@rozoai/checkout 0.1.16 → 0.1.18

package/README.md

@@ -120,6 +120,22 @@ Distributing this CLI? `--utm-source <label>` (or `ROZO_CHECKOUT_UTM_SOURCE`) is
 
 Want ROZO to be able to reach you if a payment needs attention? Add the optional `--email you@example.com` to `pay`.
 
+### Privacy: anonymous install id
+
+Every order this CLI creates carries two optional reporting fields in
+`attribution`, so repeat orders from one install can be counted as one payer:
+
+- `install_id`: a random UUID v4 made on first run and stored in
+  `~/.rozo-checkout/prefs.json` (mode 0600). It is not derived from your
+  machine, wallet or anything else about you.
+- `account_hash`: sent only if `OPENROUTER_API_KEY` is set in your
+  environment. It is the lowercase hex sha256 of `"rozo-acct-v1:" + key`. The
+  key itself is never sent, logged or written to disk. An OpenRouter account id
+  is never used for this, because a hash of a short id could be guessed back.
+
+Delete `~/.rozo-checkout/prefs.json` to get a new id (it also forgets your last
+wallet and coin). Set `ROZO_CHECKOUT_ANON_ID=off` to send neither field.
+
 Need help? Email hi@rozo.ai, or reach us on [X](https://x.com/ROZOai) or [Discord](https://discord.gg/EfWejgTbuU).
 
 <details>
@@ -372,6 +388,14 @@ keypair or an encrypted keystore, and supports EVM chains and Solana only —
 Stellar and Lightning are Mode A only.
 </details>
 
+## Bulk and automated use
+
+Buying credits regularly, reselling them, or building an agent that tops up
+OpenRouter for its users? The [Bulk Purchases and Agents](https://docs.rozo.ai/products/checkout/bulk-and-agents)
+guide covers the CLI, the MCP server and the raw HTTP flow side by side, plus
+fees, rate limits, idempotency, error codes and what each final status means.
+The batch script below is the CLI half of it.
+
 ## Paying many invoices (batch / resellers)
 
 Each OpenRouter top-up is its own Coinbase link, so paying many is a loop: one
@@ -402,7 +426,8 @@ done < links.txt
 - `--yes` is required when stdin is not a terminal, `--json` prints exactly one
   JSON object, and `--no-watch` returns as soon as the deposit details exist.
   Without `--no-watch`, `pay --json` first waits for settlement (up to
-  `--timeout`, default 900 s) and prints nothing until then, invoice included.
+  `--timeout`, default 900 s; for Lightning, the invoice's remaining validity,
+  at most 60 minutes) and prints nothing until then, invoice included.
 - Without `--send` (the loop above), a successful `pay --no-watch` means the
   order and its deposit details exist. **No money has moved yet**, which is
   why the log says `pending`. With `--send`, the CLI may already have
@@ -441,6 +466,20 @@ flight or unknown, and 1 if the order expired unpaid or needs a human:
 rozo-checkout receipt <rozoPaymentId> --json | jq '.receipt | .paymentOutcome, .merchantSettlement.status'
 ```
 
+Closed the terminal before paying? `resume` picks the order back up without
+creating a new one:
+
+```bash
+rozo-checkout resume <rozoPaymentId>          # asks before showing the address
+rozo-checkout resume <rozoPaymentId> --yes    # non-interactive
+```
+
+If the order is still unpaid and has enough time left, it prints the hosted pay
+page and (after you confirm) the exact deposit instructions again. A paid order
+is reported as paid (exit 0); an expired one exits 1 and says how to start
+over; it refuses if this machine already recorded a send. Nothing is created or
+sent.
+
 It reports your payment, the merchant invoice and service delivery as separate
 layers. Delivery is always `unknown`: Rozo cannot see your OpenRouter credits.
 
@@ -481,7 +520,11 @@ a link again, run `status` on its `rozoPaymentId`:
 - `RATE_LIMITED`: order creation is capped per IP per hour (currently 30
   requests, and each `pay` makes two), so plan on about 15 links per hour from
   one IP. Wait for the next hour and resume with the links not yet `settled`.
-  Need more? Email us.
+  Need more? Email us. The CLI retries a 429 by itself, up to 3 times, when
+  the server's `Retry-After` (or `retryAfterSeconds`) fits in 2 minutes of
+  total waiting. A longer wait fails at once: read
+  `error.details.retryAfterSeconds`, and `error.details.rateLimit` (limit,
+  remaining, tier, scope) when the server sends it.
 
 Questions about a batch? Email hi@rozo.ai, or reach us on
 [X](https://x.com/ROZOai) or [Discord](https://discord.gg/EfWejgTbuU).
@@ -514,6 +557,12 @@ The full list of what this refuses to do, and why, is in
 
 ## Changelog
 
+- **0.1.17**: new `resume <rozoPaymentId>` command: re-shows the pay page and
+  deposit instructions for an unpaid order (read-only, same expiry, payability
+  and blacklist gates as `pay`), and answers clearly when it is already paid or
+  expired. Orders now carry an anonymous `attribution.install_id` and, when
+  `OPENROUTER_API_KEY` is set, a salted `attribution.account_hash`; see
+  Privacy. `ROZO_CHECKOUT_ANON_ID=off` sends neither.
 - **0.1.16**: new `receipt` command: one read, exit 0 only when the merchant
   side itself reports the invoice paid (Coinbase v3 `CAPTURE_SUCCEEDED`, v1 usage
   count, or the Bitrefill payout), reported as three layers

package/llms.txt

@@ -86,7 +86,8 @@ override; larger invoices go through the keyless path.
 
 Other flags: --yes (skip the interactive confirm; required when stdin is not a
 TTY), --dry-run, --json (exactly one JSON object on stdout), --no-watch,
---timeout <s>. Exit codes: 0 success, 1 refused/failed (read error.code),
+--timeout <s> (default 900; Lightning: the invoice's remaining validity, max 60
+min). Exit codes: 0 success, 1 refused/failed (read error.code),
 2 usage, 3 submitted but unconfirmed.
 
 `pay` withholds the full deposit address until you confirm, then prints it as a
@@ -176,7 +177,9 @@ private key (EVM and Solana only); every other path is keyless.
 
 409 = link already used · 410 = link expired · UNSUPPORTED_SOURCE = the response's
 "supported" object lists valid (chainId, tokenSymbol) pairs (Lightning is supported
-but omitted from that list) · RATE_LIMITED = per-IP creation cap, retry later ·
+but omitted from that list) · RATE_LIMITED = per-IP creation cap, retry later (the CLI itself retries a 429 up
+to 3 times within 2 minutes of total waiting, per Retry-After; a longer wait
+fails at once with error.details.retryAfterSeconds and rateLimit) ·
 INVALID_EMAIL = the optional email is malformed; fix it or omit it.
 
 ## Support

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rozoai/checkout",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "type": "module",
   "description": "Pay OpenRouter, or any Coinbase invoice, with the crypto you already hold: USDT/USDC on Solana, BNB Chain, Ethereum or Polygon, USDC on Base or Stellar, or BTC over Lightning. No Coinbase account.",
   "license": "MIT",