elizaos-plugin-crewpay 0.1.0 → 0.2.0

package/README.md

@@ -23,11 +23,10 @@ import crewpayPlugin from 'elizaos-plugin-crewpay'
 
 ## Safety
 
-- Always run `CREW_LAUNCH_DRY_RUN` first — it returns a `dryRunToken`
-- `CREW_LAUNCH` requires `dryRunToken` + `humanConfirmed: true` + `confirmPhrase: "APPROVE_SOL_SPEND"` (human-supplied)
-- `CREW_WIRE_FEES` also requires `humanConfirmed` + `APPROVE_SOL_SPEND`
+- Always run `CREW_LAUNCH_DRY_RUN` first — it returns `dryRunId` + `approvalUrl`
+- Human opens `approvalUrl`; then `CREW_LAUNCH` with the same body + `dryRunId`
 - Fee map: **60% KOLs / 15% agent / 25% CrewPay** — buyback cron not live yet
-- Prefer MCP: `npx -y crewpay-mcp@1.2.1` or https://mcp.crewpay.dev/mcp
+- Prefer MCP: `npx -y crewpay-mcp@1.2.3` or https://mcp.crewpay.dev/mcp
 
 ## Links
 

package/dist/client.d.ts

@@ -2,21 +2,17 @@
  * Minimal CrewPay REST client for framework plugins.
  * Keys from env only — never accept private keys as function arguments.
  *
- * Spend gates: dry-run issues a short-lived dryRunToken; launch/wire require that
- * token (launch) plus the exact confirmPhrase APPROVE_SOL_SPEND (not a free-form
- * boolean the model can invent from chat alone).
+ * Spend gate: POST /api/agent/launch/dry-run returns dryRunId + approvalUrl
+ * (no approve secret). Operator opens approvalUrl and wallet-signs.
+ * Launch/wire require dryRunId after approval. Image content is bound by sha256.
  */
 export declare const DEFAULT_API_URL = "https://api.crewpay.dev";
-/** Exact phrase a human must supply for SOL-spending calls. */
-export declare const SOL_SPEND_CONFIRM_PHRASE = "APPROVE_SOL_SPEND";
 export type CrewPayEnv = {
     apiUrl?: string;
     apiKey?: string;
     launcherKey?: string;
 };
 export declare function loadCrewPayEnv(overrides?: CrewPayEnv): Required<Pick<CrewPayEnv, 'apiUrl'>> & CrewPayEnv;
-/** Canonical hash of launch fields so dry-run and launch bodies must match. */
-export declare function hashLaunchBody(body: Record<string, unknown>): string;
 export declare class CrewPayClient {
     private readonly env;
     constructor(env?: ReturnType<typeof loadCrewPayEnv>);
@@ -32,27 +28,19 @@ export declare class CrewPayClient {
         model?: string;
     }): Promise<unknown>;
     autohire(body: Record<string, unknown>): Promise<unknown>;
-    dryRun(body: Record<string, unknown>): Promise<{
-        dryRunToken: string;
-        confirmPhraseRequired: string;
-        tip: string;
-    }>;
-    /**
-     * Real launch — spends SOL. Requires a prior dryRunToken for this body plus
-     * humanConfirmed and confirmPhrase APPROVE_SOL_SPEND.
-     */
+    /** Server dry-run — returns plan + dryRunId + approvalUrl (no approve secret). */
+    dryRun(body: Record<string, unknown>): Promise<unknown>;
     launch(body: Record<string, unknown>, opts: {
-        humanConfirmed: boolean;
-        confirmPhrase: string;
-        dryRunToken: string;
+        dryRunId: string;
     }): Promise<unknown>;
     wireFees(body: {
         mint: string;
         mode?: string;
         crew?: unknown[];
+        name?: string;
+        ticker?: string;
     }, opts: {
-        humanConfirmed: boolean;
-        confirmPhrase: string;
+        dryRunId: string;
     }): Promise<unknown>;
     crank(body: {
         mint: string;

package/dist/client.js

@@ -2,16 +2,11 @@
  * Minimal CrewPay REST client for framework plugins.
  * Keys from env only — never accept private keys as function arguments.
  *
- * Spend gates: dry-run issues a short-lived dryRunToken; launch/wire require that
- * token (launch) plus the exact confirmPhrase APPROVE_SOL_SPEND (not a free-form
- * boolean the model can invent from chat alone).
+ * Spend gate: POST /api/agent/launch/dry-run returns dryRunId + approvalUrl
+ * (no approve secret). Operator opens approvalUrl and wallet-signs.
+ * Launch/wire require dryRunId after approval. Image content is bound by sha256.
  */
-import { createHash, randomBytes } from 'node:crypto';
 export const DEFAULT_API_URL = 'https://api.crewpay.dev';
-/** Exact phrase a human must supply for SOL-spending calls. */
-export const SOL_SPEND_CONFIRM_PHRASE = 'APPROVE_SOL_SPEND';
-const pendingDryRuns = new Map();
-const DRY_RUN_TTL_MS = 30 * 60 * 1000;
 export function loadCrewPayEnv(overrides = {}) {
     return {
         apiUrl: (overrides.apiUrl || process.env.CREW_API_URL || DEFAULT_API_URL).replace(/\/$/, ''),
@@ -24,29 +19,6 @@ export function loadCrewPayEnv(overrides = {}) {
             '',
     };
 }
-/** Canonical hash of launch fields so dry-run and launch bodies must match. */
-export function hashLaunchBody(body) {
-    const pick = {
-        name: body.name,
-        ticker: body.ticker,
-        description: body.description ?? null,
-        mode: body.mode ?? 'agent',
-        initialBuySol: body.initialBuySol ?? 0,
-        imageUrl: body.imageUrl ?? null,
-        autoHire: body.autoHire ?? null,
-        crew: body.crew ?? null,
-        holderKol: body.holderKol ?? false,
-    };
-    return createHash('sha256').update(JSON.stringify(pick)).digest('hex');
-}
-function assertSpendConfirm(opts, action) {
-    if (opts.humanConfirmed !== true) {
-        throw new Error(`${action} blocked: humanConfirmed must be true after an explicit human approval`);
-    }
-    if (opts.confirmPhrase !== SOL_SPEND_CONFIRM_PHRASE) {
-        throw new Error(`${action} blocked: confirmPhrase must be exactly "${SOL_SPEND_CONFIRM_PHRASE}" (human-supplied; do not invent)`);
-    }
-}
 export class CrewPayClient {
     env;
     constructor(env = loadCrewPayEnv()) {
@@ -102,52 +74,36 @@ export class CrewPayClient {
             body: JSON.stringify(body),
         });
     }
-    async dryRun(body) {
-        const data = await this.fetch('/api/agent/launch/dry-run', {
+    /** Server dry-run — returns plan + dryRunId + approvalUrl (no approve secret). */
+    dryRun(body) {
+        return this.fetch('/api/agent/launch/dry-run', {
             method: 'POST',
             auth: true,
             body: JSON.stringify(body),
         });
-        const dryRunToken = randomBytes(16).toString('hex');
-        pendingDryRuns.set(dryRunToken, {
-            bodyHash: hashLaunchBody(body),
-            expiresAt: Date.now() + DRY_RUN_TTL_MS,
-        });
-        return {
-            ...(typeof data === 'object' && data ? data : { result: data }),
-            dryRunToken,
-            confirmPhraseRequired: SOL_SPEND_CONFIRM_PHRASE,
-            tip: `To launch: pass the same body + dryRunToken + humanConfirmed:true + confirmPhrase:"${SOL_SPEND_CONFIRM_PHRASE}" (human must supply the phrase).`,
-        };
     }
-    /**
-     * Real launch — spends SOL. Requires a prior dryRunToken for this body plus
-     * humanConfirmed and confirmPhrase APPROVE_SOL_SPEND.
-     */
     launch(body, opts) {
-        assertSpendConfirm(opts, 'Launch');
-        const pending = pendingDryRuns.get(opts.dryRunToken);
-        if (!pending || pending.expiresAt < Date.now()) {
-            throw new Error('Launch blocked: missing/expired dryRunToken — call dryRun first and reuse its dryRunToken');
-        }
-        if (pending.bodyHash !== hashLaunchBody(body)) {
-            throw new Error('Launch blocked: body does not match the dry-run that issued dryRunToken');
+        const dryRunId = String(opts.dryRunId || '').trim();
+        if (!dryRunId) {
+            throw new Error('Launch blocked: dryRunId required — dry-run, operator wallet-approves on approvalUrl, then launch');
         }
-        pendingDryRuns.delete(opts.dryRunToken);
         return this.fetch('/api/agent/launch', {
             method: 'POST',
             auth: true,
             launcher: true,
-            body: JSON.stringify(body),
+            body: JSON.stringify({ ...body, dryRunId }),
         });
     }
     wireFees(body, opts) {
-        assertSpendConfirm(opts, 'Wire-fees');
+        const dryRunId = String(opts.dryRunId || '').trim();
+        if (!dryRunId) {
+            throw new Error('Wire-fees blocked: dryRunId required — dry-run with intent=wire-fees, wallet-approve, then wire');
+        }
         return this.fetch('/api/agent/wire-fees', {
             method: 'POST',
             auth: true,
             launcher: true,
-            body: JSON.stringify(body),
+            body: JSON.stringify({ ...body, dryRunId }),
         });
     }
     crank(body) {

package/dist/index.d.ts

@@ -1,22 +1,22 @@
 /**
  * ElizaOS plugin scaffold for CrewPay.
- * Docs: https://docs.elizaos.ai/plugins/development
+ * Prefer MCP: npx -y crewpay-mcp@1.2.3 or https://mcp.crewpay.dev/mcp
  *
- * Env: CREWPAY_API_KEY (or CREW_AGENT_API_KEY), optional CREW_LAUNCHER_KEY (burner), CREW_API_URL.
- * Launch/wire require dryRunToken (from dry-run) + confirmPhrase APPROVE_SOL_SPEND + humanConfirmed.
+ * Launch requires dryRunId from CREW_LAUNCH_DRY_RUN after human approval
+ * on the approvalUrl page (no confirm phrase).
  */
-type ActionResult = {
-    success: boolean;
-    text?: string;
-    data?: unknown;
-    error?: string;
-};
 export declare const crewDiscoverAction: {
     name: string;
     similes: string[];
     description: string;
     validate: () => Promise<boolean>;
-    handler: () => Promise<ActionResult>;
+    handler: () => Promise<{
+        success: boolean;
+        data: unknown;
+    } | {
+        success: boolean;
+        error: string;
+    }>;
 };
 export declare const crewAutohireAction: {
     name: string;
@@ -27,7 +27,13 @@ export declare const crewAutohireAction: {
         content?: {
             text?: string;
         };
-    }) => Promise<ActionResult>;
+    }) => Promise<{
+        success: boolean;
+        data: unknown;
+    } | {
+        success: boolean;
+        error: string;
+    }>;
 };
 export declare const crewDryRunAction: {
     name: string;
@@ -38,7 +44,13 @@ export declare const crewDryRunAction: {
         content?: {
             text?: string;
         };
-    }) => Promise<ActionResult>;
+    }) => Promise<{
+        success: boolean;
+        data: unknown;
+    } | {
+        success: boolean;
+        error: string;
+    }>;
 };
 export declare const crewLaunchAction: {
     name: string;
@@ -49,7 +61,13 @@ export declare const crewLaunchAction: {
         content?: {
             text?: string;
         };
-    }) => Promise<ActionResult>;
+    }) => Promise<{
+        success: boolean;
+        data: unknown;
+    } | {
+        success: boolean;
+        error: string;
+    }>;
 };
 export declare const crewWireFeesAction: {
     name: string;
@@ -60,7 +78,13 @@ export declare const crewWireFeesAction: {
         content?: {
             text?: string;
         };
-    }) => Promise<ActionResult>;
+    }) => Promise<{
+        success: boolean;
+        data: unknown;
+    } | {
+        success: boolean;
+        error: string;
+    }>;
 };
 export declare const crewCrankAction: {
     name: string;
@@ -71,14 +95,26 @@ export declare const crewCrankAction: {
         content?: {
             text?: string;
         };
-    }) => Promise<ActionResult>;
+    }) => Promise<{
+        success: boolean;
+        data: unknown;
+    } | {
+        success: boolean;
+        error: string;
+    }>;
 };
 export declare const crewProofAction: {
     name: string;
     similes: string[];
     description: string;
     validate: () => Promise<boolean>;
-    handler: () => Promise<ActionResult>;
+    handler: () => Promise<{
+        success: boolean;
+        data: unknown;
+    } | {
+        success: boolean;
+        error: string;
+    }>;
 };
 export declare const crewpayPlugin: {
     name: string;
@@ -92,7 +128,13 @@ export declare const crewpayPlugin: {
             content?: {
                 text?: string;
             };
-        }) => Promise<ActionResult>;
+        }) => Promise<{
+            success: boolean;
+            data: unknown;
+        } | {
+            success: boolean;
+            error: string;
+        }>;
     }[];
     providers: never[];
     services: never[];

package/dist/index.js

@@ -1,35 +1,34 @@
 /**
  * ElizaOS plugin scaffold for CrewPay.
- * Docs: https://docs.elizaos.ai/plugins/development
+ * Prefer MCP: npx -y crewpay-mcp@1.2.3 or https://mcp.crewpay.dev/mcp
  *
- * Env: CREWPAY_API_KEY (or CREW_AGENT_API_KEY), optional CREW_LAUNCHER_KEY (burner), CREW_API_URL.
- * Launch/wire require dryRunToken (from dry-run) + confirmPhrase APPROVE_SOL_SPEND + humanConfirmed.
+ * Launch requires dryRunId from CREW_LAUNCH_DRY_RUN after human approval
+ * on the approvalUrl page (no confirm phrase).
  */
-import { CrewPayClient, loadCrewPayEnv, SOL_SPEND_CONFIRM_PHRASE, } from './client.js';
+import { CrewPayClient, loadCrewPayEnv } from './client.js';
 function client() {
     return new CrewPayClient(loadCrewPayEnv());
 }
-function ok(data, text) {
-    return { success: true, text: text ?? JSON.stringify(data, null, 2), data };
-}
-function fail(err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return { success: false, error: message, text: message };
-}
 function parseJsonContent(message) {
-    const raw = message.content?.text?.trim() || '{}';
+    const text = message.content?.text?.trim() || '{}';
     try {
-        const parsed = JSON.parse(raw);
+        const parsed = JSON.parse(text);
         return typeof parsed === 'object' && parsed ? parsed : {};
     }
     catch {
         return {};
     }
 }
+function ok(data) {
+    return { success: true, data };
+}
+function fail(e) {
+    return { success: false, error: e instanceof Error ? e.message : String(e) };
+}
 export const crewDiscoverAction = {
     name: 'CREW_DISCOVER',
-    similes: ['CREWPAY_DISCOVER', 'CREW_API_INFO'],
-    description: 'GET CrewPay agent discovery JSON (endpoints, fee map, MCP).',
+    similes: ['CREWPAY_DISCOVER'],
+    description: 'Discover CrewPay agent API, fee map, and MCP surfaces.',
     validate: async () => true,
     handler: async () => {
         try {
@@ -42,8 +41,8 @@ export const crewDiscoverAction = {
 };
 export const crewAutohireAction = {
     name: 'CREW_AUTOHIRE',
-    similes: ['CREWPAY_AUTOHIRE', 'HIRE_KOLS'],
-    description: 'Preview KOL Autohire crew for a name/ticker/description (no SOL).',
+    similes: ['CREWPAY_AUTOHIRE'],
+    description: 'Preview Autohire KOL crew (no SOL).',
     validate: async () => Boolean(loadCrewPayEnv().apiKey),
     handler: async (_runtime, message) => {
         try {
@@ -57,7 +56,7 @@ export const crewAutohireAction = {
 export const crewDryRunAction = {
     name: 'CREW_LAUNCH_DRY_RUN',
     similes: ['CREWPAY_DRY_RUN', 'CREW_DRY_RUN'],
-    description: `Dry-run a CrewPay launch (no mint, no SOL). Returns dryRunToken required for CREW_LAUNCH. Human must later supply confirmPhrase ${SOL_SPEND_CONFIRM_PHRASE}.`,
+    description: 'Dry-run a CrewPay launch (no mint, no SOL). Returns dryRunId + approvalUrl. Human must open approvalUrl before CREW_LAUNCH.',
     validate: async () => Boolean(loadCrewPayEnv().apiKey),
     handler: async (_runtime, message) => {
         try {
@@ -71,18 +70,17 @@ export const crewDryRunAction = {
 export const crewLaunchAction = {
     name: 'CREW_LAUNCH',
     similes: ['CREWPAY_LAUNCH'],
-    description: `MAINNET launch after dry-run. Requires dryRunToken from CREW_LAUNCH_DRY_RUN, humanConfirmed:true, and confirmPhrase:${SOL_SPEND_CONFIRM_PHRASE} (human-supplied). Fee map 60/15/25; buyback not live.`,
+    description: 'MAINNET launch after dry-run. Requires dryRunId from CREW_LAUNCH_DRY_RUN after human approval on approvalUrl. Fee map 60/15/25; buyback not live.',
     validate: async () => Boolean(loadCrewPayEnv().apiKey && loadCrewPayEnv().launcherKey),
     handler: async (_runtime, message) => {
         try {
             const body = parseJsonContent(message);
-            const humanConfirmed = body.humanConfirmed === true;
-            const confirmPhrase = typeof body.confirmPhrase === 'string' ? body.confirmPhrase : '';
-            const dryRunToken = typeof body.dryRunToken === 'string' ? body.dryRunToken : '';
+            const dryRunId = typeof body.dryRunId === 'string' ? body.dryRunId : '';
+            delete body.dryRunId;
             delete body.humanConfirmed;
             delete body.confirmPhrase;
             delete body.dryRunToken;
-            return ok(await client().launch(body, { humanConfirmed, confirmPhrase, dryRunToken }));
+            return ok(await client().launch(body, { dryRunId }));
         }
         catch (e) {
             return fail(e);
@@ -92,16 +90,15 @@ export const crewLaunchAction = {
 export const crewWireFeesAction = {
     name: 'CREW_WIRE_FEES',
     similes: ['CREWPAY_WIRE_FEES'],
-    description: `Wire / repair fee-shares (spends SOL). Requires humanConfirmed:true and confirmPhrase:${SOL_SPEND_CONFIRM_PHRASE}.`,
+    description: 'Wire / repair fee-shares (spends SOL). Requires dryRunId from dry-run intent=wire-fees after wallet approval.',
     validate: async () => Boolean(loadCrewPayEnv().apiKey && loadCrewPayEnv().launcherKey),
     handler: async (_runtime, message) => {
         try {
             const body = parseJsonContent(message);
-            const humanConfirmed = body.humanConfirmed === true;
-            const confirmPhrase = typeof body.confirmPhrase === 'string' ? body.confirmPhrase : '';
             const mint = String(body.mint || '');
             const mode = typeof body.mode === 'string' ? body.mode : undefined;
-            return ok(await client().wireFees({ mint, mode }, { humanConfirmed, confirmPhrase }));
+            const dryRunId = typeof body.dryRunId === 'string' ? body.dryRunId : '';
+            return ok(await client().wireFees({ mint, mode }, { dryRunId }));
         }
         catch (e) {
             return fail(e);
@@ -139,7 +136,7 @@ export const crewProofAction = {
 };
 export const crewpayPlugin = {
     name: 'crewpay',
-    description: 'CrewPay — Solana Pump.fun launches with KOL Autohire and on-chain fee-shares (60/15/25). Buyback not live yet. Dry-run token + APPROVE_SOL_SPEND before launch.',
+    description: 'CrewPay — Solana Pump.fun launches with KOL Autohire and on-chain fee-shares (60/15/25). Buyback not live yet. Dry-run → approvalUrl → launch with dryRunId.',
     actions: [
         crewDiscoverAction,
         crewAutohireAction,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "elizaos-plugin-crewpay",
-  "version": "0.1.0",
-  "description": "ElizaOS plugin for CrewPay \u2014 Solana Pump.fun KOL Autohire + fee-shares (60/15/25). Buyback cron not live. Requires dryRunToken + APPROVE_SOL_SPEND before launch.",
+  "version": "0.2.0",
+  "description": "ElizaOS plugin for CrewPay — Solana Pump.fun KOL Autohire + fee-shares (60/15/25). Buyback cron not live. Dry-run returns dryRunId + approvalUrl before launch.",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -17,8 +17,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "prepublishOnly": "npm run build"
+    "build": "tsc -p tsconfig.json"
   },
   "keywords": [
     "elizaos",
@@ -50,5 +49,6 @@
   },
   "publishConfig": {
     "access": "public"
-  }
+  },
+  "private": false
 }