@rozoai/checkout 0.1.6 → 0.1.10

package/scripts/dist/send-evm.js

@@ -1759,10 +1759,10 @@ var init_u64 = __esm({
 
 // node_modules/@noble/hashes/esm/cryptoNode.js
 import * as nc from "node:crypto";
-var crypto2;
+var crypto3;
 var init_cryptoNode = __esm({
   "node_modules/@noble/hashes/esm/cryptoNode.js"() {
-    crypto2 = nc && typeof nc === "object" && "webcrypto" in nc ? nc.webcrypto : nc && typeof nc === "object" && "randomBytes" in nc ? nc : void 0;
+    crypto3 = nc && typeof nc === "object" && "webcrypto" in nc ? nc.webcrypto : nc && typeof nc === "object" && "randomBytes" in nc ? nc : void 0;
   }
 });
 
@@ -1857,11 +1857,11 @@ function createHasher(hashCons) {
   return hashC;
 }
 function randomBytes(bytesLength = 32) {
-  if (crypto2 && typeof crypto2.getRandomValues === "function") {
-    return crypto2.getRandomValues(new Uint8Array(bytesLength));
+  if (crypto3 && typeof crypto3.getRandomValues === "function") {
+    return crypto3.getRandomValues(new Uint8Array(bytesLength));
   }
-  if (crypto2 && typeof crypto2.randomBytes === "function") {
-    return Uint8Array.from(crypto2.randomBytes(bytesLength));
+  if (crypto3 && typeof crypto3.randomBytes === "function") {
+    return Uint8Array.from(crypto3.randomBytes(bytesLength));
   }
   throw new Error("crypto.getRandomValues must be defined");
 }
@@ -10214,43 +10214,148 @@ function chainFamily(chainId) {
 // scripts/src/lib/keys.mjs
 import fs from "node:fs";
 import path from "node:path";
-import { execFileSync } from "node:child_process";
-var ENV_FILE_RE = /^\.env(\..+)?$/;
-var PUBLIC_ENV_RE = /^\.env\.(example|sample|template)$/;
-function insideGitWorkTree(dir, whatFor) {
+import crypto2 from "node:crypto";
+function findGitRepo(dir) {
+  for (const v of ["GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE"]) {
+    if (process.env[v]) {
+      throw new SkillError(
+        "TRACKED_DOTENV_UNVERIFIABLE",
+        `${v} is set, so the repository layout cannot be resolved by reading the filesystem alone. Unset it (or run from a plain checkout) before using hot-wallet keys.`
+      );
+    }
+  }
+  let cur = path.resolve(dir);
+  for (; ; ) {
+    const dotGit = path.join(cur, ".git");
+    let st = null;
+    try {
+      st = fs.statSync(dotGit);
+    } catch (err) {
+      if (err?.code !== "ENOENT" && err?.code !== "ENOTDIR") {
+        throw new SkillError(
+          "TRACKED_DOTENV_UNVERIFIABLE",
+          `A .git entry here could not be inspected (${err?.code || "error"}), so tracked status cannot be proved. Refusing.`
+        );
+      }
+      st = null;
+    }
+    if (st) {
+      if (st.isDirectory()) return { root: cur, gitDir: dotGit };
+      let text;
+      try {
+        text = fs.readFileSync(dotGit, "utf8");
+      } catch {
+        throw new SkillError(
+          "TRACKED_DOTENV_UNVERIFIABLE",
+          "A .git entry exists here but could not be read, so tracked status cannot be proved. Refusing."
+        );
+      }
+      const m = /^gitdir:\s*(.+)\s*$/m.exec(text);
+      if (!m) {
+        throw new SkillError(
+          "TRACKED_DOTENV_UNVERIFIABLE",
+          "A .git file exists here but is not a recognised gitdir pointer. Refusing."
+        );
+      }
+      return { root: cur, gitDir: path.resolve(cur, m[1]) };
+    }
+    const parent = path.dirname(cur);
+    if (parent === cur) return null;
+    cur = parent;
+  }
+}
+function trackedPathsFromIndex(buf, { hashLen = 20 } = {}) {
+  const fail2 = (why) => new SkillError(
+    "TRACKED_DOTENV_UNVERIFIABLE",
+    `The git index could not be interpreted (${why}), so tracked status cannot be proved. Refusing.`
+  );
+  if (buf.length < 12 + hashLen || buf.toString("latin1", 0, 4) !== "DIRC") throw fail2("bad header");
+  const algo = hashLen === 32 ? "sha256" : "sha1";
+  const expected = buf.subarray(buf.length - hashLen);
+  const actual = crypto2.createHash(algo).update(buf.subarray(0, buf.length - hashLen)).digest();
+  if (!actual.equals(expected)) throw fail2(`${algo} checksum mismatch`);
+  const version4 = buf.readUInt32BE(4);
+  if (version4 !== 2 && version4 !== 3) throw fail2(`unsupported index version ${version4}`);
+  const count = buf.readUInt32BE(8);
+  const paths = /* @__PURE__ */ new Set();
+  const fixed = 40 + hashLen + 2;
+  let off = 12;
+  for (let i = 0; i < count; i++) {
+    const entryStart = off;
+    if (off + fixed > buf.length - hashLen) throw fail2("truncated entry");
+    const flags = buf.readUInt16BE(off + fixed - 2);
+    let nameOff = off + fixed;
+    if (flags & 16384) {
+      if (version4 < 3) throw fail2("extended flags in v2 index");
+      nameOff += 2;
+    }
+    const nameLen = flags & 4095;
+    let end;
+    if (nameLen < 4095) {
+      end = nameOff + nameLen;
+      if (end > buf.length - hashLen) throw fail2("truncated path");
+    } else {
+      end = buf.indexOf(0, nameOff);
+      if (end === -1 || end > buf.length - hashLen) throw fail2("unterminated path");
+    }
+    paths.add(buf.toString("utf8", nameOff, end));
+    const entryLen = end - entryStart;
+    off = entryStart + (Math.floor(entryLen / 8) + 1) * 8;
+  }
+  while (off < buf.length - hashLen) {
+    if (off + 8 > buf.length - hashLen) throw fail2("truncated extension header");
+    const extName = buf.toString("latin1", off, off + 4);
+    const extSize = buf.readUInt32BE(off + 4);
+    const first = extName.charCodeAt(0);
+    if (first >= 97 && first <= 122) {
+      throw fail2(`mandatory index extension "${extName}" (e.g. core.splitIndex) is not supported`);
+    }
+    off += 8 + extSize;
+    if (off > buf.length - hashLen) throw fail2("truncated extension");
+  }
+  return paths;
+}
+function repoHashLen(gitDir) {
+  let configDir = gitDir;
+  try {
+    const common = fs.readFileSync(path.join(gitDir, "commondir"), "utf8").trim();
+    if (common) configDir = path.resolve(gitDir, common);
+  } catch {
+  }
+  try {
+    const cfg = fs.readFileSync(path.join(configDir, "config"), "utf8");
+    if (/^\s*objectformat\s*=\s*sha256\s*$/im.test(cfg)) return 32;
+  } catch {
+  }
+  return 20;
+}
+function trackedAmong(repo, files) {
+  const indexPath = path.join(repo.gitDir, "index");
+  let buf;
   try {
-    return execFileSync("git", ["rev-parse", "--is-inside-work-tree"], {
-      cwd: dir,
-      stdio: ["ignore", "pipe", "pipe"],
-      encoding: "utf8"
-    }).trim() === "true";
+    buf = fs.readFileSync(indexPath);
   } catch (err) {
-    const stderr = String(err?.stderr || "");
-    if (/not a git repository|does not appear to be a git repository/i.test(stderr)) return false;
+    if (err?.code === "ENOENT") return [];
     throw new SkillError(
       "TRACKED_DOTENV_UNVERIFIABLE",
-      `git could not be consulted (${err?.code || "unknown error"}), so it cannot be proved that ${whatFor} is untracked. Refusing rather than assuming it is safe.`
+      "The git index exists but could not be read, so tracked status cannot be proved. Refusing."
     );
   }
+  const tracked = trackedPathsFromIndex(buf, { hashLen: repoHashLen(repo.gitDir) });
+  return files.filter((f) => {
+    const rel = path.relative(repo.root, path.resolve(f)).split(path.sep).join("/");
+    return tracked.has(rel);
+  });
 }
+var ENV_FILE_RE = /^\.env(\..+)?$/;
+var PUBLIC_ENV_RE = /^\.env\.(example|sample|template)$/;
 function assertNotTrackedByGit(file) {
   const dir = path.dirname(path.resolve(file));
-  const base = path.basename(file);
-  if (!insideGitWorkTree(dir, "this key file")) return { checked: true, tracked: false };
-  let out;
-  try {
-    out = execFileSync("git", ["ls-files", "-z", "--", base], {
-      cwd: dir,
-      stdio: ["ignore", "pipe", "ignore"],
-      encoding: "utf8"
-    });
-  } catch {
-    throw new SkillError(
-      "TRACKED_DOTENV_UNVERIFIABLE",
-      "git could not report whether this key file is tracked. Refusing to use it."
-    );
-  }
-  if (out.split("\0").filter(Boolean).length) {
+  const repo = findGitRepo(dir);
+  if (!repo) return { checked: true, tracked: false };
+  const hits = trackedAmong(repo, [file]);
+  if (hits.length) {
+    const base = path.basename(file);
     throw new SkillError(
       "TRACKED_KEYFILE",
       `${base} is tracked by git. A committed key is one push from being public \u2014 untrack it (git rm --cached ${base}) and gitignore it before using it to sign.`
@@ -10269,37 +10374,11 @@ function assertNoTrackedDotEnv(cwd = process.cwd()) {
     );
   }
   if (candidates.length === 0) return { checked: true, tracked: false, candidates: [] };
-  let insideRepo;
-  try {
-    insideRepo = execFileSync("git", ["rev-parse", "--is-inside-work-tree"], {
-      cwd,
-      stdio: ["ignore", "pipe", "pipe"],
-      encoding: "utf8"
-    }).trim() === "true";
-  } catch (err) {
-    const stderr = String(err?.stderr || "");
-    const notARepo = /not a git repository|does not appear to be a git repository/i.test(stderr);
-    if (notARepo) return { checked: true, tracked: false, candidates };
-    throw new SkillError(
-      "TRACKED_DOTENV_UNVERIFIABLE",
-      `Found ${candidates.length} .env file(s) here, but git could not be consulted (${err?.code || "unknown error"}), so it cannot be proved they are untracked. Refusing to use hot-wallet keys in this directory.`
-    );
-  }
-  if (!insideRepo) return { checked: true, tracked: false, candidates };
-  let out;
-  try {
-    out = execFileSync("git", ["ls-files", "-z", "--", ...candidates], {
-      cwd,
-      stdio: ["ignore", "pipe", "ignore"],
-      encoding: "utf8"
-    });
-  } catch {
-    throw new SkillError(
-      "TRACKED_DOTENV_UNVERIFIABLE",
-      "git could not report whether the .env file(s) in this directory are tracked. Refusing to use hot-wallet keys rather than assuming they are safe."
-    );
-  }
-  const tracked = out.split("\0").filter(Boolean);
+  const repo = findGitRepo(cwd);
+  if (!repo) return { checked: true, tracked: false, candidates };
+  const tracked = trackedAmong(repo, candidates.map((f) => path.join(cwd, f))).map(
+    (f) => path.basename(f)
+  );
   if (tracked.length) {
     throw new SkillError(
       "TRACKED_DOTENV",
@@ -10310,10 +10389,10 @@ function assertNoTrackedDotEnv(cwd = process.cwd()) {
 }
 
 // scripts/src/lib/key-source.mjs
-import fs2 from "node:fs";
-import path2 from "node:path";
-import os from "node:os";
-import crypto3 from "node:crypto";
+import fs3 from "node:fs";
+import path3 from "node:path";
+import os2 from "node:os";
+import crypto4 from "node:crypto";
 
 // node_modules/viem/_esm/utils/getAction.js
 function getAction(client, actionFn, name) {
@@ -21278,18 +21357,121 @@ function http(url, config = {}) {
 init_encodeFunctionData();
 init_keccak256();
 
+// scripts/src/lib/dotenv.mjs
+import fs2 from "node:fs";
+import os from "node:os";
+import path2 from "node:path";
+var ALLOWED_KEYS = [
+  "ROZO_CHECKOUT_EVM_KEY",
+  "ROZO_CHECKOUT_SOL_KEY",
+  "ROZO_CHECKOUT_EVM_KEYSTORE",
+  "ROZO_CHECKOUT_KEYSTORE_PASSPHRASE"
+];
+var ALLOWED_PATTERN = /^ROZO_CHECKOUT_RPC_[A-Za-z0-9_]+$/;
+function isAllowedKey(key) {
+  return ALLOWED_KEYS.includes(key) || ALLOWED_PATTERN.test(key);
+}
+function parseDotenv(text) {
+  const vars = {};
+  const lines = String(text).split(/\r?\n/);
+  lines.forEach((rawLine, i) => {
+    const lineNo = i + 1;
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) return;
+    const withoutExport = line.startsWith("export ") ? line.slice(7).trim() : line;
+    const eq = withoutExport.indexOf("=");
+    if (eq === -1) {
+      throw new SkillError(
+        "BAD_ENV_FILE",
+        `Malformed .env: line ${lineNo} is not KEY=VALUE. (Content withheld \u2014 it may be a secret.)`
+      );
+    }
+    const key = withoutExport.slice(0, eq).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+      throw new SkillError(
+        "BAD_ENV_FILE",
+        `Malformed .env: line ${lineNo} has an invalid key name. (Content withheld.)`
+      );
+    }
+    let value = withoutExport.slice(eq + 1).trim();
+    if (value.length >= 2 && (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))) {
+      value = value.slice(1, -1);
+    }
+    vars[key] = value;
+  });
+  return vars;
+}
+function filterAllowed(vars) {
+  const out = {};
+  for (const [k, v] of Object.entries(vars)) if (isAllowedKey(k)) out[k] = v;
+  return out;
+}
+function envFileCandidates({ cwd = process.cwd(), home = os.homedir() } = {}) {
+  const candidates = [path2.join(cwd, ".env")];
+  const owned = path2.join(home, ".rozo-checkout", ".env");
+  if (owned !== candidates[0]) candidates.push(owned);
+  return candidates;
+}
+function resolveEnvFile({ file, cwd = process.cwd(), home = os.homedir() } = {}) {
+  if (file) {
+    const p = path2.resolve(file);
+    if (!fs2.existsSync(p)) {
+      throw new SkillError("ENV_FILE_MISSING", `No such env file: ${file}`);
+    }
+    return p;
+  }
+  return envFileCandidates({ cwd, home }).find((p) => fs2.existsSync(p)) ?? null;
+}
+function applyDotenv({
+  file,
+  cwd = process.cwd(),
+  home = os.homedir(),
+  env = process.env
+} = {}) {
+  const target = resolveEnvFile({ file, cwd, home });
+  if (!target) return null;
+  let stat;
+  try {
+    stat = fs2.statSync(target);
+  } catch (err) {
+    throw new SkillError("ENV_FILE_MISSING", `Cannot read env file (${err.code || "error"}).`);
+  }
+  if (process.platform !== "win32" && stat.mode & 63) {
+    const mode = (stat.mode & 511).toString(8).padStart(3, "0");
+    throw new SkillError(
+      "ENV_FILE_PERMISSIONS",
+      `That .env is readable by other users (mode ${mode}). Run: chmod 600 ${target}`
+    );
+  }
+  assertNotTrackedByGit(target);
+  const parsed = parseDotenv(fs2.readFileSync(target, "utf8"));
+  const allowed = filterAllowed(parsed);
+  const applied = [];
+  for (const [k, v] of Object.entries(allowed)) {
+    const existing = env[k];
+    if (existing !== void 0 && String(existing).trim() !== "") continue;
+    env[k] = v;
+    applied.push(k);
+  }
+  return {
+    path: target,
+    applied,
+    ignored: Object.keys(parsed).length - Object.keys(allowed).length
+  };
+}
+
 // scripts/src/lib/key-source.mjs
 var EVM_KEY_ENV = "ROZO_CHECKOUT_EVM_KEY";
 var SOL_KEY_ENV = "ROZO_CHECKOUT_SOL_KEY";
 var EVM_KEYSTORE_ENV = "ROZO_CHECKOUT_EVM_KEYSTORE";
 var KEYSTORE_PASSPHRASE_ENV = "ROZO_CHECKOUT_KEYSTORE_PASSPHRASE";
 function defaultSolanaKeypairPath() {
-  return path2.join(os.homedir(), ".config", "solana", "id.json");
+  return path3.join(os2.homedir(), ".config", "solana", "id.json");
 }
 function assertKeyfileSafe(file) {
   let stat;
   try {
-    stat = fs2.statSync(file);
+    stat = fs3.statSync(file);
   } catch (err) {
     throw new SkillError(
       "KEYFILE_UNREADABLE",
@@ -21401,7 +21583,7 @@ function decryptKeystoreV3(keystore, passphrase) {
     if (!n || !r || !p || !dklen || !salt) {
       throw new SkillError("BAD_KEYSTORE", "The keystore scrypt parameters are incomplete.");
     }
-    derived = crypto3.scryptSync(pass, Buffer.from(salt, "hex"), dklen, {
+    derived = crypto4.scryptSync(pass, Buffer.from(salt, "hex"), dklen, {
       N: n,
       r,
       p,
@@ -21417,7 +21599,7 @@ function decryptKeystoreV3(keystore, passphrase) {
     if (!iterations || !dklen || !salt) {
       throw new SkillError("BAD_KEYSTORE", "The keystore pbkdf2 parameters are incomplete.");
     }
-    derived = crypto3.pbkdf2Sync(pass, Buffer.from(salt, "hex"), iterations, dklen, "sha256");
+    derived = crypto4.pbkdf2Sync(pass, Buffer.from(salt, "hex"), iterations, dklen, "sha256");
   } else {
     throw new SkillError("BAD_KEYSTORE", `Unsupported keystore KDF "${c.kdf}".`);
   }
@@ -21432,7 +21614,7 @@ function decryptKeystoreV3(keystore, passphrase) {
   if (c.cipher !== "aes-128-ctr") {
     throw new SkillError("BAD_KEYSTORE", `Unsupported keystore cipher "${c.cipher}".`);
   }
-  const decipher = crypto3.createDecipheriv(
+  const decipher = crypto4.createDecipheriv(
     "aes-128-ctr",
     derived.subarray(0, 16),
     Buffer.from(c.cipherparams.iv, "hex")
@@ -21454,7 +21636,7 @@ function timingSafeEqualHex(a, b) {
   const ab = Buffer.from(String(a).toLowerCase(), "hex");
   const bb = Buffer.from(String(b).toLowerCase(), "hex");
   if (ab.length === 0 || ab.length !== bb.length) return false;
-  return crypto3.timingSafeEqual(ab, bb);
+  return crypto4.timingSafeEqual(ab, bb);
 }
 function looksLikeKeystore(text) {
   const t = String(text).trimStart();
@@ -21466,12 +21648,16 @@ function looksLikeKeystore(text) {
     return false;
   }
 }
-function planKeySource({ family, keyfile, env = process.env }) {
+function searchedSuffix(searched) {
+  if (!searched || !searched.length) return "";
+  return ` Looked for a .env in: ${searched.map(displayPath).join(", ")}.`;
+}
+function planKeySource({ family, keyfile, env = process.env, searched }) {
   if (keyfile) {
     const resolved = expandHome(keyfile);
     let text;
     try {
-      text = fs2.readFileSync(resolved, "utf8");
+      text = fs3.readFileSync(resolved, "utf8");
     } catch (err) {
       throw new SkillError(
         "KEYFILE_UNREADABLE",
@@ -21495,13 +21681,13 @@ function planKeySource({ family, keyfile, env = process.env }) {
   }
   if (family === "solana") {
     const standard = defaultSolanaKeypairPath();
-    if (fs2.existsSync(standard)) {
+    if (fs3.existsSync(standard)) {
       return { kind: "keypair-file", path: standard, label: displayPath(standard) };
     }
     if (env[SOL_KEY_ENV]) return { kind: "env", label: SOL_KEY_ENV };
     throw new SkillError(
       "NO_KEY_SOURCE",
-      `No signing key found. Either create one with solana-keygen (writes ${displayPath(standard)}), pass --keyfile <path>, or set ${SOL_KEY_ENV}.`
+      `No signing key found. Either create one with solana-keygen (writes ${displayPath(standard)}), pass --keyfile <path>, or set ${SOL_KEY_ENV}.` + searchedSuffix(searched)
     );
   }
   if (family === "evm") {
@@ -21513,7 +21699,7 @@ function planKeySource({ family, keyfile, env = process.env }) {
     if (env[EVM_KEY_ENV]) return { kind: "env", label: EVM_KEY_ENV };
     throw new SkillError(
       "NO_KEY_SOURCE",
-      `No signing key found. Either point ${EVM_KEYSTORE_ENV} at an encrypted JSON keystore, pass --keyfile <path>, or set ${EVM_KEY_ENV}.`
+      `No signing key found. Either point ${EVM_KEYSTORE_ENV} at an encrypted JSON keystore, pass --keyfile <path>, or set ${EVM_KEY_ENV}.${searchedSuffix(searched)}`
     );
   }
   throw new SkillError("NO_KEY_SOURCE", `No key source for family "${family}".`);
@@ -21531,7 +21717,7 @@ async function loadKeySource(plan, { family, env = process.env, askPassphrase }
     return { secretKey: decodeSolanaEnvKey(raw), label: plan.label, kind: plan.kind };
   }
   assertKeyfileSafe(plan.path);
-  const text = fs2.readFileSync(plan.path, "utf8");
+  const text = fs3.readFileSync(plan.path, "utf8");
   if (plan.kind === "keypair-file") {
     return { secretKey: parseSolanaKeypairJson(text), label: plan.label, kind: plan.kind };
   }
@@ -21550,106 +21736,14 @@ async function loadKeySource(plan, { family, env = process.env, askPassphrase }
 }
 function expandHome(p) {
   const s = String(p);
-  if (s === "~") return os.homedir();
-  if (s.startsWith("~/")) return path2.join(os.homedir(), s.slice(2));
+  if (s === "~") return os2.homedir();
+  if (s.startsWith("~/")) return path3.join(os2.homedir(), s.slice(2));
   return s;
 }
 function displayPath(p) {
-  const home = os.homedir();
+  const home = os2.homedir();
   const s = String(p);
-  return s.startsWith(home + path2.sep) ? `~${s.slice(home.length)}` : s;
-}
-
-// scripts/src/lib/dotenv.mjs
-import fs3 from "node:fs";
-import path3 from "node:path";
-var ALLOWED_KEYS = [
-  "ROZO_CHECKOUT_EVM_KEY",
-  "ROZO_CHECKOUT_SOL_KEY",
-  "ROZO_CHECKOUT_EVM_KEYSTORE",
-  "ROZO_CHECKOUT_KEYSTORE_PASSPHRASE"
-];
-var ALLOWED_PATTERN = /^ROZO_CHECKOUT_RPC_[A-Za-z0-9_]+$/;
-function isAllowedKey(key) {
-  return ALLOWED_KEYS.includes(key) || ALLOWED_PATTERN.test(key);
-}
-function parseDotenv(text) {
-  const vars = {};
-  const lines = String(text).split(/\r?\n/);
-  lines.forEach((rawLine, i) => {
-    const lineNo = i + 1;
-    const line = rawLine.trim();
-    if (!line || line.startsWith("#")) return;
-    const withoutExport = line.startsWith("export ") ? line.slice(7).trim() : line;
-    const eq = withoutExport.indexOf("=");
-    if (eq === -1) {
-      throw new SkillError(
-        "BAD_ENV_FILE",
-        `Malformed .env: line ${lineNo} is not KEY=VALUE. (Content withheld \u2014 it may be a secret.)`
-      );
-    }
-    const key = withoutExport.slice(0, eq).trim();
-    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
-      throw new SkillError(
-        "BAD_ENV_FILE",
-        `Malformed .env: line ${lineNo} has an invalid key name. (Content withheld.)`
-      );
-    }
-    let value = withoutExport.slice(eq + 1).trim();
-    if (value.length >= 2 && (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))) {
-      value = value.slice(1, -1);
-    }
-    vars[key] = value;
-  });
-  return vars;
-}
-function filterAllowed(vars) {
-  const out = {};
-  for (const [k, v] of Object.entries(vars)) if (isAllowedKey(k)) out[k] = v;
-  return out;
-}
-function resolveEnvFile({ file, cwd = process.cwd() } = {}) {
-  if (file) {
-    const p = path3.resolve(file);
-    if (!fs3.existsSync(p)) {
-      throw new SkillError("ENV_FILE_MISSING", `No such env file: ${file}`);
-    }
-    return p;
-  }
-  const fallback = path3.join(cwd, ".env");
-  return fs3.existsSync(fallback) ? fallback : null;
-}
-function applyDotenv({ file, cwd = process.cwd(), env = process.env } = {}) {
-  const target = resolveEnvFile({ file, cwd });
-  if (!target) return null;
-  let stat;
-  try {
-    stat = fs3.statSync(target);
-  } catch (err) {
-    throw new SkillError("ENV_FILE_MISSING", `Cannot read env file (${err.code || "error"}).`);
-  }
-  if (process.platform !== "win32" && stat.mode & 63) {
-    const mode = (stat.mode & 511).toString(8).padStart(3, "0");
-    throw new SkillError(
-      "ENV_FILE_PERMISSIONS",
-      `That .env is readable by other users (mode ${mode}). Run: chmod 600 ${target}`
-    );
-  }
-  assertNotTrackedByGit(target);
-  const parsed = parseDotenv(fs3.readFileSync(target, "utf8"));
-  const allowed = filterAllowed(parsed);
-  const applied = [];
-  for (const [k, v] of Object.entries(allowed)) {
-    const existing = env[k];
-    if (existing !== void 0 && String(existing).trim() !== "") continue;
-    env[k] = v;
-    applied.push(k);
-  }
-  return {
-    path: target,
-    applied,
-    ignored: Object.keys(parsed).length - Object.keys(allowed).length
-  };
+  return s.startsWith(home + path3.sep) ? `~${s.slice(home.length)}` : s;
 }
 
 // scripts/src/lib/passphrase.mjs
@@ -22092,7 +22186,7 @@ function checkExpiry({
 // scripts/src/lib/blacklist.mjs
 import fs4 from "node:fs";
 import path4 from "node:path";
-import crypto4 from "node:crypto";
+import crypto5 from "node:crypto";
 import { fileURLToPath } from "node:url";
 var BlacklistError = class extends Error {
   constructor(code, message) {
@@ -22127,7 +22221,7 @@ function parseBlacklist(doc) {
     }
     addresses.push(e.address);
   }
-  const digest = crypto4.createHash("sha256").update(JSON.stringify(addresses), "utf8").digest("hex");
+  const digest = crypto5.createHash("sha256").update(JSON.stringify(addresses), "utf8").digest("hex");
   if (typeof provenance.addressesSha256 !== "string" || !provenance.addressesSha256) {
     throw new BlacklistError("BLACKLIST_UNAVAILABLE", "Blacklist provenance digest is missing.");
   }
@@ -22215,8 +22309,8 @@ function assertNotBlacklisted(targets, blacklist) {
 // scripts/src/lib/state.mjs
 import fs5 from "node:fs";
 import path5 from "node:path";
-import os2 from "node:os";
-import crypto5 from "node:crypto";
+import os3 from "node:os";
+import crypto6 from "node:crypto";
 var LOCK_STALE_MS = 6e4;
 var LOCK_WAIT_MS = 1e4;
 var LOCK_POLL_MS = 25;
@@ -22246,7 +22340,7 @@ function withLock(fn) {
     try {
       const age = Date.now() - fs5.statSync(file).mtimeMs;
       if (age > LOCK_STALE_MS) {
-        const stolen = `${file}.stale.${crypto5.randomBytes(4).toString("hex")}`;
+        const stolen = `${file}.stale.${crypto6.randomBytes(4).toString("hex")}`;
         try {
           fs5.renameSync(file, stolen);
           fs5.unlinkSync(stolen);
@@ -22276,7 +22370,7 @@ function withLock(fn) {
   }
 }
 function stateRoot() {
-  return process.env.ROZO_CHECKOUT_STATE_DIR || path5.join(os2.homedir(), ".rozo-checkout", "state");
+  return process.env.ROZO_CHECKOUT_STATE_DIR || path5.join(os3.homedir(), ".rozo-checkout", "state");
 }
 function statePath(rozoPaymentId) {
   if (!/^[A-Za-z0-9-]{8,64}$/.test(String(rozoPaymentId || ""))) {
@@ -22287,7 +22381,7 @@ function statePath(rozoPaymentId) {
 function writeAtomic(file, data) {
   const dir = path5.dirname(file);
   fs5.mkdirSync(dir, { recursive: true, mode: 448 });
-  const tmp = path5.join(dir, `.${path5.basename(file)}.${crypto5.randomBytes(6).toString("hex")}.tmp`);
+  const tmp = path5.join(dir, `.${path5.basename(file)}.${crypto6.randomBytes(6).toString("hex")}.tmp`);
   const fd = fs5.openSync(tmp, "wx", 384);
   try {
     fs5.writeFileSync(fd, JSON.stringify(data, null, 2) + "\n", "utf8");
@@ -22326,7 +22420,7 @@ function depositDigest(source) {
     amountUnit: source?.amountUnit ?? null,
     lnInvoice: source?.lnInvoice ?? null
   });
-  return crypto5.createHash("sha256").update(canonical, "utf8").digest("hex");
+  return crypto6.createHash("sha256").update(canonical, "utf8").digest("hex");
 }
 function claimSend(rozoPaymentId, intent, { skipCaps = false } = {}) {
   return withLock(() => {
@@ -22770,7 +22864,11 @@ async function main(argv) {
   const rozoPaymentId = assertRozoPaymentId(args["rozo-payment-id"] || args._[0]);
   assertNoTrackedDotEnv();
   const dotenv = applyDotenv({ file: args["env-file"] });
-  const plan = planKeySource({ family: "evm", keyfile: args.keyfile });
+  const plan = planKeySource({
+    family: "evm",
+    keyfile: args.keyfile,
+    searched: args["env-file"] ? null : envFileCandidates()
+  });
   const loaded = await loadKeySource(plan, { family: "evm", askPassphrase: promptPassphrase });
   const account = privateKeyToAccount(loaded.privateKey);
   const sender = account.address;