@profullstack/coinpay 0.27.0 → 0.28.0

package/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to `@profullstack/coinpay` will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.28.0] - 2026-10-29
+
+### Added
+- `coinpay finances goals edit <id>` changes any field of a goal (`--name`, `--kind`, `--target`,
+  `--deadline`, `--start`, `--start-amount n|none`, `--notes "..."|none`) and which accounts or wallets
+  count (`--account <id>,<id>` replaces the list, `--account none` unlinks all).
+- `coinpay finances goals unarchive <id>`. Archived goals are hidden from `goals list` (unless
+  `--archived`) and left out of the report and the goals email.
+- `goals show` prints what the progress is made of: every linked account with its amount, flagged when
+  its balance is over a week old. `FinanceGoal.sources` / `GoalSource` in the types.
+- MCP: `finance_goal_update` (edit, relink, archive/unarchive) and `finance_goal_delete`.
+
+## [0.27.1] - 2026-10-28
+
+### Fixed
+- `coinpay wallet create`, `wallet import` and wallet sign-in failed on every call with
+  `400 INVALID_SIGNATURE`. The proof of ownership was signed over the raw message bytes; the server
+  (noble-curves v2) verifies a signature over sha256(message). `signProofMessage` (now exported) signs
+  that digest, so an agent can make its own non-custodial CoinPay wallet from a shell again.
+- `WalletClient.authenticate()` POSTed to `/web-wallet/auth/challenge`, which only serves GET
+  (`?wallet_id=`); the 405 surfaced as "Unexpected end of JSON input".
+- Wallet API errors printed as `Error: [object Object]`; they now show the server's message and code.
+- `coinpay wallet addresses` was a stub. It now derives the receiving addresses locally from the
+  encrypted seed (`--chains SOL,USDC_POL,ETH`, `--index`, `--json`), ready to paste into a marketplace
+  payout wallet (e.g. `PUT https://ugig.net/api/profile/wallet-addresses`).
+
 ## [0.27.0] - 2026-10-28
 
 ### Added

package/bin/coinpay.js

@@ -13,7 +13,9 @@ import {
   generateMnemonic, 
   validateMnemonic,
   DEFAULT_CHAINS,
+  deriveAddress,
 } from '../src/wallet.js';
+import { mnemonicToSeedSync } from '@scure/bip39';
 import { SwapClient, SwapCoins } from '../src/swap.js';
 import {
   createInvoice,
@@ -2831,8 +2833,41 @@ async function handleWallet(subcommand, args, flags) {
         return;
       }
       
-      print.info(`Wallet: ${config.walletId}`);
-      print.info('Note: Full address list requires API authentication.');
+      // Derived locally from the encrypted seed: nothing leaves this machine.
+      // These are the receiving addresses to hand a marketplace (ugig.net
+      // profile payout wallets, invoices, bounties) so it pays you directly.
+      if (!hasEncryptedWallet(flags)) {
+        print.info(`Wallet: ${config.walletId}`);
+        print.error('No encrypted wallet file found, so no addresses can be derived here.');
+        return;
+      }
+      try {
+        const mnemonic = await getDecryptedMnemonic(flags);
+        const seed = mnemonicToSeedSync(mnemonic.trim());
+        clearString(mnemonic);
+        const chains = (flags.chains ? String(flags.chains).split(',') : DEFAULT_CHAINS)
+          .map((c) => c.trim().toUpperCase())
+          .filter(Boolean);
+        const index = parseInt(flags.index || '0', 10);
+        const addresses = [];
+        for (const chain of chains) {
+          try {
+            addresses.push({ chain, index, address: deriveAddress(seed, chain, index) });
+          } catch (err) {
+            addresses.push({ chain, index, error: err.message });
+          }
+        }
+        if (flags.json) {
+          print.json({ walletId: config.walletId, addresses });
+        } else {
+          print.info(`Wallet: ${config.walletId}`);
+          for (const a of addresses) {
+            console.log(`  ${a.chain.padEnd(9)} ${a.address || a.error}`);
+          }
+        }
+      } catch (error) {
+        print.error(error.message);
+      }
       break;
     }
     

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@profullstack/coinpay",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "CoinPay SDK & CLI — Accept cryptocurrency and card payments (BTC, ETH, SOL, POL, BCH, USDC) with wallet, swap and a live finances dashboard",
   "type": "module",
   "main": "./src/index.js",

package/src/finances-commands.js

@@ -968,7 +968,7 @@ export async function runFinancesCommand(subcommand, args, flags, ctx) {
       case 'goals':
       case 'goal': {
         const action = args[0] || 'list';
-        const usage = 'Usage: coinpay finances goals [list|show <id>|create --name "Down payment" --kind house|car|emergency_fund|debt_payoff|custom --target 60000 --deadline 2031-06-30 [--start-amount 5000] [--account <id>,<id>] [--wallet <id>]|contribute <id> <amount> [--date 2026-10-01] [--note "..."]|report [--period daily|weekly|monthly|quarterly]|digest [show|on --cadence monthly [--hour 8]|off|send-now]|sources|archive <id>|delete <id> --yes]';
+        const usage = 'Usage: coinpay finances goals [list|show <id>|create --name "Down payment" --kind house|car|emergency_fund|debt_payoff|custom --target 60000 --deadline 2031-06-30 [--start-amount 5000] [--account <id>,<id>] [--wallet <id>]|contribute <id> <amount> [--date 2026-10-01] [--note "..."]|report [--period daily|weekly|monthly|quarterly]|digest [show|on --cadence monthly [--hour 8]|off|send-now]|edit <id> [--name ..] [--target ..] [--deadline ..] [--account <id>,<id>|none] ...|sources|archive <id>|unarchive <id>|delete <id> --yes]';
         const money = (cur, n) => new Intl.NumberFormat('en-US', { style: 'currency', currency: cur || 'USD', maximumFractionDigits: 2 }).format(n);
         const STATUS = { achieved: 'achieved', on_track: 'on track', behind: 'BEHIND', overdue: 'PAST DEADLINE' };
         const line = (g) => {
@@ -1000,6 +1000,10 @@ export async function runFinancesCommand(subcommand, args, flags, ctx) {
             `  To finish on time: ${money(g.currency, s.required.perDay)}/day · ${money(g.currency, s.required.perWeek)}/week · ${money(g.currency, s.required.perMonth)}/month · ${money(g.currency, s.required.perQuarter)}/quarter`,
             s.recentPerMonth !== null ? `  Last 90 days: ${money(g.currency, s.recentPerMonth)}/month${s.projectedDate ? `, lands ${s.projectedDate}` : ''}` : null,
             data.contributions.length ? `  Contributions: ${data.contributions.slice(0, 10).map((c) => `${c.occurredOn} ${money(g.currency, c.amount)}`).join(', ')}` : null,
+            g.archivedAt ? `  Archived ${g.archivedAt.slice(0, 10)} (unarchive: coinpay finances goals unarchive ${g.id.slice(0, 8)})` : null,
+            ...(g.sources?.length
+              ? ['  Made of:', ...g.sources.map((src) => `    ${(src.counted ? money(g.currency, src.amount) : 'not counted').padStart(12)}  ${src.institution && src.type === 'account' ? `${src.institution} · ` : ''}${src.name}${src.id ? `  [${src.id.slice(0, 8)}]` : ''}${src.stale && src.asOf ? `  (balance from ${src.asOf.slice(0, 10)})` : ''}`)]
+              : []),
           ].filter(Boolean).join('\n');
           emit(data, text);
           return EXIT.OK;
@@ -1040,7 +1044,7 @@ export async function runFinancesCommand(subcommand, args, flags, ctx) {
           const data = await api.getGoalSources(client);
           emit(data, [
             'Accounts:',
-            ...data.accounts.map((a) => `  ${a.id}  ${(a.institution ? `${a.institution} · ` : '') + a.name}${a.liability ? ' (debt)' : ''}${a.balance !== null ? `  ${money(a.currency, a.balance)}` : ''}`),
+            ...data.accounts.map((a) => `  ${a.id}  ${(a.institution ? `${a.institution} · ` : '') + a.name}${a.liability ? ' (debt)' : ''}${a.hidden ? ' (hidden)' : ''}${a.balance !== null ? `  ${money(a.currency, a.balance)}` : ''}`),
             'Wallets:',
             ...(data.wallets.length ? data.wallets.map((w) => `  ${w.walletId}  ${w.label ?? ''}`) : ['  none']),
           ].join('\n'));
@@ -1070,9 +1074,31 @@ export async function runFinancesCommand(subcommand, args, flags, ctx) {
           }
           throw new CliExit(EXIT.INVALID, usage);
         }
-        if (action === 'archive') {
-          const g = await api.updateGoal(client, await resolveId(args[1]), { archived: true });
-          emit({ goal: g }, `Archived ${g.name}.`);
+        if (action === 'edit' || action === 'update') {
+          const id = await resolveId(args[1]);
+          const idsFlag = (v) => (v === 'none' ? [] : listFlag(v));
+          const patch = {
+            name: typeof flags.name === 'string' ? flags.name : undefined,
+            kind: typeof flags.kind === 'string' ? flags.kind : undefined,
+            targetAmount: flags.target !== undefined ? String(flags.target) : undefined,
+            deadline: typeof flags.deadline === 'string' ? flags.deadline : undefined,
+            startDate: typeof flags.start === 'string' ? flags.start : undefined,
+            currency: typeof flags.currency === 'string' ? flags.currency : undefined,
+            startingAmount: flags['start-amount'] === 'none' ? null : flags['start-amount'] !== undefined ? String(flags['start-amount']) : undefined,
+            linkedAccountIds: flags.account ? idsFlag(flags.account) : undefined,
+            linkedWalletIds: flags.wallet ? idsFlag(flags.wallet) : undefined,
+            notes: flags.notes === 'none' ? null : typeof flags.notes === 'string' ? flags.notes : undefined,
+          };
+          for (const k of Object.keys(patch)) if (patch[k] === undefined) delete patch[k];
+          if (Object.keys(patch).length === 0) throw new CliExit(EXIT.INVALID, 'Usage: coinpay finances goals edit <id> [--name ..] [--kind ..] [--target ..] [--deadline ..] [--start YYYY-MM-DD] [--start-amount n|none] [--account <id>,<id>|none] [--wallet <id>|none] [--notes "..."|none]');
+          const g = await api.updateGoal(client, id, patch);
+          emit({ goal: g }, `Saved ${g.name}\n${g.snapshot ? line(g) : ''}`);
+          return EXIT.OK;
+        }
+        if (action === 'archive' || action === 'unarchive') {
+          const archived = action === 'archive';
+          const g = await api.updateGoal(client, await resolveId(args[1]), { archived });
+          emit({ goal: g }, archived ? `Archived ${g.name}. It is hidden from goals list and left out of reports (list --archived shows it).` : `${g.name} is active again.`);
           return EXIT.OK;
         }
         if (action === 'delete') {

package/src/finances-reports.d.ts

@@ -494,8 +494,22 @@ export interface FinanceGoal {
   linkedAccountIds: string[];
   linkedWalletIds: string[];
   notes: string | null;
+  archivedAt: string | null;
   direction: 'save' | 'payoff';
   snapshot: GoalSnapshot;
+  /** What progress is made of; counted amounts sum to `snapshot.progress`. */
+  sources: GoalSource[];
+}
+export interface GoalSource {
+  type: 'account' | 'wallets' | 'contributions' | 'starting';
+  id: string | null;
+  name: string;
+  institution: string | null;
+  kind: string | null;
+  amount: number;
+  asOf: string | null;
+  stale: boolean;
+  counted: boolean;
 }
 export interface GoalInput {
   name: string;

package/src/mcp.js

@@ -107,6 +107,36 @@ export const TOOLS = [
     },
     handler: async (args, { client }) => text({ goal: await reports.createGoal(client, args) }),
   },
+  {
+    name: 'finance_goal_update',
+    description: 'Edit a goal (any field), choose which linked accounts/wallets count (the full list replaces the old one; [] unlinks all), or archive/unarchive it. Archived goals are hidden from finance_goals unless archived=true and left out of reports and the goals email. Each goal\'s `sources` lists what its progress is made of.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        goalId: { type: 'string' },
+        name: { type: 'string' },
+        kind: { type: 'string', enum: ['house', 'car', 'emergency_fund', 'debt_payoff', 'custom'] },
+        targetAmount: { type: ['number', 'string'] },
+        deadline: { type: 'string', description: 'YYYY-MM-DD' },
+        startDate: { type: 'string', description: 'YYYY-MM-DD' },
+        currency: { type: 'string' },
+        startingAmount: { type: ['number', 'string', 'null'] },
+        linkedAccountIds: { type: 'array', items: { type: 'string' } },
+        linkedWalletIds: { type: 'array', items: { type: 'string' } },
+        notes: { type: ['string', 'null'] },
+        archived: { type: 'boolean' },
+      },
+      required: ['goalId'],
+      additionalProperties: false,
+    },
+    handler: async ({ goalId, ...patch }, { client }) => text({ goal: await reports.updateGoal(client, goalId, patch) }),
+  },
+  {
+    name: 'finance_goal_delete',
+    description: 'Delete a goal and its recorded contributions for good. Prefer finance_goal_update with archived=true to keep it.',
+    inputSchema: { type: 'object', properties: { goalId: { type: 'string' } }, required: ['goalId'], additionalProperties: false },
+    handler: async (args, { client }) => text(await reports.deleteGoal(client, args.goalId)),
+  },
   {
     name: 'finance_goal_contribute',
     description: 'Record an amount put toward a goal, or a payment on a payoff goal (negative = withdrawal). Records only; moves no money.',

package/src/wallet.js

@@ -403,34 +403,36 @@ function getSecp256k1PublicKey(seed) {
 }
 
 /**
- * Sign a message with secp256k1 private key
- * @private
+ * Sign a proof-of-ownership / auth-challenge message with a secp256k1 key,
+ * the way the CoinPay server verifies it.
+ *
+ * The server (src/lib/web-wallet/auth.ts::verifySecp256k1Signature) runs
+ * noble-curves v2, whose `verify(sig, message, pub)` sha256-hashes the message
+ * first (prehash defaults to true). This SDK pins noble-curves v1, whose
+ * `sign(x, key)` treats `x` as an already-hashed digest. So the SDK must hash
+ * explicitly: sign(sha256(message), { prehash: false }) is byte-for-byte what
+ * the server checks, on either major version.
+ *
+ * History: 0.x signed sha256(message) and was right while the server ran v1
+ * (raw verify); a later "fix" switched to raw bytes; the server then moved to
+ * v2 and every `wallet create`, `wallet import` and wallet sign-in from the
+ * SDK/CLI failed with 400 INVALID_SIGNATURE (2026-10).
  */
-function signMessage(message, privateKey) {
-  // Signed over the RAW message bytes, not sha256(message).
-  //
-  // This used to hash first. The server verifies proofs by passing the raw
-  // encoded message straight to `secp256k1.verify` (see
-  // web-wallet/auth.ts::verifySecp256k1Signature), and noble treats that
-  // argument as the thing that was signed — so a signature over the digest
-  // verifies false against the message. Every proof of ownership this SDK
-  // produced was rejected, which meant `WalletClient.fromSeed()` could not
-  // import a wallet at all. Found while wiring the same proof into
-  // `create()` for V-04.
-  const signature = secp256k1.sign(new TextEncoder().encode(message), privateKey);
-  // Handle different noble-curves versions:
-  // v1.x returns Signature object with toCompactHex()
-  // v2.x returns raw Uint8Array directly
+export function signProofMessage(message, privateKey) {
+  const digest = sha256(new TextEncoder().encode(message));
+  const signature = secp256k1.sign(digest, privateKey, { prehash: false });
+  // v1.x returns a Signature object, v2.x a compact Uint8Array.
   if (signature instanceof Uint8Array) {
     return bytesToHex(signature);
   }
   if (typeof signature.toCompactHex === 'function') {
     return signature.toCompactHex();
   }
-  // Fallback: try toCompactRawBytes
   return bytesToHex(signature.toCompactRawBytes());
 }
 
+const signMessage = signProofMessage;
+
 // ================================================================
 // Arbitrary tx / message signing
 // ----------------------------------------------------------------
@@ -795,9 +797,13 @@ export class WalletClient {
       const data = await response.json();
       
       if (!response.ok) {
-        const error = new Error(data.error || `HTTP ${response.status}`);
+        // Web-wallet routes answer { error: { code, message } }; older ones a string.
+        const apiError = data && typeof data.error === 'object' && data.error ? data.error : null;
+        const error = new Error(
+          (apiError ? apiError.message || apiError.code : data.error) || `HTTP ${response.status}`
+        );
         error.status = response.status;
-        error.code = data.code;
+        error.code = apiError?.code ?? data.code;
         error.response = data;
         throw error;
       }
@@ -823,10 +829,11 @@ export class WalletClient {
     }
     
     // Get challenge
-    const challengeRes = await this.#request(`/web-wallet/auth/challenge`, {
-      method: 'POST',
-      body: JSON.stringify({ wallet_id: this.#walletId }),
-    });
+    // The server serves challenges on GET ?wallet_id= (a POST is a 405 with
+    // an empty body, which surfaced as "Unexpected end of JSON input").
+    const challengeRes = await this.#request(
+      `/web-wallet/auth/challenge?wallet_id=${encodeURIComponent(this.#walletId)}`
+    );
     const challenge = challengeRes.data?.challenge || challengeRes.challenge;
     const challengeId = challengeRes.data?.challenge_id || challengeRes.challenge_id;