crewpay-goat-plugin 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 CrewPay / fxams
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,39 @@
-# Temporary Holding Version
+# crewpay-goat-plugin
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+GOAT SDK plugin for [CrewPay](https://crewpay.dev).
+
+```bash
+npm i crewpay-goat-plugin
+```
+
+```ts
+import { crewpay } from 'crewpay-goat-plugin'
+
+const plugin = crewpay()
+const dry = await plugin.service.crewpay_launch_dry_run({
+  name: 'Desk Cat',
+  ticker: 'DCAT',
+  autoHire: { seats: 3 },
+})
+// human confirms…
+await plugin.service.crewpay_launch({
+  name: 'Desk Cat',
+  ticker: 'DCAT',
+  autoHire: { seats: 3 },
+  dryRunToken: dry.dryRunToken,
+  humanConfirmed: true,
+  confirmPhrase: 'APPROVE_SOL_SPEND',
+})
+```
+
+Prefer `npx -y crewpay-mcp@1.2.1` for local signing; hosted MCP `https://mcp.crewpay.dev/mcp` for discover/autohire without a launcher secret.
+
+## Safety
+
+- Fee map **60/15/25**; buyback cron not live yet
+- Launch/wire require dry-run token + exact phrase `APPROVE_SOL_SPEND`
+
+## Links
+
+- Source: https://github.com/fxams/goat-plugin-crewpay
+- Upstream: https://github.com/goat-sdk/goat

package/dist/client.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Minimal CrewPay REST client for framework plugins.
+ * Keys from env only — never accept private keys as function arguments.
+ *
+ * Spend gates: dry-run issues a short-lived dryRunToken; launch/wire require that
+ * token (launch) plus the exact confirmPhrase APPROVE_SOL_SPEND (not a free-form
+ * boolean the model can invent from chat alone).
+ */
+export declare const DEFAULT_API_URL = "https://api.crewpay.dev";
+/** Exact phrase a human must supply for SOL-spending calls. */
+export declare const SOL_SPEND_CONFIRM_PHRASE = "APPROVE_SOL_SPEND";
+export type CrewPayEnv = {
+    apiUrl?: string;
+    apiKey?: string;
+    launcherKey?: string;
+};
+export declare function loadCrewPayEnv(overrides?: CrewPayEnv): Required<Pick<CrewPayEnv, 'apiUrl'>> & CrewPayEnv;
+/** Canonical hash of launch fields so dry-run and launch bodies must match. */
+export declare function hashLaunchBody(body: Record<string, unknown>): string;
+export declare class CrewPayClient {
+    private readonly env;
+    constructor(env?: ReturnType<typeof loadCrewPayEnv>);
+    private headers;
+    fetch(path: string, init?: RequestInit & {
+        auth?: boolean;
+        launcher?: boolean;
+    }): Promise<unknown>;
+    discover(): Promise<unknown>;
+    claimKey(body?: {
+        label?: string;
+        agentName?: string;
+        model?: string;
+    }): Promise<unknown>;
+    autohire(body: Record<string, unknown>): Promise<unknown>;
+    dryRun(body: Record<string, unknown>): Promise<{
+        dryRunToken: string;
+        confirmPhraseRequired: string;
+        tip: string;
+    }>;
+    /**
+     * Real launch — spends SOL. Requires a prior dryRunToken for this body plus
+     * humanConfirmed and confirmPhrase APPROVE_SOL_SPEND.
+     */
+    launch(body: Record<string, unknown>, opts: {
+        humanConfirmed: boolean;
+        confirmPhrase: string;
+        dryRunToken: string;
+    }): Promise<unknown>;
+    wireFees(body: {
+        mint: string;
+        mode?: string;
+        crew?: unknown[];
+    }, opts: {
+        humanConfirmed: boolean;
+        confirmPhrase: string;
+    }): Promise<unknown>;
+    crank(body: {
+        mint: string;
+    }): Promise<unknown>;
+    proof(): Promise<unknown>;
+}

package/dist/client.js

@@ -0,0 +1,163 @@
+/**
+ * Minimal CrewPay REST client for framework plugins.
+ * Keys from env only — never accept private keys as function arguments.
+ *
+ * Spend gates: dry-run issues a short-lived dryRunToken; launch/wire require that
+ * token (launch) plus the exact confirmPhrase APPROVE_SOL_SPEND (not a free-form
+ * boolean the model can invent from chat alone).
+ */
+import { createHash, randomBytes } from 'node:crypto';
+export const DEFAULT_API_URL = 'https://api.crewpay.dev';
+/** Exact phrase a human must supply for SOL-spending calls. */
+export const SOL_SPEND_CONFIRM_PHRASE = 'APPROVE_SOL_SPEND';
+const pendingDryRuns = new Map();
+const DRY_RUN_TTL_MS = 30 * 60 * 1000;
+export function loadCrewPayEnv(overrides = {}) {
+    return {
+        apiUrl: (overrides.apiUrl || process.env.CREW_API_URL || DEFAULT_API_URL).replace(/\/$/, ''),
+        apiKey: overrides.apiKey ||
+            process.env.CREWPAY_API_KEY?.trim() ||
+            process.env.CREW_AGENT_API_KEY?.trim() ||
+            '',
+        launcherKey: overrides.launcherKey ||
+            process.env.CREW_LAUNCHER_KEY?.trim() ||
+            '',
+    };
+}
+/** Canonical hash of launch fields so dry-run and launch bodies must match. */
+export function hashLaunchBody(body) {
+    const pick = {
+        name: body.name,
+        ticker: body.ticker,
+        description: body.description ?? null,
+        mode: body.mode ?? 'agent',
+        initialBuySol: body.initialBuySol ?? 0,
+        imageUrl: body.imageUrl ?? null,
+        autoHire: body.autoHire ?? null,
+        crew: body.crew ?? null,
+        holderKol: body.holderKol ?? false,
+    };
+    return createHash('sha256').update(JSON.stringify(pick)).digest('hex');
+}
+function assertSpendConfirm(opts, action) {
+    if (opts.humanConfirmed !== true) {
+        throw new Error(`${action} blocked: humanConfirmed must be true after an explicit human approval`);
+    }
+    if (opts.confirmPhrase !== SOL_SPEND_CONFIRM_PHRASE) {
+        throw new Error(`${action} blocked: confirmPhrase must be exactly "${SOL_SPEND_CONFIRM_PHRASE}" (human-supplied; do not invent)`);
+    }
+}
+export class CrewPayClient {
+    env;
+    constructor(env = loadCrewPayEnv()) {
+        this.env = env;
+    }
+    headers(opts) {
+        const h = new Headers({ accept: 'application/json', 'content-type': 'application/json' });
+        if (this.env.apiKey)
+            h.set('x-crew-api-key', this.env.apiKey);
+        if (opts?.launcher) {
+            if (!this.env.launcherKey) {
+                throw new Error('Missing CREW_LAUNCHER_KEY in env — use a dedicated low-SOL burner. Never pass secrets as arguments.');
+            }
+            h.set('x-launcher-key', this.env.launcherKey);
+        }
+        return h;
+    }
+    async fetch(path, init) {
+        const headers = this.headers({ launcher: init?.launcher });
+        if (init?.auth && !this.env.apiKey) {
+            throw new Error('Missing CREWPAY_API_KEY / CREW_AGENT_API_KEY — claim via POST /api/agent/keys/claim');
+        }
+        const res = await fetch(`${this.env.apiUrl}${path}`, { ...init, headers });
+        const text = await res.text();
+        let json = null;
+        try {
+            json = text ? JSON.parse(text) : null;
+        }
+        catch {
+            json = { raw: text.slice(0, 500) };
+        }
+        if (!res.ok) {
+            const err = typeof json === 'object' && json && 'error' in json
+                ? String(json.error)
+                : text.slice(0, 300);
+            throw new Error(`CREW API ${res.status}: ${err}`);
+        }
+        return json;
+    }
+    discover() {
+        return this.fetch('/api/agent');
+    }
+    claimKey(body = {}) {
+        return this.fetch('/api/agent/keys/claim', {
+            method: 'POST',
+            body: JSON.stringify({ label: 'agent', ...body }),
+        });
+    }
+    autohire(body) {
+        return this.fetch('/api/agent/autohire', {
+            method: 'POST',
+            auth: true,
+            body: JSON.stringify(body),
+        });
+    }
+    async dryRun(body) {
+        const data = await this.fetch('/api/agent/launch/dry-run', {
+            method: 'POST',
+            auth: true,
+            body: JSON.stringify(body),
+        });
+        const dryRunToken = randomBytes(16).toString('hex');
+        pendingDryRuns.set(dryRunToken, {
+            bodyHash: hashLaunchBody(body),
+            expiresAt: Date.now() + DRY_RUN_TTL_MS,
+        });
+        return {
+            ...(typeof data === 'object' && data ? data : { result: data }),
+            dryRunToken,
+            confirmPhraseRequired: SOL_SPEND_CONFIRM_PHRASE,
+            tip: `To launch: pass the same body + dryRunToken + humanConfirmed:true + confirmPhrase:"${SOL_SPEND_CONFIRM_PHRASE}" (human must supply the phrase).`,
+        };
+    }
+    /**
+     * Real launch — spends SOL. Requires a prior dryRunToken for this body plus
+     * humanConfirmed and confirmPhrase APPROVE_SOL_SPEND.
+     */
+    launch(body, opts) {
+        assertSpendConfirm(opts, 'Launch');
+        const pending = pendingDryRuns.get(opts.dryRunToken);
+        if (!pending || pending.expiresAt < Date.now()) {
+            throw new Error('Launch blocked: missing/expired dryRunToken — call dryRun first and reuse its dryRunToken');
+        }
+        if (pending.bodyHash !== hashLaunchBody(body)) {
+            throw new Error('Launch blocked: body does not match the dry-run that issued dryRunToken');
+        }
+        pendingDryRuns.delete(opts.dryRunToken);
+        return this.fetch('/api/agent/launch', {
+            method: 'POST',
+            auth: true,
+            launcher: true,
+            body: JSON.stringify(body),
+        });
+    }
+    wireFees(body, opts) {
+        assertSpendConfirm(opts, 'Wire-fees');
+        return this.fetch('/api/agent/wire-fees', {
+            method: 'POST',
+            auth: true,
+            launcher: true,
+            body: JSON.stringify(body),
+        });
+    }
+    crank(body) {
+        return this.fetch('/api/agent/crank', {
+            method: 'POST',
+            auth: true,
+            body: JSON.stringify(body),
+        });
+    }
+    proof() {
+        return this.fetch('/api/proof');
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,43 @@
+/**
+ * GOAT SDK plugin scaffold for CrewPay.
+ * Prefer MCP: npx -y crewpay-mcp@1.2.1 or https://mcp.crewpay.dev/mcp
+ */
+export type CrewPayGoatOptions = {
+    apiUrl?: string;
+    apiKey?: string;
+};
+export declare class CrewPayGoatService {
+    private readonly opts;
+    constructor(opts?: CrewPayGoatOptions);
+    crewpay_discover(): Promise<unknown>;
+    crewpay_autohire(params: Record<string, unknown>): Promise<unknown>;
+    crewpay_launch_dry_run(params: Record<string, unknown>): Promise<{
+        dryRunToken: string;
+        confirmPhraseRequired: string;
+        tip: string;
+    }>;
+    /**
+     * Spends SOL. Requires dryRunToken from dry-run + confirmPhrase APPROVE_SOL_SPEND + humanConfirmed.
+     */
+    crewpay_launch(params: Record<string, unknown> & {
+        humanConfirmed?: boolean;
+        confirmPhrase?: string;
+        dryRunToken?: string;
+    }): Promise<unknown>;
+    crewpay_wire_fees(params: {
+        mint: string;
+        mode?: string;
+        humanConfirmed?: boolean;
+        confirmPhrase?: string;
+    }): Promise<unknown>;
+    crewpay_crank(params: {
+        mint: string;
+    }): Promise<unknown>;
+    crewpay_proof(): Promise<unknown>;
+}
+export declare function crewpay(options?: CrewPayGoatOptions): {
+    name: string;
+    description: string;
+    service: CrewPayGoatService;
+};
+export default crewpay;

package/dist/index.js

@@ -0,0 +1,55 @@
+/**
+ * GOAT SDK plugin scaffold for CrewPay.
+ * Prefer MCP: npx -y crewpay-mcp@1.2.1 or https://mcp.crewpay.dev/mcp
+ */
+import { CrewPayClient, loadCrewPayEnv, SOL_SPEND_CONFIRM_PHRASE, } from './client.js';
+function api(opts = {}) {
+    return new CrewPayClient(loadCrewPayEnv(opts));
+}
+export class CrewPayGoatService {
+    opts;
+    constructor(opts = {}) {
+        this.opts = opts;
+    }
+    async crewpay_discover() {
+        return api(this.opts).discover();
+    }
+    async crewpay_autohire(params) {
+        return api(this.opts).autohire(params);
+    }
+    async crewpay_launch_dry_run(params) {
+        return api(this.opts).dryRun(params);
+    }
+    /**
+     * Spends SOL. Requires dryRunToken from dry-run + confirmPhrase APPROVE_SOL_SPEND + humanConfirmed.
+     */
+    async crewpay_launch(params) {
+        const { humanConfirmed, confirmPhrase, dryRunToken, ...rest } = params;
+        return api(this.opts).launch(rest, {
+            humanConfirmed: humanConfirmed === true,
+            confirmPhrase: confirmPhrase || '',
+            dryRunToken: dryRunToken || '',
+        });
+    }
+    async crewpay_wire_fees(params) {
+        const { humanConfirmed, confirmPhrase, mint, mode } = params;
+        return api(this.opts).wireFees({ mint, mode }, {
+            humanConfirmed: humanConfirmed === true,
+            confirmPhrase: confirmPhrase || '',
+        });
+    }
+    async crewpay_crank(params) {
+        return api(this.opts).crank(params);
+    }
+    async crewpay_proof() {
+        return api(this.opts).proof();
+    }
+}
+export function crewpay(options = {}) {
+    return {
+        name: 'crewpay',
+        description: `CrewPay — Pump.fun KOL Autohire + fee-shares (60/15/25). Buyback not live. Dry-run token + ${SOL_SPEND_CONFIRM_PHRASE} before launch.`,
+        service: new CrewPayGoatService(options),
+    };
+}
+export default crewpay;

package/package.json

@@ -1,6 +1,49 @@
 {
   "name": "crewpay-goat-plugin",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "GOAT SDK plugin for CrewPay REST tools. Fee map 60/15/25; buyback not live; dryRunToken + APPROVE_SOL_SPEND before launch.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "goat-sdk",
+    "crewpay",
+    "solana",
+    "pump.fun",
+    "ai-agent"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/fxams/goat-plugin-crewpay.git"
+  },
+  "homepage": "https://crewpay.dev/agents",
+  "peerDependencies": {
+    "@goat-sdk/core": "*"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "typescript": "^5.7.0"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}