@rozoai/checkout 0.1.11 → 0.1.14

package/scripts/dist/create-order.js

@@ -6,7 +6,42 @@ const require = __rozoCreateRequire(import.meta.url);
 const __filename = __rozoFileURLToPath(import.meta.url);
 const __dirname = __rozoDirname(__filename);
 
+// scripts/src/lib/support.mjs
+var SUPPORT = Object.freeze({
+  email: "hi@rozo.ai",
+  x: "https://x.com/ROZOai",
+  discord: "https://discord.gg/EfWejgTbuU"
+});
+var SUPPORT_TEXT = `Need help? Email ${SUPPORT.email}, or reach ROZO on X ${SUPPORT.x} or Discord ${SUPPORT.discord}.`;
+var CONTACT_EMAIL_MAX_LENGTH = 254;
+var EMAIL_RE = /^[a-z0-9][^\s@]*@[^\s@.]+(\.[^\s@.]+)+$/;
+function normalizeContactEmail(raw) {
+  if (raw === void 0 || raw === null) return null;
+  if (typeof raw !== "string") return void 0;
+  const email = raw.trim().toLowerCase();
+  if (email.length === 0) return null;
+  if (email.length > CONTACT_EMAIL_MAX_LENGTH) return void 0;
+  if (/[\x00-\x1f\x7f]/.test(email) || !EMAIL_RE.test(email)) return void 0;
+  return email;
+}
+function contactEmailAttached(email, reused) {
+  return Boolean(email) && !reused;
+}
+function contactEmailFromArgs(args) {
+  if (args.email === void 0) return null;
+  const email = args.email === true ? void 0 : normalizeContactEmail(String(args.email));
+  if (email === void 0) {
+    const err = new Error(
+      "--email must be a valid email address, for example name@example.com. It is optional: leave it out to continue without one."
+    );
+    err.code = "INVALID_EMAIL";
+    throw err;
+  }
+  return email;
+}
+
 // scripts/src/lib/output.mjs
+var PUBLIC_SUPPORT_URLS = /* @__PURE__ */ new Set([SUPPORT.x, SUPPORT.discord]);
 var EXIT_OK = 0;
 var EXIT_ERROR = 1;
 var EXIT_USAGE = 2;
@@ -17,7 +52,8 @@ function redact(text) {
   s = s.replace(/\b[0-9a-fA-F]{64}\b/g, "<redacted>");
   s = s.replace(/\b[1-9A-HJ-NP-Za-km-z]{80,90}\b/g, "<redacted>");
   s = s.replace(/\[(?:\s*\d{1,3}\s*,){40,}\s*\d{1,3}\s*\]/g, "[<redacted>]");
-  s = s.replace(/\b([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([^\s"'<>]+)/g, (_m, scheme, rest) => {
+  s = s.replace(/\b([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([^\s"'<>]+)/g, (m, scheme, rest) => {
+    if (PUBLIC_SUPPORT_URLS.has(m.replace(/[.,;:!?)]+$/, ""))) return m;
     const withoutUserinfo = rest.includes("@") ? rest.slice(rest.indexOf("@") + 1) : rest;
     const host = withoutUserinfo.split(/[/?#]/)[0];
     const hadMore = withoutUserinfo.length > host.length;
@@ -193,7 +229,7 @@ async function request(method, url, { body, timeoutMs = DEFAULT_TIMEOUT_MS } = {
     }
   }
   if (!res.ok) {
-    const code = json?.code || json?.error?.code || (typeof json?.error === "string" ? null : null) || `HTTP_${res.status}`;
+    const code = json?.code || json?.error?.code || (typeof json?.error === "string" && /^[A-Z][A-Z0-9_]+$/.test(json.error) ? json.error : null) || `HTTP_${res.status}`;
     const message = json?.message || (typeof json?.error === "string" ? json.error : json?.error?.message) || `HTTP ${res.status}`;
     throw new SkillError(code, redact(String(message)), {
       httpStatus: res.status,
@@ -224,6 +260,14 @@ function postJson(url, body, opts) {
   return request("POST", url, { ...opts, body });
 }
 
+// scripts/src/lib/utm.mjs
+function normalizeUtmSource(value) {
+  if (typeof value !== "string") return null;
+  const s = value.trim().toLowerCase();
+  if (!s || s.length > 100 || !/^[a-z0-9][a-z0-9._-]*$/.test(s)) return null;
+  return s;
+}
+
 // scripts/src/lib/api.mjs
 var PKG_VERSION = (() => {
   const requireFrom = createRequire(import.meta.url);
@@ -239,18 +283,26 @@ var PKG_VERSION = (() => {
 var MPP_BASE = process.env.ROZO_CHECKOUT_MPP_BASE || "https://apiserver.mpprouter.dev/v1/services/rozo-agent-api";
 var CLIENT_LABEL = `rozo-checkout-cli/${PKG_VERSION}`;
 var ATTRIBUTION_CLIENT = `rozo-checkout-skill/${PKG_VERSION}`;
+function buildAttribution({ utmSource } = {}) {
+  const raw = utmSource !== void 0 ? utmSource : process.env.ROZO_CHECKOUT_UTM_SOURCE;
+  const utm_source = normalizeUtmSource(raw);
+  return { client: ATTRIBUTION_CLIENT, ...utm_source ? { utm_source } : {} };
+}
 var INTENTS_BASE = process.env.ROZO_CHECKOUT_INTENTS_BASE || "https://intentapiv4.rozo.ai/functions/v1/payment-api";
 async function quoteInvoice({ url, linkId }) {
   const body = url ? { url } : { payment_id: linkId };
   return postJson(`${MPP_BASE}/quote-invoice`, body);
 }
-async function createInvoice({ url, linkId, source, quoteReceipt }) {
+async function createInvoice({ url, linkId, source, quoteReceipt, utmSource, email }) {
   const body = {
     ...url ? { url } : { payment_id: linkId },
     source: { chainId: String(source.chainId), tokenSymbol: source.tokenSymbol },
     ...quoteReceipt ? { quoteReceipt } : {},
     client: CLIENT_LABEL,
-    attribution: { client: ATTRIBUTION_CLIENT }
+    attribution: buildAttribution({ utmSource }),
+    // Optional payer contact email (validated by the caller). Omitted, never
+    // sent empty, when the user gave none.
+    ...email ? { email } : {}
   };
   return postJson(`${MPP_BASE}/create-invoice`, body);
 }
@@ -1058,12 +1110,23 @@ function readState(rozoPaymentId) {
 function createOrderRecord(record) {
   return withLock(() => createOrderRecordUnlocked(record));
 }
+function mergeBitrefill(prev, next) {
+  if (!next) return prev ?? null;
+  if (!prev?.expiresAt || !next.expiresAt) return { ...next, expiresAt: next.expiresAt ?? prev?.expiresAt ?? null };
+  const a = Date.parse(prev.expiresAt);
+  const b = Date.parse(next.expiresAt);
+  return { ...next, expiresAt: Number.isFinite(a) && (!Number.isFinite(b) || a < b) ? prev.expiresAt : next.expiresAt };
+}
 function createOrderRecordUnlocked(record) {
   const { rozoPaymentId } = record;
   const existing = readState(rozoPaymentId);
   const next = {
     version: 1,
     rozoPaymentId,
+    // 'coinbase' (default, historical records) or 'bitrefill'. Drives which
+    // payability checks presend and status run.
+    provider: record.provider ?? existing?.provider ?? "coinbase",
+    bitrefill: mergeBitrefill(existing?.bitrefill, record.bitrefill),
     linkId: record.linkId,
     paymentLink: record.paymentLink ?? null,
     merchant: record.merchant ?? null,
@@ -1142,6 +1205,7 @@ async function main(argv) {
   }
   const requested = { chainId, tokenSymbol };
   const confirmed = Boolean(args.confirm);
+  const email = contactEmailFromArgs(args);
   let blacklist;
   try {
     blacklist = loadBlacklist();
@@ -1158,7 +1222,9 @@ async function main(argv) {
   const created = await createInvoice({
     url: String(url),
     source: requested,
-    quoteReceipt
+    quoteReceipt,
+    utmSource: typeof args["utm-source"] === "string" ? args["utm-source"] : void 0,
+    email
   });
   if (!created?.rozoPaymentId) {
     throw new SkillError("CREATE_FAILED", "create-invoice returned no rozoPaymentId.", {
@@ -1315,6 +1381,13 @@ async function main(argv) {
     success: true,
     step: "create-order",
     confirmed,
+    // True only when an email went out with a NEW order. A reused order keeps
+    // whatever email it was first created with (the router never rebinds), so
+    // reporting true there would be a false promise. The address itself is
+    // never echoed. Note the --confirm run always sees the order as reused;
+    // the CLI carries the first run's value forward.
+    contactEmailProvided: contactEmailAttached(email, created.reused),
+    support: SUPPORT,
     reused: Boolean(created.reused),
     reusedNote: created.reused ? `An existing unpaid order for this link was reused (${rozoPaymentId}), valid for another ${formatRemaining(expiry.msRemaining)}. Nothing new was created.` : null,
     orderCost: "Creating an order moves no money. An order you never fund simply expires and costs nothing.",

package/scripts/dist/quote.js

@@ -6,7 +6,16 @@ const require = __rozoCreateRequire(import.meta.url);
 const __filename = __rozoFileURLToPath(import.meta.url);
 const __dirname = __rozoDirname(__filename);
 
+// scripts/src/lib/support.mjs
+var SUPPORT = Object.freeze({
+  email: "hi@rozo.ai",
+  x: "https://x.com/ROZOai",
+  discord: "https://discord.gg/EfWejgTbuU"
+});
+var SUPPORT_TEXT = `Need help? Email ${SUPPORT.email}, or reach ROZO on X ${SUPPORT.x} or Discord ${SUPPORT.discord}.`;
+
 // scripts/src/lib/output.mjs
+var PUBLIC_SUPPORT_URLS = /* @__PURE__ */ new Set([SUPPORT.x, SUPPORT.discord]);
 var EXIT_OK = 0;
 var EXIT_ERROR = 1;
 var EXIT_USAGE = 2;
@@ -17,7 +26,8 @@ function redact(text) {
   s = s.replace(/\b[0-9a-fA-F]{64}\b/g, "<redacted>");
   s = s.replace(/\b[1-9A-HJ-NP-Za-km-z]{80,90}\b/g, "<redacted>");
   s = s.replace(/\[(?:\s*\d{1,3}\s*,){40,}\s*\d{1,3}\s*\]/g, "[<redacted>]");
-  s = s.replace(/\b([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([^\s"'<>]+)/g, (_m, scheme, rest) => {
+  s = s.replace(/\b([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([^\s"'<>]+)/g, (m, scheme, rest) => {
+    if (PUBLIC_SUPPORT_URLS.has(m.replace(/[.,;:!?)]+$/, ""))) return m;
     const withoutUserinfo = rest.includes("@") ? rest.slice(rest.indexOf("@") + 1) : rest;
     const host = withoutUserinfo.split(/[/?#]/)[0];
     const hadMore = withoutUserinfo.length > host.length;
@@ -173,7 +183,7 @@ async function request(method, url, { body, timeoutMs = DEFAULT_TIMEOUT_MS } = {
     }
   }
   if (!res.ok) {
-    const code = json?.code || json?.error?.code || (typeof json?.error === "string" ? null : null) || `HTTP_${res.status}`;
+    const code = json?.code || json?.error?.code || (typeof json?.error === "string" && /^[A-Z][A-Z0-9_]+$/.test(json.error) ? json.error : null) || `HTTP_${res.status}`;
     const message = json?.message || (typeof json?.error === "string" ? json.error : json?.error?.message) || `HTTP ${res.status}`;
     throw new SkillError(code, redact(String(message)), {
       httpStatus: res.status,

package/scripts/dist/send-evm.js

@@ -9972,7 +9972,16 @@ var init_call = __esm({
   }
 });
 
+// scripts/src/lib/support.mjs
+var SUPPORT = Object.freeze({
+  email: "hi@rozo.ai",
+  x: "https://x.com/ROZOai",
+  discord: "https://discord.gg/EfWejgTbuU"
+});
+var SUPPORT_TEXT = `Need help? Email ${SUPPORT.email}, or reach ROZO on X ${SUPPORT.x} or Discord ${SUPPORT.discord}.`;
+
 // scripts/src/lib/output.mjs
+var PUBLIC_SUPPORT_URLS = /* @__PURE__ */ new Set([SUPPORT.x, SUPPORT.discord]);
 var EXIT_OK = 0;
 var EXIT_ERROR = 1;
 var EXIT_UNCONFIRMED = 3;
@@ -9983,7 +9992,8 @@ function redact(text) {
   s = s.replace(/\b[0-9a-fA-F]{64}\b/g, "<redacted>");
   s = s.replace(/\b[1-9A-HJ-NP-Za-km-z]{80,90}\b/g, "<redacted>");
   s = s.replace(/\[(?:\s*\d{1,3}\s*,){40,}\s*\d{1,3}\s*\]/g, "[<redacted>]");
-  s = s.replace(/\b([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([^\s"'<>]+)/g, (_m, scheme, rest) => {
+  s = s.replace(/\b([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([^\s"'<>]+)/g, (m, scheme, rest) => {
+    if (PUBLIC_SUPPORT_URLS.has(m.replace(/[.,;:!?)]+$/, ""))) return m;
     const withoutUserinfo = rest.includes("@") ? rest.slice(rest.indexOf("@") + 1) : rest;
     const host = withoutUserinfo.split(/[/?#]/)[0];
     const hadMore = withoutUserinfo.length > host.length;
@@ -21857,7 +21867,7 @@ async function request(method, url, { body, timeoutMs = DEFAULT_TIMEOUT_MS } = {
     }
   }
   if (!res.ok) {
-    const code = json?.code || json?.error?.code || (typeof json?.error === "string" ? null : null) || `HTTP_${res.status}`;
+    const code = json?.code || json?.error?.code || (typeof json?.error === "string" && /^[A-Z][A-Z0-9_]+$/.test(json.error) ? json.error : null) || `HTTP_${res.status}`;
     const message = json?.message || (typeof json?.error === "string" ? json.error : json?.error?.message) || `HTTP ${res.status}`;
     throw new SkillError(code, redact(String(message)), {
       httpStatus: res.status,
@@ -22045,6 +22055,15 @@ function reuseGuard({ payment, requested, reused = false }) {
   }
   return { ok: true, code: null, reason: null, moneyDetected: false, evidence, deposit };
 }
+function normalizeDecimal(v) {
+  if (v === null || v === void 0) return null;
+  const s = String(v).trim();
+  if (!/^\d+(\.\d+)?$/.test(s)) return s;
+  const [w, f = ""] = s.split(".");
+  const frac = f.replace(/0+$/, "");
+  const whole = w.replace(/^0+(?=\d)/, "");
+  return frac ? `${whole}.${frac}` : whole;
+}
 function checkPayable(statusResponse, now = Date.now()) {
   const cb = statusResponse?.coinbase;
   if (!cb) {
@@ -22540,7 +22559,67 @@ function assertPaymentLimit(invoiceUsd) {
   return { usd, limitUsd: MAX_PAYMENT_USD };
 }
 
+// scripts/src/lib/bitrefill.mjs
+var BITREFILL_DESTINATION = Object.freeze({ chainId: "8453", tokenSymbol: "USDC" });
+var BITREFILL_MIN_EXPIRY_MS = 5 * 60 * 1e3;
+var BITREFILL_MIN_PAY_WINDOW_MS = 2 * 60 * 1e3;
+var BITREFILL_MAX_EXPIRY_AHEAD_MS = 30 * 60 * 1e3;
+function checkBitrefillExpiry(expiresAt, now = Date.now(), minMs = BITREFILL_MIN_PAY_WINDOW_MS) {
+  const ms = parseDeadline(expiresAt);
+  const base = { marginMs: minMs, deadlines: { invoiceMs: ms } };
+  if (ms === null) {
+    return { ...base, ok: false, code: "EXPIRY_UNPARSABLE", reason: "The Bitrefill invoice expiry is missing or unreadable.", effectiveDeadlineMs: null, msRemaining: null, msOfSlack: null };
+  }
+  const msRemaining = ms - now;
+  const out = { ...base, effectiveDeadlineMs: ms, msRemaining, msOfSlack: msRemaining - minMs };
+  if (msRemaining <= 0) return { ...out, ok: false, code: "EXPIRED", reason: "The Bitrefill invoice has expired." };
+  if (msRemaining < minMs) {
+    return {
+      ...out,
+      ok: false,
+      code: "INVOICE_EXPIRING",
+      reason: `Only ${Math.floor(msRemaining / 1e3)}s left on the Bitrefill invoice; at least ${Math.round(minMs / 6e4)} min is required. Create a fresh invoice.`
+    };
+  }
+  return { ...out, ok: true, code: null, reason: null };
+}
+var sameAddress = (a, b) => typeof a === "string" && typeof b === "string" && a.trim().toLowerCase() === b.trim().toLowerCase();
+function verifyBitrefillDestination({ requested, payment }) {
+  const dest = payment?.destination || {};
+  const drift = [];
+  if (String(dest.chainId ?? "") !== BITREFILL_DESTINATION.chainId) {
+    drift.push({ field: "destination.chainId", requested: "8453", live: dest.chainId ?? null });
+  }
+  if (String(dest.tokenSymbol ?? "").toUpperCase() !== BITREFILL_DESTINATION.tokenSymbol) {
+    drift.push({ field: "destination.tokenSymbol", requested: "USDC", live: dest.tokenSymbol ?? null });
+  }
+  if (normalizeDecimal(dest.amount) !== normalizeDecimal(requested.amount)) {
+    drift.push({ field: "destination.amount", requested: requested.amount, live: dest.amount ?? null });
+  }
+  const liveAddress = dest.receiverAddress ?? dest.address ?? null;
+  if (!sameAddress(liveAddress, requested.address)) {
+    drift.push({ field: "destination.address", requested: requested.address, live: liveAddress });
+  }
+  return drift.length ? {
+    ok: false,
+    code: "BITREFILL_ECHO_MISMATCH",
+    reason: "The live order does not deliver to the Bitrefill invoice. Refusing to continue.",
+    drift,
+    addressVerified: false
+  } : { ok: true, code: null, reason: null, drift, addressVerified: true };
+}
+
 // scripts/src/lib/presend.mjs
+function assertBitrefillLive(state, payment) {
+  if (!state.bitrefill) {
+    throw new SkillError("BITREFILL_ECHO_MISMATCH", "This Bitrefill order has no recorded invoice. Refusing to send.");
+  }
+  const dest = verifyBitrefillDestination({ requested: state.bitrefill, payment });
+  if (!dest.ok) throw new SkillError(dest.code, dest.reason, { drift: dest.drift });
+  const expiry = checkBitrefillExpiry(state.bitrefill.expiresAt, Date.now());
+  if (!expiry.ok) throw new SkillError(expiry.code, expiry.reason, expiry);
+  return expiry;
+}
 async function preflight({
   rozoPaymentId,
   expectFamily,
@@ -22626,16 +22705,22 @@ async function preflight({
   if ((source.receiverMemo ?? null) !== (state.receiverMemo ?? null)) {
     throw new SkillError("DEPOSIT_CHANGED", "The live deposit memo differs from the recorded one.");
   }
-  const statusNow = await invoiceStatus({ linkId: state.linkId });
-  const expiry = checkExpiry({
-    now: Date.now(),
-    chainId: source.chainId,
-    intentExpiresAt: payment?.expiresAt,
-    coinbaseExpiry: statusNow?.coinbase?.preApprovalExpiry
-  });
-  if (!expiry.ok) throw new SkillError(expiry.code, expiry.reason, expiry);
-  const payable = checkPayable(statusNow, Date.now());
-  if (!payable.ok) throw new SkillError(payable.code, payable.reason, payable.derived);
+  let statusNow = null;
+  let expiry;
+  if (state.provider === "bitrefill") {
+    expiry = assertBitrefillLive(state, payment);
+  } else {
+    statusNow = await invoiceStatus({ linkId: state.linkId });
+    expiry = checkExpiry({
+      now: Date.now(),
+      chainId: source.chainId,
+      intentExpiresAt: payment?.expiresAt,
+      coinbaseExpiry: statusNow?.coinbase?.preApprovalExpiry
+    });
+    if (!expiry.ok) throw new SkillError(expiry.code, expiry.reason, expiry);
+    const payable = checkPayable(statusNow, Date.now());
+    if (!payable.ok) throw new SkillError(payable.code, payable.reason, payable.derived);
+  }
   assertNotBlacklisted(
     [
       { address: source.receiverAddress, family, role: "deposit address" },
@@ -22654,7 +22739,17 @@ async function preflight({
     statusNow
   };
 }
-async function finalPayabilityCheck({ linkId, chainId, intentExpiresAt }) {
+async function finalPayabilityCheck({ linkId, chainId, intentExpiresAt, state = null, rozoPaymentId = null }) {
+  if (state?.provider === "bitrefill") {
+    const id = rozoPaymentId ?? state.rozoPaymentId;
+    const payment = await getPayment(id);
+    const guard = reuseGuard({ payment, requested: state.source });
+    if (!guard.ok) {
+      throw new SkillError(guard.code, guard.reason, { ...guard.evidence, moneyDetected: guard.moneyDetected });
+    }
+    const expiry2 = assertBitrefillLive(state, payment);
+    return { statusNow: null, payable: { ok: true }, expiry: expiry2 };
+  }
   const statusNow = await invoiceStatus({ linkId });
   const payable = checkPayable(statusNow, Date.now());
   if (!payable.ok) throw new SkillError(payable.code, payable.reason, payable.derived);
@@ -23018,7 +23113,9 @@ async function main(argv) {
   await finalPayabilityCheck({
     linkId: state.linkId,
     chainId: source.chainId,
-    intentExpiresAt: payment?.expiresAt
+    intentExpiresAt: payment?.expiresAt,
+    state,
+    rozoPaymentId
   });
   claimSend(
     rozoPaymentId,

package/scripts/dist/send-sol.js

@@ -32143,7 +32143,16 @@ Message: ${transactionMessage}.
   }
 });
 
+// scripts/src/lib/support.mjs
+var SUPPORT = Object.freeze({
+  email: "hi@rozo.ai",
+  x: "https://x.com/ROZOai",
+  discord: "https://discord.gg/EfWejgTbuU"
+});
+var SUPPORT_TEXT = `Need help? Email ${SUPPORT.email}, or reach ROZO on X ${SUPPORT.x} or Discord ${SUPPORT.discord}.`;
+
 // scripts/src/lib/output.mjs
+var PUBLIC_SUPPORT_URLS = /* @__PURE__ */ new Set([SUPPORT.x, SUPPORT.discord]);
 var EXIT_OK = 0;
 var EXIT_ERROR = 1;
 var EXIT_UNCONFIRMED = 3;
@@ -32154,7 +32163,8 @@ function redact(text) {
   s = s.replace(/\b[0-9a-fA-F]{64}\b/g, "<redacted>");
   s = s.replace(/\b[1-9A-HJ-NP-Za-km-z]{80,90}\b/g, "<redacted>");
   s = s.replace(/\[(?:\s*\d{1,3}\s*,){40,}\s*\d{1,3}\s*\]/g, "[<redacted>]");
-  s = s.replace(/\b([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([^\s"'<>]+)/g, (_m, scheme, rest) => {
+  s = s.replace(/\b([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([^\s"'<>]+)/g, (m, scheme, rest) => {
+    if (PUBLIC_SUPPORT_URLS.has(m.replace(/[.,;:!?)]+$/, ""))) return m;
     const withoutUserinfo = rest.includes("@") ? rest.slice(rest.indexOf("@") + 1) : rest;
     const host = withoutUserinfo.split(/[/?#]/)[0];
     const hadMore = withoutUserinfo.length > host.length;
@@ -33043,7 +33053,7 @@ async function request(method, url, { body, timeoutMs = DEFAULT_TIMEOUT_MS } = {
     }
   }
   if (!res.ok) {
-    const code = json?.code || json?.error?.code || (typeof json?.error === "string" ? null : null) || `HTTP_${res.status}`;
+    const code = json?.code || json?.error?.code || (typeof json?.error === "string" && /^[A-Z][A-Z0-9_]+$/.test(json.error) ? json.error : null) || `HTTP_${res.status}`;
     const message = json?.message || (typeof json?.error === "string" ? json.error : json?.error?.message) || `HTTP ${res.status}`;
     throw new SkillError(code, redact(String(message)), {
       httpStatus: res.status,
@@ -33231,6 +33241,15 @@ function reuseGuard({ payment, requested, reused = false }) {
   }
   return { ok: true, code: null, reason: null, moneyDetected: false, evidence, deposit };
 }
+function normalizeDecimal(v) {
+  if (v === null || v === void 0) return null;
+  const s = String(v).trim();
+  if (!/^\d+(\.\d+)?$/.test(s)) return s;
+  const [w, f = ""] = s.split(".");
+  const frac = f.replace(/0+$/, "");
+  const whole = w.replace(/^0+(?=\d)/, "");
+  return frac ? `${whole}.${frac}` : whole;
+}
 function checkPayable(statusResponse, now = Date.now()) {
   const cb = statusResponse?.coinbase;
   if (!cb) {
@@ -33726,7 +33745,67 @@ function assertPaymentLimit(invoiceUsd) {
   return { usd, limitUsd: MAX_PAYMENT_USD };
 }
 
+// scripts/src/lib/bitrefill.mjs
+var BITREFILL_DESTINATION = Object.freeze({ chainId: "8453", tokenSymbol: "USDC" });
+var BITREFILL_MIN_EXPIRY_MS = 5 * 60 * 1e3;
+var BITREFILL_MIN_PAY_WINDOW_MS = 2 * 60 * 1e3;
+var BITREFILL_MAX_EXPIRY_AHEAD_MS = 30 * 60 * 1e3;
+function checkBitrefillExpiry(expiresAt, now = Date.now(), minMs = BITREFILL_MIN_PAY_WINDOW_MS) {
+  const ms = parseDeadline(expiresAt);
+  const base = { marginMs: minMs, deadlines: { invoiceMs: ms } };
+  if (ms === null) {
+    return { ...base, ok: false, code: "EXPIRY_UNPARSABLE", reason: "The Bitrefill invoice expiry is missing or unreadable.", effectiveDeadlineMs: null, msRemaining: null, msOfSlack: null };
+  }
+  const msRemaining = ms - now;
+  const out = { ...base, effectiveDeadlineMs: ms, msRemaining, msOfSlack: msRemaining - minMs };
+  if (msRemaining <= 0) return { ...out, ok: false, code: "EXPIRED", reason: "The Bitrefill invoice has expired." };
+  if (msRemaining < minMs) {
+    return {
+      ...out,
+      ok: false,
+      code: "INVOICE_EXPIRING",
+      reason: `Only ${Math.floor(msRemaining / 1e3)}s left on the Bitrefill invoice; at least ${Math.round(minMs / 6e4)} min is required. Create a fresh invoice.`
+    };
+  }
+  return { ...out, ok: true, code: null, reason: null };
+}
+var sameAddress = (a, b) => typeof a === "string" && typeof b === "string" && a.trim().toLowerCase() === b.trim().toLowerCase();
+function verifyBitrefillDestination({ requested, payment }) {
+  const dest = payment?.destination || {};
+  const drift = [];
+  if (String(dest.chainId ?? "") !== BITREFILL_DESTINATION.chainId) {
+    drift.push({ field: "destination.chainId", requested: "8453", live: dest.chainId ?? null });
+  }
+  if (String(dest.tokenSymbol ?? "").toUpperCase() !== BITREFILL_DESTINATION.tokenSymbol) {
+    drift.push({ field: "destination.tokenSymbol", requested: "USDC", live: dest.tokenSymbol ?? null });
+  }
+  if (normalizeDecimal(dest.amount) !== normalizeDecimal(requested.amount)) {
+    drift.push({ field: "destination.amount", requested: requested.amount, live: dest.amount ?? null });
+  }
+  const liveAddress = dest.receiverAddress ?? dest.address ?? null;
+  if (!sameAddress(liveAddress, requested.address)) {
+    drift.push({ field: "destination.address", requested: requested.address, live: liveAddress });
+  }
+  return drift.length ? {
+    ok: false,
+    code: "BITREFILL_ECHO_MISMATCH",
+    reason: "The live order does not deliver to the Bitrefill invoice. Refusing to continue.",
+    drift,
+    addressVerified: false
+  } : { ok: true, code: null, reason: null, drift, addressVerified: true };
+}
+
 // scripts/src/lib/presend.mjs
+function assertBitrefillLive(state, payment) {
+  if (!state.bitrefill) {
+    throw new SkillError("BITREFILL_ECHO_MISMATCH", "This Bitrefill order has no recorded invoice. Refusing to send.");
+  }
+  const dest = verifyBitrefillDestination({ requested: state.bitrefill, payment });
+  if (!dest.ok) throw new SkillError(dest.code, dest.reason, { drift: dest.drift });
+  const expiry = checkBitrefillExpiry(state.bitrefill.expiresAt, Date.now());
+  if (!expiry.ok) throw new SkillError(expiry.code, expiry.reason, expiry);
+  return expiry;
+}
 async function preflight({
   rozoPaymentId,
   expectFamily,
@@ -33812,16 +33891,22 @@ async function preflight({
   if ((source.receiverMemo ?? null) !== (state.receiverMemo ?? null)) {
     throw new SkillError("DEPOSIT_CHANGED", "The live deposit memo differs from the recorded one.");
   }
-  const statusNow = await invoiceStatus({ linkId: state.linkId });
-  const expiry = checkExpiry({
-    now: Date.now(),
-    chainId: source.chainId,
-    intentExpiresAt: payment?.expiresAt,
-    coinbaseExpiry: statusNow?.coinbase?.preApprovalExpiry
-  });
-  if (!expiry.ok) throw new SkillError(expiry.code, expiry.reason, expiry);
-  const payable = checkPayable(statusNow, Date.now());
-  if (!payable.ok) throw new SkillError(payable.code, payable.reason, payable.derived);
+  let statusNow = null;
+  let expiry;
+  if (state.provider === "bitrefill") {
+    expiry = assertBitrefillLive(state, payment);
+  } else {
+    statusNow = await invoiceStatus({ linkId: state.linkId });
+    expiry = checkExpiry({
+      now: Date.now(),
+      chainId: source.chainId,
+      intentExpiresAt: payment?.expiresAt,
+      coinbaseExpiry: statusNow?.coinbase?.preApprovalExpiry
+    });
+    if (!expiry.ok) throw new SkillError(expiry.code, expiry.reason, expiry);
+    const payable = checkPayable(statusNow, Date.now());
+    if (!payable.ok) throw new SkillError(payable.code, payable.reason, payable.derived);
+  }
   assertNotBlacklisted(
     [
       { address: source.receiverAddress, family, role: "deposit address" },
@@ -33840,7 +33925,17 @@ async function preflight({
     statusNow
   };
 }
-async function finalPayabilityCheck({ linkId, chainId, intentExpiresAt }) {
+async function finalPayabilityCheck({ linkId, chainId, intentExpiresAt, state = null, rozoPaymentId = null }) {
+  if (state?.provider === "bitrefill") {
+    const id = rozoPaymentId ?? state.rozoPaymentId;
+    const payment = await getPayment(id);
+    const guard = reuseGuard({ payment, requested: state.source });
+    if (!guard.ok) {
+      throw new SkillError(guard.code, guard.reason, { ...guard.evidence, moneyDetected: guard.moneyDetected });
+    }
+    const expiry2 = assertBitrefillLive(state, payment);
+    return { statusNow: null, payable: { ok: true }, expiry: expiry2 };
+  }
   const statusNow = await invoiceStatus({ linkId });
   const payable = checkPayable(statusNow, Date.now());
   if (!payable.ok) throw new SkillError(payable.code, payable.reason, payable.derived);
@@ -34109,7 +34204,9 @@ async function main(argv) {
   await finalPayabilityCheck({
     linkId: state.linkId,
     chainId: source.chainId,
-    intentExpiresAt: payment?.expiresAt
+    intentExpiresAt: payment?.expiresAt,
+    state,
+    rozoPaymentId
   });
   claimSend(
     rozoPaymentId,