payment-kit 1.29.13 → 1.29.14

package/api/src/libs/constants.ts

@@ -3,3 +3,15 @@ export const EVM_CHAIN_TYPES = ['ethereum', 'base'];
 export const CHARGE_SUPPORTED_CHAIN_TYPES = ['arcblock', 'ethereum', 'base'];
 
 export const VAULT_BUFFER_THRESHOLD = 10;
+
+// Conservative cap on the number of past-due invoice ids embedded in a single
+// arcblock batch-collect transaction's on-chain metadata (see getTxMetadata()
+// in libs/util.ts, consumed by routes/connect/collect-batch.ts). Each invoice
+// id is up to 30 chars (Invoice.GENESIS_ATTRIBUTES.id is STRING(30)), so at
+// this cap the `invoices` JSON array alone stays in the low single-digit KB.
+// We could not find a documented/exact byte-size limit for arcblock chain tx
+// data in this repo or in @ocap/client, so this is a safety margin chosen to
+// stay well clear of the "tx size exceeds chain limit" failure reported in
+// https://github.com/blocklet/payment-kit/issues/1128, not a value verified
+// against the protocol's exact threshold.
+export const MAX_BATCH_COLLECT_INVOICES = 200;

package/api/src/queues/notification.ts

@@ -386,7 +386,7 @@ setInterval(
     }
   },
   60 * 60 * 1000
-); // 每小时清理一次
+).unref(); // 每小时清理一次；unref 避免该定时器阻塞进程退出（同 libs/reference-cache.ts 的既有模式）
 
 /**
  * Clear notification cache entries that match given prefix

package/api/src/routes/connect/shared.ts

@@ -45,7 +45,7 @@ import { PriceQuote } from '../../store/models/price-quote';
 import { SetupIntent } from '../../store/models/setup-intent';
 import { Subscription } from '../../store/models/subscription';
 import { ensureInvoiceAndItems } from '../../libs/invoice';
-import { CHARGE_SUPPORTED_CHAIN_TYPES, EVM_CHAIN_TYPES } from '../../libs/constants';
+import { CHARGE_SUPPORTED_CHAIN_TYPES, EVM_CHAIN_TYPES, MAX_BATCH_COLLECT_INVOICES } from '../../libs/constants';
 import { returnStakeQueue } from '../../queues/subscription';
 
 type Result = {
@@ -1511,12 +1511,30 @@ export async function ensureSubscriptionForCollectBatch(
     throw new Error(`Payment method not found for currency ${currencyId}`);
   }
 
+  const invoices = detail[currencyId] || [];
+
+  // arcblock batch-collect embeds the full `invoices` id list into the on-chain tx
+  // metadata (see getTxMetadata() usage in routes/connect/collect-batch.ts). That
+  // JSON blob has no length limit of its own, so an unbounded invoice count can
+  // grow the tx data past the chain's tx size limit (issue #1128). Fail fast with a
+  // clear error instead of silently truncating the list — the invoices field is
+  // display-only on chain (payment reconciliation re-queries this function from the
+  // DB, it never decodes the invoice list back out of the tx), so truncating it
+  // would be safe for reconciliation, but it would also make the on-chain memo
+  // permanently misleading/incomplete. Rejecting the request keeps the ledger
+  // trustworthy and asks the customer/admin to collect in smaller batches instead.
+  if (paymentMethod.type === 'arcblock' && invoices.length > MAX_BATCH_COLLECT_INVOICES) {
+    throw new Error(
+      `Too many past due invoices to batch collect in a single on-chain transaction (${invoices.length} invoices, limit is ${MAX_BATCH_COLLECT_INVOICES}). Please pay a smaller subset of invoices, or contact support to collect the remainder separately.`
+    );
+  }
+
   return {
     subscription,
     paymentCurrency: paymentCurrency as PaymentCurrency,
     paymentMethod: paymentMethod as PaymentMethod,
     amount: summary[currencyId],
-    invoices: detail[currencyId],
+    invoices,
   };
 }
 

package/api/src/routes/hono/checkout-sessions.ts

@@ -2922,7 +2922,7 @@ app.put('/:id/submit', user, ensureCheckoutSessionOpen, async (c) => {
     }
 
     // check if customer can make new purchase
-    const canMakeNewPurchase = await customer.canMakeNewPurchase(checkoutSession.invoice_id);
+    const canMakeNewPurchase = await customer.canMakeNewPurchase(checkoutSession.invoice_id, checkoutSession.livemode);
     if (!canMakeNewPurchase) {
       return c.json(
         {
@@ -3621,7 +3621,7 @@ app.post('/:id/fast-checkout-confirm', user, ensureCheckoutSessionOpen, async (c
       }
     }
 
-    const canMakeNewPurchase = await customer.canMakeNewPurchase(checkoutSession.invoice_id);
+    const canMakeNewPurchase = await customer.canMakeNewPurchase(checkoutSession.invoice_id, checkoutSession.livemode);
     if (!canMakeNewPurchase) {
       return c.json(
         {

package/api/src/store/models/customer.ts

@@ -212,10 +212,10 @@ export class Customer extends TenantModel<InferAttributes<Customer>, InferCreati
     return { paid, due, refunded };
   }
 
-  public async canMakeNewPurchase(excludedInvoiceId: string = '') {
+  public async canMakeNewPurchase(excludedInvoiceId: string = '', livemode?: boolean) {
     const { Invoice } = this.sequelize.models;
     // @ts-ignore
-    const [summary] = await Invoice!.getUncollectibleAmount({ customerId: this.id, excludedInvoiceId });
+    const [summary] = await Invoice!.getUncollectibleAmount({ customerId: this.id, excludedInvoiceId, livemode });
     return Object.entries(summary).every(([, amount]) => new BN(amount as string).lte(new BN(0)));
   }
 

package/api/tests/integrations/app-store/fixtures/make-chain.spec.ts

@@ -6,7 +6,7 @@ import { X509Certificate } from 'node:crypto';
 import { readdirSync, readFileSync, statSync } from 'node:fs';
 import path from 'node:path';
 
-import { APPLE_INT_OID, APPLE_LEAF_OID, buildJws, makeChain } from './make-chain';
+import { APPLE_INT_OID, APPLE_LEAF_OID, buildJws, Chain, makeChain } from './make-chain';
 
 // Full DER OID tag (mirrors native-asn1.ts, see 0.3) — the strict form.
 function oidToDerTag(oid: string): Buffer {
@@ -28,7 +28,10 @@ function oidToDerTag(oid: string): Buffer {
 const certOf = (b64: string): X509Certificate => new X509Certificate(Buffer.from(b64, 'base64'));
 
 describe('make-chain — happy path', () => {
-  const chain = makeChain({ signedDate: 1_781_521_334_379 });
+  let chain: Chain;
+  beforeAll(async () => {
+    chain = await makeChain({ signedDate: 1_781_521_334_379 });
+  });
 
   it('leaf verifies against intermediate, intermediate against root', () => {
     expect(chain.certs.leaf.verify(chain.certs.intermediate.publicKey)).toBe(true);
@@ -59,7 +62,10 @@ describe('make-chain — happy path', () => {
 });
 
 describe('make-chain — security negative controls', () => {
-  const chain = makeChain();
+  let chain: Chain;
+  beforeAll(async () => {
+    chain = await makeChain();
+  });
 
   it('cross-signed leaf fails leaf.verify(intermediate.publicKey) but keeps issuer/subject equality', () => {
     const cross = certOf(chain.crossSignedLeaf);
@@ -72,14 +78,17 @@ describe('make-chain — security negative controls', () => {
     expect(Buffer.from(chain.certs.leaf.raw).includes(oidToDerTag(APPLE_INT_OID))).toBe(false);
   });
 
-  it('omits the leaf OID on demand (leafOid: false)', () => {
-    const noOid = makeChain({ leafOid: false });
+  it('omits the leaf OID on demand (leafOid: false)', async () => {
+    const noOid = await makeChain({ leafOid: false });
     expect(Buffer.from(noOid.certs.leaf.raw).includes(oidToDerTag(APPLE_LEAF_OID))).toBe(false);
   });
 });
 
 describe('make-chain — data damage / round-trip', () => {
-  const chain = makeChain();
+  let chain: Chain;
+  beforeAll(async () => {
+    chain = await makeChain();
+  });
 
   it('decode(x5c[i]) byte-equals the DER we encoded', () => {
     expect(Buffer.from(chain.x5c[0]!, 'base64').equals(Buffer.from(chain.certs.leaf.raw))).toBe(true);
@@ -96,9 +105,9 @@ describe('make-chain — data damage / round-trip', () => {
 });
 
 describe('make-chain — validity window pinning', () => {
-  it('pins notBefore/notAfter relative to signedDate', () => {
+  it('pins notBefore/notAfter relative to signedDate', async () => {
     const signedDate = 1_700_000_000_000;
-    const chain = makeChain({
+    const chain = await makeChain({
       signedDate,
       certValidFrom: new Date(signedDate - 86_400_000),
       certValidTo: new Date(signedDate + 86_400_000),
@@ -136,7 +145,10 @@ describe('make-chain — data leak (committed test keys never reach src/)', () =
 });
 
 describe('make-chain — buildJws crafts variants', () => {
-  const chain = makeChain();
+  let chain: Chain;
+  beforeAll(async () => {
+    chain = await makeChain();
+  });
 
   it('re-signs a custom header/payload with the leaf key', () => {
     const { jws, p1363Sig } = buildJws({ alg: 'ES256', x5c: chain.x5c }, { foo: 'bar' }, chain.keys.leafKeyPem);

package/api/tests/integrations/app-store/fixtures/make-chain.ts

@@ -24,19 +24,27 @@
  * Apple OID, ES256 P1363 sig over `header.payload`) is identical.
  *
  * Determinism: the EC P-256 signing keys are COMMITTED under `fixtures/keys/`
- * (synthetic, test-only) and the certs are derived from them at runtime with
+ * (synthetic, test-only) and the certs are minted from them at runtime with
  * pinned validity windows — so golden-vector VALUE assertions are stable and
  * the certs never expire. Pass `freshKeys: true` to generate unique keys for a
  * single call (e.g. to make two chains demonstrably distinct). The committed
  * keys are test-only and MUST never be imported by `src/` — a data-leak spec
  * (`make-chain.spec.ts`) guards that invariant. The committed REAL Apple
  * fixture (`real-sandbox.jws`) is the golden vector for real-chain field values.
+ *
+ * Certs are minted in-process with `@peculiar/x509` (no `openssl` shell-out),
+ * so the fixtures do not depend on the host toolchain's OpenSSL version.
  */
-import { execFileSync } from 'node:child_process';
-import { X509Certificate, sign as nodeSign } from 'node:crypto';
-import { copyFileSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import os from 'node:os';
+// eslint-disable-next-line import/no-extraneous-dependencies
+import 'reflect-metadata';
+import { X509Certificate, createPrivateKey, createPublicKey, sign as nodeSign, webcrypto } from 'node:crypto';
+import { readFileSync } from 'node:fs';
 import path from 'node:path';
+// eslint-disable-next-line import/no-extraneous-dependencies
+import * as x509 from '@peculiar/x509';
+
+x509.cryptoProvider.set(webcrypto as unknown as Crypto);
+const CERT_ALG = { name: 'ECDSA', namedCurve: 'P-256', hash: 'SHA-256' } as const;
 
 export const APPLE_LEAF_OID = '1.2.840.113635.100.6.11.1';
 export const APPLE_INT_OID = '1.2.840.113635.100.6.2.1';
@@ -92,23 +100,14 @@ export interface Chain {
 }
 
 const SUBJ = {
-  root: '/CN=Test Apple Root CA/O=did-pay-test',
-  int: '/CN=Test Apple WWDR Intermediate/O=did-pay-test',
-  leaf: '/CN=Test Apple Leaf/O=did-pay-test',
+  root: 'CN=Test Apple Root CA, O=did-pay-test',
+  int: 'CN=Test Apple WWDR Intermediate, O=did-pay-test',
+  leaf: 'CN=Test Apple Leaf, O=did-pay-test',
 };
 
 /** Committed synthetic signing keys (test-only, never imported by src/). */
 const KEYS_DIR = path.join(__dirname, 'keys');
 
-/** openssl `-not_before`/`-not_after` want `[CC]YYMMDDHHMMSSZ`. */
-function fmtTime(d: Date): string {
-  return `${d
-    .toISOString()
-    .replace(/[-:]/g, '')
-    .replace('T', '')
-    .replace(/\.\d+Z$/, '')}Z`;
-}
-
 /** Sign `signingInput` (ASCII) with an EC P-256 key, returning a raw 64-byte P1363 sig. */
 export function signES256(signingInput: string, privateKeyPem: string): Buffer {
   return nodeSign('sha256', Buffer.from(signingInput, 'ascii'), { key: privateKeyPem, dsaEncoding: 'ieee-p1363' });
@@ -127,200 +126,169 @@ export function buildJws(
   return { jws: `${signingInput}.${p1363Sig.toString('base64url')}`, signingInput, p1363Sig };
 }
 
-export function makeChain(opts: MakeChainOptions = {}): Chain {
+/** A committed (or fresh) EC P-256 key as a WebCrypto pair + its PEM (for JWS signing / return). */
+async function loadKeyPair(committedStem: string, fresh: boolean): Promise<{ pair: CryptoKeyPair; pem: string }> {
+  if (fresh) {
+    const pair = (await webcrypto.subtle.generateKey(CERT_ALG, true, ['sign', 'verify'])) as CryptoKeyPair;
+    const der = Buffer.from(await webcrypto.subtle.exportKey('pkcs8', pair.privateKey));
+    const pem = createPrivateKey({ key: der, format: 'der', type: 'pkcs8' }).export({
+      type: 'sec1',
+      format: 'pem',
+    }) as string;
+    return { pair, pem };
+  }
+  const pem = readFileSync(path.join(KEYS_DIR, `${committedStem}.key.pem`), 'utf8');
+  const nodeKey = createPrivateKey(pem);
+  const privateKey = await webcrypto.subtle.importKey(
+    'pkcs8',
+    nodeKey.export({ type: 'pkcs8', format: 'der' }),
+    CERT_ALG,
+    true,
+    ['sign']
+  );
+  const publicKey = await webcrypto.subtle.importKey(
+    'spki',
+    createPublicKey(nodeKey).export({ type: 'spki', format: 'der' }),
+    CERT_ALG,
+    true,
+    ['verify']
+  );
+  return { pair: { privateKey, publicKey }, pem };
+}
+
+/** Apple marker OID carried as a critical=false extension whose value is ASN.1 NULL (`05 00`). */
+const appleOidExt = (oid: string): x509.Extension => new x509.Extension(oid, false, new Uint8Array([0x05, 0x00]));
+
+export async function makeChain(opts: MakeChainOptions = {}): Promise<Chain> {
   const signedDate = opts.signedDate ?? Date.now();
   const validFrom = opts.certValidFrom ?? new Date(signedDate - ONE_DAY_MS);
   const validTo = opts.certValidTo ?? new Date(signedDate + TEN_YEARS_MS);
-  // Resolve the [notBefore, notAfter] pair for a given cert, honoring per-cert overrides.
-  const windowFor = (cert: 'leaf' | 'intermediate' | 'root'): { nb: string; na: string } => {
+  const windowFor = (cert: 'leaf' | 'intermediate' | 'root'): { nb: Date; na: Date } => {
     const o = opts.certWindows?.[cert];
-    return { nb: fmtTime(o?.from ?? validFrom), na: fmtTime(o?.to ?? validTo) };
+    return { nb: o?.from ?? validFrom, na: o?.to ?? validTo };
   };
+  const rootW = windowFor('root');
+  const intW = windowFor('intermediate');
+  const leafW = windowFor('leaf');
 
-  const dir = mkdtempSync(path.join(os.tmpdir(), 'make-chain-'));
-  const file = (name: string): string => path.join(dir, name);
-  const ossl = (args: string[]): void => {
-    execFileSync('openssl', args, { cwd: dir, stdio: ['ignore', 'pipe', 'pipe'] });
-  };
-  // Reuse the committed synthetic keys (deterministic) unless freshKeys is set.
-  // `tmpName` is the working filename (e.g. 'root.key'); `committed` is the
-  // fixtures/keys/<committed>.key.pem stem.
-  const provisionKey = (tmpName: string, committed: string): void => {
-    if (opts.freshKeys) {
-      ossl(['ecparam', '-name', 'prime256v1', '-genkey', '-noout', '-out', file(tmpName)]);
-    } else {
-      copyFileSync(path.join(KEYS_DIR, `${committed}.key.pem`), file(tmpName));
-    }
-  };
+  const fresh = !!opts.freshKeys;
+  const root = await loadKeyPair('root', fresh);
+  const int = await loadKeyPair('int', fresh);
+  const leaf = await loadKeyPair('leaf', fresh);
+  const wrongInt = await loadKeyPair('wrongint', fresh);
 
-  try {
-    const rootW = windowFor('root');
-    const intW = windowFor('intermediate');
-    const leafW = windowFor('leaf');
+  const caUsage = (): x509.Extension =>
+    // eslint-disable-next-line no-bitwise
+    new x509.KeyUsagesExtension(x509.KeyUsageFlags.keyCertSign | x509.KeyUsageFlags.cRLSign, true);
 
-    // root — self-signed CA
-    provisionKey('root.key', 'root');
-    ossl([
-      'req',
-      '-new',
-      '-x509',
-      '-key',
-      file('root.key'),
-      '-out',
-      file('root.pem'),
-      '-subj',
-      SUBJ.root,
-      '-not_before',
-      rootW.nb,
-      '-not_after',
-      rootW.na,
-      '-addext',
-      'basicConstraints=critical,CA:TRUE',
-      '-addext',
-      'keyUsage=critical,keyCertSign,cRLSign',
-    ]);
+  const mk = (o: {
+    serial: string;
+    subject: string;
+    issuer: string;
+    nb: Date;
+    na: Date;
+    pub: CryptoKey;
+    sign: CryptoKey;
+    exts: x509.Extension[];
+  }): Promise<x509.X509Certificate> =>
+    x509.X509CertificateGenerator.create({
+      serialNumber: o.serial,
+      subject: o.subject,
+      issuer: o.issuer,
+      notBefore: o.nb,
+      notAfter: o.na,
+      signingAlgorithm: CERT_ALG,
+      publicKey: o.pub,
+      signingKey: o.sign,
+      extensions: o.exts,
+    });
 
-    // intermediate — CA + Apple intermediate OID, signed by root
-    provisionKey('int.key', 'int');
-    ossl(['req', '-new', '-key', file('int.key'), '-out', file('int.csr'), '-subj', SUBJ.int]);
-    const intExt = ['[v3]', 'basicConstraints=critical,CA:TRUE', 'keyUsage=critical,keyCertSign,cRLSign'];
-    if (opts.intOid !== false) intExt.push(`${APPLE_INT_OID}=DER:0500`);
-    writeFileSync(file('int.ext'), intExt.join('\n'));
-    ossl([
-      'x509',
-      '-req',
-      '-in',
-      file('int.csr'),
-      '-CA',
-      file('root.pem'),
-      '-CAkey',
-      file('root.key'),
-      '-CAcreateserial',
-      '-out',
-      file('int.pem'),
-      '-not_before',
-      intW.nb,
-      '-not_after',
-      intW.na,
-      '-extfile',
-      file('int.ext'),
-      '-extensions',
-      'v3',
-    ]);
+  // root — self-signed CA
+  const rootX = await mk({
+    serial: '01',
+    subject: SUBJ.root,
+    issuer: SUBJ.root,
+    nb: rootW.nb,
+    na: rootW.na,
+    pub: root.pair.publicKey,
+    sign: root.pair.privateKey,
+    exts: [new x509.BasicConstraintsExtension(true, undefined, true), caUsage()],
+  });
 
-    // leaf — Apple leaf OID, signed by intermediate
-    provisionKey('leaf.key', 'leaf');
-    ossl(['req', '-new', '-key', file('leaf.key'), '-out', file('leaf.csr'), '-subj', SUBJ.leaf]);
-    const leafExt = ['[v3]', 'basicConstraints=critical,CA:FALSE'];
-    if (opts.leafOid !== false) leafExt.push(`${APPLE_LEAF_OID}=DER:0500`);
-    writeFileSync(file('leaf.ext'), leafExt.join('\n'));
-    ossl([
-      'x509',
-      '-req',
-      '-in',
-      file('leaf.csr'),
-      '-CA',
-      file('int.pem'),
-      '-CAkey',
-      file('int.key'),
-      '-CAcreateserial',
-      '-out',
-      file('leaf.pem'),
-      '-not_before',
-      leafW.nb,
-      '-not_after',
-      leafW.na,
-      '-extfile',
-      file('leaf.ext'),
-      '-extensions',
-      'v3',
-    ]);
+  // intermediate — CA + Apple intermediate OID, signed by root
+  const intExts: x509.Extension[] = [new x509.BasicConstraintsExtension(true, undefined, true), caUsage()];
+  if (opts.intOid !== false) intExts.push(appleOidExt(APPLE_INT_OID));
+  const intX = await mk({
+    serial: '02',
+    subject: SUBJ.int,
+    issuer: SUBJ.root,
+    nb: intW.nb,
+    na: intW.na,
+    pub: int.pair.publicKey,
+    sign: root.pair.privateKey,
+    exts: intExts,
+  });
 
-    // wrong intermediate — SAME subject DN, DIFFERENT key. A leaf it signs passes
-    // issuer/subject equality but fails leaf.verify(realIntermediate.publicKey),
-    // isolating the chain-signature failure for the negative control.
-    provisionKey('wrongint.key', 'wrongint');
-    ossl([
-      'req',
-      '-new',
-      '-x509',
-      '-key',
-      file('wrongint.key'),
-      '-out',
-      file('wrongint.pem'),
-      '-subj',
-      SUBJ.int,
-      '-not_before',
-      intW.nb,
-      '-not_after',
-      intW.na,
-      '-addext',
-      'basicConstraints=critical,CA:TRUE',
-    ]);
-    provisionKey('crossleaf.key', 'leaf');
-    ossl(['req', '-new', '-key', file('crossleaf.key'), '-out', file('crossleaf.csr'), '-subj', SUBJ.leaf]);
-    ossl([
-      'x509',
-      '-req',
-      '-in',
-      file('crossleaf.csr'),
-      '-CA',
-      file('wrongint.pem'),
-      '-CAkey',
-      file('wrongint.key'),
-      '-CAcreateserial',
-      '-out',
-      file('crossleaf.pem'),
-      '-not_before',
-      leafW.nb,
-      '-not_after',
-      leafW.na,
-      '-extfile',
-      file('leaf.ext'),
-      '-extensions',
-      'v3',
-    ]);
+  // leaf — Apple leaf OID, signed by intermediate
+  const leafExts: x509.Extension[] = [new x509.BasicConstraintsExtension(false, undefined, true)];
+  if (opts.leafOid !== false) leafExts.push(appleOidExt(APPLE_LEAF_OID));
+  const leafX = await mk({
+    serial: '03',
+    subject: SUBJ.leaf,
+    issuer: SUBJ.int,
+    nb: leafW.nb,
+    na: leafW.na,
+    pub: leaf.pair.publicKey,
+    sign: int.pair.privateKey,
+    exts: leafExts,
+  });
 
-    const leafCert = new X509Certificate(readFileSync(file('leaf.pem')));
-    const intCert = new X509Certificate(readFileSync(file('int.pem')));
-    const rootCert = new X509Certificate(readFileSync(file('root.pem')));
-    const crossLeafCert = new X509Certificate(readFileSync(file('crossleaf.pem')));
+  // cross-signed leaf — the SAME leaf key + subject, but issued (signed) by a
+  // different key under the intermediate's DN (`wrongint`). It keeps
+  // issuer/subject equality up the chain yet fails leaf.verify(int.publicKey).
+  const crossLeafX = await mk({
+    serial: '05',
+    subject: SUBJ.leaf,
+    issuer: SUBJ.int,
+    nb: leafW.nb,
+    na: leafW.na,
+    pub: leaf.pair.publicKey,
+    sign: wrongInt.pair.privateKey,
+    exts: leafExts,
+  });
 
-    const x5c = [
-      Buffer.from(leafCert.raw).toString('base64'),
-      Buffer.from(intCert.raw).toString('base64'),
-      Buffer.from(rootCert.raw).toString('base64'),
-    ];
-    const header = { alg: opts.alg ?? 'ES256', x5c };
-    const payload: Record<string, unknown> = {
-      transactionId: 'txn_synth_1',
-      originalTransactionId: 'orig_synth_1',
-      productId: 'sub_synthetic',
-      bundleId: 'com.example.app',
-      environment: 'Sandbox',
-      signedDate,
-      ...opts.payload,
-    };
-    const leafKeyPem = readFileSync(file('leaf.key'), 'utf8');
-    const { jws, signingInput, p1363Sig } = buildJws(header, payload, leafKeyPem);
+  const toNode = (c: x509.X509Certificate): X509Certificate => new X509Certificate(Buffer.from(c.rawData));
+  const rootCert = toNode(rootX);
+  const intCert = toNode(intX);
+  const leafCert = toNode(leafX);
+  const crossLeafCert = toNode(crossLeafX);
 
-    return {
-      x5c,
-      jws,
-      signingInput,
-      p1363Sig,
-      crossSignedLeaf: Buffer.from(crossLeafCert.raw).toString('base64'),
-      keys: {
-        rootKeyPem: readFileSync(file('root.key'), 'utf8'),
-        intKeyPem: readFileSync(file('int.key'), 'utf8'),
-        leafKeyPem,
-        wrongIntKeyPem: readFileSync(file('wrongint.key'), 'utf8'),
-      },
-      certs: { leaf: leafCert, intermediate: intCert, root: rootCert },
-      payload,
-      header,
-    };
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
+  const x5c = [
+    Buffer.from(leafX.rawData).toString('base64'),
+    Buffer.from(intX.rawData).toString('base64'),
+    Buffer.from(rootX.rawData).toString('base64'),
+  ];
+  const header = { alg: opts.alg ?? 'ES256', x5c };
+  const payload: Record<string, unknown> = {
+    transactionId: 'txn_synth_1',
+    originalTransactionId: 'orig_synth_1',
+    productId: 'sub_synthetic',
+    bundleId: 'com.example.app',
+    environment: 'Sandbox',
+    signedDate,
+    ...opts.payload,
+  };
+  const { jws, signingInput, p1363Sig } = buildJws(header, payload, leaf.pem);
+
+  return {
+    x5c,
+    jws,
+    signingInput,
+    p1363Sig,
+    crossSignedLeaf: Buffer.from(crossLeafCert.raw).toString('base64'),
+    keys: { rootKeyPem: root.pem, intKeyPem: int.pem, leafKeyPem: leaf.pem, wrongIntKeyPem: wrongInt.pem },
+    certs: { leaf: leafCert, intermediate: intCert, root: rootCert },
+    payload,
+    header,
+  };
 }

package/api/tests/integrations/app-store/native-jws.spec.ts

@@ -15,8 +15,8 @@ import type { JwsTransactionPayload } from '../../../src/integrations/app-store/
 const FIXED_SIGNED_DATE = 1_700_000_000_000;
 
 /** A valid chain + the trustedRoots list that anchors it (the chain's own root). */
-function freshChainCtx(opts: Parameters<typeof makeChain>[0] = {}) {
-  const chain = makeChain({ signedDate: FIXED_SIGNED_DATE, ...opts });
+async function freshChainCtx(opts: Parameters<typeof makeChain>[0] = {}) {
+  const chain = await makeChain({ signedDate: FIXED_SIGNED_DATE, ...opts });
   const trustedRoots = [Buffer.from(chain.x5c[2]!, 'base64')];
   return { chain, trustedRoots };
 }
@@ -27,7 +27,7 @@ async function expectCode(promise: Promise<unknown>, code: string): Promise<void
 
 describe('verifyAppleJws — happy path', () => {
   it('decodes a synthetic chain when its root is trusted; fields match the signed payload', async () => {
-    const { chain, trustedRoots } = freshChainCtx({
+    const { chain, trustedRoots } = await freshChainCtx({
       payload: { productId: 'sub_happy', expiresDate: 1_900_000_000_000, appAccountToken: 'uuid-happy' },
     });
     const decoded = await verifyAppleJws<JwsTransactionPayload>(chain.jws, { trustedRoots });
@@ -56,7 +56,7 @@ describe('verifyAppleJws — bad input', () => {
   });
 
   it('rejects x5c.length !== 3 with INVALID_CHAIN_LENGTH', async () => {
-    const { chain, trustedRoots } = freshChainCtx();
+    const { chain, trustedRoots } = await freshChainCtx();
     const { jws } = buildJws({ alg: 'ES256', x5c: chain.x5c.slice(0, 2) }, chain.payload, chain.keys.leafKeyPem);
     await expectCode(verifyAppleJws(jws, { trustedRoots }), 'INVALID_CHAIN_LENGTH');
   });
@@ -66,7 +66,7 @@ describe('verifyAppleJws — bad input', () => {
   });
 
   it('rejects a payload that is not valid JSON (after a valid chain)', async () => {
-    const { chain, trustedRoots } = freshChainCtx();
+    const { chain, trustedRoots } = await freshChainCtx();
     const headerSeg = chain.jws.split('.')[0]!;
     const badPayload = Buffer.from('not json at all').toString('base64url');
     const jws = `${headerSeg}.${badPayload}.${chain.jws.split('.')[2]}`;
@@ -76,14 +76,14 @@ describe('verifyAppleJws — bad input', () => {
 
 describe('verifyAppleJws — security', () => {
   it('rejects a tampered payload (signature no longer matches)', async () => {
-    const { chain, trustedRoots } = freshChainCtx();
+    const { chain, trustedRoots } = await freshChainCtx();
     const [h, , s] = chain.jws.split('.');
     const tampered = Buffer.from(JSON.stringify({ ...chain.payload, productId: 'EVIL' })).toString('base64url');
     await expectCode(verifyAppleJws(`${h}.${tampered}.${s}`, { trustedRoots }), 'SIGNATURE');
   });
 
   it('rejects a tampered signature', async () => {
-    const { chain, trustedRoots } = freshChainCtx();
+    const { chain, trustedRoots } = await freshChainCtx();
     const [h, p] = chain.jws.split('.');
     const sigBytes = Buffer.from(chain.jws.split('.')[2]!, 'base64url');
     sigBytes[0] = sigBytes[0]! ^ 0xff;
@@ -91,37 +91,37 @@ describe('verifyAppleJws — security', () => {
   });
 
   it('rejects alg: "none" and alg: "RS256" (alg whitelist)', async () => {
-    const none = freshChainCtx({ alg: 'none' });
+    const none = await freshChainCtx({ alg: 'none' });
     await expectCode(verifyAppleJws(none.chain.jws, { trustedRoots: none.trustedRoots }), 'ALG');
-    const rs = freshChainCtx({ alg: 'RS256' });
+    const rs = await freshChainCtx({ alg: 'RS256' });
     await expectCode(verifyAppleJws(rs.chain.jws, { trustedRoots: rs.trustedRoots }), 'ALG');
   });
 
   it('rejects when the presented root is NOT a trusted anchor', async () => {
-    const { chain } = freshChainCtx();
+    const { chain } = await freshChainCtx();
     // default APPLE_ROOT_CERTS does NOT contain the synthetic root
     await expectCode(verifyAppleJws(chain.jws), 'ANCHOR');
   });
 
   it('rejects a cross-signed leaf (chain break) before signature', async () => {
-    const { chain, trustedRoots } = freshChainCtx();
+    const { chain, trustedRoots } = await freshChainCtx();
     const header = { alg: 'ES256', x5c: [chain.crossSignedLeaf, chain.x5c[1], chain.x5c[2]] };
     const { jws } = buildJws(header, chain.payload, chain.keys.leafKeyPem);
     await expectCode(verifyAppleJws(jws, { trustedRoots }), 'CHAIN');
   });
 
   it('rejects when the leaf is missing the Apple OID', async () => {
-    const { chain, trustedRoots } = freshChainCtx({ leafOid: false });
+    const { chain, trustedRoots } = await freshChainCtx({ leafOid: false });
     await expectCode(verifyAppleJws(chain.jws, { trustedRoots }), 'OID');
   });
 
   it('rejects when the intermediate is missing the Apple OID', async () => {
-    const { chain, trustedRoots } = freshChainCtx({ intOid: false });
+    const { chain, trustedRoots } = await freshChainCtx({ intOid: false });
     await expectCode(verifyAppleJws(chain.jws, { trustedRoots }), 'OID');
   });
 
   it('does not pollute Object.prototype from a hostile __proto__ payload', async () => {
-    const { chain, trustedRoots } = freshChainCtx();
+    const { chain, trustedRoots } = await freshChainCtx();
     const headerSeg = chain.jws.split('.')[0]!;
     // own __proto__ key via JSON.parse, then sign it so the chain is valid
     const hostile = JSON.parse(
@@ -142,29 +142,29 @@ describe('verifyAppleJws — validity & clock skew (±60s, all 3 certs)', () =>
   // boundary: reject if validTo < effectiveDate − 60s; pass at exactly −60s.
   it('passes at the expiry boundary (effectiveDate = validTo + 60s) and rejects 1ms past it', async () => {
     const validTo = new Date(FIXED_SIGNED_DATE);
-    const ctxPass = freshChainCtx({ certValidTo: validTo, signedDate: FIXED_SIGNED_DATE + 60_000 });
+    const ctxPass = await freshChainCtx({ certValidTo: validTo, signedDate: FIXED_SIGNED_DATE + 60_000 });
     await expect(verifyAppleJws(ctxPass.chain.jws, { trustedRoots: ctxPass.trustedRoots })).resolves.toBeDefined();
-    const ctxFail = freshChainCtx({ certValidTo: validTo, signedDate: FIXED_SIGNED_DATE + 60_000 + 1 });
+    const ctxFail = await freshChainCtx({ certValidTo: validTo, signedDate: FIXED_SIGNED_DATE + 60_000 + 1 });
     await expectCode(verifyAppleJws(ctxFail.chain.jws, { trustedRoots: ctxFail.trustedRoots }), 'CERT_EXPIRED');
   });
 
   it('passes at the not-yet-valid boundary (effectiveDate = validFrom − 60s) and rejects 1ms before it', async () => {
     const validFrom = new Date(FIXED_SIGNED_DATE);
-    const ctxPass = freshChainCtx({ certValidFrom: validFrom, signedDate: FIXED_SIGNED_DATE - 60_000 });
+    const ctxPass = await freshChainCtx({ certValidFrom: validFrom, signedDate: FIXED_SIGNED_DATE - 60_000 });
     await expect(verifyAppleJws(ctxPass.chain.jws, { trustedRoots: ctxPass.trustedRoots })).resolves.toBeDefined();
-    const ctxFail = freshChainCtx({ certValidFrom: validFrom, signedDate: FIXED_SIGNED_DATE - 60_000 - 1 });
+    const ctxFail = await freshChainCtx({ certValidFrom: validFrom, signedDate: FIXED_SIGNED_DATE - 60_000 - 1 });
     await expectCode(verifyAppleJws(ctxFail.chain.jws, { trustedRoots: ctxFail.trustedRoots }), 'CERT_NOT_YET_VALID');
   });
 
   it('rejects when ONLY the intermediate is expired (proves int is checked, not just leaf)', async () => {
-    const { chain, trustedRoots } = freshChainCtx({
+    const { chain, trustedRoots } = await freshChainCtx({
       certWindows: { intermediate: { to: new Date(FIXED_SIGNED_DATE - 3_600_000) } },
     });
     await expectCode(verifyAppleJws(chain.jws, { trustedRoots }), 'CERT_EXPIRED');
   });
 
   it('rejects when ONLY the root is expired (proves root is checked)', async () => {
-    const { chain, trustedRoots } = freshChainCtx({
+    const { chain, trustedRoots } = await freshChainCtx({
       certWindows: { root: { to: new Date(FIXED_SIGNED_DATE - 3_600_000) } },
     });
     await expectCode(verifyAppleJws(chain.jws, { trustedRoots }), 'CERT_EXPIRED');
@@ -173,7 +173,7 @@ describe('verifyAppleJws — validity & clock skew (±60s, all 3 certs)', () =>
 
 describe('verifyAppleJws — data loss (concurrency / statelessness)', () => {
   it('resolves all concurrent verifications correctly (no shared mutable state)', async () => {
-    const { chain, trustedRoots } = freshChainCtx();
+    const { chain, trustedRoots } = await freshChainCtx();
     const results = await Promise.all(
       Array.from({ length: 12 }, () => verifyAppleJws<JwsTransactionPayload>(chain.jws, { trustedRoots }))
     );
@@ -183,7 +183,7 @@ describe('verifyAppleJws — data loss (concurrency / statelessness)', () => {
 
 describe('verifyAppleJws — data damage (type/encoding fidelity)', () => {
   it('keeps numbers as numbers and round-trips unicode byte-faithfully', async () => {
-    const { chain, trustedRoots } = freshChainCtx({
+    const { chain, trustedRoots } = await freshChainCtx({
       payload: { productId: '产品_🎉', expiresDate: 1_888_888_888_888, appAccountToken: 'uuid-😀' },
     });
     const decoded = await verifyAppleJws<JwsTransactionPayload>(chain.jws, { trustedRoots });
@@ -194,7 +194,7 @@ describe('verifyAppleJws — data damage (type/encoding fidelity)', () => {
   });
 
   it('leaves a missing expiresDate as undefined (never coerced to 0/null)', async () => {
-    const { chain, trustedRoots } = freshChainCtx(); // default payload has no expiresDate
+    const { chain, trustedRoots } = await freshChainCtx(); // default payload has no expiresDate
     const decoded = await verifyAppleJws<JwsTransactionPayload>(chain.jws, { trustedRoots });
     expect('expiresDate' in decoded).toBe(false);
     expect(decoded.expiresDate).toBeUndefined();
@@ -203,7 +203,7 @@ describe('verifyAppleJws — data damage (type/encoding fidelity)', () => {
 
 describe('verifyAppleJws — data leak (errors name the failure, not secrets)', () => {
   it('throws AppleJwsVerifyError with a code and never echoes the raw cert/JWS material', async () => {
-    const { chain } = freshChainCtx();
+    const { chain } = await freshChainCtx();
     try {
       await verifyAppleJws(chain.jws); // ANCHOR (synthetic root not trusted)
       throw new Error('should have rejected');

package/api/tests/routes/connect/collect-batch-limit.spec.ts

@@ -0,0 +1,82 @@
+// #1128 — arcblock batch-collect embeds the FULL past-due invoice id list into
+// the on-chain tx metadata (getTxMetadata() in libs/util.ts, consumed by
+// routes/connect/collect-batch.ts). That JSON blob has no length limit of its
+// own, so a customer/subscription with many uncollectible invoices could build
+// a tx whose `data` field exceeds the chain's tx size limit and fails on-chain.
+//
+// ensureSubscriptionForCollectBatch() (routes/connect/shared.ts) is the single
+// choke point used by collect-batch's claims.authPrincipal / onConnect / onAuth,
+// so the size guard lives there: reject the request up front with a clear error
+// instead of silently truncating the invoice list (which would make the
+// on-chain memo permanently misleading) or letting an oversized tx reach the
+// chain and fail there.
+import { ensureSubscriptionForCollectBatch } from '../../../src/routes/connect/shared';
+import { Invoice, PaymentCurrency, PaymentMethod, Subscription } from '../../../src/store/models';
+import { MAX_BATCH_COLLECT_INVOICES } from '../../../src/libs/constants';
+
+const SUBSCRIPTION_ID = 'sub_test_1128';
+const CURRENCY_ID = 'cur_test_1128';
+
+const buildInvoiceIds = (count: number) => Array.from({ length: count }, (_, i) => `in_test_${i}`);
+
+function mockUncollectible({ invoiceCount, paymentMethodType }: { invoiceCount: number; paymentMethodType: string }) {
+  const invoiceIds = buildInvoiceIds(invoiceCount);
+
+  jest.spyOn(Subscription, 'findByPk').mockResolvedValue({
+    id: SUBSCRIPTION_ID,
+    customer_id: 'cus_test_1128',
+  } as any);
+
+  jest.spyOn(PaymentCurrency, 'findByPk').mockResolvedValue({
+    id: CURRENCY_ID,
+    payment_method_id: 'pm_test_1128',
+  } as any);
+
+  jest.spyOn(PaymentMethod, 'findByPk').mockResolvedValue({
+    id: 'pm_test_1128',
+    type: paymentMethodType,
+  } as any);
+
+  jest
+    .spyOn(Invoice, 'getUncollectibleAmount')
+    .mockResolvedValue([{ [CURRENCY_ID]: String(invoiceCount * 100) }, { [CURRENCY_ID]: invoiceIds }, []] as any);
+
+  return invoiceIds;
+}
+
+describe('ensureSubscriptionForCollectBatch — batch size guard (#1128)', () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('resolves normally when the arcblock invoice count is within the limit', async () => {
+    const invoiceIds = mockUncollectible({ invoiceCount: MAX_BATCH_COLLECT_INVOICES, paymentMethodType: 'arcblock' });
+
+    const result = await ensureSubscriptionForCollectBatch(SUBSCRIPTION_ID, CURRENCY_ID, undefined);
+
+    expect(result.invoices).toEqual(invoiceIds);
+  });
+
+  it('rejects with a clear error instead of building an oversized tx when the arcblock invoice count exceeds the limit', async () => {
+    mockUncollectible({ invoiceCount: MAX_BATCH_COLLECT_INVOICES + 1, paymentMethodType: 'arcblock' });
+
+    await expect(ensureSubscriptionForCollectBatch(SUBSCRIPTION_ID, CURRENCY_ID, undefined)).rejects.toThrow(
+      /Too many past due invoices.*on-chain transaction/
+    );
+  });
+
+  it('does not enforce the on-chain tx-size guard for non-arcblock (EVM) payment methods', async () => {
+    // EVM batch-collect (see collect-batch.ts onConnect) never embeds the
+    // invoices array into the signed payload — only `network` + the encoded
+    // transfer itx — so the on-chain size risk this guard protects against
+    // does not apply there.
+    const invoiceIds = mockUncollectible({
+      invoiceCount: MAX_BATCH_COLLECT_INVOICES + 1,
+      paymentMethodType: 'ethereum',
+    });
+
+    const result = await ensureSubscriptionForCollectBatch(SUBSCRIPTION_ID, CURRENCY_ID, undefined);
+
+    expect(result.invoices).toEqual(invoiceIds);
+  });
+});

package/blocklet.yml

@@ -14,7 +14,7 @@ repository:
   type: git
   url: git+https://github.com/blocklet/payment-kit.git
 specVersion: 1.2.8
-version: 1.29.13
+version: 1.29.14
 logo: logo.png
 files:
   - dist

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "payment-kit",
-  "version": "1.29.13",
+  "version": "1.29.14",
   "scripts": {
     "dev": "blocklet dev --open",
     "prelint": "npm run types",
@@ -60,9 +60,9 @@
     "@blocklet/error": "^0.3.5",
     "@blocklet/js-sdk": "^1.17.13-beta-20260613-094425-b81920c8",
     "@blocklet/logger": "^1.17.13-beta-20260613-094425-b81920c8",
-    "@blocklet/payment-broker-client": "1.29.13",
-    "@blocklet/payment-react": "1.29.13",
-    "@blocklet/payment-vendor": "1.29.13",
+    "@blocklet/payment-broker-client": "1.29.14",
+    "@blocklet/payment-react": "1.29.14",
+    "@blocklet/payment-vendor": "1.29.14",
     "@blocklet/sdk": "^1.17.13-beta-20260613-094425-b81920c8",
     "@blocklet/ui-react": "^3.5.4",
     "@blocklet/uploader": "^0.15.4",
@@ -133,7 +133,8 @@
   "devDependencies": {
     "@abtnode/types": "^1.17.13-beta-20260613-094425-b81920c8",
     "@arcblock/eslint-config-ts": "^0.3.3",
-    "@blocklet/payment-types": "1.29.13",
+    "@blocklet/payment-types": "1.29.14",
+    "@peculiar/x509": "^2.0.0",
     "@types/connect": "^3.4.38",
     "@types/debug": "^4.1.12",
     "@types/dotenv-flow": "^3.3.3",
@@ -154,6 +155,7 @@
     "npm-run-all": "^4.1.5",
     "prettier": "^3.6.0",
     "prettier-plugin-import-sort": "^0.0.7",
+    "reflect-metadata": "^0.2.2",
     "rollup-plugin-visualizer": "^6.0.3",
     "ts-jest": "^29.4.0",
     "ts-node": "^10.9.2",
@@ -180,5 +182,5 @@
       "parser": "typescript"
     }
   },
-  "gitHead": "e023f83ecfb07c0782e138a2802b5dec746fd7c6"
+  "gitHead": "ac4de50daf46f5ef2b4d58d1060610564929a10c"
 }