.alloc(n);
+  readSync(fd, buf, 0, n, size - n);
+  return buf.toString("utf8") === FULL_RECORD_SUFFIX;
+}
+function appendSecure(file, line, reserved, record, now, limits, dir, warn) {
+  const fd = openSync(file, auditAppendFlags(), 384);
   try {
     const st = fstatSync(fd);
-    if (!st.isFile()) throw new AuditPlaceRefused("not_a_regular_file");
-    const uid = myUid();
-    if (uid !== void 0 && st.uid !== uid) throw new AuditPlaceRefused("file_owned_by_another_user");
-    if (uid !== void 0 && (st.mode & 63) !== 0) fchmodSync(fd, 384);
-    if (st.size + Buffer.byteLength(line) > maxBytes) {
+    if (checkAuditFileStats(st)) fchmodSync(fd, 384);
+    const decision = spaceDecision(st.size, Buffer.byteLength(line), reserved, limits);
+    if (decision === "write") {
+      writeSync(fd, line);
+    } else if (decision === "too_long") {
+      if (!warnedTooLong) {
+        warnedTooLong = true;
+        warn(auditSpaceWarnings.tooLong(limits.maxLineBytes, dir));
+      }
+    } else if (decision === "drop") {
+      if (!warnedReserve) {
+        warnedReserve = true;
+        warn(auditSpaceWarnings.nearlyFull(dir));
+      }
+    } else {
+      const full = fullRecordLine(record.surface, record.version, now);
+      if (!endsWithFullRecord(fd, st.size) && st.size + Buffer.byteLength(full) <= limits.maxFileBytes) writeSync(fd, full);
       if (!warnedFull) {
         warnedFull = true;
-        warn(`[vonpay] Today's audit file in ${dir} is full; no more lines are written to it today.`);
+        warn(auditSpaceWarnings.full(dir));
       }
-      return;
     }
-    writeSync(fd, line);
   } finally {
     closeSync(fd);
   }
 }
-function writeAuditLine(dir, record, now = /* @__PURE__ */ new Date(), warn = stderrWarn, maxBytes = MAX_FILE_BYTES) {
+function writeAuditLine(dir, record, now = /* @__PURE__ */ new Date(), warn = stderrWarn, limits = DEFAULT_AUDIT_LIMITS) {
   const file = join(dir, `cli-${now.toISOString().slice(0, 10)}.jsonl`);
   try {
     const line = auditLine(record);
+    const reserved = isReservedLine(record, typeof record.command === "string" && isMoneyCommand(record.command));
     const attempt = () => {
       mkdirSync(dir, { recursive: true, mode: 448 });
       checkDir(dir, lstatSync(dir));
-      appendSecure(file, line, maxBytes, dir, warn);
+      appendSecure(file, line, reserved, record, now, limits, dir, warn);
     };
     try {
       attempt();
     } catch (err) {
-      if (errorCodeOf(err) !== "ENOENT") throw err;
+      if (auditErrorCodeOf(err) !== "ENOENT") throw err;
       attempt();
     }
     return true;
@@ -335,6 +243,8 @@ var COMMAND_KIND = {
   "checkout refunds create": "api",
   "checkout refunds list": "api",
   "checkout tokens create": "api",
+  "checkout subscription-products list": "api",
+  "checkout subscription-products terms": "api",
   "checkout capabilities": "api",
   "checkout listen": "api",
   "checkout health": "api",
@@ -347,6 +257,9 @@ var MONEY = {
   "checkout refunds create": (o) => ({ amount: wholeNumber(o.amount), currency: o.currency, target: o.paymentIntent ?? o.transaction }),
   "checkout sessions create": (o) => ({ amount: wholeNumber(o.amount), currency: o.currency })
 };
+function isMoneyCommand(command) {
+  return Object.prototype.hasOwnProperty.call(MONEY, command);
+}
 function wholeNumber(v) {
   return typeof v === "string" && /^[0-9]{1,15}$/.test(v.trim()) ? Number(v.trim()) : typeof v === "number" ? v : void 0;
 }
@@ -354,9 +267,6 @@ var pending = null;
 var hooked = false;
 var SIGNAL_EXIT = { SIGINT: 130, SIGTERM: 143 };
 var processHandlers = [];
-function keyFields(apiKey) {
-  return apiKey ? { key_mode: apiKey.startsWith("vp_sk_test_") ? "test" : "live", key_fingerprint: keyFingerprint(apiKey) } : {};
-}
 var signalsHandledByCommand = false;
 function auditSignalHandledByCommand() {
   signalsHandledByCommand = true;
@@ -387,13 +297,13 @@ function auditStart(command, version, opts = {}, args = []) {
     return;
   }
   pruneAuditFiles(settings.dir, settings.retentionDays);
-  let money = {};
+  let money2 = {};
   try {
-    money = Object.prototype.hasOwnProperty.call(MONEY, command) ? MONEY[command](opts, args) : {};
+    money2 = Object.prototype.hasOwnProperty.call(MONEY, command) ? MONEY[command](opts, args) : {};
   } catch {
-    money = {};
+    money2 = {};
   }
-  pending = { command, money, settings, version, intentWritten: false, written: false };
+  pending = { command, money: money2, settings, version, intentWritten: false, written: false };
   if (typeof opts.apiKey === "string") pending.apiKey = opts.apiKey;
   hookProcess();
 }
@@ -415,7 +325,7 @@ function auditIntent(now = /* @__PURE__ */ new Date()) {
   const p = pending;
   if (!p || p.intentWritten || p.settings.dir === null || !Object.prototype.hasOwnProperty.call(MONEY, p.command)) return;
   p.intentWritten = true;
-  writeAuditLine(p.settings.dir, { command: p.command, ts: now.toISOString(), surface: "cli", version: p.version, ...keyFields(p.apiKey), outcome: "pending", ...p.money }, now);
+  writeAuditLine(p.settings.dir, { command: p.command, ts: now.toISOString(), surface: "cli", version: p.version, ...auditKeyFields(p.apiKey), outcome: "pending", ...p.money }, now);
 }
 function auditFinish(exitCode, now = /* @__PURE__ */ new Date()) {
   const p = pending;
@@ -438,7 +348,7 @@ function auditFinish(exitCode, now = /* @__PURE__ */ new Date()) {
         ts: now.toISOString(),
         surface: "cli",
         version: p.version,
-        ...keyFields(p.apiKey),
+        ...auditKeyFields(p.apiKey),
         outcome,
         ...code ? { error_code: code } : {},
         ...p.requestId ? { request_id: p.requestId } : {},
@@ -484,9 +394,15 @@ function auditUsageError(command, version, commanderCode, exitCode, now = /* @__
     void err;
   }
 }
+function _resetAuditForTests() {
+  pending = null;
+  for (const [event, h] of processHandlers.splice(0)) process.removeListener(event, h);
+  hooked = false;
+  signalsHandledByCommand = false;
+}
 
 // src/config.ts
-var CONFIG_DIR = join2(homedir2(), ".vonpay");
+var CONFIG_DIR = join2(homedir(), ".vonpay");
 var CONFIG_FILE = join2(CONFIG_DIR, "config.json");
 function loadConfig() {
   if (!existsSync(CONFIG_FILE)) return {};
@@ -582,10 +498,10 @@ function evaluateKeyToSave(key) {
 }
 function readLine(prompt) {
   const rl = createInterface({ input: process.stdin, output: process.stderr });
-  return new Promise((resolve3) => {
+  return new Promise((resolve2) => {
     rl.question(prompt, (answer) => {
       rl.close();
-      resolve3(answer.trim());
+      resolve2(answer.trim());
     });
   });
 }
@@ -659,7 +575,7 @@ function logoutCommand() {
 // src/commands/init.ts
 import { Command as Command3 } from "commander";
 import { appendFileSync, chmodSync as chmodSync3, existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { resolve as resolve2 } from "path";
+import { resolve } from "path";
 import chalk3 from "chalk";
 var LIVE_KEY_NOT_WRITTEN_MESSAGE = "Refusing to write a live key (vp_sk_live_\u2026) to .env: live keys are never written to disk. Run `init` with a sandbox key (vp_sk_test_\u2026), and give your app its live key through your deployment's secret store or the environment when you go live.";
 function ensureGitignoreBlocksEnv() {
@@ -710,7 +626,7 @@ function initCommand() {
       process.exit(1);
     }
     const envFile = ".env";
-    const absPath = resolve2(envFile);
+    const absPath = resolve(envFile);
     if (existsSync2(envFile) && !opts.force) {
       console.error(
         chalk3.yellow(
@@ -846,13 +762,14 @@ function scrubSecrets(s) {
 }
 
 // src/utils/sanitize.ts
-import { stripHiddenCharacters as stripHiddenCharacters2 } from "@vonpay/checkout-node";
+import { stripHiddenCharacters } from "@vonpay/checkout-node";
 var ANSI_PATTERN = /\x1B\[[0-9;?]*[A-Za-z]/g;
 var C1_CSI_PATTERN = /\u{9B}[0-9;?]*[A-Za-z]/gu;
 var CONTROL_PATTERN = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F\u{80}-\u{9F}]/gu;
 var LINE_SEPARATOR_PATTERN = /[\u{2028}\u{2029}]/gu;
+var PLAIN_TEXT_PATTERN = /^[\x20-\x7e]*$/;
 function stripAnsi(s) {
-  return stripHiddenCharacters2(s.replace(ANSI_PATTERN, "").replace(C1_CSI_PATTERN, "").replace(CONTROL_PATTERN, ""));
+  return stripHiddenCharacters(s.replace(ANSI_PATTERN, "").replace(C1_CSI_PATTERN, "").replace(CONTROL_PATTERN, ""));
 }
 function truncate(s, max) {
   if (s.length <= max) return s;
@@ -864,13 +781,50 @@ function safeDisplay(s, max = 200) {
 function safeInline(s, max = 200) {
   return safeDisplay(s.replace(/[\r\n]+/g, " ").replace(LINE_SEPARATOR_PATTERN, " "), max);
 }
+var READ_SECRET_PATTERNS = SECRET_PATTERNS.map(
+  ([re, replacement]) => [new RegExp(`(?<![A-Za-z0-9])(?:${re.source})`, re.flags), replacement]
+);
+function redactSecretShapes(s) {
+  let out = s;
+  for (const [re, replacement] of READ_SECRET_PATTERNS) out = out.replace(re, replacement);
+  return out;
+}
+function uniqueKey(cleaned, taken) {
+  let key = cleaned;
+  for (let n = 2; taken.has(key); n++) key = `${cleaned}#${n}`;
+  taken.add(key);
+  return key;
+}
+function cleanJsonValue(value, options = {}) {
+  const { lines = "keep", maxChars = Number.MAX_SAFE_INTEGER, redact = redactSecretShapes, exactKeys } = options;
+  const text = (s) => {
+    if (PLAIN_TEXT_PATTERN.test(s)) return truncate(s, maxChars);
+    return lines === "join" ? safeInline(s, maxChars) : truncate(stripAnsi(s.replace(LINE_SEPARATOR_PATTERN, " ")), maxChars);
+  };
+  const walk = (v, exact) => {
+    if (typeof v === "string") return exact ? text(v) : redact(text(v));
+    if (v === null || typeof v !== "object") return v;
+    const toJSON = v.toJSON;
+    if (typeof toJSON === "function") return walk(toJSON.call(v), exact);
+    if (Array.isArray(v)) return v.map((item) => walk(item, exact));
+    const taken = /* @__PURE__ */ new Set();
+    return Object.fromEntries(
+      Object.entries(v).map(([k, item]) => [uniqueKey(text(k), taken), walk(item, exact || exactKeys?.has(k) === true)])
+    );
+  };
+  return walk(value, false);
+}
+function jsonOutput(value, options) {
+  return JSON.stringify(cleanJsonValue(value, options), null, 2);
+}
 
 // src/utils/errors.ts
 var CLI_READ_BACK = "From this CLI: `vonpay checkout payment-intents get <id>` (charge, capture, void), `vonpay checkout refunds list --payment-intent <id>` or `--transaction <id>` (refund), `sessions get <id>` (checkout session).";
 var READ_BACK_FIRST = "Check the payment first: read it back (`vonpay checkout payment-intents get <id>` for a charge, capture or void; `vonpay checkout refunds list --payment-intent <id>` (or `--transaction <id>`) for a refund; `sessions get <id>` for a checkout session) and act only on what it shows.";
 var UNKNOWN_OUTCOME_GUIDANCE = `${READ_BACK_FIRST} If you then retry, reuse the SAME --idempotency-key as the first attempt, never a new one: a new key is a new action and can move money twice.`;
 var str = (v) => v === void 0 || v === null ? null : String(v);
-var oneLine = (s) => safeInline(s, 2e3);
+var ONE_LINE_MAX_CHARS = 2e3;
+var oneLine = (s) => safeInline(s, ONE_LINE_MAX_CHARS);
 function paramFlagHint(param) {
   const flag = param.startsWith("metadata") ? "--metadata" : `--${param.replace(/\[(gte|lt)\]$/, "-$1").replace(/_/g, "-")}`;
   return /^--[a-z-]+$/.test(flag) ? ` (the ${flag} flag)` : "";
@@ -970,16 +924,7 @@ function errorDetailLines(err) {
   }
   return lines;
 }
-function scrubDeep(value) {
-  if (typeof value === "string") return scrubSecrets(oneLine(value));
-  if (Array.isArray(value)) return value.map(scrubDeep);
-  if (value !== null && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) out[k] = scrubDeep(v);
-    return out;
-  }
-  return value;
-}
+var ERROR_JSON_CLEANING = { lines: "join", maxChars: ONE_LINE_MAX_CHARS, redact: scrubSecrets };
 function errorJson(err) {
   if (err instanceof VonPayError) {
     const out = { error: err.message };
@@ -988,14 +933,14 @@ function errorJson(err) {
       const value = source[field];
       if (value !== void 0) out[field] = value;
     }
-    return scrubDeep(out);
+    return cleanJsonValue(out, ERROR_JSON_CLEANING);
   }
   const message = err instanceof Error ? err.message : String(err);
   return { error: scrubSecrets(oneLine(message)), code: null };
 }
 function exitWithCliError(message, text) {
   auditNote({ outcome: "refused_local", code: "local_refusal" }, true);
-  return emitCliError({ error: scrubSecrets(message), code: null }, text);
+  return emitCliError({ error: cleanJsonValue(message, ERROR_JSON_CLEANING), code: null }, text);
 }
 function handleError(err) {
   auditError(err);
@@ -1074,7 +1019,7 @@ function makeCheckoutClient() {
 import { createInterface as createInterface2 } from "readline";
 import chalk5 from "chalk";
 import { Option as Option2 } from "commander";
-import { isLiveKey as isLiveKey2 } from "@vonpay/checkout-node";
+import { heldAsLive, isLiveKey } from "@vonpay/checkout-node";
 var CONFIRM_WORD = "confirm";
 var terminal = {
   /**
@@ -1086,27 +1031,27 @@ var terminal = {
   },
   /** Ask one line on the terminal. End of input or Ctrl-C answers "" (cancel). */
   ask(prompt) {
-    return new Promise((resolve3) => {
+    return new Promise((resolve2) => {
       const rl = createInterface2({ input: process.stdin, output: process.stdout });
       let answered = false;
       rl.on("SIGINT", () => rl.close());
       rl.on("close", () => {
-        if (!answered) resolve3("");
+        if (!answered) resolve2("");
       });
       rl.question(prompt, (answer) => {
         answered = true;
         rl.close();
-        resolve3(answer);
+        resolve2(answer);
       });
     });
   }
 };
-function keyFingerprint2(key) {
+function keyFingerprint(key) {
   const m = key.match(/^(vp_sk_live_)([A-Za-z0-9_-]{0,4})/);
   return m ? `${m[1]}${m[2]}\u2026` : "a key that is not a sandbox key";
 }
 async function confirmLiveAction(key, summary, opts = {}) {
-  if (!requiresLiveConfirmation(key)) return;
+  if (!heldAsLive(key)) return;
   if (!terminal.isInteractive()) {
     const message = `Refusing to ${summary.action} with a live key: no person is at an interactive terminal to confirm it. A live-key action must be confirmed by a person typing at a terminal (stdin and stdout both a terminal); scripts, CI jobs and AI agents cannot confirm it, and --confirm-live is no longer enough. Use a sandbox key (vp_sk_test_\u2026) for automation, or run the command yourself in a terminal. Nothing was sent.`;
     auditNote({ outcome: "withheld", code: "no_terminal" });
@@ -1120,7 +1065,7 @@ async function confirmLiveAction(key, summary, opts = {}) {
     );
   }
   const lines = [
-    chalk5.bold.red(`You are about to ${summary.action} with a LIVE key (${keyFingerprint2(key)}).`),
+    chalk5.bold.red(`You are about to ${summary.action} with a LIVE key (${keyFingerprint(key)}).`),
     // At least one space after the label, however long it is.
     ...(summary.details ?? []).map(([label, value]) => `  ${`${label}:`.padEnd(Math.max(17, label.length + 2))}${safeInline(value)}`),
     chalk5.yellow(summary.consequence ?? "This moves real money and cannot be undone from here.")
@@ -1141,7 +1086,7 @@ function retiredConfirmLiveOption() {
   ).hideHelp();
 }
 function warnLiveSecretFlag(key, flag) {
-  if (!requiresLiveConfirmation(key)) return;
+  if (!heldAsLive(key)) return;
   console.warn(
     chalk5.yellow(
       `Warning: passing ${flag} as a command argument with a live key exposes it to shell history and process-list (\`ps\`). Consider piping or env-injecting the value instead.`
@@ -1162,6 +1107,11 @@ function parseMinorUnits(raw, flag) {
   }
   return { ok: true, value };
 }
+function positiveWholeNumber(raw, flag) {
+  const parsed = parseMinorUnits(raw, flag);
+  if (!parsed.ok || parsed.value < 1) throw new Error(`${flag} must be a whole number of at least 1; got ${JSON.stringify(raw)}.`);
+  return parsed.value;
+}
 function minorUnitsOrExit(raw, flag) {
   const parsed = parseMinorUnits(raw, flag);
   if (!parsed.ok) exitWithCliError(parsed.message, `Error: ${parsed.message}`);
@@ -1172,9 +1122,7 @@ function optionalMinorUnitsOrExit(raw, flag) {
 }
 
 // src/utils/mask-secrets.ts
-function maskSecretsInJson(json) {
-  return scrubSecrets(json);
-}
+var SHOW_SECRETS_CLEANING = { exactKeys: /* @__PURE__ */ new Set(["clientSecret"]) };
 var SHOW_SECRETS_HELP = "With --json, print the session's client secret in full. \u26A0 The output then contains a secret: do not paste it or let it reach a log";
 function withClientSecret(session) {
   if (session === null || typeof session !== "object" || Array.isArray(session)) return session;
@@ -1182,9 +1130,9 @@ function withClientSecret(session) {
   return { ...session, clientSecret: session.clientSecret };
 }
 function sessionJson(session, showSecrets) {
-  const json = JSON.stringify(withClientSecret(session), null, 2);
-  if (json === void 0) return String(json);
-  return showSecrets === true ? json : maskSecretsInJson(json);
+  const body = cleanJsonValue(withClientSecret(session), showSecrets === true ? SHOW_SECRETS_CLEANING : {});
+  const json = JSON.stringify(body, null, 2);
+  return json === void 0 ? String(json) : json;
 }
 
 // src/commands/sessions.ts
@@ -1284,7 +1232,7 @@ function sessionsCommand() {
         const result = await client.sessions.validate(params);
         spinner.stop();
         if (opts.json) {
-          console.log(JSON.stringify(result, null, 2));
+          console.log(jsonOutput(result));
         } else if (result.valid) {
           console.log(chalk6.green("\u2713 Valid request"));
           if (result.warnings.length > 0) {
@@ -1342,6 +1290,7 @@ import { formatMinorUnits as formatMinorUnits3 } from "@vonpay/checkout-node";
 // src/utils/idempotency.ts
 import { randomUUID } from "crypto";
 import chalk7 from "chalk";
+import { heldAsLive as heldAsLive2 } from "@vonpay/checkout-node";
 function resolveIdempotencyKey(flag) {
   const given = flag?.trim();
   if (given) return { key: given, generated: false };
@@ -1349,7 +1298,7 @@ function resolveIdempotencyKey(flag) {
 }
 function idempotencyKeyFor(flag, what, apiKey) {
   const { key, generated } = resolveIdempotencyKey(flag);
-  if (generated && apiKey !== void 0 && requiresLiveConfirmation(apiKey)) {
+  if (generated && apiKey !== void 0 && heldAsLive2(apiKey)) {
     const message = `Refusing to send this ${what} with a live key without --idempotency-key. Choose one key for this ${what} (for example your order id plus the action, such as "order_1042:${what}") and pass the SAME key if you ever run the command again: a new key is a new action and can move money twice. Nothing was sent.`;
     auditNote({ outcome: "refused_local", code: "idempotency_key_required" });
     exitWithCliError(message, chalk7.red(message));
@@ -1465,11 +1414,6 @@ function buildFilters(opts) {
   }
   return filters;
 }
-function wholeNumber2(raw, flag) {
-  const parsed = parseMinorUnits(raw, flag);
-  if (!parsed.ok || parsed.value < 1) throw new Error(`${flag} must be a whole number of at least 1; got ${JSON.stringify(raw)}.`);
-  return parsed.value;
-}
 var PAYMENT_LIST_JSON_FIELDS = [
   "id",
   "status",
@@ -1492,17 +1436,20 @@ function listItemJson(pi, includeMetadata) {
   const src = pi;
   return Object.fromEntries(PAYMENT_LIST_JSON_FIELDS.filter((k) => src[k] !== void 0).map((k) => [k, src[k]]));
 }
-var ALL_JSON_DEFAULT_MAX_ITEMS = 1e4;
+var ALL_DEFAULT_MAX_ITEMS = 1e4;
+function stoppedAtDefaultCap() {
+  return `Stopped at ${ALL_DEFAULT_MAX_ITEMS} payments (the --all default); there may be more. Pass --max-items to read more, or narrow the window.`;
+}
 function buildListParams(opts) {
   const params = buildFilters(opts);
   if (opts.status !== void 0) {
     params.status = parseListFlag(opts.status, "--status", { lowercase: true });
   }
-  if (opts.limit !== void 0) params.limit = wholeNumber2(opts.limit, "--limit");
+  if (opts.limit !== void 0) params.limit = positiveWholeNumber(opts.limit, "--limit");
   if (opts.startingAfter !== void 0) params.startingAfter = opts.startingAfter;
   if (opts.maxItems !== void 0 && !opts.all) throw new Error("--max-items is used with --all.");
   if (opts.includeMetadata && !opts.json) throw new Error("--include-metadata is used with --json.");
-  const maxItems = opts.maxItems !== void 0 ? wholeNumber2(opts.maxItems, "--max-items") : opts.all && opts.json ? ALL_JSON_DEFAULT_MAX_ITEMS : void 0;
+  const maxItems = opts.maxItems !== void 0 ? positiveWholeNumber(opts.maxItems, "--max-items") : opts.all ? ALL_DEFAULT_MAX_ITEMS : void 0;
   return { params, ...maxItems !== void 0 ? { maxItems } : {} };
 }
 function buildSummaryParams(opts) {
@@ -1587,7 +1534,10 @@ function addPaymentReportCommands(intents) {
   ).option("--status <list>", "Only these statuses, comma-separated (e.g. failed,succeeded)").option("--limit <n>", "Page size, up to 100 per page (default 25; larger values are treated as 100)").option(
     "--starting-after <cursor>",
     "The next-page cursor printed by a previous run, unchanged, with exactly the same filters and window (it lasts 24 hours)"
-  ).option("--all", "Read every page, one request at a time (text: printed as each payment arrives)").option("--max-items <n>", `With --all: stop after this many payments (with --json, default ${ALL_JSON_DEFAULT_MAX_ITEMS})`).option(
+  ).option(
+    "--all",
+    `Read every page, one request at a time, up to ${ALL_DEFAULT_MAX_ITEMS} payments unless --max-items says otherwise (text: printed as each payment arrives)`
+  ).option("--max-items <n>", `With --all: stop after this many payments (default ${ALL_DEFAULT_MAX_ITEMS})`).option(
     "--json",
     "Output JSON: each payment's status, outcome, amount, card, store and decline fields \u2014 not your metadata (with --all: one JSON array)"
   ).option("--include-metadata", "With --json: print every field of each payment, your metadata included").action(async (opts) => {
@@ -1609,12 +1559,8 @@ function addPaymentReportCommands(intents) {
           const items = [];
           for await (const pi of pager) items.push(listItemJson(pi, opts.includeMetadata));
           spinner.stop();
-          console.log(JSON.stringify(items, null, 2));
-          if (opts.maxItems === void 0 && items.length >= ALL_JSON_DEFAULT_MAX_ITEMS) {
-            console.error(
-              `Stopped at ${ALL_JSON_DEFAULT_MAX_ITEMS} payments (the --all --json default). Pass --max-items to read more, or narrow the window.`
-            );
-          }
+          console.log(jsonOutput(items));
+          if (opts.maxItems === void 0 && items.length >= ALL_DEFAULT_MAX_ITEMS) console.error(stoppedAtDefaultCap());
           return;
         }
         let count = 0;
@@ -1626,12 +1572,13 @@ function addPaymentReportCommands(intents) {
         spinner.stop();
         if (count === 0) console.log("  No payments match.");
         console.log(`  ${count} payment(s).`);
+        if (opts.maxItems === void 0 && count >= ALL_DEFAULT_MAX_ITEMS) console.error(stoppedAtDefaultCap());
         return;
       }
       const page = await client.paymentIntents.list(built.params);
       spinner.stop();
       if (opts.json) {
-        console.log(JSON.stringify({ ...page, data: page.data.map((pi) => listItemJson(pi, opts.includeMetadata)) }, null, 2));
+        console.log(jsonOutput({ ...page, data: page.data.map((pi) => listItemJson(pi, opts.includeMetadata)) }));
         return;
       }
       for (const line of paymentListLines(page)) console.log(line);
@@ -1660,7 +1607,7 @@ function addPaymentReportCommands(intents) {
       const summary = await client.paymentIntents.summary(params);
       spinner.stop();
       if (opts.json) {
-        console.log(JSON.stringify(summary, null, 2));
+        console.log(jsonOutput(summary));
         return;
       }
       for (const line of summaryLines(summary)) console.log(line);
@@ -1849,7 +1796,7 @@ function paymentIntentsCommand() {
       });
       spinner.stop();
       if (opts.json) {
-        console.log(JSON.stringify(intent, null, 2));
+        console.log(jsonOutput(intent));
       } else {
         console.log(chalk9.green("\u2713 Payment intent created"));
         printPaymentIntent(intent);
@@ -1868,7 +1815,7 @@ function paymentIntentsCommand() {
       const intent = await client.paymentIntents.retrieve(id);
       spinner.stop();
       if (opts.json) {
-        console.log(JSON.stringify(intent, null, 2));
+        console.log(jsonOutput(intent));
       } else {
         printPaymentIntent(intent);
       }
@@ -1918,7 +1865,7 @@ function paymentIntentsCommand() {
         );
         spinner.stop();
         if (opts.json) {
-          console.log(JSON.stringify(intent, null, 2));
+          console.log(jsonOutput(intent));
         } else {
           const captureLabel = amountToCapture !== void 0 ? ` (partial: ${formatMinorUnits3(amountToCapture, intent.currency)})` : "";
           console.log(chalk9.green(`\u2713 Payment intent captured${captureLabel}`));
@@ -1957,7 +1904,7 @@ function paymentIntentsCommand() {
         const intent = await client.paymentIntents.void(id, { idempotencyKey });
         spinner.stop();
         if (opts.json) {
-          console.log(JSON.stringify(intent, null, 2));
+          console.log(jsonOutput(intent));
         } else {
           console.log(chalk9.green("\u2713 Payment intent voided"));
           printPaymentIntent(intent);
@@ -1975,7 +1922,7 @@ function paymentIntentsCommand() {
 // src/commands/refunds.ts
 import { Command as Command6 } from "commander";
 import chalk10 from "chalk";
-import { formatMinorUnits as formatMinorUnits4, VonPayError as VonPayError2 } from "@vonpay/checkout-node";
+import { formatMinorUnits as formatMinorUnits4, heldAsLive as heldAsLive3, VonPayError as VonPayError2 } from "@vonpay/checkout-node";
 function present(v) {
   return v !== void 0 && v.trim() !== "";
 }
@@ -2137,11 +2084,11 @@ function refundsCommand() {
       handleError(err);
     }
     const target = resolveRefundTarget(opts);
-    const sessionProblem = refundSessionProblem(target, opts.sessionId, requiresLiveConfirmation(apiKey));
+    const sessionProblem = refundSessionProblem(target, opts.sessionId, heldAsLive3(apiKey));
     if (sessionProblem) exitWithCliError(sessionProblem, chalk10.red(sessionProblem));
     refuseUnsafeLiveDestination(apiKey);
     const idempotencyKey = idempotencyKeyFor(opts.idempotencyKey, "refund", apiKey);
-    const lookedUp = requiresLiveConfirmation(apiKey) && terminal.isInteractive() ? await refundLookupDetails(makeCheckoutClient(), target, opts.sessionId?.trim(), params.amount, params.currency) : [];
+    const lookedUp = heldAsLive3(apiKey) && terminal.isInteractive() ? await refundLookupDetails(makeCheckoutClient(), target, opts.sessionId?.trim(), params.amount, params.currency) : [];
     await confirmLiveAction(
       apiKey,
       {
@@ -2166,7 +2113,7 @@ function refundsCommand() {
       const refund = await client.refunds.create(params, { idempotencyKey });
       spinner.stop();
       if (opts.json) {
-        console.log(JSON.stringify(refund, null, 2));
+        console.log(jsonOutput(refund));
       } else {
         console.log(chalk10.green("\u2713 Refund created"));
         printRefund(refund);
@@ -2178,7 +2125,7 @@ function refundsCommand() {
   });
   refunds.command("list").description(
     "List the refunds of ONE payment and its refund totals \u2014 the way to check a refund whose outcome was unclear"
-  ).option("--payment-intent <id>", "The payment's payment intent ID (vpi_*). Use this OR --transaction").option("--transaction <id>", "The payment's transaction ID (vp_tx_*), instead of --payment-intent").option("--limit <n>", "How many refunds to show (default 25, at most 100)").option("--starting-after <cursor>", "The next-page cursor printed by a previous run").option("--json", "Output raw JSON").action(
+  ).option("--payment-intent <id>", "The payment's payment intent ID (vpi_*). Use this OR --transaction").option("--transaction <id>", "The payment's transaction ID (vp_tx_*), instead of --payment-intent").option("--limit <n>", "How many refunds to show (default 25; the API allows at most 100)").option("--starting-after <cursor>", "The next-page cursor printed by a previous run").option("--json", "Output raw JSON").action(
     async (opts) => {
       let target;
       try {
@@ -2189,12 +2136,12 @@ function refundsCommand() {
       }
       let limit;
       if (opts.limit !== void 0) {
-        const parsed = parseMinorUnits(opts.limit, "--limit");
-        if (!parsed.ok || parsed.value < 1) {
-          const message = `--limit must be a whole number from 1 to 100; got ${JSON.stringify(opts.limit)}.`;
+        try {
+          limit = positiveWholeNumber(opts.limit, "--limit");
+        } catch (err) {
+          const message = err.message;
           exitWithCliError(message, chalk10.red(`Error: ${message}`));
         }
-        limit = parsed.value;
       }
       const client = makeCheckoutClient();
       const spinner = startSpinner("Listing refunds...");
@@ -2205,7 +2152,7 @@ function refundsCommand() {
         });
         spinner.stop();
         if (opts.json) {
-          console.log(JSON.stringify(list, null, 2));
+          console.log(jsonOutput(list));
           return;
         }
         for (const line of refundListLines(list)) console.log(line);
@@ -2219,10 +2166,10 @@ function refundsCommand() {
 }
 function refundListLines(list) {
   const currency = list.data[0]?.currency;
-  const money = (n) => currency ? formatMinorUnits4(n, currency) : `${n} in minor units`;
+  const money2 = (n) => currency ? formatMinorUnits4(n, currency) : `${n} in minor units`;
   const lines = [
-    `  Refunded so far:  ${money(list.amountRefunded)} (succeeded + still in progress)`,
-    `  Still refundable: ${money(list.remainingRefundable)}${list.refundable ? "" : " \u2014 this payment cannot be refunded now"}`
+    `  Refunded so far:  ${money2(list.amountRefunded)} (succeeded + still in progress)`,
+    `  Still refundable: ${money2(list.remainingRefundable)}${list.refundable ? "" : " \u2014 this payment cannot be refunded now"}`
   ];
   if (list.data.length === 0) {
     lines.push("  No refunds on this payment.");
@@ -2292,7 +2239,7 @@ function tokensCommand() {
         );
         spinner.stop();
         if (opts.json) {
-          console.log(JSON.stringify(token, null, 2));
+          console.log(jsonOutput(token));
         } else {
           console.log(chalk11.green("\u2713 Token created"));
           printToken(token);
@@ -2311,35 +2258,166 @@ function formatTokenCard(card) {
   return { card: cardLine, expires };
 }
 
-// src/commands/capabilities.ts
+// src/commands/subscription-products.ts
 import { Command as Command8 } from "commander";
 import chalk12 from "chalk";
+import { formatMinorUnits as formatMinorUnits5 } from "@vonpay/checkout-node";
+var STATUSES = ["active", "archived"];
+function buildListParams2(opts) {
+  const params = {};
+  if (opts.productRef !== void 0) params.productRef = opts.productRef;
+  if (opts.status !== void 0) {
+    const status = opts.status.trim().toLowerCase();
+    if (!STATUSES.includes(status)) {
+      throw new Error(`--status must be active or archived; got ${JSON.stringify(opts.status)}.`);
+    }
+    params.status = status;
+  }
+  if (opts.limit !== void 0) params.limit = positiveWholeNumber(opts.limit, "--limit");
+  if (opts.startingAfter !== void 0) params.startingAfter = opts.startingAfter;
+  return params;
+}
+function buildTermsParams(opts) {
+  if (opts.amount === void 0) return void 0;
+  const parsed = parseMinorUnits(opts.amount, "--amount");
+  if (!parsed.ok) throw new Error(parsed.message);
+  if (parsed.value < 1) throw new Error(`--amount must be at least 1 (minor units); got ${JSON.stringify(opts.amount)}.`);
+  return { amount: parsed.value };
+}
+var LEGAL_TEXT_MAX_CHARS = 500;
+var CUT_MARK = "\u2026 [CUT: not the full text; use --json to read all of it]";
+function legalText(raw) {
+  const clean = safeInline(raw, Number.MAX_SAFE_INTEGER);
+  return clean.length > LEGAL_TEXT_MAX_CHARS ? { text: `${clean.slice(0, LEGAL_TEXT_MAX_CHARS)}${CUT_MARK}`, cut: true } : { text: clean, cut: false };
+}
+function money(amount, currency) {
+  if (typeof amount !== "number") return "?";
+  return currency ? safeInline(formatMinorUnits5(amount, currency)) : `${amount} in minor units`;
+}
+function every(count, interval) {
+  if (!interval) return "";
+  const unit = safeInline(interval);
+  return typeof count === "number" && count !== 1 ? `every ${count} ${unit}s` : `every ${unit}`;
+}
+function statusTone2(status) {
+  return status === "active" ? chalk12.green(status) : chalk12.yellow(status);
+}
+function productLines(p) {
+  const head = `  ${safeInline(p.id)}  ${statusTone2(safeInline(p.status))}  ${safeInline(p.name, 120)}  (ref ${safeInline(p.productRef, 128)})`;
+  const schedule = p.interval ? `first payment ${money(p.firstPrice, p.currency)}, then ${money(p.renewalPrice, p.currency)} ${every(p.intervalCount, p.interval)}` : `${money(p.renewalPrice, p.currency)} \u2014 no renewal schedule yet (it cannot start a subscription)`;
+  const lines = [head, `    ${schedule}`];
+  const terms = p.terms;
+  if (terms && typeof terms.disclosure === "string") lines.push(`    Disclosure: ${legalText(terms.disclosure).text}`);
+  return lines;
+}
+function productListLines(page) {
+  const lines = [];
+  if (page.data.length === 0) lines.push("  No subscription products match.");
+  for (const p of page.data) lines.push(...productLines(p));
+  if (page.hasMore && page.nextCursor) {
+    lines.push(`  More: re-run with the same filters and --starting-after ${safeInline(page.nextCursor)}`);
+  }
+  return lines;
+}
+function termsLines(t) {
+  const disclosure = legalText(t.disclosure);
+  const phrase = legalText(t.pricePhrase);
+  return [
+    `  Product:       ${safeInline(t.product)} (ref ${safeInline(t.productRef, 128)})`,
+    `  Disclosure:    ${disclosure.text}`,
+    `  Price phrase:  ${phrase.text}`,
+    `  First payment: ${money(t.firstAmount, t.currency)}`,
+    `  Renewal:       ${money(t.amount, t.currency)} ${every(t.intervalCount, t.interval)}`,
+    `  Terms version: ${safeInline(t.termsVersion)}`,
+    disclosure.cut || phrase.cut ? "  The text above was cut. Read all of it with --json before you show it next to the order button." : "  Show the disclosure, or your own words containing the price phrase, with your business name and how to cancel."
+  ];
+}
+function exitOnBadFlag2(err) {
+  const message = err.message;
+  exitWithCliError(message, chalk12.red(`Error: ${message}`));
+}
+function subscriptionProductsCommand() {
+  const products = new Command8("subscription-products").description(
+    "Read your subscription products and the renewal terms a sign-up states (read-only; products are created and changed in the dashboard)"
+  );
+  products.command("list").description("List your subscription products, newest first, each with the terms a sign-up on it states").option("--product-ref <ref>", "Only the product with this reference (your store's product number), matched exactly").option("--status <status>", "Only products with this status: active or archived").option("--limit <n>", "Page size, 1 to 100 (default 10)").option("--starting-after <id>", "The id of the last product on the previous page (printed by a previous run)").option("--json", "Output raw JSON").action(async (opts) => {
+    let params;
+    try {
+      params = buildListParams2(opts);
+    } catch (err) {
+      exitOnBadFlag2(err);
+    }
+    const client = makeCheckoutClient();
+    const spinner = startSpinner("Listing subscription products...");
+    try {
+      const page = await client.subscriptionProducts.list(params);
+      spinner.stop();
+      if (opts.json) {
+        console.log(jsonOutput(page));
+        return;
+      }
+      for (const line of productListLines(page)) console.log(line);
+    } catch (err) {
+      spinner.stop();
+      handleError(err);
+    }
+  });
+  products.command("terms <product>").description(
+    "Read one subscription product's renewal terms, to show next to the order button before the sign-up charge. <product> is the product's id (vsprod_*) or its reference"
+  ).option("--amount <minor>", "An intro first payment in minor units (e.g. 100 = 1.00 USD), at or below the product's price").option("--json", "Output raw JSON").action(async (product, opts) => {
+    let params;
+    try {
+      params = buildTermsParams(opts);
+    } catch (err) {
+      exitOnBadFlag2(err);
+    }
+    const client = makeCheckoutClient();
+    const spinner = startSpinner("Reading subscription product terms...");
+    try {
+      const terms = await client.subscriptionProducts.terms(product, params);
+      spinner.stop();
+      if (opts.json) {
+        console.log(jsonOutput(terms));
+        return;
+      }
+      for (const line of termsLines(terms)) console.log(line);
+    } catch (err) {
+      spinner.stop();
+      handleError(err);
+    }
+  });
+  return products;
+}
+
+// src/commands/capabilities.ts
+import { Command as Command9 } from "commander";
+import chalk13 from "chalk";
 function fmtBool(v) {
-  return v ? chalk12.green("yes") : chalk12.dim("no");
+  return v ? chalk13.green("yes") : chalk13.dim("no");
 }
 function fmtVoidPolicy(v) {
   switch (v) {
     case "supported":
-      return chalk12.green(v);
+      return chalk13.green(v);
     case "rerouted_to_refund":
-      return chalk12.yellow(v);
+      return chalk13.yellow(v);
     case "not_supported":
-      return chalk12.dim(v);
+      return chalk13.dim(v);
     default:
-      return chalk12.dim(String(v));
+      return chalk13.dim(String(v));
   }
 }
 function fmtDisputeReporting(v) {
-  return v === "tracked" ? chalk12.green(v) : chalk12.yellow(v);
+  return v === "tracked" ? chalk13.green(v) : chalk13.yellow(v);
 }
 function fmtSubscriptionBilling(v) {
-  if (v === true) return chalk12.yellow("yes");
-  if (v === false) return chalk12.green("no");
-  return chalk12.yellow("unknown");
+  if (v === true) return chalk13.yellow("yes");
+  if (v === false) return chalk13.green("no");
+  return chalk13.yellow("unknown");
 }
 function printCapabilities(caps) {
   const ops = caps.supportedOperations;
-  console.log(chalk12.bold("Supported operations"));
+  console.log(chalk13.bold("Supported operations"));
   console.log(`  auth/capture separation:  ${fmtBool(ops.authCaptureSeparation)}`);
   console.log(`  partial capture:          ${fmtBool(ops.partialCapture)}`);
   console.log(`  partial refund:           ${fmtBool(ops.partialRefund)}`);
@@ -2354,17 +2432,17 @@ function printCapabilities(caps) {
   console.log();
   if (ops.disputeReporting !== "tracked") {
     console.log(
-      chalk12.yellow(
+      chalk13.yellow(
         "  \u26A0 Chargebacks on this connection do NOT reach Von Payments.\n    A `succeeded` payment is not evidence it was never disputed.\n    Monitor and answer disputes in your processor's own dashboard \u2014\n    they carry a deadline we cannot see or report."
       )
     );
     console.log();
   }
-  console.log(chalk12.bold("Subscription billing"));
+  console.log(chalk13.bold("Subscription billing"));
   console.log(`  Von Pay renews for you:   ${fmtSubscriptionBilling(caps.subscriptionBilling?.enabled)}`);
   if (caps.subscriptionBilling?.enabled !== false) {
     console.log(
-      chalk12.yellow(
+      chalk13.yellow(
         `  \u26A0 Do not run renewals from your own system while this is not "no":
     Von Pay may be charging these customers' renewals itself, and both
     would charge them. Check again at the moment you renew.`
@@ -2372,25 +2450,25 @@ function printCapabilities(caps) {
     );
   }
   console.log();
-  console.log(chalk12.bold("Settlement currencies"));
+  console.log(chalk13.bold("Settlement currencies"));
   console.log(
-    `  ${caps.settlementCurrencies.length ? caps.settlementCurrencies.join(", ") : chalk12.dim("(none reported)")}`
+    `  ${caps.settlementCurrencies.length ? caps.settlementCurrencies.join(", ") : chalk13.dim("(none reported)")}`
   );
   console.log();
-  console.log(chalk12.bold("Rate limits"));
+  console.log(chalk13.bold("Rate limits"));
   console.log(
     `  payment intents / minute: ${caps.rateLimits.paymentIntentsPerMinute}`
   );
 }
 function capabilitiesCommand() {
-  return new Command8("capabilities").description("Show what this merchant's binder supports").option("--json", "Output raw JSON").action(async (opts) => {
+  return new Command9("capabilities").description("Show what this merchant's binder supports").option("--json", "Output raw JSON").action(async (opts) => {
     const client = makeCheckoutClient();
     const spinner = startSpinner("Fetching capabilities...");
     try {
       const caps = await client.capabilities.get();
       spinner.stop();
       if (opts.json) {
-        console.log(JSON.stringify(caps, null, 2));
+        console.log(jsonOutput(caps));
       } else {
         printCapabilities(caps);
       }
@@ -2402,9 +2480,9 @@ function capabilitiesCommand() {
 }
 
 // src/commands/trigger.ts
-import { Command as Command9 } from "commander";
+import { Command as Command10 } from "commander";
 import { createHmac as createHmac2, randomUUID as randomUUID2 } from "crypto";
-import chalk13 from "chalk";
+import chalk14 from "chalk";
 import ora2 from "ora";
 
 // src/utils/signing-secret.ts
@@ -2622,7 +2700,7 @@ function warnIfUnsubscribable(event, write = (m) => console.warn(m)) {
   if (!UNSUBSCRIBABLE_EVENTS.includes(event)) return false;
   const suggestion = event === "session.succeeded" ? "charge.succeeded" : "charge.failed";
   write(
-    chalk13.yellow(
+    chalk14.yellow(
       `\u26A0  ${event} is emitted internally but is NOT subscribable.
    The subscription API accepts the key, stores nothing and returns success, so a
    real endpoint receives this event NEVER \u2014 a handler tested only against it is
@@ -2817,7 +2895,7 @@ function buildPayload(event, opts) {
   };
 }
 function triggerCommand() {
-  return new Command9("trigger").description("Send a test webhook event to a local URL").argument("<event>", `Event type (${SUPPORTED_EVENTS.join(", ")})`).requiredOption("--url <url>", "Local webhook URL (e.g. http://localhost:3000/webhooks)").option("--session-id <id>", "Custom session ID").option("--amount <cents>", "Amount in minor units, a whole number").option("--currency <code>", "Currency code").option(
+  return new Command10("trigger").description("Send a test webhook event to a local URL").argument("<event>", `Event type (${SUPPORTED_EVENTS.join(", ")})`).requiredOption("--url <url>", "Local webhook URL (e.g. http://localhost:3000/webhooks)").option("--session-id <id>", "Custom session ID").option("--amount <cents>", "Amount in minor units, a whole number").option("--currency <code>", "Currency code").option(
     "--url-tunnel",
     "Allow a non-loopback --url (ngrok / Cloudflare Tunnel). Without it, --url must be this machine"
   ).option(
@@ -2826,7 +2904,7 @@ function triggerCommand() {
   ).addOption(retiredConfirmLiveOption()).action(async (event, opts) => {
     if (!SUPPORTED_EVENTS.includes(event)) {
       console.error(
-        chalk13.red(
+        chalk14.red(
           `Unknown event: ${event}
 Supported: ${SUPPORTED_EVENTS.join(", ")}`
         )
@@ -2840,10 +2918,10 @@ Supported: ${SUPPORTED_EVENTS.join(", ")}`
       tunnelFlag: "--url-tunnel"
     });
     if (!destination.ok) {
-      console.error(chalk13.red(destination.reason));
+      console.error(chalk14.red(destination.reason));
       process.exit(1);
     }
-    if (destination.warning) console.warn(chalk13.yellow(destination.warning));
+    if (destination.warning) console.warn(chalk14.yellow(destination.warning));
     const amount = optionalMinorUnitsOrExit(
       opts.amount === void 0 ? void 0 : String(opts.amount),
       "--amount"
@@ -2851,7 +2929,7 @@ Supported: ${SUPPORTED_EVENTS.join(", ")}`
     const apiKey = requireApiKey();
     const signing = resolveSigningSecret(opts.signingSecret, process.env, apiKey);
     if ("error" in signing) {
-      console.error(chalk13.red(signing.error));
+      console.error(chalk14.red(signing.error));
       process.exit(1);
     }
     await confirmLiveAction(
@@ -2868,7 +2946,7 @@ Supported: ${SUPPORTED_EVENTS.join(", ")}`
     );
     const payload = buildPayload(event, { ...opts, amount });
     const body = JSON.stringify(payload);
-    console.log(chalk13.dim(signingSecretNotice(signing)));
+    console.log(chalk14.dim(signingSecretNotice(signing)));
     const t = Math.floor(Date.now() / 1e3);
     const v1 = createHmac2("sha256", signing.secret).update(`${t}.${body}`).digest("hex");
     const signatureHeader = `t=${t},v1=${v1}`;
@@ -2890,45 +2968,45 @@ Supported: ${SUPPORTED_EVENTS.join(", ")}`
       spinner.stop();
       if (isRedirect(response)) {
         console.error(
-          chalk13.red(
+          chalk14.red(
             `\u2717 ${event} not delivered: ${safeDisplay(String(opts.url))} answered with a redirect (HTTP ${response.status}). It was not followed, and the signed event was not sent anywhere else. Point --url at the endpoint itself.`
           )
         );
         process.exit(1);
       }
       if (response.ok) {
-        console.log(chalk13.green(`\u2713 ${event} delivered \u2192 ${response.status}`));
+        console.log(chalk14.green(`\u2713 ${event} delivered \u2192 ${response.status}`));
       } else {
         console.log(
-          chalk13.yellow(
+          chalk14.yellow(
             `\u26A0 ${event} delivered but got ${response.status} response`
           )
         );
       }
-      console.log(chalk13.dim(`  Event:   ${payload.id} (${payload.type})`));
+      console.log(chalk14.dim(`  Event:   ${payload.id} (${payload.type})`));
       console.log(
-        chalk13.dim(
+        chalk14.dim(
           `  Amount:  ${payload.data.amount} ${payload.data.currency}`
         )
       );
       console.log(
-        chalk13.dim(
+        chalk14.dim(
           `
   Verify with: vonpay.webhooks.constructEvent(rawBody, signatureHeader, secret)`
         )
       );
       console.log(
-        chalk13.dim(
+        chalk14.dim(
           `  ('secret' is this run's signing secret, printed above \u2014 production webhooks are signed with your endpoint's whsec_\u2026 secret, and never with your API key)`
         )
       );
     } catch (err) {
       spinner.stop();
       if (err instanceof Error && err.name === "TimeoutError") {
-        console.error(chalk13.red(`Timeout: ${opts.url} did not respond within 10s`));
+        console.error(chalk14.red(`Timeout: ${opts.url} did not respond within 10s`));
       } else {
         console.error(
-          chalk13.red(
+          chalk14.red(
             `Failed to deliver: ${err instanceof Error ? err.message : err}`
           )
         );
@@ -2939,7 +3017,7 @@ Supported: ${SUPPORTED_EVENTS.join(", ")}`
 }
 
 // src/commands/listen.ts
-import { Command as Command10 } from "commander";
+import { Command as Command11 } from "commander";
 import { VonPayCheckout as VonPayCheckout2 } from "@vonpay/checkout-node";
 
 // ../sse-parser/dist/index.js
@@ -3205,14 +3283,14 @@ var SseRedirectError = class extends Error {
   status;
 };
 function sleep(ms, signal) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve2) => {
     const timer = setTimeout(() => {
       signal.removeEventListener("abort", onAbort);
-      resolve3();
+      resolve2();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
-      resolve3();
+      resolve2();
     };
     signal.addEventListener("abort", onAbort, { once: true });
   });
@@ -3231,7 +3309,7 @@ function noop() {
 }
 
 // src/utils/listen-output.ts
-import chalk14 from "chalk";
+import chalk15 from "chalk";
 function parseAttemptPayload(data) {
   let raw;
   try {
@@ -3248,21 +3326,21 @@ function parseAttemptPayload(data) {
 }
 function formatAttemptHuman(payload, forward) {
   const ts = formatTimestamp(payload.timestamp);
-  const eventType = chalk14.cyan(safeInline(payload.event_type, 64).padEnd(24));
-  const eventId = chalk14.gray(safeInline(payload.event_id, 64).padEnd(28));
-  const attempt = chalk14.gray(`attempt ${payload.attempt}`);
-  const arrow = chalk14.gray("\u2192");
+  const eventType = chalk15.cyan(safeInline(payload.event_type, 64).padEnd(24));
+  const eventId = chalk15.gray(safeInline(payload.event_id, 64).padEnd(28));
+  const attempt = chalk15.gray(`attempt ${payload.attempt}`);
+  const arrow = chalk15.gray("\u2192");
   const upstream = formatUpstream(payload);
-  const latency = chalk14.gray(`${payload.latency_ms}ms`);
-  const liveBadge = payload.livemode ? chalk14.red(" [LIVE]") : "";
+  const latency = chalk15.gray(`${payload.latency_ms}ms`);
+  const liveBadge = payload.livemode ? chalk15.red(" [LIVE]") : "";
   let line = `[${ts}] ${eventType} ${eventId} ${attempt}  ${arrow} ${upstream}  ${latency}${liveBadge}`;
   if (forward && forward.attempted) {
-    const fwdArrow = chalk14.gray("\u2192 local");
+    const fwdArrow = chalk15.gray("\u2192 local");
     if (forward.error) {
-      line += `  ${fwdArrow} ${chalk14.red(safeInline(forward.error))}`;
+      line += `  ${fwdArrow} ${chalk15.red(safeInline(forward.error))}`;
     } else if (forward.status !== null) {
       const fwdStatus = formatStatus(forward.status);
-      const fwdLatency = chalk14.gray(`${forward.latencyMs}ms`);
+      const fwdLatency = chalk15.gray(`${forward.latencyMs}ms`);
       line += `  ${fwdArrow} ${fwdStatus} ${fwdLatency}`;
     }
   }
@@ -3288,24 +3366,27 @@ function formatAttemptJson(payload, forward) {
       error: forward.error === null ? null : safeInline(forward.error)
     };
   }
-  return JSON.stringify(body);
+  return JSON.stringify(cleanJsonValue(body));
 }
+var LIFECYCLE_EXACT_KEYS = /* @__PURE__ */ new Set(["signing_secret"]);
 function formatLifecycleHuman(message, kind) {
-  const tag = kind === "info" ? chalk14.cyan("[vonpay]") : kind === "warn" ? chalk14.yellow("[vonpay]") : chalk14.red("[vonpay]");
+  const tag = kind === "info" ? chalk15.cyan("[vonpay]") : kind === "warn" ? chalk15.yellow("[vonpay]") : chalk15.red("[vonpay]");
   return `${tag} ${message}`;
 }
 function formatLifecycleJson(kind, extra = {}) {
-  return JSON.stringify({ type: `cli.${kind}`, ...extra, timestamp: (/* @__PURE__ */ new Date()).toISOString() });
+  return JSON.stringify(
+    cleanJsonValue({ type: `cli.${kind}`, ...extra, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, { exactKeys: LIFECYCLE_EXACT_KEYS })
+  );
 }
 function formatStatus(status) {
-  if (status >= 200 && status < 300) return chalk14.green(String(status));
-  if (status >= 400 && status < 500) return chalk14.yellow(String(status));
-  if (status >= 500) return chalk14.red(String(status));
-  return chalk14.gray(String(status));
+  if (status >= 200 && status < 300) return chalk15.green(String(status));
+  if (status >= 400 && status < 500) return chalk15.yellow(String(status));
+  if (status >= 500) return chalk15.red(String(status));
+  return chalk15.gray(String(status));
 }
 function formatUpstream(payload) {
   if (payload.response_status === null) {
-    return chalk14.red("timeout");
+    return chalk15.red("timeout");
   }
   return formatStatus(payload.response_status);
 }
@@ -3320,7 +3401,7 @@ function formatTimestamp(iso) {
 
 // src/commands/listen.ts
 function listenCommand() {
-  return new Command10("listen").description(
+  return new Command11("listen").description(
     "Watch webhook delivery attempts in real time. Optionally re-forward each event to a local URL for development."
   ).option(
     "--forward-to <url>",
@@ -3568,20 +3649,20 @@ function lifecycleSeverity(kind) {
 }
 
 // src/commands/health.ts
-import { Command as Command11 } from "commander";
-import chalk15 from "chalk";
+import { Command as Command12 } from "commander";
+import chalk16 from "chalk";
 import { VonPayError as VonPayError3 } from "@vonpay/checkout-node";
 function healthCommand() {
-  return new Command11("health").description("Check checkout API health").option("--json", "Output raw JSON").action(async (opts) => {
+  return new Command12("health").description("Check checkout API health").option("--json", "Output raw JSON").action(async (opts) => {
     const client = makeCheckoutClient();
     const spinner = startSpinner("Checking API health...");
     try {
       const health = await client.health();
       spinner.stop();
       if (opts.json) {
-        console.log(JSON.stringify(health, null, 2));
+        console.log(jsonOutput(health));
       } else {
-        const statusColor = health.status === "ok" ? chalk15.green : health.status === "degraded" ? chalk15.yellow : chalk15.red;
+        const statusColor = health.status === "ok" ? chalk16.green : health.status === "degraded" ? chalk16.yellow : chalk16.red;
         console.log(`  Status:   ${statusColor(safeInline(String(health.status)))}`);
         console.log(`  Latency:  ${safeInline(String(health.latencyMs))}ms`);
         if (health.version) {
@@ -3593,11 +3674,11 @@ function healthCommand() {
       auditError(err);
       if (jsonErrorsEnabled()) handleError(err);
       if (err instanceof VonPayError3) {
-        console.error(chalk15.red(`API error: ${scrubSecrets(safeInline(err.message, 2e3))}`));
-        console.error(chalk15.dim(`  Code: ${safeInline(String(err.code))}`));
+        console.error(chalk16.red(`API error: ${scrubSecrets(safeInline(err.message, 2e3))}`));
+        console.error(chalk16.dim(`  Code: ${safeInline(String(err.code))}`));
       } else {
         console.error(
-          chalk15.red(
+          chalk16.red(
             `Cannot reach API: ${scrubSecrets(safeInline(err instanceof Error ? err.message : String(err), 2e3))}`
           )
         );
@@ -3608,10 +3689,10 @@ function healthCommand() {
 }
 
 // src/commands/doctor.ts
-import { Command as Command12 } from "commander";
-import chalk16 from "chalk";
+import { Command as Command13 } from "commander";
+import chalk17 from "chalk";
 import ora3 from "ora";
-import { homedir as homedir3 } from "os";
+import { homedir as homedir2 } from "os";
 import { existsSync as existsSync3 } from "fs";
 import {
   VonPayCheckout as VonPayCheckout3,
@@ -3627,7 +3708,7 @@ var RELEVANT_ENV_VARS = [
   "NEXT_PUBLIC_BASE_URL"
 ];
 function redactHome(p) {
-  const home = homedir3();
+  const home = homedir2();
   if (home && p.startsWith(home)) {
     return "~" + p.slice(home.length);
   }
@@ -3639,7 +3720,8 @@ function maskPrefix(key) {
   if (!m) return void 0;
   return `${m[1]}${m[3]}\u2026`;
 }
-function keyMode(key) {
+var DOCTOR_JSON_CLEANING = { exactKeys: /* @__PURE__ */ new Set(["apiKeyPrefix"]) };
+function keyMode2(key) {
   if (!key) return void 0;
   return secretKeyMode(key) ?? "not_a_secret_key";
 }
@@ -3665,10 +3747,10 @@ async function gather() {
       present: existsSync3(
         `${process.env.HOME ?? process.env.USERPROFILE ?? ""}/.vonpay/config.json`
       ),
-      keyType: config.checkout?.apiKey ? keyMode(config.checkout?.apiKey) : void 0
+      keyType: config.checkout?.apiKey ? keyMode2(config.checkout?.apiKey) : void 0
     },
     apiKeyPrefix: maskPrefix(apiKey),
-    apiKeyMode: keyMode(apiKey),
+    apiKeyMode: keyMode2(apiKey),
     health: { baseUrl, reachable: false },
     hints: []
   };
@@ -3793,47 +3875,47 @@ async function gather() {
 }
 function renderHuman(r) {
   const lines = [];
-  lines.push(chalk16.bold.blue("vonpay doctor \u2014 diagnostic report"));
-  lines.push(chalk16.dim(`generated ${r.generatedAt}`));
+  lines.push(chalk17.bold.blue("vonpay doctor \u2014 diagnostic report"));
+  lines.push(chalk17.dim(`generated ${r.generatedAt}`));
   lines.push("");
-  lines.push(chalk16.bold("Runtime"));
+  lines.push(chalk17.bold("Runtime"));
   lines.push(`  CLI:       ${r.cli.version}`);
   lines.push(`  Node:      ${r.runtime.node}`);
   lines.push(`  Platform:  ${r.runtime.platform} (${r.runtime.arch})`);
   lines.push(`  CWD:       ${r.runtime.cwd}`);
   lines.push("");
-  lines.push(chalk16.bold("API key"));
+  lines.push(chalk17.bold("API key"));
   if (r.apiKeyPrefix) {
     lines.push(`  Prefix:    ${r.apiKeyPrefix}`);
     lines.push(`  Mode:      ${r.apiKeyMode}`);
   } else {
-    lines.push(chalk16.dim("  (no key found in env or ~/.vonpay/config.json)"));
+    lines.push(chalk17.dim("  (no key found in env or ~/.vonpay/config.json)"));
   }
   lines.push("");
-  lines.push(chalk16.bold("Env vars present (names only)"));
+  lines.push(chalk17.bold("Env vars present (names only)"));
   if (r.envVarsPresent.length === 0) {
-    lines.push(chalk16.dim("  (none of the expected vonpay env vars are set)"));
+    lines.push(chalk17.dim("  (none of the expected vonpay env vars are set)"));
   } else {
     for (const n of r.envVarsPresent) lines.push(`  \u2713 ${n}`);
   }
   lines.push("");
-  lines.push(chalk16.bold("Health probe"));
+  lines.push(chalk17.bold("Health probe"));
   if (r.health.reachable) {
-    const statusColor = r.health.status === "ok" ? chalk16.green : r.health.status === "degraded" ? chalk16.yellow : chalk16.red;
-    lines.push(`  Reachable: ${chalk16.green("yes")}`);
+    const statusColor = r.health.status === "ok" ? chalk17.green : r.health.status === "degraded" ? chalk17.yellow : chalk17.red;
+    lines.push(`  Reachable: ${chalk17.green("yes")}`);
     lines.push(`  Status:    ${statusColor(r.health.status ?? "?")}`);
     lines.push(`  Latency:   ${r.health.latencyMs}ms`);
   } else {
-    lines.push(`  Reachable: ${chalk16.red("no")}`);
+    lines.push(`  Reachable: ${chalk17.red("no")}`);
     lines.push(`  Error:     ${r.health.error}`);
   }
   lines.push("");
   if (r.validateProbe) {
-    lines.push(chalk16.bold("sessions.validate probe ($14.99 USD dry-run)"));
+    lines.push(chalk17.bold("sessions.validate probe ($14.99 USD dry-run)"));
     if (r.validateProbe.ok) {
-      lines.push(`  Result:    ${chalk16.green("valid")}`);
+      lines.push(`  Result:    ${chalk17.green("valid")}`);
     } else {
-      lines.push(`  Result:    ${chalk16.red("invalid")}`);
+      lines.push(`  Result:    ${chalk17.red("invalid")}`);
       if (r.validateProbe.error) {
         lines.push(`  Code:      ${r.validateProbe.error.code}`);
         lines.push(`  Action:    ${r.validateProbe.error.nextAction}`);
@@ -3846,7 +3928,7 @@ function renderHuman(r) {
     lines.push("");
   }
   if (r.hints.length > 0) {
-    lines.push(chalk16.bold("Hints"));
+    lines.push(chalk17.bold("Hints"));
     for (const h of r.hints) lines.push(`  \u2022 ${h}`);
     lines.push("");
   }
@@ -3923,7 +4005,7 @@ function renderForLlm(r) {
   return out.join("\n");
 }
 function doctorCommand() {
-  return new Command12("doctor").description(
+  return new Command13("doctor").description(
     "Diagnose your Von Payments environment \u2014 runtime, env vars, live API probe; outputs human / JSON / LLM-readable formats"
   ).option("--json", "Output JSON (machine-parseable)").option(
     "--for-llm",
@@ -3938,7 +4020,7 @@ function doctorCommand() {
     const report = await gather();
     spinner.stop();
     if (opts.json) {
-      console.log(JSON.stringify(report, null, 2));
+      console.log(jsonOutput(report, DOCTOR_JSON_CLEANING));
     } else if (opts.forLlm) {
       console.log(renderForLlm(report));
     } else {
@@ -3960,6 +4042,7 @@ function registerCheckout(program) {
   checkout.addCommand(paymentIntentsCommand());
   checkout.addCommand(refundsCommand());
   checkout.addCommand(tokensCommand());
+  checkout.addCommand(subscriptionProductsCommand());
   checkout.addCommand(capabilitiesCommand());
   checkout.addCommand(triggerCommand());
   checkout.addCommand(listenCommand());
@@ -3974,7 +4057,7 @@ function commandPath(cmd) {
   return names.join(" ");
 }
 function buildProgram() {
-  const program = new Command13();
+  const program = new Command14();
   program.name("vonpay").description("Von Payments developer tools").version(CLI_VERSION).option(
     ALLOW_CUSTOM_BASE_URL_FLAG,
     "With VONPAY_ALLOW_CUSTOM_BASE_URL=1: send a live key to a base URL that is not a Von Payments host (a proxy you run)"