@openreceive/browser 0.3.3 → 0.4.1

package/README.md

@@ -25,39 +25,21 @@ will move without notice.
 
 ## Icon assets
 
-The checkout UI (used directly or via `@openreceive/react` /
-`@openreceive/elements`) loads its payment-method icons from
-`dist/assets/icons/*.svg` **by URL at runtime** — the SVGs are not inlined into
-the JS. Each URL is resolved with `new URL()` against the module's own
-`import.meta.url`:
-
-- module emitted as `…/assets/<chunk>.js` (typical Vite/Rollup output) →
-  icons resolve to a sibling `…/assets/icons/*.svg`;
-- any other module URL → `./assets/icons/*.svg` next to the module file.
-
-Bundlers do not follow these dynamic URLs, so your app must serve the icon
-files where the resolution lands. Per setup:
-
-- **Plain `<script type="module">` / import map**: serve the package's `dist/`
-  directory as-is (e.g. `/vendor/openreceive/dist/index.js`). The icons already
-  sit at `dist/assets/icons/`, so nothing to copy.
-- **Vite / Rollup**: chunks are emitted under `assets/`, so serve the icons at
-  `assets/icons/` in the same output — either copy
-  `node_modules/@openreceive/browser/dist/assets/icons` into
-  `public/assets/icons/`, or copy it into the build output from a small
-  `writeBundle` plugin (the repo demos use
-  `examples/buttons/shared/copy-openreceive-payment-icons-plugin.ts`).
-- **webpack / Next.js**: copy the icons next to your emitted bundles with
-  `copy-webpack-plugin` (the repo's Rails Shakapacker demo copies
-  `node_modules/@openreceive/browser/dist/assets/icons` to
-  `<packs output>/js/assets/icons`). Note webpack can compile `import.meta.url`
-  to a build-machine `file://` URL; always confirm the URLs the page actually
-  requests (see below) and place — or serve — the icons at that path.
-
-To verify a setup, check the DevTools network panel for `…/icons/*.svg`
-requests, or log `paymentIconUrls` (exported from
-`@openreceive/browser/headless`) to see every resolved URL.
-
-`@openreceive/provider-data` follows the same contract for its runtime images
-(`dist/assets/provider-icons`, `dist/assets/pay_tutorials`); the copy recipes
-above handle those directories the same way.
+The payment-method icons (`btc`, `lightning`, `usdt`, …) are compiled into
+this package's JavaScript — nothing to copy, serve, or configure, under any
+bundler:
+
+- The custom element (`@openreceive/elements`, and the Vue/Svelte/Angular
+  wrappers over it) draws them inline in its shadow root from
+  `paymentIconSvgs`.
+- Everything that wants a URL — `@openreceive/react`, the display models,
+  `getPaymentMethodIcon` and friends, your own `<img>` — gets the same icons
+  from `paymentIconUrls` as `data:image/svg+xml` URIs. If your
+  Content-Security-Policy `img-src` forbids `data:`, allow it, or pass
+  `assetBaseUrl` / `resolveAssetUrl` and the icons are served as files
+  instead (`dist/assets/icons/*.svg` still ships, keyed by
+  `paymentIconPaths`).
+
+`@openreceive/provider-data`'s wallet logos and pay tutorials are files
+(PNG/WebP) your host serves; see
+[docs/guides/provider-registry.md](../../../docs/guides/provider-registry.md#assets).

package/dist/{chunk-AOX3YX2W.js → chunk-64ROVMMY.js}

@@ -181,9 +181,11 @@ var OPENRECEIVE_CHECKOUT_ELEMENT_ATTRIBUTES = {
    * Vue/Svelte/Angular wrappers can reach it (a function cannot cross an HTML
    * attribute). Every packaged key is a relative path under one `assets/` root,
    * so the value is joined to it directly: `asset-base-url="/openreceive-assets"`
-   * makes `assets/icons/btc.svg` load from
-   * `/openreceive-assets/assets/icons/btc.svg`. A `resolveAssetUrl` passed to
-   * `defineElements` wins over it.
+   * makes `assets/provider-icons/strike.png` load from
+   * `/openreceive-assets/assets/provider-icons/strike.png`. Only the provider
+   * images need it; the payment-method icons are compiled in and drawn inline
+   * unless a base URL is set, in which case they are served as files too. A
+   * `resolveAssetUrl` passed to `defineElements` wins over it.
    */
   assetBaseUrl: "asset-base-url",
   /** `polling="false"` renders the snapshot without status polling (no POST /payments/check). */
@@ -198,8 +200,7 @@ var OPENRECEIVE_THEME_TOGGLE_ELEMENT_ATTRIBUTES = {
   storageKey: "storage-key"
 };
 
-// src/internal/icons.ts
-import { lazyAssetUrlTable, warnOnFileAssetUrl } from "@openreceive/provider-data";
+// src/generated/payment-icon-svgs.ts
 var OPENRECEIVE_PAYMENT_ICON_IDS = [
   "btc",
   "crypto",
@@ -213,33 +214,34 @@ var OPENRECEIVE_PAYMENT_ICON_IDS = [
   "xmr",
   "xrp"
 ];
+var paymentIconSvgs = Object.freeze({
+  btc: '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><g fill="none" fill-rule="evenodd"><circle cx="16" cy="16" r="16" fill="#F7931A"/><path fill="#FFF" fill-rule="nonzero" d="M23.189 14.02c.314-2.096-1.283-3.223-3.465-3.975l.708-2.84-1.728-.43-.69 2.765c-.454-.114-.92-.22-1.385-.326l.695-2.783L15.596 6l-.708 2.839c-.376-.086-.746-.17-1.104-.26l.002-.009-2.384-.595-.46 1.846s1.283.294 1.256.312c.7.175.826.638.805 1.006l-.806 3.235c.048.012.11.03.18.057l-.183-.045-1.13 4.532c-.086.212-.303.531-.793.41.018.025-1.256-.313-1.256-.313l-.858 1.978 2.25.561c.418.105.828.215 1.231.318l-.715 2.872 1.727.43.708-2.84c.472.127.93.245 1.378.357l-.706 2.828 1.728.43.715-2.866c2.948.558 5.164.333 6.097-2.333.752-2.146-.037-3.385-1.588-4.192 1.13-.26 1.98-1.003 2.207-2.538zm-3.95 5.538c-.533 2.147-4.148.986-5.32.695l.95-3.805c1.172.293 4.929.872 4.37 3.11zm.535-5.569c-.487 1.953-3.495.96-4.47.717l.86-3.45c.975.243 4.118.696 3.61 2.733z"/></g></svg>',
+  crypto: '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-label="Crypto"><defs><linearGradient id="crypto-g" x1="8" x2="56" y1="8" y2="56" gradientUnits="userSpaceOnUse"><stop stop-color="#A78BFA"/><stop offset=".5" stop-color="#06B6D4"/><stop offset="1" stop-color="#22C55E"/></linearGradient></defs><rect width="64" height="64" rx="16" fill="#F5F3FF"/><path fill="url(#crypto-g)" d="M31.8 9 50 19.5v21L31.8 51 14 40.5v-21L31.8 9Z"/><path fill="#FFFFFF" fill-opacity=".92" d="m32 17 10.8 6.2v12.5L32 42l-10.8-6.3V23.2L32 17Zm0 6.8-5 2.9v5.8l5 2.9 5-2.9v-5.8l-5-2.9Z"/></svg>',
+  eth: '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><g fill="none" fill-rule="evenodd"><circle cx="16" cy="16" r="16" fill="#627EEA"/><g fill="#FFF" fill-rule="nonzero"><path fill-opacity=".602" d="M16.498 4v8.87l7.497 3.35z"/><path d="M16.498 4L9 16.22l7.498-3.35z"/><path fill-opacity=".602" d="M16.498 21.968v6.027L24 17.616z"/><path d="M16.498 27.995v-6.028L9 17.616z"/><path fill-opacity=".2" d="M16.498 20.573l7.497-4.353-7.497-3.348z"/><path fill-opacity=".602" d="M9 16.22l7.498 4.353v-7.701z"/></g></g></svg>',
+  lightning: '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-label="Lightning"><defs><linearGradient id="ln-g" x1="18" x2="46" y1="8" y2="58" gradientUnits="userSpaceOnUse"><stop stop-color="#FDE047"/><stop offset=".55" stop-color="#F59E0B"/><stop offset="1" stop-color="#EA580C"/></linearGradient></defs><rect width="64" height="64" rx="16" fill="#FFFBEB"/><path fill="url(#ln-g)" d="M37.6 7 17 36h13.6L26.4 57 47 28H33.3L37.6 7Z"/></svg>',
+  ltc: '<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32"><g fill="none" fill-rule="evenodd"><circle cx="16" cy="16" r="16" fill="#BFBBBB"/><path fill="#FFF" d="M10.427 19.214L9 19.768l.688-2.759 1.444-.58L13.213 8h5.129l-1.519 6.196 1.41-.571-.68 2.75-1.427.571-.848 3.483H23L22.127 24H9.252z"/></g></svg>',
+  sol: '<svg width="32" height="32" viewBox="0 0 32 32" xmlns="http://www.w3.org/2000/svg"><g fill="none"><circle fill="#66F9A1" cx="16" cy="16" r="16"/><path d="M9.925 19.687a.59.59 0 01.415-.17h14.366a.29.29 0 01.207.497l-2.838 2.815a.59.59 0 01-.415.171H7.294a.291.291 0 01-.207-.498l2.838-2.815zm0-10.517A.59.59 0 0110.34 9h14.366c.261 0 .392.314.207.498l-2.838 2.815a.59.59 0 01-.415.17H7.294a.291.291 0 01-.207-.497L9.925 9.17zm12.15 5.225a.59.59 0 00-.415-.17H7.294a.291.291 0 00-.207.498l2.838 2.815c.11.109.26.17.415.17h14.366a.291.291 0 00.207-.498l-2.838-2.815z" fill="#FFF"/></g></svg>',
+  trx: '<svg width="32" height="32" viewBox="0 0 32 32" xmlns="http://www.w3.org/2000/svg"><g fill="none"><circle fill="#EF0027" cx="16" cy="16" r="16"/><path d="M21.932 9.913L7.5 7.257l7.595 19.112 10.583-12.894-3.746-3.562zm-.232 1.17l2.208 2.099-6.038 1.093 3.83-3.192zm-5.142 2.973l-6.364-5.278 10.402 1.914-4.038 3.364zm-.453.934l-1.038 8.58L9.472 9.487l6.633 5.502zm.96.455l6.687-1.21-7.67 9.343.983-8.133z" fill="#FFF"/></g></svg>',
+  usdc: '<svg width="32" height="32" viewBox="0 0 32 32" xmlns="http://www.w3.org/2000/svg"><g fill="none"><circle fill="#3E73C4" cx="16" cy="16" r="16"/><g fill="#FFF"><path d="M20.022 18.124c0-2.124-1.28-2.852-3.84-3.156-1.828-.243-2.193-.728-2.193-1.578 0-.85.61-1.396 1.828-1.396 1.097 0 1.707.364 2.011 1.275a.458.458 0 00.427.303h.975a.416.416 0 00.427-.425v-.06a3.04 3.04 0 00-2.743-2.489V9.142c0-.243-.183-.425-.487-.486h-.915c-.243 0-.426.182-.487.486v1.396c-1.829.242-2.986 1.456-2.986 2.974 0 2.002 1.218 2.791 3.778 3.095 1.707.303 2.255.668 2.255 1.639 0 .97-.853 1.638-2.011 1.638-1.585 0-2.133-.667-2.316-1.578-.06-.242-.244-.364-.427-.364h-1.036a.416.416 0 00-.426.425v.06c.243 1.518 1.219 2.61 3.23 2.914v1.457c0 .242.183.425.487.485h.915c.243 0 .426-.182.487-.485V21.34c1.829-.303 3.047-1.578 3.047-3.217z"/><path d="M12.892 24.497c-4.754-1.7-7.192-6.98-5.424-11.653.914-2.55 2.925-4.491 5.424-5.402.244-.121.365-.303.365-.607v-.85c0-.242-.121-.424-.365-.485-.061 0-.183 0-.244.06a10.895 10.895 0 00-7.13 13.717c1.096 3.4 3.717 6.01 7.13 7.102.244.121.488 0 .548-.243.061-.06.061-.122.061-.243v-.85c0-.182-.182-.424-.365-.546zm6.46-18.936c-.244-.122-.488 0-.548.242-.061.061-.061.122-.061.243v.85c0 .243.182.485.365.607 4.754 1.7 7.192 6.98 5.424 11.653-.914 2.55-2.925 4.491-5.424 5.402-.244.121-.365.303-.365.607v.85c0 .242.121.424.365.485.061 0 .183 0 .244-.06a10.895 10.895 0 007.13-13.717c-1.096-3.46-3.778-6.07-7.13-7.162z"/></g></g></svg>',
+  usdt: '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><g fill="none" fill-rule="evenodd"><circle cx="16" cy="16" r="16" fill="#26A17B"/><path fill="#FFF" d="M17.922 17.383v-.002c-.11.008-.677.042-1.942.042-1.01 0-1.721-.03-1.971-.042v.003c-3.888-.171-6.79-.848-6.79-1.658 0-.809 2.902-1.486 6.79-1.66v2.644c.254.018.982.061 1.988.061 1.207 0 1.812-.05 1.925-.06v-2.643c3.88.173 6.775.85 6.775 1.658 0 .81-2.895 1.485-6.775 1.657m0-3.59v-2.366h5.414V7.819H8.595v3.608h5.414v2.365c-4.4.202-7.709 1.074-7.709 2.118 0 1.044 3.309 1.915 7.709 2.118v7.582h3.913v-7.584c4.393-.202 7.694-1.073 7.694-2.116 0-1.043-3.301-1.914-7.694-2.117"/></g></svg>',
+  xmr: '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><g fill="none" fill-rule="evenodd"><circle cx="16" cy="16" r="16" fill="#F60"/><path fill="#FFF" fill-rule="nonzero" d="M15.97 5.235c5.985 0 10.825 4.84 10.825 10.824a11.07 11.07 0 01-.558 3.432h-3.226v-9.094l-7.04 7.04-7.04-7.04v9.094H5.704a11.07 11.07 0 01-.557-3.432c0-5.984 4.84-10.824 10.824-10.824zM14.358 19.02L16 20.635l1.613-1.614 3.051-3.08v5.72h4.547a10.806 10.806 0 01-9.24 5.192c-3.902 0-7.334-2.082-9.24-5.192h4.546v-5.72l3.08 3.08z"/></g></svg>',
+  xrp: '<svg width="32" height="32" viewBox="0 0 32 32" xmlns="http://www.w3.org/2000/svg"><g fill="none"><circle cx="16" cy="16" r="16" fill="#23292F"/><path d="M23.07 8h2.89l-6.015 5.957a5.621 5.621 0 01-7.89 0L6.035 8H8.93l4.57 4.523a3.556 3.556 0 004.996 0L23.07 8zM8.895 24.563H6l6.055-5.993a5.621 5.621 0 017.89 0L26 24.562h-2.895L18.5 20a3.556 3.556 0 00-4.996 0l-4.61 4.563z" fill="#FFF"/></g></svg>'
+});
+
+// src/internal/icons.ts
 var PACKAGED_ICON_PREFIX = "assets/icons/";
-var moduleUrl = typeof import.meta.url === "string" && import.meta.url.length > 0 ? import.meta.url : fileUrlFromPath(__filename);
-function fileUrlFromPath(path) {
-  const normalized = path.replace(/\\/g, "/");
-  const absolute = normalized.startsWith("/") ? normalized : `/${normalized}`;
-  return `file://${encodeURI(absolute).replace(/#/g, "%23").replace(/\?/g, "%3F")}`;
-}
-function paymentIconRoot() {
-  if (moduleUrl.includes("/src/internal/")) return "../assets/icons/";
-  try {
-    const { pathname } = new URL(moduleUrl);
-    if (/\/assets\/[^/]+\.js$/i.test(pathname)) return "./icons/";
-  } catch {
-  }
-  return "./assets/icons/";
-}
-function paymentIconUrl(file) {
-  const resolved = new URL(`${paymentIconRoot()}${file}`, moduleUrl).href;
-  warnOnFileAssetUrl(`${PACKAGED_ICON_PREFIX}${file}`, resolved);
-  return resolved;
-}
-var paymentIconPaths = Object.fromEntries(
-  OPENRECEIVE_PAYMENT_ICON_IDS.map((id) => [id, `${PACKAGED_ICON_PREFIX}${id}.svg`])
+var paymentIconPaths = Object.freeze(
+  Object.fromEntries(
+    OPENRECEIVE_PAYMENT_ICON_IDS.map((id) => [id, `${PACKAGED_ICON_PREFIX}${id}.svg`])
+  )
 );
-var paymentIconUrls = lazyAssetUrlTable(
-  OPENRECEIVE_PAYMENT_ICON_IDS,
-  (id) => paymentIconUrl(`${id}.svg`)
+function svgDataUri(svg) {
+  return `data:image/svg+xml,${svg.replace(/[%#"<>&]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`)}`;
+}
+var paymentIconUrls = Object.freeze(
+  Object.fromEntries(
+    OPENRECEIVE_PAYMENT_ICON_IDS.map((id) => [id, svgDataUri(paymentIconSvgs[id])])
+  )
 );
 var paymentMethodIconIds = {
   bitcoin: "btc"
@@ -1378,12 +1380,14 @@ function getRouteNetworkLabel(routeId) {
 function createWizardRouteAssetDisplays(assets, options = {}) {
   return assets.map((asset) => {
     const id = asset.route ?? asset.symbol;
+    const iconId = routeIconId(asset);
     return {
       id,
       label: asset.label,
       subtitle: getRouteNetworkLabel(id),
-      icon: getRouteIcon(asset, options.resolveAssetUrl),
-      iconPath: getRouteIconPath(asset),
+      icon: resolvePaymentIcon(iconId, options.resolveAssetUrl),
+      iconId,
+      iconPath: paymentIconPaths[iconId],
       selected: options.selectedRoute === id
     };
   });
@@ -1423,21 +1427,30 @@ function createWizardProviderDisplay(entry, resolveAssetUrl) {
     openLabel: getCheckoutProviderOpenLabel()
   };
 }
+function getPaymentMethodIconId(method) {
+  return paymentMethodIconIds[method];
+}
 function getPaymentMethodIcon(method, resolveAssetUrl) {
-  return resolvePaymentIcon(paymentMethodIconIds[method], resolveAssetUrl);
+  return resolvePaymentIcon(getPaymentMethodIconId(method), resolveAssetUrl);
 }
-function getAssetIcon(symbol, resolveAssetUrl) {
-  return resolvePaymentIcon(assetIconIds[symbol] ?? "crypto", resolveAssetUrl);
+function assetIconId(symbol) {
+  return assetIconIds[symbol] ?? "crypto";
 }
-function getNetworkIcon(networkLabel, resolveAssetUrl) {
+function getNetworkIconId(networkLabel) {
   const key = networkLabel.trim().toLowerCase();
-  if (key === "tron" || key === "trx") return resolvePaymentIcon("trx", resolveAssetUrl);
-  if (key === "solana" || key === "sol") return resolvePaymentIcon("sol", resolveAssetUrl);
-  if (key === "ethereum" || key === "eth") return resolvePaymentIcon("eth", resolveAssetUrl);
-  return resolvePaymentIcon("crypto", resolveAssetUrl);
+  if (key === "tron" || key === "trx") return "trx";
+  if (key === "solana" || key === "sol") return "sol";
+  if (key === "ethereum" || key === "eth") return "eth";
+  return "crypto";
+}
+function getNetworkIcon(networkLabel, resolveAssetUrl) {
+  return resolvePaymentIcon(getNetworkIconId(networkLabel), resolveAssetUrl);
+}
+function getSwapOptionIconId(option) {
+  return assetIconId(option.label.trim().toLowerCase());
 }
 function getSwapOptionIcon(option, resolveAssetUrl) {
-  return getAssetIcon(option.label.trim().toLowerCase(), resolveAssetUrl);
+  return resolvePaymentIcon(getSwapOptionIconId(option), resolveAssetUrl);
 }
 function groupSwapOptionsByLabel(options) {
   const groups = [];
@@ -1797,16 +1810,13 @@ function getSwapRefundFormError(payInAsset, address, networkLabel) {
   if (address.length === 0) return "Enter a refund address.";
   return getSwapRefundAddressError(payInAsset, address, networkLabel);
 }
-function getRouteIcon(asset, resolveAssetUrl) {
-  return resolvePaymentIcon(routeIconId(asset), resolveAssetUrl);
-}
 function getRouteIconPath(asset) {
   return paymentIconPaths[routeIconId(asset)];
 }
 function routeIconId(asset) {
   const routeId = asset.route ?? asset.symbol;
   if (asset.symbol === "btc" && routeId.includes("lightning")) return "lightning";
-  return assetIconIds[asset.symbol] ?? "crypto";
+  return assetIconId(asset.symbol);
 }
 function createPaymentWizardState(request) {
   const selectedRouteId = request.selectedMethod === "bitcoin" ? request.selectedBitcoinRoute ?? getDefaultBitcoinRoute() : null;
@@ -3675,6 +3685,7 @@ export {
   createThemeChangeEvent,
   OPENRECEIVE_CHECKOUT_ELEMENT_ATTRIBUTES,
   OPENRECEIVE_THEME_TOGGLE_ELEMENT_ATTRIBUTES,
+  paymentIconSvgs,
   paymentIconPaths,
   paymentIconUrls,
   orClasses,
@@ -3713,8 +3724,11 @@ export {
   getRouteNetworkLabel,
   createWizardRouteAssetDisplays,
   createWizardRouteDisplays,
+  getPaymentMethodIconId,
   getPaymentMethodIcon,
+  getNetworkIconId,
   getNetworkIcon,
+  getSwapOptionIconId,
   getSwapOptionIcon,
   buildMethodGridEntries,
   swapPickerKey,

package/dist/headless.d.ts

@@ -1,18 +1,15 @@
 import { AssetIndexEntry, AssetUrlResolver, PaymentWizardRoute } from '@openreceive/provider-data';
 export { AssetUrlResolver, PaymentWizardRoute, PaymentWizardRouteRequest, createAssetBaseUrlResolver, getPaymentWizardRoutes } from '@openreceive/provider-data';
-import { P as ParseOpenReceiveOptionalIntegerOptions, a as PaymentMethod, R as ResolvedTheme, T as ThemePreference, b as PaymentMethodOption, c as TickingValueOptions, d as TickingValueController, e as TransientFeedbackOptions, f as TransientFeedbackController, C as CheckoutInvoiceSnapshot, U as UnixSeconds, S as SwapDisplayModel, g as CheckoutSnapshot, h as SwapDepositRisk, i as CheckoutState, j as TransactionDetailsInput, k as TransactionDetailRow, l as CreateCheckoutStateOptions, m as CheckoutStatusModelInput, n as CheckoutStatusModel, o as CheckoutPaymentMethod, B as BrowserLoggerOption, p as ThemeAttributeTarget, q as CheckoutElementAttributes, r as CheckoutElementAttributeOptions, s as CheckoutElementEventHandlers, t as CheckoutElementListeners, u as CreateCheckoutShellOptions, v as CheckoutShellElements, w as CheckoutShellOptions, x as CheckoutShellModel, y as CreateOpenReceiveThemeToggleElementOptions, z as ThemeToggleElementAttributeOptions, A as ThemeToggleElementAttributes, D as StoredThemeModelOptions, E as ThemeModel, F as ThemeModelOptions, G as ReadThemePreferenceOptions, H as ThemeControlTargets, I as ThemeStorageOptions, J as PaymentWizardControllerOptions, K as PaymentWizardController, L as PaymentWizardSelection, M as PaymentWizardModel, W as WizardRouteAssetDisplay, N as WizardRouteDisplay, O as PaymentWizardSelectionAction } from './status-BMYd00Xn.js';
-export { Q as BrowserLogContext, V as BrowserLogger, X as BrowserRequestError, Y as CheckoutController, Z as CheckoutControllerOptions, _ as CheckoutPhase, $ as CheckoutStatusRefresh, a0 as OPENRECEIVE_CHECKOUT_DATA_ATTRIBUTES, a1 as OPENRECEIVE_CHECKOUT_DATA_SELECTORS, a2 as OPENRECEIVE_CHECKOUT_ELEMENT_ATTRIBUTES, a3 as OPENRECEIVE_CHECKOUT_ELEMENT_EVENTS, a4 as OPENRECEIVE_CHECKOUT_ELEMENT_PARTS, a5 as OPENRECEIVE_CHECKOUT_ELEMENT_PART_SELECTORS, a6 as OPENRECEIVE_CHECKOUT_ELEMENT_SLOTS, a7 as OPENRECEIVE_CHECKOUT_ELEMENT_TAG_NAME, a8 as OPENRECEIVE_COPY_FEEDBACK_MS, a9 as OPENRECEIVE_DEFAULT_POLL_INTERVAL_MS, aa as OPENRECEIVE_DEFAULT_PREFIX, ab as OPENRECEIVE_PAYMENT_WIZARD_ATTRIBUTES, ac as OPENRECEIVE_PAYMENT_WIZARD_SELECTORS, ad as OPENRECEIVE_PROVIDER_PREVIEW_LIMIT, ae as OPENRECEIVE_THEME_STORAGE_KEY, af as OPENRECEIVE_THEME_TOGGLE_ELEMENT_ATTRIBUTES, ag as OPENRECEIVE_THEME_TOGGLE_ELEMENT_EVENTS, ah as OPENRECEIVE_THEME_TOGGLE_ELEMENT_PARTS, ai as OPENRECEIVE_THEME_TOGGLE_ELEMENT_PART_SELECTORS, aj as OPENRECEIVE_THEME_TOGGLE_ELEMENT_TAG_NAME, ak as QrEncoder, al as QrSvgController, am as QrSvgControllerOptions, an as Status, ao as SwapCopyRow, ap as SwapRefundStaging, aq as WizardProviderDisplay, ar as assertDisplayInvoice, as as copyInvoice, at as createCheckoutActionEvent, au as createCheckoutController, av as createCheckoutErrorEvent, aw as createCheckoutProviderCopyEvent, ax as createCheckoutStateEvent, ay as createQrPayloadSvg, az as createQrSvg, aA as createQrSvgController, aB as createStatusFetcher, aC as createThemeChangeEvent, aD as currentCheckoutUrl, aE as deriveCheckoutStateLabels, aF as deriveStatus, aG as enterCheckoutResumePath, aH as escapeHtml, aI as formatAmountCaption, aJ as formatDepositAmount, aK as formatFiatAmount, aL as formatMsats, aM as formatSwapLimit, aN as formatUnixTime, aO as openWallet, aP as prepareCheckout, aQ as requestCheckout } from './status-BMYd00Xn.js';
+import { P as PaymentIconId, a as ParseOpenReceiveOptionalIntegerOptions, b as PaymentMethod, R as ResolvedTheme, T as ThemePreference, c as PaymentMethodOption, d as TickingValueOptions, e as TickingValueController, f as TransientFeedbackOptions, g as TransientFeedbackController, C as CheckoutInvoiceSnapshot, U as UnixSeconds, S as SwapDisplayModel, h as CheckoutSnapshot, i as SwapDepositRisk, j as CheckoutState, k as TransactionDetailsInput, l as TransactionDetailRow, m as CreateCheckoutStateOptions, n as CheckoutStatusModelInput, o as CheckoutStatusModel, p as CheckoutPaymentMethod, B as BrowserLoggerOption, q as ThemeAttributeTarget, r as CheckoutElementAttributes, s as CheckoutElementAttributeOptions, t as CheckoutElementEventHandlers, u as CheckoutElementListeners, v as CreateCheckoutShellOptions, w as CheckoutShellElements, x as CheckoutShellOptions, y as CheckoutShellModel, z as CreateOpenReceiveThemeToggleElementOptions, A as ThemeToggleElementAttributeOptions, D as ThemeToggleElementAttributes, E as StoredThemeModelOptions, F as ThemeModel, G as ThemeModelOptions, H as ReadThemePreferenceOptions, I as ThemeControlTargets, J as ThemeStorageOptions, K as PaymentWizardControllerOptions, L as PaymentWizardController, M as PaymentWizardSelection, N as PaymentWizardModel, W as WizardRouteAssetDisplay, O as WizardRouteDisplay, Q as PaymentWizardSelectionAction } from './status-CzIEJWjS.js';
+export { V as BrowserLogContext, X as BrowserLogger, Y as BrowserRequestError, Z as CheckoutController, _ as CheckoutControllerOptions, $ as CheckoutPhase, a0 as CheckoutStatusRefresh, a1 as OPENRECEIVE_CHECKOUT_DATA_ATTRIBUTES, a2 as OPENRECEIVE_CHECKOUT_DATA_SELECTORS, a3 as OPENRECEIVE_CHECKOUT_ELEMENT_ATTRIBUTES, a4 as OPENRECEIVE_CHECKOUT_ELEMENT_EVENTS, a5 as OPENRECEIVE_CHECKOUT_ELEMENT_PARTS, a6 as OPENRECEIVE_CHECKOUT_ELEMENT_PART_SELECTORS, a7 as OPENRECEIVE_CHECKOUT_ELEMENT_SLOTS, a8 as OPENRECEIVE_CHECKOUT_ELEMENT_TAG_NAME, a9 as OPENRECEIVE_COPY_FEEDBACK_MS, aa as OPENRECEIVE_DEFAULT_POLL_INTERVAL_MS, ab as OPENRECEIVE_DEFAULT_PREFIX, ac as OPENRECEIVE_PAYMENT_WIZARD_ATTRIBUTES, ad as OPENRECEIVE_PAYMENT_WIZARD_SELECTORS, ae as OPENRECEIVE_PROVIDER_PREVIEW_LIMIT, af as OPENRECEIVE_THEME_STORAGE_KEY, ag as OPENRECEIVE_THEME_TOGGLE_ELEMENT_ATTRIBUTES, ah as OPENRECEIVE_THEME_TOGGLE_ELEMENT_EVENTS, ai as OPENRECEIVE_THEME_TOGGLE_ELEMENT_PARTS, aj as OPENRECEIVE_THEME_TOGGLE_ELEMENT_PART_SELECTORS, ak as OPENRECEIVE_THEME_TOGGLE_ELEMENT_TAG_NAME, al as QrEncoder, am as QrSvgController, an as QrSvgControllerOptions, ao as Status, ap as SwapCopyRow, aq as SwapRefundStaging, ar as WizardProviderDisplay, as as assertDisplayInvoice, at as copyInvoice, au as createCheckoutActionEvent, av as createCheckoutController, aw as createCheckoutErrorEvent, ax as createCheckoutProviderCopyEvent, ay as createCheckoutStateEvent, az as createQrPayloadSvg, aA as createQrSvg, aB as createQrSvgController, aC as createStatusFetcher, aD as createThemeChangeEvent, aE as currentCheckoutUrl, aF as deriveCheckoutStateLabels, aG as deriveStatus, aH as enterCheckoutResumePath, aI as escapeHtml, aJ as formatAmountCaption, aK as formatDepositAmount, aL as formatFiatAmount, aM as formatMsats, aN as formatSwapLimit, aO as formatUnixTime, aP as openWallet, aQ as paymentIconSvgs, aR as prepareCheckout, aS as requestCheckout } from './status-CzIEJWjS.js';
 import '@openreceive/core';
 
-declare const OPENRECEIVE_PAYMENT_ICON_IDS: readonly ["btc", "crypto", "eth", "lightning", "ltc", "sol", "trx", "usdc", "usdt", "xmr", "xrp"];
-type PaymentIconId = (typeof OPENRECEIVE_PAYMENT_ICON_IDS)[number];
 /**
- * The packaged PATH of each icon, independent of how (or whether) this module
- * managed to resolve it to a URL. A host whose bundler leaves
- * `import.meta.url` alone serves these files itself and maps them by path —
+ * The packaged PATH of each icon, for a host serving `dist/assets` itself —
  * see `AssetUrlResolver`.
  */
 declare const paymentIconPaths: Readonly<Record<PaymentIconId, string>>;
+/** Each packaged payment icon as a `data:image/svg+xml` URI, keyed by id. */
 declare const paymentIconUrls: Readonly<Record<PaymentIconId, string>>;
 
 /**
@@ -610,8 +607,11 @@ interface CheckoutComponentProps {
      * the string form of the `resolveAssetUrl` seam. Packaged icon and tutorial
      * keys are relative paths under one `assets/` root, so the value is joined to
      * them directly: `assetBaseUrl="/openreceive-assets"` loads
-     * `assets/icons/btc.svg` from `/openreceive-assets/assets/icons/btc.svg`.
-     * Needed under every bundler that does not rewrite `import.meta.url` — see
+     * `assets/provider-icons/strike.png` from
+     * `/openreceive-assets/assets/provider-icons/strike.png`. Needed for the
+     * provider images under every bundler that does not rewrite
+     * `import.meta.url`; the payment-method icons are compiled in and need
+     * nothing (a base URL, when set, serves them as files too) — see
      * docs/guides/provider-registry.md.
      */
     readonly assetBaseUrl?: string;
@@ -930,14 +930,19 @@ declare function createWizardRouteDisplays(routes: readonly PaymentWizardRoute[]
     /** Host-side rewrite of the packaged icon and tutorial paths. See {@link AssetUrlResolver}. */
     readonly resolveAssetUrl?: AssetUrlResolver;
 }): readonly WizardRouteDisplay[];
+declare function getPaymentMethodIconId(method: PaymentMethod): PaymentIconId;
 declare function getPaymentMethodIcon(method: PaymentMethod, resolveAssetUrl?: AssetUrlResolver): string;
-/** Icon for a swap network label (Tron → trx, Solana → sol, Ethereum → eth). */
+/** Icon id for a swap network label (Tron → trx, Solana → sol, Ethereum → eth). */
+declare function getNetworkIconId(networkLabel: string): PaymentIconId;
 declare function getNetworkIcon(networkLabel: string, resolveAssetUrl?: AssetUrlResolver): string;
 /**
- * Icon for a swap pay-in option card. Always the token/coin mark (USDT, USDC, SOL, …).
- * Network marks (Tron/Solana/Ethereum) belong only in the network reveal via
- * {@link getNetworkIcon}.
+ * Icon id for a swap pay-in option card. Always the token/coin mark (USDT,
+ * USDC, SOL, …). Network marks (Tron/Solana/Ethereum) belong only in the
+ * network reveal via {@link getNetworkIconId}.
  */
+declare function getSwapOptionIconId(option: {
+    readonly label: string;
+}): PaymentIconId;
 declare function getSwapOptionIcon(option: {
     readonly label: string;
 }, resolveAssetUrl?: AssetUrlResolver): string;
@@ -1224,4 +1229,4 @@ declare function createPaymentWizardModel(selection: PaymentWizardSelection): Pa
 declare function updatePaymentWizardSelection(selection: PaymentWizardSelection, action: PaymentWizardSelectionAction): PaymentWizardSelection;
 declare function createPaymentWizardController(options?: PaymentWizardControllerOptions): PaymentWizardController;
 
-export { BrowserLoggerOption, type CheckoutComponentProps, CheckoutElementAttributeOptions, CheckoutElementAttributes, CheckoutElementEventHandlers, CheckoutElementListeners, CheckoutInvoiceSnapshot, CheckoutPaymentMethod, type CheckoutPropsValidation, type CheckoutSession, type CheckoutSessionOptions, CheckoutShellElements, CheckoutShellModel, CheckoutShellOptions, CheckoutSnapshot, CheckoutState, CheckoutStatusModel, type CheckoutSwapOptions, CreateCheckoutShellOptions, type DetailLinkKind, type MethodGridContinueDisplay, type MethodGridDisplay, type MethodGridDisplayEntry, type MethodGridEntry, type MethodGridGroupDisplay, PaymentMethod, PaymentWizardController, PaymentWizardModel, PaymentWizardSelection, ResolvedTheme, StoredThemeModelOptions, SwapDepositRisk, SwapDisplayModel, type SwapLimitContext, type SwapMethodGroup, type SwapSelection, type SwapUnavailableModel, ThemeModel, ThemeModelOptions, ThemePreference, ThemeToggleElementAttributeOptions, ThemeToggleElementAttributes, TransactionDetailRow, TransactionDetailsInput, type TransactionDetailsSource, TransientFeedbackController, UnixSeconds, WizardRouteAssetDisplay, WizardRouteDisplay, type WizardSelection, applyCheckoutElementAttributes, assetButtonClasses, buildMethodGridEntries, checkoutElementStyles, checkoutLabels, createBlockExplorerUrl, createCheckoutElementAttributes, createCheckoutElementListeners, createCheckoutSession, createCheckoutShell, createCheckoutShellModel, createCheckoutSnapshotFromInvoice, createCheckoutState, createCheckoutStatusModel, createDetailExternalLink, createLightningInvoiceDecodeUrl, createMethodGridDisplay, createPaymentWizardController, createPaymentWizardModel, createPaymentWizardSelection, createStoredThemeModel, createSwapDisplayModel, createSwapUnavailableModel, createThemeModel, createThemeToggleElement, createThemeToggleElementAttributes, createTickingValueController, createTransactionDetails, createTransactionDetailsFromState, createTransientFeedbackController, createWizardRouteAssetDisplays, createWizardRouteDisplays, formatMethodNetworkDetail, formatNetworkSummary, getExplorerNetwork, getNetworkIcon, getPaymentMethodIcon, getRouteIconPath, getRouteNetworkLabel, getSwapOptionIcon, getSwapRefundFormError, getWizardEmptyMessage, isReusableLightningInvoice, mergeAttemptIntoCheckout, mergeAttemptIntoSnapshot, networkButtonClasses, networkCheckClasses, networkMobileRevealClasses, networkSummaryIconClasses, normalizeSwapStartInvoice, orClasses, parseBooleanAttribute, parseMethodPickerKey, parseOptionalInteger, parsePaymentMethod, parseResolvedTheme, parseThemePreference, paymentAccentId, paymentIconPaths, paymentIconUrls, paymentMethods, postJson, readThemePreference, requestSwapRefund, requestSwapStatus, resolveTransactionDetailRows, resolveWizardSelection, resumeSwapAttempt, selectCheckoutDisplayInvoice, selectCurrentSwapInvoice, startSwapRequest, swapAssetMatchesRoute, swapDepositRisk, swapOptionLimitMessage, swapOptionLimitSentence, swapPickerKey, syncStoredThemeControls, toggleStoredThemeControls, updatePaymentWizardSelection, validateCheckoutProps, writeThemePreference };
+export { BrowserLoggerOption, type CheckoutComponentProps, CheckoutElementAttributeOptions, CheckoutElementAttributes, CheckoutElementEventHandlers, CheckoutElementListeners, CheckoutInvoiceSnapshot, CheckoutPaymentMethod, type CheckoutPropsValidation, type CheckoutSession, type CheckoutSessionOptions, CheckoutShellElements, CheckoutShellModel, CheckoutShellOptions, CheckoutSnapshot, CheckoutState, CheckoutStatusModel, type CheckoutSwapOptions, CreateCheckoutShellOptions, type DetailLinkKind, type MethodGridContinueDisplay, type MethodGridDisplay, type MethodGridDisplayEntry, type MethodGridEntry, type MethodGridGroupDisplay, PaymentIconId, PaymentMethod, PaymentWizardController, PaymentWizardModel, PaymentWizardSelection, ResolvedTheme, StoredThemeModelOptions, SwapDepositRisk, SwapDisplayModel, type SwapLimitContext, type SwapMethodGroup, type SwapSelection, type SwapUnavailableModel, ThemeModel, ThemeModelOptions, ThemePreference, ThemeToggleElementAttributeOptions, ThemeToggleElementAttributes, TransactionDetailRow, TransactionDetailsInput, type TransactionDetailsSource, TransientFeedbackController, UnixSeconds, WizardRouteAssetDisplay, WizardRouteDisplay, type WizardSelection, applyCheckoutElementAttributes, assetButtonClasses, buildMethodGridEntries, checkoutElementStyles, checkoutLabels, createBlockExplorerUrl, createCheckoutElementAttributes, createCheckoutElementListeners, createCheckoutSession, createCheckoutShell, createCheckoutShellModel, createCheckoutSnapshotFromInvoice, createCheckoutState, createCheckoutStatusModel, createDetailExternalLink, createLightningInvoiceDecodeUrl, createMethodGridDisplay, createPaymentWizardController, createPaymentWizardModel, createPaymentWizardSelection, createStoredThemeModel, createSwapDisplayModel, createSwapUnavailableModel, createThemeModel, createThemeToggleElement, createThemeToggleElementAttributes, createTickingValueController, createTransactionDetails, createTransactionDetailsFromState, createTransientFeedbackController, createWizardRouteAssetDisplays, createWizardRouteDisplays, formatMethodNetworkDetail, formatNetworkSummary, getExplorerNetwork, getNetworkIcon, getNetworkIconId, getPaymentMethodIcon, getPaymentMethodIconId, getRouteIconPath, getRouteNetworkLabel, getSwapOptionIcon, getSwapOptionIconId, getSwapRefundFormError, getWizardEmptyMessage, isReusableLightningInvoice, mergeAttemptIntoCheckout, mergeAttemptIntoSnapshot, networkButtonClasses, networkCheckClasses, networkMobileRevealClasses, networkSummaryIconClasses, normalizeSwapStartInvoice, orClasses, parseBooleanAttribute, parseMethodPickerKey, parseOptionalInteger, parsePaymentMethod, parseResolvedTheme, parseThemePreference, paymentAccentId, paymentIconPaths, paymentIconUrls, paymentMethods, postJson, readThemePreference, requestSwapRefund, requestSwapStatus, resolveTransactionDetailRows, resolveWizardSelection, resumeSwapAttempt, selectCheckoutDisplayInvoice, selectCurrentSwapInvoice, startSwapRequest, swapAssetMatchesRoute, swapDepositRisk, swapOptionLimitMessage, swapOptionLimitSentence, swapPickerKey, syncStoredThemeControls, toggleStoredThemeControls, updatePaymentWizardSelection, validateCheckoutProps, writeThemePreference };

package/dist/headless.js

@@ -70,10 +70,13 @@ import {
   formatUnixTime,
   getExplorerNetwork,
   getNetworkIcon,
+  getNetworkIconId,
   getPaymentMethodIcon,
+  getPaymentMethodIconId,
   getRouteIconPath,
   getRouteNetworkLabel,
   getSwapOptionIcon,
+  getSwapOptionIconId,
   getSwapRefundFormError,
   getWizardEmptyMessage,
   isPaidCheckoutSnapshot,
@@ -96,6 +99,7 @@ import {
   parseThemePreference,
   paymentAccentId,
   paymentIconPaths,
+  paymentIconSvgs,
   paymentIconUrls,
   paymentMethods,
   postJson,
@@ -115,7 +119,7 @@ import {
   swapOptionLimitSentence,
   swapPickerKey,
   updatePaymentWizardSelection
-} from "./chunk-AOX3YX2W.js";
+} from "./chunk-64ROVMMY.js";
 
 // src/headless.ts
 import { createAssetBaseUrlResolver, getPaymentWizardRoutes } from "@openreceive/provider-data";
@@ -688,11 +692,14 @@ export {
   formatUnixTime,
   getExplorerNetwork,
   getNetworkIcon,
+  getNetworkIconId,
   getPaymentMethodIcon,
+  getPaymentMethodIconId,
   getPaymentWizardRoutes,
   getRouteIconPath,
   getRouteNetworkLabel,
   getSwapOptionIcon,
+  getSwapOptionIconId,
   getSwapRefundFormError,
   getWizardEmptyMessage,
   isReusableLightningInvoice,
@@ -713,6 +720,7 @@ export {
   parseThemePreference,
   paymentAccentId,
   paymentIconPaths,
+  paymentIconSvgs,
   paymentIconUrls,
   paymentMethods,
   postJson,

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { aR as BrowserLogLevel } from './status-BMYd00Xn.js';
-export { aS as BrowserLogEntry, V as BrowserLogger, B as BrowserLoggerOption, X as BrowserRequestError, Y as CheckoutController, Z as CheckoutControllerOptions, g as CheckoutSnapshot, i as CheckoutState, aT as CopyInvoiceOptions, aU as GuestCheckoutResumeController, aV as GuestCheckoutResumeOptions, aW as OpenWalletOptions, aX as PrepareCheckoutOptions, aY as QrOptions, aZ as RequestCheckoutOptions, an as Status, a_ as StatusInvoiceLike, U as UnixSeconds, as as copyInvoice, au as createCheckoutController, a$ as createGuestCheckoutResume, b0 as createGuestOrderFetcher, b1 as createLightningUri, b2 as createQrPngDataUrl, az as createQrSvg, aF as deriveStatus, aG as enterCheckoutResumePath, aO as openWallet, aP as prepareCheckout, aQ as requestCheckout } from './status-BMYd00Xn.js';
+import { aT as BrowserLogLevel } from './status-CzIEJWjS.js';
+export { aU as BrowserLogEntry, X as BrowserLogger, B as BrowserLoggerOption, Y as BrowserRequestError, Z as CheckoutController, _ as CheckoutControllerOptions, h as CheckoutSnapshot, j as CheckoutState, aV as CopyInvoiceOptions, aW as GuestCheckoutResumeController, aX as GuestCheckoutResumeOptions, aY as OpenWalletOptions, aZ as PrepareCheckoutOptions, a_ as QrOptions, a$ as RequestCheckoutOptions, ao as Status, b0 as StatusInvoiceLike, U as UnixSeconds, at as copyInvoice, av as createCheckoutController, b1 as createGuestCheckoutResume, b2 as createGuestOrderFetcher, b3 as createLightningUri, b4 as createQrPngDataUrl, aA as createQrSvg, aG as deriveStatus, aH as enterCheckoutResumePath, aP as openWallet, aR as prepareCheckout, aS as requestCheckout } from './status-CzIEJWjS.js';
 import '@openreceive/provider-data';
 import '@openreceive/core';
 

package/dist/index.js

@@ -13,7 +13,7 @@ import {
   openWallet,
   prepareCheckout,
   requestCheckout
-} from "./chunk-AOX3YX2W.js";
+} from "./chunk-64ROVMMY.js";
 export {
   BrowserRequestError,
   copyInvoice,

package/dist/{status-BMYd00Xn.d.ts → status-CzIEJWjS.d.ts}

@@ -1,6 +1,11 @@
 import { PaymentWizardRoute, AssetIndexEntry } from '@openreceive/provider-data';
 import { TransactionSettlementStatus } from '@openreceive/core';
 
+declare const OPENRECEIVE_PAYMENT_ICON_IDS: readonly ["btc", "crypto", "eth", "lightning", "ltc", "sol", "trx", "usdc", "usdt", "xmr", "xrp"];
+type PaymentIconId = (typeof OPENRECEIVE_PAYMENT_ICON_IDS)[number];
+/** Each packaged payment icon as minified SVG markup, keyed by id. */
+declare const paymentIconSvgs: Readonly<Record<PaymentIconId, string>>;
+
 /**
  * Trim insignificant trailing zeros from a decimal crypto amount for display,
  * e.g. "12.25900000" -> "12.259" and "5.000" -> "5". Only fractional digits are
@@ -282,9 +287,11 @@ declare const OPENRECEIVE_CHECKOUT_ELEMENT_ATTRIBUTES: {
      * Vue/Svelte/Angular wrappers can reach it (a function cannot cross an HTML
      * attribute). Every packaged key is a relative path under one `assets/` root,
      * so the value is joined to it directly: `asset-base-url="/openreceive-assets"`
-     * makes `assets/icons/btc.svg` load from
-     * `/openreceive-assets/assets/icons/btc.svg`. A `resolveAssetUrl` passed to
-     * `defineElements` wins over it.
+     * makes `assets/provider-icons/strike.png` load from
+     * `/openreceive-assets/assets/provider-icons/strike.png`. Only the provider
+     * images need it; the payment-method icons are compiled in and drawn inline
+     * unless a base URL is set, in which case they are served as files too. A
+     * `resolveAssetUrl` passed to `defineElements` wins over it.
      */
     readonly assetBaseUrl: "asset-base-url";
     /** `polling="false"` renders the snapshot without status polling (no POST /payments/check). */
@@ -1013,8 +1020,11 @@ interface WizardRouteAssetDisplay {
     readonly id: string;
     readonly label: string;
     readonly subtitle: string;
+    /** The icon as a URL: the packaged `data:` URI, or the host resolver's answer. */
     readonly icon: string;
-    /** The packaged key behind `icon`, for a host serving the files itself. */
+    /** The key behind `icon`, into `paymentIconSvgs` for a renderer drawing it inline. */
+    readonly iconId: PaymentIconId;
+    /** The packaged path behind `icon`, for a host serving the files itself. */
     readonly iconPath: string;
     readonly selected: boolean;
 }
@@ -1281,4 +1291,4 @@ declare function deriveStatus(invoice: StatusInvoiceLike, options?: {
     readonly now?: UnixSeconds;
 }): Status;
 
-export { type CheckoutStatusRefresh as $, type ThemeToggleElementAttributes as A, type BrowserLoggerOption as B, type CheckoutInvoiceSnapshot as C, type StoredThemeModelOptions as D, type ThemeModel as E, type ThemeModelOptions as F, type ReadThemePreferenceOptions as G, type ThemeControlTargets as H, type ThemeStorageOptions as I, type PaymentWizardControllerOptions as J, type PaymentWizardController as K, type PaymentWizardSelection as L, type PaymentWizardModel as M, type WizardRouteDisplay as N, type PaymentWizardSelectionAction as O, type ParseOpenReceiveOptionalIntegerOptions as P, type BrowserLogContext as Q, type ResolvedTheme as R, type SwapDisplayModel as S, type ThemePreference as T, type UnixSeconds as U, type BrowserLogger as V, type WizardRouteAssetDisplay as W, BrowserRequestError as X, type CheckoutController as Y, type CheckoutControllerOptions as Z, type CheckoutPhase as _, type PaymentMethod as a, createGuestCheckoutResume as a$, OPENRECEIVE_CHECKOUT_DATA_ATTRIBUTES as a0, OPENRECEIVE_CHECKOUT_DATA_SELECTORS as a1, OPENRECEIVE_CHECKOUT_ELEMENT_ATTRIBUTES as a2, OPENRECEIVE_CHECKOUT_ELEMENT_EVENTS as a3, OPENRECEIVE_CHECKOUT_ELEMENT_PARTS as a4, OPENRECEIVE_CHECKOUT_ELEMENT_PART_SELECTORS as a5, OPENRECEIVE_CHECKOUT_ELEMENT_SLOTS as a6, OPENRECEIVE_CHECKOUT_ELEMENT_TAG_NAME as a7, OPENRECEIVE_COPY_FEEDBACK_MS as a8, OPENRECEIVE_DEFAULT_POLL_INTERVAL_MS as a9, createQrSvgController as aA, createStatusFetcher as aB, createThemeChangeEvent as aC, currentCheckoutUrl as aD, deriveCheckoutStateLabels as aE, deriveStatus as aF, enterCheckoutResumePath as aG, escapeHtml as aH, formatAmountCaption as aI, formatDepositAmount as aJ, formatFiatAmount as aK, formatMsats as aL, formatSwapLimit as aM, formatUnixTime as aN, openWallet as aO, prepareCheckout as aP, requestCheckout as aQ, type BrowserLogLevel as aR, type BrowserLogEntry as aS, type CopyInvoiceOptions as aT, type GuestCheckoutResumeController as aU, type GuestCheckoutResumeOptions as aV, type OpenWalletOptions as aW, type PrepareCheckoutOptions as aX, type QrOptions as aY, type RequestCheckoutOptions as aZ, type StatusInvoiceLike as a_, OPENRECEIVE_DEFAULT_PREFIX as aa, OPENRECEIVE_PAYMENT_WIZARD_ATTRIBUTES as ab, OPENRECEIVE_PAYMENT_WIZARD_SELECTORS as ac, OPENRECEIVE_PROVIDER_PREVIEW_LIMIT as ad, OPENRECEIVE_THEME_STORAGE_KEY as ae, OPENRECEIVE_THEME_TOGGLE_ELEMENT_ATTRIBUTES as af, OPENRECEIVE_THEME_TOGGLE_ELEMENT_EVENTS as ag, OPENRECEIVE_THEME_TOGGLE_ELEMENT_PARTS as ah, OPENRECEIVE_THEME_TOGGLE_ELEMENT_PART_SELECTORS as ai, OPENRECEIVE_THEME_TOGGLE_ELEMENT_TAG_NAME as aj, type QrEncoder as ak, type QrSvgController as al, type QrSvgControllerOptions as am, type Status as an, type SwapCopyRow as ao, type SwapRefundStaging as ap, type WizardProviderDisplay as aq, assertDisplayInvoice as ar, copyInvoice as as, createCheckoutActionEvent as at, createCheckoutController as au, createCheckoutErrorEvent as av, createCheckoutProviderCopyEvent as aw, createCheckoutStateEvent as ax, createQrPayloadSvg as ay, createQrSvg as az, type PaymentMethodOption as b, createGuestOrderFetcher as b0, createLightningUri as b1, createQrPngDataUrl as b2, type TickingValueOptions as c, type TickingValueController as d, type TransientFeedbackOptions as e, type TransientFeedbackController as f, type CheckoutSnapshot as g, type SwapDepositRisk as h, type CheckoutState as i, type TransactionDetailsInput as j, type TransactionDetailRow as k, type CreateCheckoutStateOptions as l, type CheckoutStatusModelInput as m, type CheckoutStatusModel as n, type CheckoutPaymentMethod as o, type ThemeAttributeTarget as p, type CheckoutElementAttributes as q, type CheckoutElementAttributeOptions as r, type CheckoutElementEventHandlers as s, type CheckoutElementListeners as t, type CreateCheckoutShellOptions as u, type CheckoutShellElements as v, type CheckoutShellOptions as w, type CheckoutShellModel as x, type CreateOpenReceiveThemeToggleElementOptions as y, type ThemeToggleElementAttributeOptions as z };
+export { type CheckoutPhase as $, type ThemeToggleElementAttributeOptions as A, type BrowserLoggerOption as B, type CheckoutInvoiceSnapshot as C, type ThemeToggleElementAttributes as D, type StoredThemeModelOptions as E, type ThemeModel as F, type ThemeModelOptions as G, type ReadThemePreferenceOptions as H, type ThemeControlTargets as I, type ThemeStorageOptions as J, type PaymentWizardControllerOptions as K, type PaymentWizardController as L, type PaymentWizardSelection as M, type PaymentWizardModel as N, type WizardRouteDisplay as O, type PaymentIconId as P, type PaymentWizardSelectionAction as Q, type ResolvedTheme as R, type SwapDisplayModel as S, type ThemePreference as T, type UnixSeconds as U, type BrowserLogContext as V, type WizardRouteAssetDisplay as W, type BrowserLogger as X, BrowserRequestError as Y, type CheckoutController as Z, type CheckoutControllerOptions as _, type ParseOpenReceiveOptionalIntegerOptions as a, type RequestCheckoutOptions as a$, type CheckoutStatusRefresh as a0, OPENRECEIVE_CHECKOUT_DATA_ATTRIBUTES as a1, OPENRECEIVE_CHECKOUT_DATA_SELECTORS as a2, OPENRECEIVE_CHECKOUT_ELEMENT_ATTRIBUTES as a3, OPENRECEIVE_CHECKOUT_ELEMENT_EVENTS as a4, OPENRECEIVE_CHECKOUT_ELEMENT_PARTS as a5, OPENRECEIVE_CHECKOUT_ELEMENT_PART_SELECTORS as a6, OPENRECEIVE_CHECKOUT_ELEMENT_SLOTS as a7, OPENRECEIVE_CHECKOUT_ELEMENT_TAG_NAME as a8, OPENRECEIVE_COPY_FEEDBACK_MS as a9, createQrSvg as aA, createQrSvgController as aB, createStatusFetcher as aC, createThemeChangeEvent as aD, currentCheckoutUrl as aE, deriveCheckoutStateLabels as aF, deriveStatus as aG, enterCheckoutResumePath as aH, escapeHtml as aI, formatAmountCaption as aJ, formatDepositAmount as aK, formatFiatAmount as aL, formatMsats as aM, formatSwapLimit as aN, formatUnixTime as aO, openWallet as aP, paymentIconSvgs as aQ, prepareCheckout as aR, requestCheckout as aS, type BrowserLogLevel as aT, type BrowserLogEntry as aU, type CopyInvoiceOptions as aV, type GuestCheckoutResumeController as aW, type GuestCheckoutResumeOptions as aX, type OpenWalletOptions as aY, type PrepareCheckoutOptions as aZ, type QrOptions as a_, OPENRECEIVE_DEFAULT_POLL_INTERVAL_MS as aa, OPENRECEIVE_DEFAULT_PREFIX as ab, OPENRECEIVE_PAYMENT_WIZARD_ATTRIBUTES as ac, OPENRECEIVE_PAYMENT_WIZARD_SELECTORS as ad, OPENRECEIVE_PROVIDER_PREVIEW_LIMIT as ae, OPENRECEIVE_THEME_STORAGE_KEY as af, OPENRECEIVE_THEME_TOGGLE_ELEMENT_ATTRIBUTES as ag, OPENRECEIVE_THEME_TOGGLE_ELEMENT_EVENTS as ah, OPENRECEIVE_THEME_TOGGLE_ELEMENT_PARTS as ai, OPENRECEIVE_THEME_TOGGLE_ELEMENT_PART_SELECTORS as aj, OPENRECEIVE_THEME_TOGGLE_ELEMENT_TAG_NAME as ak, type QrEncoder as al, type QrSvgController as am, type QrSvgControllerOptions as an, type Status as ao, type SwapCopyRow as ap, type SwapRefundStaging as aq, type WizardProviderDisplay as ar, assertDisplayInvoice as as, copyInvoice as at, createCheckoutActionEvent as au, createCheckoutController as av, createCheckoutErrorEvent as aw, createCheckoutProviderCopyEvent as ax, createCheckoutStateEvent as ay, createQrPayloadSvg as az, type PaymentMethod as b, type StatusInvoiceLike as b0, createGuestCheckoutResume as b1, createGuestOrderFetcher as b2, createLightningUri as b3, createQrPngDataUrl as b4, type PaymentMethodOption as c, type TickingValueOptions as d, type TickingValueController as e, type TransientFeedbackOptions as f, type TransientFeedbackController as g, type CheckoutSnapshot as h, type SwapDepositRisk as i, type CheckoutState as j, type TransactionDetailsInput as k, type TransactionDetailRow as l, type CreateCheckoutStateOptions as m, type CheckoutStatusModelInput as n, type CheckoutStatusModel as o, type CheckoutPaymentMethod as p, type ThemeAttributeTarget as q, type CheckoutElementAttributes as r, type CheckoutElementAttributeOptions as s, type CheckoutElementEventHandlers as t, type CheckoutElementListeners as u, type CreateCheckoutShellOptions as v, type CheckoutShellElements as w, type CheckoutShellOptions as x, type CheckoutShellModel as y, type CreateOpenReceiveThemeToggleElementOptions as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openreceive/browser",
-  "version": "0.3.3",
+  "version": "0.4.1",
   "description": "Framework-free browser helpers for OpenReceive checkout: prepare/create calls, status polling, QR and wallet helpers.",
   "keywords": [
     "bitcoin",
@@ -31,8 +31,8 @@
     "./assets/*": "./dist/assets/*"
   },
   "dependencies": {
-    "@openreceive/core": "0.3.3",
-    "@openreceive/provider-data": "0.3.3",
+    "@openreceive/core": "0.4.1",
+    "@openreceive/provider-data": "0.4.1",
     "qrcode": "^1.5.4"
   },
   "devDependencies": {
@@ -48,7 +48,8 @@
   ],
   "scripts": {
     "build:css": "node ../../../tools/package/build-browser-css.mjs",
-    "build": "npm run build:css && tsup src/index.ts src/headless.ts --format esm --dts --clean --target es2022 --out-dir dist && node ../../../tools/package/copy-static.mjs src dist styles.css assets",
+    "build:icons": "node ../../../tools/package/generate-payment-icons.mjs",
+    "build": "npm run build:icons && npm run build:css && tsup src/index.ts src/headless.ts --format esm --dts --clean --target es2022 --out-dir dist && node ../../../tools/package/copy-static.mjs src dist styles.css assets",
     "prepack": "npm run build"
   },
   "license": "MIT",

package/skills/debug-openreceive-payment/SKILL.md

@@ -40,6 +40,7 @@ same diagnostics redacted, always exit 0 — safe to share.
 | Status | Meaning | Where to look |
 | --- | --- | --- |
 | 403 FORBIDDEN | Your own `authorize` hook denied it, or the request looked cross-site. Check the session/cookie actually reaches the checkout routes. https://openreceive.org/guides/authorization.md |
+| Never 403s — any visitor can mint, poll, or refund for any reference | The opposite failure: on Rails the generated `config.authorize = OpenReceive::ALLOW_ALL_AUTHORIZE` placeholder is still installed (the engine warns at boot; `bin/rails openreceive:doctor` reports it). Replace it with the app's real ownership check. https://openreceive.org/guides/authorization.md |
 | 404 NOT_FOUND | `amountFor` returned `null` (unknown reference), or the `payment_hash` does not belong to that reference. |
 | 409 CONFLICT | **Normal state, not a bug**: the reference already settled, or an unpaid checkout for that method is already live. Show it as order state; never retry-loop. |
 | 503 retryable | The host hook failed while persisting the attempt (instructions withheld), or the wallet is unavailable. Read the server log for the underlying error. |

package/skills/integrate-openreceive/references/node.md

@@ -1,6 +1,6 @@
 # OpenReceive agent directions (Node.js)
 
-These directions describe OpenReceive 0.3.3.
+These directions describe OpenReceive 0.4.1.
 
 Add OpenReceive to a Node application — the app you are already working in. You
 do not need a copy of the OpenReceive source: the packages are on npm, and the
@@ -374,6 +374,8 @@ const openreceive = openReceiveExpress({
       : null;
   },
   // Your own access check: may this caller do this action to this reference?
+  // `resource.reference` is your own order id, sent back by the payer's
+  // browser — a claim, not proof — already validated as a non-empty string.
   authorize: async ({ action, request, resource }) =>
     orders.viewerMay(
       await sessions.currentUser(request),
@@ -451,11 +453,13 @@ so a white card never lands on a dark page. The checkout is styled by CSS
 variables under `data-theme`; [Frontend checkout](https://openreceive.org/guides/frontend-checkout.md) has
 the knobs.
 
-Outside Vite/Rollup (esbuild, webpack, a plain script tag) the packaged
-payment-method icons cannot resolve their own URLs — the drop-in needs this
-exactly as a custom UI does. Serve the two packages' `dist/assets` trees and
-pass the base as `assetBaseUrl="/openreceive-assets"`
-([Provider registry](https://openreceive.org/guides/provider-registry.md#assets-are-files-your-host-serves)).
+The payment-method icons are compiled into `@openreceive/browser` and need
+nothing from your bundler. The wallet logos and pay tutorials are files in
+`@openreceive/provider-data`, and outside Vite/Rollup (esbuild, webpack, a
+plain script tag) they cannot resolve their own URLs — the drop-in needs this
+exactly as a custom UI does. Serve that package's `dist/assets` tree and pass
+the base as `assetBaseUrl="/openreceive-assets"`
+([Provider registry](https://openreceive.org/guides/provider-registry.md#assets)).
 
 That is the whole loop: your server owns the price and the order, the payer gets
 an invoice, and `onPaid` runs once inside the settlement transaction.

package/skills/integrate-openreceive/references/rails.md

@@ -1,6 +1,6 @@
 # OpenReceive agent directions (Rails)
 
-These directions describe OpenReceive 0.3.3.
+These directions describe OpenReceive 0.4.1.
 
 Add OpenReceive to a Rails application — the app you are already working in. You
 do not need a copy of the OpenReceive source: the gem is on RubyGems, the
@@ -106,7 +106,9 @@ itself, and they hold for every integration.
   reject payer-supplied amounts.
 - `config.authorize` runs on every request, and the `resource` it receives is a
   CLAIM the payer made, not proof. Read the framework session; never trust a
-  body field.
+  body field. The generator installs `OpenReceive::ALLOW_ALL_AUTHORIZE`, a
+  placeholder that allows everything (the engine warns at boot while it is
+  set) — replace it with this app's real ownership check, same as `on_paid`.
 - `config.on_paid` must be idempotent. It runs once per `reference` — your order
   id, one per thing you fulfill, created before checkout, kept across retries,
   never reused. A fresh id per page load lets one order be paid twice.
@@ -409,7 +411,9 @@ OpenReceive.configure do |config|
   #                        cookies, or headers from it, as in a controller
   #   context[:resource] — { reference:, payment_hash: } copied from the
   #                        payer's JSON body. It names an order; it does not
-  #                        prove this caller owns it.
+  #                        prove this caller owns it. reference is always a
+  #                        validated non-empty String (≤200 chars); payment_hash
+  #                        is nil except on payment.check / swap.read / swap.refund.
   # Return true to allow, false for a 403. Here: only the signed-in customer
   # who placed the order may act on it.
   config.authorize = lambda do |context|
@@ -455,7 +459,12 @@ The generated initializer ships
 the settlement and fulfills nothing. Replace it with your real fulfillment (as
 above); the engine warns every time your application boots while the
 placeholder is still configured, because orders would otherwise be recorded as settled without ever
-being fulfilled.
+being fulfilled. The same applies to
+`config.authorize = OpenReceive::ALLOW_ALL_AUTHORIZE`, the generated
+allow-all placeholder: it treats possession of the reference as
+authorization, which is safe only while references are unguessable, and the
+engine warns at boot until you replace it with your own ownership check (as
+above). Replace both, not just `on_paid`.
 
 The amount always comes from your own order record; payer-supplied amounts are
 rejected. Advanced hooks (`resolve_checkout`, `on_checkout_created`) remain as
@@ -510,13 +519,13 @@ Bundling with esbuild (jsbundling-rails)? Two things:
    <%= javascript_include_tag "application", type: "module" %>
    ```
 
-2. Serve the payment-method icons. They are files shipped in
-   `@openreceive/browser` and `@openreceive/provider-data` — not in
-   `@openreceive/elements` — and only Vite-style bundlers resolve them from
-   the import. Merge both packages' `dist/assets` trees into
-   `public/openreceive-assets/assets/` and set
+2. Serve the provider images. The payment-method icons are compiled into
+   `@openreceive/browser` and need nothing, but the wallet logos and pay
+   tutorials are files shipped in `@openreceive/provider-data`, and only
+   Vite-style bundlers resolve them from the import. Copy that package's
+   `dist/assets` tree to `public/openreceive-assets/assets/` and set
    `asset-base-url="/openreceive-assets"` on the element
-   ([Provider registry](https://openreceive.org/guides/provider-registry.md#assets-are-files-your-host-serves)).
+   ([Provider registry](https://openreceive.org/guides/provider-registry.md#assets)).
 
 The element creates the checkout for `reference`, then renders and polls
 itself. React/Vue/Svelte/Angular apps use the matching wrapper package