@profullstack/coinpay 0.27.1 → 0.29.0

package/CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to `@profullstack/coinpay` will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.29.0] - 2026-10-29
+
+### Added
+- `coinpay login` uses OAuth 2.1 either way: authorization code + PKCE on a loopback redirect when a
+  browser is on this machine, the device flow (RFC 8628) otherwise. Over SSH or with no display it
+  picks the device flow by itself; `--device` / `--browser` force one. The device flow now gets real
+  OAuth tokens (rotating refresh token) from `/api/oauth/device_authorization` and the token
+  endpoint instead of the old `/api/cli-auth` session.
+- `coinpay logout` revokes the session at CoinPay (RFC 7009, `/api/oauth/revoke`) before forgetting it.
+- `deviceLogin`, `revokeToken` and `hasLocalBrowser` exported from `src/oauth-login.js`.
+
+## [0.28.0] - 2026-10-29
+
+### Added
+- `coinpay finances goals edit <id>` changes any field of a goal (`--name`, `--kind`, `--target`,
+  `--deadline`, `--start`, `--start-amount n|none`, `--notes "..."|none`) and which accounts or wallets
+  count (`--account <id>,<id>` replaces the list, `--account none` unlinks all).
+- `coinpay finances goals unarchive <id>`. Archived goals are hidden from `goals list` (unless
+  `--archived`) and left out of the report and the goals email.
+- `goals show` prints what the progress is made of: every linked account with its amount, flagged when
+  its balance is over a week old. `FinanceGoal.sources` / `GoalSource` in the types.
+- MCP: `finance_goal_update` (edit, relink, archive/unarchive) and `finance_goal_delete`.
+
 ## [0.27.1] - 2026-10-28
 
 ### Fixed

package/bin/coinpay.js

@@ -500,8 +500,8 @@ ${colors.cyan}Commands:${colors.reset}
     set-url <base-url>    Set custom API URL
     show                  Show current configuration
 
-  ${colors.bright}login${colors.reset}                 Sign in (OAuth 2.1 in your browser; --device on a machine without one)
-  ${colors.bright}logout${colors.reset}                Forget the saved session
+  ${colors.bright}login${colors.reset}                 Sign in (OAuth 2.1: browser + PKCE, or the device flow over SSH / --device)
+  ${colors.bright}logout${colors.reset}                Sign out and revoke the session at CoinPay
 
   ${colors.bright}auth${colors.reset}
     register              Register new merchant account
@@ -4746,22 +4746,28 @@ async function runInteractiveMenu() {
   }
 }
 
-// Headless login: ask the server for a device code, show a URL to approve on any
-// device, and poll until a merchant session token is minted and stored. No
-// password on this machine — works over SSH / on a server.
+// `coinpay login`: OAuth 2.1 as the public client `coinpay-cli`. With a local
+// browser it uses authorization code + PKCE on a loopback redirect; over SSH
+// or with no display (or --device) it uses the device flow (RFC 8628): it
+// prints a code to type at coinpayportal.com/oauth/device on any device.
+// Either way it stores a rotating refresh token in ~/.coinpay.json.
 async function handleLogin(flags = {}) {
-  // OAuth 2.1 (authorization code + PKCE, loopback redirect, rotating refresh)
-  // unless asked for the device flow, which is what works over SSH.
-  if (!flags.device) {
-    const cfg = loadConfig();
-    const { loopbackLogin, toStoredSession } = await import('../src/oauth-login.js');
+  const cfg = loadConfig();
+  const { loopbackLogin, deviceLogin, hasLocalBrowser, toStoredSession } = await import('../src/oauth-login.js');
+  const useDevice = Boolean(flags.device) || (!flags.browser && !hasLocalBrowser());
+
+  const save = async (tokens, how) => {
+    cfg.oauth = toStoredSession(tokens);
+    cfg.jwtToken = cfg.oauth.accessToken;
+    saveConfig(cfg);
+    const me = await fetchMe();
+    print.success(me ? `Logged in as ${meLabel(me)} (${how})` : 'Logged in! Session saved to ' + CONFIG_FILE);
+  };
+
+  if (!useDevice) {
     try {
       const tokens = await loopbackLogin({ apiBase: cfg.baseUrl, log: (line) => console.log(line) });
-      cfg.oauth = toStoredSession(tokens);
-      cfg.jwtToken = cfg.oauth.accessToken;
-      saveConfig(cfg);
-      const me = await fetchMe();
-      print.success(me ? `Logged in as ${meLabel(me)} (OAuth 2.1)` : 'Logged in! Session saved to ' + CONFIG_FILE);
+      await save(tokens, 'OAuth 2.1');
       return;
     } catch (err) {
       print.error(`Browser sign-in failed: ${err.message}`);
@@ -4769,75 +4775,54 @@ async function handleLogin(flags = {}) {
       process.exit(1);
     }
   }
-  const cfg = loadConfig();
-  const base = (cfg.baseUrl || 'https://coinpayportal.com/api').replace(/\/$/, '');
 
-  let start;
   try {
-    const res = await fetch(`${base}/cli-auth/start`, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ client_name: hostname() }),
+    const tokens = await deviceLogin({
+      apiBase: cfg.baseUrl,
+      prompt: ({ userCode, verificationUri }) => {
+        // No pre-filled link (verification_uri_complete): typing the code is
+        // what ties the approval to this terminal.
+        console.log('');
+        console.log('  To sign in, open this page on any device where you are signed in to CoinPay:');
+        console.log('');
+        console.log('    ' + colors.cyan + verificationUri + colors.reset);
+        console.log('');
+        console.log('  and enter this code: ' + colors.bright + userCode + colors.reset);
+        console.log('');
+        console.log(colors.yellow + '  Only enter a code your own terminal printed.' + colors.reset);
+        console.log('');
+        print.info('Waiting for approval… (Ctrl-C to cancel)');
+      },
     });
-    if (!res.ok) throw new Error(`server returned ${res.status}`);
-    start = await res.json();
+    await save(tokens, 'OAuth 2.1 device flow');
   } catch (err) {
-    print.error(`Couldn't start login: ${err.message}`);
+    if (err.code === 'access_denied') print.error('Request denied.');
+    else if (err.code === 'expired_token') print.error('The code expired. Run `coinpay login --device` again.');
+    else print.error(`Couldn't sign in: ${err.message}`);
     process.exit(1);
   }
-
-  // G-1.2-10: there is no pre-filled approval link any more. A link that filled
-  // in the code turned a phishing message into one-click account takeover —
-  // anyone could start a device authorization and send the resulting link to a
-  // signed-in merchant. Entering the code by hand is what ties the approval to
-  // a terminal the person is actually sitting at.
-  print.info('');
-  console.log('  To log in, open this URL on any device (e.g. your desktop):');
-  console.log('');
-  console.log('    ' + colors.cyan + start.verification_uri + colors.reset);
-  console.log('');
-  console.log('  and enter this code: ' + colors.bright + start.user_code + colors.reset);
-  console.log('');
-  console.log(colors.yellow + '  Only enter a code your own terminal printed.' + colors.reset);
-  console.log('');
-  print.info('Waiting for approval… (Ctrl-C to cancel)');
-
-  const deadline = Date.now() + (start.expires_in || 600) * 1000;
-  const intervalMs = Math.max(1, start.interval || 5) * 1000;
-  while (Date.now() < deadline) {
-    await new Promise((r) => setTimeout(r, intervalMs));
-    let data = {};
-    try {
-      const res = await fetch(`${base}/cli-auth/poll`, {
-        method: 'POST',
-        headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ device_code: start.device_code }),
-      });
-      if (res.status === 202) continue; // authorization_pending
-      data = await res.json().catch(() => ({}));
-    } catch {
-      continue; // transient network error — keep polling
-    }
-    if (data.status === 'complete' && data.token) {
-      cfg.jwtToken = data.token;
-      saveConfig(cfg);
-      const me = await fetchMe();
-      print.success(me ? `Logged in as ${meLabel(me)}` : 'Logged in! Session saved to ' + CONFIG_FILE);
-      return;
-    }
-    if (data.status === 'denied') { print.error('Request denied.'); process.exit(1); }
-    if (data.status === 'expired') { print.error('Login request expired — run `coinpay login` again.'); process.exit(1); }
-  }
-  print.error('Timed out waiting for approval.');
-  process.exit(1);
 }
 
-function handleLogout() {
+// `coinpay logout`: revoke the grant at CoinPay (RFC 7009; revoking the
+// refresh token revokes its access tokens too), then forget it locally.
+async function handleLogout() {
   const cfg = loadConfig();
+  if (cfg.oauth) {
+    const { revokeToken, CLI_CLIENT_ID } = await import('../src/oauth-login.js');
+    const clientId = cfg.oauth.clientId || CLI_CLIENT_ID;
+    let ok = false;
+    if (cfg.oauth.refreshToken) {
+      ok = await revokeToken({ apiBase: cfg.baseUrl, token: cfg.oauth.refreshToken, tokenTypeHint: 'refresh_token', clientId });
+    }
+    if (cfg.oauth.accessToken) {
+      ok = (await revokeToken({ apiBase: cfg.baseUrl, token: cfg.oauth.accessToken, tokenTypeHint: 'access_token', clientId })) || ok;
+    }
+    if (!ok) print.warn('Could not reach CoinPay to revoke the session; it is removed locally and expires on its own.');
+  }
   delete cfg.jwtToken;
   delete cfg.oauth;
   saveConfig(cfg);
-  print.success('Logged out — session removed from ' + CONFIG_FILE);
+  print.success('Logged out — session revoked and removed from ' + CONFIG_FILE);
 }
 
 // Fetch the signed-in merchant (via the stored session token), or null if not
@@ -5505,7 +5490,7 @@ async function handleLightning(subcommand, args, flags) {
         break;
 
       case 'logout':
-        handleLogout();
+        await handleLogout();
         break;
 
       case 'whoami':

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@profullstack/coinpay",
-  "version": "0.27.1",
+  "version": "0.29.0",
   "description": "CoinPay SDK & CLI — Accept cryptocurrency and card payments (BTC, ETH, SOL, POL, BCH, USDC) with wallet, swap and a live finances dashboard",
   "type": "module",
   "main": "./src/index.js",

package/src/finances-commands.js

@@ -968,7 +968,7 @@ export async function runFinancesCommand(subcommand, args, flags, ctx) {
       case 'goals':
       case 'goal': {
         const action = args[0] || 'list';
-        const usage = 'Usage: coinpay finances goals [list|show <id>|create --name "Down payment" --kind house|car|emergency_fund|debt_payoff|custom --target 60000 --deadline 2031-06-30 [--start-amount 5000] [--account <id>,<id>] [--wallet <id>]|contribute <id> <amount> [--date 2026-10-01] [--note "..."]|report [--period daily|weekly|monthly|quarterly]|digest [show|on --cadence monthly [--hour 8]|off|send-now]|sources|archive <id>|delete <id> --yes]';
+        const usage = 'Usage: coinpay finances goals [list|show <id>|create --name "Down payment" --kind house|car|emergency_fund|debt_payoff|custom --target 60000 --deadline 2031-06-30 [--start-amount 5000] [--account <id>,<id>] [--wallet <id>]|contribute <id> <amount> [--date 2026-10-01] [--note "..."]|report [--period daily|weekly|monthly|quarterly]|digest [show|on --cadence monthly [--hour 8]|off|send-now]|edit <id> [--name ..] [--target ..] [--deadline ..] [--account <id>,<id>|none] ...|sources|archive <id>|unarchive <id>|delete <id> --yes]';
         const money = (cur, n) => new Intl.NumberFormat('en-US', { style: 'currency', currency: cur || 'USD', maximumFractionDigits: 2 }).format(n);
         const STATUS = { achieved: 'achieved', on_track: 'on track', behind: 'BEHIND', overdue: 'PAST DEADLINE' };
         const line = (g) => {
@@ -1000,6 +1000,10 @@ export async function runFinancesCommand(subcommand, args, flags, ctx) {
             `  To finish on time: ${money(g.currency, s.required.perDay)}/day · ${money(g.currency, s.required.perWeek)}/week · ${money(g.currency, s.required.perMonth)}/month · ${money(g.currency, s.required.perQuarter)}/quarter`,
             s.recentPerMonth !== null ? `  Last 90 days: ${money(g.currency, s.recentPerMonth)}/month${s.projectedDate ? `, lands ${s.projectedDate}` : ''}` : null,
             data.contributions.length ? `  Contributions: ${data.contributions.slice(0, 10).map((c) => `${c.occurredOn} ${money(g.currency, c.amount)}`).join(', ')}` : null,
+            g.archivedAt ? `  Archived ${g.archivedAt.slice(0, 10)} (unarchive: coinpay finances goals unarchive ${g.id.slice(0, 8)})` : null,
+            ...(g.sources?.length
+              ? ['  Made of:', ...g.sources.map((src) => `    ${(src.counted ? money(g.currency, src.amount) : 'not counted').padStart(12)}  ${src.institution && src.type === 'account' ? `${src.institution} · ` : ''}${src.name}${src.id ? `  [${src.id.slice(0, 8)}]` : ''}${src.stale && src.asOf ? `  (balance from ${src.asOf.slice(0, 10)})` : ''}`)]
+              : []),
           ].filter(Boolean).join('\n');
           emit(data, text);
           return EXIT.OK;
@@ -1040,7 +1044,7 @@ export async function runFinancesCommand(subcommand, args, flags, ctx) {
           const data = await api.getGoalSources(client);
           emit(data, [
             'Accounts:',
-            ...data.accounts.map((a) => `  ${a.id}  ${(a.institution ? `${a.institution} · ` : '') + a.name}${a.liability ? ' (debt)' : ''}${a.balance !== null ? `  ${money(a.currency, a.balance)}` : ''}`),
+            ...data.accounts.map((a) => `  ${a.id}  ${(a.institution ? `${a.institution} · ` : '') + a.name}${a.liability ? ' (debt)' : ''}${a.hidden ? ' (hidden)' : ''}${a.balance !== null ? `  ${money(a.currency, a.balance)}` : ''}`),
             'Wallets:',
             ...(data.wallets.length ? data.wallets.map((w) => `  ${w.walletId}  ${w.label ?? ''}`) : ['  none']),
           ].join('\n'));
@@ -1070,9 +1074,31 @@ export async function runFinancesCommand(subcommand, args, flags, ctx) {
           }
           throw new CliExit(EXIT.INVALID, usage);
         }
-        if (action === 'archive') {
-          const g = await api.updateGoal(client, await resolveId(args[1]), { archived: true });
-          emit({ goal: g }, `Archived ${g.name}.`);
+        if (action === 'edit' || action === 'update') {
+          const id = await resolveId(args[1]);
+          const idsFlag = (v) => (v === 'none' ? [] : listFlag(v));
+          const patch = {
+            name: typeof flags.name === 'string' ? flags.name : undefined,
+            kind: typeof flags.kind === 'string' ? flags.kind : undefined,
+            targetAmount: flags.target !== undefined ? String(flags.target) : undefined,
+            deadline: typeof flags.deadline === 'string' ? flags.deadline : undefined,
+            startDate: typeof flags.start === 'string' ? flags.start : undefined,
+            currency: typeof flags.currency === 'string' ? flags.currency : undefined,
+            startingAmount: flags['start-amount'] === 'none' ? null : flags['start-amount'] !== undefined ? String(flags['start-amount']) : undefined,
+            linkedAccountIds: flags.account ? idsFlag(flags.account) : undefined,
+            linkedWalletIds: flags.wallet ? idsFlag(flags.wallet) : undefined,
+            notes: flags.notes === 'none' ? null : typeof flags.notes === 'string' ? flags.notes : undefined,
+          };
+          for (const k of Object.keys(patch)) if (patch[k] === undefined) delete patch[k];
+          if (Object.keys(patch).length === 0) throw new CliExit(EXIT.INVALID, 'Usage: coinpay finances goals edit <id> [--name ..] [--kind ..] [--target ..] [--deadline ..] [--start YYYY-MM-DD] [--start-amount n|none] [--account <id>,<id>|none] [--wallet <id>|none] [--notes "..."|none]');
+          const g = await api.updateGoal(client, id, patch);
+          emit({ goal: g }, `Saved ${g.name}\n${g.snapshot ? line(g) : ''}`);
+          return EXIT.OK;
+        }
+        if (action === 'archive' || action === 'unarchive') {
+          const archived = action === 'archive';
+          const g = await api.updateGoal(client, await resolveId(args[1]), { archived });
+          emit({ goal: g }, archived ? `Archived ${g.name}. It is hidden from goals list and left out of reports (list --archived shows it).` : `${g.name} is active again.`);
           return EXIT.OK;
         }
         if (action === 'delete') {

package/src/finances-reports.d.ts

@@ -494,8 +494,22 @@ export interface FinanceGoal {
   linkedAccountIds: string[];
   linkedWalletIds: string[];
   notes: string | null;
+  archivedAt: string | null;
   direction: 'save' | 'payoff';
   snapshot: GoalSnapshot;
+  /** What progress is made of; counted amounts sum to `snapshot.progress`. */
+  sources: GoalSource[];
+}
+export interface GoalSource {
+  type: 'account' | 'wallets' | 'contributions' | 'starting';
+  id: string | null;
+  name: string;
+  institution: string | null;
+  kind: string | null;
+  amount: number;
+  asOf: string | null;
+  stale: boolean;
+  counted: boolean;
 }
 export interface GoalInput {
   name: string;

package/src/mcp.js

@@ -107,6 +107,36 @@ export const TOOLS = [
     },
     handler: async (args, { client }) => text({ goal: await reports.createGoal(client, args) }),
   },
+  {
+    name: 'finance_goal_update',
+    description: 'Edit a goal (any field), choose which linked accounts/wallets count (the full list replaces the old one; [] unlinks all), or archive/unarchive it. Archived goals are hidden from finance_goals unless archived=true and left out of reports and the goals email. Each goal\'s `sources` lists what its progress is made of.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        goalId: { type: 'string' },
+        name: { type: 'string' },
+        kind: { type: 'string', enum: ['house', 'car', 'emergency_fund', 'debt_payoff', 'custom'] },
+        targetAmount: { type: ['number', 'string'] },
+        deadline: { type: 'string', description: 'YYYY-MM-DD' },
+        startDate: { type: 'string', description: 'YYYY-MM-DD' },
+        currency: { type: 'string' },
+        startingAmount: { type: ['number', 'string', 'null'] },
+        linkedAccountIds: { type: 'array', items: { type: 'string' } },
+        linkedWalletIds: { type: 'array', items: { type: 'string' } },
+        notes: { type: ['string', 'null'] },
+        archived: { type: 'boolean' },
+      },
+      required: ['goalId'],
+      additionalProperties: false,
+    },
+    handler: async ({ goalId, ...patch }, { client }) => text({ goal: await reports.updateGoal(client, goalId, patch) }),
+  },
+  {
+    name: 'finance_goal_delete',
+    description: 'Delete a goal and its recorded contributions for good. Prefer finance_goal_update with archived=true to keep it.',
+    inputSchema: { type: 'object', properties: { goalId: { type: 'string' } }, required: ['goalId'], additionalProperties: false },
+    handler: async (args, { client }) => text(await reports.deleteGoal(client, args.goalId)),
+  },
   {
     name: 'finance_goal_contribute',
     description: 'Record an amount put toward a goal, or a payment on a payoff goal (negative = withdrawal). Records only; moves no money.',

package/src/oauth-login.js

@@ -147,6 +147,99 @@ export async function loopbackLogin({ apiBase, open = openInBrowser, log = () =>
   }
 }
 
+export const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
+
+/**
+ * Is there a browser this process can open? Not over SSH, not on a Linux box
+ * with no display. Used to pick loopback PKCE vs the device flow.
+ */
+export function hasLocalBrowser(env = process.env, platform = process.platform) {
+  if (env.SSH_CONNECTION || env.SSH_TTY || env.SSH_CLIENT) return false;
+  if (env.COINPAY_NO_BROWSER) return false;
+  if (platform === 'darwin' || platform === 'win32') return true;
+  return Boolean(env.DISPLAY || env.WAYLAND_DISPLAY || env.BROWSER);
+}
+
+/**
+ * OAuth 2.0 Device Authorization Grant (RFC 8628). Starts at
+ * /api/oauth/device_authorization, shows the user_code via `prompt`, and polls
+ * /api/oauth/token honouring interval and slow_down. Resolves with the token
+ * response; rejects with err.code access_denied / expired_token.
+ */
+export async function deviceLogin({
+  apiBase,
+  clientId = CLI_CLIENT_ID,
+  scope = CLI_SCOPE,
+  prompt = () => {},
+  fetchImpl = fetch,
+  sleep = (ms) => new Promise((r) => setTimeout(r, ms)),
+  now = () => Date.now(),
+} = {}) {
+  const origin = siteOrigin(apiBase);
+  const res = await fetchImpl(new URL('/api/oauth/device_authorization', origin), {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+    body: new URLSearchParams({ client_id: clientId, scope }).toString(),
+  });
+  const start = await res.json().catch(() => ({}));
+  if (!res.ok || !start.device_code) {
+    const err = new Error(start.error_description || start.error || `device authorization answered ${res.status}`);
+    err.code = start.error || 'device_error';
+    throw err;
+  }
+  prompt({ userCode: start.user_code, verificationUri: start.verification_uri, expiresIn: start.expires_in });
+
+  let interval = Math.max(1, Number(start.interval) || 5);
+  const deadline = now() + (Number(start.expires_in) || 600) * 1000;
+  while (now() < deadline) {
+    await sleep(interval * 1000);
+    let data = {};
+    let status = 0;
+    try {
+      const r = await fetchImpl(new URL('/api/oauth/token', origin), {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+        body: new URLSearchParams({ grant_type: DEVICE_GRANT, device_code: start.device_code, client_id: clientId }).toString(),
+      });
+      status = r.status;
+      data = await r.json().catch(() => ({}));
+    } catch {
+      continue; // network blip: keep polling
+    }
+    if (status === 200 && data.access_token) return data;
+    if (data.error === 'authorization_pending') continue;
+    if (data.error === 'slow_down') {
+      interval += 5;
+      continue;
+    }
+    const err = new Error(
+      data.error === 'access_denied' ? 'access denied' : data.error === 'expired_token' ? 'the code expired' : data.error_description || data.error || `token endpoint answered ${status}`
+    );
+    err.code = data.error || 'token_error';
+    throw err;
+  }
+  const err = new Error('the code expired');
+  err.code = 'expired_token';
+  throw err;
+}
+
+/** RFC 7009: revoke a token at CoinPay. Best effort; resolves true on 200. */
+export async function revokeToken({ apiBase, token, tokenTypeHint, clientId = CLI_CLIENT_ID, fetchImpl = fetch }) {
+  if (!token) return false;
+  try {
+    const params = { token, client_id: clientId };
+    if (tokenTypeHint) params.token_type_hint = tokenTypeHint;
+    const res = await fetchImpl(new URL('/api/oauth/revoke', siteOrigin(apiBase)), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams(params).toString(),
+    });
+    return res.status === 200;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Before any command: if the stored OAuth access token is within a minute of
  * expiring, rotate it. Mutates and saves `cfg`. Returns false when the