@profullstack/coinpay 0.8.0 → 0.10.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@profullstack/coinpay",
-  "version": "0.8.0",
-  "description": "CoinPay SDK & CLI — Accept cryptocurrency payments (BTC, ETH, SOL, POL, BCH, USDC) with wallet and swap support",
+  "version": "0.10.0",
+  "description": "CoinPay SDK & CLI \u2014 Accept cryptocurrency and card payments (BTC, ETH, SOL, POL, BCH, USDC) with wallet, swap and a live finances dashboard",
   "type": "module",
   "main": "./src/index.js",
   "types": "./src/index.d.ts",
@@ -48,6 +48,29 @@
     },
     "./x402-pay-server": {
       "import": "./src/x402-pay-server.js"
+    },
+    "./taskmarket": {
+      "import": "./src/taskmarket.js"
+    },
+    "./finances": {
+      "import": "./src/finances.js",
+      "types": "./src/finances.d.ts"
+    },
+    "./finances-tui": {
+      "import": "./src/finances-tui.js"
+    },
+    "./finances-reports": {
+      "types": "./src/finances-reports.d.ts",
+      "import": "./src/finances-reports.js",
+      "default": "./src/finances-reports.js"
+    },
+    "./finances-commands": {
+      "import": "./src/finances-commands.js",
+      "default": "./src/finances-commands.js"
+    },
+    "./finances-report": {
+      "import": "./src/finances-report.js",
+      "default": "./src/finances-report.js"
     }
   },
   "files": [
@@ -86,7 +109,12 @@
     "payment-gateway",
     "merchant",
     "bip39",
-    "mnemonic"
+    "mnemonic",
+    "finances",
+    "tui",
+    "dashboard",
+    "plaid",
+    "simplefin"
   ],
   "author": "Profullstack, Inc.",
   "license": "MIT",
@@ -103,16 +131,16 @@
     "node": ">=20.0.0"
   },
   "devDependencies": {
-    "vitest": "^4.1.0",
     "eslint": "^8.57.0",
-    "prettier": "^3.4.1"
+    "prettier": "^3.4.1",
+    "vitest": "^4.1.11"
   },
-  "peerDependencies": {},
   "dependencies": {
-    "@scure/bip39": "^1.4.0",
-    "@scure/bip32": "^1.5.0",
+    "@inquirer/prompts": "^8.3.0",
     "@noble/curves": "^1.6.0",
     "@noble/hashes": "^1.5.0",
-    "@inquirer/prompts": "^8.3.0"
+    "@profullstack/hqtui": "^0.1.11",
+    "@scure/bip32": "^1.5.0",
+    "@scure/bip39": "^1.4.0"
   }
 }

package/src/card-payments.js

@@ -309,13 +309,21 @@ export async function createCardEscrow(client, businessId, amountUSD, descriptio
   // Convert USD to cents
   const amountCents = Math.round(amountUSD * 100);
 
-  return client.request('POST', '/api/stripe/payments/create', {
-    businessId,
-    amount: amountCents,
-    currency: 'usd',
-    description,
-    metadata,
-    escrowMode: true,
+  // `CoinPayClient.request(endpoint, options)` takes TWO arguments. Every call
+  // in this file passed three, in the shape `request(method, path, body)` — so
+  // `endpoint` received 'POST', the URL became `baseUrl + 'POST'`, and `options`
+  // received the path as a string. These calls failed 100% of the time, which
+  // made releasing or refunding a card escrow unreachable through the SDK.
+  return client.request('/api/stripe/payments/create', {
+    method: 'POST',
+    body: JSON.stringify({
+      businessId,
+      amount: amountCents,
+      currency: 'usd',
+      description,
+      metadata,
+      escrowMode: true,
+    }),
   });
 }
 
@@ -346,7 +354,7 @@ export async function listCardEscrows(client, options = {}) {
   const queryString = queryParams.toString();
   const url = `/api/stripe/escrows${queryString ? `?${queryString}` : ''}`;
   
-  return client.request('GET', url);
+  return client.request(url, { method: 'GET' });
 }
 
 /**
@@ -360,8 +368,9 @@ export async function listCardEscrows(client, options = {}) {
  * const result = await releaseCardEscrow(client, 'escrow-123');
  */
 export async function releaseCardEscrow(client, escrowId) {
-  return client.request('POST', '/api/stripe/escrow/release', {
-    escrowId,
+  return client.request('/api/stripe/escrow/release', {
+    method: 'POST',
+    body: JSON.stringify({ escrowId }),
   });
 }
 
@@ -386,9 +395,9 @@ export async function releaseCardEscrow(client, escrowId) {
  * });
  */
 export async function refundCardEscrow(client, escrowId, options = {}) {
-  return client.request('POST', '/api/stripe/escrow/refund', {
-    escrowId,
-    ...options,
+  return client.request('/api/stripe/escrow/refund', {
+    method: 'POST',
+    body: JSON.stringify({ escrowId, ...options }),
   });
 }
 
@@ -404,7 +413,7 @@ export async function refundCardEscrow(client, escrowId, options = {}) {
  * console.log(status.escrow_status); // 'pending', 'released', 'refunded'
  */
 export async function getCardEscrowStatus(client, escrowId) {
-  return client.request('GET', `/api/stripe/transactions/${escrowId}`);
+  return client.request(`/api/stripe/transactions/${escrowId}`, { method: 'GET' });
 }
 
 /**

package/src/client.d.ts

@@ -313,6 +313,16 @@ export class CoinPayClient {
    * @param eventType  - Event type to simulate (default: `'payment.completed'`)
    */
   testWebhook(businessId: string, eventType?: string): Promise<Record<string, unknown>>;
+  /** Fetch a binary body (PDF, CSV) with its describing headers. */
+  requestBinary(endpoint: string, options?: RequestInit): Promise<{
+    bytes: Uint8Array;
+    contentType: string;
+    filename: string | null;
+    sha256: string | null;
+    headers: Record<string, string>;
+  }>;
+  /** POST a multipart form (file upload). */
+  requestForm(endpoint: string, form: FormData): Promise<any>;
 }
 
 export default CoinPayClient;

package/src/client.js

@@ -77,6 +77,97 @@ export class CoinPayClient {
     }
   }
 
+  /**
+   * Fetch a binary body (a PDF, a CSV) rather than JSON.
+   *
+   * `request()` always parses JSON, which a file download is not. This
+   * returns the bytes plus the headers that describe them; an error body
+   * is still parsed as JSON so its `code` survives.
+   * @param {string} endpoint - API endpoint
+   * @param {Object} [options] - Fetch options
+   * @returns {Promise<{bytes: Uint8Array, contentType: string, filename: string|null, sha256: string|null, headers: Record<string,string>}>}
+   */
+  async requestBinary(endpoint, options = {}) {
+    if (!this.#apiKey) {
+      throw new Error('API key is required for authenticated requests.');
+    }
+    const url = `${this.#baseUrl}${endpoint}`;
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), this.#timeout);
+    try {
+      const response = await fetch(url, {
+        ...options,
+        signal: controller.signal,
+        headers: { 'Authorization': `Bearer ${this.#apiKey}`, ...options.headers },
+      });
+      if (!response.ok) {
+        let data = {};
+        try { data = await response.json(); } catch { /* not JSON */ }
+        const structured = data && data.error && typeof data.error === 'object' ? data.error : null;
+        const error = new Error((structured && structured.message) || data.error || `HTTP ${response.status}`);
+        error.status = response.status;
+        error.response = data;
+        if (structured && structured.code) error.code = structured.code;
+        throw error;
+      }
+      const headers = {};
+      response.headers.forEach((value, key) => { headers[key] = value; });
+      const disposition = headers['content-disposition'] || '';
+      const match = /filename="?([^";]+)"?/i.exec(disposition);
+      return {
+        bytes: new Uint8Array(await response.arrayBuffer()),
+        contentType: headers['content-type'] || 'application/octet-stream',
+        filename: match ? match[1] : null,
+        sha256: headers['x-content-sha256'] || null,
+        headers,
+      };
+    } catch (error) {
+      if (error.name === 'AbortError') throw new Error(`Request timeout after ${this.#timeout}ms`);
+      throw error;
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+
+  /**
+   * POST a multipart form (a file upload). The browser/undici sets the
+   * boundary, so no Content-Type is forced here.
+   * @param {string} endpoint - API endpoint
+   * @param {FormData} form - The form to send
+   * @returns {Promise<Object>} API response
+   */
+  async requestForm(endpoint, form) {
+    if (!this.#apiKey) {
+      throw new Error('API key is required for authenticated requests.');
+    }
+    const url = `${this.#baseUrl}${endpoint}`;
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), this.#timeout);
+    try {
+      const response = await fetch(url, {
+        method: 'POST',
+        body: form,
+        signal: controller.signal,
+        headers: { 'Authorization': `Bearer ${this.#apiKey}` },
+      });
+      const data = await response.json();
+      if (!response.ok) {
+        const structured = data && data.error && typeof data.error === 'object' ? data.error : null;
+        const error = new Error((structured && structured.message) || data.error || `HTTP ${response.status}`);
+        error.status = response.status;
+        error.response = data;
+        if (structured && structured.code) error.code = structured.code;
+        throw error;
+      }
+      return data;
+    } catch (error) {
+      if (error.name === 'AbortError') throw new Error(`Request timeout after ${this.#timeout}ms`);
+      throw error;
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+
   /**
    * Make an unauthenticated API request (for registration/login)
    * @param {string} endpoint - API endpoint
@@ -454,23 +545,61 @@ export class CoinPayClient {
 
   /**
    * Create a new business
+   *
+   * Field names are snake_case because that is what the API reads. This used to
+   * send `webhookUrl`, which POST /api/businesses does not look at -- it reads
+   * `input.webhook_url` -- so every business created through the SDK came back
+   * with a null webhook_url and no webhook secret, silently. The value was
+   * accepted, echoed nowhere, and dropped.
+   *
+   * `category` is required by the API and was not sent at all, so
+   * `coinpay business create` failed outright with "Select a valid business
+   * category" and there was no flag to supply one. Valid slugs live in
+   * src/lib/business/taxonomy.ts.
+   *
    * @param {Object} params - Business parameters
    * @param {string} params.name - Business name
+   * @param {string} params.category - Taxonomy slug; required by the API
+   * @param {string} [params.description]
    * @param {string} [params.webhookUrl] - Webhook URL
+   * @param {string} [params.webhookSecret] - Supply one, or the API generates it
    * @param {Object} [params.walletAddresses] - Wallet addresses by chain
    * @returns {Promise<Object>} Created business
    */
-  async createBusiness({ name, webhookUrl, walletAddresses }) {
+  async createBusiness({
+    name,
+    category,
+    description,
+    webhookUrl,
+    webhookSecret,
+    walletAddresses,
+  }) {
     return this.request('/businesses', {
       method: 'POST',
       body: JSON.stringify({
         name,
-        webhookUrl,
+        category,
+        description,
+        webhook_url: webhookUrl,
+        webhook_secret: webhookSecret,
         walletAddresses,
       }),
     });
   }
 
+  /**
+   * The taxonomy a business may be created with.
+   *
+   * Fetched rather than bundled: a copy inside the SDK goes stale the moment a
+   * category is added, and a stale copy is how "Select a valid business category"
+   * happens a second time.
+   *
+   * @returns {Promise<Object>} { success, categories: [{ slug, label, group, baseRisk }] }
+   */
+  async listBusinessCategories() {
+    return this.request('/businesses/categories', { method: 'GET' });
+  }
+
   /**
    * Update business
    * @param {string} businessId - Business ID