openreceive 0.4.21 → 0.4.23

data/skills/integrate-openreceive/references/node.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (Node.js)
 
 ```sh
-# READ THIS FIRST: this file is 35 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 37 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/node/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/node/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.21.
+These directions describe OpenReceive 0.4.23.
 
 Add OpenReceive to a Node application — the app you are already working in. You
 do not need a copy of the OpenReceive source: the packages are on npm, and the
@@ -55,11 +55,12 @@ owns orders, users, prices, or fulfillment.
 
 ## Step 0 — ask for the two codes, one question at a time
 
-Before anything else, look at one file: the project's `.env`, if it exists.
-Read it only far enough to see whether `NWC_URI` and `LSC_URI_PRIMARY` are
-there and non-empty, and never print the values. A code that is already
-set is not asked for again; if both are set, skip to step 5
-(making the server load the file), then the quickstart.
+Before anything else, check one file: the project's `.env`, if it exists.
+`grep -E '^(NWC_URI|LSC_URI_PRIMARY)=.' .env | cut -d= -f1` names the codes
+it sets without printing them. Check with that, here and after each write,
+not by reading the file, and never print the values. A code that is already
+set is not asked for again; if both are set, skip to step 5 (making the
+server load the file), then the quickstart.
 
 On a hosted builder (v0, Vercel, Replit, Lovable), the user may say instead
 that both codes are already set as the project's environment variables or
@@ -95,14 +96,17 @@ you store it. Ask one question per message.
    Do not mention `.env`, exports, or "tell me when it's set".
 2. **When they paste it.** If it does not start with `nostr+walletconnect://`,
    ask them to copy the receive-only code again. Otherwise write
-   `NWC_URI=<paste>` into the project's `.env`, creating the file if needed.
-   Make sure `.gitignore` covers `.env` (and `.dockerignore`, if the app has
-   one). Never echo the value, commit it, or put it in client code. Reply only
-   that it is saved, then ask the next question.
-3. **Second message — swaps.** If the user already asked for stablecoins or
-   altcoins, skip the yes/no and go straight to the walkthrough. Otherwise ask
-   whether payers should also be able to pay with USDT, USDC, ETH or SOL. The
-   walkthrough:
+   `NWC_URI=<paste>` into the project's `.env` with your file-editing tool,
+   creating the file if needed. Never write it with a shell command (`echo`,
+   `printf`, a heredoc, `python -c`): the command line shows the code. Make
+   sure `.gitignore` covers `.env` (and `.dockerignore`, if the app has one).
+   Never echo the value, commit it, or put it in client code. Reply only that
+   it is saved, then ask the next question.
+3. **Second message — swaps.** If the user asked for stablecoins, USDT, USDC,
+   ETH, SOL, altcoins or "crypto" (as in "Bitcoin and stablecoin payments"),
+   this message IS the walkthrough below: send it as it is, and do not ask yes
+   or no first. Otherwise ask whether payers should also be able to pay with
+   USDT, USDC, ETH or SOL, then give the walkthrough. The walkthrough:
 
    > Go to https://lightning-swap.com, sign in for API keys, create a key, and
    > copy the whole URI (https://openreceive.org/set_up_swap_provider). Paste
@@ -112,10 +116,10 @@ you store it. Ask one question per message.
    Mention FixedFloat only if they already use it.
 4. **When they paste it.** If it does not start with
    `lightning+swapconnect://`, ask them to copy it again. Otherwise add
-   `LSC_URI_PRIMARY=<paste>` to the same `.env`, without echoing it. Swaps
-   are now on, so build the refund route back (the swap non-negotiable below) as
-   part of this integration. If they chose Bitcoin only, leave
-   `LSC_URI_PRIMARY` unset and skip that route.
+   `LSC_URI_PRIMARY=<paste>` to the same `.env` with the file-editing tool,
+   never a shell command. Swaps are now on, so build the refund route back
+   (the swap non-negotiable below) as part of this integration. If they chose
+   Bitcoin only, leave `LSC_URI_PRIMARY` unset and skip that route.
 5. **Make the server load the file — yourself.** OpenReceive reads
    `process.env`, and a `.env` file on disk is not in it. Put
    `import "dotenv/config";` at the top of the server entry, as the quickstart
@@ -148,24 +152,29 @@ names any failed check and exits nonzero; fix it before going on.
 Doctor reads `.env` itself. Never source it into a shell: the `&` in a
 code splits the value and prints the pieces.
 
-Give the user that checkout link. The browser check in the quickstart's
-step 6 (payment-method icons, wallet logos, a pay tutorial) is theirs: tell
-them what to look at, and do not run it yourself.
+Give the user that checkout link. The browser check in the quickstart's step 6
+(payment-method icons, wallet logos, a pay tutorial) is theirs: name it in one
+line of your closing message, and do not run it yourself.
 
 You cannot pay the invoice: the code is receive-only. Do not pay, settle or
 mark an order paid, and do not look for a way to (a wallet control port, a
 test endpoint, another wallet). If the user wants a real settlement test, they
 pay on that link from their own wallet, and `onPaid` marks the order paid.
 
-Setup ends here. Say "Setup is finished" in one message of at most five
-lines, with the link and what to check. Do not list what changed, offer more
-work, or end the message on a question.
+Setup ends here. Your last message starts "Setup is finished" and has at most
+five short lines (about 80 characters each): the link, the methods it offers,
+and one line of what to look at. Send nothing after it. Do not list what
+changed, copy out the quickstart's browser checklist, offer more work, or end
+the message on a question.
 
 - The link is to a real unpaid order. Keep that order; do not delete it.
+- When this app's orders belong to a session or cookie, the user's browser
+  cannot open the order you made. Then the link is the shop's own page:
+  "Open <shop url> and click Buy: it opens the checkout." Do not explain order
+  ownership or mention your test order.
 - Name the methods it offers: Bitcoin, plus USDT, USDC, ETH and SOL when
-  `LSC_URI_PRIMARY` is saved. Never say a coin will not work or will not be
-  offered. Swap minimums apply per order, and a coin whose minimum is above an
-  order's total says so on its own tile.
+  `LSC_URI_PRIMARY` is saved. Do not mention minimums, and never say a coin
+  will not work or will not be offered.
 
 ## Non-negotiables
 
@@ -182,6 +191,21 @@ itself, and they hold for every integration.
 - Work only in this application. Never read or run anything from another
   project on this machine (its `node_modules`, tools or source), for any
   reason. A browser and Playwright are not part of setup.
+- Restart only this app's server, on the port it already uses: stop the
+  process you started, or the one listening on that port, by its pid (or
+  restart its Compose service). Never `pkill` or `killall` by name: that
+  stops other people's servers too. Start it the way this project already
+  does (its README, Procfile, compose file or package script), on its own
+  port, not a port you pick.
+- Run commands where the app runs. When a compose file builds it, run its
+  package manager, generators, migrations and doctor inside that service
+  (`docker compose exec` or `run`), and rebuild the image after adding a
+  package. This machine's language version and database path are not the
+  app's.
+- To check that the running app sees the codes, run doctor: it reports each
+  one as present or missing and never prints a value. Never print the
+  environment (`printenv`, `env`, `docker compose config`), even filtered to
+  names.
 - The host owns the price. `amountFor` reads it from your own data; reject
   payer-supplied amounts.
 - `authorize` runs on every request, and the `resource` it receives is a CLAIM
@@ -252,7 +276,10 @@ products, and you do not join them.
   are buying.
 - **Users own the order; OpenReceive never sees them.** `authorize` uses the
   same ownership check this app already uses on the order show / pay page —
-  `sessions.currentUser(request)`, a cookie, whatever it is.
+  `sessions.currentUser(native)`, a cookie, whatever it is. Pass `native` (the
+  Express request) to this app's own cookie and session helpers, never
+  `request`: that one is a Web Request, a helper that reads
+  `req.headers.cookie` finds nothing on it, and every payer gets a 403.
   `resource.reference` is a claim the payer sent, not proof.
 - **The order is unpaid or paid.** Do not copy `pending` / `expired` / `failed`
   / `attention` onto it. Those are attempt statuses on `openreceive_payments`. An
@@ -505,9 +532,12 @@ const openreceive = openReceiveExpress({
   // Your own access check: may this caller do this action to this reference?
   // `resource.reference` is your own order id, sent back by the payer's
   // browser — a claim, not proof — already validated as a non-empty string.
-  authorize: async ({ action, request, resource }) =>
+  // `native` is the untouched Express request: pass it to this app's own
+  // cookie and session helpers. `request` is a Web Request, so a helper that
+  // reads `req.headers.cookie` finds nothing on it and every payer gets a 403.
+  authorize: async ({ action, native, resource }) =>
     orders.viewerMay(
-      await sessions.currentUser(request),
+      await sessions.currentUser(native),
       resource.reference,
       action,
     ),

data/skills/integrate-openreceive/references/php.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (PHP)
 
 ```sh
-# READ THIS FIRST: this file is 39 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 40 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/php/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/php/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.21.
+These directions describe OpenReceive 0.4.23.
 
 Add OpenReceive to a PHP application — the app you are already working in. You
 do not need a copy of the OpenReceive source: the engine is on Packagist
@@ -59,11 +59,12 @@ owns orders, users, prices, or fulfillment.
 
 ## Step 0 — ask for the two codes, one question at a time
 
-Before anything else, look at one file: the project's `.env`, if it exists.
-Read it only far enough to see whether `NWC_URI` and `LSC_URI_PRIMARY` are
-there and non-empty, and never print the values. A code that is already
-set is not asked for again; if both are set, skip to step 5
-(making the server load the file), then the quickstart.
+Before anything else, check one file: the project's `.env`, if it exists.
+`grep -E '^(NWC_URI|LSC_URI_PRIMARY)=.' .env | cut -d= -f1` names the codes
+it sets without printing them. Check with that, here and after each write,
+not by reading the file, and never print the values. A code that is already
+set is not asked for again; if both are set, skip to step 5 (making the
+server load the file), then the quickstart.
 
 Otherwise your next action is a question to the user. Do not run `composer require`,
 edit the app, write `.env.example`, or search anywhere else before asking
@@ -94,14 +95,17 @@ you store it. Ask one question per message.
    Do not mention `.env`, exports, or "tell me when it's set".
 2. **When they paste it.** If it does not start with `nostr+walletconnect://`,
    ask them to copy the receive-only code again. Otherwise write
-   `NWC_URI=<paste>` into the project's `.env`, creating the file if needed.
-   Make sure `.gitignore` covers `.env` (and `.dockerignore`, if the app has
-   one). Never echo the value, commit it, or put it in client code. Reply only
-   that it is saved, then ask the next question.
-3. **Second message — swaps.** If the user already asked for stablecoins or
-   altcoins, skip the yes/no and go straight to the walkthrough. Otherwise ask
-   whether payers should also be able to pay with USDT, USDC, ETH or SOL. The
-   walkthrough:
+   `NWC_URI=<paste>` into the project's `.env` with your file-editing tool,
+   creating the file if needed. Never write it with a shell command (`echo`,
+   `printf`, a heredoc, `python -c`): the command line shows the code. Make
+   sure `.gitignore` covers `.env` (and `.dockerignore`, if the app has one).
+   Never echo the value, commit it, or put it in client code. Reply only that
+   it is saved, then ask the next question.
+3. **Second message — swaps.** If the user asked for stablecoins, USDT, USDC,
+   ETH, SOL, altcoins or "crypto" (as in "Bitcoin and stablecoin payments"),
+   this message IS the walkthrough below: send it as it is, and do not ask yes
+   or no first. Otherwise ask whether payers should also be able to pay with
+   USDT, USDC, ETH or SOL, then give the walkthrough. The walkthrough:
 
    > Go to https://lightning-swap.com, sign in for API keys, create a key, and
    > copy the whole URI (https://openreceive.org/set_up_swap_provider). Paste
@@ -111,10 +115,10 @@ you store it. Ask one question per message.
    Mention FixedFloat only if they already use it.
 4. **When they paste it.** If it does not start with
    `lightning+swapconnect://`, ask them to copy it again. Otherwise add
-   `LSC_URI_PRIMARY=<paste>` to the same `.env`, without echoing it. Swaps
-   are now on, so build the refund route back (the swap non-negotiable below) as
-   part of this integration. If they chose Bitcoin only, leave
-   `LSC_URI_PRIMARY` unset and skip that route.
+   `LSC_URI_PRIMARY=<paste>` to the same `.env` with the file-editing tool,
+   never a shell command. Swaps are now on, so build the refund route back
+   (the swap non-negotiable below) as part of this integration. If they chose
+   Bitcoin only, leave `LSC_URI_PRIMARY` unset and skip that route.
 5. **Make the server load the file — yourself.** Nothing in PHP
    reads `.env` on its own. Add `vlucas/phpdotenv` and load the file in the
    front controller before `Service::fromEnvironment()`. When the app is started
@@ -129,8 +133,10 @@ again. Never set the spend-capable override to get past it.
 
 Then check the PHP runtime: `php -m` must list `gmp`, `sodium`, `mbstring`,
 `json`, `pdo` and one PDO driver. `ext-gmp` is REQUIRED — the NWC transport
-signs every request with it — and `php:*-cli`/`-fpm` images do not ship it
-(`docker-php-ext-install gmp`). PHP must be ≥ 8.2 and 64-bit.
+signs every request with it — and `php:*-cli`/`-fpm` images do not ship it:
+install `libgmp-dev` first, then `docker-php-ext-install gmp`, in the
+Dockerfile. Never pass `--ignore-platform-req=ext-gmp` to Composer. PHP must
+be ≥ 8.2 and 64-bit.
 
 ### Upgrading an existing install
 
@@ -155,23 +161,28 @@ this app serves the checkout page for one of its orders. Doctor names any
 failed check; fix it before going on.
 
 Give the user that checkout link. The browser check in the quickstart's step 6
-(payment-method icons, wallet logos, a pay tutorial) is theirs: tell them what
-to look at, and do not run it yourself.
+(payment-method icons, wallet logos, a pay tutorial) is theirs: name it in one
+line of your closing message, and do not run it yourself.
 
 You cannot pay the invoice: the code is receive-only. Do not pay, settle or
 mark an order paid, and do not look for a way to (a wallet control port, a
 test endpoint, another wallet). If the user wants a real settlement test, they
 pay on that link from their own wallet, and `onPaid` marks the order paid.
 
-Setup ends here. Say "Setup is finished" in one message of at most five
-lines, with the link and what to check. Do not list what changed, offer more
-work, or end the message on a question.
+Setup ends here. Your last message starts "Setup is finished" and has at most
+five short lines (about 80 characters each): the link, the methods it offers,
+and one line of what to look at. Send nothing after it. Do not list what
+changed, copy out the quickstart's browser checklist, offer more work, or end
+the message on a question.
 
 - The link is to a real unpaid order. Keep that order; do not delete it.
+- When this app's orders belong to a session or cookie, the user's browser
+  cannot open the order you made. Then the link is the shop's own page:
+  "Open <shop url> and click Buy: it opens the checkout." Do not explain order
+  ownership or mention your test order.
 - Name the methods it offers: Bitcoin, plus USDT, USDC, ETH and SOL when
-  `LSC_URI_PRIMARY` is saved. Never say a coin will not work or will not be
-  offered. Swap minimums apply per order, and a coin whose minimum is above an
-  order's total says so on its own tile.
+  `LSC_URI_PRIMARY` is saved. Do not mention minimums, and never say a coin
+  will not work or will not be offered.
 
 ## Non-negotiables
 
@@ -188,6 +199,21 @@ itself, and they hold for every integration.
 - Work only in this application. Never read or run anything from another
   project on this machine (its `node_modules`, tools or source), for any
   reason. A browser and Playwright are not part of setup.
+- Restart only this app's server, on the port it already uses: stop the
+  process you started, or the one listening on that port, by its pid (or
+  restart its Compose service). Never `pkill` or `killall` by name: that
+  stops other people's servers too. Start it the way this project already
+  does (its README, Procfile, compose file or package script), on its own
+  port, not a port you pick.
+- Run commands where the app runs. When a compose file builds it, run its
+  package manager, generators, migrations and doctor inside that service
+  (`docker compose exec` or `run`), and rebuild the image after adding a
+  package. This machine's language version and database path are not the
+  app's.
+- To check that the running app sees the codes, run doctor: it reports each
+  one as present or missing and never prints a value. Never print the
+  environment (`printenv`, `env`, `docker compose config`), even filtered to
+  names.
 - The host owns the price. `amountFor` reads it from your own data; reject
   payer-supplied amounts.
 - `authorize` runs on every request, and the `resource` it receives is a CLAIM

data/skills/integrate-openreceive/references/rails.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (Rails)
 
 ```sh
-# READ THIS FIRST: this file is 40 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 42 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/rails/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/rails/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.21.
+These directions describe OpenReceive 0.4.23.
 
 Add OpenReceive to a Rails application — the app you are already working in. You
 do not need a copy of the OpenReceive source: the gem is on RubyGems, the
@@ -57,11 +57,12 @@ owns orders, users, prices, or fulfillment.
 
 ## Step 0 — ask for the two codes, one question at a time
 
-Before anything else, look at one file: the project's `.env`, if it exists.
-Read it only far enough to see whether `NWC_URI` and `LSC_URI_PRIMARY` are
-there and non-empty, and never print the values. A code that is already
-set is not asked for again; if both are set, skip to step 5
-(making the server load the file), then the quickstart.
+Before anything else, check one file: the project's `.env`, if it exists.
+`grep -E '^(NWC_URI|LSC_URI_PRIMARY)=.' .env | cut -d= -f1` names the codes
+it sets without printing them. Check with that, here and after each write,
+not by reading the file, and never print the values. A code that is already
+set is not asked for again; if both are set, skip to step 5 (making the
+server load the file), then the quickstart.
 
 Otherwise your next action is a question to the user. Do not install the gem,
 edit the app, write `.env.example`, or search anywhere else before asking
@@ -92,14 +93,17 @@ you store it. Ask one question per message.
    Do not mention `.env`, exports, or "tell me when it's set".
 2. **When they paste it.** If it does not start with `nostr+walletconnect://`,
    ask them to copy the receive-only code again. Otherwise write
-   `NWC_URI=<paste>` into the project's `.env`, creating the file if needed.
-   Make sure `.gitignore` covers `.env` (and `.dockerignore`, if the app has
-   one). Never echo the value, commit it, or put it in client code. Reply only
-   that it is saved, then ask the next question.
-3. **Second message — swaps.** If the user already asked for stablecoins or
-   altcoins, skip the yes/no and go straight to the walkthrough. Otherwise ask
-   whether payers should also be able to pay with USDT, USDC, ETH or SOL. The
-   walkthrough:
+   `NWC_URI=<paste>` into the project's `.env` with your file-editing tool,
+   creating the file if needed. Never write it with a shell command (`echo`,
+   `printf`, a heredoc, `python -c`): the command line shows the code. Make
+   sure `.gitignore` covers `.env` (and `.dockerignore`, if the app has one).
+   Never echo the value, commit it, or put it in client code. Reply only that
+   it is saved, then ask the next question.
+3. **Second message — swaps.** If the user asked for stablecoins, USDT, USDC,
+   ETH, SOL, altcoins or "crypto" (as in "Bitcoin and stablecoin payments"),
+   this message IS the walkthrough below: send it as it is, and do not ask yes
+   or no first. Otherwise ask whether payers should also be able to pay with
+   USDT, USDC, ETH or SOL, then give the walkthrough. The walkthrough:
 
    > Go to https://lightning-swap.com, sign in for API keys, create a key, and
    > copy the whole URI (https://openreceive.org/set_up_swap_provider). Paste
@@ -109,10 +113,10 @@ you store it. Ask one question per message.
    Mention FixedFloat only if they already use it.
 4. **When they paste it.** If it does not start with
    `lightning+swapconnect://`, ask them to copy it again. Otherwise add
-   `LSC_URI_PRIMARY=<paste>` to the same `.env`, without echoing it. Swaps
-   are now on, so build the refund route back (the swap non-negotiable below) as
-   part of this integration. If they chose Bitcoin only, leave
-   `LSC_URI_PRIMARY` unset and skip that route.
+   `LSC_URI_PRIMARY=<paste>` to the same `.env` with the file-editing tool,
+   never a shell command. Swaps are now on, so build the refund route back
+   (the swap non-negotiable below) as part of this integration. If they chose
+   Bitcoin only, leave `LSC_URI_PRIMARY` unset and skip that route.
 5. **Make the server load the file — yourself.** Rails does not read
    `.env` on its own. When the app is started with `bin/rails` or `bin/dev`,
    add `dotenv-rails` to the Gemfile. When it is started with Docker Compose,
@@ -147,22 +151,28 @@ check; fix it before going on.
 
 Give the user that checkout link. The browser check in the quickstart's
 "Render the checkout" section (payment-method icons, wallet logos, a pay
-tutorial) is theirs: tell them what to look at, and do not run it yourself.
+tutorial) is theirs: name it in one line of your closing message, and do not
+run it yourself.
 
 You cannot pay the invoice: the code is receive-only. Do not pay, settle or
 mark an order paid, and do not look for a way to (a wallet control port, a
 test endpoint, another wallet). If the user wants a real settlement test, they
 pay on that link from their own wallet, and `on_paid` marks the order paid.
 
-Setup ends here. Say "Setup is finished" in one message of at most five
-lines, with the link and what to check. Do not list what changed, offer more
-work, or end the message on a question.
+Setup ends here. Your last message starts "Setup is finished" and has at most
+five short lines (about 80 characters each): the link, the methods it offers,
+and one line of what to look at. Send nothing after it. Do not list what
+changed, copy out the quickstart's browser checklist, offer more work, or end
+the message on a question.
 
 - The link is to a real unpaid order. Keep that order; do not delete it.
+- When this app's orders belong to a session or cookie, the user's browser
+  cannot open the order you made. Then the link is the shop's own page:
+  "Open <shop url> and click Buy: it opens the checkout." Do not explain order
+  ownership or mention your test order.
 - Name the methods it offers: Bitcoin, plus USDT, USDC, ETH and SOL when
-  `LSC_URI_PRIMARY` is saved. Never say a coin will not work or will not be
-  offered. Swap minimums apply per order, and a coin whose minimum is above an
-  order's total says so on its own tile.
+  `LSC_URI_PRIMARY` is saved. Do not mention minimums, and never say a coin
+  will not work or will not be offered.
 
 ## Non-negotiables
 
@@ -179,6 +189,21 @@ itself, and they hold for every integration.
 - Work only in this application. Never read or run anything from another
   project on this machine (its `node_modules`, tools or source), for any
   reason. A browser and Playwright are not part of setup.
+- Restart only this app's server, on the port it already uses: stop the
+  process you started, or the one listening on that port, by its pid (or
+  restart its Compose service). Never `pkill` or `killall` by name: that
+  stops other people's servers too. Start it the way this project already
+  does (its README, Procfile, compose file or package script), on its own
+  port, not a port you pick.
+- Run commands where the app runs. When a compose file builds it, run its
+  package manager, generators, migrations and doctor inside that service
+  (`docker compose exec` or `run`), and rebuild the image after adding a
+  package. This machine's language version and database path are not the
+  app's.
+- To check that the running app sees the codes, run doctor: it reports each
+  one as present or missing and never prints a value. Never print the
+  environment (`printenv`, `env`, `docker compose config`), even filtered to
+  names.
 - The host owns the price. `config.amount_for` reads it from your own data;
   reject payer-supplied amounts.
 - `config.authorize` runs on every request, and the `resource` it receives is a

data/skills/integrate-openreceive/references/woocommerce.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (WordPress + WooCommerce)
 
 ```sh
-# READ THIS FIRST: this file is 22 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 23 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/woocommerce/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/woocommerce/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Setup is done only when the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.21.
+These directions describe OpenReceive 0.4.23.
 
 Install and configure the OpenReceive payment gateway in the WooCommerce store
 you are working in. Preserve its theme, checkout, customer accounts, order
@@ -92,20 +92,27 @@ is saved or the user said "Bitcoin only". Never invent a placeholder code.
 
 ## Step 1 — install the plugin
 
-Install the plugin built for this release. Never install the GitHub
+Install this release from the WordPress.org plugin directory:
+
+```sh
+wp plugin install openreceive --version=0.4.23 --activate
+```
+
+If that fails because WordPress.org does not have this version yet, install
+the ZIP attached to the same GitHub release. Never install the GitHub
 source-code ZIP or a ZIP from an older release:
 
 ```sh
-wp plugin install https://github.com/OpenReceive/openreceive/releases/download/v0.4.21/openreceive-wordpress-0.4.21.zip --activate
+wp plugin install https://github.com/OpenReceive/openreceive/releases/download/v0.4.23/openreceive-wordpress-0.4.23.zip --activate
 ```
 
 It needs WooCommerce active, and PHP 8.2+ with GMP and sodium in BOTH the web
 PHP and the WP-CLI PHP. On the official `wordpress` and `wordpress:cli` Docker
-images, activation fails with "OpenReceive requires the PHP sodium and GMP
-extensions": add GMP to both images as "Enable GMP in both PHP runtimes" below
+images, activation warns "OpenReceive is not running: this site needs the PHP
+GMP extension" and the plugin stays idle: add GMP to both images as "Enable GMP in both PHP runtimes" below
 says, rebuild both, then install again. If the Compose file has only `image:`
 lines, use the two Dockerfiles and `build:` keys under "Compose files with only
-`image:` lines" below, and add no other service. If the URL answers 404, build the same
+`image:` lines" below, and add no other service. If the ZIP URL answers 404, build the same
 tag as "Get the installable archive" below says.
 
 ## Step 2 — store the codes, then enable the gateway
@@ -163,13 +170,19 @@ pay on the order-pay link from their own wallet; afterwards
 `wp wc shop_order get <order id> --user=<admin user id> --field=status` is no
 longer `pending`.
 
-Setup ends here. Once doctor is clean and the user has the link, say that setup
-is finished, in one message. Do not install mail software, add containers or
-services, or set up cron. If doctor's "Reconcile scheduled" check fails, fix
-that. On a store with little traffic, add one sentence to that message: a
-system cron for WordPress scheduled work settles orders sooner, and this setup
-does not add one. State it as a recommendation. Do not offer to set it up or
-end the message on a question.
+Setup ends here. Once doctor is clean and the user has the link, your last
+message starts "Setup is finished" and has at most six short lines: the pay
+link, the methods the checkout offers (Bitcoin, plus USDT, USDC, ETH and SOL
+when the swap code is saved), and one line of what to look at. Do not list
+each coin's availability, mention a minimum, or say a coin will not work: a
+provider minimum depends on the order total, and the user's own orders will
+differ. Do not list what you changed or what doctor checked. Send nothing
+after it. Do not install mail software, add containers or services, or set up
+cron. If doctor's "Reconcile scheduled" check fails, fix that. On a store with
+little traffic, add one sentence to that message: a system cron for WordPress
+scheduled work settles orders sooner, and this setup does not add one. State
+it as a recommendation. Do not offer to set it up or end the message on a
+question.
 
 ## Non-negotiables
 
@@ -224,10 +237,11 @@ The [WordPress integration entry point](https://openreceive.org/integrations/wor
 redirects to the WooCommerce integration, which uses this same guide and agent
 directions. OpenReceive checkout on WordPress requires WooCommerce.
 
-Activate WooCommerce first. Then install the built OpenReceive plugin zip
-through **Plugins → Add New → Upload Plugin**. You cannot upload the source
-directory as-is. It needs a build first. The plugin is not yet submitted to
-WordPress.org.
+Activate WooCommerce first. Then install OpenReceive from the
+[WordPress.org plugin directory](https://wordpress.org/plugins/openreceive/):
+in **Plugins → Add New**, search for **OpenReceive**, then install and
+activate it. With WP-CLI, run `wp plugin install openreceive --activate`.
+WordPress offers each new release as an ordinary plugin update.
 
 Requirements: WordPress 6.6+, WooCommerce 9+, 64-bit PHP 8.2+ with GMP and sodium,
 and MySQL 8 or MariaDB 10.5+. When you activate the plugin, it creates tables for
@@ -236,16 +250,19 @@ database or application.
 
 ### Get the installable archive
 
-Download [openreceive-wordpress-0.4.21.zip](https://github.com/OpenReceive/openreceive/releases/download/v0.4.21/openreceive-wordpress-0.4.21.zip)
-from the matching release. Historical releases may lack this asset. If that exact
-URL returns 404, build the same tag below; never silently install an older ZIP.
-The GitHub source-code ZIP is not an installable plugin. On a development machine
-with Node 22+, PHP 8.2+ with GMP/sodium, Composer and WP-CLI:
+Each GitHub release also attaches the same plugin as a ZIP, for a site that
+cannot reach WordPress.org or when WordPress.org does not list a release yet.
+Download [openreceive-wordpress-0.4.23.zip](https://github.com/OpenReceive/openreceive/releases/download/v0.4.23/openreceive-wordpress-0.4.23.zip)
+and install it through **Plugins → Add New → Upload Plugin**. Historical
+releases may lack this asset. If that exact URL returns 404, build the same tag
+below; never silently install an older ZIP. The GitHub source-code ZIP is not
+an installable plugin. On a development machine with Node 22+, PHP 8.2+ with
+GMP/sodium, Composer and WP-CLI:
 
 ```sh
 git clone https://github.com/OpenReceive/openreceive.git
 cd openreceive
-git checkout v0.4.21
+git checkout v0.4.23
 npm ci
 npm run build:packages
 composer install --working-dir=packages/php/wordpress

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: openreceive
 version: !ruby/object:Gem::Version
-  version: 0.4.21
+  version: 0.4.23
 platform: ruby
 authors:
 - OpenReceive
@@ -61,6 +61,7 @@ files:
 - skills/integrate-openreceive/references/fastapi.md
 - skills/integrate-openreceive/references/fastify.md
 - skills/integrate-openreceive/references/laravel.md
+- skills/integrate-openreceive/references/lovable.md
 - skills/integrate-openreceive/references/next.md
 - skills/integrate-openreceive/references/node.md
 - skills/integrate-openreceive/references/php.md