@openreceive/node 0.4.18 → 0.4.19

package/dist/{chunk-LD7HMUY3.js → chunk-6XUDLYM6.js}

@@ -491,8 +491,6 @@ function unwrapNwcResult(value) {
 }
 
 // src/nwc/transport.ts
-import { createRequire } from "node:module";
-import { pathToFileURL } from "node:url";
 import { recordOrEmpty as recordOrEmpty2 } from "@openreceive/core";
 
 // src/nwc/history-request.ts
@@ -567,7 +565,6 @@ async function historyRequest(client, params, signal) {
 }
 
 // src/nwc/transport.ts
-var require2 = createRequire(import.meta.url);
 async function callRequiredMethod(client, names, request, options) {
   for (const name of names) {
     const method = client[name];
@@ -582,10 +579,7 @@ async function callRequiredMethod(client, names, request, options) {
 }
 async function createDefaultAlbyNwcClient(connectionString) {
   ensureNodeWebSocket();
-  const dynamicImport = new Function("specifier", "return import(specifier)");
-  const namespace = recordOrEmpty2(
-    await dynamicImport(pathToFileURL(require2.resolve("@getalby/sdk/nwc")).href)
-  );
+  const namespace = recordOrEmpty2(await import("@getalby/sdk/nwc"));
   const Constructor = namespace.NWCClient;
   if (typeof Constructor !== "function") {
     throw new WalletPreflightError(

package/dist/cli.js

@@ -2,7 +2,7 @@ import {
   createNwcReceiveClient,
   readLscConnectionsFromEnvironment,
   redactSecrets
-} from "./chunk-LD7HMUY3.js";
+} from "./chunk-6XUDLYM6.js";
 
 // src/cli.ts
 import { cpSync, existsSync, mkdirSync, realpathSync, rmSync } from "node:fs";

package/dist/index.js

@@ -19,7 +19,7 @@ import {
   summarizeReconcilePass,
   summarizeSwapProviderApiRequest,
   summarizeSwapProviderApiResponse
-} from "./chunk-LD7HMUY3.js";
+} from "./chunk-6XUDLYM6.js";
 
 // src/index.ts
 import { OpenReceiveError as OpenReceiveError2 } from "@openreceive/core";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openreceive/node",
-  "version": "0.4.18",
+  "version": "0.4.19",
   "description": "Accept Bitcoin Lightning payments in Node.js with your own wallet and optional USDT, USDC, SOL and ETH swaps.",
   "keywords": [
     "bitcoin",
@@ -17,7 +17,7 @@
   "types": "./dist/index.d.ts",
   "dependencies": {
     "@getalby/sdk": "^8.0.3",
-    "@openreceive/core": "0.4.18"
+    "@openreceive/core": "0.4.19"
   },
   "bin": {
     "openreceive": "./bin/openreceive.mjs"

package/skills/integrate-openreceive/references/btcpay.md

@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/btcpay/full.md
 - Never tick the spend-capable override to make a save succeed.
 - Do not suggest rotating or revoking a code because it was pasted here.
 
-These directions describe OpenReceive 0.4.18.
+These directions describe OpenReceive 0.4.19.
 
 Connect a BTCPay Server store to a receive-only NWC wallet with the OpenReceive
 plugin, and optionally let payers pay BTCPay invoices with USDT, USDC, ETH or
@@ -125,6 +125,9 @@ needing attention. On a regtest machine, `packages/dotnet/docker/up.sh` then
 `e2e.sh` in the OpenReceive repository proves the whole path end to end, and
 that is the only situation where cloning the repository is the right move.
 
+Setup ends when the health check is clean. Say "Setup is finished" in one
+message. Do not offer more work or end the message on a question.
+
 ## More documentation
 
 Fetch one when the moment comes. Each is raw markdown, so a plain GET is

package/skills/integrate-openreceive/references/django.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (Django)
 
 ```sh
-# READ THIS FIRST: this file is 42 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 43 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/django/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/django/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.18.
+These directions describe OpenReceive 0.4.19.
 
 Add OpenReceive to a Django project — the app you are already working in. You
 do not need a copy of the OpenReceive source: the Python package is on PyPI
@@ -152,6 +152,24 @@ in-place `pip install -U` is undone by the next `compose up`.
 
 Only then start the quickstart.
 
+## After the quickstart — hand over, then stop
+
+The quickstart is done when `python manage.py openreceive_doctor` is clean and
+this app serves the checkout page for one of its orders. Doctor names any
+failed check and exits nonzero; fix it before going on.
+
+Give the user that checkout link. The browser check in the quickstart's
+"Render the checkout" section (payment-method icons, wallet logos, a pay
+tutorial) is theirs: tell them what to look at, and do not run it yourself.
+
+You cannot pay the invoice: the code is receive-only. Do not pay, settle or
+mark an order paid, and do not look for a way to (a wallet control port, a
+test endpoint, another wallet). If the user wants a real settlement test, they
+pay on that link from their own wallet, and `on_paid` marks the order paid.
+
+Setup ends here. Say "Setup is finished" in one message, with the link and
+what to check. Do not offer more work or end the message on a question.
+
 ## Non-negotiables
 
 The quickstart below has the code. These are the rules it cannot state for
@@ -164,6 +182,9 @@ itself, and they hold for every integration.
   logs, or assets.
 - Do not suggest rotating, revoking or replacing a code because it was pasted
   into this chat; that is the supported path.
+- Work only in this application. Never read or run anything from another
+  project on this machine (its `node_modules`, tools or source), for any
+  reason. A browser and Playwright are not part of setup.
 - The host owns the price. `amount_for` reads it from your own data;
   reject payer-supplied amounts.
 - `authorize` runs on every request, and the `resource` it receives is a

package/skills/integrate-openreceive/references/fastapi.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (FastAPI)
 
 ```sh
-# READ THIS FIRST: this file is 35 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 37 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/fastapi/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/fastapi/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.18.
+These directions describe OpenReceive 0.4.19.
 
 Add OpenReceive to a FastAPI application — the app you are already working in.
 You do not need a copy of the OpenReceive source: the engine is on PyPI
@@ -145,6 +145,25 @@ saying why. Upgrade first.
 
 Only then start the quickstart.
 
+## After the quickstart — hand over, then stop
+
+The quickstart is done when
+`openreceive doctor --app <module>:app --url <app url>` is clean and this app
+serves the checkout page for one of its orders. Doctor names any failed check
+and exits nonzero; fix it before going on.
+
+Give the user that checkout link. The browser check in the quickstart's step 6
+(payment-method icons, wallet logos, a pay tutorial) is theirs: tell them what
+to look at, and do not run it yourself.
+
+You cannot pay the invoice: the code is receive-only. Do not pay, settle or
+mark an order paid, and do not look for a way to (a wallet control port, a
+test endpoint, another wallet). If the user wants a real settlement test, they
+pay on that link from their own wallet, and `on_paid` marks the order paid.
+
+Setup ends here. Say "Setup is finished" in one message, with the link and
+what to check. Do not offer more work or end the message on a question.
+
 ## Non-negotiables
 
 The quickstart below has the code. These are the rules it cannot state for
@@ -157,6 +176,9 @@ itself, and they hold for every integration.
   logs, or assets.
 - Do not suggest rotating, revoking or replacing a code because it was pasted
   into this chat; that is the supported path.
+- Work only in this application. Never read or run anything from another
+  project on this machine (its `node_modules`, tools or source), for any
+  reason. A browser and Playwright are not part of setup.
 - The host owns the price. `amount_for` reads it from your own data; reject
   payer-supplied amounts.
 - `authorize` runs on every request, and the `resource` it receives is a CLAIM

package/skills/integrate-openreceive/references/fastify.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (Fastify)
 
 ```sh
-# READ THIS FIRST: this file is 34 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 36 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/fastify/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/fastify/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.18.
+These directions describe OpenReceive 0.4.19.
 
 Add OpenReceive to a Fastify application — the app you are already working in.
 You do not need a copy of the OpenReceive source: the packages are on npm, and
@@ -138,6 +138,25 @@ first.
 
 Only then start the quickstart.
 
+## After the quickstart — hand over, then stop
+
+The quickstart is done when
+`npx openreceive doctor --db <file-or-url> --url <app url>` is clean and this
+app serves the checkout page for one of its orders. Doctor names any failed
+check and exits nonzero; fix it before going on.
+
+Give the user that checkout link. The browser check in the quickstart's step 6
+(payment-method icons, wallet logos, a pay tutorial) is theirs: tell them what
+to look at, and do not run it yourself.
+
+You cannot pay the invoice: the code is receive-only. Do not pay, settle or
+mark an order paid, and do not look for a way to (a wallet control port, a
+test endpoint, another wallet). If the user wants a real settlement test, they
+pay on that link from their own wallet, and `onPaid` marks the order paid.
+
+Setup ends here. Say "Setup is finished" in one message, with the link and
+what to check. Do not offer more work or end the message on a question.
+
 ## Non-negotiables
 
 The quickstart below has the code. These are the rules it cannot state for
@@ -150,6 +169,9 @@ itself, and they hold for every integration.
   logs, or assets.
 - Do not suggest rotating, revoking or replacing a code because it was pasted
   into this chat; that is the supported path.
+- Work only in this application. Never read or run anything from another
+  project on this machine (its `node_modules`, tools or source), for any
+  reason. A browser and Playwright are not part of setup.
 - The host owns the price. `amountFor` reads it from your own data; reject
   payer-supplied amounts.
 - `authorize` runs on every request, and the `resource` it receives is a CLAIM

package/skills/integrate-openreceive/references/laravel.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (Laravel)
 
 ```sh
-# READ THIS FIRST: this file is 41 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 42 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/laravel/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/laravel/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.18.
+These directions describe OpenReceive 0.4.19.
 
 Add OpenReceive to a Laravel application — the app you are already working in.
 You do not need a copy of the OpenReceive source: the package is on Packagist
@@ -143,6 +143,24 @@ in-place `composer update` is undone by the next `compose up`.
 
 Only then start the quickstart.
 
+## After the quickstart — hand over, then stop
+
+The quickstart is done when `php artisan openreceive:doctor` is clean and this
+app serves the checkout page for one of its orders. Doctor names any failed
+check; fix it before going on.
+
+Give the user that checkout link. The browser check in the quickstart's
+"Render the checkout" section (payment-method icons, wallet logos, a pay
+tutorial) is theirs: tell them what to look at, and do not run it yourself.
+
+You cannot pay the invoice: the code is receive-only. Do not pay, settle or
+mark an order paid, and do not look for a way to (a wallet control port, a
+test endpoint, another wallet). If the user wants a real settlement test, they
+pay on that link from their own wallet, and `onPaid` marks the order paid.
+
+Setup ends here. Say "Setup is finished" in one message, with the link and
+what to check. Do not offer more work or end the message on a question.
+
 ## Non-negotiables
 
 The quickstart below has the code. These are the rules it cannot state for
@@ -155,6 +173,9 @@ itself, and they hold for every integration.
   logs, or assets.
 - Do not suggest rotating, revoking or replacing a code because it was pasted
   into this chat; that is the supported path.
+- Work only in this application. Never read or run anything from another
+  project on this machine (its `node_modules`, tools or source), for any
+  reason. A browser and Playwright are not part of setup.
 - The host owns the price. `amountFor` reads it from your own data; reject
   payer-supplied amounts.
 - `authorize` runs on every request, and the `resource` it receives is a CLAIM

package/skills/integrate-openreceive/references/next.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (Next.js)
 
 ```sh
-# READ THIS FIRST: this file is 37 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 38 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/next/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/next/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.18.
+These directions describe OpenReceive 0.4.19.
 
 Add OpenReceive to a Next.js App Router application — the app you are already
 working in. You do not need a copy of the OpenReceive source: the packages are
@@ -64,6 +64,11 @@ there and non-empty, and never print the values. A code that is already
 set is not asked for again; if both are set, skip to step 5
 (making the server load the file), then the quickstart.
 
+On a hosted builder (v0, Vercel, Replit, Lovable), the user may say instead
+that both codes are already set as the project's environment variables or
+secrets. Believe them: do not ask for the codes, do not write `.env.local`, and
+do not read or print the variables. Next reads them from the environment.
+
 Otherwise your next action is a question to the user. Do not install packages,
 edit the app, write `.env.example`, or search anywhere else before asking
 it. Do not read deploy config (compose files, Vercel or platform secrets), Docker containers, or process environments, and never run
@@ -138,6 +143,25 @@ first.
 
 Only then start the quickstart.
 
+## After the quickstart — hand over, then stop
+
+The quickstart is done when
+`npx openreceive doctor --db <file-or-url> --url <app url>` is clean and this
+app serves the checkout page for one of its orders. Doctor names any failed
+check and exits nonzero; fix it before going on.
+
+Give the user that checkout link. The browser check in the quickstart's step 6
+(payment-method icons, wallet logos, a pay tutorial) is theirs: tell them what
+to look at, and do not run it yourself.
+
+You cannot pay the invoice: the code is receive-only. Do not pay, settle or
+mark an order paid, and do not look for a way to (a wallet control port, a
+test endpoint, another wallet). If the user wants a real settlement test, they
+pay on that link from their own wallet, and `onPaid` marks the order paid.
+
+Setup ends here. Say "Setup is finished" in one message, with the link and
+what to check. Do not offer more work or end the message on a question.
+
 ## Non-negotiables
 
 The quickstart below has the code. These are the rules it cannot state for
@@ -150,6 +174,9 @@ itself, and they hold for every integration.
   logs, or assets.
 - Do not suggest rotating, revoking or replacing a code because it was pasted
   into this chat; that is the supported path.
+- Work only in this application. Never read or run anything from another
+  project on this machine (its `node_modules`, tools or source), for any
+  reason. A browser and Playwright are not part of setup.
 - The host owns the price. `amountFor` reads it from your own data; reject
   payer-supplied amounts.
 - `authorize` runs on every request, and the `resource` it receives is a CLAIM

package/skills/integrate-openreceive/references/node.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (Node.js)
 
 ```sh
-# READ THIS FIRST: this file is 33 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 34 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/node/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/node/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.18.
+These directions describe OpenReceive 0.4.19.
 
 Add OpenReceive to a Node application — the app you are already working in. You
 do not need a copy of the OpenReceive source: the packages are on npm, and the
@@ -61,6 +61,11 @@ there and non-empty, and never print the values. A code that is already
 set is not asked for again; if both are set, skip to step 5
 (making the server load the file), then the quickstart.
 
+On a hosted builder (v0, Vercel, Replit, Lovable), the user may say instead
+that both codes are already set as the project's environment variables or
+secrets. Believe them: do not ask for the codes, do not write `.env`, and
+do not read or print the variables. Skip step 5's file loading: the platform already puts them in `process.env`.
+
 Otherwise your next action is a question to the user. Do not install packages,
 edit the app, write `.env.example`, or search anywhere else before asking
 it. Do not read deploy config (compose files, platform secrets), Docker containers, or process environments, and never run
@@ -135,6 +140,24 @@ first.
 
 Only then start the quickstart.
 
+## After the quickstart — hand over, then stop
+
+The quickstart is done when `npx openreceive doctor --db <file-or-url> --url <app url>`
+is clean and this app serves the checkout page for one of its orders. Doctor
+names any failed check and exits nonzero; fix it before going on.
+
+Give the user that checkout link. The browser check in the quickstart's
+step 6 (payment-method icons, wallet logos, a pay tutorial) is theirs: tell
+them what to look at, and do not run it yourself.
+
+You cannot pay the invoice: the code is receive-only. Do not pay, settle or
+mark an order paid, and do not look for a way to (a wallet control port, a
+test endpoint, another wallet). If the user wants a real settlement test, they
+pay on that link from their own wallet, and `onPaid` marks the order paid.
+
+Setup ends here. Say "Setup is finished" in one message, with the link and
+what to check. Do not offer more work or end the message on a question.
+
 ## Non-negotiables
 
 The quickstart below has the code. These are the rules it cannot state for
@@ -147,6 +170,9 @@ itself, and they hold for every integration.
   logs, or assets.
 - Do not suggest rotating, revoking or replacing a code because it was pasted
   into this chat; that is the supported path.
+- Work only in this application. Never read or run anything from another
+  project on this machine (its `node_modules`, tools or source), for any
+  reason. A browser and Playwright are not part of setup.
 - The host owns the price. `amountFor` reads it from your own data; reject
   payer-supplied amounts.
 - `authorize` runs on every request, and the `resource` it receives is a CLAIM

package/skills/integrate-openreceive/references/php.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (PHP)
 
 ```sh
-# READ THIS FIRST: this file is 37 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 38 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/php/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/php/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.18.
+These directions describe OpenReceive 0.4.19.
 
 Add OpenReceive to a PHP application — the app you are already working in. You
 do not need a copy of the OpenReceive source: the engine is on Packagist
@@ -148,6 +148,24 @@ the image, so an in-place `composer update` is undone by the next
 
 Only then start the quickstart.
 
+## After the quickstart — hand over, then stop
+
+The quickstart is done when the quickstart's `bin/doctor` script is clean and
+this app serves the checkout page for one of its orders. Doctor names any
+failed check; fix it before going on.
+
+Give the user that checkout link. The browser check in the quickstart's step 6
+(payment-method icons, wallet logos, a pay tutorial) is theirs: tell them what
+to look at, and do not run it yourself.
+
+You cannot pay the invoice: the code is receive-only. Do not pay, settle or
+mark an order paid, and do not look for a way to (a wallet control port, a
+test endpoint, another wallet). If the user wants a real settlement test, they
+pay on that link from their own wallet, and `onPaid` marks the order paid.
+
+Setup ends here. Say "Setup is finished" in one message, with the link and
+what to check. Do not offer more work or end the message on a question.
+
 ## Non-negotiables
 
 The quickstart below has the code. These are the rules it cannot state for
@@ -160,6 +178,9 @@ itself, and they hold for every integration.
   logs, or assets — and never in a `config.php` that ships in the repository.
 - Do not suggest rotating, revoking or replacing a code because it was pasted
   into this chat; that is the supported path.
+- Work only in this application. Never read or run anything from another
+  project on this machine (its `node_modules`, tools or source), for any
+  reason. A browser and Playwright are not part of setup.
 - The host owns the price. `amountFor` reads it from your own data; reject
   payer-supplied amounts.
 - `authorize` runs on every request, and the `resource` it receives is a CLAIM

package/skills/integrate-openreceive/references/rails.md

@@ -3,7 +3,7 @@ This is the full file; follow it from Step 0.
 # OpenReceive agent directions (Rails)
 
 ```sh
-# READ THIS FIRST: this file is 38 KB and a summary drops required steps. Download it whole:
+# READ THIS FIRST: this file is 40 KB and a summary drops required steps. Download it whole:
 curl -fsSL https://openreceive.org/agent-directions/rails/full.md
 # Skip the download only if you already have all of it: pasted, read from disk or fetched raw.
 ```
@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/rails/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Start the quickstart only once the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.18.
+These directions describe OpenReceive 0.4.19.
 
 Add OpenReceive to a Rails application — the app you are already working in. You
 do not need a copy of the OpenReceive source: the gem is on RubyGems, the
@@ -139,6 +139,24 @@ is undone by the next `compose up`.
 
 Only then start the quickstart.
 
+## After the quickstart — hand over, then stop
+
+The quickstart is done when `bin/rails openreceive:doctor` is clean and this
+app serves the checkout page for one of its orders. Doctor names any failed
+check; fix it before going on.
+
+Give the user that checkout link. The browser check in the quickstart's
+"Render the checkout" section (payment-method icons, wallet logos, a pay
+tutorial) is theirs: tell them what to look at, and do not run it yourself.
+
+You cannot pay the invoice: the code is receive-only. Do not pay, settle or
+mark an order paid, and do not look for a way to (a wallet control port, a
+test endpoint, another wallet). If the user wants a real settlement test, they
+pay on that link from their own wallet, and `on_paid` marks the order paid.
+
+Setup ends here. Say "Setup is finished" in one message, with the link and
+what to check. Do not offer more work or end the message on a question.
+
 ## Non-negotiables
 
 The quickstart below has the code. These are the rules it cannot state for
@@ -151,6 +169,9 @@ itself, and they hold for every integration.
   logs, or assets.
 - Do not suggest rotating, revoking or replacing a code because it was pasted
   into this chat; that is the supported path.
+- Work only in this application. Never read or run anything from another
+  project on this machine (its `node_modules`, tools or source), for any
+  reason. A browser and Playwright are not part of setup.
 - The host owns the price. `config.amount_for` reads it from your own data;
   reject payer-supplied amounts.
 - `config.authorize` runs on every request, and the `resource` it receives is a

package/skills/integrate-openreceive/references/woocommerce.md

@@ -17,7 +17,7 @@ curl -fsSL https://openreceive.org/agent-directions/woocommerce/full.md
 - Do not suggest rotating or revoking a code because it was pasted here.
 - Setup is done only when the NWC code is saved, and the LSC code is saved or the user said "Bitcoin only".
 
-These directions describe OpenReceive 0.4.18.
+These directions describe OpenReceive 0.4.19.
 
 Install and configure the OpenReceive payment gateway in the WooCommerce store
 you are working in. Preserve its theme, checkout, customer accounts, order
@@ -96,7 +96,7 @@ Install the plugin built for this release. Never install the GitHub
 source-code ZIP or a ZIP from an older release:
 
 ```sh
-wp plugin install https://github.com/OpenReceive/openreceive/releases/download/v0.4.18/openreceive-wordpress-0.4.18.zip --activate
+wp plugin install https://github.com/OpenReceive/openreceive/releases/download/v0.4.19/openreceive-wordpress-0.4.19.zip --activate
 ```
 
 It needs WooCommerce active, and PHP 8.2+ with GMP and sodium in BOTH the web
@@ -236,7 +236,7 @@ database or application.
 
 ### Get the installable archive
 
-Download [openreceive-wordpress-0.4.18.zip](https://github.com/OpenReceive/openreceive/releases/download/v0.4.18/openreceive-wordpress-0.4.18.zip)
+Download [openreceive-wordpress-0.4.19.zip](https://github.com/OpenReceive/openreceive/releases/download/v0.4.19/openreceive-wordpress-0.4.19.zip)
 from the matching release. Historical releases may lack this asset. If that exact
 URL returns 404, build the same tag below; never silently install an older ZIP.
 The GitHub source-code ZIP is not an installable plugin. On a development machine
@@ -245,7 +245,7 @@ with Node 22+, PHP 8.2+ with GMP/sodium, Composer and WP-CLI:
 ```sh
 git clone https://github.com/OpenReceive/openreceive.git
 cd openreceive
-git checkout v0.4.18
+git checkout v0.4.19
 npm ci
 npm run build:packages
 composer install --working-dir=packages/php/wordpress
@@ -288,7 +288,9 @@ package matching the active PHP version (for example `php8.2-gmp` for PHP 8.2),
 then restart that version's web PHP service. Verify `php --ri gmp` and
 `wp openreceive doctor` for CLI, and the gateway Doctor panel for web PHP.
 On managed WordPress hosting, ask the host to enable GMP and sodium in both
-runtimes; if they cannot, this plugin cannot run there. Do not use Composer's
+runtimes; if they cannot, this plugin cannot run there.
+[WordPress hosting requirements](https://openreceive.org/guides/wordpress-hosting.md) lists what common hosts
+offer and how to check your site. Do not use Composer's
 `--ignore-platform-reqs` to bypass the requirements.
 
 #### Compose files with only `image:` lines