OpenReceive Files

OpenReceive 0.4.24 fixes Supabase storage over HTTPS, the path every Lovable app uses: when two requests wrote one order at once, Supabase's PostgREST 14 retried the write forever and the request timed out after 15 seconds. After upgrading, apply the Supabase migration again (npx openreceive scaffold payments --supabase, or the SQL on /guides/supabase-migration); until then the payment routes answer 503 and the log names the fix. This release also adds a serverless guide, makes openreceive doctor read the env files Next.js and FastAPI apps use, and points each registry page at its openreceive.org page. Upgrade if you use Supabase over HTTPS or Lovable.

Optional swaps let payers use USDT, USDC, SOL and ETH; a configured swap provider converts them to BTC over Lightning in the merchant's connected wallet. Asset and network availability depends on the provider.

• Added (docs): a guide for serverless hosts (/guides/serverless): Netlify, AWS Lambda, Google Cloud Run and Google AI Studio, beside the Vercel guide. It covers pooled connection strings for Neon, Supabase, Cloud SQL and RDS Proxy (Aurora DSQL is not supported: it has no advisory locks), a 30-second function timeout (Lambda's default is 3), and why a serverless app needs no cron job or worker. The Node, Next.js, Fastify, FastAPI and Django directions link it.
• Tests (Python): CI runs the SQLAlchemy repository through PgBouncer in transaction mode too, with a new test of sustained concurrent checkouts. Through a transaction pooler, psycopg's default prepared statements fail under load with prepared statement "_pg3_0" already exists; the engine needs connect_args={"prepare_threshold": None}, as the Supabase and serverless guides say. Django's defaults need no change.
• Changed (packages): registry pages link the matching openreceive.org page. @openreceive/express, @openreceive/fastify, @openreceive/next, the three gems, the Python package, openreceive/openreceive and openreceive/laravel set their homepage to their /integrations/ page (Rails for the gems, Django for Python, which also links FastAPI). openreceive-rails, the Python package and both Composer packages link their quickstart as documentation. The WordPress plugin's Plugin URI is /integrations/woocommerce.
• Fixed (JS): Supabase storage over HTTPS no longer hangs when two requests write the same order at once. The migration's write functions raised SQLSTATE 40001 when the order changed since the read, and PostgREST 14, which Supabase runs, retries a 40001 transaction at once and forever: the request timed out after 15 seconds, and the retries kept a PostgREST connection busy about 250 times a second after the client gave up. Two checkout requests for one order at once were enough. The functions now raise PT409, which PostgREST answers with a 409 and never retries, and the repository reads again. This is functions version 2: apply the migration again (npx openreceive scaffold payments --supabase, or the SQL on /guides/supabase-migration). Until then the payment routes answer 503 and the log names the fix. CI now runs PostgREST v14.18, the version Supabase serves; v16.4 does not retry, which hid this. Found by npm run test:live:supabase, a new opt-in run against a real Supabase project: Supavisor with Supabase's certificate authority, the API gateway with an sb_secret_ key, and the publishable key refused.
• Fixed (docs): the Lovable directions keep the app's own order flow. They said to create orders in a server function, and one 0.4.23 agent trial replaced the shop's order form route with one, so the shop's form stopped creating orders. The directions now say to call that function where the app already creates orders, and to keep those routes, forms and redirects.
• Fixed (examples): the Next.js + Postgres starter's preview starts in v0. v0 writes the project's variables to .env.development.local, and the starter's table script read only .env.local, so npm run dev stopped with "No database URL" before Next started. The script now loads env files with Next's own loader, @next/env, so it reads the files next dev and next build read. The Vercel guide also says what to do when Vercel asks for a Pro plan for an organization repository, or the starter's project name is taken.
• Fixed (examples): the Express + Postgres starter's .replit has a Replit workflow. It had only a run command, and current Replit runs an app through a workflow: an imported copy showed no Run button, and Preview said the shop had crashed while it listened on port 5000. The workflow is the one Replit Agent wrote on a real import: npm start, waiting for port 5000.
• Fixed (JS): openreceive doctor reads the env files Next.js reads, in Next's order: .env.development.local, .env.local, .env.development, then .env (the production files when NODE_ENV=production). It read only .env.local and .env, so in a v0 project, whose codes live in .env.development.local, it reported NWC_URI: missing.
• Fixed (Python): openreceive doctor and debug-report read .env in the working directory, as uvicorn --env-file .env does, for variables the environment does not set, and before --app is imported. They read only the process environment, so an agent following the FastAPI directions got NWC_URI is not set and loaded the file into its shell. Sourcing it split each code at its & and printed the pieces in the transcript. Doctor prints the file name, never a value. --env-file <path> names another file, and reconcile and notifications read one only when it is given.
• Fixed (docs): the FastAPI directions and quickstart run doctor as dotenv -f .env run -- openreceive doctor …, which works on 0.4.23 too, and say never to source, export or cat .env. The quickstart also names the standalone checkout files for Jinja templates and where to copy them from: npm's @openreceive/elements/dist/standalone/ or the PyPI package's openreceive/django/static/openreceive/.
• Changed (examples): every demo product costs $5.00 or more, so a payer can pick USDT, USDC or SOL. The starters' sticker was $1.00 and the buttons ran $1 to $10, below the swap providers' minimums (USDT $2.63, USDC $2.39, SOL $2.60 on 2026-10-12), so those coins showed greyed out with "Minimum amount". The sticker is now $5.00 and the buttons $5, $7, $9, $12, $15 and $20. ETH's minimum is near $20, so it can still be greyed out. A new step in the Rails, Django, Node and plain-PHP buttons demos reprices a database that was seeded at the old prices.
• Fixed (examples): the Express buttons demo's Angular tab no longer goes blank when a payer picks a coin. Starting a swap remounts the checkout to resume that attempt, and the demo had given Angular its own React-owned div as the component's host element. Destroying the old component removed that div from the page, so the new one mounted into a detached node. The demo now gives Angular a child element of its own. The weekly Demos run had failed on this since 2026-09-28. The Vercel guide also says that Neon's database gets a random name.