@rozoai/checkout 0.1.17 → 0.1.19

package/scripts/dist/create-order.js

@@ -13,6 +13,8 @@ var SUPPORT = Object.freeze({
   discord: "https://discord.gg/EfWejgTbuU"
 });
 var SUPPORT_TEXT = `Need help? Email ${SUPPORT.email}, or reach ROZO on X ${SUPPORT.x} or Discord ${SUPPORT.discord}.`;
+var BULK_DOCS_URL = "https://docs.rozo.ai/products/checkout/bulk-and-agents";
+var BULK_HINT_TEXT = `Buying regularly or for others? ${BULK_DOCS_URL}`;
 var CONTACT_EMAIL_MAX_LENGTH = 254;
 var EMAIL_RE = /^[a-z0-9][^\s@]*@[^\s@.]+(\.[^\s@.]+)+$/;
 function normalizeContactEmail(raw) {
@@ -60,6 +62,7 @@ function redact(text) {
     return `${scheme}://${host}${hadMore ? "/<redacted>" : ""}`;
   });
   s = s.replace(/\b(bearer)\s+[A-Za-z0-9._~+/=-]{8,}/gi, "$1 <redacted>");
+  s = s.replace(/\bak_[A-Za-z0-9_-]{8,}/g, "ak_<redacted>");
   s = s.replace(
     /\b(api[-_]?key|apikey|access[-_]?token|auth[-_]?token|secret|token|password|passwd|pwd)\b(\s*[:=]\s*)("?)[A-Za-z0-9._~+/=-]{6,}\3/gi,
     "$1$2<redacted>"
@@ -198,18 +201,66 @@ function maskMemo(memo) {
   return `${s.slice(0, 4)}...${s.slice(-3)}`;
 }
 
-// scripts/src/lib/api.mjs
+// scripts/src/lib/version.mjs
 import { createRequire } from "node:module";
+var PKG_VERSION = (() => {
+  const requireFrom = createRequire(import.meta.url);
+  for (const candidate of ["../../package.json", "../../../package.json"]) {
+    try {
+      const pkg = requireFrom(candidate);
+      if (pkg?.name === "@rozoai/checkout" && pkg.version) return pkg.version;
+    } catch {
+    }
+  }
+  return "0.0.0";
+})();
 
 // scripts/src/lib/http.mjs
 var DEFAULT_TIMEOUT_MS = 2e4;
-var USER_AGENT = "rozo-checkout-skill/1.0";
-async function request(method, url, { body, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+var USER_AGENT = `rozo-checkout-skill/${PKG_VERSION}`;
+var MAX_RETRIES = 3;
+var MAX_TOTAL_WAIT_MS = 12e4;
+var FALLBACK_BACKOFF_MS = [2e3, 4e3, 8e3];
+var defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function parseRetryAfter(value, now = Date.now()) {
+  if (value === null || value === void 0) return null;
+  const s = String(value).trim();
+  if (!s) return null;
+  if (/^\d+(\.\d+)?$/.test(s)) return Math.round(Number(s) * 1e3);
+  const at = Date.parse(s);
+  if (!Number.isFinite(at)) return null;
+  return Math.max(0, at - now);
+}
+function bodyRetryAfterMs(json) {
+  const raw = json?.retryAfterSeconds ?? json?.error?.retryAfterSeconds;
+  if (raw === null || raw === void 0 || raw === "") return null;
+  const n = Number(raw);
+  return Number.isFinite(n) && n >= 0 ? Math.round(n * 1e3) : null;
+}
+function rateLimitInfo(res) {
+  const pick = (name) => res.headers?.get?.(name) ?? null;
+  const info = {
+    limit: pick("x-ratelimit-limit"),
+    remaining: pick("x-ratelimit-remaining"),
+    tier: pick("x-ratelimit-tier"),
+    scope: pick("x-ratelimit-scope")
+  };
+  const present = Object.fromEntries(Object.entries(info).filter(([, v]) => v !== null));
+  return Object.keys(present).length ? present : null;
+}
+function parseBody(text) {
+  if (!text) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+async function fetchOnce(method, url, body, timeoutMs) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
-  let res;
   try {
-    res = await fetch(url, {
+    const res = await fetch(url, {
       method,
       headers: {
         accept: "application/json",
@@ -219,6 +270,8 @@ async function request(method, url, { body, timeoutMs = DEFAULT_TIMEOUT_MS } = {
       body: body !== void 0 ? JSON.stringify(body) : void 0,
       signal: controller.signal
     });
+    const text = await res.text();
+    return { res, text };
   } catch (err) {
     throw new SkillError(
       err?.name === "AbortError" ? "HTTP_TIMEOUT" : "HTTP_UNREACHABLE",
@@ -228,31 +281,54 @@ async function request(method, url, { body, timeoutMs = DEFAULT_TIMEOUT_MS } = {
   } finally {
     clearTimeout(timer);
   }
-  const text = await res.text();
-  let json = null;
-  if (text) {
-    try {
-      json = JSON.parse(text);
-    } catch {
-      json = null;
+}
+async function request(method, url, {
+  body,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+  sleep = defaultSleep,
+  now = Date.now,
+  maxTotalWaitMs = MAX_TOTAL_WAIT_MS
+} = {}) {
+  let waitedMs = 0;
+  let retries = 0;
+  for (; ; ) {
+    const { res, text } = await fetchOnce(method, url, body, timeoutMs);
+    const json = parseBody(text);
+    if (res.ok) {
+      if (json === null) {
+        throw new SkillError("HTTP_BAD_JSON", "Endpoint returned a non-JSON body.", {
+          url: redactUrl(url),
+          snippet: redact(text).slice(0, 400)
+        });
+      }
+      return json;
+    }
+    const headerWaitMs = parseRetryAfter(res.headers?.get?.("retry-after"), now());
+    const hintMs = headerWaitMs ?? bodyRetryAfterMs(json);
+    const retryable = res.status === 429 || res.status === 503 && hintMs !== null;
+    if (retryable && retries < MAX_RETRIES) {
+      const waitMs = hintMs ?? FALLBACK_BACKOFF_MS[retries];
+      if (waitedMs + waitMs <= Math.min(maxTotalWaitMs, MAX_TOTAL_WAIT_MS)) {
+        retries += 1;
+        waitedMs += waitMs;
+        await sleep(waitMs);
+        continue;
+      }
     }
-  }
-  if (!res.ok) {
     const code = json?.code || json?.error?.code || (typeof json?.error === "string" && /^[A-Z][A-Z0-9_]+$/.test(json.error) ? json.error : null) || `HTTP_${res.status}`;
     const message = json?.message || (typeof json?.error === "string" ? json.error : json?.error?.message) || `HTTP ${res.status}`;
+    const rateLimit = rateLimitInfo(res);
     throw new SkillError(code, redact(String(message)), {
       httpStatus: res.status,
       url: redactUrl(url),
-      body: json ?? redact(text).slice(0, 800)
-    });
-  }
-  if (json === null) {
-    throw new SkillError("HTTP_BAD_JSON", "Endpoint returned a non-JSON body.", {
-      url: redactUrl(url),
-      snippet: redact(text).slice(0, 400)
+      body: json ?? redact(text).slice(0, 800),
+      ...retryable ? {
+        retries,
+        retryAfterSeconds: hintMs === null ? null : Math.ceil(hintMs / 1e3)
+      } : {},
+      ...rateLimit ? { rateLimit } : {}
     });
   }
-  return json;
 }
 function redactUrl(url) {
   try {
@@ -582,17 +658,6 @@ function attributionIdentity(env = process.env) {
 }
 
 // scripts/src/lib/api.mjs
-var PKG_VERSION = (() => {
-  const requireFrom = createRequire(import.meta.url);
-  for (const candidate of ["../../package.json", "../../../package.json"]) {
-    try {
-      const pkg = requireFrom(candidate);
-      if (pkg?.name === "@rozoai/checkout" && pkg.version) return pkg.version;
-    } catch {
-    }
-  }
-  return "0.0.0";
-})();
 var MPP_BASE = process.env.ROZO_CHECKOUT_MPP_BASE || "https://apiserver.mpprouter.dev/v1/services/rozo-agent-api";
 var CLIENT_LABEL = `rozo-checkout-cli/${PKG_VERSION}`;
 var ATTRIBUTION_CLIENT = `rozo-checkout-skill/${PKG_VERSION}`;
@@ -612,6 +677,7 @@ async function quoteInvoice({ url, linkId }) {
   const body = url ? { url } : { payment_id: linkId };
   return postJson(`${MPP_BASE}/quote-invoice`, body);
 }
+var QUOTE_RECEIPT_RETRY_BUDGET_MS = 2e4;
 async function createInvoice({ url, linkId, source, quoteReceipt, utmSource, email }) {
   const body = {
     ...url ? { url } : { payment_id: linkId },
@@ -623,7 +689,11 @@ async function createInvoice({ url, linkId, source, quoteReceipt, utmSource, ema
     // sent empty, when the user gave none.
     ...email ? { email } : {}
   };
-  return postJson(`${MPP_BASE}/create-invoice`, body);
+  return postJson(
+    `${MPP_BASE}/create-invoice`,
+    body,
+    quoteReceipt ? { maxTotalWaitMs: QUOTE_RECEIPT_RETRY_BUDGET_MS } : void 0
+  );
 }
 async function invoiceStatus({ linkId, rozoPaymentId }) {
   const qs = new URLSearchParams();
@@ -812,6 +882,8 @@ var MARGINS_MS = {
 };
 var BOLT11_MIN_VALIDITY_MS = 10 * MINUTE;
 var DEFAULT_MARGIN_MS = 10 * MINUTE;
+var DEFAULT_WATCH_MS = 10 * MINUTE;
+var LIGHTNING_WATCH_CAP_MS = 60 * MINUTE;
 function formatRemaining(ms) {
   if (!Number.isFinite(ms)) return "unknown";
   if (ms <= 0) return "expired";

package/scripts/dist/quote.js

@@ -13,6 +13,8 @@ var SUPPORT = Object.freeze({
   discord: "https://discord.gg/EfWejgTbuU"
 });
 var SUPPORT_TEXT = `Need help? Email ${SUPPORT.email}, or reach ROZO on X ${SUPPORT.x} or Discord ${SUPPORT.discord}.`;
+var BULK_DOCS_URL = "https://docs.rozo.ai/products/checkout/bulk-and-agents";
+var BULK_HINT_TEXT = `Buying regularly or for others? ${BULK_DOCS_URL}`;
 
 // scripts/src/lib/output.mjs
 var PUBLIC_SUPPORT_URLS = /* @__PURE__ */ new Set([SUPPORT.x, SUPPORT.discord]);
@@ -34,6 +36,7 @@ function redact(text) {
     return `${scheme}://${host}${hadMore ? "/<redacted>" : ""}`;
   });
   s = s.replace(/\b(bearer)\s+[A-Za-z0-9._~+/=-]{8,}/gi, "$1 <redacted>");
+  s = s.replace(/\bak_[A-Za-z0-9_-]{8,}/g, "ak_<redacted>");
   s = s.replace(
     /\b(api[-_]?key|apikey|access[-_]?token|auth[-_]?token|secret|token|password|passwd|pwd)\b(\s*[:=]\s*)("?)[A-Za-z0-9._~+/=-]{6,}\3/gi,
     "$1$2<redacted>"
@@ -152,18 +155,66 @@ function extractLinkId(urlOrId) {
   );
 }
 
-// scripts/src/lib/api.mjs
+// scripts/src/lib/version.mjs
 import { createRequire } from "node:module";
+var PKG_VERSION = (() => {
+  const requireFrom = createRequire(import.meta.url);
+  for (const candidate of ["../../package.json", "../../../package.json"]) {
+    try {
+      const pkg = requireFrom(candidate);
+      if (pkg?.name === "@rozoai/checkout" && pkg.version) return pkg.version;
+    } catch {
+    }
+  }
+  return "0.0.0";
+})();
 
 // scripts/src/lib/http.mjs
 var DEFAULT_TIMEOUT_MS = 2e4;
-var USER_AGENT = "rozo-checkout-skill/1.0";
-async function request(method, url, { body, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+var USER_AGENT = `rozo-checkout-skill/${PKG_VERSION}`;
+var MAX_RETRIES = 3;
+var MAX_TOTAL_WAIT_MS = 12e4;
+var FALLBACK_BACKOFF_MS = [2e3, 4e3, 8e3];
+var defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function parseRetryAfter(value, now = Date.now()) {
+  if (value === null || value === void 0) return null;
+  const s = String(value).trim();
+  if (!s) return null;
+  if (/^\d+(\.\d+)?$/.test(s)) return Math.round(Number(s) * 1e3);
+  const at = Date.parse(s);
+  if (!Number.isFinite(at)) return null;
+  return Math.max(0, at - now);
+}
+function bodyRetryAfterMs(json) {
+  const raw = json?.retryAfterSeconds ?? json?.error?.retryAfterSeconds;
+  if (raw === null || raw === void 0 || raw === "") return null;
+  const n = Number(raw);
+  return Number.isFinite(n) && n >= 0 ? Math.round(n * 1e3) : null;
+}
+function rateLimitInfo(res) {
+  const pick = (name) => res.headers?.get?.(name) ?? null;
+  const info = {
+    limit: pick("x-ratelimit-limit"),
+    remaining: pick("x-ratelimit-remaining"),
+    tier: pick("x-ratelimit-tier"),
+    scope: pick("x-ratelimit-scope")
+  };
+  const present = Object.fromEntries(Object.entries(info).filter(([, v]) => v !== null));
+  return Object.keys(present).length ? present : null;
+}
+function parseBody(text) {
+  if (!text) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+async function fetchOnce(method, url, body, timeoutMs) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
-  let res;
   try {
-    res = await fetch(url, {
+    const res = await fetch(url, {
       method,
       headers: {
         accept: "application/json",
@@ -173,6 +224,8 @@ async function request(method, url, { body, timeoutMs = DEFAULT_TIMEOUT_MS } = {
       body: body !== void 0 ? JSON.stringify(body) : void 0,
       signal: controller.signal
     });
+    const text = await res.text();
+    return { res, text };
   } catch (err) {
     throw new SkillError(
       err?.name === "AbortError" ? "HTTP_TIMEOUT" : "HTTP_UNREACHABLE",
@@ -182,31 +235,54 @@ async function request(method, url, { body, timeoutMs = DEFAULT_TIMEOUT_MS } = {
   } finally {
     clearTimeout(timer);
   }
-  const text = await res.text();
-  let json = null;
-  if (text) {
-    try {
-      json = JSON.parse(text);
-    } catch {
-      json = null;
+}
+async function request(method, url, {
+  body,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+  sleep = defaultSleep,
+  now = Date.now,
+  maxTotalWaitMs = MAX_TOTAL_WAIT_MS
+} = {}) {
+  let waitedMs = 0;
+  let retries = 0;
+  for (; ; ) {
+    const { res, text } = await fetchOnce(method, url, body, timeoutMs);
+    const json = parseBody(text);
+    if (res.ok) {
+      if (json === null) {
+        throw new SkillError("HTTP_BAD_JSON", "Endpoint returned a non-JSON body.", {
+          url: redactUrl(url),
+          snippet: redact(text).slice(0, 400)
+        });
+      }
+      return json;
+    }
+    const headerWaitMs = parseRetryAfter(res.headers?.get?.("retry-after"), now());
+    const hintMs = headerWaitMs ?? bodyRetryAfterMs(json);
+    const retryable = res.status === 429 || res.status === 503 && hintMs !== null;
+    if (retryable && retries < MAX_RETRIES) {
+      const waitMs = hintMs ?? FALLBACK_BACKOFF_MS[retries];
+      if (waitedMs + waitMs <= Math.min(maxTotalWaitMs, MAX_TOTAL_WAIT_MS)) {
+        retries += 1;
+        waitedMs += waitMs;
+        await sleep(waitMs);
+        continue;
+      }
     }
-  }
-  if (!res.ok) {
     const code = json?.code || json?.error?.code || (typeof json?.error === "string" && /^[A-Z][A-Z0-9_]+$/.test(json.error) ? json.error : null) || `HTTP_${res.status}`;
     const message = json?.message || (typeof json?.error === "string" ? json.error : json?.error?.message) || `HTTP ${res.status}`;
+    const rateLimit = rateLimitInfo(res);
     throw new SkillError(code, redact(String(message)), {
       httpStatus: res.status,
       url: redactUrl(url),
-      body: json ?? redact(text).slice(0, 800)
+      body: json ?? redact(text).slice(0, 800),
+      ...retryable ? {
+        retries,
+        retryAfterSeconds: hintMs === null ? null : Math.ceil(hintMs / 1e3)
+      } : {},
+      ...rateLimit ? { rateLimit } : {}
     });
   }
-  if (json === null) {
-    throw new SkillError("HTTP_BAD_JSON", "Endpoint returned a non-JSON body.", {
-      url: redactUrl(url),
-      snippet: redact(text).slice(0, 400)
-    });
-  }
-  return json;
 }
 function redactUrl(url) {
   try {
@@ -221,17 +297,6 @@ function postJson(url, body, opts) {
 }
 
 // scripts/src/lib/api.mjs
-var PKG_VERSION = (() => {
-  const requireFrom = createRequire(import.meta.url);
-  for (const candidate of ["../../package.json", "../../../package.json"]) {
-    try {
-      const pkg = requireFrom(candidate);
-      if (pkg?.name === "@rozoai/checkout" && pkg.version) return pkg.version;
-    } catch {
-    }
-  }
-  return "0.0.0";
-})();
 var MPP_BASE = process.env.ROZO_CHECKOUT_MPP_BASE || "https://apiserver.mpprouter.dev/v1/services/rozo-agent-api";
 var CLIENT_LABEL = `rozo-checkout-cli/${PKG_VERSION}`;
 var ATTRIBUTION_CLIENT = `rozo-checkout-skill/${PKG_VERSION}`;
@@ -300,6 +365,8 @@ var MARGINS_MS = {
 };
 var BOLT11_MIN_VALIDITY_MS = 10 * MINUTE;
 var DEFAULT_MARGIN_MS = 10 * MINUTE;
+var DEFAULT_WATCH_MS = 10 * MINUTE;
+var LIGHTNING_WATCH_CAP_MS = 60 * MINUTE;
 function parseDeadline(value) {
   if (value === null || value === void 0 || value === "") return null;
   if (typeof value === "number" && Number.isFinite(value)) {

package/scripts/dist/receipt.js

@@ -13,6 +13,8 @@ var SUPPORT = Object.freeze({
   discord: "https://discord.gg/EfWejgTbuU"
 });
 var SUPPORT_TEXT = `Need help? Email ${SUPPORT.email}, or reach ROZO on X ${SUPPORT.x} or Discord ${SUPPORT.discord}.`;
+var BULK_DOCS_URL = "https://docs.rozo.ai/products/checkout/bulk-and-agents";
+var BULK_HINT_TEXT = `Buying regularly or for others? ${BULK_DOCS_URL}`;
 
 // scripts/src/lib/output.mjs
 var PUBLIC_SUPPORT_URLS = /* @__PURE__ */ new Set([SUPPORT.x, SUPPORT.discord]);
@@ -34,6 +36,7 @@ function redact(text) {
     return `${scheme}://${host}${hadMore ? "/<redacted>" : ""}`;
   });
   s = s.replace(/\b(bearer)\s+[A-Za-z0-9._~+/=-]{8,}/gi, "$1 <redacted>");
+  s = s.replace(/\bak_[A-Za-z0-9_-]{8,}/g, "ak_<redacted>");
   s = s.replace(
     /\b(api[-_]?key|apikey|access[-_]?token|auth[-_]?token|secret|token|password|passwd|pwd)\b(\s*[:=]\s*)("?)[A-Za-z0-9._~+/=-]{6,}\3/gi,
     "$1$2<redacted>"
@@ -138,18 +141,66 @@ function maskAddress(address) {
   return `${s.slice(0, 6)}...${s.slice(-4)}`;
 }
 
-// scripts/src/lib/api.mjs
+// scripts/src/lib/version.mjs
 import { createRequire } from "node:module";
+var PKG_VERSION = (() => {
+  const requireFrom = createRequire(import.meta.url);
+  for (const candidate of ["../../package.json", "../../../package.json"]) {
+    try {
+      const pkg = requireFrom(candidate);
+      if (pkg?.name === "@rozoai/checkout" && pkg.version) return pkg.version;
+    } catch {
+    }
+  }
+  return "0.0.0";
+})();
 
 // scripts/src/lib/http.mjs
 var DEFAULT_TIMEOUT_MS = 2e4;
-var USER_AGENT = "rozo-checkout-skill/1.0";
-async function request(method, url, { body, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+var USER_AGENT = `rozo-checkout-skill/${PKG_VERSION}`;
+var MAX_RETRIES = 3;
+var MAX_TOTAL_WAIT_MS = 12e4;
+var FALLBACK_BACKOFF_MS = [2e3, 4e3, 8e3];
+var defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function parseRetryAfter(value, now = Date.now()) {
+  if (value === null || value === void 0) return null;
+  const s = String(value).trim();
+  if (!s) return null;
+  if (/^\d+(\.\d+)?$/.test(s)) return Math.round(Number(s) * 1e3);
+  const at = Date.parse(s);
+  if (!Number.isFinite(at)) return null;
+  return Math.max(0, at - now);
+}
+function bodyRetryAfterMs(json) {
+  const raw = json?.retryAfterSeconds ?? json?.error?.retryAfterSeconds;
+  if (raw === null || raw === void 0 || raw === "") return null;
+  const n = Number(raw);
+  return Number.isFinite(n) && n >= 0 ? Math.round(n * 1e3) : null;
+}
+function rateLimitInfo(res) {
+  const pick = (name) => res.headers?.get?.(name) ?? null;
+  const info = {
+    limit: pick("x-ratelimit-limit"),
+    remaining: pick("x-ratelimit-remaining"),
+    tier: pick("x-ratelimit-tier"),
+    scope: pick("x-ratelimit-scope")
+  };
+  const present = Object.fromEntries(Object.entries(info).filter(([, v]) => v !== null));
+  return Object.keys(present).length ? present : null;
+}
+function parseBody(text) {
+  if (!text) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+async function fetchOnce(method, url, body, timeoutMs) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
-  let res;
   try {
-    res = await fetch(url, {
+    const res = await fetch(url, {
       method,
       headers: {
         accept: "application/json",
@@ -159,6 +210,8 @@ async function request(method, url, { body, timeoutMs = DEFAULT_TIMEOUT_MS } = {
       body: body !== void 0 ? JSON.stringify(body) : void 0,
       signal: controller.signal
     });
+    const text = await res.text();
+    return { res, text };
   } catch (err) {
     throw new SkillError(
       err?.name === "AbortError" ? "HTTP_TIMEOUT" : "HTTP_UNREACHABLE",
@@ -168,31 +221,54 @@ async function request(method, url, { body, timeoutMs = DEFAULT_TIMEOUT_MS } = {
   } finally {
     clearTimeout(timer);
   }
-  const text = await res.text();
-  let json = null;
-  if (text) {
-    try {
-      json = JSON.parse(text);
-    } catch {
-      json = null;
+}
+async function request(method, url, {
+  body,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+  sleep = defaultSleep,
+  now = Date.now,
+  maxTotalWaitMs = MAX_TOTAL_WAIT_MS
+} = {}) {
+  let waitedMs = 0;
+  let retries = 0;
+  for (; ; ) {
+    const { res, text } = await fetchOnce(method, url, body, timeoutMs);
+    const json = parseBody(text);
+    if (res.ok) {
+      if (json === null) {
+        throw new SkillError("HTTP_BAD_JSON", "Endpoint returned a non-JSON body.", {
+          url: redactUrl(url),
+          snippet: redact(text).slice(0, 400)
+        });
+      }
+      return json;
+    }
+    const headerWaitMs = parseRetryAfter(res.headers?.get?.("retry-after"), now());
+    const hintMs = headerWaitMs ?? bodyRetryAfterMs(json);
+    const retryable = res.status === 429 || res.status === 503 && hintMs !== null;
+    if (retryable && retries < MAX_RETRIES) {
+      const waitMs = hintMs ?? FALLBACK_BACKOFF_MS[retries];
+      if (waitedMs + waitMs <= Math.min(maxTotalWaitMs, MAX_TOTAL_WAIT_MS)) {
+        retries += 1;
+        waitedMs += waitMs;
+        await sleep(waitMs);
+        continue;
+      }
     }
-  }
-  if (!res.ok) {
     const code = json?.code || json?.error?.code || (typeof json?.error === "string" && /^[A-Z][A-Z0-9_]+$/.test(json.error) ? json.error : null) || `HTTP_${res.status}`;
     const message = json?.message || (typeof json?.error === "string" ? json.error : json?.error?.message) || `HTTP ${res.status}`;
+    const rateLimit = rateLimitInfo(res);
     throw new SkillError(code, redact(String(message)), {
       httpStatus: res.status,
       url: redactUrl(url),
-      body: json ?? redact(text).slice(0, 800)
-    });
-  }
-  if (json === null) {
-    throw new SkillError("HTTP_BAD_JSON", "Endpoint returned a non-JSON body.", {
-      url: redactUrl(url),
-      snippet: redact(text).slice(0, 400)
+      body: json ?? redact(text).slice(0, 800),
+      ...retryable ? {
+        retries,
+        retryAfterSeconds: hintMs === null ? null : Math.ceil(hintMs / 1e3)
+      } : {},
+      ...rateLimit ? { rateLimit } : {}
     });
   }
-  return json;
 }
 function redactUrl(url) {
   try {
@@ -258,17 +334,6 @@ function findByLinkId(linkId) {
 }
 
 // scripts/src/lib/api.mjs
-var PKG_VERSION = (() => {
-  const requireFrom = createRequire(import.meta.url);
-  for (const candidate of ["../../package.json", "../../../package.json"]) {
-    try {
-      const pkg = requireFrom(candidate);
-      if (pkg?.name === "@rozoai/checkout" && pkg.version) return pkg.version;
-    } catch {
-    }
-  }
-  return "0.0.0";
-})();
 var MPP_BASE = process.env.ROZO_CHECKOUT_MPP_BASE || "https://apiserver.mpprouter.dev/v1/services/rozo-agent-api";
 var CLIENT_LABEL = `rozo-checkout-cli/${PKG_VERSION}`;
 var ATTRIBUTION_CLIENT = `rozo-checkout-skill/${PKG_VERSION}`;
@@ -619,6 +684,8 @@ var MARGINS_MS = {
 };
 var BOLT11_MIN_VALIDITY_MS = 10 * MINUTE;
 var DEFAULT_MARGIN_MS = 10 * MINUTE;
+var DEFAULT_WATCH_MS = 10 * MINUTE;
+var LIGHTNING_WATCH_CAP_MS = 60 * MINUTE;
 function formatRemaining(ms) {
   if (!Number.isFinite(ms)) return "unknown";
   if (ms <= 0) return "expired";