@rozoai/checkout 0.1.1 → 0.1.2

package/docs/safety.md

@@ -58,9 +58,13 @@ reviewing or extending the code.
   never become a second transfer. Transactions are signed before broadcast so
   the hash is known in advance; on an ambiguous result the scripts look that
   exact transaction up instead of rebroadcasting.
-- **Hot-wallet controls.** Keys come from the environment only
-  (`ROZO_CHECKOUT_EVM_KEY`, `ROZO_CHECKOUT_SOL_KEY`), are never printed and
-  never accepted on the command line; library and RPC errors are redacted
+- **Hot-wallet controls.** A signing key is read from a local key file (a
+  solana-keygen keypair, or an encrypted V3 keystore whose passphrase is
+  prompted) or from the environment for unattended runs. A key file that is
+  readable by other users, or tracked by git, is refused — as is a `.env`
+  carrying the same settings, which is parsed as plain text and never
+  evaluated by a shell. Keys and passphrases
+  are never accepted on the command line, and are never printed; library and RPC errors are redacted
   before display, including credential-bearing provider URLs, bearer tokens and
   key-shaped strings. The scripts refuse to run when any `.env`/`.env.*` in the
   working directory is git-tracked, and refuse just as hard when git cannot

package/llms.txt

@@ -25,8 +25,38 @@ usdc-ethereum, usdt-polygon, usdc-polygon, usdc-base, usdc-stellar, btc-lightnin
 
 DEFAULT PATH NEEDS NO KEY: `pay` prints a deposit address for the user to pay from
 any wallet. No private key, no environment variable, no configuration. Only the
-optional --send flag signs locally, and only that flag reads
-ROZO_CHECKOUT_EVM_KEY / ROZO_CHECKOUT_SOL_KEY (from the environment, never argv).
+optional --send flag signs locally. Its key comes from the first source that
+exists: --keyfile <path>; then ~/.config/solana/id.json (the keypair
+solana-keygen already wrote) for Solana or ROZO_CHECKOUT_EVM_KEYSTORE (an
+encrypted V3 keystore, passphrase prompted, never argv) for EVM; then a raw key
+in ROZO_CHECKOUT_SOL_KEY / ROZO_CHECKOUT_EVM_KEY, which is the unattended-
+automation option. Those settings may also come from a .env in the working
+directory (or --env-file <path>): only ROZO_CHECKOUT_* keys are read from it, it
+is parsed as text and never shell-evaluated, and the real environment wins.
+Key files and .env must be chmod 600 and untracked by git.
+
+## Local wallet setup for --send (not needed for the default keyless path)
+
+.env keys (only ROZO_CHECKOUT_* are read; real env wins; chmod 600; gitignore):
+  ROZO_CHECKOUT_SOL_KEY               base58 string OR JSON byte array
+  ROZO_CHECKOUT_EVM_KEY               64 hex chars, 0x prefix optional
+  ROZO_CHECKOUT_EVM_KEYSTORE          path to an encrypted V3 keystore
+  ROZO_CHECKOUT_KEYSTORE_PASSPHRASE   unattended runs only; else prompted
+  ROZO_CHECKOUT_RPC_<chainId>         e.g. ROZO_CHECKOUT_RPC_8453 (Base),
+                                      ROZO_CHECKOUT_RPC_900 (Solana)
+
+Where the material comes from:
+- Solana: `solana-keygen new` -> ~/.config/solana/id.json, found automatically
+  (preferred). Phantom exports base58; Solflare exports base58 (current) or a
+  JSON byte array (older). Both accepted.
+- EVM: MetaMask/Rabby export 64 hex chars with no 0x prefix; paste as-is, the
+  prefix is optional. For an encrypted keystore, Foundry's
+  `cast wallet import <name> --interactive` writes a V3 keystore to
+  ~/.foundry/keystores/<name>; `geth account import` also writes one. Browser
+  wallets do not export keystores, only raw keys.
+- Hardware wallets, WalletConnect-only wallets and exchange accounts CANNOT be
+  used with --send. Those users take the default keyless path, which works with
+  any wallet.
 With --send, one limit applies: a single payment may not exceed $1,100, with no
 override; larger invoices go through the keyless path.
 
@@ -46,6 +76,12 @@ chainId "1" Ethereum (USDC, USDT) · "56" BNB Chain (USDC, USDT; 18-decimals) ·
 amounts in integer satoshis via source.amountUnit=="sats").
 Native SOL/ETH/BNB are NOT supported — stablecoins (or Lightning BTC) only.
 
+WALLET: one wallet on one of these chains is enough — not one per chain. Any
+wallet, or an exchange withdrawal, can fund the deposit address; nothing
+connects to a site. Stellar is the exception that must be able to set a memo,
+and Lightning pays a BOLT11 invoice rather than an address. Only --send needs a
+private key (EVM and Solana only); every other path is keyless.
+
 ## Flow (4 HTTP calls, all public)
 
 1) Quote (read-only, safe):

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rozoai/checkout",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "type": "module",
   "description": "Pay an OpenRouter Coinbase Payment Link with BTC Lightning, or USDT/USDC on Solana, BNB Chain, Ethereum, Polygon, Base or Stellar.",
   "license": "MIT",