feat: complete code review fixes and LINE SDK compatibility

Major Fixes:
- Fix Express middleware creating new instance per request (performance)
- Fix OAuth error message to include API response content
- Add comprehensive tests for push.ts and multicast.ts

Code Review Improvements:
- All 3 Major issues resolved
- 67 tests passing across 10 test files
- Build successful (ESM + CJS + DTS)

LINE SDK Documentation Research:
- Verified implementation against official LINE API docs
- Add LINE API Compatibility section to README
- Document API versions: Messaging API v2, LINE Login v2.1, LIFF v2
- Document endpoint base URLs and API limits

New Files:
- packages/messaging/src/push.test.ts (6 tests)
- packages/messaging/src/multicast.test.ts (5 tests)
- packages/adapters/express/src/index.test.ts (3 tests)
- packages/liff/* (placeholder package)
- packages/messaging/src/validation.ts (message/recipient limits)
- packages/messaging/src/types.ts (Message type definitions)
- pnpm-workspace.yaml (monorepo configuration)
- tsup.config.ts files for all packages

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: kevintseng

README.md

@@ -85,6 +85,25 @@ if (login.validateState(savedState, returnedState)) {
 - **@linekit/login**: OAuth flow, ID Token verification, CSRF state helpers.
 - **@linekit/express**: Adapter for Express.js.
 
+## LINE API Compatibility
+
+This toolkit is built against the following LINE API versions:
+
+| API | Version | Reference |
+|-----|---------|-----------|
+| Messaging API | v2 | [docs](https://developers.line.biz/en/reference/messaging-api/) |
+| LINE Login | v2.1 (OAuth 2.1) | [docs](https://developers.line.biz/en/reference/line-login/) |
+| LIFF | v2 | [docs](https://developers.line.biz/en/reference/liff/) |
+
+**Endpoint Base URLs:**
+- Messaging API: `https://api.line.me/v2/bot/`
+- LINE Login: `https://api.line.me/oauth2/v2.1/`
+- Authorization: `https://access.line.me/oauth2/v2.1/`
+
+**API Limits (enforced by linekit):**
+- Maximum 5 messages per request
+- Maximum 500 recipients per multicast request
+
 ## Documentation
 
 📚 **[Full Tutorials & API Reference](https://pcircle-ai.github.io/linekit/)** - Comprehensive guides with flow diagrams

README.zh-TW.md

@@ -85,6 +85,25 @@ if (login.validateState(savedState, returnedState)) {
 - **@linekit/login**: OAuth 流程、ID Token 驗證、CSRF state 工具。
 - **@linekit/express**: Express.js 的適配器。
 
+## LINE API 相容性
+
+本工具包基於以下 LINE API 版本開發：
+
+| API | 版本 | 參考文件 |
+|-----|------|---------|
+| Messaging API | v2 | [文件](https://developers.line.biz/en/reference/messaging-api/) |
+| LINE Login | v2.1 (OAuth 2.1) | [文件](https://developers.line.biz/en/reference/line-login/) |
+| LIFF | v2 | [文件](https://developers.line.biz/en/reference/liff/) |
+
+**API 端點 Base URL：**
+- Messaging API: `https://api.line.me/v2/bot/`
+- LINE Login: `https://api.line.me/oauth2/v2.1/`
+- 授權: `https://access.line.me/oauth2/v2.1/`
+
+**API 限制（由 linekit 強制執行）：**
+- 每次請求最多 5 則訊息
+- 每次 multicast 請求最多 500 位收件人
+
 ## 文件
 
 📚 **[完整教學與 API 參考](https://pcircle-ai.github.io/linekit/index-zh.html)** - 附流程圖的詳細指南

docs/research-invoicekit.md

@@ -0,0 +1,111 @@
+# Research Report: Taiwan E-Invoice Development Kit
+
+## 1. Executive Summary
+
+The goal is to create `invoicekit`, a modern, modular, and framework-agnostic TypeScript toolkit for Taiwan Electronic Invoices (e-Invoice/eGUI), similar in philosophy to `linekit`.
+
+Currently, developers usually integrate with **Value Added Service Centers (加值中心)** like ECPay (綠界) or EZpay (簡單付) because connecting directly to the Ministry of Finance (MOF) Turnkey system is technically complex and regulated.
+
+**Opportunity**: There is no single, unified TypeScript SDK that abstracts these different providers (MOF, ECPay, EZpay) into a consistent API. Existing libraries are often outdated, provider-specific, or lack TypeScript support.
+
+## 2. The Ecosystem
+
+### A. Ministry of Finance (MOF) Platform
+
+- **Role**: The central government source.
+- **Access**:
+  - **Turnkey**: For high-volume B2B/B2C issuance. Requires strict certification and MIG 4.0 xml formats.
+  - **API (AppID)**: For querying invoice details, winning numbers, and verifying carriers (手機條碼). **Not for issuing B2C invoices** directly without a Turnkey or aggregator.
+- **Key APIs**: `getInvoiceDetail`, `getWinningNumbers`, `checkMobileBarCode`.
+
+### B. Third-Party Aggregators (Providers)
+
+- **Role**: Intermediaries that handle the Turnkey complexity. Businesses pay them a fee per invoice.
+- **Major Players**:
+  - **ECPay (綠界)**: Dominant market share. Uses AES encryption + HashKey/IV.
+  - **EZpay (簡單付)**: Another popular option.
+  - **Others**: NewebPay (藍新), LINE Pay (sometimes bundles).
+- **Mechanism**: RESTful-ish APIs (often XML or JSON with specific encryption).
+
+## 3. Proposed Architecture (`invoicekit`)
+
+Drafting a similar monorepo structure to `linekit`:
+
+```text
+packages/
+  core/             # Common types (MIG 4.0), validators, utilities
+  mof/              # Ministry of Finance Public API (Winning #, Carrier check)
+  ecpay/            # ECPay specific implementation
+  ezpay/            # EZpay specific implementation
+  universal/        # (Optional) Unified Interface for "Issuing"
+```
+
+### Module Breakdown
+
+#### 1. `@invoicekit/core`
+
+- **Validators**:
+  - Uniform Business No (統一編號) validation (Logic 8-digit check).
+  - Mobile Barcode (手機條碼) regex validation (`/^\/[0-9A-Z.+-]{7}$/`).
+  - Donate Code (愛心碼) verification.
+- **Types**:
+  - Shared interfaces for `InvoiceItem`, `Customer`, `VatType` (Taxable, Zero-tax).
+- **Utils**:
+  - Random number generators for tracking checking.
+
+#### 2. `@invoicekit/mof` (Public Data)
+
+Direct integration with `api.einvoice.nat.gov.tw`.
+
+- **Features**:
+  - `getWinningNumbers(term)`: Fetch winning lottery numbers.
+  - `verifyMobileBarcode(code)`: Check if a user's phone barcode exists.
+  - `getInvoiceDetail(...)`: Query specific invoice info (B2B mostly).
+
+#### 3. `@invoicekit/ecpay` (Issuance)
+
+Wrapper for ECPay's specific encryption/form-posting flow.
+
+- **Features**:
+  - `issue(invoiceData)`: Create a new B2C invoice.
+  - `void(invoiceNumber)`: Cancel an invoice.
+  - `allowance(invoiceNumber)`: Issue a refund/allowance.
+
+## 4. Example Usage (Concept)
+
+```typescript
+// 1. Validation (Core)
+import { validateTaxId, validateMobileBarcode } from "@invoicekit/core";
+
+if (!validateMobileBarcode("/AB12345")) {
+    throw new Error("Invalid barcode");
+}
+
+// 2. Fetching Winning Numbers (MOF)
+import { mof } from "@invoicekit/mof";
+const numbers = await mof.getWinningNumbers("11210"); // Oct 2023
+
+// 3. Issuing Invoice (ECPay Adapter)
+import { ECPayClient } from "@invoicekit/ecpay";
+
+const client = new ECPayClient({
+    merchantId: "...",
+    hashKey: "...",
+    hashIv: "..."
+});
+
+const result = await client.issue({
+    orderId: "ORD-001",
+    amount: 1000,
+    items: [{ name: "Tech Gadget", count: 1, price: 1000 }],
+    carrier: { type: "mobile", id: "/AB12345" }
+});
+```
+
+## 5. Roadmap Recommendation
+
+1. **Phase 1**: Build `@invoicekit/core` with strict validation logic (Tax ID, Barcodes) as these are universal.
+2. **Phase 2**: Build `@invoicekit/mof` to query government open data (Winning numbers are a great "Hello World").
+3. **Phase 3**: Implement `@invoicekit/ecpay` as it's the most requested feature for commercial use.
+
+This structure allows you to maintain the same "Clean, Modular, Type-Safe" philosophy as `linekit`.

package.json

@@ -1,19 +1,16 @@
 {
   "name": "linekit-monorepo",
   "private": true,
-  "workspaces": [
-    "packages/*",
-    "packages/adapters/*",
-    "examples/*"
-  ],
+  "packageManager": "pnpm@9.0.0",
   "scripts": {
-    "build": "npm run build --workspaces",
-    "test": "npm run test --workspaces",
-    "lint": "npm run lint --workspaces"
+    "build": "pnpm -r run build",
+    "test": "pnpm -r run test",
+    "lint": "pnpm -r run lint"
   },
   "devDependencies": {
     "typescript": "^5.0.0",
     "tsup": "^8.0.0",
-    "@types/node": "^18.0.0"
+    "@types/node": "^18.0.0",
+    "vitest": "^2.1.0"
   }
 }

packages/adapters/express/package.json

@@ -1,12 +1,27 @@
 {
     "name": "@linekit/express",
     "version": "0.1.0",
-    "main": "./dist/index.js",
-    "module": "./dist/index.mjs",
+    "type": "module",
+    "main": "./dist/index.cjs",
+    "module": "./dist/index.js",
     "types": "./dist/index.d.ts",
+    "exports": {
+        ".": {
+            "import": {
+                "types": "./dist/index.d.ts",
+                "default": "./dist/index.js"
+            },
+            "require": {
+                "types": "./dist/index.d.cts",
+                "default": "./dist/index.cjs"
+            }
+        }
+    },
+    "files": ["dist"],
     "scripts": {
-        "build": "npm exec tsup src/index.ts --format cjs,esm --dts",
-        "dev": "npm exec tsup src/index.ts --format cjs,esm --dts --watch"
+        "build": "tsup",
+        "dev": "tsup --watch",
+        "test": "vitest run"
     },
     "keywords": [
         "line",
@@ -23,6 +38,7 @@
     },
     "devDependencies": {
         "tsup": "^8.0.0",
-        "@types/express": "^4.0.0"
+        "@types/express": "^4.0.0",
+        "vitest": "^2.1.0"
     }
 }

packages/adapters/express/src/index.test.ts

@@ -0,0 +1,31 @@
+import { describe, it, expect, vi } from "vitest";
+import { lineMiddleware } from "./index.js";
+
+// Mock the core module
+vi.mock("@linekit/core", () => ({
+    createWebhookMiddleware: vi.fn(() => {
+        return vi.fn((_req, _res, next) => next());
+    }),
+}));
+
+describe("@linekit/express", () => {
+    it("should export lineMiddleware function", () => {
+        expect(typeof lineMiddleware).toBe("function");
+    });
+
+    it("should create middleware with channel secret config", () => {
+        const middleware = lineMiddleware({ channelSecret: "test-secret" });
+        expect(typeof middleware).toBe("function");
+    });
+
+    it("should return a function that accepts req, res, next", () => {
+        const middleware = lineMiddleware({ channelSecret: "test-secret" });
+        const req = {} as any;
+        const res = {} as any;
+        const next = vi.fn();
+
+        middleware(req, res, next);
+
+        expect(next).toHaveBeenCalled();
+    });
+});

packages/adapters/express/src/index.ts

@@ -14,13 +14,15 @@ export * from "@linekit/core";
 import { createWebhookMiddleware as coreCreateWebhookMiddleware } from "@linekit/core";
 
 export function lineMiddleware(config: { channelSecret: string }) {
+    // Create middleware instance once during initialization, not per request
+    const middleware = coreCreateWebhookMiddleware(config);
+
     // linekit core middleware signature matches (req: IncomingMessage, res: ServerResponse, next: ...)
     // Express Req/Res extend these.
     return (req: Request, res: Response, next: NextFunction) => {
         // Ensure rawBody is available if not handled by body-parser
         // If the user uses a body parser that swallows stream, core middleware might fail.
         // We can add logic here to buffer it if needed, or documentation.
-        const middleware = coreCreateWebhookMiddleware(config);
         return middleware(req, res, next);
     };
 }

packages/adapters/express/tsconfig.json

@@ -5,6 +5,12 @@
         "rootDir": "./src"
     },
     "include": [
-        "src/**/*"
+        "src/**/*.ts"
+    ],
+    "exclude": [
+        "node_modules",
+        "dist",
+        "**/*.test.ts",
+        "**/*.spec.ts"
     ]
 }

packages/adapters/express/tsup.config.ts

@@ -0,0 +1,16 @@
+import { defineConfig } from 'tsup';
+
+export default defineConfig({
+    entry: ['src/index.ts'],
+    format: ['cjs', 'esm'],
+    dts: true,
+    splitting: false,
+    clean: true,
+    treeshake: true,
+    sourcemap: true,
+    outExtension({ format }) {
+        return {
+            js: format === 'cjs' ? '.cjs' : '.js',
+        };
+    },
+});

packages/core/package.json

@@ -1,13 +1,27 @@
 {
     "name": "@linekit/core",
     "version": "0.1.0",
-    "main": "./dist/index.js",
-    "module": "./dist/index.mjs",
+    "type": "module",
+    "main": "./dist/index.cjs",
+    "module": "./dist/index.js",
     "types": "./dist/index.d.ts",
+    "exports": {
+        ".": {
+            "import": {
+                "types": "./dist/index.d.ts",
+                "default": "./dist/index.js"
+            },
+            "require": {
+                "types": "./dist/index.d.cts",
+                "default": "./dist/index.cjs"
+            }
+        }
+    },
+    "files": ["dist"],
     "scripts": {
-        "build": "npm exec tsup src/index.ts --format cjs,esm --dts",
-        "dev": "npm exec tsup src/index.ts --format cjs,esm --dts --watch",
-        "test": "npm exec vitest run"
+        "build": "tsup",
+        "dev": "tsup --watch",
+        "test": "vitest run"
     },
     "keywords": [
         "line",