@mint.club/v2-eliza-plugin 2.0.0 → 2.0.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mint Club contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -22,6 +22,8 @@ The plugin exposes nine protocol-specific actions:
 | `SEND_TOKEN` | Send native currency or an ERC-20 token |
 | `CREATE_TOKEN` | Create an ERC-20 bonding curve token |
 
+`CREATE_TOKEN` performs onchain creation through the CLI. Configure logos and website links afterward using the creator wallet on Mint Club; see the [CLI metadata guidance](../cli/README.md#create-a-token). The plugin does not call the metadata API.
+
 There is no general-purpose DEX swap action. Zap routing checks only direct and one-intermediary homogeneous V2/V3/V4 paths by RPC.
 
 ## Setup
@@ -30,7 +32,7 @@ There is no general-purpose DEX swap action. Zap routing checks only direct and
 npm install @mint.club/v2-eliza-plugin
 ```
 
-Requires Node.js 18 or later and an ElizaOS project compatible with `@elizaos/core ^1.7.2`. The plugin installs a compatible `@mint.club/v2-cli` 2.x runtime dependency automatically.
+Requires Node.js 22.13 or later and an ElizaOS project compatible with `@elizaos/core ^1.7.2`. The plugin installs a compatible `@mint.club/v2-cli` 2.x runtime dependency automatically.
 
 Add the plugin to an ElizaOS character configuration:
 
@@ -46,29 +48,39 @@ Read-only actions work without a wallet. Write actions and wallet balances requi
 
 > Never store a key in a character file, commit it, or paste it into an agent conversation. Use a dedicated wallet with limited funds.
 
+A write action runs only when the **original user message** is one affirmative `Confirm:` statement. The parser rejects question-form confirmations, non-ASCII whitespace, control/format/bidirectional characters, negation, cancellation, multiple write clauses, and any unmatched text. The model and plugin must never add this prefix on the user’s behalf; a bare follow-up such as “yes” is insufficient.
+
+Every confirmation must name exactly one chain and bind every effective financial parameter:
+
+- direct buys: `with maximum cost AMOUNT reserve units`
+- direct sells: `with minimum refund AMOUNT reserve units`
+- routed buys/sells: an explicit slippage percentage
+- sends: the native or ERC-20 asset, amount, recipient, and chain
+- token creation: a printable ASCII name without transaction instructions, plus mint and burn royalties in basis points
+
 ## Example prompts
 
 - “Get info about SIGNET.”
 - “What is the price of TOKEN on Robinhood?”
-- “Buy 25 SIGNET.”
-- “Sell 5 SIGNET.”
-- “Buy TOKEN with 10 USDT on Arbitrum with 0.5% slippage.”
-- “Sell 5 TOKEN for USDC on Unichain.”
+- “Confirm: Buy 25 SIGNET on Base with maximum cost 30 reserve units.”
+- “Confirm: Sell 5 SIGNET on Base with minimum refund 4 reserve units.”
+- “Confirm: Buy TOKEN with 10 USDT on Arbitrum with 0.5% slippage.”
+- “Confirm: Sell 5 TOKEN for USDC on Unichain with 1% slippage.”
 - “Show my wallet balance on Polygon.”
-- “Send 10 USDG to `0x1111111111111111111111111111111111111111` on Robinhood.”
-- “Create token \"My Token\" (MYT) backed by USDG with max supply 1000000 using a linear curve from 0.01 to 1 on Robinhood.”
+- “Confirm: Send 10 USDG to `0x1111111111111111111111111111111111111111` on Robinhood.”
+- “Confirm: Create token \"My Token\" (MYT) backed by USDG with max supply 1000000 using a linear curve from 0.01 to 1 on Robinhood with 100 bps mint royalty and 100 bps burn royalty.”
 
-The Zap parser deliberately rejects the ambiguous target-amount form “Buy 10 TOKEN with ETH.” Use “Buy TOKEN with 0.1 ETH” so the exact routed input amount is explicit. Zap slippage defaults to 1% when omitted.
+The Zap parser deliberately rejects the ambiguous target-amount form “Buy 10 TOKEN with ETH.” Use “Buy TOKEN with 0.1 ETH” so the exact routed input amount is explicit. The plugin does not accept an implicit Zap slippage default in a confirmed write.
 
 The target Mint Club token may be ERC-20 or ERC-1155; ERC-1155 amounts must be whole numbers. Routed input/output and `SEND_TOKEN` assets must be native currency or ERC-20 tokens.
 
-The text parser fails closed on explicit max/min or royalty constraints it cannot map without ambiguity. `CREATE_TOKEN` creates ERC-20 tokens with the CLI defaults of 100 basis points (1%) for both mint and burn royalties. Use the CLI when different royalties are required; use the CLI or MCP server for explicit trade limits.
+The text parser fails closed on constraints it cannot map without ambiguity. Direct trade limits use numeric reserve-token units, and token-creation royalties use integer basis points. Use the CLI or MCP server when you need explicit routed minimum-output values instead of percentage slippage.
 
 Supported canonical chain keys:
 
 `ethereum` · `optimism` · `arbitrum` · `avalanche` · `base` · `polygon` · `bsc` · `zora` · `unichain` · `robinhood` · `sepolia` · `base-sepolia`
 
-Natural-language aliases such as “Ethereum mainnet,” “Ethereum Sepolia,” “Base Sepolia,” “Arbitrum One,” “BNB Chain,” and “Robinhood Chain” are loaded from the central registry. Base is the default. Contradictory or multiple positive chain instructions are rejected rather than guessed.
+Natural-language aliases such as “Ethereum mainnet,” “Ethereum Sepolia,” “Base Sepolia,” “Arbitrum One,” “BNB Chain,” and “Robinhood Chain” are loaded from the central registry. Base is the default only for reads; every write confirmation must name one chain explicitly. Contradictory or repeated chain instructions are rejected rather than guessed.
 
 ZapV2 is deployed on every supported chain listed above. Blast is unsupported by this integration.
 

package/dist/commands.js

@@ -2,6 +2,58 @@ import { createRequire } from 'module';
 const require = createRequire(import.meta.url);
 const chainRegistry = require('@mint.club/v2-cli/chain-registry.json');
 export const SUPPORTED_CHAINS = Object.freeze(chainRegistry.chains.map(({ key }) => key));
+function matchSpan(match) {
+    const start = match.index;
+    if (start === undefined)
+        throw new Error('Parser match is missing its source position');
+    return [start, start + match[0].length];
+}
+function assertFullyParsed(text, spans) {
+    const ordered = [...spans].sort(([left], [right]) => left - right);
+    for (let index = 1; index < ordered.length; index += 1) {
+        if (ordered[index][0] < ordered[index - 1][1]) {
+            throw new Error('Confirmed write contains overlapping transaction clauses');
+        }
+    }
+    const remaining = text.split('');
+    for (const [start, end] of spans) {
+        for (let index = start; index < end; index += 1)
+            remaining[index] = ' ';
+    }
+    const unmatched = remaining
+        .join('')
+        .replace(/[.,!?;]+/g, ' ')
+        .trim();
+    if (unmatched) {
+        throw new Error(`Confirmed write contains unsupported or unmatched text: "${unmatched}"`);
+    }
+}
+const WRITE_ACTIONS = new Set([
+    'BUY_TOKEN',
+    'SELL_TOKEN',
+    'ZAP_BUY',
+    'ZAP_SELL',
+    'SEND_TOKEN',
+    'CREATE_TOKEN',
+]);
+const UNSAFE_CONFIRMATION_CHARS = /[^\S ]|[\p{Cc}\p{Cf}\p{Cs}\p{Zl}\p{Zp}]/u;
+const TRANSACTION_NAME_WORDS = /(?:^|[^a-z])(?:buy|mint|sell|burn|send|transfer|create|launch|approve|revoke|execute|confirm)(?=$|[^a-z])/i;
+function confirmationEnvelopeSpan(text) {
+    const confirmation = text.match(/^\s*confirm\s*:\s+/i);
+    if (!confirmation) {
+        throw new Error('Write requests must start with "Confirm:" and repeat the full transaction details');
+    }
+    if (UNSAFE_CONFIRMATION_CHARS.test(text)) {
+        throw new Error('Confirmed writes must use printable text with ASCII spaces; control, formatting, and bidirectional characters are not allowed');
+    }
+    if (text.includes('?')) {
+        throw new Error('Confirmed writes must be affirmative statements, not questions');
+    }
+    if (/\b(?:do\s+not|don['’]?t|not|never|cancel|abort|stop|without|except|no\s+longer)\b/i.test(text)) {
+        throw new Error('Confirmed write must be a single affirmative transaction without negation or cancellation');
+    }
+    return matchSpan(confirmation);
+}
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
@@ -48,17 +100,25 @@ function resolveChainAlias(alias) {
         throw new Error(`Unknown chain alias: ${alias}`);
     return chain;
 }
-function chainArgs(text) {
+function chainSelection(text, strictWrite = false) {
     const negated = new Set();
     const negation = new RegExp(`\\b(?:not|without|except)\\s+(?:on\\s+)?(?:the\\s+)?(${CHAIN_ALIAS_PATTERN})(?:\\s+chain)?\\b`, 'gi');
-    const positiveText = text.replace(negation, (_match, alias) => {
+    const positiveText = text.replace(negation, (match, alias) => {
         negated.add(resolveChainAlias(alias));
-        return ' ';
+        return ' '.repeat(match.length);
     });
+    if (positiveText.length !== text.length) {
+        throw new Error('Chain parser span alignment failed');
+    }
     const mentioned = new Set();
-    const positive = new RegExp(`(?:\\bon\\s+(?:the\\s+)?(${CHAIN_ALIAS_PATTERN})(?:\\s+chain)?\\b|\\b(${CHAIN_ALIAS_PATTERN})\\s+(?:chain|mainnet|wallet|balance|holdings)\\b)`, 'gi');
+    const spans = [];
+    const contextSuffix = strictWrite
+        ? '(?:chain|mainnet)'
+        : '(?:chain|mainnet|wallet|balance|holdings)';
+    const positive = new RegExp(`(?:\\bon\\s+(?:the\\s+)?(${CHAIN_ALIAS_PATTERN})(?:\\s+chain)?\\b|\\b(${CHAIN_ALIAS_PATTERN})\\s+${contextSuffix}\\b)`, 'gi');
     for (const match of positiveText.matchAll(positive)) {
         mentioned.add(resolveChainAlias(match[1] ?? match[2]));
+        spans.push(matchSpan(match));
     }
     const hasConflict = [...mentioned].some((chain) => negated.has(chain));
     if (mentioned.size > 1 ||
@@ -67,7 +127,7 @@ function chainArgs(text) {
         throw new Error(`Specify exactly one chain: ${SUPPORTED_CHAINS.join(', ')}`);
     }
     const selected = mentioned.values().next().value ?? 'base';
-    return ['--chain', selected];
+    return { args: ['--chain', selected], spans, mentionCount: spans.length };
 }
 const TOKEN_PATTERN = '(0x[a-fA-F0-9]{40}|[a-zA-Z][a-zA-Z0-9_-]*)';
 const ASSET_PATTERN = '(native(?:\\s+currency)?|0x[a-fA-F0-9]{40}|[a-zA-Z][a-zA-Z0-9_-]*)';
@@ -80,16 +140,33 @@ function rejectUnsupportedIntent(text, pattern, description) {
         throw new Error(`${description} is not supported by this text parser`);
     }
 }
+function tradeLimitPattern(action) {
+    const limit = action === 'buy'
+        ? 'max(?:imum)?\\s+cost'
+        : 'min(?:imum)?\\s+refund';
+    return new RegExp(`\\bwith\\s+(?:a\\s+)?${limit}\\s+${AMOUNT_PATTERN}\\s+reserve\\s+(?:tokens?|units?)\\b`, 'i');
+}
+function tradeLimitParts(text, action) {
+    const match = text.match(tradeLimitPattern(action));
+    if (!match) {
+        throw new Error(action === 'buy'
+            ? 'Confirmed buy must include "with maximum cost AMOUNT reserve units"'
+            : 'Confirmed sell must include "with minimum refund AMOUNT reserve units"');
+    }
+    return {
+        args: [action === 'buy' ? '--max-cost' : '--min-refund', match[1]],
+        span: matchSpan(match),
+    };
+}
 function tradeParts(text, action) {
-    rejectUnsupportedIntent(text, action === 'buy'
-        ? /\bmax(?:imum)?\s+cost\b/i
-        : /\bmin(?:imum)?\s+refund\b/i, action === 'buy' ? 'Maximum cost' : 'Minimum refund');
     const verbs = action === 'buy' ? '(?:buy|mint)' : '(?:sell|burn)';
     const match = text.match(new RegExp(`\\b${verbs}\\s+${AMOUNT_PATTERN}\\s+(?:of\\s+)?${TOKEN_PATTERN}\\b`, 'i'));
     if (!match) {
         throw new Error('Specify an amount and token, for example: "buy 10 SIGNET"');
     }
-    const trailingText = text.slice((match.index ?? 0) + match[0].length);
+    const trailingText = text
+        .slice((match.index ?? 0) + match[0].length)
+        .replace(tradeLimitPattern(action), ' ');
     const routedIntent = action === 'buy'
         ? /\b(?:with|using|from)\b/i
         : /\b(?:for|to|into)\b/i;
@@ -98,7 +175,7 @@ function tradeParts(text, action) {
             ? 'Use the exact-input form: Buy TOKEN with AMOUNT INPUT_TOKEN'
             : 'Use the routed-output form: Sell AMOUNT TOKEN for OUTPUT_TOKEN');
     }
-    return { amount: match[1], token: match[2] };
+    return { amount: match[1], token: match[2], span: matchSpan(match) };
 }
 function zapBuyParts(text) {
     rejectUnsupportedIntent(text, /\bmin(?:imum)?\s+tokens?\b/i, 'Minimum token output');
@@ -110,6 +187,7 @@ function zapBuyParts(text) {
         token: match[1],
         inputAmount: match[2],
         inputToken: normalizeAsset(match[3]),
+        span: matchSpan(match),
     };
 }
 function zapSellParts(text) {
@@ -122,11 +200,18 @@ function zapSellParts(text) {
         amount: match[1],
         token: match[2],
         outputToken: normalizeAsset(match[3]),
+        span: matchSpan(match),
     };
 }
-function slippageArgs(text) {
+function slippageParts(text) {
     const match = text.match(/\b(?:with|at)?\s*([0-9]+(?:\.[0-9]+)?)\s*%\s+slippage\b/i);
-    return match ? ['--slippage', match[1]] : [];
+    if (!match) {
+        throw new Error('Confirmed routed write must include an explicit slippage percentage');
+    }
+    return {
+        args: ['--slippage', match[1]],
+        spans: [matchSpan(match)],
+    };
 }
 function tokenFromText(text, action) {
     const patterns = action === 'info'
@@ -148,9 +233,9 @@ function tokenFromText(text, action) {
     throw new Error(`Specify a token for ${action}`);
 }
 function sendParts(text, chain) {
-    const match = text.match(new RegExp(`\\b(?:send|transfer)\\s+${AMOUNT_PATTERN}\\s+(?:${ASSET_PATTERN}\\s+)?to\\s+(0x[a-fA-F0-9]{40})\\b`, 'i'));
+    const match = text.match(new RegExp(`\\b(?:send|transfer)\\s+${AMOUNT_PATTERN}\\s+${ASSET_PATTERN}\\s+to\\s+(0x[a-fA-F0-9]{40})\\b`, 'i'));
     if (!match) {
-        throw new Error('Specify amount, optional token, and recipient, for example: "send 10 USDC to 0x..."');
+        throw new Error('Specify amount, token or native asset, and recipient, for example: "send 10 USDC to 0x..."');
     }
     const token = match[2];
     const normalizedToken = token
@@ -175,13 +260,39 @@ function sendParts(text, chain) {
             ? undefined
             : token,
         recipient: match[3],
+        span: matchSpan(match),
+    };
+}
+function royaltyParts(text) {
+    const mint = text.match(/\bwith\s+([0-9]+)\s*(?:bp|bps|basis\s+points?)\s+mint\s+royalt(?:y|ies)\b/i);
+    const burn = text.match(/\band\s+([0-9]+)\s*(?:bp|bps|basis\s+points?)\s+burn\s+royalt(?:y|ies)\b/i);
+    if (!mint || !burn) {
+        throw new Error('Confirmed token creation must include explicit mint and burn royalties in basis points');
+    }
+    for (const value of [mint[1], burn[1]]) {
+        if (Number(value) > 10_000) {
+            throw new Error('Royalty basis points must be between 0 and 10000');
+        }
+    }
+    return {
+        args: [
+            '--mint-royalty',
+            mint[1],
+            '--burn-royalty',
+            burn[1],
+        ],
+        spans: [matchSpan(mint), matchSpan(burn)],
     };
 }
 function createParts(text) {
-    rejectUnsupportedIntent(text, /\b(?:(?:mint|burn)\s+)?royalt(?:y|ies)\b/i, 'Explicit royalty configuration');
-    const match = text.match(/\b(?:create|launch)\s+(?:a\s+)?token\s+"([^"]{1,64})"\s+\(([a-zA-Z][a-zA-Z0-9_-]*)\)\s+backed\s+by\s+(0x[a-fA-F0-9]{40}|[a-zA-Z][a-zA-Z0-9_-]*)\s+with\s+max(?:imum)?\s+supply\s+([0-9]+(?:\.[0-9]+)?)\s+using\s+(?:a\s+)?(linear|exponential|logarithmic|flat)\s+curve\s+from\s+([0-9]+(?:\.[0-9]+)?)\s+to\s+([0-9]+(?:\.[0-9]+)?)\b/i);
+    const match = text.match(/\b(?:create|launch)\s+(?:a\s+)?token\s+"([a-zA-Z0-9][a-zA-Z0-9 ._&()+-]{0,63})"\s+\(([a-zA-Z][a-zA-Z0-9_-]*)\)\s+backed\s+by\s+(0x[a-fA-F0-9]{40}|[a-zA-Z][a-zA-Z0-9_-]*)\s+with\s+max(?:imum)?\s+supply\s+([0-9]+(?:\.[0-9]+)?)\s+using\s+(?:a\s+)?(linear|exponential|logarithmic|flat)\s+curve\s+from\s+([0-9]+(?:\.[0-9]+)?)\s+to\s+([0-9]+(?:\.[0-9]+)?)\b/i);
     if (!match) {
-        throw new Error('Use: create token "Name" (SYMBOL) backed by RESERVE with max supply N using a CURVE curve from START to END');
+        throw new Error('Use a printable ASCII name: create token "Name" (SYMBOL) backed by RESERVE with max supply N using a CURVE curve from START to END');
+    }
+    if (match[1] !== match[1].trim() ||
+        / {2,}/.test(match[1]) ||
+        TRANSACTION_NAME_WORDS.test(match[1])) {
+        throw new Error('Token name must be printable ASCII without transaction instructions');
     }
     return {
         name: match[1],
@@ -191,10 +302,23 @@ function createParts(text) {
         curve: match[5].toLowerCase(),
         initialPrice: match[6],
         finalPrice: match[7],
+        span: matchSpan(match),
     };
 }
+function confirmedWriteArgs(text, argv, spans, chainMentionCount) {
+    const confirmationSpan = confirmationEnvelopeSpan(text);
+    if (chainMentionCount !== 1) {
+        throw new Error(`Confirmed write must specify exactly one chain: ${SUPPORTED_CHAINS.join(', ')}`);
+    }
+    assertFullyParsed(text, [confirmationSpan, ...spans]);
+    return [...argv, '--yes'];
+}
 export function buildActionArgs(action, text) {
-    const prefix = chainArgs(text);
+    const isWrite = WRITE_ACTIONS.has(action);
+    if (isWrite)
+        confirmationEnvelopeSpan(text);
+    const chain = chainSelection(text, isWrite);
+    const prefix = chain.args;
     switch (action) {
         case 'TOKEN_INFO':
             return [...prefix, 'info', tokenFromText(text, 'info')];
@@ -203,53 +327,72 @@ export function buildActionArgs(action, text) {
         case 'WALLET_BALANCE':
             return [...prefix, 'wallet'];
         case 'BUY_TOKEN': {
-            const { token, amount } = tradeParts(text, 'buy');
-            return [...prefix, 'buy', token, '--amount', amount];
+            const parts = tradeParts(text, 'buy');
+            const limit = tradeLimitParts(text, 'buy');
+            return confirmedWriteArgs(text, [
+                ...prefix,
+                'buy',
+                parts.token,
+                '--amount',
+                parts.amount,
+                ...limit.args,
+            ], [...chain.spans, parts.span, limit.span], chain.mentionCount);
         }
         case 'SELL_TOKEN': {
-            const { token, amount } = tradeParts(text, 'sell');
-            return [...prefix, 'sell', token, '--amount', amount];
+            const parts = tradeParts(text, 'sell');
+            const limit = tradeLimitParts(text, 'sell');
+            return confirmedWriteArgs(text, [
+                ...prefix,
+                'sell',
+                parts.token,
+                '--amount',
+                parts.amount,
+                ...limit.args,
+            ], [...chain.spans, parts.span, limit.span], chain.mentionCount);
         }
         case 'ZAP_BUY': {
-            const { token, inputAmount, inputToken } = zapBuyParts(text);
-            return [
+            const parts = zapBuyParts(text);
+            const slippage = slippageParts(text);
+            return confirmedWriteArgs(text, [
                 ...prefix,
                 'zap-buy',
-                token,
+                parts.token,
                 '--input-token',
-                inputToken,
+                parts.inputToken,
                 '--input-amount',
-                inputAmount,
-                ...slippageArgs(text),
-            ];
+                parts.inputAmount,
+                ...slippage.args,
+            ], [...chain.spans, parts.span, ...slippage.spans], chain.mentionCount);
         }
         case 'ZAP_SELL': {
-            const { token, amount, outputToken } = zapSellParts(text);
-            return [
+            const parts = zapSellParts(text);
+            const slippage = slippageParts(text);
+            return confirmedWriteArgs(text, [
                 ...prefix,
                 'zap-sell',
-                token,
+                parts.token,
                 '--amount',
-                amount,
+                parts.amount,
                 '--output-token',
-                outputToken,
-                ...slippageArgs(text),
-            ];
+                parts.outputToken,
+                ...slippage.args,
+            ], [...chain.spans, parts.span, ...slippage.spans], chain.mentionCount);
         }
         case 'SEND_TOKEN': {
-            const { amount, token, recipient } = sendParts(text, prefix[1]);
-            return [
+            const parts = sendParts(text, prefix[1]);
+            return confirmedWriteArgs(text, [
                 ...prefix,
                 'send',
-                recipient,
+                parts.recipient,
                 '--amount',
-                amount,
-                ...(token ? ['--token', token] : []),
-            ];
+                parts.amount,
+                ...(parts.token ? ['--token', parts.token] : []),
+            ], [...chain.spans, parts.span], chain.mentionCount);
         }
         case 'CREATE_TOKEN': {
             const parts = createParts(text);
-            return [
+            const royalties = royaltyParts(text);
+            return confirmedWriteArgs(text, [
                 ...prefix,
                 'create',
                 '--name',
@@ -266,8 +409,8 @@ export function buildActionArgs(action, text) {
                 parts.initialPrice,
                 '--final-price',
                 parts.finalPrice,
-                '--yes',
-            ];
+                ...royalties.args,
+            ], [...chain.spans, parts.span, ...royalties.spans], chain.mentionCount);
         }
     }
 }

package/dist/plugin.js

@@ -105,7 +105,7 @@ const buyTokenAction = createAction({
     description: 'Mint a token with its Bond reserve ERC-20',
     validateText: (text) => canBuildActionArgs('BUY_TOKEN', text) &&
         !canBuildActionArgs('ZAP_BUY', text),
-    examplePrompt: 'Buy 10 SIGNET',
+    examplePrompt: 'Confirm: Buy 10 SIGNET on Base with maximum cost 12 reserve units',
     exampleResult: 'Minted 10 SIGNET through MCV2_Bond.',
 });
 const sellTokenAction = createAction({
@@ -114,7 +114,7 @@ const sellTokenAction = createAction({
     description: 'Burn a token for its Bond reserve ERC-20',
     validateText: (text) => canBuildActionArgs('SELL_TOKEN', text) &&
         !canBuildActionArgs('ZAP_SELL', text),
-    examplePrompt: 'Sell 5 SIGNET',
+    examplePrompt: 'Confirm: Sell 5 SIGNET on Base with minimum refund 4 reserve units',
     exampleResult: 'Burned 5 SIGNET through MCV2_Bond.',
 });
 const zapBuyAction = createAction({
@@ -122,7 +122,7 @@ const zapBuyAction = createAction({
     similes: ['BUY_WITH_ASSET', 'MINT_WITH_ASSET', 'ROUTED_MINT'],
     description: 'Mint a Mint Club token from an exact amount of a routed native/ERC-20 asset via MCV2_ZapV2',
     validateText: (text) => canBuildActionArgs('ZAP_BUY', text),
-    examplePrompt: 'Buy TOKEN with 10 USDC on Arbitrum',
+    examplePrompt: 'Confirm: Buy TOKEN with 10 USDC on Arbitrum with 1% slippage',
     exampleResult: 'Minted TOKEN from 10 USDC through MCV2_ZapV2.',
 });
 const zapSellAction = createAction({
@@ -130,7 +130,7 @@ const zapSellAction = createAction({
     similes: ['SELL_FOR_ASSET', 'BURN_TO_ASSET', 'ROUTED_BURN'],
     description: 'Burn a Mint Club token into a routed native/ERC-20 output asset via MCV2_ZapV2',
     validateText: (text) => canBuildActionArgs('ZAP_SELL', text),
-    examplePrompt: 'Sell 5 TOKEN for USDC on Unichain',
+    examplePrompt: 'Confirm: Sell 5 TOKEN for USDC on Unichain with 1% slippage',
     exampleResult: 'Burned 5 TOKEN into USDC through MCV2_ZapV2.',
 });
 const walletBalanceAction = createAction({
@@ -146,7 +146,7 @@ const sendTokenAction = createAction({
     similes: ['TRANSFER_TOKEN', 'SEND_ASSET'],
     description: 'Send native currency or an ERC-20 token to an address',
     validateText: (text) => canBuildActionArgs('SEND_TOKEN', text),
-    examplePrompt: 'Send 10 USDG to 0x1111111111111111111111111111111111111111 on Robinhood',
+    examplePrompt: 'Confirm: Send 10 USDG to 0x1111111111111111111111111111111111111111 on Robinhood',
     exampleResult: 'Sent 10 USDG on Robinhood Chain.',
 });
 const createTokenAction = createAction({
@@ -154,7 +154,7 @@ const createTokenAction = createAction({
     similes: ['LAUNCH_TOKEN', 'CREATE_BONDING_CURVE'],
     description: 'Create an ERC-20 Mint Club V2 bonding curve token',
     validateText: (text) => canBuildActionArgs('CREATE_TOKEN', text),
-    examplePrompt: 'Create token "My Token" (MYT) backed by USDG with max supply 1000000 using a linear curve from 0.01 to 1 on Robinhood',
+    examplePrompt: 'Confirm: Create token "My Token" (MYT) backed by USDG with max supply 1000000 using a linear curve from 0.01 to 1 on Robinhood with 100 bps mint royalty and 100 bps burn royalty',
     exampleResult: 'Created the MYT bonding curve token on Robinhood Chain.',
 });
 const mintclubProvider = {
@@ -170,9 +170,10 @@ const mintclubProvider = {
             '- SEND_TOKEN: send native currency or ERC-20 tokens',
             '- CREATE_TOKEN: create an ERC-20 bonding curve token',
             '',
-            `Supported chains: ${SUPPORTED_CHAINS.join(', ')}. Base is the default.`,
+            `Supported chains: ${SUPPORTED_CHAINS.join(', ')}. Base is the default for reads; writes require exactly one explicit chain.`,
             'Zap routing enumerates direct and one-intermediary V2/V3/V4 candidates and uses the configured per-chain ZapV2 deployment.',
-            'The compatible mc CLI is installed as a plugin dependency; write actions require PRIVATE_KEY or the CLI wallet file.',
+            `Write actions run only when the original user message is one affirmative "Confirm:" statement that repeats the full transaction details; never add this prefix on the user's behalf. Direct trades require max-cost/min-refund reserve units, routed trades require slippage, sends require an asset, and creation requires a printable ASCII name without transaction instructions plus mint/burn royalty basis points.`,
+            'The compatible mc CLI is installed as a plugin dependency; writes also require PRIVATE_KEY or the CLI wallet file.',
         ].join('\n'),
         values: {
             platform: 'Mint Club V2',

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@mint.club/v2-eliza-plugin",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "description": "ElizaOS plugin for Mint Club V2 Bond operations and bounded local Uniswap ZapV2 routing across supported chains",
   "files": [
-    "dist",
-    "README.md"
+    "dist/",
+    "README.md",
+    "LICENSE"
   ],
   "type": "module",
   "main": "dist/index.js",
@@ -17,7 +18,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@mint.club/v2-cli": "^2.0.0",
+    "@mint.club/v2-cli": "^2.0.2",
     "zod": "^4.3.5"
   },
   "peerDependencies": {
@@ -46,10 +47,13 @@
     "@elizaos/core": "^1.7.2",
     "@types/node": "^22.0.0",
     "typescript": "^5.0.0",
-    "vitest": "^2.1.9"
+    "vitest": "^3.2.7"
   },
   "license": "MIT",
   "publishConfig": {
     "access": "public"
+  },
+  "engines": {
+    "node": ">=22.13.0"
   }
 }