payment-kit 1.29.7 → 1.29.8

package/api/src/host-glue.ts

@@ -0,0 +1,79 @@
+/**
+ * Runtime-neutral payment host glue (lives in the canonical core source tree).
+ *
+ * Zero runtime dependency (only the Web `Headers` global and `Map`), so it is the
+ * SINGLE source of truth for the host API gate header glue and the lazy-provision
+ * dedup. Two hosts consume it:
+ *   - the CF adapter (`../../cloudflare/cf-adapter.ts`, sibling import), and
+ *   - the arc-node daemon, via the published `@arcblock/payment-service` main
+ *     entry (the barrel re-exposes these through the same `as string` facade it
+ *     uses for the other node-side helpers).
+ * They previously kept hand-mirrored copies that had already drifted (the node
+ * host injected a raw role, the CF adapter prefixed it with `blocklet-`); a single
+ * source removes that drift class.
+ */
+
+/** The reserved mount prefix for the embedded payment service. */
+export const PAYMENT_PREFIX = '/.well-known/payment';
+
+/**
+ * The caller identity the host resolved (host injects it as `x-user-*`; the core
+ * never verifies a `login_token` in-process — the host owns caller resolution).
+ */
+export interface HostCallerIdentity {
+  did: string;
+  role?: string;
+  authMethod?: string;
+  displayName?: string;
+}
+
+/** Client-forged identity headers — always stripped before the host injects the real caller. */
+export const USER_HEADERS = ['x-user-did', 'x-user-role', 'x-user-provider', 'x-user-fullname', 'x-user-wallet-os'];
+
+/**
+ * Host API gate caller header glue (decision #5). STRIP any client-supplied
+ * `x-user-*` first (a forged `x-user-did` would be an auth bypass), then inject the
+ * host-resolved caller as the canonical headers the core `authenticate()` trusts.
+ * No caller → the request runs anonymous (the strip already happened, so it is
+ * never forged).
+ *
+ * `x-user-role` carries the RAW role (e.g. `owner` / `admin`). The core normalizes
+ * it as `(role || '').replace('blocklet-', '') || 'guest'`, so the legacy
+ * `blocklet-` prefix is deliberately NOT added — it was vestigial (the core strips
+ * it either way) and a prefixed role is wrong.
+ */
+export function injectCaller(headers: Headers, caller: HostCallerIdentity | null): void {
+  for (const h of USER_HEADERS) headers.delete(h);
+  if (!caller) return;
+  const canonicalDid = caller.did?.startsWith('did:abt:') ? caller.did : `did:abt:${caller.did}`;
+  headers.set('x-user-did', canonicalDid);
+  headers.set('x-user-role', caller.role || 'guest');
+  headers.set('x-user-provider', caller.authMethod === 'access-key' ? 'access-key' : caller.authMethod || 'wallet');
+  headers.set('x-user-fullname', encodeURIComponent(caller.displayName || ''));
+  headers.set('x-user-wallet-os', '');
+}
+
+/**
+ * Lazy per-tenant provisioning with in-flight dedup. Concurrent first-requests for
+ * the same tenant await the SAME provision() call — a Set would let a burst at
+ * isolate/daemon start double-seed before the DB idempotency guard commits. A
+ * resolved promise stays cached so later requests are instant; a FAILED provision
+ * is dropped so the next request retries. Null tenant is a no-op.
+ */
+export function createTenantProvisioner(
+  provision: (instanceDid: string) => Promise<void>
+): (instanceDid: string | null) => Promise<void> {
+  const inflight = new Map<string, Promise<void>>();
+  return (instanceDid) => {
+    if (!instanceDid) return Promise.resolve();
+    let p = inflight.get(instanceDid);
+    if (!p) {
+      p = provision(instanceDid).catch((err) => {
+        inflight.delete(instanceDid); // drop so the next request retries
+        throw err;
+      });
+      inflight.set(instanceDid, p);
+    }
+    return p;
+  };
+}

package/api/src/libs/env.ts

@@ -57,6 +57,31 @@ const numConfig = (key: string, fallback: number): number => {
   return v ? +v : fallback;
 };
 
+// Unified boolean env parsing. Accepts 1/true/yes/on (truthy) and 0/false/no/off
+// (falsy), case-insensitive; unset / empty / unrecognized → `fallback`. Replaces
+// the ad-hoc `=== '1'` / `=== 'true'` / `!== 'false'` conventions that used to be
+// scattered across these accessors, so operators no longer have to guess whether a
+// flag wants `1` or `true`.
+const TRUTHY = new Set(['1', 'true', 'yes', 'on']);
+const FALSY = new Set(['0', 'false', 'no', 'off']);
+const parseBool = (value: string | undefined, fallback = false): boolean => {
+  if (value === undefined || value === '') return fallback;
+  const v = value.trim().toLowerCase();
+  if (TRUTHY.has(v)) return true;
+  if (FALSY.has(v)) return false;
+  return fallback;
+};
+
+// First non-empty value among keys — used to honor a renamed key while still
+// reading the deprecated alias (new name wins, old name kept as fallback).
+const readConfigAny = (...keys: string[]): string | undefined => {
+  for (const key of keys) {
+    const v = readConfig(key);
+    if (v !== undefined && v !== '') return v;
+  }
+  return undefined;
+};
+
 export const paymentStatCronTime = (): string => '0 1 0 * * *'; // 默认每天一次，计算前一天的
 export const subscriptionCronTime = (): string => readConfig('SUBSCRIPTION_CRON_TIME') || '0 */30 * * * *';
 export const notificationCronTime = (): string => readConfig('NOTIFICATION_CRON_TIME') || '0 5 */6 * * *';
@@ -67,7 +92,6 @@ export const stripeInvoiceCronTime = (): string => readConfig('STRIPE_INVOICE_CR
 export const stripePaymentCronTime = (): string => readConfig('STRIPE_PAYMENT_CRON_TIME') || '0 */20 * * * *';
 export const stripeSubscriptionCronTime = (): string => readConfig('STRIPE_SUBSCRIPTION_CRON_TIME') || '0 10 */8 * * *';
 export const revokeStakeCronTime = (): string => readConfig('REVOKE_STAKE_CRON_TIME') || '0 */5 * * * *';
-export const daysUntilCancel = (): string | undefined => readConfig('DAYS_UNTIL_CANCEL');
 export const meteringSubscriptionDetectionCronTime = (): string =>
   readConfig('METERING_SUBSCRIPTION_DETECTION_CRON_TIME') || '0 0 10 * * *';
 export const overdueDetectionCronTime = (): string => readConfig('OVERDUE_DETECTION_CRON_TIME') || '0 0 10 * * *';
@@ -93,20 +117,26 @@ export const sequelizeOptionsPoolIdle = (): number => numConfig('SEQUELIZE_OPTIO
 
 export const updateDataConcurrency = (): number => numConfig('UPDATE_DATA_CONCURRENCY', 5);
 
-// When set to 'true' or '1', the system stops accepting new orders.
-// Existing checkout sessions can still be viewed but new submissions will be rejected.
+// When truthy, the system stops accepting new orders. Existing checkout sessions
+// can still be viewed but new submissions will be rejected.
+// Renamed PAYMENT_KIT_STOP_ACCEPTING_ORDERS → PAYMENT_STOP_ACCEPTING_ORDERS; the
+// old name is still honored as a deprecated alias.
 export const stopAcceptingOrders = (): boolean =>
-  readConfig('PAYMENT_KIT_STOP_ACCEPTING_ORDERS') === 'true' || readConfig('PAYMENT_KIT_STOP_ACCEPTING_ORDERS') === '1';
+  parseBool(readConfigAny('PAYMENT_STOP_ACCEPTING_ORDERS', 'PAYMENT_KIT_STOP_ACCEPTING_ORDERS'));
 
 export const exchangeRateCacheTTLSeconds = (): number => numConfig('EXCHANGE_RATE_CACHE_TTL_SECONDS', 10 * 60);
 
-// System-level maximum pending amount limit (in token format, e.g., "10")
-// Default is 0 (disabled). Set PAYMENT_KIT_MAX_PENDING_AMOUNT to enable this limit.
-export const systemMaxPendingAmount = (): number => numConfig('PAYMENT_KIT_MAX_PENDING_AMOUNT', 5);
+// System-level maximum pending amount limit (in token format, e.g., "10"). Default 5.
+// Renamed PAYMENT_KIT_MAX_PENDING_AMOUNT → PAYMENT_MAX_PENDING_AMOUNT; the old name
+// is still honored as a deprecated alias.
+export const systemMaxPendingAmount = (): number => {
+  const v = readConfigAny('PAYMENT_MAX_PENDING_AMOUNT', 'PAYMENT_KIT_MAX_PENDING_AMOUNT');
+  return v ? +v : 5;
+};
 
 // Whether a locked price may still be edited. Lazy (reads injected config via
 // the boundary at call time) like every other Phase 8 accessor.
-export const allowChangeLockedPrice = (): boolean => readConfig('PAYMENT_CHANGE_LOCKED_PRICE') === '1';
+export const allowChangeLockedPrice = (): boolean => parseBool(readConfig('PAYMENT_CHANGE_LOCKED_PRICE'));
 
 // ──────────────────────────────────────────────────────────────────────────
 // Phase 8 (W2′): converged accessors. Every read below used to live inline in
@@ -122,7 +152,7 @@ export const isProduction = (): boolean => blockletMode() === 'production';
 export const nodeEnv = (): string | undefined => readConfig('NODE_ENV');
 export const isTestEnv = (): boolean => nodeEnv() === 'test';
 export const isDevelopmentEnv = (): boolean => nodeEnv() === 'development';
-export const enableDevFakeAuth = (): boolean => readConfig('ENABLE_DEV_FAKE_AUTH') === '1';
+export const enableDevFakeAuth = (): boolean => parseBool(readConfig('ENABLE_DEV_FAKE_AUTH'));
 
 // -- tenant mode-source (getTenantMode / getDefaultInstanceDid read these) --
 export const tenantModeRaw = (): string | undefined => readConfig('PAYMENT_TENANT_MODE');
@@ -138,14 +168,14 @@ export const blockletPort = (): string | undefined => readConfig('BLOCKLET_PORT'
 export const blockletMountPoints = (): string | undefined => readConfig('BLOCKLET_MOUNT_POINTS');
 
 // -- integrations --
-export const appStoreWriteEnabled = (): boolean => readConfig('APP_STORE_WRITE_ENABLED') === 'true';
-export const appStoreSkipSignatureVerify = (): boolean => readConfig('APP_STORE_SKIP_SIGNATURE_VERIFY') === 'true';
+export const appStoreWriteEnabled = (): boolean => parseBool(readConfig('APP_STORE_WRITE_ENABLED'));
+export const appStoreSkipSignatureVerify = (): boolean => parseBool(readConfig('APP_STORE_SKIP_SIGNATURE_VERIFY'));
 export const googlePubsubSkipSignatureVerify = (): boolean =>
-  readConfig('GOOGLE_PUBSUB_SKIP_SIGNATURE_VERIFY') === 'true';
+  parseBool(readConfig('GOOGLE_PUBSUB_SKIP_SIGNATURE_VERIFY'));
 export const googlePubsubPushServiceAccount = (): string | undefined =>
   readConfig('GOOGLE_PUBSUB_PUSH_SERVICE_ACCOUNT');
 export const googlePubsubAllowUnverifiedSender = (): boolean =>
-  readConfig('GOOGLE_PUBSUB_ALLOW_UNVERIFIED_SENDER') === 'true';
+  parseBool(readConfig('GOOGLE_PUBSUB_ALLOW_UNVERIFIED_SENDER'));
 export const googlePlayWebhookUrl = (): string | undefined => readConfig('GOOGLE_PLAY_WEBHOOK_URL');
 export const stripeWebhookSecret = (): string | undefined => readConfig('STRIPE_WEBHOOK_SECRET');
 export const iapReconcileBatchSize = (): number => Number(readConfig('IAP_RECONCILE_BATCH_SIZE') ?? '100');
@@ -155,9 +185,12 @@ export const paymentBillingThreshold = (): number => +(readConfig('PAYMENT_BILLI
 export const paymentMinStakeAmount = (): number => +(readConfig('PAYMENT_MIN_STAKE_AMOUNT') as string);
 export const paymentDaysUntilDue = (): string | undefined => readConfig('PAYMENT_DAYS_UNTIL_DUE');
 export const paymentDaysUntilCancel = (): string | undefined => readConfig('PAYMENT_DAYS_UNTIL_CANCEL');
-export const paymentReloadSubscriptionJobs = (): boolean => readConfig('PAYMENT_RELOAD_SUBSCRIPTION_JOBS') === '1';
+export const paymentReloadSubscriptionJobs = (): boolean => parseBool(readConfig('PAYMENT_RELOAD_SUBSCRIPTION_JOBS'));
 export const paymentRateVolatilityThreshold = (): string | undefined => readConfig('PAYMENT_RATE_VOLATILITY_THRESHOLD');
-export const paymentLivemode = (): boolean => readConfig('PAYMENT_LIVEMODE') !== 'false';
+// Defaults to livemode (true) when unset. NOTE: with the unified parser, an
+// explicit falsy value (false/0/no/off) now means testmode — previously ONLY the
+// literal string 'false' did, so PAYMENT_LIVEMODE=0 used to (mis)read as livemode.
+export const paymentLivemode = (): boolean => parseBool(readConfig('PAYMENT_LIVEMODE'), true);
 
 // -- credit queue --
 export const creditLowBalanceThresholdPercentage = (): number =>
@@ -172,8 +205,8 @@ export const creditQueueConcurrency = (): number =>
 export const exchangeRateCacheTTLFromEnv = (): boolean => hasConfig('EXCHANGE_RATE_CACHE_TTL_SECONDS');
 
 // -- store / sequelize logging --
-export const sqlLog = (): boolean => readConfig('SQL_LOG') === '1';
-export const sqlBenchmark = (): boolean => readConfig('SQL_BENCHMARK') === '1';
+export const sqlLog = (): boolean => parseBool(readConfig('SQL_LOG'));
+export const sqlBenchmark = (): boolean => parseBool(readConfig('SQL_BENCHMARK'));
 
 // -- CF worker runtime detection + env mirror (set by cloudflare/worker.ts on
 //    globalThis; the boundary so core never reads the global directly) --
@@ -184,17 +217,26 @@ export const isCfWorker = (): boolean => !!cfEnv();
  * THE single, reusable gate for Blocklet-Server-ONLY features.
  *
  * True only under Blocklet Server, where the full @blocklet/sdk host runtime is
- * present — BLOCKLET_APP_ID plus the rest of the env the SDK's
- * `checkBlockletEnvironment` requires (BLOCKLET_DID / BLOCKLET_APP_EK / ABT_NODE_*).
- * BLOCKLET_APP_ID is the canonical marker; arc-node and the CF worker run the
- * embedded core with NONE of it.
+ * present — the env the SDK's `checkBlockletEnvironment` requires (BLOCKLET_APP_ID /
+ * BLOCKLET_DID / BLOCKLET_APP_EK / ABT_NODE_*).
+ *
+ * Keyed on BLOCKLET_DID, NOT BLOCKLET_APP_ID: the CF worker injects
+ * BLOCKLET_APP_ID = APP_PID into the config slot (cloudflare/worker.ts
+ * envToPaymentCoreConfig — blockletAppId() legitimately needs it for app identity
+ * in auth.ts / util.ts), which made the old BLOCKLET_APP_ID check spuriously true
+ * on CF and defeated the transport guard below. BLOCKLET_DID is supplied only by
+ * the real Blocklet Server runtime — the CF worker uses APP_PID for the node DID
+ * and never sets BLOCKLET_DID in config, and arc-node never injects it — so it
+ * cleanly distinguishes the three hosts. (BLOCKLET_APP_EK would also be BS-only in
+ * production, but the test harness sets it for the crypto shim, so DID is the
+ * unambiguous discriminator.)
  *
  * Any integration that only works on Blocklet Server (the @blocklet/sdk
  * notification / eventbus / relay transports, and any future host-service feature)
  * MUST gate on this and skip itself off Blocklet Server — never branch on
  * isCfWorker()/hasDynamicIdentity() ad hoc, so "what is BS-only" stays in one place.
  */
-export const isBlockletServer = (): boolean => hasConfig('BLOCKLET_APP_ID');
+export const isBlockletServer = (): boolean => hasConfig('BLOCKLET_DID');
 
 export default {
   ...env,

package/api/src/routes/hono/credit-grants.ts

@@ -394,7 +394,7 @@ app.get('/verify-availability', authMine, async (c) => {
     const pendingAmountBN = new BN(pendingAmount);
 
     // 5. Check system-level maximum pending amount limit (highest priority, cannot be bypassed)
-    // systemMaxPendingAmount() is configured via PAYMENT_KIT_MAX_PENDING_AMOUNT (in token format)
+    // systemMaxPendingAmount() is configured via PAYMENT_MAX_PENDING_AMOUNT (in token format)
     if (systemMaxPendingAmount() > 0 && pendingAmountBN.gt(new BN(0))) {
       const systemMaxPendingAmountBN = fromTokenToUnit(
         trimDecimals(String(systemMaxPendingAmount()), currency.decimal),

package/api/tests/libs/notification-guard.spec.ts

@@ -5,13 +5,17 @@
 // environments" off Blocklet Server (arc-node / CF). The guard no-ops both SDK
 // transports there — at the module level, so app-side logic still runs and only
 // the send/publish is skipped — and leaves Blocklet Server untouched. Gated on the
-// single reusable predicate isBlockletServer() (= BLOCKLET_APP_ID present).
+// single reusable predicate isBlockletServer() (= BLOCKLET_DID present; the CF
+// worker injects BLOCKLET_APP_ID = APP_PID so that can NOT be the marker).
 describe('ensureBlockletSdkTransportGuard', () => {
-  const ORIG = process.env.BLOCKLET_APP_ID;
+  const ORIG = process.env.BLOCKLET_DID;
+  const ORIG_APP_ID = process.env.BLOCKLET_APP_ID;
 
   afterEach(() => {
-    if (ORIG === undefined) delete process.env.BLOCKLET_APP_ID;
-    else process.env.BLOCKLET_APP_ID = ORIG;
+    if (ORIG === undefined) delete process.env.BLOCKLET_DID;
+    else process.env.BLOCKLET_DID = ORIG;
+    if (ORIG_APP_ID === undefined) delete process.env.BLOCKLET_APP_ID;
+    else process.env.BLOCKLET_APP_ID = ORIG_APP_ID;
     jest.resetModules();
   });
 
@@ -33,8 +37,8 @@ describe('ensureBlockletSdkTransportGuard', () => {
     return { notification, eventbus };
   }
 
-  it('off Blocklet Server (no BLOCKLET_APP_ID): no-ops notification + eventbus on module + default', async () => {
-    delete process.env.BLOCKLET_APP_ID;
+  it('off Blocklet Server (no BLOCKLET_DID): no-ops notification + eventbus on module + default', async () => {
+    delete process.env.BLOCKLET_DID;
     const { notification, eventbus } = loadAndGuard();
     for (const target of [notification, notification.default]) {
       expect(target.sendToUser).not.toBe('REAL');
@@ -50,12 +54,25 @@ describe('ensureBlockletSdkTransportGuard', () => {
     }
   });
 
-  it('on Blocklet Server (BLOCKLET_APP_ID set): leaves both transports intact', () => {
-    process.env.BLOCKLET_APP_ID = 'z_app_pid';
+  it('on Blocklet Server (BLOCKLET_DID set): leaves both transports intact', () => {
+    process.env.BLOCKLET_DID = 'z_node_did';
     const { notification, eventbus } = loadAndGuard();
     expect(notification.sendToUser).toBe('REAL');
     expect(notification.default.sendToUser).toBe('REAL');
     expect(eventbus.publish).toBe('REAL');
     expect(eventbus.default.publish).toBe('REAL');
   });
+
+  // Regression: the CF worker injects BLOCKLET_APP_ID = APP_PID for app identity,
+  // which used to make isBlockletServer() spuriously true and skip the guard — then
+  // the SDK transport crashed at send time. With the marker on BLOCKLET_DID, an
+  // APP_ID without a DID is correctly treated as off-Blocklet-Server.
+  it('CF worker (BLOCKLET_APP_ID set, no BLOCKLET_DID): still no-ops the transports', async () => {
+    delete process.env.BLOCKLET_DID;
+    process.env.BLOCKLET_APP_ID = 'z_app_pid';
+    const { notification, eventbus } = loadAndGuard();
+    expect(notification.sendToUser).not.toBe('REAL');
+    expect(eventbus.publish).not.toBe('REAL');
+    await expect(notification.sendToUser('zUser', { title: 't' })).resolves.toBeUndefined();
+  });
 });

package/blocklet.yml

@@ -14,7 +14,7 @@ repository:
   type: git
   url: git+https://github.com/blocklet/payment-kit.git
 specVersion: 1.2.8
-version: 1.29.7
+version: 1.29.8
 logo: logo.png
 files:
   - dist

package/cloudflare/cf-adapter.ts

@@ -54,6 +54,11 @@ import { setDB } from './shims/sequelize-d1/model';
 import { withD1Retry } from './shims/sequelize-d1/retry';
 import { cronInstance } from './shims/cron';
 import { createCloudflareDidConnectRuntime, createCloudflareIdentityDriver } from './did-connect-runtime';
+// Runtime-neutral host glue — single source of truth in the core source tree,
+// shared with the arc-node daemon (via the package main entry's `as string`
+// facade). Re-exported below so existing importers (cf-adapter.spec.ts) keep
+// resolving them from this module.
+import { injectCaller, createTenantProvisioner } from '../api/src/host-glue';
 
 /**
  * The reserved mount prefix for the embedded payment service. The internal
@@ -142,52 +147,12 @@ export interface CloudflarePaymentAdapter {
   ensureSchema: () => Promise<string[]>;
 }
 
-/** Client-forged identity headers — always stripped before the host injects the real caller. */
-const USER_HEADERS = ['x-user-did', 'x-user-role', 'x-user-provider', 'x-user-fullname', 'x-user-wallet-os'];
-
-/**
- * CF API gate caller header glue (decision #5). STRIP any client-supplied
- * `x-user-*` first (a forged `x-user-did` would be an auth bypass), then inject the
- * host-resolved caller as canonical headers the core `authenticate()` trusts. No
- * caller → the request runs anonymous (the strip already happened, so it is never
- * forged). Mirrors the standalone worker's identical strip-then-inject.
- */
-export function injectCaller(headers: Headers, caller: CloudflareCallerIdentity | null): void {
-  for (const h of USER_HEADERS) headers.delete(h);
-  if (!caller) return;
-  const canonicalDid = caller.did?.startsWith('did:abt:') ? caller.did : `did:abt:${caller.did}`;
-  headers.set('x-user-did', canonicalDid);
-  headers.set('x-user-role', `blocklet-${caller.role || 'guest'}`);
-  headers.set('x-user-provider', caller.authMethod === 'access-key' ? 'access-key' : caller.authMethod || 'wallet');
-  headers.set('x-user-fullname', encodeURIComponent(caller.displayName || ''));
-  headers.set('x-user-wallet-os', '');
-}
-
-/**
- * Lazy per-tenant provisioning with in-flight dedup. Concurrent first-requests for
- * the same tenant await the SAME provision() call — a Set would let a burst at
- * isolate start double-seed before the DB idempotency guard commits. A resolved
- * promise stays cached so later requests are instant; a FAILED provision is dropped
- * so the next request retries. Null tenant is a no-op. Copied from the node witness
- * (runtimes/node/src/daemon/payment/index.ts:72-105).
- */
-export function createTenantProvisioner(
-  provision: (instanceDid: string) => Promise<void>,
-): (instanceDid: string | null) => Promise<void> {
-  const inflight = new Map<string, Promise<void>>();
-  return (instanceDid) => {
-    if (!instanceDid) return Promise.resolve();
-    let p = inflight.get(instanceDid);
-    if (!p) {
-      p = provision(instanceDid).catch((err) => {
-        inflight.delete(instanceDid); // drop so the next request retries
-        throw err;
-      });
-      inflight.set(instanceDid, p);
-    }
-    return p;
-  };
-}
+// `injectCaller` (CF API gate caller header glue) and `createTenantProvisioner`
+// (lazy-provision in-flight dedup) now live in the runtime-neutral
+// `../api/src/host-glue` — a single source shared with the arc-node daemon (via
+// the package main entry). Re-exported here so existing importers keep resolving
+// them from this module.
+export { injectCaller, createTenantProvisioner };
 
 /** Dependencies for the request handler (factored out so it is testable with a fake service). */
 export interface FetchDeps {

package/cloudflare/tests/cf-adapter.spec.ts

@@ -16,7 +16,8 @@ describe('injectCaller — CF API gate caller header glue (decision #5)', () =>
     const h = new Headers();
     injectCaller(h, { did: 'zUSER', role: 'admin', authMethod: 'passkey', displayName: 'Alice' });
     expect(h.get('x-user-did')).toBe('did:abt:zUSER');
-    expect(h.get('x-user-role')).toBe('blocklet-admin');
+    // raw role — NO `blocklet-` prefix (the core strips it anyway; a prefixed role is wrong)
+    expect(h.get('x-user-role')).toBe('admin');
     expect(h.get('x-user-provider')).toBe('passkey');
     expect(h.get('x-user-fullname')).toBe(encodeURIComponent('Alice'));
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "payment-kit",
-  "version": "1.29.7",
+  "version": "1.29.8",
   "scripts": {
     "dev": "blocklet dev --open",
     "prelint": "npm run types",
@@ -48,7 +48,7 @@
   "dependencies": {
     "@abtnode/cron": "^1.17.13-beta-20260613-094425-b81920c8",
     "@arcblock/did": "^1.30.24",
-    "@arcblock/did-connect-js": "^4.0.7",
+    "@arcblock/did-connect-js": "^4.1.0",
     "@arcblock/did-connect-react": "^3.5.4",
     "@arcblock/did-connect-storage-nedb": "^1.8.0",
     "@arcblock/did-util": "^1.30.24",
@@ -60,9 +60,9 @@
     "@blocklet/error": "^0.3.5",
     "@blocklet/js-sdk": "^1.17.13-beta-20260613-094425-b81920c8",
     "@blocklet/logger": "^1.17.13-beta-20260613-094425-b81920c8",
-    "@blocklet/payment-broker-client": "1.29.7",
-    "@blocklet/payment-react": "1.29.7",
-    "@blocklet/payment-vendor": "1.29.7",
+    "@blocklet/payment-broker-client": "1.29.8",
+    "@blocklet/payment-react": "1.29.8",
+    "@blocklet/payment-vendor": "1.29.8",
     "@blocklet/sdk": "^1.17.13-beta-20260613-094425-b81920c8",
     "@blocklet/ui-react": "^3.5.4",
     "@blocklet/uploader": "^0.3.20",
@@ -133,7 +133,7 @@
   "devDependencies": {
     "@abtnode/types": "^1.17.13-beta-20260613-094425-b81920c8",
     "@arcblock/eslint-config-ts": "^0.3.3",
-    "@blocklet/payment-types": "1.29.7",
+    "@blocklet/payment-types": "1.29.8",
     "@types/connect": "^3.4.38",
     "@types/debug": "^4.1.12",
     "@types/dotenv-flow": "^3.3.3",
@@ -180,5 +180,5 @@
       "parser": "typescript"
     }
   },
-  "gitHead": "e1999aecfa9ce64bfd56da14bf47b255a19ef394"
+  "gitHead": "547c0614f1f83abad80ea08452d2f5a9f4f5aa07"
 }