docs: new root as prior history lost (orphan + GC); ~215 commits not recoverable

configs/merchant-landing/README.md

@@ -0,0 +1,42 @@
+# Merchant landing (`taler.hacktivism.ch` intro)
+
+Static intro for the **GOA merchant** backend (dual currency GOA + CHF).
+
+| Item | Value |
+|------|--------|
+| Container | `taler-hacktivism` |
+| In-container path | `/var/www/merchant-landing/` |
+| nginx | listen **9015** (`nginx-landing.conf`) |
+| **Host port to publish / wire** | **`9015`** → `127.0.0.1:9015` |
+| Public path | `https://taler.hacktivism.ch/intro/` |
+
+## Features (page)
+
+| Piece | Notes |
+|-------|--------|
+| Wallet fold | Collapsed “Get the wallet · Android / iOS / web browsers” |
+| Web icons | Chrome · Firefox · Opera · Ubuntu Touch (gold+blue; [taler.net wallet](https://www.taler.net/de/wallet.html)) |
+| GOA shop samples | `data-product` buttons → public template pay (`goa-shop` instance) |
+| Link previews | Open Graph / Twitter meta → `og-goa-shop.png` (1200×630) for chats & social |
+| Shop pay popup | `shop-pay.js` / `shop-pay.css` — **QR_Taler** (blue ring + `qr-logo.svg`), settlement payto expandable |
+| Get GOA first | Hint + link to bank (plain “pay here”) |
+| Stats | Dual-currency aggregates; **recent activity** split GOA/CHF (≤5 each); refund badge violet |
+| Performance | Live HTTP probes + container RSS |
+
+Shop product ids/amounts must stay in sync with
+`scripts/taler-monitoring/check_e2e.sh` → `E2E_SHOP_PRODUCTS`
+(e2e random-picks **2** products per run by default).
+
+## Deploy
+
+```bash
+podman cp configs/merchant-landing/index.html \
+  taler-hacktivism:/var/www/merchant-landing/index.html
+podman cp configs/merchant-landing/og-goa-shop.png \
+  taler-hacktivism:/var/www/merchant-landing/og-goa-shop.png
+podman cp configs/merchant-landing/shop-pay.js \
+  taler-hacktivism:/var/www/merchant-landing/shop-pay.js
+# shop-pay.css, qr-logo.svg, qrcode.min.js as needed
+```
+
+Also see `scripts/taler-landing/deploy-landings.sh` if present.

configs/merchant-landing/nginx-landing.conf

@@ -0,0 +1,24 @@
+# Merchant landing — :9015 (behind Caddy — no port in Location)
+server {
+    listen 9015;
+    listen [::]:9015;
+    server_name taler.hacktivism.ch _;
+    root /var/www/merchant-landing;
+    index index.html;
+
+    absolute_redirect off;
+    port_in_redirect off;
+
+    location = / {
+        return 302 /intro/;
+    }
+    location = /intro {
+        return 302 /intro/;
+    }
+    location /intro/ {
+        alias /var/www/merchant-landing/;
+    }
+    location / {
+        try_files $uri $uri/ =404;
+    }
+}

configs/merchant-landing/shop-pay.css

@@ -0,0 +1,348 @@
+/* GOA shop pay popup — QR_Taler style from taler-merchant-webui / @gnu-taler/web-util */
+
+/* Animated blue ring (same as webui QR.tsx) */
+@property --angle {
+  syntax: "<angle>";
+  initial-value: 0deg;
+  inherits: false;
+}
+@keyframes goa-pay-qr-rotate {
+  to {
+    --angle: 360deg;
+  }
+}
+
+.shop-item[data-product] {
+  cursor: pointer;
+  transition: border-color 0.15s, transform 0.12s, background 0.15s;
+}
+.shop-item[data-product]:hover,
+.shop-item[data-product]:focus-visible {
+  border-color: rgba(196, 181, 253, 0.75);
+  background: rgba(0, 0, 0, 0.4);
+  transform: translateY(-1px);
+  outline: none;
+}
+button.shop-item {
+  font: inherit;
+  color: inherit;
+  width: 100%;
+  appearance: none;
+  -webkit-appearance: none;
+}
+
+.goa-pay-modal {
+  position: fixed;
+  inset: 0;
+  z-index: 80;
+  display: none;
+  align-items: center;
+  justify-content: center;
+  padding: 1rem;
+  background: rgba(8, 6, 14, 0.75);
+  backdrop-filter: blur(8px);
+  -webkit-backdrop-filter: blur(8px);
+}
+.goa-pay-modal.open {
+  display: flex;
+}
+.goa-pay-card {
+  position: relative;
+  background: rgba(36, 28, 48, 0.98);
+  border: 1px solid rgba(167, 139, 250, 0.45);
+  border-radius: 16px;
+  padding: 1.25rem 1.2rem 1.2rem;
+  max-width: 24rem;
+  width: 100%;
+  text-align: center;
+  box-shadow: 0 20px 50px rgba(0, 0, 0, 0.5);
+  max-height: 92vh;
+  overflow-y: auto;
+}
+.goa-pay-x {
+  position: absolute;
+  top: 0.45rem;
+  right: 0.55rem;
+  border: 0;
+  background: transparent;
+  color: #c4b5fd;
+  font-size: 1.4rem;
+  line-height: 1;
+  cursor: pointer;
+  padding: 0.2rem 0.45rem;
+}
+.goa-pay-card h3 {
+  margin: 0 0 0.2rem;
+  font-size: 1.08rem;
+  color: #faf5ff;
+  padding-right: 1.5rem;
+}
+.goa-pay-amount {
+  margin: 0 0 0.85rem;
+  font-weight: 750;
+  color: #c4b5fd;
+  font-variant-numeric: tabular-nums;
+}
+
+/* === QR_Taler frame (webui QR.tsx) === */
+.goa-pay-taler-qr {
+  width: 100%;
+  max-width: 280px;
+  margin: 0 auto 0.75rem;
+  padding: 10px;
+  border-radius: 20px;
+  box-sizing: border-box;
+  position: relative;
+  background: conic-gradient(
+    from var(--angle),
+    #0042b3 0deg,
+    #f1f1f4 20deg,
+    #f1f1f4 150deg,
+    #f1f1f4 160deg,
+    #0042b3 180deg,
+    #f1f1f4 200deg,
+    #f1f1f4 330deg,
+    #f1f1f4 340deg,
+    #0042b3
+  );
+  animation: goa-pay-qr-rotate 10s linear infinite;
+}
+.goa-pay-taler-qr__inner {
+  padding: 10px;
+  border-radius: 20px;
+  background: #fff;
+  line-height: 0;
+  min-height: 180px;
+  box-sizing: border-box;
+}
+/* Always an <img data-url> with explicit pixel size from JS */
+.goa-pay-taler-qr__inner img {
+  display: block !important;
+  margin: 0 auto !important;
+  border: 0 !important;
+  background: #fff;
+  image-rendering: pixelated;
+}
+/* Center logo plate — official qr-logo.png (webui ~100×50; PNG for Android) */
+.goa-pay-taler-qr__logo {
+  position: absolute;
+  top: 50%;
+  left: 50%;
+  transform: translate(-50%, -50%);
+  width: 28%;
+  height: auto;
+  max-width: 100px;
+  aspect-ratio: 200 / 95;
+  object-fit: contain;
+  pointer-events: none;
+  background: #fff;
+  border-radius: 4px;
+}
+/* Full encoded payload under QR — clickable (wallet / webextension) */
+.goa-pay-payload {
+  display: block;
+  margin: 0.45rem 0 0.55rem;
+  padding: 0 0.25rem;
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  font-size: 0.68rem;
+  line-height: 1.35;
+  color: #7eb6ff;
+  word-break: break-all;
+  text-align: center;
+  text-decoration: none;
+  border-bottom: 1px solid rgba(126, 182, 255, 0.4);
+  cursor: pointer;
+}
+.goa-pay-payload:hover {
+  color: #b8d6ff;
+  border-bottom-color: #7eb6ff;
+}
+
+/* Settlement: collapsed by default, expand on click */
+.goa-pay-settle {
+  margin-top: 0.85rem;
+  border: 1px solid rgba(148, 163, 184, 0.35);
+  border-radius: 12px;
+  overflow: hidden;
+  background: rgba(0, 0, 0, 0.22);
+}
+.goa-pay-settle-toggle {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.5rem;
+  width: 100%;
+  margin: 0;
+  padding: 0.65rem 0.75rem;
+  border: 0;
+  background: transparent;
+  color: #cbd5e1;
+  font: inherit;
+  font-size: 0.78rem;
+  font-weight: 650;
+  text-align: left;
+  cursor: pointer;
+  line-height: 1.3;
+}
+.goa-pay-settle-toggle:hover {
+  background: rgba(148, 163, 184, 0.1);
+  color: #e2e8f0;
+}
+.goa-pay-settle-toggle-text {
+  flex: 1;
+}
+.goa-pay-settle-chevron {
+  flex-shrink: 0;
+  transition: transform 0.15s ease;
+  color: #94a3b8;
+  font-size: 0.85rem;
+}
+.goa-pay-modal.settle-open .goa-pay-settle-chevron {
+  transform: rotate(90deg);
+}
+.goa-pay-settle-body {
+  padding: 0 0.75rem 0.75rem;
+  border-top: 1px solid rgba(148, 163, 184, 0.25);
+}
+.goa-pay-settle-note {
+  margin-top: 0.55rem;
+}
+/* Settlement payto QR — plain box (not wallet pay / no logo / no blue ring) */
+.goa-pay-payto-qr {
+  width: fit-content;
+  max-width: 160px;
+  margin: 0.35rem auto 0.55rem;
+  padding: 0.45rem 0.5rem 0.5rem;
+  border-radius: 10px;
+  background: #fff;
+  border: 1px dashed rgba(100, 116, 139, 0.75);
+  box-sizing: border-box;
+}
+.goa-pay-payto-qr__caption {
+  font-size: 0.62rem;
+  font-weight: 750;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+  color: #64748b;
+  text-align: center;
+  margin: 0 0 0.35rem;
+  line-height: 1.2;
+}
+.goa-pay-payto-qr__inner {
+  line-height: 0;
+  min-height: 0;
+}
+.goa-pay-payto-qr__inner img {
+  display: block !important;
+  margin: 0 auto !important;
+  background: #fff;
+  image-rendering: pixelated;
+}
+.goa-pay-sub {
+  margin: 0 0 0.55rem;
+  font-size: 0.75rem;
+  line-height: 1.35;
+  color: #b8a8c9;
+  font-weight: 500;
+  text-align: center;
+}
+
+.goa-pay-hint {
+  margin: 0 0 0.75rem;
+  font-size: 0.82rem;
+  color: #b8a8c9;
+}
+.goa-pay-hint.err {
+  color: #fca5a5;
+}
+.goa-pay-cta {
+  display: block;
+  text-decoration: none;
+  font-weight: 750;
+  padding: 0.65rem 1rem;
+  border-radius: 11px;
+  background: linear-gradient(135deg, #a78bfa, #6366f1);
+  color: #0f0a1a;
+  margin-bottom: 0.75rem;
+}
+.goa-pay-cta:hover {
+  filter: brightness(1.06);
+}
+.goa-pay-cta.disabled {
+  opacity: 0.45;
+  pointer-events: none;
+}
+.goa-pay-label {
+  margin: 0.55rem 0 0.2rem;
+  font-size: 0.68rem;
+  font-weight: 700;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+  color: #b8a8c9;
+}
+.goa-pay-line {
+  margin: 0 0 0.35rem;
+  text-align: center;
+  font-size: 0.88rem;
+  font-weight: 650;
+}
+.goa-pay-link {
+  color: #93c5fd;
+  text-decoration: none;
+  white-space: nowrap;
+}
+.goa-pay-link:hover {
+  text-decoration: underline;
+}
+.goa-pay-link.disabled {
+  opacity: 0.45;
+  pointer-events: none;
+}
+.goa-pay-sep {
+  margin: 0 0.4rem;
+  color: #b8a8c9;
+  font-weight: 500;
+}
+.goa-pay-close {
+  display: block;
+  width: 100%;
+  margin-top: 0.85rem;
+  border: 1px solid rgba(167, 139, 250, 0.45);
+  background: transparent;
+  color: #c4b5fd;
+  font-weight: 650;
+  padding: 0.5rem;
+  border-radius: 10px;
+  cursor: pointer;
+}
+
+/* Bank (gold/teal) overrides */
+.goa-pay-modal.bank-theme .goa-pay-card {
+  background: rgba(42, 32, 24, 0.98);
+  border-color: rgba(232, 168, 56, 0.4);
+}
+.goa-pay-modal.bank-theme .goa-pay-amount {
+  color: #5eead4;
+}
+.goa-pay-modal.bank-theme .goa-pay-cta {
+  background: linear-gradient(135deg, #5eead4, #0d9488);
+  color: #042f2e;
+}
+.goa-pay-modal.bank-theme .goa-pay-link {
+  color: #5eead4;
+}
+.goa-pay-modal.bank-theme .goa-pay-x,
+.goa-pay-modal.bank-theme .goa-pay-close {
+  color: #e8c878;
+  border-color: rgba(232, 168, 56, 0.35);
+}
+.goa-pay-modal.bank-theme .goa-pay-settle {
+  border-color: rgba(232, 168, 56, 0.3);
+  background: rgba(0, 0, 0, 0.28);
+}
+.goa-pay-modal.bank-theme .goa-pay-settle-toggle {
+  color: #e8c878;
+}
+.goa-pay-modal.bank-theme .goa-pay-settle-body {
+  border-top-color: rgba(232, 168, 56, 0.25);
+}

configs/merchant-landing/shop-pay.js

@@ -0,0 +1,410 @@
+/**
+ * GOA shop pay popup — public only (no merchant secrets).
+ * Flow: POST templates/{id} → taler://pay/… + payto links.
+ *
+ * QR display matches taler-merchant-webui QR_Taler
+ * (@gnu-taler/web-util QR.tsx): animated #0042B3 conic ring + qr-logo.png.
+ * Uses qrcode-generator (same lib as webui) via global QRCode if present,
+ * else falls back to canvas from qrcode.min.js (davidshimjs).
+ */
+(function () {
+  var MERCHANT_HOST = "taler.hacktivism.ch";
+  /* goa-shop: dedicated instance with fixed-order product templates */
+  var INSTANCE = "goa-shop";
+  var SHOP_PAYTO =
+    "payto://x-taler-bank/bank.hacktivism.ch/goa-shop?receiver-name=GOA%20Shop";
+  var SHOP_PAYTO_HTTPS = "https://bank.hacktivism.ch/webui/";
+
+  function introBase() {
+    var b = document.querySelector("base");
+    return b && b.href ? b.href : "/intro/";
+  }
+
+  function logoSrc() {
+    /* PNG: Android often drops SVG wordmark fill inheritance (missing "taler") */
+    return introBase() + "qr-logo.png";
+  }
+
+  function templateHttps(productId) {
+    return (
+      "https://" +
+      MERCHANT_HOST +
+      "/instances/" +
+      INSTANCE +
+      "/templates/" +
+      encodeURIComponent(productId)
+    );
+  }
+
+  function payTemplateUri(productId) {
+    return (
+      "taler://pay-template/" +
+      MERCHANT_HOST +
+      "/instances/" +
+      INSTANCE +
+      "/" +
+      encodeURIComponent(productId)
+    );
+  }
+
+  function ensureModal() {
+    var m = document.getElementById("goa-pay-modal");
+    if (m) return m;
+    m = document.createElement("div");
+    m.id = "goa-pay-modal";
+    m.className = "goa-pay-modal";
+    m.setAttribute("role", "dialog");
+    m.setAttribute("aria-modal", "true");
+    m.setAttribute("aria-labelledby", "goa-pay-title");
+    m.hidden = true;
+    m.innerHTML =
+      '<div class="goa-pay-card">' +
+      '  <button type="button" class="goa-pay-x" id="goa-pay-x" aria-label="Close">×</button>' +
+      '  <h3 id="goa-pay-title">Pay with Taler</h3>' +
+      '  <p class="goa-pay-amount" id="goa-pay-amount"></p>' +
+      '  <p class="goa-pay-hint" id="goa-pay-status">Preparing payment…</p>' +
+      '  <p class="goa-pay-label">Wallet payment</p>' +
+      '  <p class="goa-pay-sub">Scan with the GNU Taler Wallet to pay this product</p>' +
+      '  <div class="goa-pay-taler-qr" id="goa-pay-qr-pay-wrap">' +
+      '    <div class="goa-pay-taler-qr__inner" id="goa-pay-qr-pay"></div>' +
+      '    <img class="goa-pay-taler-qr__logo" id="goa-pay-qr-pay-logo" alt="" />' +
+      "  </div>" +
+      '  <a class="goa-pay-payload" id="goa-pay-qr-payload" href="#">…</a>' +
+      '  <a class="goa-pay-cta" id="goa-pay-open" href="#">Open payment link →</a>' +
+      '  <p class="goa-pay-line">' +
+      '    <a class="goa-pay-link" id="goa-pay-uri" href="#">taler:// URI</a>' +
+      '    <span class="goa-pay-sep">·</span>' +
+      '    <a class="goa-pay-link" id="goa-pay-uri-https" href="#" target="_blank" rel="noopener">HTTPS</a>' +
+      "  </p>" +
+      '  <div class="goa-pay-settle" id="goa-pay-settle">' +
+      '    <button type="button" class="goa-pay-settle-toggle" id="goa-pay-settle-toggle" aria-expanded="false" aria-controls="goa-pay-settle-body">' +
+      '      <span class="goa-pay-settle-toggle-text">Settlement account (payto) · not a wallet pay QR</span>' +
+      '      <span class="goa-pay-settle-chevron" aria-hidden="true">▸</span>' +
+      "    </button>" +
+      '    <div class="goa-pay-settle-body" id="goa-pay-settle-body" hidden>' +
+      '      <p class="goa-pay-sub goa-pay-settle-note">' +
+      "        This is the merchant’s bank account address (payto://). " +
+      "        The exchange wires funds here after a wallet payment. " +
+      "        Do not scan this to buy the product — use the wallet QR above." +
+      "      </p>" +
+      '      <div class="goa-pay-payto-qr" id="goa-pay-qr-payto-wrap">' +
+      '        <div class="goa-pay-payto-qr__caption">Settlement only</div>' +
+      '        <div class="goa-pay-payto-qr__inner" id="goa-pay-qr-payto"></div>' +
+      "      </div>" +
+      '      <a class="goa-pay-payload" id="goa-pay-payto-payload" href="#">…</a>' +
+      '      <p class="goa-pay-line">' +
+      '        <a class="goa-pay-link" id="goa-pay-payto" href="#">payto:// URI</a>' +
+      '        <span class="goa-pay-sep">·</span>' +
+      '        <a class="goa-pay-link" id="goa-pay-payto-https" href="#" target="_blank" rel="noopener">HTTPS</a>' +
+      "      </p>" +
+      "    </div>" +
+      "  </div>" +
+      '  <button type="button" class="goa-pay-close" id="goa-pay-close">Close</button>' +
+      "</div>";
+    document.body.appendChild(m);
+    function close() {
+      m.classList.remove("open");
+      m.hidden = true;
+      // collapse settlement on close
+      var body = document.getElementById("goa-pay-settle-body");
+      var btn = document.getElementById("goa-pay-settle-toggle");
+      if (body) body.hidden = true;
+      if (btn) {
+        btn.setAttribute("aria-expanded", "false");
+        m.classList.remove("settle-open");
+      }
+    }
+    m.addEventListener("click", function (e) {
+      if (e.target === m) close();
+    });
+    document.getElementById("goa-pay-x").onclick = close;
+    document.getElementById("goa-pay-close").onclick = close;
+    document.getElementById("goa-pay-settle-toggle").onclick = function () {
+      var body = document.getElementById("goa-pay-settle-body");
+      var btn = document.getElementById("goa-pay-settle-toggle");
+      var open = body.hidden;
+      body.hidden = !open;
+      btn.setAttribute("aria-expanded", open ? "true" : "false");
+      m.classList.toggle("settle-open", open);
+      if (open) {
+        // paint payto QR when first expanded
+        renderQr(document.getElementById("goa-pay-qr-payto"), SHOP_PAYTO, 140);
+        var pp = document.getElementById("goa-pay-payto-payload");
+        if (pp) {
+          pp.href = SHOP_PAYTO;
+          pp.textContent = SHOP_PAYTO;
+        }
+      }
+    };
+    document.addEventListener("keydown", function (e) {
+      if (e.key === "Escape" && m.classList.contains("open")) close();
+    });
+    return m;
+  }
+
+  /**
+   * Render URI as a real <img> PNG (not a live canvas).
+   * davidshimjs paints canvas then often hides it for an img; if the modal is
+   * still display:none, layout collapses and you only see the blue ring.
+   * We always encode off-DOM and inject a fixed-size image.
+   */
+  function renderQr(hostEl, text, size) {
+    if (!hostEl) return;
+    hostEl.innerHTML = "";
+    size = size || 220;
+    if (!text) {
+      hostEl.innerHTML = '<p class="goa-pay-hint">…</p>';
+      return;
+    }
+    if (typeof QRCode === "undefined") {
+      hostEl.innerHTML =
+        '<p class="goa-pay-hint err">QR library missing (qrcode.min.js)</p>';
+      return;
+    }
+    var level =
+      QRCode.CorrectLevel && QRCode.CorrectLevel.M != null
+        ? QRCode.CorrectLevel.M
+        : QRCode.CorrectLevel && QRCode.CorrectLevel.L != null
+          ? QRCode.CorrectLevel.L
+          : 1;
+    var scratch = document.createElement("div");
+    scratch.setAttribute("aria-hidden", "true");
+    scratch.style.cssText =
+      "position:fixed;left:-9999px;top:0;width:" +
+      size +
+      "px;height:" +
+      size +
+      "px;overflow:hidden;opacity:0;pointer-events:none";
+    document.body.appendChild(scratch);
+    var dataUrl = "";
+    try {
+      new QRCode(scratch, {
+        text: String(text),
+        width: size,
+        height: size,
+        colorDark: "#000000",
+        colorLight: "#ffffff",
+        correctLevel: level,
+      });
+      var canvas = scratch.querySelector("canvas");
+      var libImg = scratch.querySelector("img");
+      if (canvas && canvas.width > 0) {
+        try {
+          dataUrl = canvas.toDataURL("image/png");
+        } catch (e1) {}
+      }
+      if (!dataUrl && libImg && libImg.src && libImg.src.indexOf("data:") === 0) {
+        dataUrl = libImg.src;
+      }
+    } catch (err) {
+      dataUrl = "";
+    }
+    if (scratch.parentNode) scratch.parentNode.removeChild(scratch);
+
+    if (!dataUrl) {
+      hostEl.innerHTML =
+        '<p class="goa-pay-hint err">QR encode failed</p>';
+      return;
+    }
+    var img = document.createElement("img");
+    img.alt = "QR code";
+    img.width = size;
+    img.height = size;
+    img.src = dataUrl;
+    img.style.display = "block";
+    img.style.width = size + "px";
+    img.style.height = size + "px";
+    img.style.maxWidth = "100%";
+    img.style.margin = "0 auto";
+    img.style.background = "#fff";
+    hostEl.appendChild(img);
+  }
+
+  function setLogo(imgEl) {
+    if (!imgEl) return;
+    imgEl.alt = "Taler";
+    imgEl.width = 100;
+    imgEl.height = 50;
+    imgEl.decoding = "async";
+    imgEl.src = logoSrc();
+    imgEl.onerror = function () {
+      imgEl.src = introBase() + "qr-logo.svg";
+    };
+    imgEl.style.display = "";
+  }
+
+  function normalizePayUri(uri) {
+    if (!uri) return "";
+    return String(uri)
+      .replace(/taler\.hacktivism\.ch:443/g, "taler.hacktivism.ch")
+      .replace(/:443\//g, "/")
+      .replace(/:443\?/g, "?");
+  }
+
+  /** Public: template → order → taler_pay_uri (no secrets). */
+  function createPayUri(productId) {
+    var url = templateHttps(productId);
+    return fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: "{}",
+      cache: "no-store",
+    })
+      .then(function (r) {
+        if (!r.ok) throw new Error("template POST HTTP " + r.status);
+        return r.json();
+      })
+      .then(function (created) {
+        var oid = created.order_id;
+        var tok = created.token;
+        if (!oid || !tok) throw new Error("no order_id/token");
+        var statusUrl =
+          "https://" +
+          MERCHANT_HOST +
+          "/instances/" +
+          INSTANCE +
+          "/orders/" +
+          encodeURIComponent(oid) +
+          "?token=" +
+          encodeURIComponent(tok);
+        return fetch(statusUrl, { cache: "no-store" }).then(function (r) {
+          return r.text().then(function (t) {
+            var pay = "";
+            try {
+              var d = JSON.parse(t);
+              pay = d.taler_pay_uri || "";
+            } catch (e) {}
+            if (!pay) {
+              pay =
+                "taler://pay/" +
+                MERCHANT_HOST +
+                "/instances/" +
+                INSTANCE +
+                "/" +
+                oid +
+                "/?c=" +
+                tok;
+            }
+            return {
+              taler_pay_uri: normalizePayUri(pay),
+              order_id: oid,
+              token: tok,
+              status_https: statusUrl.replace(
+                "taler.hacktivism.ch:443",
+                "taler.hacktivism.ch"
+              ),
+              template_https: url,
+            };
+          });
+        });
+      });
+  }
+
+  function showPay(productId, name, amount) {
+    var m = ensureModal();
+    if (document.body && document.body.getAttribute("data-shop-theme") === "bank") {
+      m.classList.add("bank-theme");
+    } else {
+      m.classList.remove("bank-theme");
+    }
+    document.getElementById("goa-pay-title").textContent = name || productId;
+    document.getElementById("goa-pay-amount").textContent = amount || "";
+    var status = document.getElementById("goa-pay-status");
+    status.textContent = "Preparing payment…";
+    status.className = "goa-pay-hint";
+    var open = document.getElementById("goa-pay-open");
+    open.removeAttribute("href");
+    open.classList.add("disabled");
+    open.onclick = null;
+    var payLink = document.getElementById("goa-pay-uri");
+    payLink.removeAttribute("href");
+    payLink.classList.add("disabled");
+    payLink.textContent = "taler:// URI";
+    document.getElementById("goa-pay-uri-https").href = templateHttps(productId);
+    document.getElementById("goa-pay-uri-https").textContent = "HTTPS";
+    var paytoLink = document.getElementById("goa-pay-payto");
+    paytoLink.href = SHOP_PAYTO;
+    paytoLink.textContent = "payto:// URI";
+    document.getElementById("goa-pay-payto-https").href = SHOP_PAYTO_HTTPS;
+    document.getElementById("goa-pay-payto-https").textContent = "HTTPS";
+
+    setLogo(document.getElementById("goa-pay-qr-pay-logo"));
+
+    // Reset settlement panel (collapsed until user expands)
+    var settleBody = document.getElementById("goa-pay-settle-body");
+    var settleBtn = document.getElementById("goa-pay-settle-toggle");
+    if (settleBody) settleBody.hidden = true;
+    if (settleBtn) settleBtn.setAttribute("aria-expanded", "false");
+    m.classList.remove("settle-open");
+    var paytoHost = document.getElementById("goa-pay-qr-payto");
+    if (paytoHost) paytoHost.innerHTML = "";
+
+    // Open first so layout exists, then paint wallet QR only
+    m.hidden = false;
+    m.classList.add("open");
+    var tpl = payTemplateUri(productId);
+    renderQr(
+      document.getElementById("goa-pay-qr-pay"),
+      tpl,
+      220
+    );
+    var payload = document.getElementById("goa-pay-qr-payload");
+    if (payload) {
+      payload.href = tpl;
+      payload.textContent = tpl;
+    }
+
+    createPayUri(productId)
+      .then(function (info) {
+        var pay = info.taler_pay_uri;
+        open.href = pay;
+        open.classList.remove("disabled");
+        open.textContent = "Open payment link →";
+        payLink.href = pay;
+        payLink.classList.remove("disabled");
+        payLink.textContent = "taler:// URI";
+        var uh = document.getElementById("goa-pay-uri-https");
+        uh.href = info.status_https || info.template_https;
+        uh.textContent = "HTTPS";
+        // Live unpaid taler://pay (fresh order each open)
+        renderQr(document.getElementById("goa-pay-qr-pay"), pay, 220);
+        if (payload) {
+          payload.href = pay;
+          payload.textContent = pay;
+        }
+        status.textContent = "Ready — scan in wallet";
+      })
+      .catch(function (err) {
+        status.textContent =
+          "Payment setup failed: " + (err && err.message ? err.message : err);
+        status.className = "goa-pay-hint err";
+        open.textContent = "Retry";
+        open.onclick = function (e) {
+          e.preventDefault();
+          showPay(productId, name, amount);
+        };
+      });
+  }
+
+  function bind() {
+    document.querySelectorAll("[data-product]").forEach(function (el) {
+      el.addEventListener("click", function (e) {
+        e.preventDefault();
+        var id = el.getAttribute("data-product");
+        var nameEl = el.querySelector(".name");
+        var priceEl = el.querySelector(".price");
+        showPay(
+          id,
+          nameEl ? nameEl.textContent.trim() : id,
+          priceEl ? priceEl.textContent.trim() : ""
+        );
+      });
+    });
+  }
+
+  if (document.readyState === "loading") {
+    document.addEventListener("DOMContentLoaded", bind);
+  } else {
+    bind();
+  }
+})();