RubyGems - openreceive - Versions diffs - 0.4.21 → 0.4.22 - Mend

openreceive 0.4.21 → 0.4.22

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (14) hide show

checksums.yaml +4 -4
data/CHANGELOG.md +9 -0
data/lib/openreceive/version.rb +1 -1
data/skills/integrate-openreceive/references/btcpay.md +1 -1
data/skills/integrate-openreceive/references/django.md +55 -26
data/skills/integrate-openreceive/references/fastapi.md +59 -31
data/skills/integrate-openreceive/references/fastify.md +63 -33
data/skills/integrate-openreceive/references/laravel.md +63 -30
data/skills/integrate-openreceive/references/next.md +51 -27
data/skills/integrate-openreceive/references/node.md +61 -31
data/skills/integrate-openreceive/references/php.md +51 -27
data/skills/integrate-openreceive/references/rails.md +51 -26
data/skills/integrate-openreceive/references/woocommerce.md +20 -14
metadata +1 -1

data/skills/integrate-openreceive/references/laravel.md CHANGED Viewed

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (Laravel)
 ```sh
-# READ THIS FIRST: this file is 42 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 44 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/laravel/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/laravel/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
-These directions describe OpenReceive 0.4.21.
+These directions describe OpenReceive 0.4.22.
 Add OpenReceive to a Laravel application — the app you are already working in.
 You do not need a copy of the OpenReceive source: the package is on Packagist
@@ -59,11 +59,12 @@ owns orders, users, prices, or fulfillment.
 ## Step 0 — ask for the two codes, one question at a time
-Before anything else, look at one file: the project's `.env`, if it exists.
-Read it only far enough to see whether `NWC_URI` and `LSC_URI_PRIMARY` are
-there and non-empty, and never print the values. A code that is already
-set is not asked for again; if both are set, skip to step 5
-(making the server load the file), then the quickstart.
+Before anything else, check one file: the project's `.env`, if it exists.
+`grep -E '^(NWC_URI|LSC_URI_PRIMARY)=.' .env | cut -d= -f1` names the codes
+it sets without printing them. Check with that, here and after each write,
+not by reading the file, and never print the values. A code that is already
+set is not asked for again; if both are set, skip to step 5 (making the
+server load the file), then the quickstart.
 Otherwise your next action is a question to the user. Do not install the package,
 edit the app, write `.env.example`, or search anywhere else before asking
@@ -94,14 +95,17 @@ you store it. Ask one question per message.
    Do not mention `.env`, exports, or "tell me when it's set".
 2. **When they paste it.** If it does not start with `nostr+walletconnect://`,
    ask them to copy the receive-only code again. Otherwise write
-   `NWC_URI=<paste>` into the project's `.env`, creating the file if needed.
-   Make sure `.gitignore` covers `.env` (and `.dockerignore`, if the app has
-   one). Never echo the value, commit it, or put it in client code. Reply only
-   that it is saved, then ask the next question.
-3. **Second message — swaps.** If the user already asked for stablecoins or
-   altcoins, skip the yes/no and go straight to the walkthrough. Otherwise ask
-   whether payers should also be able to pay with USDT, USDC, ETH or SOL. The
-   walkthrough:
+   `NWC_URI=<paste>` into the project's `.env` with your file-editing tool,
+   creating the file if needed. Never write it with a shell command (`echo`,
+   `printf`, a heredoc, `python -c`): the command line shows the code. Make
+   sure `.gitignore` covers `.env` (and `.dockerignore`, if the app has one).
+   Never echo the value, commit it, or put it in client code. Reply only that
+   it is saved, then ask the next question.
+3. **Second message — swaps.** If the user asked for stablecoins, USDT, USDC,
+   ETH, SOL, altcoins or "crypto" (as in "Bitcoin and stablecoin payments"),
+   this message IS the walkthrough below: send it as it is, and do not ask yes
+   or no first. Otherwise ask whether payers should also be able to pay with
+   USDT, USDC, ETH or SOL, then give the walkthrough. The walkthrough:
    > Go to https://lightning-swap.com, sign in for API keys, create a key, and
    > copy the whole URI (https://openreceive.org/set_up_swap_provider). Paste
@@ -111,16 +115,21 @@ you store it. Ask one question per message.
    Mention FixedFloat only if they already use it.
 4. **When they paste it.** If it does not start with
    `lightning+swapconnect://`, ask them to copy it again. Otherwise add
-   `LSC_URI_PRIMARY=<paste>` to the same `.env`, without echoing it. Swaps
-   are now on, so build the refund route back (the swap non-negotiable below) as
-   part of this integration. If they chose Bitcoin only, leave
-   `LSC_URI_PRIMARY` unset and skip that route.
+   `LSC_URI_PRIMARY=<paste>` to the same `.env` with the file-editing tool,
+   never a shell command. Swaps are now on, so build the refund route back
+   (the swap non-negotiable below) as part of this integration. If they chose
+   Bitcoin only, leave `LSC_URI_PRIMARY` unset and skip that route.
 5. **Make the server load the file — yourself.** Laravel loads
    `.env` itself. If the app runs `php artisan config:cache`, run
    `php artisan config:clear` (or re-cache) after writing the file: a cached
    config never reads `.env` again. When the app is started with Docker
-   Compose, give the service `env_file: .env`. Restart the server after
-   writing the file.
+   Compose, give the service `env_file: .env`. A Compose variable reaches
+   artisan commands, but not the web server: `php artisan serve` hands
+   requests only what `.env` holds, and php-fpm clears the environment by
+   default. So make the running app read the codes too: keep them in the
+   `.env` the server reads (an image that copies `.env.example` over it
+   drops them), start `php artisan serve` with `--no-reload`, or set
+   `clear_env = no` for php-fpm. Restart the server after writing the file.
 Do not invent placeholder URIs. Start the quickstart only once `NWC_URI` is
 saved and `LSC_URI_PRIMARY` is saved or explicitly declined. The first boot
@@ -151,22 +160,28 @@ check; fix it before going on.
 Give the user that checkout link. The browser check in the quickstart's
 "Render the checkout" section (payment-method icons, wallet logos, a pay
-tutorial) is theirs: tell them what to look at, and do not run it yourself.
+tutorial) is theirs: name it in one line of your closing message, and do not
+run it yourself.
 You cannot pay the invoice: the code is receive-only. Do not pay, settle or
 mark an order paid, and do not look for a way to (a wallet control port, a
 test endpoint, another wallet). If the user wants a real settlement test, they
 pay on that link from their own wallet, and `onPaid` marks the order paid.
-Setup ends here. Say "Setup is finished" in one message of at most five
-lines, with the link and what to check. Do not list what changed, offer more
-work, or end the message on a question.
+Setup ends here. Your last message starts "Setup is finished" and has at most
+five short lines (about 80 characters each): the link, the methods it offers,
+and one line of what to look at. Send nothing after it. Do not list what
+changed, copy out the quickstart's browser checklist, offer more work, or end
+the message on a question.
 - The link is to a real unpaid order. Keep that order; do not delete it.
+- When this app's orders belong to a session or cookie, the user's browser
+  cannot open the order you made. Then the link is the shop's own page:
+  "Open <shop url> and click Buy: it opens the checkout." Do not explain order
+  ownership or mention your test order.
 - Name the methods it offers: Bitcoin, plus USDT, USDC, ETH and SOL when
-  `LSC_URI_PRIMARY` is saved. Never say a coin will not work or will not be
-  offered. Swap minimums apply per order, and a coin whose minimum is above an
-  order's total says so on its own tile.
+  `LSC_URI_PRIMARY` is saved. Do not mention minimums, and never say a coin
+  will not work or will not be offered.
 ## Non-negotiables
@@ -183,6 +198,22 @@ itself, and they hold for every integration.
 - Work only in this application. Never read or run anything from another
   project on this machine (its `node_modules`, tools or source), for any
   reason. A browser and Playwright are not part of setup.
+- Restart only this app's server, on the port it already uses: stop the
+  process you started, or the one listening on that port, by its pid (or
+  restart its Compose service). Never `pkill` or `killall` by name: that
+  stops other people's servers too. Start it the way this project already
+  does (its README, Procfile, compose file or package script), on its own
+  port, not a port you pick.
+- Run commands where the app runs. When a compose file builds it, run its
+  package manager, generators, migrations and doctor inside that service
+  (`docker compose exec` or `run`), and rebuild the image after adding a
+  package. This machine's language version and database path are not the
+  app's.
+- To check that the running app sees the codes, run doctor: it reports each
+  one as present or missing and never prints a value. Never print the
+  environment (`printenv`, `env`, `docker compose config`), even filtered to
+  names. Doctor runs as an artisan command, so also open the checkout page:
+  the web server can miss a code that doctor sees (step 5).
 - The host owns the price. `amountFor` reads it from your own data; reject
   payer-supplied amounts.
 - `authorize` runs on every request, and the `resource` it receives is a CLAIM
@@ -392,10 +423,12 @@ PHP extensions:
 Add the Laravel package:
 ```sh
-composer require openreceive/laravel
+composer require openreceive/laravel -W
 ```
-That is the whole install. `openreceive/laravel` depends on
+`-W` lets Composer move Guzzle to 7.x: the wallet client's WebSocket
+middleware needs Guzzle 7, and a Laravel 13 app can lock Guzzle 8. That is
+the whole install. `openreceive/laravel` depends on
 `openreceive/openreceive`, the engine. So the default wallet client works with
 nothing else added. It is built from `NWC_URI`. Package discovery registers the
 service provider. If your app brings its own NWC client, bind

data/skills/integrate-openreceive/references/next.md CHANGED Viewed

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (Next.js)
 ```sh
-# READ THIS FIRST: this file is 39 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 41 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/next/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/next/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
-These directions describe OpenReceive 0.4.21.
+These directions describe OpenReceive 0.4.22.
 Add OpenReceive to a Next.js App Router application — the app you are already
 working in. You do not need a copy of the OpenReceive source: the packages are
@@ -58,11 +58,12 @@ owns orders, users, prices, or fulfillment.
 ## Step 0 — ask for the two codes, one question at a time
-Before anything else, look at one file: the project's `.env.local`, if it exists.
-Read it only far enough to see whether `NWC_URI` and `LSC_URI_PRIMARY` are
-there and non-empty, and never print the values. A code that is already
-set is not asked for again; if both are set, skip to step 5
-(making the server load the file), then the quickstart.
+Before anything else, check one file: the project's `.env.local`, if it exists.
+`grep -E '^(NWC_URI|LSC_URI_PRIMARY)=.' .env.local | cut -d= -f1` names the codes
+it sets without printing them. Check with that, here and after each write,
+not by reading the file, and never print the values. A code that is already
+set is not asked for again; if both are set, skip to step 5 (making the
+server load the file), then the quickstart.
 On a hosted builder (v0, Vercel, Replit, Lovable), the user may say instead
 that both codes are already set as the project's environment variables or
@@ -98,14 +99,17 @@ you store it. Ask one question per message.
    Do not mention `.env`, exports, or "tell me when it's set".
 2. **When they paste it.** If it does not start with `nostr+walletconnect://`,
    ask them to copy the receive-only code again. Otherwise write
-   `NWC_URI=<paste>` into the project's `.env.local`, creating the file if needed.
-   Make sure `.gitignore` covers `.env.local` (and `.dockerignore`, if the app has
-   one). Never echo the value, commit it, or put it in client code. Reply only
-   that it is saved, then ask the next question.
-3. **Second message — swaps.** If the user already asked for stablecoins or
-   altcoins, skip the yes/no and go straight to the walkthrough. Otherwise ask
-   whether payers should also be able to pay with USDT, USDC, ETH or SOL. The
-   walkthrough:
+   `NWC_URI=<paste>` into the project's `.env.local` with your file-editing
+   tool, creating the file if needed. Never write it with a shell command
+   (`echo`, `printf`, a heredoc, `python -c`): the command line shows the
+   code. Make sure `.gitignore` covers `.env.local` (and `.dockerignore`, if
+   the app has one). Never echo the value, commit it, or put it in client
+   code. Reply only that it is saved, then ask the next question.
+3. **Second message — swaps.** If the user asked for stablecoins, USDT, USDC,
+   ETH, SOL, altcoins or "crypto" (as in "Bitcoin and stablecoin payments"),
+   this message IS the walkthrough below: send it as it is, and do not ask yes
+   or no first. Otherwise ask whether payers should also be able to pay with
+   USDT, USDC, ETH or SOL, then give the walkthrough. The walkthrough:
    > Go to https://lightning-swap.com, sign in for API keys, create a key, and
    > copy the whole URI (https://openreceive.org/set_up_swap_provider). Paste
@@ -115,10 +119,10 @@ you store it. Ask one question per message.
    Mention FixedFloat only if they already use it.
 4. **When they paste it.** If it does not start with
    `lightning+swapconnect://`, ask them to copy it again. Otherwise add
-   `LSC_URI_PRIMARY=<paste>` to the same `.env.local`, without echoing it. Swaps
-   are now on, so build the refund route back (the swap non-negotiable below) as
-   part of this integration. If they chose Bitcoin only, leave
-   `LSC_URI_PRIMARY` unset and skip that route.
+   `LSC_URI_PRIMARY=<paste>` to the same `.env.local` with the file-editing
+   tool, never a shell command. Swaps are now on, so build the refund route
+   back (the swap non-negotiable below) as part of this integration. If they
+   chose Bitcoin only, leave `LSC_URI_PRIMARY` unset and skip that route.
 5. **Make the server load the file — yourself.** Next loads
    `.env.local` into `process.env` on its own: do not add `dotenv`, and never
    give a credential a `NEXT_PUBLIC_` prefix, which inlines it into the browser
@@ -153,23 +157,28 @@ Doctor reads `.env.local` itself. Never source it into a shell: the `&` in a
 code splits the value and prints the pieces.
 Give the user that checkout link. The browser check in the quickstart's step 6
-(payment-method icons, wallet logos, a pay tutorial) is theirs: tell them what
-to look at, and do not run it yourself.
+(payment-method icons, wallet logos, a pay tutorial) is theirs: name it in one
+line of your closing message, and do not run it yourself.
 You cannot pay the invoice: the code is receive-only. Do not pay, settle or
 mark an order paid, and do not look for a way to (a wallet control port, a
 test endpoint, another wallet). If the user wants a real settlement test, they
 pay on that link from their own wallet, and `onPaid` marks the order paid.
-Setup ends here. Say "Setup is finished" in one message of at most five
-lines, with the link and what to check. Do not list what changed, offer more
-work, or end the message on a question.
+Setup ends here. Your last message starts "Setup is finished" and has at most
+five short lines (about 80 characters each): the link, the methods it offers,
+and one line of what to look at. Send nothing after it. Do not list what
+changed, copy out the quickstart's browser checklist, offer more work, or end
+the message on a question.
 - The link is to a real unpaid order. Keep that order; do not delete it.
+- When this app's orders belong to a session or cookie, the user's browser
+  cannot open the order you made. Then the link is the shop's own page:
+  "Open <shop url> and click Buy: it opens the checkout." Do not explain order
+  ownership or mention your test order.
 - Name the methods it offers: Bitcoin, plus USDT, USDC, ETH and SOL when
-  `LSC_URI_PRIMARY` is saved. Never say a coin will not work or will not be
-  offered. Swap minimums apply per order, and a coin whose minimum is above an
-  order's total says so on its own tile.
+  `LSC_URI_PRIMARY` is saved. Do not mention minimums, and never say a coin
+  will not work or will not be offered.
 ## Non-negotiables
@@ -186,6 +195,21 @@ itself, and they hold for every integration.
 - Work only in this application. Never read or run anything from another
   project on this machine (its `node_modules`, tools or source), for any
   reason. A browser and Playwright are not part of setup.
+- Restart only this app's server, on the port it already uses: stop the
+  process you started, or the one listening on that port, by its pid (or
+  restart its Compose service). Never `pkill` or `killall` by name: that
+  stops other people's servers too. Start it the way this project already
+  does (its README, Procfile, compose file or package script), on its own
+  port, not a port you pick.
+- Run commands where the app runs. When a compose file builds it, run its
+  package manager, generators, migrations and doctor inside that service
+  (`docker compose exec` or `run`), and rebuild the image after adding a
+  package. This machine's language version and database path are not the
+  app's.
+- To check that the running app sees the codes, run doctor: it reports each
+  one as present or missing and never prints a value. Never print the
+  environment (`printenv`, `env`, `docker compose config`), even filtered to
+  names.
 - The host owns the price. `amountFor` reads it from your own data; reject
   payer-supplied amounts.
 - `authorize` runs on every request, and the `resource` it receives is a CLAIM

data/skills/integrate-openreceive/references/node.md CHANGED Viewed

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (Node.js)
 ```sh
-# READ THIS FIRST: this file is 35 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 37 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/node/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/node/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
-These directions describe OpenReceive 0.4.21.
+These directions describe OpenReceive 0.4.22.
 Add OpenReceive to a Node application — the app you are already working in. You
 do not need a copy of the OpenReceive source: the packages are on npm, and the
@@ -55,11 +55,12 @@ owns orders, users, prices, or fulfillment.
 ## Step 0 — ask for the two codes, one question at a time
-Before anything else, look at one file: the project's `.env`, if it exists.
-Read it only far enough to see whether `NWC_URI` and `LSC_URI_PRIMARY` are
-there and non-empty, and never print the values. A code that is already
-set is not asked for again; if both are set, skip to step 5
-(making the server load the file), then the quickstart.
+Before anything else, check one file: the project's `.env`, if it exists.
+`grep -E '^(NWC_URI|LSC_URI_PRIMARY)=.' .env | cut -d= -f1` names the codes
+it sets without printing them. Check with that, here and after each write,
+not by reading the file, and never print the values. A code that is already
+set is not asked for again; if both are set, skip to step 5 (making the
+server load the file), then the quickstart.
 On a hosted builder (v0, Vercel, Replit, Lovable), the user may say instead
 that both codes are already set as the project's environment variables or
@@ -95,14 +96,17 @@ you store it. Ask one question per message.
    Do not mention `.env`, exports, or "tell me when it's set".
 2. **When they paste it.** If it does not start with `nostr+walletconnect://`,
    ask them to copy the receive-only code again. Otherwise write
-   `NWC_URI=<paste>` into the project's `.env`, creating the file if needed.
-   Make sure `.gitignore` covers `.env` (and `.dockerignore`, if the app has
-   one). Never echo the value, commit it, or put it in client code. Reply only
-   that it is saved, then ask the next question.
-3. **Second message — swaps.** If the user already asked for stablecoins or
-   altcoins, skip the yes/no and go straight to the walkthrough. Otherwise ask
-   whether payers should also be able to pay with USDT, USDC, ETH or SOL. The
-   walkthrough:
+   `NWC_URI=<paste>` into the project's `.env` with your file-editing tool,
+   creating the file if needed. Never write it with a shell command (`echo`,
+   `printf`, a heredoc, `python -c`): the command line shows the code. Make
+   sure `.gitignore` covers `.env` (and `.dockerignore`, if the app has one).
+   Never echo the value, commit it, or put it in client code. Reply only that
+   it is saved, then ask the next question.
+3. **Second message — swaps.** If the user asked for stablecoins, USDT, USDC,
+   ETH, SOL, altcoins or "crypto" (as in "Bitcoin and stablecoin payments"),
+   this message IS the walkthrough below: send it as it is, and do not ask yes
+   or no first. Otherwise ask whether payers should also be able to pay with
+   USDT, USDC, ETH or SOL, then give the walkthrough. The walkthrough:
    > Go to https://lightning-swap.com, sign in for API keys, create a key, and
    > copy the whole URI (https://openreceive.org/set_up_swap_provider). Paste
@@ -112,10 +116,10 @@ you store it. Ask one question per message.
    Mention FixedFloat only if they already use it.
 4. **When they paste it.** If it does not start with
    `lightning+swapconnect://`, ask them to copy it again. Otherwise add
-   `LSC_URI_PRIMARY=<paste>` to the same `.env`, without echoing it. Swaps
-   are now on, so build the refund route back (the swap non-negotiable below) as
-   part of this integration. If they chose Bitcoin only, leave
-   `LSC_URI_PRIMARY` unset and skip that route.
+   `LSC_URI_PRIMARY=<paste>` to the same `.env` with the file-editing tool,
+   never a shell command. Swaps are now on, so build the refund route back
+   (the swap non-negotiable below) as part of this integration. If they chose
+   Bitcoin only, leave `LSC_URI_PRIMARY` unset and skip that route.
 5. **Make the server load the file — yourself.** OpenReceive reads
    `process.env`, and a `.env` file on disk is not in it. Put
    `import "dotenv/config";` at the top of the server entry, as the quickstart
@@ -148,24 +152,29 @@ names any failed check and exits nonzero; fix it before going on.
 Doctor reads `.env` itself. Never source it into a shell: the `&` in a
 code splits the value and prints the pieces.
-Give the user that checkout link. The browser check in the quickstart's
-step 6 (payment-method icons, wallet logos, a pay tutorial) is theirs: tell
-them what to look at, and do not run it yourself.
+Give the user that checkout link. The browser check in the quickstart's step 6
+(payment-method icons, wallet logos, a pay tutorial) is theirs: name it in one
+line of your closing message, and do not run it yourself.
 You cannot pay the invoice: the code is receive-only. Do not pay, settle or
 mark an order paid, and do not look for a way to (a wallet control port, a
 test endpoint, another wallet). If the user wants a real settlement test, they
 pay on that link from their own wallet, and `onPaid` marks the order paid.
-Setup ends here. Say "Setup is finished" in one message of at most five
-lines, with the link and what to check. Do not list what changed, offer more
-work, or end the message on a question.
+Setup ends here. Your last message starts "Setup is finished" and has at most
+five short lines (about 80 characters each): the link, the methods it offers,
+and one line of what to look at. Send nothing after it. Do not list what
+changed, copy out the quickstart's browser checklist, offer more work, or end
+the message on a question.
 - The link is to a real unpaid order. Keep that order; do not delete it.
+- When this app's orders belong to a session or cookie, the user's browser
+  cannot open the order you made. Then the link is the shop's own page:
+  "Open <shop url> and click Buy: it opens the checkout." Do not explain order
+  ownership or mention your test order.
 - Name the methods it offers: Bitcoin, plus USDT, USDC, ETH and SOL when
-  `LSC_URI_PRIMARY` is saved. Never say a coin will not work or will not be
-  offered. Swap minimums apply per order, and a coin whose minimum is above an
-  order's total says so on its own tile.
+  `LSC_URI_PRIMARY` is saved. Do not mention minimums, and never say a coin
+  will not work or will not be offered.
 ## Non-negotiables
@@ -182,6 +191,21 @@ itself, and they hold for every integration.
 - Work only in this application. Never read or run anything from another
   project on this machine (its `node_modules`, tools or source), for any
   reason. A browser and Playwright are not part of setup.
+- Restart only this app's server, on the port it already uses: stop the
+  process you started, or the one listening on that port, by its pid (or
+  restart its Compose service). Never `pkill` or `killall` by name: that
+  stops other people's servers too. Start it the way this project already
+  does (its README, Procfile, compose file or package script), on its own
+  port, not a port you pick.
+- Run commands where the app runs. When a compose file builds it, run its
+  package manager, generators, migrations and doctor inside that service
+  (`docker compose exec` or `run`), and rebuild the image after adding a
+  package. This machine's language version and database path are not the
+  app's.
+- To check that the running app sees the codes, run doctor: it reports each
+  one as present or missing and never prints a value. Never print the
+  environment (`printenv`, `env`, `docker compose config`), even filtered to
+  names.
 - The host owns the price. `amountFor` reads it from your own data; reject
   payer-supplied amounts.
 - `authorize` runs on every request, and the `resource` it receives is a CLAIM
@@ -252,7 +276,10 @@ products, and you do not join them.
   are buying.
 - **Users own the order; OpenReceive never sees them.** `authorize` uses the
   same ownership check this app already uses on the order show / pay page —
-  `sessions.currentUser(request)`, a cookie, whatever it is.
+  `sessions.currentUser(native)`, a cookie, whatever it is. Pass `native` (the
+  Express request) to this app's own cookie and session helpers, never
+  `request`: that one is a Web Request, a helper that reads
+  `req.headers.cookie` finds nothing on it, and every payer gets a 403.
   `resource.reference` is a claim the payer sent, not proof.
 - **The order is unpaid or paid.** Do not copy `pending` / `expired` / `failed`
   / `attention` onto it. Those are attempt statuses on `openreceive_payments`. An
@@ -505,9 +532,12 @@ const openreceive = openReceiveExpress({
   // Your own access check: may this caller do this action to this reference?
   // `resource.reference` is your own order id, sent back by the payer's
   // browser — a claim, not proof — already validated as a non-empty string.
-  authorize: async ({ action, request, resource }) =>
+  // `native` is the untouched Express request: pass it to this app's own
+  // cookie and session helpers. `request` is a Web Request, so a helper that
+  // reads `req.headers.cookie` finds nothing on it and every payer gets a 403.
+  authorize: async ({ action, native, resource }) =>
     orders.viewerMay(
-      await sessions.currentUser(request),
+      await sessions.currentUser(native),
       resource.reference,
       action,
     ),

data/skills/integrate-openreceive/references/php.md CHANGED Viewed

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (PHP)
 ```sh
-# READ THIS FIRST: this file is 39 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 40 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/php/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/php/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
-These directions describe OpenReceive 0.4.21.
+These directions describe OpenReceive 0.4.22.
 Add OpenReceive to a PHP application — the app you are already working in. You
 do not need a copy of the OpenReceive source: the engine is on Packagist
@@ -59,11 +59,12 @@ owns orders, users, prices, or fulfillment.
 ## Step 0 — ask for the two codes, one question at a time
-Before anything else, look at one file: the project's `.env`, if it exists.
-Read it only far enough to see whether `NWC_URI` and `LSC_URI_PRIMARY` are
-there and non-empty, and never print the values. A code that is already
-set is not asked for again; if both are set, skip to step 5
-(making the server load the file), then the quickstart.
+Before anything else, check one file: the project's `.env`, if it exists.
+`grep -E '^(NWC_URI|LSC_URI_PRIMARY)=.' .env | cut -d= -f1` names the codes
+it sets without printing them. Check with that, here and after each write,
+not by reading the file, and never print the values. A code that is already
+set is not asked for again; if both are set, skip to step 5 (making the
+server load the file), then the quickstart.
 Otherwise your next action is a question to the user. Do not run `composer require`,
 edit the app, write `.env.example`, or search anywhere else before asking
@@ -94,14 +95,17 @@ you store it. Ask one question per message.
    Do not mention `.env`, exports, or "tell me when it's set".
 2. **When they paste it.** If it does not start with `nostr+walletconnect://`,
    ask them to copy the receive-only code again. Otherwise write
-   `NWC_URI=<paste>` into the project's `.env`, creating the file if needed.
-   Make sure `.gitignore` covers `.env` (and `.dockerignore`, if the app has
-   one). Never echo the value, commit it, or put it in client code. Reply only
-   that it is saved, then ask the next question.
-3. **Second message — swaps.** If the user already asked for stablecoins or
-   altcoins, skip the yes/no and go straight to the walkthrough. Otherwise ask
-   whether payers should also be able to pay with USDT, USDC, ETH or SOL. The
-   walkthrough:
+   `NWC_URI=<paste>` into the project's `.env` with your file-editing tool,
+   creating the file if needed. Never write it with a shell command (`echo`,
+   `printf`, a heredoc, `python -c`): the command line shows the code. Make
+   sure `.gitignore` covers `.env` (and `.dockerignore`, if the app has one).
+   Never echo the value, commit it, or put it in client code. Reply only that
+   it is saved, then ask the next question.
+3. **Second message — swaps.** If the user asked for stablecoins, USDT, USDC,
+   ETH, SOL, altcoins or "crypto" (as in "Bitcoin and stablecoin payments"),
+   this message IS the walkthrough below: send it as it is, and do not ask yes
+   or no first. Otherwise ask whether payers should also be able to pay with
+   USDT, USDC, ETH or SOL, then give the walkthrough. The walkthrough:
    > Go to https://lightning-swap.com, sign in for API keys, create a key, and
    > copy the whole URI (https://openreceive.org/set_up_swap_provider). Paste
@@ -111,10 +115,10 @@ you store it. Ask one question per message.
    Mention FixedFloat only if they already use it.
 4. **When they paste it.** If it does not start with
    `lightning+swapconnect://`, ask them to copy it again. Otherwise add
-   `LSC_URI_PRIMARY=<paste>` to the same `.env`, without echoing it. Swaps
-   are now on, so build the refund route back (the swap non-negotiable below) as
-   part of this integration. If they chose Bitcoin only, leave
-   `LSC_URI_PRIMARY` unset and skip that route.
+   `LSC_URI_PRIMARY=<paste>` to the same `.env` with the file-editing tool,
+   never a shell command. Swaps are now on, so build the refund route back
+   (the swap non-negotiable below) as part of this integration. If they chose
+   Bitcoin only, leave `LSC_URI_PRIMARY` unset and skip that route.
 5. **Make the server load the file — yourself.** Nothing in PHP
    reads `.env` on its own. Add `vlucas/phpdotenv` and load the file in the
    front controller before `Service::fromEnvironment()`. When the app is started
@@ -155,23 +159,28 @@ this app serves the checkout page for one of its orders. Doctor names any
 failed check; fix it before going on.
 Give the user that checkout link. The browser check in the quickstart's step 6
-(payment-method icons, wallet logos, a pay tutorial) is theirs: tell them what
-to look at, and do not run it yourself.
+(payment-method icons, wallet logos, a pay tutorial) is theirs: name it in one
+line of your closing message, and do not run it yourself.
 You cannot pay the invoice: the code is receive-only. Do not pay, settle or
 mark an order paid, and do not look for a way to (a wallet control port, a
 test endpoint, another wallet). If the user wants a real settlement test, they
 pay on that link from their own wallet, and `onPaid` marks the order paid.
-Setup ends here. Say "Setup is finished" in one message of at most five
-lines, with the link and what to check. Do not list what changed, offer more
-work, or end the message on a question.
+Setup ends here. Your last message starts "Setup is finished" and has at most
+five short lines (about 80 characters each): the link, the methods it offers,
+and one line of what to look at. Send nothing after it. Do not list what
+changed, copy out the quickstart's browser checklist, offer more work, or end
+the message on a question.
 - The link is to a real unpaid order. Keep that order; do not delete it.
+- When this app's orders belong to a session or cookie, the user's browser
+  cannot open the order you made. Then the link is the shop's own page:
+  "Open <shop url> and click Buy: it opens the checkout." Do not explain order
+  ownership or mention your test order.
 - Name the methods it offers: Bitcoin, plus USDT, USDC, ETH and SOL when
-  `LSC_URI_PRIMARY` is saved. Never say a coin will not work or will not be
-  offered. Swap minimums apply per order, and a coin whose minimum is above an
-  order's total says so on its own tile.
+  `LSC_URI_PRIMARY` is saved. Do not mention minimums, and never say a coin
+  will not work or will not be offered.
 ## Non-negotiables
@@ -188,6 +197,21 @@ itself, and they hold for every integration.
 - Work only in this application. Never read or run anything from another
   project on this machine (its `node_modules`, tools or source), for any
   reason. A browser and Playwright are not part of setup.
+- Restart only this app's server, on the port it already uses: stop the
+  process you started, or the one listening on that port, by its pid (or
+  restart its Compose service). Never `pkill` or `killall` by name: that
+  stops other people's servers too. Start it the way this project already
+  does (its README, Procfile, compose file or package script), on its own
+  port, not a port you pick.
+- Run commands where the app runs. When a compose file builds it, run its
+  package manager, generators, migrations and doctor inside that service
+  (`docker compose exec` or `run`), and rebuild the image after adding a
+  package. This machine's language version and database path are not the
+  app's.
+- To check that the running app sees the codes, run doctor: it reports each
+  one as present or missing and never prints a value. Never print the
+  environment (`printenv`, `env`, `docker compose config`), even filtered to
+  names.
 - The host owns the price. `amountFor` reads it from your own data; reject
   payer-supplied amounts.
 - `authorize` runs on every request, and the `resource` it receives is a CLAIM