@rozoai/checkout 0.1.6 → 0.1.10

package/scripts/dist/cli.js

@@ -21270,10 +21270,10 @@ var require_dist = __commonJS({
 });
 
 // node_modules/uuid/dist/esm-node/rng.js
-import crypto6 from "crypto";
+import crypto7 from "crypto";
 function rng() {
   if (poolPtr > rnds8Pool.length - 16) {
-    crypto6.randomFillSync(rnds8Pool);
+    crypto7.randomFillSync(rnds8Pool);
     poolPtr = 0;
   }
   return rnds8Pool.slice(poolPtr, poolPtr += 16);
@@ -21473,14 +21473,14 @@ var init_v35 = __esm({
 });
 
 // node_modules/uuid/dist/esm-node/md5.js
-import crypto7 from "crypto";
+import crypto8 from "crypto";
 function md5(bytes) {
   if (Array.isArray(bytes)) {
     bytes = Buffer.from(bytes);
   } else if (typeof bytes === "string") {
     bytes = Buffer.from(bytes, "utf8");
   }
-  return crypto7.createHash("md5").update(bytes).digest();
+  return crypto8.createHash("md5").update(bytes).digest();
 }
 var md5_default;
 var init_md5 = __esm({
@@ -21525,14 +21525,14 @@ var init_v4 = __esm({
 });
 
 // node_modules/uuid/dist/esm-node/sha1.js
-import crypto8 from "crypto";
+import crypto9 from "crypto";
 function sha1(bytes) {
   if (Array.isArray(bytes)) {
     bytes = Buffer.from(bytes);
   } else if (typeof bytes === "string") {
     bytes = Buffer.from(bytes, "utf8");
   }
-  return crypto8.createHash("sha1").update(bytes).digest();
+  return crypto9.createHash("sha1").update(bytes).digest();
 }
 var sha1_default;
 var init_sha1 = __esm({
@@ -24789,14 +24789,14 @@ var require_node_gyp_build = __commonJS({
   "node_modules/node-gyp-build/node-gyp-build.js"(exports, module) {
     var fs7 = __require("fs");
     var path7 = __require("path");
-    var os4 = __require("os");
+    var os5 = __require("os");
     var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
     var vars = process.config && process.config.variables || {};
     var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
     var abi2 = process.versions.modules;
     var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-    var arch = process.env.npm_config_arch || os4.arch();
-    var platform = process.env.npm_config_platform || os4.platform();
+    var arch = process.env.npm_config_arch || os5.arch();
+    var platform = process.env.npm_config_platform || os5.platform();
     var libc = process.env.LIBC || (isAlpine(platform) ? "musl" : "glibc");
     var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
     var uv = (process.versions.uv || "").split(".")[0];
@@ -42726,10 +42726,10 @@ function checkExpiry({
 }
 
 // scripts/src/lib/key-source.mjs
-import fs5 from "node:fs";
-import path5 from "node:path";
-import os3 from "node:os";
-import crypto5 from "node:crypto";
+import fs6 from "node:fs";
+import path6 from "node:path";
+import os4 from "node:os";
+import crypto6 from "node:crypto";
 
 // node_modules/viem/_esm/utils/getAction.js
 function getAction(client, actionFn, name) {
@@ -53697,43 +53697,148 @@ init_keccak256();
 // scripts/src/lib/keys.mjs
 import fs4 from "node:fs";
 import path4 from "node:path";
-import { execFileSync } from "node:child_process";
-var ENV_FILE_RE = /^\.env(\..+)?$/;
-var PUBLIC_ENV_RE = /^\.env\.(example|sample|template)$/;
-function insideGitWorkTree(dir, whatFor) {
+import crypto5 from "node:crypto";
+function findGitRepo(dir) {
+  for (const v of ["GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE"]) {
+    if (process.env[v]) {
+      throw new SkillError(
+        "TRACKED_DOTENV_UNVERIFIABLE",
+        `${v} is set, so the repository layout cannot be resolved by reading the filesystem alone. Unset it (or run from a plain checkout) before using hot-wallet keys.`
+      );
+    }
+  }
+  let cur = path4.resolve(dir);
+  for (; ; ) {
+    const dotGit = path4.join(cur, ".git");
+    let st = null;
+    try {
+      st = fs4.statSync(dotGit);
+    } catch (err) {
+      if (err?.code !== "ENOENT" && err?.code !== "ENOTDIR") {
+        throw new SkillError(
+          "TRACKED_DOTENV_UNVERIFIABLE",
+          `A .git entry here could not be inspected (${err?.code || "error"}), so tracked status cannot be proved. Refusing.`
+        );
+      }
+      st = null;
+    }
+    if (st) {
+      if (st.isDirectory()) return { root: cur, gitDir: dotGit };
+      let text;
+      try {
+        text = fs4.readFileSync(dotGit, "utf8");
+      } catch {
+        throw new SkillError(
+          "TRACKED_DOTENV_UNVERIFIABLE",
+          "A .git entry exists here but could not be read, so tracked status cannot be proved. Refusing."
+        );
+      }
+      const m = /^gitdir:\s*(.+)\s*$/m.exec(text);
+      if (!m) {
+        throw new SkillError(
+          "TRACKED_DOTENV_UNVERIFIABLE",
+          "A .git file exists here but is not a recognised gitdir pointer. Refusing."
+        );
+      }
+      return { root: cur, gitDir: path4.resolve(cur, m[1]) };
+    }
+    const parent = path4.dirname(cur);
+    if (parent === cur) return null;
+    cur = parent;
+  }
+}
+function trackedPathsFromIndex(buf, { hashLen = 20 } = {}) {
+  const fail2 = (why) => new SkillError(
+    "TRACKED_DOTENV_UNVERIFIABLE",
+    `The git index could not be interpreted (${why}), so tracked status cannot be proved. Refusing.`
+  );
+  if (buf.length < 12 + hashLen || buf.toString("latin1", 0, 4) !== "DIRC") throw fail2("bad header");
+  const algo = hashLen === 32 ? "sha256" : "sha1";
+  const expected = buf.subarray(buf.length - hashLen);
+  const actual = crypto5.createHash(algo).update(buf.subarray(0, buf.length - hashLen)).digest();
+  if (!actual.equals(expected)) throw fail2(`${algo} checksum mismatch`);
+  const version6 = buf.readUInt32BE(4);
+  if (version6 !== 2 && version6 !== 3) throw fail2(`unsupported index version ${version6}`);
+  const count = buf.readUInt32BE(8);
+  const paths = /* @__PURE__ */ new Set();
+  const fixed = 40 + hashLen + 2;
+  let off = 12;
+  for (let i = 0; i < count; i++) {
+    const entryStart = off;
+    if (off + fixed > buf.length - hashLen) throw fail2("truncated entry");
+    const flags = buf.readUInt16BE(off + fixed - 2);
+    let nameOff = off + fixed;
+    if (flags & 16384) {
+      if (version6 < 3) throw fail2("extended flags in v2 index");
+      nameOff += 2;
+    }
+    const nameLen = flags & 4095;
+    let end;
+    if (nameLen < 4095) {
+      end = nameOff + nameLen;
+      if (end > buf.length - hashLen) throw fail2("truncated path");
+    } else {
+      end = buf.indexOf(0, nameOff);
+      if (end === -1 || end > buf.length - hashLen) throw fail2("unterminated path");
+    }
+    paths.add(buf.toString("utf8", nameOff, end));
+    const entryLen = end - entryStart;
+    off = entryStart + (Math.floor(entryLen / 8) + 1) * 8;
+  }
+  while (off < buf.length - hashLen) {
+    if (off + 8 > buf.length - hashLen) throw fail2("truncated extension header");
+    const extName = buf.toString("latin1", off, off + 4);
+    const extSize = buf.readUInt32BE(off + 4);
+    const first = extName.charCodeAt(0);
+    if (first >= 97 && first <= 122) {
+      throw fail2(`mandatory index extension "${extName}" (e.g. core.splitIndex) is not supported`);
+    }
+    off += 8 + extSize;
+    if (off > buf.length - hashLen) throw fail2("truncated extension");
+  }
+  return paths;
+}
+function repoHashLen(gitDir) {
+  let configDir = gitDir;
+  try {
+    const common = fs4.readFileSync(path4.join(gitDir, "commondir"), "utf8").trim();
+    if (common) configDir = path4.resolve(gitDir, common);
+  } catch {
+  }
+  try {
+    const cfg = fs4.readFileSync(path4.join(configDir, "config"), "utf8");
+    if (/^\s*objectformat\s*=\s*sha256\s*$/im.test(cfg)) return 32;
+  } catch {
+  }
+  return 20;
+}
+function trackedAmong(repo, files) {
+  const indexPath = path4.join(repo.gitDir, "index");
+  let buf;
   try {
-    return execFileSync("git", ["rev-parse", "--is-inside-work-tree"], {
-      cwd: dir,
-      stdio: ["ignore", "pipe", "pipe"],
-      encoding: "utf8"
-    }).trim() === "true";
+    buf = fs4.readFileSync(indexPath);
   } catch (err) {
-    const stderr = String(err?.stderr || "");
-    if (/not a git repository|does not appear to be a git repository/i.test(stderr)) return false;
+    if (err?.code === "ENOENT") return [];
     throw new SkillError(
       "TRACKED_DOTENV_UNVERIFIABLE",
-      `git could not be consulted (${err?.code || "unknown error"}), so it cannot be proved that ${whatFor} is untracked. Refusing rather than assuming it is safe.`
+      "The git index exists but could not be read, so tracked status cannot be proved. Refusing."
     );
   }
+  const tracked = trackedPathsFromIndex(buf, { hashLen: repoHashLen(repo.gitDir) });
+  return files.filter((f) => {
+    const rel = path4.relative(repo.root, path4.resolve(f)).split(path4.sep).join("/");
+    return tracked.has(rel);
+  });
 }
+var ENV_FILE_RE = /^\.env(\..+)?$/;
+var PUBLIC_ENV_RE = /^\.env\.(example|sample|template)$/;
 function assertNotTrackedByGit(file) {
   const dir = path4.dirname(path4.resolve(file));
-  const base = path4.basename(file);
-  if (!insideGitWorkTree(dir, "this key file")) return { checked: true, tracked: false };
-  let out2;
-  try {
-    out2 = execFileSync("git", ["ls-files", "-z", "--", base], {
-      cwd: dir,
-      stdio: ["ignore", "pipe", "ignore"],
-      encoding: "utf8"
-    });
-  } catch {
-    throw new SkillError(
-      "TRACKED_DOTENV_UNVERIFIABLE",
-      "git could not report whether this key file is tracked. Refusing to use it."
-    );
-  }
-  if (out2.split("\0").filter(Boolean).length) {
+  const repo = findGitRepo(dir);
+  if (!repo) return { checked: true, tracked: false };
+  const hits = trackedAmong(repo, [file]);
+  if (hits.length) {
+    const base = path4.basename(file);
     throw new SkillError(
       "TRACKED_KEYFILE",
       `${base} is tracked by git. A committed key is one push from being public \u2014 untrack it (git rm --cached ${base}) and gitignore it before using it to sign.`
@@ -53752,44 +53857,121 @@ function assertNoTrackedDotEnv(cwd = process.cwd()) {
     );
   }
   if (candidates.length === 0) return { checked: true, tracked: false, candidates: [] };
-  let insideRepo;
-  try {
-    insideRepo = execFileSync("git", ["rev-parse", "--is-inside-work-tree"], {
-      cwd,
-      stdio: ["ignore", "pipe", "pipe"],
-      encoding: "utf8"
-    }).trim() === "true";
-  } catch (err) {
-    const stderr = String(err?.stderr || "");
-    const notARepo = /not a git repository|does not appear to be a git repository/i.test(stderr);
-    if (notARepo) return { checked: true, tracked: false, candidates };
+  const repo = findGitRepo(cwd);
+  if (!repo) return { checked: true, tracked: false, candidates };
+  const tracked = trackedAmong(repo, candidates.map((f) => path4.join(cwd, f))).map(
+    (f) => path4.basename(f)
+  );
+  if (tracked.length) {
     throw new SkillError(
-      "TRACKED_DOTENV_UNVERIFIABLE",
-      `Found ${candidates.length} .env file(s) here, but git could not be consulted (${err?.code || "unknown error"}), so it cannot be proved they are untracked. Refusing to use hot-wallet keys in this directory.`
+      "TRACKED_DOTENV",
+      `These env file(s) are tracked by git: ${tracked.join(", ")}. Refusing to use hot-wallet keys here \u2014 untrack them (git rm --cached <file>) and gitignore them first.`
     );
   }
-  if (!insideRepo) return { checked: true, tracked: false, candidates };
-  let out2;
+  return { checked: true, tracked: false, candidates };
+}
+
+// scripts/src/lib/dotenv.mjs
+import fs5 from "node:fs";
+import os3 from "node:os";
+import path5 from "node:path";
+var ALLOWED_KEYS = [
+  "ROZO_CHECKOUT_EVM_KEY",
+  "ROZO_CHECKOUT_SOL_KEY",
+  "ROZO_CHECKOUT_EVM_KEYSTORE",
+  "ROZO_CHECKOUT_KEYSTORE_PASSPHRASE"
+];
+var ALLOWED_PATTERN = /^ROZO_CHECKOUT_RPC_[A-Za-z0-9_]+$/;
+function isAllowedKey(key) {
+  return ALLOWED_KEYS.includes(key) || ALLOWED_PATTERN.test(key);
+}
+function parseDotenv(text) {
+  const vars = {};
+  const lines = String(text).split(/\r?\n/);
+  lines.forEach((rawLine, i) => {
+    const lineNo = i + 1;
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) return;
+    const withoutExport = line.startsWith("export ") ? line.slice(7).trim() : line;
+    const eq = withoutExport.indexOf("=");
+    if (eq === -1) {
+      throw new SkillError(
+        "BAD_ENV_FILE",
+        `Malformed .env: line ${lineNo} is not KEY=VALUE. (Content withheld \u2014 it may be a secret.)`
+      );
+    }
+    const key = withoutExport.slice(0, eq).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+      throw new SkillError(
+        "BAD_ENV_FILE",
+        `Malformed .env: line ${lineNo} has an invalid key name. (Content withheld.)`
+      );
+    }
+    let value = withoutExport.slice(eq + 1).trim();
+    if (value.length >= 2 && (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))) {
+      value = value.slice(1, -1);
+    }
+    vars[key] = value;
+  });
+  return vars;
+}
+function filterAllowed(vars) {
+  const out2 = {};
+  for (const [k, v] of Object.entries(vars)) if (isAllowedKey(k)) out2[k] = v;
+  return out2;
+}
+function envFileCandidates({ cwd = process.cwd(), home = os3.homedir() } = {}) {
+  const candidates = [path5.join(cwd, ".env")];
+  const owned = path5.join(home, ".rozo-checkout", ".env");
+  if (owned !== candidates[0]) candidates.push(owned);
+  return candidates;
+}
+function resolveEnvFile({ file, cwd = process.cwd(), home = os3.homedir() } = {}) {
+  if (file) {
+    const p = path5.resolve(file);
+    if (!fs5.existsSync(p)) {
+      throw new SkillError("ENV_FILE_MISSING", `No such env file: ${file}`);
+    }
+    return p;
+  }
+  return envFileCandidates({ cwd, home }).find((p) => fs5.existsSync(p)) ?? null;
+}
+function applyDotenv({
+  file,
+  cwd = process.cwd(),
+  home = os3.homedir(),
+  env = process.env
+} = {}) {
+  const target = resolveEnvFile({ file, cwd, home });
+  if (!target) return null;
+  let stat;
   try {
-    out2 = execFileSync("git", ["ls-files", "-z", "--", ...candidates], {
-      cwd,
-      stdio: ["ignore", "pipe", "ignore"],
-      encoding: "utf8"
-    });
-  } catch {
-    throw new SkillError(
-      "TRACKED_DOTENV_UNVERIFIABLE",
-      "git could not report whether the .env file(s) in this directory are tracked. Refusing to use hot-wallet keys rather than assuming they are safe."
-    );
+    stat = fs5.statSync(target);
+  } catch (err) {
+    throw new SkillError("ENV_FILE_MISSING", `Cannot read env file (${err.code || "error"}).`);
   }
-  const tracked = out2.split("\0").filter(Boolean);
-  if (tracked.length) {
+  if (process.platform !== "win32" && stat.mode & 63) {
+    const mode = (stat.mode & 511).toString(8).padStart(3, "0");
     throw new SkillError(
-      "TRACKED_DOTENV",
-      `These env file(s) are tracked by git: ${tracked.join(", ")}. Refusing to use hot-wallet keys here \u2014 untrack them (git rm --cached <file>) and gitignore them first.`
+      "ENV_FILE_PERMISSIONS",
+      `That .env is readable by other users (mode ${mode}). Run: chmod 600 ${target}`
     );
   }
-  return { checked: true, tracked: false, candidates };
+  assertNotTrackedByGit(target);
+  const parsed = parseDotenv(fs5.readFileSync(target, "utf8"));
+  const allowed = filterAllowed(parsed);
+  const applied = [];
+  for (const [k, v] of Object.entries(allowed)) {
+    const existing = env[k];
+    if (existing !== void 0 && String(existing).trim() !== "") continue;
+    env[k] = v;
+    applied.push(k);
+  }
+  return {
+    path: target,
+    applied,
+    ignored: Object.keys(parsed).length - Object.keys(allowed).length
+  };
 }
 
 // scripts/src/lib/key-source.mjs
@@ -53798,12 +53980,12 @@ var SOL_KEY_ENV = "ROZO_CHECKOUT_SOL_KEY";
 var EVM_KEYSTORE_ENV = "ROZO_CHECKOUT_EVM_KEYSTORE";
 var KEYSTORE_PASSPHRASE_ENV = "ROZO_CHECKOUT_KEYSTORE_PASSPHRASE";
 function defaultSolanaKeypairPath() {
-  return path5.join(os3.homedir(), ".config", "solana", "id.json");
+  return path6.join(os4.homedir(), ".config", "solana", "id.json");
 }
 function assertKeyfileSafe(file) {
   let stat;
   try {
-    stat = fs5.statSync(file);
+    stat = fs6.statSync(file);
   } catch (err) {
     throw new SkillError(
       "KEYFILE_UNREADABLE",
@@ -53915,7 +54097,7 @@ function decryptKeystoreV3(keystore, passphrase) {
     if (!n || !r || !p || !dklen || !salt) {
       throw new SkillError("BAD_KEYSTORE", "The keystore scrypt parameters are incomplete.");
     }
-    derived = crypto5.scryptSync(pass, Buffer.from(salt, "hex"), dklen, {
+    derived = crypto6.scryptSync(pass, Buffer.from(salt, "hex"), dklen, {
       N: n,
       r,
       p,
@@ -53931,7 +54113,7 @@ function decryptKeystoreV3(keystore, passphrase) {
     if (!iterations || !dklen || !salt) {
       throw new SkillError("BAD_KEYSTORE", "The keystore pbkdf2 parameters are incomplete.");
     }
-    derived = crypto5.pbkdf2Sync(pass, Buffer.from(salt, "hex"), iterations, dklen, "sha256");
+    derived = crypto6.pbkdf2Sync(pass, Buffer.from(salt, "hex"), iterations, dklen, "sha256");
   } else {
     throw new SkillError("BAD_KEYSTORE", `Unsupported keystore KDF "${c2.kdf}".`);
   }
@@ -53946,7 +54128,7 @@ function decryptKeystoreV3(keystore, passphrase) {
   if (c2.cipher !== "aes-128-ctr") {
     throw new SkillError("BAD_KEYSTORE", `Unsupported keystore cipher "${c2.cipher}".`);
   }
-  const decipher = crypto5.createDecipheriv(
+  const decipher = crypto6.createDecipheriv(
     "aes-128-ctr",
     derived.subarray(0, 16),
     Buffer.from(c2.cipherparams.iv, "hex")
@@ -53968,7 +54150,7 @@ function timingSafeEqualHex(a, b) {
   const ab = Buffer.from(String(a).toLowerCase(), "hex");
   const bb = Buffer.from(String(b).toLowerCase(), "hex");
   if (ab.length === 0 || ab.length !== bb.length) return false;
-  return crypto5.timingSafeEqual(ab, bb);
+  return crypto6.timingSafeEqual(ab, bb);
 }
 function looksLikeKeystore(text) {
   const t = String(text).trimStart();
@@ -53980,12 +54162,16 @@ function looksLikeKeystore(text) {
     return false;
   }
 }
-function planKeySource({ family, keyfile, env = process.env }) {
+function searchedSuffix(searched) {
+  if (!searched || !searched.length) return "";
+  return ` Looked for a .env in: ${searched.map(displayPath).join(", ")}.`;
+}
+function planKeySource({ family, keyfile, env = process.env, searched }) {
   if (keyfile) {
     const resolved = expandHome(keyfile);
     let text;
     try {
-      text = fs5.readFileSync(resolved, "utf8");
+      text = fs6.readFileSync(resolved, "utf8");
     } catch (err) {
       throw new SkillError(
         "KEYFILE_UNREADABLE",
@@ -54009,13 +54195,13 @@ function planKeySource({ family, keyfile, env = process.env }) {
   }
   if (family === "solana") {
     const standard = defaultSolanaKeypairPath();
-    if (fs5.existsSync(standard)) {
+    if (fs6.existsSync(standard)) {
       return { kind: "keypair-file", path: standard, label: displayPath(standard) };
     }
     if (env[SOL_KEY_ENV]) return { kind: "env", label: SOL_KEY_ENV };
     throw new SkillError(
       "NO_KEY_SOURCE",
-      `No signing key found. Either create one with solana-keygen (writes ${displayPath(standard)}), pass --keyfile <path>, or set ${SOL_KEY_ENV}.`
+      `No signing key found. Either create one with solana-keygen (writes ${displayPath(standard)}), pass --keyfile <path>, or set ${SOL_KEY_ENV}.` + searchedSuffix(searched)
     );
   }
   if (family === "evm") {
@@ -54027,7 +54213,7 @@ function planKeySource({ family, keyfile, env = process.env }) {
     if (env[EVM_KEY_ENV]) return { kind: "env", label: EVM_KEY_ENV };
     throw new SkillError(
       "NO_KEY_SOURCE",
-      `No signing key found. Either point ${EVM_KEYSTORE_ENV} at an encrypted JSON keystore, pass --keyfile <path>, or set ${EVM_KEY_ENV}.`
+      `No signing key found. Either point ${EVM_KEYSTORE_ENV} at an encrypted JSON keystore, pass --keyfile <path>, or set ${EVM_KEY_ENV}.${searchedSuffix(searched)}`
     );
   }
   throw new SkillError("NO_KEY_SOURCE", `No key source for family "${family}".`);
@@ -54045,7 +54231,7 @@ async function loadKeySource(plan, { family, env = process.env, askPassphrase }
     return { secretKey: decodeSolanaEnvKey(raw), label: plan.label, kind: plan.kind };
   }
   assertKeyfileSafe(plan.path);
-  const text = fs5.readFileSync(plan.path, "utf8");
+  const text = fs6.readFileSync(plan.path, "utf8");
   if (plan.kind === "keypair-file") {
     return { secretKey: parseSolanaKeypairJson(text), label: plan.label, kind: plan.kind };
   }
@@ -54072,110 +54258,19 @@ function planSignability({
 }) {
   const probeEnv = { ...env };
   if (applyEnvFile) applyEnvFile({ file: envFile, cwd, env: probeEnv });
-  return planKeySource({ family, keyfile, env: probeEnv });
+  const searched = envFile ? null : envFileCandidates({ cwd });
+  return planKeySource({ family, keyfile, env: probeEnv, searched });
 }
 function expandHome(p) {
   const s = String(p);
-  if (s === "~") return os3.homedir();
-  if (s.startsWith("~/")) return path5.join(os3.homedir(), s.slice(2));
+  if (s === "~") return os4.homedir();
+  if (s.startsWith("~/")) return path6.join(os4.homedir(), s.slice(2));
   return s;
 }
 function displayPath(p) {
-  const home = os3.homedir();
+  const home = os4.homedir();
   const s = String(p);
-  return s.startsWith(home + path5.sep) ? `~${s.slice(home.length)}` : s;
-}
-
-// scripts/src/lib/dotenv.mjs
-import fs6 from "node:fs";
-import path6 from "node:path";
-var ALLOWED_KEYS = [
-  "ROZO_CHECKOUT_EVM_KEY",
-  "ROZO_CHECKOUT_SOL_KEY",
-  "ROZO_CHECKOUT_EVM_KEYSTORE",
-  "ROZO_CHECKOUT_KEYSTORE_PASSPHRASE"
-];
-var ALLOWED_PATTERN = /^ROZO_CHECKOUT_RPC_[A-Za-z0-9_]+$/;
-function isAllowedKey(key) {
-  return ALLOWED_KEYS.includes(key) || ALLOWED_PATTERN.test(key);
-}
-function parseDotenv(text) {
-  const vars = {};
-  const lines = String(text).split(/\r?\n/);
-  lines.forEach((rawLine, i) => {
-    const lineNo = i + 1;
-    const line = rawLine.trim();
-    if (!line || line.startsWith("#")) return;
-    const withoutExport = line.startsWith("export ") ? line.slice(7).trim() : line;
-    const eq = withoutExport.indexOf("=");
-    if (eq === -1) {
-      throw new SkillError(
-        "BAD_ENV_FILE",
-        `Malformed .env: line ${lineNo} is not KEY=VALUE. (Content withheld \u2014 it may be a secret.)`
-      );
-    }
-    const key = withoutExport.slice(0, eq).trim();
-    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
-      throw new SkillError(
-        "BAD_ENV_FILE",
-        `Malformed .env: line ${lineNo} has an invalid key name. (Content withheld.)`
-      );
-    }
-    let value = withoutExport.slice(eq + 1).trim();
-    if (value.length >= 2 && (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))) {
-      value = value.slice(1, -1);
-    }
-    vars[key] = value;
-  });
-  return vars;
-}
-function filterAllowed(vars) {
-  const out2 = {};
-  for (const [k, v] of Object.entries(vars)) if (isAllowedKey(k)) out2[k] = v;
-  return out2;
-}
-function resolveEnvFile({ file, cwd = process.cwd() } = {}) {
-  if (file) {
-    const p = path6.resolve(file);
-    if (!fs6.existsSync(p)) {
-      throw new SkillError("ENV_FILE_MISSING", `No such env file: ${file}`);
-    }
-    return p;
-  }
-  const fallback = path6.join(cwd, ".env");
-  return fs6.existsSync(fallback) ? fallback : null;
-}
-function applyDotenv({ file, cwd = process.cwd(), env = process.env } = {}) {
-  const target = resolveEnvFile({ file, cwd });
-  if (!target) return null;
-  let stat;
-  try {
-    stat = fs6.statSync(target);
-  } catch (err) {
-    throw new SkillError("ENV_FILE_MISSING", `Cannot read env file (${err.code || "error"}).`);
-  }
-  if (process.platform !== "win32" && stat.mode & 63) {
-    const mode = (stat.mode & 511).toString(8).padStart(3, "0");
-    throw new SkillError(
-      "ENV_FILE_PERMISSIONS",
-      `That .env is readable by other users (mode ${mode}). Run: chmod 600 ${target}`
-    );
-  }
-  assertNotTrackedByGit(target);
-  const parsed = parseDotenv(fs6.readFileSync(target, "utf8"));
-  const allowed = filterAllowed(parsed);
-  const applied = [];
-  for (const [k, v] of Object.entries(allowed)) {
-    const existing = env[k];
-    if (existing !== void 0 && String(existing).trim() !== "") continue;
-    env[k] = v;
-    applied.push(k);
-  }
-  return {
-    path: target,
-    applied,
-    ignored: Object.keys(parsed).length - Object.keys(allowed).length
-  };
+  return s.startsWith(home + path6.sep) ? `~${s.slice(home.length)}` : s;
 }
 
 // scripts/src/lib/http.mjs
@@ -55592,7 +55687,11 @@ async function main4(argv) {
   const rozoPaymentId = assertRozoPaymentId(args["rozo-payment-id"] || args._[0]);
   assertNoTrackedDotEnv();
   const dotenv = applyDotenv({ file: args["env-file"] });
-  const plan = planKeySource({ family: "evm", keyfile: args.keyfile });
+  const plan = planKeySource({
+    family: "evm",
+    keyfile: args.keyfile,
+    searched: args["env-file"] ? null : envFileCandidates()
+  });
   const loaded = await loadKeySource(plan, { family: "evm", askPassphrase: promptPassphrase });
   const account = privateKeyToAccount(loaded.privateKey);
   const sender = account.address;
@@ -57536,7 +57635,11 @@ async function main5(argv) {
   const rozoPaymentId = assertRozoPaymentId(args["rozo-payment-id"] || args._[0]);
   assertNoTrackedDotEnv();
   const dotenv = applyDotenv({ file: args["env-file"] });
-  const plan = planKeySource({ family: "solana", keyfile: args.keyfile });
+  const plan = planKeySource({
+    family: "solana",
+    keyfile: args.keyfile,
+    searched: args["env-file"] ? null : envFileCandidates()
+  });
   const loaded = await loadKeySource(plan, { family: "solana", askPassphrase: promptPassphrase });
   const secret = loaded.secretKey;
   const keypair = secret.length === 64 ? import_web36.Keypair.fromSecretKey(secret) : import_web36.Keypair.fromSeed(secret);