OpenReceive Files

OpenReceive 0.4.27 lets the payment routes serve a page on another site. The new cors: { origins } option on createStack and the @openreceive/http handler admits the shop's own origins, answers their preflights and never allows credentials, so a Supabase Edge Function on <ref>.supabase.co can serve a shop's checkout with the buyer's Supabase token from the React <Checkout fetch>. The Express adapter now reads the JSON body itself when no body parser ran, so NestJS needs no app.useBodyParser("json"). A Rails host without ActiveJob boots again, and a stack whose wallet is unreachable at boot no longer ends the process after its 503. New agent directions cover SvelteKit, Nuxt, Astro, React Router, TanStack Start and mobile apps, and Odoo, Magento and PrestaShop are tested end to end through BTCPay Server. Upgrade if you run Rails without ActiveJob, mount the Express adapter without a body parser, or want routes on another origin.

Optional swaps let payers use USDT, USDC, SOL and ETH; a configured swap provider converts them to BTC over Lightning in the merchant's connected wallet. Asset and network availability depends on the provider.

• Added (Node): a cors: { origins } option on createStack and the @openreceive/http handler, for routes on another site than the shop's pages, as on a Supabase Edge Function. A listed origin passes the Sec-Fetch-Site: cross-site check and its preflights are answered; every other origin is refused as before. Credentials are never allowed across sites, so the page sends a token (the React <Checkout fetch>) and authorize checks it. The Supabase guide gains an Edge Functions section, and CI runs the engine in Supabase's edge-runtime on both storage routes. Supabase's hosted platform and Bolt are not tested.
• Changed (Express): the adapter reads the request body itself when no Express body parser ran before it, so a checkout no longer answers 500 when express.json() is missing or mounted after OpenReceive. NestJS no longer needs app.useBodyParser("json") before the mount. The body is read only when a route needs it, after the cross-site and content-type checks, and under the same 64 KB cap; a larger one answers 413. When something else already drained the body without setting req.body, the adapter still answers the 500 that names the missing body parser. The NestJS quickstart and directions drop the rule; the API reference describes the behaviour under openReceiveExpress.
• Docs: agent directions for mobile apps (React Native or Expo, Flutter, Swift, Kotlin), at /agent-directions/mobile.md and in the skill as references/mobile.md. They check what the app sells against the store rules, find the app's server and add OpenReceive there with that stack's own directions, then make the app open the checkout page and ask the server whether the order is paid. They have no Tested badge: the trial harness cannot run a phone app.
• Docs: Odoo, Magento and PrestaShop through BTCPay Server, each with a merchant guide and a Tested badge from npm run trial:btcpay-route, which runs the store's own BTCPay module against BTCPay 2.4.5 with the published OpenReceive plugin end to end. Site contract v11 adds these via-btcpay rows.
• Docs: agent directions for SvelteKit, Nuxt, Astro, React Router and TanStack Start on Node, each with its recipe inlined as the quickstart, and agent trials that pass 3 of 3 on each. Site contract v10: a recipe row may carry agent directions. The Node, Fastify, Next.js, NestJS, TanStack Start, FastAPI, Django and Flask directions gain an "If the database is Supabase" branch in their database step: the transaction pooler, Supabase's certificate authority, and closing OpenReceive's tables to the Data API.
• Fixed (Node): when the wallet was unreachable at boot, a stack built with createStack (and every adapter's all-in-one form) answered each request with the 503 WALLET_UNAVAILABLE, and then the process exited: the stack's ready promise rejected with no handler, unless the host awaited it. A Deno isolate ended the same way, before it could answer. ready still rejects for a host that awaits it.
• Fixed (Rails): a host without ActiveJob (rails new --minimal, or an app that loads only the railties it uses) could not boot in production. Eager loading reached OpenReceive::ReconcileJob, a subclass of ActiveJob::Base, and stopped with uninitialized constant OpenReceive::ActiveJob; so did bin/rails generate openreceive:install. The engine now skips its app/jobs when ActiveJob is not loaded.
• Fixed (Node): npx openreceive doctor --url passed an Express app with no JSON body parser in front of the OpenReceive middleware, and every checkout then answered 500. Doctor now also POSTs a JSON body to its probe path and fails with the adapter's own fix (app.use(express.json())).
• Fixed (Node): the OPENRECEIVE_PAYMENTS.md that openreceive scaffold payments writes marked the order paid with the ORM's own connection and said plain ORM calls were fine. Its first onPaid example now uses the query it receives, inside the settlement transaction, as the agent directions and the ORM guide say.
• Changed (Node, Python, PHP): doctor no longer says to install the agent skills when the project already has them. A merchant who had installed the Claude Code plugin was told to run npx openreceive skills install. Doctor now reports installed when it finds integrate-openreceive in .agents/skills/ or .claude/skills/, or the openreceive plugin enabled in .claude/settings.local.json, .claude/settings.json or ~/.claude/settings.json. Otherwise it calls the install optional.
• Docs: the Claude Code plugin's description lists every stack the skill covers, as Claude Code's install screen shows it. Flask, NestJS, Fastify, Next.js, the recipe stacks and Lovable were missing. The skill's own description adds Flask, Lovable and Supabase. /agents puts each install command in its own block with a copy button.
• Docs (Rails): the quickstart and directions say to add <%= csrf_meta_tags %> to the layout that renders the checkout when it is missing, since without it every checkout answers 403, and never to skip forgery protection to get past that.
• Docs (Rails): slim images also need libssl-dev. nwc-ruby's connection libraries need a newer openssl gem than Ruby ships, and Bundler compiles it against the OpenSSL headers.
• Docs (PHP): $engine->doctor() runs the wallet preflight only when it gets the same factory Doctor::report() takes; without it the preflight line reads skipped.
• Site contract v9: every framework row says what kind of integration it is (package, plugin, guide, recipe or via-btcpay) and carries a capability record: the runtime and databases it is tested on, where its secrets live, what a refund can do, and what a mobile app may assume. The SvelteKit, Nuxt, Astro, React Router and TanStack Start recipes join the table, so each gets an /integrations page. A recipe row has no agent directions and no example app, and its page links the recipe. NestJS and Flask are guide rows: each is a quickstart over another package.