payment-kit 1.29.6 → 1.29.8

package/api/tests/libs/notification-guard.spec.ts

@@ -5,13 +5,17 @@
 // environments" off Blocklet Server (arc-node / CF). The guard no-ops both SDK
 // transports there — at the module level, so app-side logic still runs and only
 // the send/publish is skipped — and leaves Blocklet Server untouched. Gated on the
-// single reusable predicate isBlockletServer() (= BLOCKLET_APP_ID present).
+// single reusable predicate isBlockletServer() (= BLOCKLET_DID present; the CF
+// worker injects BLOCKLET_APP_ID = APP_PID so that can NOT be the marker).
 describe('ensureBlockletSdkTransportGuard', () => {
-  const ORIG = process.env.BLOCKLET_APP_ID;
+  const ORIG = process.env.BLOCKLET_DID;
+  const ORIG_APP_ID = process.env.BLOCKLET_APP_ID;
 
   afterEach(() => {
-    if (ORIG === undefined) delete process.env.BLOCKLET_APP_ID;
-    else process.env.BLOCKLET_APP_ID = ORIG;
+    if (ORIG === undefined) delete process.env.BLOCKLET_DID;
+    else process.env.BLOCKLET_DID = ORIG;
+    if (ORIG_APP_ID === undefined) delete process.env.BLOCKLET_APP_ID;
+    else process.env.BLOCKLET_APP_ID = ORIG_APP_ID;
     jest.resetModules();
   });
 
@@ -33,8 +37,8 @@ describe('ensureBlockletSdkTransportGuard', () => {
     return { notification, eventbus };
   }
 
-  it('off Blocklet Server (no BLOCKLET_APP_ID): no-ops notification + eventbus on module + default', async () => {
-    delete process.env.BLOCKLET_APP_ID;
+  it('off Blocklet Server (no BLOCKLET_DID): no-ops notification + eventbus on module + default', async () => {
+    delete process.env.BLOCKLET_DID;
     const { notification, eventbus } = loadAndGuard();
     for (const target of [notification, notification.default]) {
       expect(target.sendToUser).not.toBe('REAL');
@@ -50,12 +54,25 @@ describe('ensureBlockletSdkTransportGuard', () => {
     }
   });
 
-  it('on Blocklet Server (BLOCKLET_APP_ID set): leaves both transports intact', () => {
-    process.env.BLOCKLET_APP_ID = 'z_app_pid';
+  it('on Blocklet Server (BLOCKLET_DID set): leaves both transports intact', () => {
+    process.env.BLOCKLET_DID = 'z_node_did';
     const { notification, eventbus } = loadAndGuard();
     expect(notification.sendToUser).toBe('REAL');
     expect(notification.default.sendToUser).toBe('REAL');
     expect(eventbus.publish).toBe('REAL');
     expect(eventbus.default.publish).toBe('REAL');
   });
+
+  // Regression: the CF worker injects BLOCKLET_APP_ID = APP_PID for app identity,
+  // which used to make isBlockletServer() spuriously true and skip the guard — then
+  // the SDK transport crashed at send time. With the marker on BLOCKLET_DID, an
+  // APP_ID without a DID is correctly treated as off-Blocklet-Server.
+  it('CF worker (BLOCKLET_APP_ID set, no BLOCKLET_DID): still no-ops the transports', async () => {
+    delete process.env.BLOCKLET_DID;
+    process.env.BLOCKLET_APP_ID = 'z_app_pid';
+    const { notification, eventbus } = loadAndGuard();
+    expect(notification.sendToUser).not.toBe('REAL');
+    expect(eventbus.publish).not.toBe('REAL');
+    await expect(notification.sendToUser('zUser', { title: 't' })).resolves.toBeUndefined();
+  });
 });

package/blocklet.yml

@@ -14,7 +14,7 @@ repository:
   type: git
   url: git+https://github.com/blocklet/payment-kit.git
 specVersion: 1.2.8
-version: 1.29.6
+version: 1.29.8
 logo: logo.png
 files:
   - dist

package/cloudflare/cf-adapter.ts

@@ -54,6 +54,11 @@ import { setDB } from './shims/sequelize-d1/model';
 import { withD1Retry } from './shims/sequelize-d1/retry';
 import { cronInstance } from './shims/cron';
 import { createCloudflareDidConnectRuntime, createCloudflareIdentityDriver } from './did-connect-runtime';
+// Runtime-neutral host glue — single source of truth in the core source tree,
+// shared with the arc-node daemon (via the package main entry's `as string`
+// facade). Re-exported below so existing importers (cf-adapter.spec.ts) keep
+// resolving them from this module.
+import { injectCaller, createTenantProvisioner } from '../api/src/host-glue';
 
 /**
  * The reserved mount prefix for the embedded payment service. The internal
@@ -142,52 +147,12 @@ export interface CloudflarePaymentAdapter {
   ensureSchema: () => Promise<string[]>;
 }
 
-/** Client-forged identity headers — always stripped before the host injects the real caller. */
-const USER_HEADERS = ['x-user-did', 'x-user-role', 'x-user-provider', 'x-user-fullname', 'x-user-wallet-os'];
-
-/**
- * CF API gate caller header glue (decision #5). STRIP any client-supplied
- * `x-user-*` first (a forged `x-user-did` would be an auth bypass), then inject the
- * host-resolved caller as canonical headers the core `authenticate()` trusts. No
- * caller → the request runs anonymous (the strip already happened, so it is never
- * forged). Mirrors the standalone worker's identical strip-then-inject.
- */
-export function injectCaller(headers: Headers, caller: CloudflareCallerIdentity | null): void {
-  for (const h of USER_HEADERS) headers.delete(h);
-  if (!caller) return;
-  const canonicalDid = caller.did?.startsWith('did:abt:') ? caller.did : `did:abt:${caller.did}`;
-  headers.set('x-user-did', canonicalDid);
-  headers.set('x-user-role', `blocklet-${caller.role || 'guest'}`);
-  headers.set('x-user-provider', caller.authMethod === 'access-key' ? 'access-key' : caller.authMethod || 'wallet');
-  headers.set('x-user-fullname', encodeURIComponent(caller.displayName || ''));
-  headers.set('x-user-wallet-os', '');
-}
-
-/**
- * Lazy per-tenant provisioning with in-flight dedup. Concurrent first-requests for
- * the same tenant await the SAME provision() call — a Set would let a burst at
- * isolate start double-seed before the DB idempotency guard commits. A resolved
- * promise stays cached so later requests are instant; a FAILED provision is dropped
- * so the next request retries. Null tenant is a no-op. Copied from the node witness
- * (runtimes/node/src/daemon/payment/index.ts:72-105).
- */
-export function createTenantProvisioner(
-  provision: (instanceDid: string) => Promise<void>,
-): (instanceDid: string | null) => Promise<void> {
-  const inflight = new Map<string, Promise<void>>();
-  return (instanceDid) => {
-    if (!instanceDid) return Promise.resolve();
-    let p = inflight.get(instanceDid);
-    if (!p) {
-      p = provision(instanceDid).catch((err) => {
-        inflight.delete(instanceDid); // drop so the next request retries
-        throw err;
-      });
-      inflight.set(instanceDid, p);
-    }
-    return p;
-  };
-}
+// `injectCaller` (CF API gate caller header glue) and `createTenantProvisioner`
+// (lazy-provision in-flight dedup) now live in the runtime-neutral
+// `../api/src/host-glue` — a single source shared with the arc-node daemon (via
+// the package main entry). Re-exported here so existing importers keep resolving
+// them from this module.
+export { injectCaller, createTenantProvisioner };
 
 /** Dependencies for the request handler (factored out so it is testable with a fake service). */
 export interface FetchDeps {

package/cloudflare/tests/cf-adapter.spec.ts

@@ -16,7 +16,8 @@ describe('injectCaller — CF API gate caller header glue (decision #5)', () =>
     const h = new Headers();
     injectCaller(h, { did: 'zUSER', role: 'admin', authMethod: 'passkey', displayName: 'Alice' });
     expect(h.get('x-user-did')).toBe('did:abt:zUSER');
-    expect(h.get('x-user-role')).toBe('blocklet-admin');
+    // raw role — NO `blocklet-` prefix (the core strips it anyway; a prefixed role is wrong)
+    expect(h.get('x-user-role')).toBe('admin');
     expect(h.get('x-user-provider')).toBe('passkey');
     expect(h.get('x-user-fullname')).toBe(encodeURIComponent('Alice'));
   });

package/cloudflare/tests/x509-probe.mjs

@@ -0,0 +1,260 @@
+// X509 / crypto probe — runs inside REAL workerd (via miniflare) with the EXACT
+// production CF config (compatibility_date 2024-12-01 + nodejs_compat).
+//
+// Settles the Apple-IAP native-verify plan (intent/apple-iap-native-verify-plan/)
+// AND is the committed regression gate proving the §5 algorithm holds under
+// workerd. Rounds:
+//   Round 1 (baseline): X509Certificate construct/publicKey/verify, node ES256
+//            (DER sig), subtle ECDSA P-256, subtle importKey spki.
+//   Round 2 (§4 prep): the verify-path specifics NOT covered by round 1 —
+//     P1: leafCert.publicKey.export({type:'spki',format:'der'}) in workerd
+//     P2: verify a REAL P1363 (raw r||s) ES256 sig — (a) via crypto.subtle,
+//                                                      (b) via createVerify dsaEncoding:'ieee-p1363'
+//     P3: read an Apple custom extension OID (1.2.840.113635.*) WITHOUT an ASN.1
+//         lib — DER-encode the OID and indexOf() it in cert.raw. (Node's
+//         X509Certificate has NO generic extension-by-OID accessor.)
+//   chain_round (0.2): a synthetic 3-cert chain (root → CA int w/ Apple OID →
+//            leaf w/ Apple OID) — proves §5.4 walk (intermediate.verify(root),
+//            leaf.verify(int)) + §5.5 OID presence on BOTH certs under workerd,
+//            plus a cross-signed leaf that MUST fail leaf.verify(int).
+//            Mirrors api/tests/integrations/app-store/fixtures/make-chain.ts —
+//            keep the two in sync.
+//   pkcs8_sign_round (0.5): importKey('pkcs8') for SIGN + round-trip verify —
+//            de-risks the App Store Server API JWT bearer (Phase 2) BEFORE it is
+//            built. If workerd rejects pkcs8-for-sign, Phase 2 takes Approach J.
+//
+// Vectors are generated at runtime (openssl + node:crypto) so cert validity is
+// always current and the P1363 sig is real.
+//
+// Run:  node cloudflare/tests/x509-probe.mjs    (cwd = blocklets/core)
+import { Miniflare } from 'miniflare';
+import { execSync, execFileSync } from 'node:child_process';
+import { generateKeyPairSync, sign as nodeSign, X509Certificate } from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const LEAF_OID = '1.2.840.113635.100.6.11.1'; // Apple: present on the leaf
+const INT_OID = '1.2.840.113635.100.6.2.1'; // Apple: present on the intermediate (ABSENT from our leaf — negative control)
+const SIGNING_INPUT = 'header.payload';
+
+// DER-encode an OID's *content* octets (no 0x06 tag / length) — enough to scan
+// for inside a cert's DER with indexOf (the content is unique enough).
+function oidContentHex(oid) {
+  const parts = oid.split('.').map(Number);
+  const bytes = [40 * parts[0] + parts[1]];
+  for (let i = 2; i < parts.length; i++) {
+    let v = parts[i];
+    const stack = [v & 0x7f];
+    v = Math.floor(v / 128);
+    while (v > 0) {
+      stack.unshift((v & 0x7f) | 0x80);
+      v = Math.floor(v / 128);
+    }
+    bytes.push(...stack);
+  }
+  return Buffer.from(bytes).toString('hex');
+}
+
+// ---- generate vectors (node side) ----
+const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'x509-probe-'));
+const keyPath = path.join(dir, 'leaf.key');
+const certPem = path.join(dir, 'leaf.pem');
+const certDer = path.join(dir, 'leaf.der');
+execSync(`openssl ecparam -name prime256v1 -genkey -noout -out ${keyPath}`, { stdio: 'ignore' });
+// self-signed leaf carrying the Apple LEAF extension OID (value = ASN.1 NULL)
+execSync(
+  `openssl req -new -x509 -key ${keyPath} -out ${certPem} -days 3650 -subj "/CN=apple-leaf-probe" -addext "${LEAF_OID}=DER:0500"`,
+  { stdio: 'ignore' }
+);
+execSync(`openssl x509 -in ${certPem} -outform DER -out ${certDer}`, { stdio: 'ignore' });
+
+const certDerB64 = fs.readFileSync(certDer).toString('base64');
+const keyPem = fs.readFileSync(keyPath, 'utf8');
+// REAL P1363 ES256 signature (raw 64-byte r||s — the JWS form), NOT DER.
+const p1363SigB64 = nodeSign('sha256', Buffer.from(SIGNING_INPUT), { key: keyPem, dsaEncoding: 'ieee-p1363' }).toString(
+  'base64'
+);
+
+// ---- chain_round vectors (0.2): synthetic root → CA int (Apple OID) → leaf (Apple OID) ----
+// Mirrors fixtures/make-chain.ts. The cross-signed leaf shares the int's subject
+// DN but is signed by a DIFFERENT key, so leaf.verify(int.publicKey) MUST fail.
+function buildChain() {
+  const d = fs.mkdtempSync(path.join(os.tmpdir(), 'x509-chain-'));
+  const f = (n) => path.join(d, n);
+  const run = (args) => execFileSync('openssl', args, { cwd: d, stdio: ['ignore', 'pipe', 'pipe'] });
+  const key = (n) => run(['ecparam', '-name', 'prime256v1', '-genkey', '-noout', '-out', f(n)]);
+  const SUBJ_INT = '/CN=Probe Apple WWDR Intermediate';
+  try {
+    key('root.key');
+    run(['req', '-new', '-x509', '-key', f('root.key'), '-out', f('root.pem'), '-days', '3650',
+      '-subj', '/CN=Probe Apple Root CA', '-addext', 'basicConstraints=critical,CA:TRUE']);
+    key('int.key');
+    run(['req', '-new', '-key', f('int.key'), '-out', f('int.csr'), '-subj', SUBJ_INT]);
+    fs.writeFileSync(f('int.ext'), `[v3]\nbasicConstraints=critical,CA:TRUE\n${INT_OID}=DER:0500`);
+    run(['x509', '-req', '-in', f('int.csr'), '-CA', f('root.pem'), '-CAkey', f('root.key'), '-CAcreateserial',
+      '-out', f('int.pem'), '-days', '3650', '-extfile', f('int.ext'), '-extensions', 'v3']);
+    key('leaf.key');
+    run(['req', '-new', '-key', f('leaf.key'), '-out', f('leaf.csr'), '-subj', '/CN=Probe Apple Leaf']);
+    fs.writeFileSync(f('leaf.ext'), `[v3]\nbasicConstraints=critical,CA:FALSE\n${LEAF_OID}=DER:0500`);
+    run(['x509', '-req', '-in', f('leaf.csr'), '-CA', f('int.pem'), '-CAkey', f('int.key'), '-CAcreateserial',
+      '-out', f('leaf.pem'), '-days', '3650', '-extfile', f('leaf.ext'), '-extensions', 'v3']);
+    // wrong intermediate: same subject DN, different key
+    key('wrongint.key');
+    run(['req', '-new', '-x509', '-key', f('wrongint.key'), '-out', f('wrongint.pem'), '-days', '3650',
+      '-subj', SUBJ_INT, '-addext', 'basicConstraints=critical,CA:TRUE']);
+    key('crossleaf.key');
+    run(['req', '-new', '-key', f('crossleaf.key'), '-out', f('crossleaf.csr'), '-subj', '/CN=Probe Apple Leaf']);
+    run(['x509', '-req', '-in', f('crossleaf.csr'), '-CA', f('wrongint.pem'), '-CAkey', f('wrongint.key'),
+      '-CAcreateserial', '-out', f('crossleaf.pem'), '-days', '3650', '-extfile', f('leaf.ext'), '-extensions', 'v3']);
+    const der = (n) => Buffer.from(new X509Certificate(fs.readFileSync(f(n))).raw).toString('base64');
+    return { leaf: der('leaf.pem'), int: der('int.pem'), root: der('root.pem'), crossLeaf: der('crossleaf.pem') };
+  } finally {
+    fs.rmSync(d, { recursive: true, force: true });
+  }
+}
+const chain = buildChain();
+
+// ---- pkcs8_sign_round vectors (0.5): EC P-256 pkcs8 (DER) + its spki, for SIGN ----
+const { privateKey: ecPriv, publicKey: ecPub } = generateKeyPairSync('ec', { namedCurve: 'P-256' });
+const pkcs8B64 = ecPriv.export({ type: 'pkcs8', format: 'der' }).toString('base64');
+const spkiSignB64 = ecPub.export({ type: 'spki', format: 'der' }).toString('base64');
+const badPkcs8B64 = Buffer.from('not-a-real-pkcs8-key').toString('base64');
+
+const script = `
+import { X509Certificate, createVerify } from 'node:crypto';
+import { Buffer } from 'node:buffer';
+
+const CERT_DER_B64   = ${JSON.stringify(certDerB64)};
+const P1363_SIG_B64  = ${JSON.stringify(p1363SigB64)};
+const LEAF_OID_HEX   = ${JSON.stringify(oidContentHex(LEAF_OID))};
+const INT_OID_HEX    = ${JSON.stringify(oidContentHex(INT_OID))};
+const MSG = ${JSON.stringify(SIGNING_INPUT)};
+
+// chain_round (0.2)
+const CHAIN = ${JSON.stringify(chain)};
+// pkcs8_sign_round (0.5)
+const PKCS8_B64      = ${JSON.stringify(pkcs8B64)};
+const SPKI_SIGN_B64  = ${JSON.stringify(spkiSignB64)};
+const BAD_PKCS8_B64  = ${JSON.stringify(badPkcs8B64)};
+
+function ok(v){ return { ok: true, ...v }; }
+function err(e){ return { ok: false, error: String(e && e.message || e) }; }
+function hex(buf){ return Buffer.from(buf).toString('hex'); }
+
+export default {
+  async fetch() {
+    const out = {};
+    const cert = new X509Certificate(Buffer.from(CERT_DER_B64, 'base64'));
+
+    // P1 — export leaf public key as SPKI DER (needed to feed crypto.subtle)
+    let spkiDer = null;
+    try {
+      spkiDer = cert.publicKey.export({ type: 'spki', format: 'der' });
+      out.P1_export_spki_der = ok({ bytes: spkiDer.byteLength ?? spkiDer.length });
+    } catch (e) { out.P1_export_spki_der = err(e); }
+
+    // P2a — verify REAL P1363 ES256 sig via crypto.subtle (preferred)
+    try {
+      if (!spkiDer) throw new Error('no spki from P1');
+      const key = await crypto.subtle.importKey(
+        'spki', spkiDer, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']
+      );
+      const valid = await crypto.subtle.verify(
+        { name: 'ECDSA', hash: 'SHA-256' }, key,
+        Buffer.from(P1363_SIG_B64, 'base64'), new TextEncoder().encode(MSG)
+      );
+      out.P2a_subtle_p1363_verify = ok({ valid });
+    } catch (e) { out.P2a_subtle_p1363_verify = err(e); }
+
+    // P2b — verify REAL P1363 sig via node createVerify dsaEncoding:'ieee-p1363' (fallback)
+    try {
+      const v = createVerify('SHA256');
+      v.update(MSG); v.end();
+      const valid = v.verify({ key: cert.publicKey, dsaEncoding: 'ieee-p1363' }, Buffer.from(P1363_SIG_B64, 'base64'));
+      out.P2b_node_p1363_verify = ok({ valid });
+    } catch (e) { out.P2b_node_p1363_verify = err(e); }
+
+    // P3 — Apple extension-OID presence via indexOf in cert.raw (no ASN.1 lib)
+    try {
+      const rawHex = hex(cert.raw);
+      const leafPresent = rawHex.includes(LEAF_OID_HEX);   // expect TRUE  (we added it)
+      const intPresent  = rawHex.includes(INT_OID_HEX);    // expect FALSE (negative control)
+      // also confirm Node has NO generic extension accessor (documents the gap)
+      const hasGenericExtAccessor =
+        typeof cert.getExtension === 'function' || typeof cert.extensions !== 'undefined';
+      out.P3_oid_scan = ok({
+        rawIsBuffer: cert.raw instanceof Uint8Array,
+        leafOidPresent: leafPresent,
+        intOidPresent: intPresent,
+        hasGenericExtAccessor,
+      });
+    } catch (e) { out.P3_oid_scan = err(e); }
+
+    // chain_round (0.2) — full §5.4 walk + §5.5 OID presence on a 3-cert chain
+    try {
+      const leaf = new X509Certificate(Buffer.from(CHAIN.leaf, 'base64'));
+      const intermediate = new X509Certificate(Buffer.from(CHAIN.int, 'base64'));
+      const root = new X509Certificate(Buffer.from(CHAIN.root, 'base64'));
+      const crossLeaf = new X509Certificate(Buffer.from(CHAIN.crossLeaf, 'base64'));
+      out.chain_round = ok({
+        intVerifiesRoot: intermediate.verify(root.publicKey),
+        leafVerifiesInt: leaf.verify(intermediate.publicKey),
+        leafOidPresent: hex(leaf.raw).includes(LEAF_OID_HEX),
+        intOidPresent: hex(intermediate.raw).includes(INT_OID_HEX),
+        intIsCa: intermediate.ca === true,
+        crossSignedLeafVerifies: crossLeaf.verify(intermediate.publicKey), // expect FALSE
+      });
+    } catch (e) { out.chain_round = err(e); }
+
+    // pkcs8_sign_round (0.5) — importKey('pkcs8') for SIGN + round-trip verify
+    try {
+      const signKey = await crypto.subtle.importKey(
+        'pkcs8', Buffer.from(PKCS8_B64, 'base64'), { name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign']
+      );
+      const sig = await crypto.subtle.sign(
+        { name: 'ECDSA', hash: 'SHA-256' }, signKey, new TextEncoder().encode(MSG)
+      );
+      const verifyKey = await crypto.subtle.importKey(
+        'spki', Buffer.from(SPKI_SIGN_B64, 'base64'), { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']
+      );
+      const roundTripVerifyOk = await crypto.subtle.verify(
+        { name: 'ECDSA', hash: 'SHA-256' }, verifyKey, sig, new TextEncoder().encode(MSG)
+      );
+      // negative control: a malformed pkcs8 must surface as importPkcs8Ok:false, not a silent unsigned key
+      let importBadOk = true;
+      try {
+        await crypto.subtle.importKey(
+          'pkcs8', Buffer.from(BAD_PKCS8_B64, 'base64'), { name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign']
+        );
+      } catch { importBadOk = false; }
+      out.pkcs8_sign_round = ok({
+        importPkcs8Ok: true,
+        signOk: sig.byteLength > 0,
+        roundTripVerifyOk,
+        malformedPkcs8Rejected: importBadOk === false,
+      });
+    } catch (e) { out.pkcs8_sign_round = err(e); }
+
+    return new Response(JSON.stringify(out, null, 2), { headers: { 'content-type': 'application/json' } });
+  }
+};
+`;
+
+const mf = new Miniflare({
+  modules: true,
+  script,
+  compatibilityDate: '2024-12-01',
+  compatibilityFlags: ['nodejs_compat'],
+});
+
+try {
+  const res = await mf.dispatchFetch('http://localhost/');
+  console.log(await res.text());
+} catch (e) {
+  console.error('PROBE FAILED TO RUN:', e);
+  process.exitCode = 1;
+} finally {
+  await mf.dispose();
+  fs.rmSync(dir, { recursive: true, force: true });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "payment-kit",
-  "version": "1.29.6",
+  "version": "1.29.8",
   "scripts": {
     "dev": "blocklet dev --open",
     "prelint": "npm run types",
@@ -47,9 +47,8 @@
   },
   "dependencies": {
     "@abtnode/cron": "^1.17.13-beta-20260613-094425-b81920c8",
-    "@apple/app-store-server-library": "^3.1.0",
     "@arcblock/did": "^1.30.24",
-    "@arcblock/did-connect-js": "^4.0.7",
+    "@arcblock/did-connect-js": "^4.1.0",
     "@arcblock/did-connect-react": "^3.5.4",
     "@arcblock/did-connect-storage-nedb": "^1.8.0",
     "@arcblock/did-util": "^1.30.24",
@@ -61,9 +60,9 @@
     "@blocklet/error": "^0.3.5",
     "@blocklet/js-sdk": "^1.17.13-beta-20260613-094425-b81920c8",
     "@blocklet/logger": "^1.17.13-beta-20260613-094425-b81920c8",
-    "@blocklet/payment-broker-client": "1.29.6",
-    "@blocklet/payment-react": "1.29.6",
-    "@blocklet/payment-vendor": "1.29.6",
+    "@blocklet/payment-broker-client": "1.29.8",
+    "@blocklet/payment-react": "1.29.8",
+    "@blocklet/payment-vendor": "1.29.8",
     "@blocklet/sdk": "^1.17.13-beta-20260613-094425-b81920c8",
     "@blocklet/ui-react": "^3.5.4",
     "@blocklet/uploader": "^0.3.20",
@@ -105,7 +104,6 @@
     "morgan": "^1.10.0",
     "mui-daterange-picker": "^1.0.5",
     "nanoid": "^3.3.11",
-    "node-apple-receipt-verify": "^1.15.0",
     "numbro": "^2.5.0",
     "p-all": "3.0.0",
     "p-wait-for": "^3.2.0",
@@ -135,12 +133,11 @@
   "devDependencies": {
     "@abtnode/types": "^1.17.13-beta-20260613-094425-b81920c8",
     "@arcblock/eslint-config-ts": "^0.3.3",
-    "@blocklet/payment-types": "1.29.6",
+    "@blocklet/payment-types": "1.29.8",
     "@types/connect": "^3.4.38",
     "@types/debug": "^4.1.12",
     "@types/dotenv-flow": "^3.3.3",
     "@types/node": "^18.19.112",
-    "@types/node-apple-receipt-verify": "^1.7.5",
     "@types/react": "^18.3.23",
     "@types/react-dom": "^18.3.7",
     "@vitejs/plugin-react": "^4.6.0",
@@ -183,5 +180,5 @@
       "parser": "typescript"
     }
   },
-  "gitHead": "ee97756d3e9ba56def933580a6cb6bb93d97b55c"
+  "gitHead": "547c0614f1f83abad80ea08452d2f5a9f4f5aa07"
 }

package/api/src/integrations/app-store/node-apple-receipt-verify.d.ts

@@ -1,17 +0,0 @@
-// Minimal ambient declarations for `node-apple-receipt-verify`.
-// The library ships no @types package; we only use config() + validate(),
-// and accept that validate() returns `unknown` items we narrow ourselves.
-
-declare module 'node-apple-receipt-verify' {
-  export interface AppleReceiptConfig {
-    secret?: string;
-    verbose?: boolean;
-    environment?: Array<'production' | 'sandbox'>;
-    /** ignore expired items, default false */
-    ignoreExpired?: boolean;
-    /** extended fields, etc. */
-    [k: string]: any;
-  }
-  export function config(options: AppleReceiptConfig): void;
-  export function validate(options: { receipt: string }): Promise<unknown[]>;
-}