openreceive 0.4.26 → 0.4.27

data/skills/integrate-openreceive/references/php.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (PHP)
 
 ```sh
-# READ THIS FIRST: this file is 42 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 43 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/php/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/php/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.26.
+These directions describe OpenReceive 0.4.27.
 
 Add OpenReceive to a PHP application — the app you are already working in. You
 do not need a copy of the OpenReceive source: the engine is on Packagist
@@ -737,8 +737,11 @@ foreach (\OpenReceive\Server\Doctor::report(
 - where the handler is mounted;
 - the receive-only wallet preflight.
 
-`$engine->doctor()` is the same report for an engine you already built. Put it
-behind a `bin/doctor` script. The demo's is twelve lines.
+`$engine->doctor()` is the same report for an engine you already built, but it
+runs the wallet preflight only when you pass the same factory:
+`$engine->doctor(walletCheck: static fn () => \OpenReceive\Server\Service::fromEnvironment())`.
+Without it the preflight line reads `skipped`. Put the report behind a
+`bin/doctor` script. The demo's is twelve lines.
 → [Doctor](https://openreceive.org/guides/api-reference.md#openreceiveserverdoctor)
 
 Then open the checkout in a browser. Confirm the payment-method icons and

data/skills/integrate-openreceive/references/rails.md

@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/rails/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.26.
+These directions describe OpenReceive 0.4.27.
 
 Add OpenReceive to a Rails application — the app you are already working in. You
 do not need a copy of the OpenReceive source: the gem is on RubyGems, the
@@ -422,13 +422,16 @@ That is the whole install. `openreceive-rails` depends on `openreceive`,
 nothing else added. It is built from `NWC_URI`. If your app brings its own NWC
 client, set `config.nwc_client` instead.
 
-There is one native prerequisite. `nwc-ruby` uses `rbsecp256k1`, which builds
-libsecp256k1 from source. Minimal images (`ruby:3.3-slim`, fresh Docker builds)
-need the autotools for that, or `bundle install` fails with
-`autoreconf: not found`. Install them before bundling:
+Two native builds need system packages. `nwc-ruby` uses `rbsecp256k1`, which
+builds libsecp256k1 from source and needs the autotools; without them
+`bundle install` fails with `autoreconf: not found`. Its connection libraries
+also need a newer `openssl` gem than Ruby ships, and Bundler compiles that gem
+against the OpenSSL headers; without them it fails installing `openssl` at
+`checking for openssl/ssl.h... no`. Minimal images (`ruby:3.3-slim`, fresh
+Docker builds) have neither. Install them before bundling:
 
 ```sh
-apt-get install -y autoconf automake libtool build-essential pkg-config
+apt-get install -y autoconf automake libtool build-essential pkg-config libssl-dev
 ```
 
 Full Ruby images and typical developer machines already have these.
@@ -616,9 +619,11 @@ settlement transaction, only for the first settled attempt for a reference.
 
 The engine's controllers inherit from `config.parent_controller`. The generated
 initializer sets it to `"ApplicationController"`. That is how the engine picks
-up your application's `protect_from_forgery`. Keep `csrf_meta_tags` in the
-layout that renders the checkout. The checkout client sends `X-CSRF-Token` from
-it automatically.
+up your application's `protect_from_forgery`. The layout that renders the
+checkout needs `<%= csrf_meta_tags %>` in its `<head>`: add it if it is not
+there. The checkout client sends `X-CSRF-Token` from it automatically; without
+it, every checkout answers 403 "Can't verify CSRF token authenticity". Do not
+skip forgery protection for the engine to get past that 403.
 
 The same inheritance also brings every global `before_action` that your
 `ApplicationController` declares. A filter that redirects signed-out users to a