openreceive 0.4.29 → 0.4.31

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d1a81bab2d7f01fe8c723b24b3d22b5ae1b2cfa705dbf9f52001b2dc3259af89
-  data.tar.gz: d46ece12f35400fccfc15365cbe61854d2ad9a6dd8641ab42dd2b6bc8d157829
+  metadata.gz: e14b1d9f9ff049eeb46e718b76e4f22ed33c762e18a395191d5a3644f9099d06
+  data.tar.gz: 86668b11e568545b70037fe04d7bd0a48e10f6e8bf4c0cc611dcceddd1c716a3
 SHA512:
-  metadata.gz: 7b90b00d878b6cc2a6800337a096d98790ebdc5402717814f620c45042f21ec31347fa6c1448b9ff77d5e524b1e61b6d3a954c3e8a3d75d2e1813b7a28da96a6
-  data.tar.gz: 4d209c7a0cdc243d7d3e801a0c3617aa8be4a567ea2f78b057ab6ba8de13ce302f1bbe2f42d9fd870bf872ce128ef90dc018681de8370a5ebd1a576ba3a7c894
+  metadata.gz: 408b766d25f9ab3f488cacb2a3f144804d93e1ad3c596275f5542e80399eac04203399c4e4b5d410b8f76d3c823d4857a3e39e6f74bbefd281366af634e44efb
+  data.tar.gz: e68e45763fa2e972e199ea036496a6c7d865e572763398b0fab0cd1e06c97e3c4016fb759606575354a88b0a70ed18f62c245bbae1e29a8cc406ba20ebbce71f

data/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.4.31 - 2026-10-20
+
+Release with the complete 0.4.31 package family. The gem's summary names
+Rails and the optional USDT and USDC swaps. No Ruby runtime changes from
+0.4.30.
+
+## 0.4.30 - 2026-10-19
+
+Release with the complete 0.4.30 package family. The bundled agent skill adds the
+PrestaShop, Odoo and Vendure references and the guide corrections from a review of
+openreceive.org. No Ruby runtime changes from 0.4.29.
+
 ## 0.4.29 - 2026-10-19
 
 Release with the complete 0.4.29 package family. The bundled agent skill's

data/lib/openreceive/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module OpenReceive
-  VERSION = "0.4.29"
+  VERSION = "0.4.31"
 end

data/skills/integrate-openreceive/SKILL.md

@@ -6,7 +6,7 @@ description: >
   SvelteKit, Nuxt, Astro, React Router, TanStack Start, Rails,
   Python, Django, FastAPI, Flask, Laravel, plain PHP, WordPress/WooCommerce,
   Easy Digital Downloads,
-  Paymenter, FOSSBilling, Medusa, Lovable, Bolt, Supabase, React, Vue, Svelte, Angular, or plain HTML applications,
+  Paymenter, FOSSBilling, PrestaShop, Odoo, Medusa, Vendure, Lovable, Bolt, Supabase, React, Vue, Svelte, Angular, or plain HTML applications,
   mobile apps (React Native, Expo, Flutter, Swift, Kotlin) through their
   server, or connecting BTCPay Server to a receive-only NWC wallet. A configured swap provider
   converts these payments to BTC over Lightning in the merchant's connected
@@ -59,9 +59,18 @@ connected wallet; asset and network availability depends on the provider.
    - FOSSBilling: [references/fossbilling.md](references/fossbilling.md) — a
      module and payment gateway from the GitHub release, configured with
      console commands; no Composer or npm packages.
+   - PrestaShop: [references/prestashop.md](references/prestashop.md) — a
+     payment module from the GitHub release, configured with bin/console
+     commands; no Composer or npm packages.
+   - Odoo: [references/odoo.md](references/odoo.md) — a payment provider module
+     from the GitHub release and the `openreceive` package from PyPI,
+     configured with `odoo openreceive` commands.
    - Medusa: [references/medusa.md](references/medusa.md) — the
      `@openreceive/medusa` plugin and payment provider in the Medusa server,
      and the React checkout in the storefront; no hooks to write.
+   - Vendure: [references/vendure.md](references/vendure.md) — the
+     `@openreceive/vendure` plugin and payment method handler in the Vendure
+     server, and the React checkout in the storefront; no hooks to write.
    - Lovable (TanStack Start on Cloudflare Workers, with Supabase):
      [references/lovable.md](references/lovable.md) — no terminal; codes are
      Lovable secrets and payments go through Supabase's HTTPS API.

data/skills/integrate-openreceive/references/astro.md

@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/astro/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.29.
+These directions describe OpenReceive 0.4.31.
 
 Add OpenReceive to an Astro site — the one you are already working in, on
 `@astrojs/node`. OpenReceive ships no Astro package: the integration is one
@@ -434,13 +434,12 @@ enough; drop the `.md` for the same page a person would read.
 - https://openreceive.org/guides/custom-checkout-route.md — advanced: replacing the shipped adapter's routes with your own
 - https://openreceive.org/guides/react-material-ui-recipe.md — a worked custom UI on a component library
 - https://openreceive.org/guides/quickstart-next.md — each hook explained step by step, on Next.js; they are the same here
+- https://openreceive.org/guides/payment-safety-upgrade.md — coordinated upgrades and reviewed repair of existing attempts
 - https://openreceive.org/guides.md — the index, if what you need is not above
 
 Questions, or a problem with the library itself:
 https://openreceive.org/contact
 
-- https://openreceive.org/guides/payment-safety-upgrade.md — coordinated upgrades and reviewed repair of existing attempts
-
 ---
 
 ## The quickstart, in full
@@ -481,7 +480,7 @@ On Node, with `@astrojs/node`. The payment route and the checkout page render
 on demand (`prerender = false`); the rest of the site can stay static. The
 wallet connection and your database driver need Node, so the route cannot run
 on an edge runtime. The Vercel and Netlify adapters deploy Node functions:
-read Bitcoin checkout on serverless hosts first.
+read [Bitcoin checkout on serverless hosts](https://openreceive.org/guides/serverless.md) first.
 For Cloudflare Workers, the [TanStack Start recipe](https://openreceive.org/guides/tanstack-start-recipe.md#where-it-runs)
 explains what a Worker needs. This recipe was not run on those hosts.
 
@@ -572,25 +571,25 @@ export const POST: APIRoute = (context) => handleOpenReceive(context);
 
 `native` is the endpoint's `APIContext`, so `authorize` can check the
 session your app already has: its cookies, or the user your middleware puts
-in `context.locals`. The Next.js quickstart
+in `context.locals`. The [Next.js quickstart](https://openreceive.org/guides/quickstart-next.md)
 explains each hook. They are the same here.
 
 One stack serves the whole server process. Astro's origin check refuses
 cross-site form posts. The checkout sends JSON, which it lets through.
 `clientAddress` is the socket address. Behind your own reverse proxy, list
 your domain in `security.allowedDomains`: Astro then takes the payer's
-address from `x-forwarded-for` (Rate limiting).
+address from `x-forwarded-for` ([Rate limiting](https://openreceive.org/guides/rate-limiting.md)).
 
 ### Your database
 
 `db` is a `pg` Pool, `node:sqlite` or `better-sqlite3`, or one of the
-adapters in Node ORM recipes. With Drizzle, pass
+adapters in [Node ORM recipes](https://openreceive.org/guides/node-orms.md). With Drizzle, pass
 the `pg` Pool underneath it.
 
 Create OpenReceive's two tables with your migrations
 (`npx openreceive scaffold payments --orm <your orm>`), or run
 `paymentsSchemaSql("postgres")` from `@openreceive/http` once. It is
-idempotent. See Payment storage.
+idempotent. See [Payment storage](https://openreceive.org/guides/storage.md).
 
 ### The checkout page
 
@@ -630,7 +629,7 @@ if (!order || order.visitor !== Astro.cookies.get("visitor")?.value) {
 
 The element starts the checkout in the browser. The payer picks Bitcoin and
 gets the invoice. Keep it at the order's own URL: a payer with a swap deposit
-in flight comes back to it (Swap refunds).
+in flight comes back to it ([Swap refunds](https://openreceive.org/guides/swap-refunds.md)).
 
 ### Settings
 

data/skills/integrate-openreceive/references/bolt.md

@@ -17,7 +17,7 @@ If your fetch tool gave you a summary, fetch that URL again for the full text.
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start Step 1 only once NWC_URI is saved, and LSC_URI_PRIMARY is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.29.
+These directions describe OpenReceive 0.4.31.
 
 Add OpenReceive to this Bolt app: a Vite React app on Bolt Cloud, with Bolt
 Database or a connected Supabase project as its database, and Supabase Edge
@@ -123,9 +123,11 @@ explicitly declined.
 
 ## Step 1 — the packages
 
-Add `@openreceive/react` at 0.4.29 or newer to the app's
-`package.json`. The function imports `npm:@openreceive/http@^0.4.29`
-and `npm:@supabase/supabase-js@2` directly; add nothing else. No `pg`, no
+Add `@openreceive/react` at 0.4.31 or newer to the app's
+`package.json`. The function imports `npm:@openreceive/http@^0.4.31`
+and `npm:@supabase/supabase-js@2` directly; add nothing else. (The recipe
+below writes `^0.4.27`, the oldest release with the `cors` option; both
+resolve to the newest 0.4.x.) No `pg`, no
 Postgres driver, no OpenReceive scaffold.
 
 ## Step 2 — the migration
@@ -353,7 +355,7 @@ Use `@openreceive/*` 0.4.27 or newer: the function needs the `cors` option.
 
 ### 1. The migration
 
-Save the SQL from Supabase migration,
+Save the SQL from [Supabase migration](https://openreceive.org/guides/supabase-migration.md),
 unchanged, as a new migration (`supabase/migrations/<timestamp>_openreceive.sql`)
 and apply it. It creates OpenReceive's tables with row level security on and
 every grant revoked from `anon` and `authenticated`, and the functions the
@@ -502,7 +504,7 @@ is. OpenReceive never allows credentials across sites, so no cookie reaches
 the function, and a page on any listed origin can only send the tokens it
 holds. `authorize` decides with the token, on every request. Never answer
 these routes with CORS headers of your own, and never remove the token check.
-More: Cross-site requests.
+More: [Cross-site requests](https://openreceive.org/guides/authorization.md#cross-site-requests).
 
 ### 6. The secrets
 
@@ -573,7 +575,7 @@ page, as the payer's receipt.
 OpenReceive's CI runs both storage routes in Supabase's edge-runtime under
 the hosted limits, including a cross-site page with a bearer token. The trial
 harness runs coding agents through a Bolt-shaped shop on a local Supabase
-stack (see How we test platforms). We
+stack (see [How we test platforms](https://openreceive.org/guides/how-we-test-platforms.md)). We
 have not deployed to Supabase's hosted platform: its own API gateway, its
 `verify_jwt` check and its handling of preflights are untested. If something
 there does not work as this recipe says,

data/skills/integrate-openreceive/references/btcpay.md

@@ -13,11 +13,11 @@ curl -fsSL https://openreceive.org/agent-directions/btcpay/full.md
 - Check first: BTCPay Server 2.4.4 or later, and the plugin installed from Plugins → Plugin Directory.
 - Unless the store already uses OpenReceive, stop and ask the user for a receive-only NWC code.
 - Save it via Store → OpenReceive or the Greenfield API, never BTCPay's Lightning node screen. Never echo it.
-- If the user wants USDT, USDC, ETH or SOL, ask for an LSC code too, but do not wait for it.
+- Next ask for the LSC code. If the user wants stablecoins, USDT, USDC, ETH, SOL or crypto, do not ask yes/no first.
 - Never tick the spend-capable override to make a save succeed.
 - Do not suggest rotating or revoking a code because it was pasted here.
 
-These directions describe OpenReceive 0.4.29.
+These directions describe OpenReceive 0.4.31.
 
 Connect a BTCPay Server store to a receive-only NWC wallet with the OpenReceive
 plugin, and optionally let payers pay BTCPay invoices with USDT, USDC, ETH or
@@ -196,13 +196,12 @@ enough; drop the `.md` for the same page a person would read.
 - https://openreceive.org/guides/lightning-swap-connect.md — what an LSC code actually is
 - https://openreceive.org/guides/automated-swaps.md — provider states, and what turning swaps on commits a merchant to
 - https://openreceive.org/guides/swap-refunds.md — the refund states; the route back is BTCPay's own invoice checkout page here
+- https://openreceive.org/guides/payment-safety-upgrade.md — coordinated upgrades and reviewed repair of existing attempts
 - https://openreceive.org/guides.md — the index, if what you need is not above
 
 Questions, or a problem with the plugin itself:
 https://openreceive.org/contact
 
-- https://openreceive.org/guides/payment-safety-upgrade.md — coordinated upgrades and reviewed repair of existing attempts
-
 ---
 
 ## The quickstart, in full

data/skills/integrate-openreceive/references/django.md

@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/django/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.29.
+These directions describe OpenReceive 0.4.31.
 
 Add OpenReceive to a Django project — the app you are already working in. You
 do not need a copy of the OpenReceive source: the Python package is on PyPI
@@ -442,13 +442,12 @@ enough; drop the `.md` for the same page a person would read.
 - https://openreceive.org/guides/custom-checkout-route.md — advanced: replacing the mounted engine's routes with your own
 - https://openreceive.org/guides/react-material-ui-recipe.md — a worked custom UI on a component library
 - https://openreceive.org/agent-directions/flask.md — the same engine as a Flask Blueprint: follow those directions instead if this app is Flask after all
+- https://openreceive.org/guides/payment-safety-upgrade.md — coordinated upgrades and reviewed repair of existing attempts
 - https://openreceive.org/guides.md — the index, if what you need is not above
 
 Questions, or a problem with the library itself:
 https://openreceive.org/contact
 
-- https://openreceive.org/guides/payment-safety-upgrade.md — coordinated upgrades and reviewed repair of existing attempts
-
 ---
 
 ## The quickstart, in full

data/skills/integrate-openreceive/references/edd.md

@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/edd/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Setup is done only when the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.29.
+These directions describe OpenReceive 0.4.31.
 
 Install and configure the OpenReceive payment gateway in the Easy Digital
 Downloads (EDD) store you are working in. Preserve its theme, checkout,
@@ -96,7 +96,7 @@ is saved or the user said "Bitcoin only". Never invent a placeholder code.
 Install this release from the WordPress.org plugin directory:
 
 ```sh
-wp plugin install openreceive --version=0.4.29 --activate
+wp plugin install openreceive --version=0.4.31 --activate
 ```
 
 If that fails because WordPress.org does not have this version yet, install
@@ -104,7 +104,7 @@ the ZIP attached to the same GitHub release. Never install the GitHub
 source-code ZIP or a ZIP from an older release:
 
 ```sh
-wp plugin install https://github.com/OpenReceive/openreceive/releases/download/v0.4.29/openreceive-wordpress-0.4.29.zip --activate
+wp plugin install https://github.com/OpenReceive/openreceive/releases/download/v0.4.31/openreceive-wordpress-0.4.31.zip --activate
 ```
 
 It needs Easy Digital Downloads active, and PHP 8.2+ with GMP and sodium in
@@ -222,7 +222,6 @@ question.
 - [Lightning Swap Connect URI](https://openreceive.org/guides/lightning-swap-connect.md)
 - [Security](https://openreceive.org/guides/security.md)
 - [Price Feeds](https://openreceive.org/guides/price-feeds.md)
-- [Payment Safety Upgrade](https://openreceive.org/guides/payment-safety-upgrade.md)
 
 ---
 
@@ -258,7 +257,7 @@ activate it. With WP-CLI, run `wp plugin install openreceive --activate`.
 
 Each GitHub release also attaches the plugin as a ZIP, for a site that cannot
 reach WordPress.org:
-[openreceive-wordpress-0.4.29.zip](https://github.com/OpenReceive/openreceive/releases/download/v0.4.29/openreceive-wordpress-0.4.29.zip).
+[openreceive-wordpress-0.4.31.zip](https://github.com/OpenReceive/openreceive/releases/download/v0.4.31/openreceive-wordpress-0.4.31.zip).
 Install it through **Plugins → Add New → Upload Plugin**. The GitHub
 source-code ZIP is not an installable plugin.
 

data/skills/integrate-openreceive/references/fastapi.md

@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/fastapi/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.29.
+These directions describe OpenReceive 0.4.31.
 
 Add OpenReceive to a FastAPI application — the app you are already working in.
 You do not need a copy of the OpenReceive source: the engine is on PyPI
@@ -444,13 +444,12 @@ enough; drop the `.md` for the same page a person would read.
 - https://openreceive.org/guides/custom-checkout-route.md — advanced: replacing the shipped adapter's routes with your own
 - https://openreceive.org/guides/react-material-ui-recipe.md — a worked custom UI on a component library
 - https://openreceive.org/agent-directions/flask.md — the same engine as a Flask Blueprint: follow those directions instead if this app is Flask after all
+- https://openreceive.org/guides/payment-safety-upgrade.md — coordinated upgrades and reviewed repair of existing attempts
 - https://openreceive.org/guides.md — the index, if what you need is not above
 
 Questions, or a problem with the library itself:
 https://openreceive.org/contact
 
-- https://openreceive.org/guides/payment-safety-upgrade.md — coordinated upgrades and reviewed repair of existing attempts
-
 ---
 
 ## The quickstart, in full
@@ -625,14 +624,14 @@ checks the wallet, and requests get `503 WALLET_UNAVAILABLE` until the check
 passes.
 → [openreceive_router](https://openreceive.org/guides/api-reference.md#openreceive_router) ·
 [openreceive_lifespan](https://openreceive.org/guides/api-reference.md#openreceive_lifespan) ·
-[the authorize context](https://openreceive.org/guides/api-reference.md#the-authorize-context)
+[the authorize context](https://openreceive.org/guides/api-reference.md#host-python)
 
 `rate_limiting=True` is for public web shops. Leave it off for point-of-sale,
 where many payers share one IP. → [Rate limiting](https://openreceive.org/guides/rate-limiting.md)
 
 An optional worker, `openreceive notifications --app main:app`, listens for
 wallet payment notifications so settlement does not wait for the next page
-load. → [openreceive notifications](https://openreceive.org/guides/api-reference.md#openreceive-notifications)
+load. → [openreceive notifications](https://openreceive.org/guides/api-reference.md#openreceive-reconcile--openreceive-notifications)
 
 Your app also needs an ordinary order-creation route that validates the cart,
 prices with exact decimal math, and returns the order id the page will pass as

data/skills/integrate-openreceive/references/fastify.md

@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/fastify/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.29.
+These directions describe OpenReceive 0.4.31.
 
 Add OpenReceive to a Fastify application — the app you are already working in.
 You do not need a copy of the OpenReceive source: the packages are on npm, and
@@ -429,13 +429,12 @@ enough; drop the `.md` for the same page a person would read.
 - https://openreceive.org/guides/api-reference.md — every route, option and error code
 - https://openreceive.org/guides/custom-checkout-route.md — advanced: replacing the shipped adapter's routes with your own
 - https://openreceive.org/guides/react-material-ui-recipe.md — a worked custom UI on a component library
+- https://openreceive.org/guides/payment-safety-upgrade.md — coordinated upgrades and reviewed repair of existing attempts
 - https://openreceive.org/guides.md — the index, if what you need is not above
 
 Questions, or a problem with the library itself:
 https://openreceive.org/contact
 
-- https://openreceive.org/guides/payment-safety-upgrade.md — coordinated upgrades and reviewed repair of existing attempts
-
 ---
 
 ## The quickstart, in full
@@ -464,8 +463,8 @@ stays the same.
 | Server   | `@openreceive/fastify`, `@openreceive/express`, `@openreceive/next`                                                           |
 | Frontend | `@openreceive/react`, `@openreceive/vue`, `@openreceive/svelte`, `@openreceive/angular`, `@openreceive/elements` (plain HTML) |
 
-Express: [quickstart-node.md](https://openreceive.org/guides/quickstart-node.md) · Next.js:
-[quickstart-next.md](https://openreceive.org/guides/quickstart-next.md). This page is the Fastify one.
+Express: [Express quickstart](https://openreceive.org/guides/quickstart-node.md) · Next.js:
+[Next.js quickstart](https://openreceive.org/guides/quickstart-next.md). This page is the Fastify one.
 
 On a fresh project, also install what this guide assumes you already have: the
 framework, a static-file plugin for the checkout page, and an env loader

data/skills/integrate-openreceive/references/flask.md

@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/flask/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.29.
+These directions describe OpenReceive 0.4.31.
 
 Add OpenReceive to a Flask application — the app you are already working in.
 You do not need a copy of the OpenReceive source: the engine is on PyPI
@@ -449,13 +449,12 @@ enough; drop the `.md` for the same page a person would read.
 - https://openreceive.org/guides/api-reference.md — every route, option and error code
 - https://openreceive.org/guides/custom-checkout-route.md — advanced: replacing the shipped adapter's routes with your own
 - https://openreceive.org/guides/react-material-ui-recipe.md — a worked custom UI on a component library
+- https://openreceive.org/guides/payment-safety-upgrade.md — coordinated upgrades and reviewed repair of existing attempts
 - https://openreceive.org/guides.md — the index, if what you need is not above
 
 Questions, or a problem with the library itself:
 https://openreceive.org/contact
 
-- https://openreceive.org/guides/payment-safety-upgrade.md — coordinated upgrades and reviewed repair of existing attempts
-
 ---
 
 ## The quickstart, in full

data/skills/integrate-openreceive/references/fossbilling.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (FOSSBilling)
 
 ```sh
-# READ THIS FIRST: this file is 25 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 24 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/fossbilling/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/fossbilling/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Setup is done only when the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.29.
+These directions describe OpenReceive 0.4.31.
 
 Install and configure the OpenReceive payment method in the FOSSBilling
 billing panel you are working in. Preserve its theme, clients, products,
@@ -121,7 +121,7 @@ Docker image, download and unpack it inside the container, as the web user,
 then activate the module:
 
 ```sh
-docker compose exec -T -u www-data fossbilling sh -c 'curl -fsSLO https://github.com/OpenReceive/openreceive/releases/download/v0.4.29/openreceive-fossbilling-0.4.29.zip && unzip -oq openreceive-fossbilling-0.4.29.zip && rm openreceive-fossbilling-0.4.29.zip'
+docker compose exec -T -u www-data fossbilling sh -c 'curl -fsSLO https://github.com/OpenReceive/openreceive/releases/download/v0.4.31/openreceive-fossbilling-0.4.31.zip && unzip -oq openreceive-fossbilling-0.4.31.zip && rm openreceive-fossbilling-0.4.31.zip'
 docker compose exec -T -u www-data fossbilling php modules/Openreceive/activate.php
 ```
 
@@ -235,7 +235,6 @@ FOSSBilling's cron has never run, say so in one line of that message.
 - [Lightning Swap Connect URI](https://openreceive.org/guides/lightning-swap-connect.md)
 - [Security](https://openreceive.org/guides/security.md)
 - [Price Feeds](https://openreceive.org/guides/price-feeds.md)
-- [Payment Safety Upgrade](https://openreceive.org/guides/payment-safety-upgrade.md)
 
 ---
 
@@ -277,9 +276,9 @@ routes, console commands and cron hook), and
 
 ```sh
 cd /var/www/fossbilling
-curl -fsSLO https://github.com/OpenReceive/openreceive/releases/download/v0.4.29/openreceive-fossbilling-0.4.29.zip
-unzip -oq openreceive-fossbilling-0.4.29.zip
-rm openreceive-fossbilling-0.4.29.zip
+curl -fsSLO https://github.com/OpenReceive/openreceive/releases/download/v0.4.31/openreceive-fossbilling-0.4.31.zip
+unzip -oq openreceive-fossbilling-0.4.31.zip
+rm openreceive-fossbilling-0.4.31.zip
 chown -R www-data:www-data modules/Openreceive library/Payment/Adapter/OpenReceive
 sudo -u www-data php modules/Openreceive/activate.php
 ```
@@ -331,7 +330,7 @@ Run every command inside the container, in `/var/www/html`, as its web user
 `www-data`. Unpack the release there too:
 
 ```sh
-docker compose exec -T -u www-data fossbilling sh -c 'curl -fsSLO https://github.com/OpenReceive/openreceive/releases/download/v0.4.29/openreceive-fossbilling-0.4.29.zip && unzip -oq openreceive-fossbilling-0.4.29.zip && rm openreceive-fossbilling-0.4.29.zip'
+docker compose exec -T -u www-data fossbilling sh -c 'curl -fsSLO https://github.com/OpenReceive/openreceive/releases/download/v0.4.31/openreceive-fossbilling-0.4.31.zip && unzip -oq openreceive-fossbilling-0.4.31.zip && rm openreceive-fossbilling-0.4.31.zip'
 docker compose exec -T -u www-data fossbilling php modules/Openreceive/activate.php
 ```
 

data/skills/integrate-openreceive/references/laravel.md

@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/laravel/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.29.
+These directions describe OpenReceive 0.4.31.
 
 Add OpenReceive to a Laravel application — the app you are already working in.
 You do not need a copy of the OpenReceive source: the package is on Packagist
@@ -405,13 +405,12 @@ enough; drop the `.md` for the same page a person would read.
 - https://openreceive.org/guides/api-reference.md — every route, option and error code
 - https://openreceive.org/guides/custom-checkout-route.md — advanced: replacing the mounted engine's routes with your own
 - https://openreceive.org/guides/react-material-ui-recipe.md — a worked custom UI on a component library
+- https://openreceive.org/guides/payment-safety-upgrade.md — coordinated upgrades and reviewed repair of existing attempts
 - https://openreceive.org/guides.md — the index, if what you need is not above
 
 Questions, or a problem with the library itself:
 https://openreceive.org/contact
 
-- https://openreceive.org/guides/payment-safety-upgrade.md — coordinated upgrades and reviewed repair of existing attempts
-
 ---
 
 ## The quickstart, in full
@@ -421,7 +420,7 @@ passes. The page it comes from is https://openreceive.org/guides/quickstart-lara
 
 ## Laravel quickstart
 
-Requires PHP ≥ 8.2 (64-bit) and Laravel ≥ 11 (12 current). You also need these
+Requires PHP ≥ 8.2 (64-bit) and Laravel 11, 12 or 13. You also need these
 PHP extensions:
 
 - `ext-gmp`, which is REQUIRED. The NWC transport's elliptic-curve math depends

data/skills/integrate-openreceive/references/lovable.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (Lovable)
 
 ```text
-READ THIS FIRST: this file is 26 KB and a summary drops required steps. Read all of it:
+READ THIS FIRST: this file is 27 KB and a summary drops required steps. Read all of it:
 https://openreceive.org/agent-directions/lovable/full.md
 If your fetch tool gave you a summary, fetch that URL again for the full text.
 ```
@@ -17,7 +17,7 @@ If your fetch tool gave you a summary, fetch that URL again for the full text.
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start Step 1 only once NWC_URI is saved, and LSC_URI_PRIMARY is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.29.
+These directions describe OpenReceive 0.4.31.
 
 Add OpenReceive to this Lovable app: a TanStack Start app on Cloudflare
 Workers, with Lovable Cloud or a connected Supabase project as its database.
@@ -121,7 +121,7 @@ saved or explicitly declined.
 
 ## Step 1 — the packages
 
-Add `@openreceive/http` and `@openreceive/react` at 0.4.29 or newer.
+Add `@openreceive/http` and `@openreceive/react` at 0.4.31 or newer.
 Nothing else: no `pg`, no Postgres driver, no OpenReceive scaffold. Do not
 change the Vite or Wrangler configuration.
 
@@ -182,7 +182,7 @@ begin
   update public.orders
      set status = 'paid'
    where id = p_reference::uuid   -- or just p_reference, if the ids are text
-     and status = 'pending';
+     and status = 'awaiting_payment';  -- this app's own unpaid status
 end
 $$;
 ```
@@ -410,12 +410,12 @@ export async function handleOpenReceive(request: Request): Promise<Response> {
 ```
 
 `authorize` sees the incoming request with its cookies, so check it with
-the session your app already has. The Next.js quickstart
+the session your app already has. The [Next.js quickstart](https://openreceive.org/guides/quickstart-next.md)
 explains each hook. They are the same here.
 
 Create OpenReceive's two tables with your migrations, or run
 `paymentsSchemaSql("postgres")` from `@openreceive/http` once. It is
-idempotent. See Payment storage.
+idempotent. See [Payment storage](https://openreceive.org/guides/storage.md).
 
 ### On Supabase (Lovable)
 
@@ -440,7 +440,7 @@ npm install @openreceive/http @openreceive/react
    ) returns void language plpgsql as $$
    begin
      update public.orders set status = 'paid'
-      where id = p_reference::uuid and status = 'pending';
+      where id = p_reference::uuid and status = 'awaiting_payment'; -- your unpaid status
    end
    $$;
    ```
@@ -492,17 +492,21 @@ There is no `onPaid`: `openreceive_on_paid` is the fulfillment. `findOrder`
 reads the order with your server-side Supabase client; in a Lovable app that
 is `supabaseAdmin` from `@/integrations/supabase/client.server`.
 
-The checkout calls the payment routes from the browser with the page's
-cookies, and nothing else. A Lovable app keeps its Supabase sign-in in the
-browser, not in a cookie, so `authorize` cannot see who is signed in. Give
-the buyer a cookie of their own instead: create orders in a server function
+By default the checkout calls the payment routes from the browser with the
+page's cookies and nothing else. A Lovable app keeps its Supabase sign-in in
+the browser, not in a cookie, so `authorize` cannot see who is signed in from
+those cookies. Since 0.4.25 the React `<Checkout>` also takes a `fetch` that
+sends the access token
+([Use Supabase Auth in `authorize`](https://openreceive.org/guides/supabase.md#4-use-supabase-auth-in-authorize)), but
+this recipe keeps the simpler route that works with every checkout: give the
+buyer a cookie of their own. Create orders in a server function
 that sets an HttpOnly `buyer` cookie (a random value, kept across orders) and
 stores the same value on the order as `buyer_token`. `currentBuyer` reads it
 back from the request's `cookie` header.
 
 Before it serves, the server checks the database, and the payment routes
 answer 503 until the migration is applied and `openreceive_on_paid` is
-yours; the log names the fix. More: Supabase over HTTPS.
+yours; the log names the fix. More: [Supabase over HTTPS](https://openreceive.org/guides/supabase.md#supabase-over-https).
 
 ### The checkout page
 

data/skills/integrate-openreceive/references/medusa.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (Medusa)
 
 ```sh
-# READ THIS FIRST: this file is 21 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 22 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/medusa/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/medusa/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.29.
+These directions describe OpenReceive 0.4.31.
 
 Add OpenReceive to the Medusa store you are working in: a Medusa server, and
 usually a storefront in its own project (Medusa's Next.js starter or another).
@@ -199,7 +199,6 @@ Medusa.
 - [Lightning Swap Connect URI](https://openreceive.org/guides/lightning-swap-connect.md)
 - [Security](https://openreceive.org/guides/security.md)
 - [Price Feeds](https://openreceive.org/guides/price-feeds.md)
-- [Payment Safety Upgrade](https://openreceive.org/guides/payment-safety-upgrade.md)
 
 ---
 
@@ -321,13 +320,14 @@ starter's Tailwind build:
 
 ```ts
 import { readFile } from "node:fs/promises"
-import { createRequire } from "node:module"
 import path from "node:path"
 import { NextRequest } from "next/server"
 
 const BACKEND_URL = process.env.MEDUSA_BACKEND_URL ?? "http://localhost:9000"
 
 async function stylesheet() {
+  // Node's own createRequire: Next's bundler would replace an imported one.
+  const { createRequire } = await import(/* webpackIgnore: true */ "node:module")
   const resolve = createRequire(path.join(process.cwd(), "package.json")).resolve
   const css = await readFile(resolve("@openreceive/react/styles.css"))
   return new Response(css, {
@@ -460,7 +460,14 @@ and a buyer paying an order by Lightning and by USDT on Solana in Chromium,
 after which the order is placed with its payment captured. A payment whose
 buyer never placed the order was placed by the plugin's job. An unknown
 session, another provider's session and a request without the publishable
-key were refused, and an admin refund was recorded.
+key were refused, and an admin refund was recorded. The repository's CI runs
+the plugin in a real Medusa 2.21.2 on PostgreSQL on every push: those payments
+through the store API, the refusals, the refund and the job.
+
+Tested on 2026-10-19 with the starter's production build (`next build`, then
+`next start`): a buyer paid by Lightning and by USDT on Solana as above, and
+the route served the checkout's stylesheet, as it also does under
+`next dev --turbopack`.
 
 Not tested: Medusa split into a server and a worker, Medusa Cloud, storefronts
 other than the Next.js starter, and a storefront calling Medusa from the

data/skills/integrate-openreceive/references/mobile.md

@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/mobile/full.md
 - The app never decides paid: it asks the server. A link back to the app is navigation only.
 - Do not suggest rotating or revoking a code because it was pasted here.
 
-These directions describe OpenReceive 0.4.29.
+These directions describe OpenReceive 0.4.31.
 
 Add Bitcoin checkout, with optional USDT, USDC, ETH and SOL, to a mobile app:
 React Native or Expo, Flutter, Swift or Kotlin. OpenReceive has no mobile SDK