@profullstack/coinpay 0.26.0 → 0.27.1

package/CHANGELOG.md

@@ -5,6 +5,38 @@ All notable changes to `@profullstack/coinpay` will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.27.1] - 2026-10-28
+
+### Fixed
+- `coinpay wallet create`, `wallet import` and wallet sign-in failed on every call with
+  `400 INVALID_SIGNATURE`. The proof of ownership was signed over the raw message bytes; the server
+  (noble-curves v2) verifies a signature over sha256(message). `signProofMessage` (now exported) signs
+  that digest, so an agent can make its own non-custodial CoinPay wallet from a shell again.
+- `WalletClient.authenticate()` POSTed to `/web-wallet/auth/challenge`, which only serves GET
+  (`?wallet_id=`); the 405 surfaced as "Unexpected end of JSON input".
+- Wallet API errors printed as `Error: [object Object]`; they now show the server's message and code.
+- `coinpay wallet addresses` was a stub. It now derives the receiving addresses locally from the
+  encrypted seed (`--chains SOL,USDC_POL,ETH`, `--index`, `--json`), ready to paste into a marketplace
+  payout wallet (e.g. `PUT https://ugig.net/api/profile/wallet-addresses`).
+
+## [0.27.0] - 2026-10-28
+
+### Added
+- Finance goals: save for a house or a car, build an emergency fund, or pay off a debt, by a deadline.
+  `coinpay finances goals create --name "Down payment" --kind house --target 60000 --deadline 2031-06-30`
+  (`--account <id>` / `--wallet <id>` link real balances; `--start-amount` is what is already saved, or
+  the debt at the start of a payoff goal); `goals list|show|contribute <id> <amount>|sources|archive|delete`.
+  Each goal says on track, behind, achieved or past deadline, and what it takes per day/week/month/quarter
+  to finish on time.
+- `coinpay finances goals report --period daily|weekly|monthly|quarterly`: each goal's change over the
+  trailing period, what the period needed to stay on schedule, and the pace.
+- `coinpay finances goals digest on --cadence monthly`: the opt-in goals report email (daily, weekly,
+  monthly on the 1st, quarterly on Jan/Apr/Jul/Oct 1st); `digest show|off|send-now`.
+- SDK `listGoals`, `getGoal`, `createGoal`, `updateGoal`, `deleteGoal`, `addGoalContribution`,
+  `getGoalSources`, `getGoalsReport`, `getGoalsDigest`, `setGoalsDigest`, `deleteGoalsDigest`,
+  `sendGoalsDigestNow`; MCP `finance_goals`, `finance_goal_create`, `finance_goal_contribute`,
+  `finance_goals_report`, `finance_goals_digest`. Not financial advice; nothing moves money.
+
 ## [0.26.0] - 2026-10-28
 
 ### Added

package/bin/coinpay.js

@@ -13,7 +13,9 @@ import {
   generateMnemonic, 
   validateMnemonic,
   DEFAULT_CHAINS,
+  deriveAddress,
 } from '../src/wallet.js';
+import { mnemonicToSeedSync } from '@scure/bip39';
 import { SwapClient, SwapCoins } from '../src/swap.js';
 import {
   createInvoice,
@@ -728,6 +730,10 @@ ${colors.cyan}Commands:${colors.reset}
                             toCoinPayCosts rows (--source opendevice, --header "K: V" for a URL)
     due-day <id> <1-31|clear>  A card/loan's statement due day (--amount 810.46, or balance)
     daily [show|on|off|send-now]  Daily summary email: spend vs target, top cuts, due soon, position (--hour 7 --to …, --target 100)
+    goals [list|show|create|contribute|report|digest|sources|archive|delete]
+                            Savings and payoff goals (house, car, emergency fund, debt) by a deadline;
+                            progress from linked accounts/wallets or recorded contributions.
+                            report --period daily|weekly|monthly|quarterly · digest on --cadence monthly
 
   ${colors.bright}escrow${colors.reset}
     create                Create a new escrow
@@ -2827,8 +2833,41 @@ async function handleWallet(subcommand, args, flags) {
         return;
       }
       
-      print.info(`Wallet: ${config.walletId}`);
-      print.info('Note: Full address list requires API authentication.');
+      // Derived locally from the encrypted seed: nothing leaves this machine.
+      // These are the receiving addresses to hand a marketplace (ugig.net
+      // profile payout wallets, invoices, bounties) so it pays you directly.
+      if (!hasEncryptedWallet(flags)) {
+        print.info(`Wallet: ${config.walletId}`);
+        print.error('No encrypted wallet file found, so no addresses can be derived here.');
+        return;
+      }
+      try {
+        const mnemonic = await getDecryptedMnemonic(flags);
+        const seed = mnemonicToSeedSync(mnemonic.trim());
+        clearString(mnemonic);
+        const chains = (flags.chains ? String(flags.chains).split(',') : DEFAULT_CHAINS)
+          .map((c) => c.trim().toUpperCase())
+          .filter(Boolean);
+        const index = parseInt(flags.index || '0', 10);
+        const addresses = [];
+        for (const chain of chains) {
+          try {
+            addresses.push({ chain, index, address: deriveAddress(seed, chain, index) });
+          } catch (err) {
+            addresses.push({ chain, index, error: err.message });
+          }
+        }
+        if (flags.json) {
+          print.json({ walletId: config.walletId, addresses });
+        } else {
+          print.info(`Wallet: ${config.walletId}`);
+          for (const a of addresses) {
+            console.log(`  ${a.chain.padEnd(9)} ${a.address || a.error}`);
+          }
+        }
+      } catch (error) {
+        print.error(error.message);
+      }
       break;
     }
     
@@ -5258,7 +5297,9 @@ async function handleFinances(subcommand, args, flags) {
     case 'recurring':
     case 'due-day':
     case 'daily':
-    case 'costs': {
+    case 'costs':
+    case 'goals':
+    case 'goal': {
       const { client } = financesClient();
       const { runFinancesCommand } = await import('../src/finances-commands.js');
       const code = await runFinancesCommand(subcommand, args, flags, {
@@ -5272,7 +5313,7 @@ async function handleFinances(subcommand, args, flags) {
 
     default:
       print.error(`Unknown finances command: ${subcommand}`);
-      console.log('Usage: coinpay finances [tui|summary|accounts|ledger|connections|sync|connect|disconnect|backfill|jobs|coverage|report|reports|statements|books|pnl|payloads|digest|due|recurring|due-day|daily|costs]');
+      console.log('Usage: coinpay finances [tui|summary|accounts|ledger|connections|sync|connect|disconnect|backfill|jobs|coverage|report|reports|statements|books|pnl|payloads|digest|due|recurring|due-day|daily|costs|goals]');
       process.exit(1);
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@profullstack/coinpay",
-  "version": "0.26.0",
+  "version": "0.27.1",
   "description": "CoinPay SDK & CLI — Accept cryptocurrency and card payments (BTC, ETH, SOL, POL, BCH, USDC) with wallet, swap and a live finances dashboard",
   "type": "module",
   "main": "./src/index.js",

package/src/finances-commands.js

@@ -965,6 +965,126 @@ export async function runFinancesCommand(subcommand, args, flags, ctx) {
         throw new CliExit(EXIT.INVALID, 'Usage: coinpay finances costs [list [--source s]|import <file|url> [--source opendevice] [--header "K: V"]|clear --source s --yes]');
       }
 
+      case 'goals':
+      case 'goal': {
+        const action = args[0] || 'list';
+        const usage = 'Usage: coinpay finances goals [list|show <id>|create --name "Down payment" --kind house|car|emergency_fund|debt_payoff|custom --target 60000 --deadline 2031-06-30 [--start-amount 5000] [--account <id>,<id>] [--wallet <id>]|contribute <id> <amount> [--date 2026-10-01] [--note "..."]|report [--period daily|weekly|monthly|quarterly]|digest [show|on --cadence monthly [--hour 8]|off|send-now]|sources|archive <id>|delete <id> --yes]';
+        const money = (cur, n) => new Intl.NumberFormat('en-US', { style: 'currency', currency: cur || 'USD', maximumFractionDigits: 2 }).format(n);
+        const STATUS = { achieved: 'achieved', on_track: 'on track', behind: 'BEHIND', overdue: 'PAST DEADLINE' };
+        const line = (g) => {
+          const s = g.snapshot;
+          const pace = s.status === 'achieved' ? '' : ` · ${money(g.currency, s.required.perMonth)}/mo to finish`;
+          return `  ${g.id.slice(0, 8)}  ${g.name.padEnd(24).slice(0, 24)} ${money(g.currency, s.progress).padStart(12)} / ${money(g.currency, g.targetAmount).padEnd(12)} ${String(s.percent).padStart(5)}%  ${STATUS[s.status].padEnd(13)} by ${g.deadline}${pace}`;
+        };
+        const resolveId = async (prefix) => {
+          if (!prefix) throw new CliExit(EXIT.INVALID, usage);
+          if (/^[0-9a-f-]{36}$/i.test(prefix)) return prefix;
+          const { goals } = await api.listGoals(client, { archived: true });
+          const hits = goals.filter((g) => g.id.startsWith(prefix));
+          if (hits.length !== 1) throw new CliExit(EXIT.INVALID, hits.length ? `"${prefix}" matches ${hits.length} goals; give more of the id` : `No goal ${prefix}`);
+          return hits[0].id;
+        };
+        if (action === 'list') {
+          const data = await api.listGoals(client, { archived: Boolean(flags.archived) });
+          emit(data, data.goals.length ? [`${data.goals.length} goal(s)`, ...data.goals.map(line), '', data.disclaimer].join('\n') : 'No goals yet. Create one: coinpay finances goals create --name "Down payment" --kind house --target 60000 --deadline 2031-06-30');
+          return EXIT.OK;
+        }
+        if (action === 'show') {
+          const data = await api.getGoal(client, await resolveId(args[1]));
+          const g = data.goal;
+          const s = g.snapshot;
+          const text = [
+            `${g.name} (${g.kind}) · ${STATUS[s.status]}`,
+            `  ${money(g.currency, s.progress)} of ${money(g.currency, g.targetAmount)} (${s.percent}%) · started ${g.startDate} · deadline ${g.deadline} (${s.daysLeft} days)`,
+            `  Expected by now: ${money(g.currency, s.expectedByNow)} · remaining ${money(g.currency, s.remaining)}`,
+            `  To finish on time: ${money(g.currency, s.required.perDay)}/day · ${money(g.currency, s.required.perWeek)}/week · ${money(g.currency, s.required.perMonth)}/month · ${money(g.currency, s.required.perQuarter)}/quarter`,
+            s.recentPerMonth !== null ? `  Last 90 days: ${money(g.currency, s.recentPerMonth)}/month${s.projectedDate ? `, lands ${s.projectedDate}` : ''}` : null,
+            data.contributions.length ? `  Contributions: ${data.contributions.slice(0, 10).map((c) => `${c.occurredOn} ${money(g.currency, c.amount)}`).join(', ')}` : null,
+          ].filter(Boolean).join('\n');
+          emit(data, text);
+          return EXIT.OK;
+        }
+        if (action === 'create' || action === 'add') {
+          const goal = {
+            name: typeof flags.name === 'string' ? flags.name : args.slice(1).join(' '),
+            kind: typeof flags.kind === 'string' ? flags.kind : 'custom',
+            targetAmount: flags.target !== undefined ? String(flags.target) : undefined,
+            deadline: typeof flags.deadline === 'string' ? flags.deadline : undefined,
+            currency: typeof flags.currency === 'string' ? flags.currency : undefined,
+            startingAmount: flags['start-amount'] !== undefined ? String(flags['start-amount']) : undefined,
+            linkedAccountIds: flags.account ? listFlag(flags.account) : undefined,
+            linkedWalletIds: flags.wallet ? listFlag(flags.wallet) : undefined,
+            notes: typeof flags.notes === 'string' ? flags.notes : undefined,
+          };
+          if (!goal.name || !goal.deadline) throw new CliExit(EXIT.INVALID, usage);
+          const g = await api.createGoal(client, goal);
+          emit({ goal: g }, `Created ${g.id}\n${g.snapshot ? line(g) : ''}`);
+          return EXIT.OK;
+        }
+        if (action === 'contribute' || action === 'pay') {
+          const id = await resolveId(args[1]);
+          if (args[2] === undefined) throw new CliExit(EXIT.INVALID, usage);
+          const c = await api.addGoalContribution(client, id, { amount: args[2], occurredOn: typeof flags.date === 'string' ? flags.date : undefined, note: typeof flags.note === 'string' ? flags.note : undefined });
+          emit({ contribution: c }, `Recorded ${c.amount} on ${c.occurredOn}. (Recorded only; nothing was moved.)`);
+          return EXIT.OK;
+        }
+        if (action === 'report') {
+          const period = typeof flags.period === 'string' ? flags.period : args[1] || 'weekly';
+          if (!['daily', 'weekly', 'monthly', 'quarterly'].includes(period)) throw new CliExit(EXIT.INVALID, '--period must be daily, weekly, monthly or quarterly');
+          const data = await api.getGoalsReport(client, { period });
+          if (json) { out(JSON.stringify(data.report, null, 2)); return EXIT.OK; }
+          out(data.text);
+          return EXIT.OK;
+        }
+        if (action === 'sources') {
+          const data = await api.getGoalSources(client);
+          emit(data, [
+            'Accounts:',
+            ...data.accounts.map((a) => `  ${a.id}  ${(a.institution ? `${a.institution} · ` : '') + a.name}${a.liability ? ' (debt)' : ''}${a.balance !== null ? `  ${money(a.currency, a.balance)}` : ''}`),
+            'Wallets:',
+            ...(data.wallets.length ? data.wallets.map((w) => `  ${w.walletId}  ${w.label ?? ''}`) : ['  none']),
+          ].join('\n'));
+          return EXIT.OK;
+        }
+        if (action === 'digest') {
+          const sub = args[1] || 'show';
+          const describe = (s) => s
+            ? `Goals report ${s.active ? 'on' : 'off'} · ${s.cadence ?? 'weekly'} at ${String(s.hour).padStart(2, '0')}:00 ${s.timezone} · to ${s.recipients.join(', ')}${s.nextRunAt ? ` · next ${s.nextRunAt}` : ''}`
+            : 'Goals report email is off. Turn it on: coinpay finances goals digest on --cadence monthly';
+          if (sub === 'show') { const s = await api.getGoalsDigest(client); emit({ schedule: s }, describe(s)); return EXIT.OK; }
+          if (sub === 'on') {
+            const s = await api.setGoalsDigest(client, {
+              cadence: typeof flags.cadence === 'string' ? flags.cadence : undefined,
+              hour: flags.hour !== undefined ? Number(flags.hour) : undefined,
+              timezone: typeof flags.timezone === 'string' ? flags.timezone : Intl.DateTimeFormat().resolvedOptions().timeZone,
+              recipients: flags.to ? listFlag(flags.to) : undefined,
+            });
+            emit({ schedule: s }, describe(s));
+            return EXIT.OK;
+          }
+          if (sub === 'off') { const d = await api.deleteGoalsDigest(client); emit(d, 'Goals report email turned off.'); return EXIT.OK; }
+          if (sub === 'send-now') {
+            const d = await api.sendGoalsDigestNow(client);
+            emit(d, `Sent the ${d.period} goals report to ${d.sent.join(', ') || 'nobody'}${d.failed.length ? `; failed: ${d.failed.map((f) => `${f.to} (${f.error})`).join(', ')}` : ''}`);
+            return d.sent.length > 0 ? EXIT.OK : EXIT.FAILURE;
+          }
+          throw new CliExit(EXIT.INVALID, usage);
+        }
+        if (action === 'archive') {
+          const g = await api.updateGoal(client, await resolveId(args[1]), { archived: true });
+          emit({ goal: g }, `Archived ${g.name}.`);
+          return EXIT.OK;
+        }
+        if (action === 'delete') {
+          const id = await resolveId(args[1]);
+          if (!flags.yes) throw new CliExit(EXIT.INVALID, 'This deletes the goal and its recorded contributions. Re-run with --yes to confirm.');
+          const d = await api.deleteGoal(client, id);
+          emit(d, 'Goal deleted.');
+          return EXIT.OK;
+        }
+        throw new CliExit(EXIT.INVALID, usage);
+      }
+
       case 'due-day': {
         const id = args[0];
         const value = args[1];
@@ -1056,4 +1176,4 @@ export async function runFinancesCommand(subcommand, args, flags, ctx) {
   }
 }
 
-export const EXTENDED_SUBCOMMANDS = ['connect', 'disconnect', 'consent', 'backfill', 'jobs', 'coverage', 'report', 'reports', 'statements', 'books', 'pnl', 'profit-loss', 'payloads', 'digest', 'due', 'due-soon', 'recurring', 'due-day', 'daily', 'costs'];
+export const EXTENDED_SUBCOMMANDS = ['connect', 'disconnect', 'consent', 'backfill', 'jobs', 'coverage', 'report', 'reports', 'statements', 'books', 'pnl', 'profit-loss', 'payloads', 'digest', 'due', 'due-soon', 'recurring', 'due-day', 'daily', 'costs', 'goals', 'goal'];

package/src/finances-reports.d.ts

@@ -465,3 +465,59 @@ export function setDailySummary(
 export function deleteDailySummary(client: CoinPayClient): Promise<{ success: boolean }>;
 export function sendDailySummaryNow(client: CoinPayClient): Promise<{ sent: string[]; failed: Array<{ to: string; error: string }>; due: number; overdue: number }>;
 export function setAccountDueDay(client: CoinPayClient, accountId: string, opts: { day: number | null; amount?: number | string | null }): Promise<Record<string, unknown>>;
+
+export type GoalKind = 'house' | 'car' | 'emergency_fund' | 'debt_payoff' | 'custom';
+export type GoalPeriod = 'daily' | 'weekly' | 'monthly' | 'quarterly';
+export type GoalStatus = 'achieved' | 'on_track' | 'behind' | 'overdue';
+export interface GoalSnapshot {
+  progress: number;
+  remaining: number;
+  percent: number;
+  expectedByNow: number;
+  status: GoalStatus;
+  daysLeft: number;
+  required: { perDay: number; perWeek: number; perMonth: number; perQuarter: number };
+  recentPerMonth: number | null;
+  projectedDate: string | null;
+  exact: boolean;
+}
+export interface FinanceGoal {
+  id: string;
+  name: string;
+  kind: GoalKind;
+  targetAmount: number;
+  currency: string;
+  startDate: string;
+  deadline: string;
+  startingAmount: number | null;
+  startProgress: number;
+  linkedAccountIds: string[];
+  linkedWalletIds: string[];
+  notes: string | null;
+  direction: 'save' | 'payoff';
+  snapshot: GoalSnapshot;
+}
+export interface GoalInput {
+  name: string;
+  kind: GoalKind;
+  targetAmount?: number | string;
+  deadline: string;
+  currency?: string;
+  startDate?: string;
+  startingAmount?: number | string | null;
+  linkedAccountIds?: string[];
+  linkedWalletIds?: string[];
+  notes?: string | null;
+}
+export function listGoals(client: CoinPayClient, opts?: { archived?: boolean }): Promise<{ goals: FinanceGoal[]; timezone: string; disclaimer: string }>;
+export function getGoal(client: CoinPayClient, id: string): Promise<{ goal: FinanceGoal; contributions: Array<{ id: string; amount: number; occurredOn: string; note: string | null }> }>;
+export function createGoal(client: CoinPayClient, goal: GoalInput): Promise<FinanceGoal>;
+export function updateGoal(client: CoinPayClient, id: string, patch: Partial<GoalInput> & { archived?: boolean; startProgress?: number }): Promise<FinanceGoal>;
+export function deleteGoal(client: CoinPayClient, id: string): Promise<{ success: boolean }>;
+export function addGoalContribution(client: CoinPayClient, id: string, c: { amount: number | string; occurredOn?: string; note?: string }): Promise<{ id: string; amount: number; occurredOn: string; note: string | null }>;
+export function getGoalSources(client: CoinPayClient): Promise<{ accounts: Array<{ id: string; name: string; institution: string | null; liability: boolean; currency: string; balance: number | null }>; wallets: Array<{ walletId: string; label: string | null }> }>;
+export function getGoalsReport(client: CoinPayClient, opts?: { period?: GoalPeriod }): Promise<{ report: Record<string, unknown>; text: string }>;
+export function getGoalsDigest(client: CoinPayClient): Promise<(WeeklyDigest & { cadence?: GoalPeriod }) | null>;
+export function setGoalsDigest(client: CoinPayClient, opts?: { cadence?: GoalPeriod; hour?: number; timezone?: string; recipients?: string[]; active?: boolean }): Promise<WeeklyDigest & { cadence?: GoalPeriod }>;
+export function deleteGoalsDigest(client: CoinPayClient): Promise<{ success: boolean }>;
+export function sendGoalsDigestNow(client: CoinPayClient): Promise<{ sent: string[]; failed: Array<{ to: string; error: string }>; goals: number; period: GoalPeriod }>;

package/src/finances-reports.js

@@ -530,3 +530,72 @@ export async function setAccountDueDay(client, accountId, { day, amount } = {})
   const data = await call(client, `/finances/accounts/${encodeURIComponent(accountId)}`, { method: 'PATCH', body: JSON.stringify(body) });
   return data.account;
 }
+
+/**
+ * Finance goals: saving toward something or paying something off, by a
+ * deadline. Progress follows linked finance accounts and web wallets, or
+ * contributions recorded by hand. Records only; nothing moves money.
+ */
+export async function listGoals(client, { archived = false } = {}) {
+  return call(client, `/finances/goals${archived ? '?archived=1' : ''}`);
+}
+
+export async function getGoal(client, id) {
+  return call(client, `/finances/goals/${encodeURIComponent(id)}`);
+}
+
+/** `{ name, kind, targetAmount, deadline, currency?, startDate?, startingAmount?, linkedAccountIds?, linkedWalletIds?, notes? }` */
+export async function createGoal(client, goal) {
+  const data = await call(client, '/finances/goals', { method: 'POST', body: JSON.stringify(goal) });
+  return data.goal;
+}
+
+export async function updateGoal(client, id, patch) {
+  const data = await call(client, `/finances/goals/${encodeURIComponent(id)}`, { method: 'PATCH', body: JSON.stringify(patch) });
+  return data.goal;
+}
+
+export async function deleteGoal(client, id) {
+  return call(client, `/finances/goals/${encodeURIComponent(id)}`, { method: 'DELETE' });
+}
+
+/** Record an amount toward a goal (negative = withdrawal). `occurredOn` defaults to today. */
+export async function addGoalContribution(client, id, { amount, occurredOn, note } = {}) {
+  const data = await call(client, `/finances/goals/${encodeURIComponent(id)}/contributions`, {
+    method: 'POST',
+    body: JSON.stringify({ amount, occurredOn, note }),
+  });
+  return data.contribution;
+}
+
+/** What a goal can be linked to: finance accounts and CoinPay web wallets. */
+export async function getGoalSources(client) {
+  return call(client, '/finances/goals/sources');
+}
+
+/** The daily, weekly, monthly or quarterly goals report: `{ report, text }`. */
+export async function getGoalsReport(client, { period = 'weekly' } = {}) {
+  return call(client, `/finances/goals/report?period=${encodeURIComponent(period)}`);
+}
+
+export async function getGoalsDigest(client) {
+  const data = await call(client, '/finances/email-schedules?kind=goals_digest');
+  return data.schedule;
+}
+
+/** Turn the goals report email on at a cadence (daily, weekly, monthly, quarterly). */
+export async function setGoalsDigest(client, { cadence, hour, timezone, recipients, active = true } = {}) {
+  const data = await call(client, '/finances/email-schedules', {
+    method: 'POST',
+    body: JSON.stringify({ kind: 'goals_digest', cadence, hour, timezone, recipients, active }),
+  });
+  return data.schedule;
+}
+
+export async function deleteGoalsDigest(client) {
+  return call(client, '/finances/email-schedules?kind=goals_digest', { method: 'DELETE' });
+}
+
+export async function sendGoalsDigestNow(client) {
+  return call(client, '/finances/email-schedules/send-now?kind=goals_digest', { method: 'POST', body: '{}' });
+}

package/src/mcp.js

@@ -79,6 +79,77 @@ export const TOOLS = [
       return text(await reports.importDeclaredCosts(client, body, { source: args.source || 'opendevice' }));
     },
   },
+  {
+    name: 'finance_goals',
+    description: 'Savings and payoff goals (buy a house or car, emergency fund, pay off debt): each with progress, percent, on track/behind/achieved/past deadline, and what it takes per day/week/month/quarter to finish by the deadline. Not financial advice.',
+    inputSchema: { type: 'object', properties: { archived: { type: 'boolean', description: 'Include archived goals' } }, additionalProperties: false },
+    handler: async (args, { client }) => text(await reports.listGoals(client, { archived: args.archived === true })),
+  },
+  {
+    name: 'finance_goal_create',
+    description: 'Create a goal. kind: house, car, emergency_fund, debt_payoff or custom. Link finance account ids (finance_accounts; debt accounts for a payoff goal) or web wallet ids so progress follows real balances; otherwise progress is startingAmount plus recorded contributions. A payoff goal linked to debt accounts with no startingAmount starts at what they owe now.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        name: { type: 'string' },
+        kind: { type: 'string', enum: ['house', 'car', 'emergency_fund', 'debt_payoff', 'custom'] },
+        targetAmount: { type: ['number', 'string'] },
+        deadline: { type: 'string', description: 'YYYY-MM-DD' },
+        currency: { type: 'string', description: 'Default USD' },
+        startDate: { type: 'string', description: 'YYYY-MM-DD, default today' },
+        startingAmount: { type: ['number', 'string'], description: 'Already saved (save goal) or the debt at the start (payoff goal)' },
+        linkedAccountIds: { type: 'array', items: { type: 'string' } },
+        linkedWalletIds: { type: 'array', items: { type: 'string' } },
+        notes: { type: 'string' },
+      },
+      required: ['name', 'kind', 'deadline'],
+      additionalProperties: false,
+    },
+    handler: async (args, { client }) => text({ goal: await reports.createGoal(client, args) }),
+  },
+  {
+    name: 'finance_goal_contribute',
+    description: 'Record an amount put toward a goal, or a payment on a payoff goal (negative = withdrawal). Records only; moves no money.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        goalId: { type: 'string' },
+        amount: { type: ['number', 'string'] },
+        occurredOn: { type: 'string', description: 'YYYY-MM-DD, default today' },
+        note: { type: 'string' },
+      },
+      required: ['goalId', 'amount'],
+      additionalProperties: false,
+    },
+    handler: async (args, { client }) => text({ contribution: await reports.addGoalContribution(client, args.goalId, { amount: args.amount, occurredOn: args.occurredOn, note: args.note }) }),
+  },
+  {
+    name: 'finance_goals_report',
+    description: 'The goals progress report for the trailing day, week, month or quarter: each goal\'s change in the period, what the period needed to stay on schedule, pace (ahead/on pace/short), and overall status.',
+    inputSchema: { type: 'object', properties: { period: { type: 'string', enum: ['daily', 'weekly', 'monthly', 'quarterly'] } }, additionalProperties: false },
+    handler: async (args, { client }) => text((await reports.getGoalsReport(client, { period: args.period || 'weekly' })).text),
+  },
+  {
+    name: 'finance_goals_digest',
+    description: 'The opt-in goals report email: show it, turn it on at a cadence (daily, weekly, monthly, quarterly; optional hour 0-23 and recipients), turn it off, or send one now.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        action: { type: 'string', enum: ['show', 'on', 'off', 'send_now'] },
+        cadence: { type: 'string', enum: ['daily', 'weekly', 'monthly', 'quarterly'] },
+        hour: { type: 'integer', minimum: 0, maximum: 23 },
+        to: { type: 'array', items: { type: 'string' }, maxItems: 5 },
+      },
+      required: ['action'],
+      additionalProperties: false,
+    },
+    handler: async (args, { client }) => {
+      if (args.action === 'on') return text({ schedule: await reports.setGoalsDigest(client, { cadence: args.cadence, hour: args.hour, recipients: args.to }) });
+      if (args.action === 'off') return text(await reports.deleteGoalsDigest(client));
+      if (args.action === 'send_now') return text(await reports.sendGoalsDigestNow(client));
+      return text({ schedule: await reports.getGoalsDigest(client) });
+    },
+  },
   {
     name: 'finance_summary',
     description: 'Balance sheet (assets, debt, net by currency), cashflow for the window, top spending categories, and the debt-and-income position.',

package/src/wallet.js

@@ -403,34 +403,36 @@ function getSecp256k1PublicKey(seed) {
 }
 
 /**
- * Sign a message with secp256k1 private key
- * @private
+ * Sign a proof-of-ownership / auth-challenge message with a secp256k1 key,
+ * the way the CoinPay server verifies it.
+ *
+ * The server (src/lib/web-wallet/auth.ts::verifySecp256k1Signature) runs
+ * noble-curves v2, whose `verify(sig, message, pub)` sha256-hashes the message
+ * first (prehash defaults to true). This SDK pins noble-curves v1, whose
+ * `sign(x, key)` treats `x` as an already-hashed digest. So the SDK must hash
+ * explicitly: sign(sha256(message), { prehash: false }) is byte-for-byte what
+ * the server checks, on either major version.
+ *
+ * History: 0.x signed sha256(message) and was right while the server ran v1
+ * (raw verify); a later "fix" switched to raw bytes; the server then moved to
+ * v2 and every `wallet create`, `wallet import` and wallet sign-in from the
+ * SDK/CLI failed with 400 INVALID_SIGNATURE (2026-10).
  */
-function signMessage(message, privateKey) {
-  // Signed over the RAW message bytes, not sha256(message).
-  //
-  // This used to hash first. The server verifies proofs by passing the raw
-  // encoded message straight to `secp256k1.verify` (see
-  // web-wallet/auth.ts::verifySecp256k1Signature), and noble treats that
-  // argument as the thing that was signed — so a signature over the digest
-  // verifies false against the message. Every proof of ownership this SDK
-  // produced was rejected, which meant `WalletClient.fromSeed()` could not
-  // import a wallet at all. Found while wiring the same proof into
-  // `create()` for V-04.
-  const signature = secp256k1.sign(new TextEncoder().encode(message), privateKey);
-  // Handle different noble-curves versions:
-  // v1.x returns Signature object with toCompactHex()
-  // v2.x returns raw Uint8Array directly
+export function signProofMessage(message, privateKey) {
+  const digest = sha256(new TextEncoder().encode(message));
+  const signature = secp256k1.sign(digest, privateKey, { prehash: false });
+  // v1.x returns a Signature object, v2.x a compact Uint8Array.
   if (signature instanceof Uint8Array) {
     return bytesToHex(signature);
   }
   if (typeof signature.toCompactHex === 'function') {
     return signature.toCompactHex();
   }
-  // Fallback: try toCompactRawBytes
   return bytesToHex(signature.toCompactRawBytes());
 }
 
+const signMessage = signProofMessage;
+
 // ================================================================
 // Arbitrary tx / message signing
 // ----------------------------------------------------------------
@@ -795,9 +797,13 @@ export class WalletClient {
       const data = await response.json();
       
       if (!response.ok) {
-        const error = new Error(data.error || `HTTP ${response.status}`);
+        // Web-wallet routes answer { error: { code, message } }; older ones a string.
+        const apiError = data && typeof data.error === 'object' && data.error ? data.error : null;
+        const error = new Error(
+          (apiError ? apiError.message || apiError.code : data.error) || `HTTP ${response.status}`
+        );
         error.status = response.status;
-        error.code = data.code;
+        error.code = apiError?.code ?? data.code;
         error.response = data;
         throw error;
       }
@@ -823,10 +829,11 @@ export class WalletClient {
     }
     
     // Get challenge
-    const challengeRes = await this.#request(`/web-wallet/auth/challenge`, {
-      method: 'POST',
-      body: JSON.stringify({ wallet_id: this.#walletId }),
-    });
+    // The server serves challenges on GET ?wallet_id= (a POST is a 405 with
+    // an empty body, which surfaced as "Unexpected end of JSON input").
+    const challengeRes = await this.#request(
+      `/web-wallet/auth/challenge?wallet_id=${encodeURIComponent(this.#walletId)}`
+    );
     const challenge = challengeRes.data?.challenge || challengeRes.challenge;
     const challengeId = challengeRes.data?.challenge_id || challengeRes.challenge_id;