@aquarian-metals/coin-moebius-bitcoin 0.0.0-stage → 4.4.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 aquarian-metals
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,169 @@
-# Temporary Holding Version
+# @aquarian-metals/coin-moebius-bitcoin
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Self-hosted Bitcoin provider for **[Coin Moebius](https://github.com/aquarian-metals/coin-moebius)**. No custodial third-party gateway, no API keys to a payment processor, no merchant-tax-form-collecting middleman. The merchant runs `bitcoind`, this package supplies everything else.
+
+Two entries in one package:
+
+- `@aquarian-metals/coin-moebius-bitcoin` — **browser** entry. Modal-rendering provider that posts to your own checkout endpoint and shows the buyer a fresh Bitcoin address, the exact amount, and a `bitcoin:` link.
+- `@aquarian-metals/coin-moebius-bitcoin/server` — **server** entry. `createBitcoinCreator` (mints a labeled address per checkout), `createBitcoinVerifier` (validates indexer webhooks), `createBitcoinIndexer` (the long-running chain watcher). **Never import this from browser code.**
+
+## Why a self-hosted Bitcoin provider
+
+Custodial gateways (Cryptomus, NOWPayments, BTCPay-as-a-service) ask you to trust them with your money, your KYC, and your geo-availability. Self-hosting Bitcoin gives you:
+
+- **No counterparty.** Funds land directly in a wallet you control. No "gateway froze our account" thread on r/Bitcoin ends with your store.
+- **No third-party API keys.** Nothing on a vendor's dashboard can be revoked from under you.
+- **No geo limits.** Cryptomus is geo-blocked in the US; NOWPayments is fine but is a custodian. Self-hosted has no political surface.
+- **No fee skim.** The only fee is the Bitcoin network fee, which the buyer pays.
+
+The trade-off is operational: you (or your VPS) run a Bitcoin node. This package makes the wiring on top of that as small as possible.
+
+## Install
+
+```bash
+npm install @aquarian-metals/coin-moebius-bitcoin
+```
+
+The server entry uses Web Crypto (`crypto.subtle`) for HMAC and `fetch` for the node's JSON-RPC — works in Node 18+, Cloudflare Workers, Deno, and Bun. No additional dependency.
+
+## Use — browser
+
+```ts
+import { createBitcoinProvider } from '@aquarian-metals/coin-moebius-bitcoin';
+import { createPaymentManager } from '@aquarian-metals/coin-moebius';
+
+const payments = createPaymentManager({
+  providers: [
+    createBitcoinProvider({
+      checkoutEndpoint: '/api/checkout/bitcoin',
+      statusEndpoint: '/api/payment-status',
+    }),
+  ],
+});
+
+document.getElementById('buy-with-bitcoin')?.addEventListener('click', () => {
+  payments.initiate({ productId: 'ebook-42', amount: 19.99, currency: 'USD' });
+});
+```
+
+## Use — server (overview)
+
+Three serverless functions / handlers, plus one long-running indexer:
+
+1. `POST /api/checkout/bitcoin` — the browser posts here; you call `createBitcoinCreator(...)` and return its result.
+2. `POST /api/payment-webhook` — the **indexer** posts here; you call `verifierRegistry.verify(...)` and fulfill orders on `'success'`.
+3. `GET /api/payment-status?paymentId=…` — the browser polls here; you return the current `PaymentRecord` from your store.
+4. **The indexer process** — see "Running the indexer" below.
+
+```js
+// /api/checkout/bitcoin
+import { createBitcoinCreator } from '@aquarian-metals/coin-moebius-bitcoin/server';
+import { myProductionStore } from './store.js';
+
+const create = createBitcoinCreator({
+  rpcUrl: process.env.BITCOIN_RPC_URL,
+  wallet: 'shop',
+  rpcUser: process.env.BITCOIN_RPC_USER,
+  rpcPassword: process.env.BITCOIN_RPC_PASSWORD,
+  store: myProductionStore,
+  btcPerUnit: async (currency) => {
+    // You decide where prices come from — CoinGecko, Kraken ticker,
+    // pinned constant. Coin Moebius does not call any oracle.
+    return 1 / (await fetchBitcoinPriceFromMyOracle(currency));
+  },
+});
+
+export default async (req) => {
+  const { productId, metadata } = await req.json();
+  // Price from your own catalog, never from the request: the browser is the
+  // buyer's, and a buyer can send any amount they like.
+  const price = await priceOf(productId);
+  if (!price) return new Response('Unknown product', { status: 404 });
+  return Response.json(await create({ productId, ...price, metadata }));
+};
+```
+
+```js
+// /api/payment-webhook
+import { createVerifierRegistry } from '@aquarian-metals/coin-moebius-server';
+import { createBitcoinVerifier } from '@aquarian-metals/coin-moebius-bitcoin/server';
+
+const verifiers = createVerifierRegistry();
+verifiers.register('bitcoin', createBitcoinVerifier({ hmacSecret: process.env.BITCOIN_HMAC_SECRET }).verify);
+
+export default async (req) => {
+  const result = await verifiers.verify(await req.text(), Object.fromEntries(req.headers));
+  if (result?.status === 'success') {
+    // Fulfill the order. This handler MUST be idempotent — like every
+    // webhook receiver, you may get a duplicate.
+  }
+  return new Response('', { status: 200 });
+};
+```
+
+## Running the indexer
+
+The indexer is the long-running process that watches the node's wallet and converts on-chain events into webhook posts. **It must run inside the same private network as `bitcoind`.** It never accepts inbound network traffic; it only makes outbound calls to the node's RPC (private network) and to your webhook endpoint (HTTPS).
+
+```js
+// indexer.js
+import { createBitcoinIndexer } from '@aquarian-metals/coin-moebius-bitcoin/server';
+import { myProductionStore } from './store.js';
+
+const indexer = createBitcoinIndexer({
+  rpcUrl: process.env.BITCOIN_RPC_URL,
+  wallet: 'shop',
+  rpcUser: process.env.BITCOIN_RPC_USER,
+  rpcPassword: process.env.BITCOIN_RPC_PASSWORD,
+  store: myProductionStore,
+  webhookUrl: process.env.BITCOIN_WEBHOOK_URL,
+  hmacSecret: process.env.BITCOIN_HMAC_SECRET,
+  requiredConfirmations: 1,
+  pollIntervalMs: 30_000,
+});
+
+const stop = indexer.start();
+process.on('SIGTERM', stop);
+process.on('SIGINT', stop);
+```
+
+## Why downtime is cheap
+
+The indexer is **catch-up by design**. If it's offline for an hour, the next tick queries the node for the missed block range and emits the webhooks then. Buyers see a stale "pending" during the outage; nothing is lost, nothing requires manual reconciliation.
+
+Compared to a hosted gateway, where downtime on the gateway's end means missed events and refund tickets, your operational SLA for self-hosted Bitcoin is "eventually consistent within a few minutes." That's a much easier bar to meet than "five-nines uptime," and it's the property that makes self-hosting realistic for indie merchants who don't run an ops team.
+
+## Node setup notes
+
+The minimum the merchant needs running, in production:
+
+```bash
+# bitcoin.conf
+server=1
+prune=550
+rpcbind=127.0.0.1
+rpcallowip=127.0.0.1
+rpcuser=shop
+rpcpassword=<long random password>
+```
+
+```bash
+# A watch-only wallet holding only your public descriptor.
+bitcoin-cli -named createwallet wallet_name=shop disable_private_keys=true blank=true load_on_startup=true
+bitcoin-cli -rpcwallet=shop importdescriptors '[{"desc":"wpkh([…]xpub…/0/*)#…","active":true,"range":[0,999],"timestamp":"now"}]'
+```
+
+**Never expose the node's RPC to the public internet.** See [`docs/self-hosted-bitcoin.md`](https://github.com/aquarian-metals/coin-moebius/blob/main/docs/self-hosted-bitcoin.md) for the full walkthrough, including where the descriptor comes from, a regtest recipe for trying it without real money, and troubleshooting.
+
+## Related
+
+- For self-hosted Monero or Zano, see `@aquarian-metals/coin-moebius-monero` and `@aquarian-metals/coin-moebius-zano`.
+- For custodial crypto on a hosted gateway, see `@aquarian-metals/coin-moebius-nowpayments`.
+- For fiat (Stripe), see `@aquarian-metals/coin-moebius-stripe`.
+- For Goldbacks, cash, check, or barter, see `@aquarian-metals/coin-moebius-manual`.
+
+See the [main README](https://github.com/aquarian-metals/coin-moebius#readme) for the full quick-start, and `examples/static-site-demo/bitcoin/` for a copy-paste deployment.
+
+## License
+
+MIT — see [LICENSE](./LICENSE).

package/dist/amounts.d.ts

@@ -0,0 +1,13 @@
+/** Bitcoin carries eight decimal places. One satoshi is 10^-8 BTC. */
+export declare const BTC_DECIMALS = 8;
+/**
+ * Satoshis to an exact decimal string of BTC with no trailing zeros.
+ *
+ * This is the only honest way to write an amount for a buyer. The satoshi
+ * integer is what the invoice actually requires; a float built from it can
+ * print binary noise or slide into exponent form, and a buyer who types what
+ * they read would then underpay. Lives here because both the browser modal
+ * and the server creator have to print the same number.
+ */
+export declare function formatAtomic(atomic: bigint): string;
+//# sourceMappingURL=amounts.d.ts.map

package/dist/amounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"amounts.d.ts","sourceRoot":"","sources":["../src/amounts.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,eAAO,MAAM,YAAY,IAAI,CAAC;AAE9B;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKnD"}

package/dist/amounts.js

@@ -0,0 +1,18 @@
+/** Bitcoin carries eight decimal places. One satoshi is 10^-8 BTC. */
+export const BTC_DECIMALS = 8;
+/**
+ * Satoshis to an exact decimal string of BTC with no trailing zeros.
+ *
+ * This is the only honest way to write an amount for a buyer. The satoshi
+ * integer is what the invoice actually requires; a float built from it can
+ * print binary noise or slide into exponent form, and a buyer who types what
+ * they read would then underpay. Lives here because both the browser modal
+ * and the server creator have to print the same number.
+ */
+export function formatAtomic(atomic) {
+    const digits = atomic.toString().padStart(BTC_DECIMALS + 1, '0');
+    const whole = digits.slice(0, digits.length - BTC_DECIMALS);
+    const fraction = digits.slice(digits.length - BTC_DECIMALS).replace(/0+$/, '');
+    return fraction.length > 0 ? `${whole}.${fraction}` : whole;
+}
+//# sourceMappingURL=amounts.js.map

package/dist/amounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"amounts.js","sourceRoot":"","sources":["../src/amounts.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAE9B;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,YAAY,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/E,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7D,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Bitcoin client-side provider for Coin Moebius.
+ *
+ * Self-hosted flow. The browser POSTs to a checkout endpoint on the
+ * merchant's own backend, which asks the merchant's Bitcoin Core wallet for
+ * a fresh receiving address and returns payment instructions. The buyer
+ * sees those instructions in a modal and pays from their own wallet. The
+ * merchant's separately running indexer watches the wallet and posts a
+ * webhook when the payment confirms.
+ *
+ *     import { createBitcoinProvider } from '@aquarian-metals/coin-moebius-bitcoin';
+ *     const bitcoin = createBitcoinProvider({
+ *       checkoutEndpoint: '/api/checkout/bitcoin',
+ *       statusEndpoint: '/api/payment-status',
+ *     });
+ *
+ *     const manager = createPaymentManager({ providers: [bitcoin] });
+ *     await manager.initiate({ productId: 'pro', amount: 19.99, currency: 'USD' });
+ */
+import type { PaymentProvider } from '@aquarian-metals/coin-moebius-core';
+export { BTC_DECIMALS, formatAtomic } from './amounts.js';
+/**
+ * Shape of the payment instructions presented to the buyer. A custom
+ * `renderModal` receives this and is responsible for displaying it.
+ */
+export interface BitcoinInstructions {
+    paymentId: string;
+    /** Bitcoin address minted for this checkout. Never handed to a second checkout. */
+    address: string;
+    /** Exact amount to send, in satoshis, as a string to avoid float precision loss. */
+    atomicAmount: string;
+    /** Same amount in BTC, for human display. */
+    btcAmount: number;
+    /** `bitcoin:address?amount=…` link (BIP 21) suitable for a QR code or a wallet deep link. */
+    uri: string;
+    /** Epoch milliseconds. After this, the merchant's indexer will mark the payment failed if unpaid. */
+    expiresAt: number;
+}
+/** Client-side config. All secrets stay server-side. */
+export interface BitcoinProviderConfig {
+    /**
+     * Full URL (or relative path) of the checkout endpoint that calls
+     * `createBitcoinCreator(...)` on the server and returns
+     * {@link BitcoinInstructions}. Defaults to `/api/checkout/bitcoin`.
+     */
+    checkoutEndpoint?: string;
+    /**
+     * Optional URL (or relative path) of a status endpoint that returns the
+     * current `PaymentRecord` for a `paymentId`. When provided, the provider
+     * attaches it to the pending result's metadata so the caller can hand it
+     * to `payments.subscribeToStatus(paymentId, …)`.
+     */
+    statusEndpoint?: string;
+    /**
+     * Optional custom modal renderer. Receives the buyer-facing instructions
+     * and a `close()` callback. Must return a cleanup function that removes
+     * the modal from the DOM.
+     *
+     * When omitted, a minimal inline-styled modal shows the address, amount,
+     * and the `bitcoin:` link. The default is a working fallback, not a
+     * styling target.
+     */
+    renderModal?: (instructions: BitcoinInstructions, callbacks: {
+        onClose: () => void;
+    }) => () => void;
+    /** Optional `fetch` override. Defaults to global `fetch`. */
+    fetcher?: typeof fetch;
+}
+/**
+ * Build a `PaymentProvider` registered as `id: 'bitcoin'`. Calls `onPending`
+ * once the buyer-facing modal is shown; never calls `onSuccess` directly,
+ * because chain confirmations land asynchronously through the indexer, the
+ * webhook, and the merchant's status store. Call
+ * `manager.subscribeToStatus(paymentId, …)` after `initiate` resolves to be
+ * told when the payment settles.
+ */
+export declare function createBitcoinProvider(config?: BitcoinProviderConfig): PaymentProvider;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAmB,MAAM,oCAAoC,CAAC;AAI3F,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE1D;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,oFAAoF;IACpF,YAAY,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,GAAG,EAAE,MAAM,CAAC;IACZ,qGAAqG;IACrG,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,WAAW,qBAAqB;IACrC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,CACb,YAAY,EAAE,mBAAmB,EACjC,SAAS,EAAE;QAAE,OAAO,EAAE,MAAM,IAAI,CAAA;KAAE,KAC9B,MAAM,IAAI,CAAC;IAChB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,GAAE,qBAA0B,GAAG,eAAe,CAsCzF"}

package/dist/index.js

@@ -0,0 +1,172 @@
+import { formatAtomic } from './amounts.js';
+export { BTC_DECIMALS, formatAtomic } from './amounts.js';
+/**
+ * Build a `PaymentProvider` registered as `id: 'bitcoin'`. Calls `onPending`
+ * once the buyer-facing modal is shown; never calls `onSuccess` directly,
+ * because chain confirmations land asynchronously through the indexer, the
+ * webhook, and the merchant's status store. Call
+ * `manager.subscribeToStatus(paymentId, …)` after `initiate` resolves to be
+ * told when the payment settles.
+ */
+export function createBitcoinProvider(config = {}) {
+    const checkoutEndpoint = config.checkoutEndpoint ?? '/api/checkout/bitcoin';
+    const fetcher = config.fetcher ?? globalThis.fetch.bind(globalThis);
+    const renderer = config.renderModal ?? defaultRenderModal;
+    return {
+        id: 'bitcoin',
+        name: 'Bitcoin',
+        async initiate(options, callbacks) {
+            try {
+                const instructions = await fetchInstructions(fetcher, checkoutEndpoint, options);
+                const cleanup = renderer(instructions, {
+                    onClose: () => cleanup(),
+                });
+                callbacks.onPending?.({
+                    status: 'pending',
+                    paymentId: instructions.paymentId,
+                    provider: 'bitcoin',
+                    amount: options.amount,
+                    currency: options.currency,
+                    metadata: {
+                        ...(options.metadata ?? {}),
+                        address: instructions.address,
+                        atomicAmount: instructions.atomicAmount,
+                        btcAmount: instructions.btcAmount,
+                        uri: instructions.uri,
+                        expiresAt: instructions.expiresAt,
+                        statusEndpoint: config.statusEndpoint,
+                    },
+                    timestamp: Date.now(),
+                });
+            }
+            catch (err) {
+                callbacks.onError(err instanceof Error ? err : new Error(String(err)));
+            }
+        },
+    };
+}
+const ALLOWED_URI_SCHEMES = new Set(['bitcoin:']);
+function validateUri(uri) {
+    let parsed;
+    try {
+        parsed = new URL(uri);
+    }
+    catch {
+        throw new Error('coin-moebius/bitcoin: checkout response contains an invalid URI');
+    }
+    if (!ALLOWED_URI_SCHEMES.has(parsed.protocol)) {
+        throw new Error(`coin-moebius/bitcoin: URI scheme "${parsed.protocol}" is not allowed (expected bitcoin:)`);
+    }
+    return uri;
+}
+async function fetchInstructions(fetcher, endpoint, options) {
+    const response = await fetcher(endpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            productId: options.productId,
+            amount: options.amount,
+            currency: options.currency,
+            metadata: options.metadata,
+        }),
+    });
+    if (!response.ok) {
+        throw new Error(`coin-moebius/bitcoin: checkout endpoint responded ${response.status}`);
+    }
+    const payload = (await response.json());
+    // Check every field the modal renders, not just the ones it routes on. A
+    // missing number is not a blank on the screen, it is the word "undefined"
+    // where an amount should be, or "NaN minutes" on the expiry line, and the
+    // buyer has no way to tell that from a real instruction.
+    if (typeof payload.paymentId !== 'string' ||
+        typeof payload.address !== 'string' ||
+        typeof payload.atomicAmount !== 'string' ||
+        !/^\d+$/.test(payload.atomicAmount) ||
+        typeof payload.uri !== 'string' ||
+        !Number.isFinite(payload.btcAmount) ||
+        !Number.isFinite(payload.expiresAt)) {
+        throw new Error('coin-moebius/bitcoin: checkout response missing required fields (paymentId, address, atomicAmount, btcAmount, uri, expiresAt)');
+    }
+    payload.uri = validateUri(payload.uri);
+    return payload;
+}
+/**
+ * Minimal default modal. Names the network on the line that matters, because
+ * bitcoin sent over Lightning or as a wrapped coin on another chain never
+ * reaches this address. Uses inline styles to survive arbitrary host-page
+ * CSS. No QR rendering, to keep the browser bundle small; render your own
+ * inside a custom `renderModal`.
+ */
+function defaultRenderModal(instructions, callbacks) {
+    const overlay = document.createElement('div');
+    overlay.setAttribute('role', 'dialog');
+    overlay.setAttribute('aria-modal', 'true');
+    overlay.setAttribute('aria-labelledby', 'cm-bitcoin-title');
+    overlay.style.cssText = [
+        'position:fixed',
+        'inset:0',
+        'z-index:2147483647',
+        'background:rgba(0,0,0,0.5)',
+        'display:flex',
+        'align-items:center',
+        'justify-content:center',
+        'padding:16px',
+        'font-family:system-ui,-apple-system,sans-serif',
+    ].join(';');
+    const card = document.createElement('div');
+    card.style.cssText = [
+        'background:#fff',
+        'color:#1a1a1a',
+        'border-radius:8px',
+        'padding:24px',
+        'max-width:520px',
+        'width:100%',
+        'box-shadow:0 20px 60px rgba(0,0,0,0.2)',
+    ].join(';');
+    const expiresIn = Math.max(0, Math.round((instructions.expiresAt - Date.now()) / 1000 / 60));
+    // Print the satoshi integer, not the float beside it. The satoshi value is
+    // what settles the invoice, and it is the only form that cannot show the
+    // buyer binary noise or exponent notation in place of a payable number.
+    const amount = `${escapeHtml(formatAtomic(BigInt(instructions.atomicAmount)))} BTC`;
+    card.innerHTML = `
+		<h2 id="cm-bitcoin-title" style="margin:0 0 8px;font-size:1.25rem;">Pay with Bitcoin</h2>
+		<p style="margin:0 0 16px;color:#555;">Send <strong>exactly</strong> ${amount} to the address below. Send only on the Bitcoin network. Expires in ~${expiresIn} minutes.</p>
+		<div style="background:#f5f5f5;padding:16px;border-radius:4px;margin-bottom:16px;font-family:ui-monospace,monospace;font-size:0.85rem;word-break:break-all;">
+			<div style="margin-bottom:8px;"><strong>Address:</strong></div>
+			<div style="user-select:all;">${escapeHtml(instructions.address)}</div>
+			<div style="margin-top:12px;"><strong>Amount:</strong> ${amount}</div>
+			<div style="margin-top:8px;"><strong>Wallet link:</strong></div>
+			<div><a href="${escapeHtml(instructions.uri)}" style="color:#1a73e8;word-break:break-all;">${escapeHtml(instructions.uri)}</a></div>
+		</div>
+		<div style="display:flex;gap:8px;justify-content:flex-end;">
+			<button type="button" data-action="close" style="padding:8px 16px;border:none;background:#1a1a1a;color:#fff;border-radius:4px;cursor:pointer;font:inherit;">Done</button>
+		</div>
+	`;
+    overlay.appendChild(card);
+    document.body.appendChild(overlay);
+    const previouslyFocused = document.activeElement;
+    const closeBtn = card.querySelector('[data-action="close"]');
+    closeBtn?.focus();
+    closeBtn?.addEventListener('click', () => callbacks.onClose());
+    const onKey = (e) => {
+        if (e.key === 'Escape')
+            callbacks.onClose();
+    };
+    document.addEventListener('keydown', onKey);
+    return () => {
+        document.removeEventListener('keydown', onKey);
+        overlay.remove();
+        previouslyFocused?.focus();
+    };
+}
+function escapeHtml(s) {
+    const map = {
+        '&': '&amp;',
+        '<': '&lt;',
+        '>': '&gt;',
+        '"': '&quot;',
+        "'": '&#39;',
+    };
+    return s.replace(/[&<>"']/g, (c) => map[c] ?? c);
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAoD1D;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAgC,EAAE;IACvE,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,uBAAuB,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAE1D,OAAO;QACN,EAAE,EAAE,SAAS;QACb,IAAI,EAAE,SAAS;QACf,KAAK,CAAC,QAAQ,CAAC,OAAwB,EAAE,SAAS;YACjD,IAAI,CAAC;gBACJ,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;gBAEjF,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,EAAE;oBACtC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE;iBACxB,CAAC,CAAC;gBAEH,SAAS,CAAC,SAAS,EAAE,CAAC;oBACrB,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,YAAY,CAAC,SAAS;oBACjC,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE;wBACT,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;wBAC3B,OAAO,EAAE,YAAY,CAAC,OAAO;wBAC7B,YAAY,EAAE,YAAY,CAAC,YAAY;wBACvC,SAAS,EAAE,YAAY,CAAC,SAAS;wBACjC,GAAG,EAAE,YAAY,CAAC,GAAG;wBACrB,SAAS,EAAE,YAAY,CAAC,SAAS;wBACjC,cAAc,EAAE,MAAM,CAAC,cAAc;qBACrC;oBACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;iBACrB,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,SAAS,CAAC,OAAO,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxE,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;AAElD,SAAS,WAAW,CAAC,GAAW;IAC/B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACd,qCAAqC,MAAM,CAAC,QAAQ,sCAAsC,CAC1F,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC/B,OAAqB,EACrB,QAAgB,EAChB,OAAwB;IAExB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE;QACxC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC1B,CAAC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiC,CAAC;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,yDAAyD;IACzD,IACC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;QACrC,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;QACnC,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ;QACxC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QACnC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;QACnC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAClC,CAAC;QACF,MAAM,IAAI,KAAK,CACd,+HAA+H,CAC/H,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,OAA8B,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAC1B,YAAiC,EACjC,SAAkC;IAElC,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvC,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC3C,OAAO,CAAC,YAAY,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;IAC5D,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG;QACvB,gBAAgB;QAChB,SAAS;QACT,oBAAoB;QACpB,4BAA4B;QAC5B,cAAc;QACd,oBAAoB;QACpB,wBAAwB;QACxB,cAAc;QACd,gDAAgD;KAChD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEZ,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG;QACpB,iBAAiB;QACjB,eAAe;QACf,mBAAmB;QACnB,cAAc;QACd,iBAAiB;QACjB,YAAY;QACZ,wCAAwC;KACxC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEZ,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7F,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,MAAM,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;IAEpF,IAAI,CAAC,SAAS,GAAG;;yEAEuD,MAAM,wEAAwE,SAAS;;;mCAG7H,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC;4DACP,MAAM;;mBAE/C,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,iDAAiD,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC;;;;;EAK1H,CAAC;IAEF,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAEnC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,aAAmC,CAAC;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAoB,uBAAuB,CAAC,CAAC;IAChF,QAAQ,EAAE,KAAK,EAAE,CAAC;IAClB,QAAQ,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;IAE/D,MAAM,KAAK,GAAG,CAAC,CAAgB,EAAE,EAAE;QAClC,IAAI,CAAC,CAAC,GAAG,KAAK,QAAQ;YAAE,SAAS,CAAC,OAAO,EAAE,CAAC;IAC7C,CAAC,CAAC;IACF,QAAQ,CAAC,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAE5C,OAAO,GAAG,EAAE;QACX,QAAQ,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC/C,OAAO,CAAC,MAAM,EAAE,CAAC;QACjB,iBAAiB,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC5B,MAAM,GAAG,GAA2B;QACnC,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,OAAO;KACZ,CAAC;IACF,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAClD,CAAC"}