@profullstack/coinpay 0.27.0 → 0.27.1

package/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to `@profullstack/coinpay` will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.27.1] - 2026-10-28
+
+### Fixed
+- `coinpay wallet create`, `wallet import` and wallet sign-in failed on every call with
+  `400 INVALID_SIGNATURE`. The proof of ownership was signed over the raw message bytes; the server
+  (noble-curves v2) verifies a signature over sha256(message). `signProofMessage` (now exported) signs
+  that digest, so an agent can make its own non-custodial CoinPay wallet from a shell again.
+- `WalletClient.authenticate()` POSTed to `/web-wallet/auth/challenge`, which only serves GET
+  (`?wallet_id=`); the 405 surfaced as "Unexpected end of JSON input".
+- Wallet API errors printed as `Error: [object Object]`; they now show the server's message and code.
+- `coinpay wallet addresses` was a stub. It now derives the receiving addresses locally from the
+  encrypted seed (`--chains SOL,USDC_POL,ETH`, `--index`, `--json`), ready to paste into a marketplace
+  payout wallet (e.g. `PUT https://ugig.net/api/profile/wallet-addresses`).
+
 ## [0.27.0] - 2026-10-28
 
 ### Added

package/bin/coinpay.js

@@ -13,7 +13,9 @@ import {
   generateMnemonic, 
   validateMnemonic,
   DEFAULT_CHAINS,
+  deriveAddress,
 } from '../src/wallet.js';
+import { mnemonicToSeedSync } from '@scure/bip39';
 import { SwapClient, SwapCoins } from '../src/swap.js';
 import {
   createInvoice,
@@ -2831,8 +2833,41 @@ async function handleWallet(subcommand, args, flags) {
         return;
       }
       
-      print.info(`Wallet: ${config.walletId}`);
-      print.info('Note: Full address list requires API authentication.');
+      // Derived locally from the encrypted seed: nothing leaves this machine.
+      // These are the receiving addresses to hand a marketplace (ugig.net
+      // profile payout wallets, invoices, bounties) so it pays you directly.
+      if (!hasEncryptedWallet(flags)) {
+        print.info(`Wallet: ${config.walletId}`);
+        print.error('No encrypted wallet file found, so no addresses can be derived here.');
+        return;
+      }
+      try {
+        const mnemonic = await getDecryptedMnemonic(flags);
+        const seed = mnemonicToSeedSync(mnemonic.trim());
+        clearString(mnemonic);
+        const chains = (flags.chains ? String(flags.chains).split(',') : DEFAULT_CHAINS)
+          .map((c) => c.trim().toUpperCase())
+          .filter(Boolean);
+        const index = parseInt(flags.index || '0', 10);
+        const addresses = [];
+        for (const chain of chains) {
+          try {
+            addresses.push({ chain, index, address: deriveAddress(seed, chain, index) });
+          } catch (err) {
+            addresses.push({ chain, index, error: err.message });
+          }
+        }
+        if (flags.json) {
+          print.json({ walletId: config.walletId, addresses });
+        } else {
+          print.info(`Wallet: ${config.walletId}`);
+          for (const a of addresses) {
+            console.log(`  ${a.chain.padEnd(9)} ${a.address || a.error}`);
+          }
+        }
+      } catch (error) {
+        print.error(error.message);
+      }
       break;
     }
     

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@profullstack/coinpay",
-  "version": "0.27.0",
+  "version": "0.27.1",
   "description": "CoinPay SDK & CLI — Accept cryptocurrency and card payments (BTC, ETH, SOL, POL, BCH, USDC) with wallet, swap and a live finances dashboard",
   "type": "module",
   "main": "./src/index.js",

package/src/wallet.js

@@ -403,34 +403,36 @@ function getSecp256k1PublicKey(seed) {
 }
 
 /**
- * Sign a message with secp256k1 private key
- * @private
+ * Sign a proof-of-ownership / auth-challenge message with a secp256k1 key,
+ * the way the CoinPay server verifies it.
+ *
+ * The server (src/lib/web-wallet/auth.ts::verifySecp256k1Signature) runs
+ * noble-curves v2, whose `verify(sig, message, pub)` sha256-hashes the message
+ * first (prehash defaults to true). This SDK pins noble-curves v1, whose
+ * `sign(x, key)` treats `x` as an already-hashed digest. So the SDK must hash
+ * explicitly: sign(sha256(message), { prehash: false }) is byte-for-byte what
+ * the server checks, on either major version.
+ *
+ * History: 0.x signed sha256(message) and was right while the server ran v1
+ * (raw verify); a later "fix" switched to raw bytes; the server then moved to
+ * v2 and every `wallet create`, `wallet import` and wallet sign-in from the
+ * SDK/CLI failed with 400 INVALID_SIGNATURE (2026-10).
  */
-function signMessage(message, privateKey) {
-  // Signed over the RAW message bytes, not sha256(message).
-  //
-  // This used to hash first. The server verifies proofs by passing the raw
-  // encoded message straight to `secp256k1.verify` (see
-  // web-wallet/auth.ts::verifySecp256k1Signature), and noble treats that
-  // argument as the thing that was signed — so a signature over the digest
-  // verifies false against the message. Every proof of ownership this SDK
-  // produced was rejected, which meant `WalletClient.fromSeed()` could not
-  // import a wallet at all. Found while wiring the same proof into
-  // `create()` for V-04.
-  const signature = secp256k1.sign(new TextEncoder().encode(message), privateKey);
-  // Handle different noble-curves versions:
-  // v1.x returns Signature object with toCompactHex()
-  // v2.x returns raw Uint8Array directly
+export function signProofMessage(message, privateKey) {
+  const digest = sha256(new TextEncoder().encode(message));
+  const signature = secp256k1.sign(digest, privateKey, { prehash: false });
+  // v1.x returns a Signature object, v2.x a compact Uint8Array.
   if (signature instanceof Uint8Array) {
     return bytesToHex(signature);
   }
   if (typeof signature.toCompactHex === 'function') {
     return signature.toCompactHex();
   }
-  // Fallback: try toCompactRawBytes
   return bytesToHex(signature.toCompactRawBytes());
 }
 
+const signMessage = signProofMessage;
+
 // ================================================================
 // Arbitrary tx / message signing
 // ----------------------------------------------------------------
@@ -795,9 +797,13 @@ export class WalletClient {
       const data = await response.json();
       
       if (!response.ok) {
-        const error = new Error(data.error || `HTTP ${response.status}`);
+        // Web-wallet routes answer { error: { code, message } }; older ones a string.
+        const apiError = data && typeof data.error === 'object' && data.error ? data.error : null;
+        const error = new Error(
+          (apiError ? apiError.message || apiError.code : data.error) || `HTTP ${response.status}`
+        );
         error.status = response.status;
-        error.code = data.code;
+        error.code = apiError?.code ?? data.code;
         error.response = data;
         throw error;
       }
@@ -823,10 +829,11 @@ export class WalletClient {
     }
     
     // Get challenge
-    const challengeRes = await this.#request(`/web-wallet/auth/challenge`, {
-      method: 'POST',
-      body: JSON.stringify({ wallet_id: this.#walletId }),
-    });
+    // The server serves challenges on GET ?wallet_id= (a POST is a 405 with
+    // an empty body, which surfaced as "Unexpected end of JSON input").
+    const challengeRes = await this.#request(
+      `/web-wallet/auth/challenge?wallet_id=${encodeURIComponent(this.#walletId)}`
+    );
     const challenge = challengeRes.data?.challenge || challengeRes.challenge;
     const challengeId = challengeRes.data?.challenge_id || challengeRes.challenge_id;