openreceive 0.4.18 → 0.4.20

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dba3fc81d0ad5172879105b99ddd8fc0d4e28125d18395f9bbbce8926a831e2e
-  data.tar.gz: 49853773e93fa93b6668c64153047494ead7f74fb6698afbc30ad9367bcb2465
+  metadata.gz: a4d27a57c2eb4472bb9115faa410c456627175138dfdc0a99bac922b41e2c5e2
+  data.tar.gz: 8b9cf0b6349386672e6ddd837b4b22e37ae2b8b60859c81b434db6e61e800449
 SHA512:
-  metadata.gz: 6c4385a7f1dd045b2930ed819268de3744bfc3107af0f936b9a4ef03684f60d5dc4bf4eab6c84dca7c8afaf8df911c7974957acc0639e86827090be04ea1967d
-  data.tar.gz: ba37c33ce56f652c338bf2e1462e2a5da1c226df9c00f725293e8d55dc9df8cef200d932e9cd0f5146abe224d608ad394100aaf775cc50eeaa1042e675ca2f87
+  metadata.gz: f8209f3a34e49f833443c7bbf7da40ea1244c4369e18457d3936994234b98b94be28639f0299427493842eef8e84fa7829dd09ac35bb239b78ea6c37926cb236
+  data.tar.gz: a1ad42f0a0ef75f78f986f3104f1aa380ab05c559bf62694c83a08f10933af2eead4436fe64eb3114ef18b4fede8c7af1f51d3a17ffb88d4d47f676bd89d9e06

data/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.4.20 - 2026-10-09
+
+Release with the complete 0.4.20 package family. The bundled agent skills now
+describe the checkout stylesheet's rules as low specificity rather than zero:
+inside the checkout they carry one attribute, so a host page's Tailwind
+utilities cannot rearrange it. No Ruby runtime changes from 0.4.19.
+
+## 0.4.19 - 2026-10-07
+
+Release with the complete 0.4.19 package family. The bundled agent skills link
+the new WordPress hosting guide, and their Next.js and Express directions accept
+wallet codes already set as a hosting platform's environment variables. No Ruby
+runtime changes from 0.4.18.
+
 ## 0.4.18 - 2026-10-06
 
 Release with the complete 0.4.18 package family. The bundled agent skills carry

data/lib/openreceive/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module OpenReceive
-  VERSION = "0.4.18"
+  VERSION = "0.4.20"
 end

data/skills/integrate-openreceive/references/btcpay.md

@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/btcpay/full.md
 - Never tick the spend-capable override to make a save succeed.
 - Do not suggest rotating or revoking a code because it was pasted here.
 
-These directions describe OpenReceive 0.4.18.
+These directions describe OpenReceive 0.4.20.
 
 Connect a BTCPay Server store to a receive-only NWC wallet with the OpenReceive
 plugin, and optionally let payers pay BTCPay invoices with USDT, USDC, ETH or
@@ -125,6 +125,9 @@ needing attention. On a regtest machine, `packages/dotnet/docker/up.sh` then
 `e2e.sh` in the OpenReceive repository proves the whole path end to end, and
 that is the only situation where cloning the repository is the right move.
 
+Setup ends when the health check is clean. Say "Setup is finished" in one
+message. Do not offer more work or end the message on a question.
+
 ## More documentation
 
 Fetch one when the moment comes. Each is raw markdown, so a plain GET is

data/skills/integrate-openreceive/references/django.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (Django)
 
 ```sh
-# READ THIS FIRST: this file is 42 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 43 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/django/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/django/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.18.
+These directions describe OpenReceive 0.4.20.
 
 Add OpenReceive to a Django project — the app you are already working in. You
 do not need a copy of the OpenReceive source: the Python package is on PyPI
@@ -152,6 +152,24 @@ in-place `pip install -U` is undone by the next `compose up`.
 
 Only then start the quickstart.
 
+## After the quickstart — hand over, then stop
+
+The quickstart is done when `python manage.py openreceive_doctor` is clean and
+this app serves the checkout page for one of its orders. Doctor names any
+failed check and exits nonzero; fix it before going on.
+
+Give the user that checkout link. The browser check in the quickstart's
+"Render the checkout" section (payment-method icons, wallet logos, a pay
+tutorial) is theirs: tell them what to look at, and do not run it yourself.
+
+You cannot pay the invoice: the code is receive-only. Do not pay, settle or
+mark an order paid, and do not look for a way to (a wallet control port, a
+test endpoint, another wallet). If the user wants a real settlement test, they
+pay on that link from their own wallet, and `on_paid` marks the order paid.
+
+Setup ends here. Say "Setup is finished" in one message, with the link and
+what to check. Do not offer more work or end the message on a question.
+
 ## Non-negotiables
 
 The quickstart below has the code. These are the rules it cannot state for
@@ -164,6 +182,9 @@ itself, and they hold for every integration.
   logs, or assets.
 - Do not suggest rotating, revoking or replacing a code because it was pasted
   into this chat; that is the supported path.
+- Work only in this application. Never read or run anything from another
+  project on this machine (its `node_modules`, tools or source), for any
+  reason. A browser and Playwright are not part of setup.
 - The host owns the price. `amount_for` reads it from your own data;
   reject payer-supplied amounts.
 - `authorize` runs on every request, and the `resource` it receives is a
@@ -331,6 +352,7 @@ enough; drop the `.md` for the same page a person would read.
 - https://openreceive.org/guides/authorization.md — before you write `authorize`
 - https://openreceive.org/guides/environment-variables.md — every variable, and what is deliberately not one
 - https://openreceive.org/guides/storage.md — the engine tables and the attempt state machine
+- https://openreceive.org/guides/supabase.md — when the database is Supabase: its pooler, its certificate, and locking the tables away from its Data API
 - https://openreceive.org/guides/frontend-checkout.md — the drop-in's props, attributes and slots
 - https://openreceive.org/guides/checkout-ux.md — read before building any custom UI
 - https://openreceive.org/guides/headless-checkout.md — the controller, the display models, refunds
@@ -669,7 +691,7 @@ manage.py openreceive_doctor                        # the same, for humans; neve
 Serve the compiled `styles.css` without Tailwind processing. Either import it
 from JavaScript (with a CSS-capable bundler) or use a plain
 `<link rel="stylesheet">`. Do not `@import` it into your Tailwind entry. Its
-rules have zero specificity, so your own styles can override checkout styles.
+rules have low specificity, so your own styles can override checkout styles.
 Scoping does not prevent that.
 
 The app serves JSON checkout routes only. Your template does the rendering. Any

data/skills/integrate-openreceive/references/fastapi.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (FastAPI)
 
 ```sh
-# READ THIS FIRST: this file is 35 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 37 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/fastapi/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/fastapi/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.18.
+These directions describe OpenReceive 0.4.20.
 
 Add OpenReceive to a FastAPI application — the app you are already working in.
 You do not need a copy of the OpenReceive source: the engine is on PyPI
@@ -145,6 +145,25 @@ saying why. Upgrade first.
 
 Only then start the quickstart.
 
+## After the quickstart — hand over, then stop
+
+The quickstart is done when
+`openreceive doctor --app <module>:app --url <app url>` is clean and this app
+serves the checkout page for one of its orders. Doctor names any failed check
+and exits nonzero; fix it before going on.
+
+Give the user that checkout link. The browser check in the quickstart's step 6
+(payment-method icons, wallet logos, a pay tutorial) is theirs: tell them what
+to look at, and do not run it yourself.
+
+You cannot pay the invoice: the code is receive-only. Do not pay, settle or
+mark an order paid, and do not look for a way to (a wallet control port, a
+test endpoint, another wallet). If the user wants a real settlement test, they
+pay on that link from their own wallet, and `on_paid` marks the order paid.
+
+Setup ends here. Say "Setup is finished" in one message, with the link and
+what to check. Do not offer more work or end the message on a question.
+
 ## Non-negotiables
 
 The quickstart below has the code. These are the rules it cannot state for
@@ -157,6 +176,9 @@ itself, and they hold for every integration.
   logs, or assets.
 - Do not suggest rotating, revoking or replacing a code because it was pasted
   into this chat; that is the supported path.
+- Work only in this application. Never read or run anything from another
+  project on this machine (its `node_modules`, tools or source), for any
+  reason. A browser and Playwright are not part of setup.
 - The host owns the price. `amount_for` reads it from your own data; reject
   payer-supplied amounts.
 - `authorize` runs on every request, and the `resource` it receives is a CLAIM
@@ -329,6 +351,7 @@ enough; drop the `.md` for the same page a person would read.
 - https://openreceive.org/guides/authorization.md — before you write `authorize`
 - https://openreceive.org/guides/environment-variables.md — every variable, and what is deliberately not one
 - https://openreceive.org/guides/storage.md — the payment tables and the attempt state machine
+- https://openreceive.org/guides/supabase.md — when the database is Supabase: its pooler, its certificate, and locking the tables away from its Data API
 - https://openreceive.org/guides/frontend-checkout.md — the drop-in's props, attributes and slots
 - https://openreceive.org/guides/checkout-ux.md — read before building any custom UI
 - https://openreceive.org/guides/headless-checkout.md — the controller, the display models, refunds
@@ -568,7 +591,7 @@ rule applies only inside what OpenReceive renders.
 Serve the compiled `styles.css` without Tailwind processing. Import it from
 JavaScript if your bundler handles CSS, or use a plain
 `<link rel="stylesheet">`. Do not `@import` it into your app's Tailwind entry.
-Its rules have zero specificity, so your page's styles can override checkout
+Its rules have low specificity, so your page's styles can override checkout
 styles. Scoping does not prevent that.
 
 `<Checkout>` is complete as rendered. It already shows the `description` from

data/skills/integrate-openreceive/references/fastify.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (Fastify)
 
 ```sh
-# READ THIS FIRST: this file is 34 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 36 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/fastify/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/fastify/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.18.
+These directions describe OpenReceive 0.4.20.
 
 Add OpenReceive to a Fastify application — the app you are already working in.
 You do not need a copy of the OpenReceive source: the packages are on npm, and
@@ -138,6 +138,25 @@ first.
 
 Only then start the quickstart.
 
+## After the quickstart — hand over, then stop
+
+The quickstart is done when
+`npx openreceive doctor --db <file-or-url> --url <app url>` is clean and this
+app serves the checkout page for one of its orders. Doctor names any failed
+check and exits nonzero; fix it before going on.
+
+Give the user that checkout link. The browser check in the quickstart's step 6
+(payment-method icons, wallet logos, a pay tutorial) is theirs: tell them what
+to look at, and do not run it yourself.
+
+You cannot pay the invoice: the code is receive-only. Do not pay, settle or
+mark an order paid, and do not look for a way to (a wallet control port, a
+test endpoint, another wallet). If the user wants a real settlement test, they
+pay on that link from their own wallet, and `onPaid` marks the order paid.
+
+Setup ends here. Say "Setup is finished" in one message, with the link and
+what to check. Do not offer more work or end the message on a question.
+
 ## Non-negotiables
 
 The quickstart below has the code. These are the rules it cannot state for
@@ -150,6 +169,9 @@ itself, and they hold for every integration.
   logs, or assets.
 - Do not suggest rotating, revoking or replacing a code because it was pasted
   into this chat; that is the supported path.
+- Work only in this application. Never read or run anything from another
+  project on this machine (its `node_modules`, tools or source), for any
+  reason. A browser and Playwright are not part of setup.
 - The host owns the price. `amountFor` reads it from your own data; reject
   payer-supplied amounts.
 - `authorize` runs on every request, and the `resource` it receives is a CLAIM
@@ -313,6 +335,7 @@ enough; drop the `.md` for the same page a person would read.
 - https://openreceive.org/guides/authorization.md — before you write `authorize`
 - https://openreceive.org/guides/environment-variables.md — every variable, and what is deliberately not one
 - https://openreceive.org/guides/storage.md — the payment tables and the attempt state machine
+- https://openreceive.org/guides/supabase.md — when the database is Supabase: its pooler, its certificate, and locking the tables away from its Data API
 - https://openreceive.org/guides/node-orms.md — recipes for Prisma, Drizzle, Knex, TypeORM, Sequelize
 - https://openreceive.org/guides/frontend-checkout.md — the drop-in's props, attributes and slots
 - https://openreceive.org/guides/checkout-ux.md — read before building any custom UI
@@ -575,7 +598,7 @@ rule applies only inside what OpenReceive renders.
 Serve the compiled `styles.css` without Tailwind processing. Import it from
 JavaScript if your bundler handles CSS, or use a plain
 `<link rel="stylesheet">`. Do not `@import` it into your app's Tailwind entry.
-Its rules have zero specificity, so your page's styles can override checkout
+Its rules have low specificity, so your page's styles can override checkout
 styles. Scoping does not prevent that.
 
 `<Checkout>` is complete as rendered. It already shows the `description` from

data/skills/integrate-openreceive/references/laravel.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (Laravel)
 
 ```sh
-# READ THIS FIRST: this file is 41 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 42 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/laravel/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/laravel/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.18.
+These directions describe OpenReceive 0.4.20.
 
 Add OpenReceive to a Laravel application — the app you are already working in.
 You do not need a copy of the OpenReceive source: the package is on Packagist
@@ -143,6 +143,24 @@ in-place `composer update` is undone by the next `compose up`.
 
 Only then start the quickstart.
 
+## After the quickstart — hand over, then stop
+
+The quickstart is done when `php artisan openreceive:doctor` is clean and this
+app serves the checkout page for one of its orders. Doctor names any failed
+check; fix it before going on.
+
+Give the user that checkout link. The browser check in the quickstart's
+"Render the checkout" section (payment-method icons, wallet logos, a pay
+tutorial) is theirs: tell them what to look at, and do not run it yourself.
+
+You cannot pay the invoice: the code is receive-only. Do not pay, settle or
+mark an order paid, and do not look for a way to (a wallet control port, a
+test endpoint, another wallet). If the user wants a real settlement test, they
+pay on that link from their own wallet, and `onPaid` marks the order paid.
+
+Setup ends here. Say "Setup is finished" in one message, with the link and
+what to check. Do not offer more work or end the message on a question.
+
 ## Non-negotiables
 
 The quickstart below has the code. These are the rules it cannot state for
@@ -155,6 +173,9 @@ itself, and they hold for every integration.
   logs, or assets.
 - Do not suggest rotating, revoking or replacing a code because it was pasted
   into this chat; that is the supported path.
+- Work only in this application. Never read or run anything from another
+  project on this machine (its `node_modules`, tools or source), for any
+  reason. A browser and Playwright are not part of setup.
 - The host owns the price. `amountFor` reads it from your own data; reject
   payer-supplied amounts.
 - `authorize` runs on every request, and the `resource` it receives is a CLAIM
@@ -647,7 +668,7 @@ then costs one relay round trip, not two.
 Serve the compiled `styles.css` without Tailwind processing. Either import it
 from JavaScript (with a CSS-capable bundler) or use a plain
 `<link rel="stylesheet">`. Do not `@import` it into your Tailwind entry. Its
-rules have zero specificity, so your own styles can override checkout styles.
+rules have low specificity, so your own styles can override checkout styles.
 Scoping does not prevent that.
 
 The engine serves JSON checkout routes only. Your view does the rendering. Any

data/skills/integrate-openreceive/references/next.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (Next.js)
 
 ```sh
-# READ THIS FIRST: this file is 37 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 39 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/next/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/next/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.18.
+These directions describe OpenReceive 0.4.20.
 
 Add OpenReceive to a Next.js App Router application — the app you are already
 working in. You do not need a copy of the OpenReceive source: the packages are
@@ -64,6 +64,11 @@ there and non-empty, and never print the values. A code that is already
 set is not asked for again; if both are set, skip to step 5
 (making the server load the file), then the quickstart.
 
+On a hosted builder (v0, Vercel, Replit, Lovable), the user may say instead
+that both codes are already set as the project's environment variables or
+secrets. Believe them: do not ask for the codes, do not write `.env.local`, and
+do not read or print the variables. Next reads them from the environment.
+
 Otherwise your next action is a question to the user. Do not install packages,
 edit the app, write `.env.example`, or search anywhere else before asking
 it. Do not read deploy config (compose files, Vercel or platform secrets), Docker containers, or process environments, and never run
@@ -138,6 +143,25 @@ first.
 
 Only then start the quickstart.
 
+## After the quickstart — hand over, then stop
+
+The quickstart is done when
+`npx openreceive doctor --db <file-or-url> --url <app url>` is clean and this
+app serves the checkout page for one of its orders. Doctor names any failed
+check and exits nonzero; fix it before going on.
+
+Give the user that checkout link. The browser check in the quickstart's step 6
+(payment-method icons, wallet logos, a pay tutorial) is theirs: tell them what
+to look at, and do not run it yourself.
+
+You cannot pay the invoice: the code is receive-only. Do not pay, settle or
+mark an order paid, and do not look for a way to (a wallet control port, a
+test endpoint, another wallet). If the user wants a real settlement test, they
+pay on that link from their own wallet, and `onPaid` marks the order paid.
+
+Setup ends here. Say "Setup is finished" in one message, with the link and
+what to check. Do not offer more work or end the message on a question.
+
 ## Non-negotiables
 
 The quickstart below has the code. These are the rules it cannot state for
@@ -150,6 +174,9 @@ itself, and they hold for every integration.
   logs, or assets.
 - Do not suggest rotating, revoking or replacing a code because it was pasted
   into this chat; that is the supported path.
+- Work only in this application. Never read or run anything from another
+  project on this machine (its `node_modules`, tools or source), for any
+  reason. A browser and Playwright are not part of setup.
 - The host owns the price. `amountFor` reads it from your own data; reject
   payer-supplied amounts.
 - `authorize` runs on every request, and the `resource` it receives is a CLAIM
@@ -317,6 +344,7 @@ enough; drop the `.md` for the same page a person would read.
 - https://openreceive.org/guides/authorization.md — before you write `authorize`
 - https://openreceive.org/guides/environment-variables.md — every variable, and what is deliberately not one
 - https://openreceive.org/guides/storage.md — the payment tables and the attempt state machine
+- https://openreceive.org/guides/supabase.md — when the database is Supabase: its pooler, its certificate, and locking the tables away from its Data API
 - https://openreceive.org/guides/node-orms.md — recipes for Prisma, Drizzle, Knex, TypeORM, Sequelize
 - https://openreceive.org/guides/frontend-checkout.md — the drop-in's props, attributes and slots
 - https://openreceive.org/guides/checkout-ux.md — read before building any custom UI
@@ -334,6 +362,7 @@ enough; drop the `.md` for the same page a person would read.
 - https://openreceive.org/guides/api-reference.md — every route, option and error code
 - https://openreceive.org/guides/custom-checkout-route.md — advanced: replacing the shipped adapter's routes with your own
 - https://openreceive.org/guides/react-material-ui-recipe.md — a worked custom UI on a component library
+- https://openreceive.org/guides/tanstack-start-recipe.md — the same handler as a TanStack Start server route, if this app is TanStack Start after all
 - https://openreceive.org/guides.md — the index, if what you need is not above
 
 Questions, or a problem with the library itself:
@@ -620,7 +649,7 @@ scoped: every rule applies only inside what OpenReceive renders. You need no
 
 Serve the compiled `styles.css` without Tailwind processing: import it from
 JavaScript (with a CSS-capable bundler) or use a plain `<link rel="stylesheet">`.
-Do not `@import` it into the host Tailwind entry. Its zero-specificity rules
+Do not `@import` it into the host Tailwind entry. Its low-specificity rules
 allow host styles to override checkout styles; scoping does not prevent that.
 
 `<Checkout>` is complete as rendered. It already shows the `description` from

data/skills/integrate-openreceive/references/node.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (Node.js)
 
 ```sh
-# READ THIS FIRST: this file is 33 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 35 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/node/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/node/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.18.
+These directions describe OpenReceive 0.4.20.
 
 Add OpenReceive to a Node application — the app you are already working in. You
 do not need a copy of the OpenReceive source: the packages are on npm, and the
@@ -61,6 +61,11 @@ there and non-empty, and never print the values. A code that is already
 set is not asked for again; if both are set, skip to step 5
 (making the server load the file), then the quickstart.
 
+On a hosted builder (v0, Vercel, Replit, Lovable), the user may say instead
+that both codes are already set as the project's environment variables or
+secrets. Believe them: do not ask for the codes, do not write `.env`, and
+do not read or print the variables. Skip step 5's file loading: the platform already puts them in `process.env`.
+
 Otherwise your next action is a question to the user. Do not install packages,
 edit the app, write `.env.example`, or search anywhere else before asking
 it. Do not read deploy config (compose files, platform secrets), Docker containers, or process environments, and never run
@@ -135,6 +140,24 @@ first.
 
 Only then start the quickstart.
 
+## After the quickstart — hand over, then stop
+
+The quickstart is done when `npx openreceive doctor --db <file-or-url> --url <app url>`
+is clean and this app serves the checkout page for one of its orders. Doctor
+names any failed check and exits nonzero; fix it before going on.
+
+Give the user that checkout link. The browser check in the quickstart's
+step 6 (payment-method icons, wallet logos, a pay tutorial) is theirs: tell
+them what to look at, and do not run it yourself.
+
+You cannot pay the invoice: the code is receive-only. Do not pay, settle or
+mark an order paid, and do not look for a way to (a wallet control port, a
+test endpoint, another wallet). If the user wants a real settlement test, they
+pay on that link from their own wallet, and `onPaid` marks the order paid.
+
+Setup ends here. Say "Setup is finished" in one message, with the link and
+what to check. Do not offer more work or end the message on a question.
+
 ## Non-negotiables
 
 The quickstart below has the code. These are the rules it cannot state for
@@ -147,6 +170,9 @@ itself, and they hold for every integration.
   logs, or assets.
 - Do not suggest rotating, revoking or replacing a code because it was pasted
   into this chat; that is the supported path.
+- Work only in this application. Never read or run anything from another
+  project on this machine (its `node_modules`, tools or source), for any
+  reason. A browser and Playwright are not part of setup.
 - The host owns the price. `amountFor` reads it from your own data; reject
   payer-supplied amounts.
 - `authorize` runs on every request, and the `resource` it receives is a CLAIM
@@ -305,6 +331,7 @@ enough; drop the `.md` for the same page a person would read.
 - https://openreceive.org/guides/authorization.md — before you write `authorize`
 - https://openreceive.org/guides/environment-variables.md — every variable, and what is deliberately not one
 - https://openreceive.org/guides/storage.md — the payment tables and the attempt state machine
+- https://openreceive.org/guides/supabase.md — when the database is Supabase: its pooler, its certificate, and locking the tables away from its Data API
 - https://openreceive.org/guides/node-orms.md — recipes for Prisma, Drizzle, Knex, TypeORM, Sequelize
 - https://openreceive.org/guides/frontend-checkout.md — the drop-in's props, attributes and slots
 - https://openreceive.org/guides/checkout-ux.md — read before building any custom UI
@@ -549,7 +576,7 @@ rule applies only inside what OpenReceive renders.
 Serve the compiled `styles.css` without Tailwind processing. Import it from
 JavaScript if your bundler handles CSS, or use a plain
 `<link rel="stylesheet">`. Do not `@import` it into your app's Tailwind entry.
-Its rules have zero specificity, so your page's styles can override checkout
+Its rules have low specificity, so your page's styles can override checkout
 styles. Scoping does not prevent that.
 
 `<Checkout>` is complete as rendered. It already shows the `description` from

data/skills/integrate-openreceive/references/php.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (PHP)
 
 ```sh
-# READ THIS FIRST: this file is 37 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 38 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/php/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/php/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.18.
+These directions describe OpenReceive 0.4.20.
 
 Add OpenReceive to a PHP application — the app you are already working in. You
 do not need a copy of the OpenReceive source: the engine is on Packagist
@@ -148,6 +148,24 @@ the image, so an in-place `composer update` is undone by the next
 
 Only then start the quickstart.
 
+## After the quickstart — hand over, then stop
+
+The quickstart is done when the quickstart's `bin/doctor` script is clean and
+this app serves the checkout page for one of its orders. Doctor names any
+failed check; fix it before going on.
+
+Give the user that checkout link. The browser check in the quickstart's step 6
+(payment-method icons, wallet logos, a pay tutorial) is theirs: tell them what
+to look at, and do not run it yourself.
+
+You cannot pay the invoice: the code is receive-only. Do not pay, settle or
+mark an order paid, and do not look for a way to (a wallet control port, a
+test endpoint, another wallet). If the user wants a real settlement test, they
+pay on that link from their own wallet, and `onPaid` marks the order paid.
+
+Setup ends here. Say "Setup is finished" in one message, with the link and
+what to check. Do not offer more work or end the message on a question.
+
 ## Non-negotiables
 
 The quickstart below has the code. These are the rules it cannot state for
@@ -160,6 +178,9 @@ itself, and they hold for every integration.
   logs, or assets — and never in a `config.php` that ships in the repository.
 - Do not suggest rotating, revoking or replacing a code because it was pasted
   into this chat; that is the supported path.
+- Work only in this application. Never read or run anything from another
+  project on this machine (its `node_modules`, tools or source), for any
+  reason. A browser and Playwright are not part of setup.
 - The host owns the price. `amountFor` reads it from your own data; reject
   payer-supplied amounts.
 - `authorize` runs on every request, and the `resource` it receives is a CLAIM
@@ -592,7 +613,7 @@ HTTP routes and the browser snapshots are snake_case throughout.
 Serve the compiled `styles.css` without Tailwind processing. Either import it
 from JavaScript (with a CSS-capable bundler) or use a plain
 `<link rel="stylesheet">`. Do not `@import` it into your Tailwind entry. Its
-rules have zero specificity, so your own styles can override checkout styles.
+rules have low specificity, so your own styles can override checkout styles.
 Scoping does not prevent that.
 
 Unpack the release's `standalone-checkout-<version>.tar.gz` into a directory

data/skills/integrate-openreceive/references/rails.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (Rails)
 
 ```sh
-# READ THIS FIRST: this file is 38 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 40 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/rails/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/rails/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.18.
+These directions describe OpenReceive 0.4.20.
 
 Add OpenReceive to a Rails application — the app you are already working in. You
 do not need a copy of the OpenReceive source: the gem is on RubyGems, the
@@ -139,6 +139,24 @@ is undone by the next `compose up`.
 
 Only then start the quickstart.
 
+## After the quickstart — hand over, then stop
+
+The quickstart is done when `bin/rails openreceive:doctor` is clean and this
+app serves the checkout page for one of its orders. Doctor names any failed
+check; fix it before going on.
+
+Give the user that checkout link. The browser check in the quickstart's
+"Render the checkout" section (payment-method icons, wallet logos, a pay
+tutorial) is theirs: tell them what to look at, and do not run it yourself.
+
+You cannot pay the invoice: the code is receive-only. Do not pay, settle or
+mark an order paid, and do not look for a way to (a wallet control port, a
+test endpoint, another wallet). If the user wants a real settlement test, they
+pay on that link from their own wallet, and `on_paid` marks the order paid.
+
+Setup ends here. Say "Setup is finished" in one message, with the link and
+what to check. Do not offer more work or end the message on a question.
+
 ## Non-negotiables
 
 The quickstart below has the code. These are the rules it cannot state for
@@ -151,6 +169,9 @@ itself, and they hold for every integration.
   logs, or assets.
 - Do not suggest rotating, revoking or replacing a code because it was pasted
   into this chat; that is the supported path.
+- Work only in this application. Never read or run anything from another
+  project on this machine (its `node_modules`, tools or source), for any
+  reason. A browser and Playwright are not part of setup.
 - The host owns the price. `config.amount_for` reads it from your own data;
   reject payer-supplied amounts.
 - `config.authorize` runs on every request, and the `resource` it receives is a
@@ -609,7 +630,7 @@ live wallet is needed.
 Serve the compiled `styles.css` without Tailwind processing. Either import it
 from JavaScript (with a CSS-capable bundler) or use a plain
 `<link rel="stylesheet">`. Do not `@import` it into your Tailwind entry. Its
-rules have zero specificity, so your own styles can override checkout styles.
+rules have low specificity, so your own styles can override checkout styles.
 Scoping does not prevent that.
 
 The engine serves JSON checkout routes only. Your view does the rendering. Any

data/skills/integrate-openreceive/references/woocommerce.md

@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/woocommerce/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Setup is done only when the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.18.
+These directions describe OpenReceive 0.4.20.
 
 Install and configure the OpenReceive payment gateway in the WooCommerce store
 you are working in. Preserve its theme, checkout, customer accounts, order
@@ -96,7 +96,7 @@ Install the plugin built for this release. Never install the GitHub
 source-code ZIP or a ZIP from an older release:
 
 ```sh
-wp plugin install https://github.com/OpenReceive/openreceive/releases/download/v0.4.18/openreceive-wordpress-0.4.18.zip --activate
+wp plugin install https://github.com/OpenReceive/openreceive/releases/download/v0.4.20/openreceive-wordpress-0.4.20.zip --activate
 ```
 
 It needs WooCommerce active, and PHP 8.2+ with GMP and sodium in BOTH the web
@@ -236,7 +236,7 @@ database or application.
 
 ### Get the installable archive
 
-Download [openreceive-wordpress-0.4.18.zip](https://github.com/OpenReceive/openreceive/releases/download/v0.4.18/openreceive-wordpress-0.4.18.zip)
+Download [openreceive-wordpress-0.4.20.zip](https://github.com/OpenReceive/openreceive/releases/download/v0.4.20/openreceive-wordpress-0.4.20.zip)
 from the matching release. Historical releases may lack this asset. If that exact
 URL returns 404, build the same tag below; never silently install an older ZIP.
 The GitHub source-code ZIP is not an installable plugin. On a development machine
@@ -245,7 +245,7 @@ with Node 22+, PHP 8.2+ with GMP/sodium, Composer and WP-CLI:
 ```sh
 git clone https://github.com/OpenReceive/openreceive.git
 cd openreceive
-git checkout v0.4.18
+git checkout v0.4.20
 npm ci
 npm run build:packages
 composer install --working-dir=packages/php/wordpress
@@ -288,7 +288,9 @@ package matching the active PHP version (for example `php8.2-gmp` for PHP 8.2),
 then restart that version's web PHP service. Verify `php --ri gmp` and
 `wp openreceive doctor` for CLI, and the gateway Doctor panel for web PHP.
 On managed WordPress hosting, ask the host to enable GMP and sodium in both
-runtimes; if they cannot, this plugin cannot run there. Do not use Composer's
+runtimes; if they cannot, this plugin cannot run there.
+[WordPress hosting requirements](https://openreceive.org/guides/wordpress-hosting.md) lists what common hosts
+offer and how to check your site. Do not use Composer's
 `--ignore-platform-reqs` to bypass the requirements.
 
 #### Compose files with only `image:` lines

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: openreceive
 version: !ruby/object:Gem::Version
-  version: 0.4.18
+  version: 0.4.20
 platform: ruby
 authors:
 - OpenReceive