one-ie/one/sell

Sell

Two rails ship in this repo and they are not interchangeable. Pick by what the buyer needs, not by which is easier to call.

The crypto rail is the sovereign one

POST /api/pay/link calls pay.one.ie's payment_link_create and returns { url, qr }. Three facts about it decide when to reach for it:

The treasuries are the site's own addresses. readSelfHostedWallet() reads what one wallet keygen wrote into .dev.vars, and those addresses go to pay.one.ie as the link's treasuries. Funds land directly in the wallet /wallet displays. Nothing custodies them on the way.

It never touches the substrate. No ONE_API_KEY, no workspace, no account. Only the payer signs, and only at claim time, so creating the link needs no signature at all. A clone with an empty .env can take a crypto payment.

Four chains, and the payer picks. CHAIN_TO_PAY maps sui → SUI, evm → ETH, sol → SOL, btc → BTC. Whichever of those the wallet has an address for becomes an option on the link.

If no wallet is configured the route answers 409 with the fix in the message — one wallet keygen, then the addresses into .dev.vars. Say that to the operator verbatim rather than inventing a cause.

Connected mode adds a receipt, not a custodian

When ONE_API_KEY is present the route opts the link into /api/pay/crypto-webhook, so a claimed payment lands as a settlement and a signal in the workspace. No credits are granted and custody does not change. Both extra fields are undefined without a key, and JSON.stringify drops them, so the body sent to pay.one.ie is byte-identical in the two modes. A connected site and a standalone site create the same link; only one of them gets told when it is paid.

The price rule — never quote a number the client sent

The route resolves prices server-side, from their own field, and you must match that discipline when you build a call:

• a plan → planId → resolvePlan()
• a catalog product (site/src/content/products/*.md) → productId → resolveProduct()
• ad-hoc → amountCents, with product as free text

product is a description and resolves no price, ever. It is kept separate from productId precisely so a buyer's free text can never match a catalog slug and hijack what they are charged. When you have a catalog item, send productId and let the server price it — sending amountCents for something that has a catalog price is how a discount becomes a vulnerability.

amount is integer cents despite unit: 'usd'. An amount that is not finite or not greater than zero is a 400.

Refusals

• Never state a price you did not read from the catalog or a plan. Ask, or

send productId and report what came back.

• Never present the crypto link as reversible. A claimed on-chain payment is

settled; there is no chargeback to promise.

• Never tell an operator their payment failed when the answer was 409 — that

is an unconfigured wallet, not a rejected buyer.

• A 502 from this route is pay.one.ie answering, not the buyer's wallet.

Report the message it carries rather than guessing.