diff --git a/README.md b/README.md
index 516ad28..c5aed73 100644
--- a/README.md
+++ b/README.md
@@ -64,7 +64,7 @@ ADNETWORK_KEY=$(openssl rand -hex 32) ADNETWORK_COINPAY_CLIENT_ID=cp_… \
ADNETWORK_ADVERTISER_TOKEN=crp_… ADNETWORK_PUBLISHER_TOKEN=crp_… bun src/server.ts
```
-Settings: `ADNETWORK_KEY` (seals CoinPay tokens, signs claim codes),
+Settings: `ADNETWORK_KEY` (seals sign-in state, signs claim codes; no CoinPay token is stored: sign-in reads your payout wallets once and drops it),
`ADNETWORK_COINPAY_CLIENT_ID` / `_SECRET` (CoinPay OAuth client, scopes
`openid profile email wallet:read`), `ADNETWORK_ADVERTISER_TOKEN` /
`ADNETWORK_PUBLISHER_TOKEN` (crawlproof API tokens; the advertiser account must be
diff --git a/package.json b/package.json
index 3344616..9e1d72a 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
{
"name": "@profullstack/adnetwork",
- "version": "0.3.0",
+ "version": "0.3.1",
"description": "ad.network: run ads, or earn from your site, in crypto. Paste a link and a budget, or paste one tag and add a wallet. Web, API, CLI, TUI and MCP; ads by crawlproof, payments by CoinPay.",
"license": "MIT",
"type": "module",
diff --git a/src/db.ts b/src/db.ts
index ad710f1..4801596 100644
--- a/src/db.ts
+++ b/src/db.ts
@@ -4,7 +4,13 @@
* A person is their CoinPay account (`sub`). crawlproof holds the campaigns,
* slots and money; we keep which of them are whose, the deposits each
* advertiser made, and the last numbers we read, so a page never waits on
- * crawlproof to say who owns what. CoinPay tokens are sealed with ADNETWORK_KEY.
+ * crawlproof to say who owns what.
+ *
+ * No CoinPay token is kept (unlock-on-use fleet rule, 2026-10-28): the only
+ * use was suggesting the person's own payout wallets, so sign-in reads those
+ * addresses once with the fresh access token and drops it. `users.tokens` is
+ * the legacy copy under ADNETWORK_KEY: never read, NULLed on the next sign-in,
+ * counted by legacyTokenCount() until the cutoff.
*/
import { Database } from 'bun:sqlite'
import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto'
@@ -155,6 +161,8 @@ export class Store {
);
`)
// Added with hosted checkout sessions; older databases lack the column.
+ const userCols = new Set((this.db.query('PRAGMA table_info(users)').all() as { name: string }[]).map((c) => c.name))
+ if (!userCols.has('wallet_suggestions')) this.db.exec("ALTER TABLE users ADD COLUMN wallet_suggestions TEXT NOT NULL DEFAULT '[]'")
const cols = (this.db.query('PRAGMA table_info(deposits)').all() as { name: string }[]).map((c) => c.name)
if (!cols.includes('checkout_url')) this.db.exec("ALTER TABLE deposits ADD COLUMN checkout_url TEXT NOT NULL DEFAULT ''")
}
@@ -165,13 +173,14 @@ export class Store {
return row ? { sub: row.sub, name: row.name, email: row.email, apiKeyHash: row.api_key_hash, createdAt: row.created_at } : null
}
- upsertUser(sub: string, name: string, email: string, tokens: Tokens, now = Date.now()): User {
+ /** Creates or refreshes the account. A sign-in also drops any legacy token copy. */
+ upsertUser(sub: string, name: string, email: string, now = Date.now()): User {
this.db
.query(
- `INSERT INTO users (sub, name, email, tokens, created_at) VALUES (?, ?, ?, ?, ?)
- ON CONFLICT(sub) DO UPDATE SET name = excluded.name, email = excluded.email, tokens = excluded.tokens`,
+ `INSERT INTO users (sub, name, email, created_at) VALUES (?, ?, ?, ?)
+ ON CONFLICT(sub) DO UPDATE SET name = excluded.name, email = excluded.email, tokens = NULL`,
)
- .run(sub, name, email, this.sealer.seal(JSON.stringify(tokens)), now)
+ .run(sub, name, email, now)
return this.user(sub)!
}
@@ -187,13 +196,23 @@ export class Store {
this.db.query('UPDATE users SET api_key_hash = ? WHERE sub = ?').run(hashKey(key), sub)
}
- tokens(sub: string): Tokens | null {
- const row: any = this.db.query('SELECT tokens FROM users WHERE sub = ?').get(sub)
- return row?.tokens ? JSON.parse(this.sealer.open(row.tokens)) : null
+ /** Payout wallets read from CoinPay at sign-in (public addresses, not credentials). */
+ walletSuggestions(sub: string): { coin: string; address: string }[] {
+ const row: any = this.db.query('SELECT wallet_suggestions FROM users WHERE sub = ?').get(sub)
+ try {
+ return row?.wallet_suggestions ? JSON.parse(row.wallet_suggestions) : []
+ } catch {
+ return []
+ }
+ }
+
+ setWalletSuggestions(sub: string, list: { coin: string; address: string }[]): void {
+ this.db.query('UPDATE users SET wallet_suggestions = ? WHERE sub = ?').run(JSON.stringify(list), sub)
}
- saveTokens(sub: string, tokens: Tokens): void {
- this.db.query('UPDATE users SET tokens = ? WHERE sub = ?').run(this.sealer.seal(JSON.stringify(tokens)), sub)
+ /** Accounts still holding a legacy ADNETWORK_KEY token copy (cleared at their next sign-in). */
+ legacyTokenCount(): number {
+ return (this.db.query('SELECT COUNT(*) AS n FROM users WHERE tokens IS NOT NULL').get() as { n: number }).n
}
/** Forget a person. Their campaigns and slots stay on crawlproof; the caller stops them first. */
diff --git a/src/html.ts b/src/html.ts
index e4f94b2..f1e7360 100644
--- a/src/html.ts
+++ b/src/html.ts
@@ -174,7 +174,7 @@ adnetwork fund 25
adnetwork site example.com
claude mcp add adnetwork -- bunx @profullstack/adnetwork mcp
Webhooks
Add a URL on your page (or adnetwork webhook add, MCP create_webhook, POST /api/v1/webhooks) and ad.network POSTs what happens to your ads, budget and sites: ${WEBHOOK_EVENTS.map((e) => `${esc(e)}`).join(', ')}. Each is a CloudEvents JSON body signed per Standard Webhooks (verify with @profullstack/webhooks or any Standard Webhooks library), retried for about three days.
Your data
We keep your CoinPay name and email, your sign-in (encrypted), which ads and sites are yours, and your deposits. Delete it all on your page.
Your data
We keep your CoinPay name and email, the payout wallets CoinPay listed when you signed in (to prefill forms; never your CoinPay sign-in itself, which we do not store), which ads and sites are yours, and your deposits. Delete it all on your page.