openreceive 0.4.28 → 0.4.30

data/skills/integrate-openreceive/references/lovable.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (Lovable)
 
 ```text
-READ THIS FIRST: this file is 26 KB and a summary drops required steps. Read all of it:
+READ THIS FIRST: this file is 27 KB and a summary drops required steps. Read all of it:
 https://openreceive.org/agent-directions/lovable/full.md
 If your fetch tool gave you a summary, fetch that URL again for the full text.
 ```
@@ -17,7 +17,7 @@ If your fetch tool gave you a summary, fetch that URL again for the full text.
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start Step 1 only once NWC_URI is saved, and LSC_URI_PRIMARY is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.28.
+These directions describe OpenReceive 0.4.30.
 
 Add OpenReceive to this Lovable app: a TanStack Start app on Cloudflare
 Workers, with Lovable Cloud or a connected Supabase project as its database.
@@ -121,7 +121,7 @@ saved or explicitly declined.
 
 ## Step 1 — the packages
 
-Add `@openreceive/http` and `@openreceive/react` at 0.4.28 or newer.
+Add `@openreceive/http` and `@openreceive/react` at 0.4.30 or newer.
 Nothing else: no `pg`, no Postgres driver, no OpenReceive scaffold. Do not
 change the Vite or Wrangler configuration.
 
@@ -182,7 +182,7 @@ begin
   update public.orders
      set status = 'paid'
    where id = p_reference::uuid   -- or just p_reference, if the ids are text
-     and status = 'pending';
+     and status = 'awaiting_payment';  -- this app's own unpaid status
 end
 $$;
 ```
@@ -410,12 +410,12 @@ export async function handleOpenReceive(request: Request): Promise<Response> {
 ```
 
 `authorize` sees the incoming request with its cookies, so check it with
-the session your app already has. The Next.js quickstart
+the session your app already has. The [Next.js quickstart](https://openreceive.org/guides/quickstart-next.md)
 explains each hook. They are the same here.
 
 Create OpenReceive's two tables with your migrations, or run
 `paymentsSchemaSql("postgres")` from `@openreceive/http` once. It is
-idempotent. See Payment storage.
+idempotent. See [Payment storage](https://openreceive.org/guides/storage.md).
 
 ### On Supabase (Lovable)
 
@@ -440,7 +440,7 @@ npm install @openreceive/http @openreceive/react
    ) returns void language plpgsql as $$
    begin
      update public.orders set status = 'paid'
-      where id = p_reference::uuid and status = 'pending';
+      where id = p_reference::uuid and status = 'awaiting_payment'; -- your unpaid status
    end
    $$;
    ```
@@ -492,17 +492,21 @@ There is no `onPaid`: `openreceive_on_paid` is the fulfillment. `findOrder`
 reads the order with your server-side Supabase client; in a Lovable app that
 is `supabaseAdmin` from `@/integrations/supabase/client.server`.
 
-The checkout calls the payment routes from the browser with the page's
-cookies, and nothing else. A Lovable app keeps its Supabase sign-in in the
-browser, not in a cookie, so `authorize` cannot see who is signed in. Give
-the buyer a cookie of their own instead: create orders in a server function
+By default the checkout calls the payment routes from the browser with the
+page's cookies and nothing else. A Lovable app keeps its Supabase sign-in in
+the browser, not in a cookie, so `authorize` cannot see who is signed in from
+those cookies. Since 0.4.25 the React `<Checkout>` also takes a `fetch` that
+sends the access token
+([Use Supabase Auth in `authorize`](https://openreceive.org/guides/supabase.md#4-use-supabase-auth-in-authorize)), but
+this recipe keeps the simpler route that works with every checkout: give the
+buyer a cookie of their own. Create orders in a server function
 that sets an HttpOnly `buyer` cookie (a random value, kept across orders) and
 stores the same value on the order as `buyer_token`. `currentBuyer` reads it
 back from the request's `cookie` header.
 
 Before it serves, the server checks the database, and the payment routes
 answer 503 until the migration is applied and `openreceive_on_paid` is
-yours; the log names the fix. More: Supabase over HTTPS.
+yours; the log names the fix. More: [Supabase over HTTPS](https://openreceive.org/guides/supabase.md#supabase-over-https).
 
 ### The checkout page
 

data/skills/integrate-openreceive/references/medusa.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (Medusa)
 
 ```sh
-# READ THIS FIRST: this file is 21 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 22 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/medusa/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/medusa/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.28.
+These directions describe OpenReceive 0.4.30.
 
 Add OpenReceive to the Medusa store you are working in: a Medusa server, and
 usually a storefront in its own project (Medusa's Next.js starter or another).
@@ -199,7 +199,6 @@ Medusa.
 - [Lightning Swap Connect URI](https://openreceive.org/guides/lightning-swap-connect.md)
 - [Security](https://openreceive.org/guides/security.md)
 - [Price Feeds](https://openreceive.org/guides/price-feeds.md)
-- [Payment Safety Upgrade](https://openreceive.org/guides/payment-safety-upgrade.md)
 
 ---
 
@@ -321,13 +320,14 @@ starter's Tailwind build:
 
 ```ts
 import { readFile } from "node:fs/promises"
-import { createRequire } from "node:module"
 import path from "node:path"
 import { NextRequest } from "next/server"
 
 const BACKEND_URL = process.env.MEDUSA_BACKEND_URL ?? "http://localhost:9000"
 
 async function stylesheet() {
+  // Node's own createRequire: Next's bundler would replace an imported one.
+  const { createRequire } = await import(/* webpackIgnore: true */ "node:module")
   const resolve = createRequire(path.join(process.cwd(), "package.json")).resolve
   const css = await readFile(resolve("@openreceive/react/styles.css"))
   return new Response(css, {
@@ -460,7 +460,14 @@ and a buyer paying an order by Lightning and by USDT on Solana in Chromium,
 after which the order is placed with its payment captured. A payment whose
 buyer never placed the order was placed by the plugin's job. An unknown
 session, another provider's session and a request without the publishable
-key were refused, and an admin refund was recorded.
+key were refused, and an admin refund was recorded. The repository's CI runs
+the plugin in a real Medusa 2.21.2 on PostgreSQL on every push: those payments
+through the store API, the refusals, the refund and the job.
+
+Tested on 2026-10-19 with the starter's production build (`next build`, then
+`next start`): a buyer paid by Lightning and by USDT on Solana as above, and
+the route served the checkout's stylesheet, as it also does under
+`next dev --turbopack`.
 
 Not tested: Medusa split into a server and a worker, Medusa Cloud, storefronts
 other than the Next.js starter, and a storefront calling Medusa from the

data/skills/integrate-openreceive/references/mobile.md

@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/mobile/full.md
 - The app never decides paid: it asks the server. A link back to the app is navigation only.
 - Do not suggest rotating or revoking a code because it was pasted here.
 
-These directions describe OpenReceive 0.4.28.
+These directions describe OpenReceive 0.4.30.
 
 Add Bitcoin checkout, with optional USDT, USDC, ETH and SOL, to a mobile app:
 React Native or Expo, Flutter, Swift or Kotlin. OpenReceive has no mobile SDK

data/skills/integrate-openreceive/references/nestjs.md

@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/nestjs/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.28.
+These directions describe OpenReceive 0.4.30.
 
 Add OpenReceive to a NestJS application — the app you are already working in,
 on Nest's default Express platform. You do not need a copy of the OpenReceive
@@ -447,13 +447,12 @@ enough; drop the `.md` for the same page a person would read.
 - https://openreceive.org/guides/api-reference.md — every route, option and error code
 - https://openreceive.org/guides/custom-checkout-route.md — advanced: replacing the shipped adapter's routes with your own
 - https://openreceive.org/guides/react-material-ui-recipe.md — a worked custom UI on a component library
+- https://openreceive.org/guides/payment-safety-upgrade.md — coordinated upgrades and reviewed repair of existing attempts
 - https://openreceive.org/guides.md — the index, if what you need is not above
 
 Questions, or a problem with the library itself:
 https://openreceive.org/contact
 
-- https://openreceive.org/guides/payment-safety-upgrade.md — coordinated upgrades and reviewed repair of existing attempts
-
 ---
 
 ## The quickstart, in full

data/skills/integrate-openreceive/references/next.md

@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/next/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.28.
+These directions describe OpenReceive 0.4.30.
 
 Add OpenReceive to a Next.js App Router application — the app you are already
 working in. You do not need a copy of the OpenReceive source: the packages are
@@ -438,13 +438,12 @@ enough; drop the `.md` for the same page a person would read.
 - https://openreceive.org/guides/react-material-ui-recipe.md — a worked custom UI on a component library
 - https://openreceive.org/guides/tanstack-start-recipe.md — the same handler as a TanStack Start server route, if this app is TanStack Start after all
 - https://openreceive.org/guides/sveltekit-recipe.md, https://openreceive.org/guides/nuxt-recipe.md, https://openreceive.org/guides/astro-recipe.md and https://openreceive.org/guides/react-router-recipe.md — the same handler as a SvelteKit, Nuxt, Astro or React Router route, if this app is one of those
+- https://openreceive.org/guides/payment-safety-upgrade.md — coordinated upgrades and reviewed repair of existing attempts
 - https://openreceive.org/guides.md — the index, if what you need is not above
 
 Questions, or a problem with the library itself:
 https://openreceive.org/contact
 
-- https://openreceive.org/guides/payment-safety-upgrade.md — coordinated upgrades and reviewed repair of existing attempts
-
 ---
 
 ## The quickstart, in full
@@ -473,8 +472,8 @@ stays the same.
 | Server   | `@openreceive/next`, `@openreceive/express`, `@openreceive/fastify`                                                           |
 | Frontend | `@openreceive/react`, `@openreceive/vue`, `@openreceive/svelte`, `@openreceive/angular`, `@openreceive/elements` (plain HTML) |
 
-Express: [quickstart-node.md](https://openreceive.org/guides/quickstart-node.md) · Fastify:
-[quickstart-fastify.md](https://openreceive.org/guides/quickstart-fastify.md). This page is the Next.js one.
+Express: [Express quickstart](https://openreceive.org/guides/quickstart-node.md) · Fastify:
+[Fastify quickstart](https://openreceive.org/guides/quickstart-fastify.md). This page is the Next.js one.
 An agent given the Express guide goes wrong on Next.js in three places: Next
 needs no `dotenv`, no `app.use`, and it needs a client component for the
 checkout.

data/skills/integrate-openreceive/references/node.md

@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/node/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.28.
+These directions describe OpenReceive 0.4.30.
 
 Add OpenReceive to a Node application — the app you are already working in. You
 do not need a copy of the OpenReceive source: the packages are on npm, and the
@@ -428,13 +428,12 @@ enough; drop the `.md` for the same page a person would read.
 - https://openreceive.org/guides/custom-checkout-route.md — advanced: replacing the shipped adapter's routes with your own
 - https://openreceive.org/guides/react-material-ui-recipe.md — a worked custom UI on a component library
 - https://openreceive.org/guides/sveltekit-recipe.md, https://openreceive.org/guides/nuxt-recipe.md, https://openreceive.org/guides/astro-recipe.md and https://openreceive.org/guides/react-router-recipe.md — the same handler as a SvelteKit, Nuxt, Astro or React Router route, if this app is one of those
+- https://openreceive.org/guides/payment-safety-upgrade.md — coordinated upgrades and reviewed repair of existing attempts
 - https://openreceive.org/guides.md — the index, if what you need is not above
 
 Questions, or a problem with the library itself:
 https://openreceive.org/contact
 
-- https://openreceive.org/guides/payment-safety-upgrade.md — coordinated upgrades and reviewed repair of existing attempts
-
 ---
 
 ## The quickstart, in full
@@ -463,8 +462,8 @@ stays the same.
 | Server   | `@openreceive/express`, `@openreceive/fastify`, `@openreceive/next`                                                           |
 | Frontend | `@openreceive/react`, `@openreceive/vue`, `@openreceive/svelte`, `@openreceive/angular`, `@openreceive/elements` (plain HTML) |
 
-Fastify: [quickstart-fastify.md](https://openreceive.org/guides/quickstart-fastify.md) · Next.js:
-[quickstart-next.md](https://openreceive.org/guides/quickstart-next.md). This page is the Express one.
+Fastify: [Fastify quickstart](https://openreceive.org/guides/quickstart-fastify.md) · Next.js:
+[Next.js quickstart](https://openreceive.org/guides/quickstart-next.md). This page is the Express one.
 
 On a fresh project, also install what this guide assumes you already have: the
 framework and an env loader (`npm install express dotenv`). Install your ORM

data/skills/integrate-openreceive/references/nuxt.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (Nuxt)
 
 ```sh
-# READ THIS FIRST: this file is 33 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 34 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/nuxt/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/nuxt/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.28.
+These directions describe OpenReceive 0.4.30.
 
 Add OpenReceive to a Nuxt application — the app you are already working in,
 on Nitro's `node-server` preset. OpenReceive ships no Nuxt package: the
@@ -419,13 +419,12 @@ enough; drop the `.md` for the same page a person would read.
 - https://openreceive.org/guides/custom-checkout-route.md — advanced: replacing the shipped adapter's routes with your own
 - https://openreceive.org/guides/react-material-ui-recipe.md — a worked custom UI on a component library
 - https://openreceive.org/guides/quickstart-next.md — each hook explained step by step, on Next.js; they are the same here
+- https://openreceive.org/guides/payment-safety-upgrade.md — coordinated upgrades and reviewed repair of existing attempts
 - https://openreceive.org/guides.md — the index, if what you need is not above
 
 Questions, or a problem with the library itself:
 https://openreceive.org/contact
 
-- https://openreceive.org/guides/payment-safety-upgrade.md — coordinated upgrades and reviewed repair of existing attempts
-
 ---
 
 ## The quickstart, in full
@@ -464,7 +463,7 @@ npm install @openreceive/http @openreceive/vue pg
 On Node, with Nitro's default `node-server` preset. The wallet connection and
 your database driver need Node, so the route cannot run on an edge runtime.
 The Vercel, Netlify and AWS Lambda presets deploy Node functions: read
-Bitcoin checkout on serverless hosts first. For
+[Bitcoin checkout on serverless hosts](https://openreceive.org/guides/serverless.md) first. For
 Cloudflare Workers, the [TanStack Start recipe](https://openreceive.org/guides/tanstack-start-recipe.md#where-it-runs)
 explains what a Worker needs. This recipe was not run on those hosts.
 
@@ -529,24 +528,24 @@ export default defineEventHandler((event) => handleOpenReceive(event));
 Put it in `server/routes/`, not `server/api/`, which would add `/api` to
 the path. `native` is the request's `H3Event`, so `authorize` can check the
 session your app already has: its cookies, or the user your session module
-reads from the event. The Next.js quickstart
+reads from the event. The [Next.js quickstart](https://openreceive.org/guides/quickstart-next.md)
 explains each hook. They are the same here.
 
 One stack serves the whole server process. `getRequestIP` returns the socket
 address. Behind your own reverse proxy, `{ xForwardedFor: true }` reads the
 first address in `x-forwarded-for`, which is safe only when that proxy sets
-the header (Rate limiting).
+the header ([Rate limiting](https://openreceive.org/guides/rate-limiting.md)).
 
 ### Your database
 
 `db` is a `pg` Pool, `node:sqlite` or `better-sqlite3`, or one of the
-adapters in Node ORM recipes. With Drizzle, pass
+adapters in [Node ORM recipes](https://openreceive.org/guides/node-orms.md). With Drizzle, pass
 the `pg` Pool underneath it.
 
 Create OpenReceive's two tables with your migrations
 (`npx openreceive scaffold payments --orm <your orm>`), or run
 `paymentsSchemaSql("postgres")` from `@openreceive/http` once. It is
-idempotent. See Payment storage.
+idempotent. See [Payment storage](https://openreceive.org/guides/storage.md).
 
 ### The checkout page
 
@@ -585,7 +584,7 @@ if (error.value) {
 The page renders on the server and starts the checkout in the browser. The
 payer picks Bitcoin and gets the invoice. Keep it at the order's own URL: a
 payer with a swap deposit in flight comes back to it
-(Swap refunds).
+([Swap refunds](https://openreceive.org/guides/swap-refunds.md)).
 
 ### Settings