payment-kit 1.29.7 → 1.29.9

package/api/src/service.ts

@@ -275,10 +275,30 @@ export function buildConnectRoutesHono(): Hono {
   // withTenant) we pass through; otherwise we resolve Host→tenant once and wrap.
   connectApp.use('*', async (c, next) => {
     const { context: requestCtx } = require('./libs/context');
-    if (requestCtx.peekInstanceDid()) return next();
+    const { warmTenantIdentity } = require('./libs/did-connect/tenant-identity');
+    // Warm the tenant's signing identity + secrets keyring BEFORE the DID handler so
+    // the synchronous secrets hot path (connect/pay → getStripeClient →
+    // PaymentMethod.decryptSettings) resolves — else it throws "secrets: key for
+    // tenant <did> is not warmed". Mirrors contextMiddleware (context.ts); the native
+    // resource group warms there, but connectApp is mounted ALONGSIDE it (no shared
+    // pipeline), so DID routes must warm themselves. Best-effort + no-op on
+    // blocklet-server (hasDynamicIdentity() === false).
+    const preResolved = requestCtx.peekInstanceDid();
+    if (preResolved) {
+      // Host already scoped this request (e.g. the CF worker wrapped /api/* in
+      // withTenant before the core ran) — run inside that context; warm is idempotent
+      // (cache hit if the host already warmed).
+      await warmTenantIdentity(preResolved);
+      return next();
+    }
+    // arc-node embedded (svc.http.fetch) never pre-wraps: resolve Host→tenant once,
+    // run inside the tenant context, and warm before the handler.
     const { resolveTenantForHost } = require('./libs/drivers/identity');
     const instanceDid = await resolveTenantForHost(c.req.header('host'));
-    return requestCtx.withTenant(instanceDid, () => next());
+    return requestCtx.withTenant(instanceDid, async () => {
+      await warmTenantIdentity(instanceDid);
+      return next();
+    });
   });
 
   for (const h of connectHandlerModules()) handlers.attach(Object.assign({ app: connectApp }, h));
@@ -455,8 +475,20 @@ async function provisionTenant(instanceDid: string): Promise<void> {
   const { PaymentMethod, PaymentCurrency } = require('./store/models');
 
   const CHAINS = [
-    { chainId: 'main', livemode: true, symbol: 'ABT', label: 'ArcBlock Main', contract: 'z35nNRvYxBoHitx9yZ5ATS88psfShzPPBLxYD' },
-    { chainId: 'beta', livemode: false, symbol: 'TBA', label: 'ArcBlock Beta', contract: 'z35n6UoHSi9MED4uaQy6ozFgKPaZj2UKrurBG' },
+    {
+      chainId: 'main',
+      livemode: true,
+      symbol: 'ABT',
+      label: 'ArcBlock Main',
+      contract: 'z35nNRvYxBoHitx9yZ5ATS88psfShzPPBLxYD',
+    },
+    {
+      chainId: 'beta',
+      livemode: false,
+      symbol: 'TBA',
+      label: 'ArcBlock Beta',
+      contract: 'z35n6UoHSi9MED4uaQy6ozFgKPaZj2UKrurBG',
+    },
   ];
 
   await requestContext.withTenant(instanceDid, async () => {
@@ -464,6 +496,11 @@ async function provisionTenant(instanceDid: string): Promise<void> {
     const existing = await PaymentMethod.findOne({ where: { type: 'arcblock' } });
     if (existing) return;
 
+    // Sequential by design: only 2 chains, and within each the currency needs the
+    // method id and the method's default_currency_id needs the currency id — no
+    // intra-chain parallelism is possible, and inter-chain ordering is irrelevant
+    // for two one-time seed inserts.
+    /* eslint-disable no-await-in-loop */
     for (const chain of CHAINS) {
       const logo = '/methods/arcblock.png';
       const method = await PaymentMethod.create({
@@ -507,6 +544,7 @@ async function provisionTenant(instanceDid: string): Promise<void> {
       });
       await method.update({ default_currency_id: currency.id });
     }
+    /* eslint-enable no-await-in-loop */
     logger.info('provisionTenant: seeded arcblock payment methods + currencies', { instanceDid });
   });
 }

package/api/src/store/models/payment-currency.ts

@@ -19,7 +19,7 @@ import type { LiteralUnion } from 'type-fest';
 import { fromTokenToUnit } from '@ocap/util';
 import { TenantModel } from '../tenant-model';
 import { getInstanceDid } from '../../libs/context';
-import { createIdGenerator } from '../../libs/util';
+import { createIdGenerator, getPublicAssetUrl } from '../../libs/util';
 import { RechargeConfig, VaultConfig } from './types';
 
 const nextId = createIdGenerator('pc', 12);
@@ -57,6 +57,12 @@ export class PaymentCurrency extends TenantModel<InferAttributes<PaymentCurrency
   declare recharge_config?: RechargeConfig;
   declare token_config?: Record<string, any> | null;
 
+  public override toJSON(): any {
+    const data = super.toJSON() as any;
+    if (data.logo) data.logo = getPublicAssetUrl(data.logo);
+    return data;
+  }
+
   public static readonly GENESIS_ATTRIBUTES = {
     id: {
       type: DataTypes.STRING(15),

package/api/src/store/models/payment-method.ts

@@ -16,7 +16,7 @@ import { encryptSecret, decryptSecret } from '../../libs/secrets';
 
 import { AppStoreClient } from '../../integrations/app-store/client';
 import { GooglePlayClient } from '../../integrations/google-play/client';
-import { STRIPE_API_VERSION, createIdGenerator } from '../../libs/util';
+import { STRIPE_API_VERSION, createIdGenerator, getPublicAssetUrl } from '../../libs/util';
 import { sequelize } from '../sequelize';
 import type { PaymentMethodSettings } from './types';
 import { CHARGE_SUPPORTED_CHAIN_TYPES, EVM_CHAIN_TYPES } from '../../libs/constants';
@@ -73,6 +73,12 @@ export class PaymentMethod extends TenantModel<InferAttributes<PaymentMethod>, I
   declare created_at: CreationOptional<Date>;
   declare updated_at: CreationOptional<Date>;
 
+  public override toJSON(): any {
+    const data = super.toJSON() as any;
+    if (data.logo) data.logo = getPublicAssetUrl(data.logo);
+    return data;
+  }
+
   public static readonly GENESIS_ATTRIBUTES = {
     id: {
       type: DataTypes.STRING(30),
@@ -170,11 +176,21 @@ export class PaymentMethod extends TenantModel<InferAttributes<PaymentMethod>, I
 
   public static encryptSettings(settings: PaymentMethodSettings) {
     const tmp = cloneDeep(settings);
-    if (tmp.stripe) {
+    // Per-field truthy guards: admin UI submits *all* channel stubs (empty
+    // strings for the ones the user is not configuring), so a parent-level
+    // `if (tmp.stripe)` would gladly enter the branch and call
+    // encryptSecret('') for every empty stub. Under the multi-tenant
+    // KeyringSecretsDriver, CryptoJS.AES.encrypt(undefined, …) throws
+    // "Cannot read properties of undefined (reading 'encrypt')" — the
+    // single-tenant DefaultSecretsDriver swallowed it silently. Field-level
+    // guards make the function robust to either caller shape.
+    if (tmp.stripe?.secret_key) {
       tmp.stripe.secret_key = encryptSecret(tmp.stripe.secret_key);
+    }
+    if (tmp.stripe?.webhook_signing_secret) {
       tmp.stripe.webhook_signing_secret = encryptSecret(tmp.stripe.webhook_signing_secret);
     }
-    if (tmp.google_play) {
+    if (tmp.google_play?.service_account_json) {
       tmp.google_play.service_account_json = encryptSecret(tmp.google_play.service_account_json);
     }
     if (tmp.app_store?.private_key_pem) {
@@ -189,11 +205,16 @@ export class PaymentMethod extends TenantModel<InferAttributes<PaymentMethod>, I
 
   public static decryptSettings(settings: PaymentMethodSettings) {
     const tmp = cloneDeep(settings);
-    if (tmp.stripe) {
+    // Same per-field guard as encryptSettings — empty stubs from the admin
+    // UI roundtrip would otherwise hit decryptSecret('') and explode under
+    // the keyring driver.
+    if (tmp.stripe?.secret_key) {
       tmp.stripe.secret_key = decryptSecret(tmp.stripe.secret_key);
+    }
+    if (tmp.stripe?.webhook_signing_secret) {
       tmp.stripe.webhook_signing_secret = decryptSecret(tmp.stripe.webhook_signing_secret);
     }
-    if (tmp.google_play) {
+    if (tmp.google_play?.service_account_json) {
       tmp.google_play.service_account_json = decryptSecret(tmp.google_play.service_account_json);
     }
     if (tmp.app_store?.private_key_pem) {
@@ -250,7 +271,10 @@ export class PaymentMethod extends TenantModel<InferAttributes<PaymentMethod>, I
       // wallets only decode protobuf-encoded tx bytes. Use `@ocap/client/legacy`
       // (protobuf client) so encode / decode / broadcast all stay protobuf,
       // matching the wallet signatures and what the chain node expects to hash.
-      const created = new OcapClient(host);
+      // Disable the client's implicit getContext() warmup. Its zero-delay timer
+      // can be classified as a permanently hung request by workerd. Callers that
+      // need chain context fetch it explicitly through Worker-safe I/O.
+      const created = new OcapClient(host, false);
       ocapClients.set(host, created);
       return created;
     }

package/api/tests/libs/arcblock-transfer.spec.ts

@@ -0,0 +1,58 @@
+const fetchContext = jest.fn();
+const encodeTx = jest.fn();
+
+jest.mock('@ocap/client/encode', () => ({
+  fetchContext,
+  encodeTx,
+}));
+
+import { encodeArcblockTransfer } from '../../src/libs/arcblock-transfer';
+
+describe('encodeArcblockTransfer', () => {
+  beforeEach(() => {
+    fetchContext.mockReset();
+    encodeTx.mockReset();
+  });
+
+  it('uses the worker-safe context fetcher instead of the OCAP client context timer', async () => {
+    fetchContext.mockResolvedValue({
+      chainId: 'beta',
+      txFee: [{ typeUrl: 'fg:t:transfer_v3', fee: '0' }],
+    });
+    const encoded = {
+      object: { signature: Buffer.from('signed') },
+      buffer: Buffer.from('encoded'),
+    };
+    encodeTx.mockReturnValue(encoded);
+
+    const client = {
+      getContext: jest.fn(() => {
+        throw new Error('must not call timer-backed getContext');
+      }),
+      encodeTransferV3Tx: jest.fn(() => {
+        throw new Error('must not call timer-backed client encoder');
+      }),
+    };
+    const tx = { chainId: '', itx: { typeUrl: 'fg:t:transfer_v3', value: { outputs: [] } } };
+    const wallet = { address: 'zUser', publicKey: 'zPk' };
+
+    await expect(
+      encodeArcblockTransfer({
+        chainHost: 'https://beta.abtnetwork.io/api/',
+        tx,
+        wallet,
+      })
+    ).resolves.toBe(encoded);
+
+    expect(fetchContext).toHaveBeenCalledWith('https://beta.abtnetwork.io/api/');
+    expect(encodeTx).toHaveBeenCalledWith({
+      type: 'TransferV3Tx',
+      tx,
+      wallet,
+      chainId: 'beta',
+      feeConfig: [{ typeUrl: 'fg:t:transfer_v3', fee: '0' }],
+    });
+    expect(client.getContext).not.toHaveBeenCalled();
+    expect(client.encodeTransferV3Tx).not.toHaveBeenCalled();
+  });
+});

package/api/tests/libs/notification-guard.spec.ts

@@ -5,13 +5,17 @@
 // environments" off Blocklet Server (arc-node / CF). The guard no-ops both SDK
 // transports there — at the module level, so app-side logic still runs and only
 // the send/publish is skipped — and leaves Blocklet Server untouched. Gated on the
-// single reusable predicate isBlockletServer() (= BLOCKLET_APP_ID present).
+// single reusable predicate isBlockletServer() (= BLOCKLET_DID present; the CF
+// worker injects BLOCKLET_APP_ID = APP_PID so that can NOT be the marker).
 describe('ensureBlockletSdkTransportGuard', () => {
-  const ORIG = process.env.BLOCKLET_APP_ID;
+  const ORIG = process.env.BLOCKLET_DID;
+  const ORIG_APP_ID = process.env.BLOCKLET_APP_ID;
 
   afterEach(() => {
-    if (ORIG === undefined) delete process.env.BLOCKLET_APP_ID;
-    else process.env.BLOCKLET_APP_ID = ORIG;
+    if (ORIG === undefined) delete process.env.BLOCKLET_DID;
+    else process.env.BLOCKLET_DID = ORIG;
+    if (ORIG_APP_ID === undefined) delete process.env.BLOCKLET_APP_ID;
+    else process.env.BLOCKLET_APP_ID = ORIG_APP_ID;
     jest.resetModules();
   });
 
@@ -33,8 +37,8 @@ describe('ensureBlockletSdkTransportGuard', () => {
     return { notification, eventbus };
   }
 
-  it('off Blocklet Server (no BLOCKLET_APP_ID): no-ops notification + eventbus on module + default', async () => {
-    delete process.env.BLOCKLET_APP_ID;
+  it('off Blocklet Server (no BLOCKLET_DID): no-ops notification + eventbus on module + default', async () => {
+    delete process.env.BLOCKLET_DID;
     const { notification, eventbus } = loadAndGuard();
     for (const target of [notification, notification.default]) {
       expect(target.sendToUser).not.toBe('REAL');
@@ -50,12 +54,25 @@ describe('ensureBlockletSdkTransportGuard', () => {
     }
   });
 
-  it('on Blocklet Server (BLOCKLET_APP_ID set): leaves both transports intact', () => {
-    process.env.BLOCKLET_APP_ID = 'z_app_pid';
+  it('on Blocklet Server (BLOCKLET_DID set): leaves both transports intact', () => {
+    process.env.BLOCKLET_DID = 'z_node_did';
     const { notification, eventbus } = loadAndGuard();
     expect(notification.sendToUser).toBe('REAL');
     expect(notification.default.sendToUser).toBe('REAL');
     expect(eventbus.publish).toBe('REAL');
     expect(eventbus.default.publish).toBe('REAL');
   });
+
+  // Regression: the CF worker injects BLOCKLET_APP_ID = APP_PID for app identity,
+  // which used to make isBlockletServer() spuriously true and skip the guard — then
+  // the SDK transport crashed at send time. With the marker on BLOCKLET_DID, an
+  // APP_ID without a DID is correctly treated as off-Blocklet-Server.
+  it('CF worker (BLOCKLET_APP_ID set, no BLOCKLET_DID): still no-ops the transports', async () => {
+    delete process.env.BLOCKLET_DID;
+    process.env.BLOCKLET_APP_ID = 'z_app_pid';
+    const { notification, eventbus } = loadAndGuard();
+    expect(notification.sendToUser).not.toBe('REAL');
+    expect(eventbus.publish).not.toBe('REAL');
+    await expect(notification.sendToUser('zUser', { title: 't' })).resolves.toBeUndefined();
+  });
 });

package/api/tests/libs/util.spec.ts

@@ -19,12 +19,63 @@ import {
   resolveAddressChainTypes,
   formatCurrencyInfo,
   getExplorerTxUrl,
+  getPublicAssetUrl,
+  stripeEndpoint,
 } from '../../src/libs/util';
+import { setCoreConfig } from '../../src/libs/env';
 import type { Subscription, PaymentMethod, PaymentCurrency } from '../../src/store/models';
 
 import { blocklet } from '../../src/libs/auth';
+import { context } from '../../src/libs/context';
 import logger from '../../src/libs/logger';
 
+describe('stripeEndpoint', () => {
+  afterEach(() => setCoreConfig(undefined));
+
+  it('uses the request-scoped embedded payment public base URL', async () => {
+    const endpoint = await context.run(
+      { publicBaseUrl: 'https://cf-aside.ofind.cn/.well-known/payment' },
+      async () => stripeEndpoint()
+    );
+
+    expect(endpoint).toBe(
+      'https://cf-aside.ofind.cn/.well-known/payment/api/integrations/stripe/webhook'
+    );
+  });
+
+  it('prefers the explicit webhook URL override', async () => {
+    setCoreConfig({ STRIPE_WEBHOOK_URL: 'https://hooks.example.com/stripe' });
+
+    const endpoint = await context.run(
+      { publicBaseUrl: 'https://cf-aside.ofind.cn/.well-known/payment' },
+      async () => stripeEndpoint()
+    );
+
+    expect(endpoint).toBe('https://hooks.example.com/stripe');
+  });
+});
+
+describe('getPublicAssetUrl', () => {
+  afterEach(() => setCoreConfig(undefined));
+
+  it('prefixes root-relative assets with the embedded payment mount', () => {
+    setCoreConfig({ PAYMENT_PUBLIC_BASE_PATH: '/.well-known/payment' });
+    expect(getPublicAssetUrl('/methods/arcblock.png')).toBe('/.well-known/payment/methods/arcblock.png');
+  });
+
+  it('keeps external asset URLs unchanged', () => {
+    setCoreConfig({ PAYMENT_PUBLIC_BASE_PATH: '/.well-known/payment' });
+    expect(getPublicAssetUrl('https://cdn.example.com/arcblock.png')).toBe('https://cdn.example.com/arcblock.png');
+  });
+
+  it('does not duplicate an existing embedded payment mount', () => {
+    setCoreConfig({ PAYMENT_PUBLIC_BASE_PATH: '/.well-known/payment' });
+    expect(getPublicAssetUrl('/.well-known/payment/methods/arcblock.png')).toBe(
+      '/.well-known/payment/methods/arcblock.png'
+    );
+  });
+});
+
 describe('createIdGenerator', () => {
   it('should return a function that generates an ID with the specified prefix and size', () => {
     const generateId = createIdGenerator('test', 10);

package/blocklet.yml

@@ -14,7 +14,7 @@ repository:
   type: git
   url: git+https://github.com/blocklet/payment-kit.git
 specVersion: 1.2.8
-version: 1.29.7
+version: 1.29.9
 logo: logo.png
 files:
   - dist

package/cloudflare/cf-adapter.ts

@@ -47,13 +47,18 @@ import {
   createCronRegistry,
   applyPaymentCoreMigrations,
 } from '../api/src/libs/drivers';
-import type { IdentityDriver } from '../api/src/libs/drivers';
+import type { IdentityDriver, InstanceAppIdentity } from '../api/src/libs/drivers';
 import { flushQueueWork, dispatchDueJobs, getQueueHandler } from '../api/src/libs/queue/runtime';
 import { Sequelize } from './shims/sequelize-d1/sequelize-class';
 import { setDB } from './shims/sequelize-d1/model';
 import { withD1Retry } from './shims/sequelize-d1/retry';
 import { cronInstance } from './shims/cron';
 import { createCloudflareDidConnectRuntime, createCloudflareIdentityDriver } from './did-connect-runtime';
+// Runtime-neutral host glue — single source of truth in the core source tree,
+// shared with the arc-node daemon (via the package main entry's `as string`
+// facade). Re-exported below so existing importers (cf-adapter.spec.ts) keep
+// resolving them from this module.
+import { injectCaller, createTenantProvisioner } from '../api/src/host-glue';
 
 /**
  * The reserved mount prefix for the embedded payment service. The internal
@@ -106,6 +111,14 @@ export interface CloudflarePaymentAdapterOptions {
   /** Per-tenant EK source (semantics aligned with arc-node: connect-service `app:ek` else derive). */
   identity: {
     getAppEk: (instanceDid: string) => Promise<string> | string;
+    /**
+     * Per-instance app signing identity (S3-CF). When the host provides it — arc
+     * reads connect-service settings `app:sk`/`app:psk`, the SAME authority as
+     * getAppEk — it is the authoritative DID-Connect signer source. Optional: when
+     * the host doesn't wire it, the adapter falls back to the AUTH_SERVICE-backed
+     * CF driver (which fails closed if AUTH_SERVICE is also absent).
+     */
+    getInstanceAppIdentity?: (instanceDid: string) => Promise<InstanceAppIdentity> | InstanceAppIdentity;
   };
   /**
    * Host-resolved caller (CF API gate). The adapter injects it as `x-user-did`
@@ -142,52 +155,12 @@ export interface CloudflarePaymentAdapter {
   ensureSchema: () => Promise<string[]>;
 }
 
-/** Client-forged identity headers — always stripped before the host injects the real caller. */
-const USER_HEADERS = ['x-user-did', 'x-user-role', 'x-user-provider', 'x-user-fullname', 'x-user-wallet-os'];
-
-/**
- * CF API gate caller header glue (decision #5). STRIP any client-supplied
- * `x-user-*` first (a forged `x-user-did` would be an auth bypass), then inject the
- * host-resolved caller as canonical headers the core `authenticate()` trusts. No
- * caller → the request runs anonymous (the strip already happened, so it is never
- * forged). Mirrors the standalone worker's identical strip-then-inject.
- */
-export function injectCaller(headers: Headers, caller: CloudflareCallerIdentity | null): void {
-  for (const h of USER_HEADERS) headers.delete(h);
-  if (!caller) return;
-  const canonicalDid = caller.did?.startsWith('did:abt:') ? caller.did : `did:abt:${caller.did}`;
-  headers.set('x-user-did', canonicalDid);
-  headers.set('x-user-role', `blocklet-${caller.role || 'guest'}`);
-  headers.set('x-user-provider', caller.authMethod === 'access-key' ? 'access-key' : caller.authMethod || 'wallet');
-  headers.set('x-user-fullname', encodeURIComponent(caller.displayName || ''));
-  headers.set('x-user-wallet-os', '');
-}
-
-/**
- * Lazy per-tenant provisioning with in-flight dedup. Concurrent first-requests for
- * the same tenant await the SAME provision() call — a Set would let a burst at
- * isolate start double-seed before the DB idempotency guard commits. A resolved
- * promise stays cached so later requests are instant; a FAILED provision is dropped
- * so the next request retries. Null tenant is a no-op. Copied from the node witness
- * (runtimes/node/src/daemon/payment/index.ts:72-105).
- */
-export function createTenantProvisioner(
-  provision: (instanceDid: string) => Promise<void>,
-): (instanceDid: string | null) => Promise<void> {
-  const inflight = new Map<string, Promise<void>>();
-  return (instanceDid) => {
-    if (!instanceDid) return Promise.resolve();
-    let p = inflight.get(instanceDid);
-    if (!p) {
-      p = provision(instanceDid).catch((err) => {
-        inflight.delete(instanceDid); // drop so the next request retries
-        throw err;
-      });
-      inflight.set(instanceDid, p);
-    }
-    return p;
-  };
-}
+// `injectCaller` (CF API gate caller header glue) and `createTenantProvisioner`
+// (lazy-provision in-flight dedup) now live in the runtime-neutral
+// `../api/src/host-glue` — a single source shared with the arc-node daemon (via
+// the package main entry). Re-exported here so existing importers keep resolving
+// them from this module.
+export { injectCaller, createTenantProvisioner };
 
 /** Dependencies for the request handler (factored out so it is testable with a fake service). */
 export interface FetchDeps {
@@ -245,7 +218,11 @@ export function buildFetch(deps: FetchDeps) {
       if (instanceDid) await warmTenantIdentity(instanceDid);
       return deps.svc.http.fetch(forwarded, { basePath: deps.basePath });
     };
-    const res = instanceDid ? await requestContext.withTenant(instanceDid, run) : await run();
+    const requestOrigin = new URL(request.url).origin;
+    const publicBaseUrl = new URL(deps.basePath, `${requestOrigin}/`).href.replace(/\/$/, '');
+    const res = await requestContext.run({ publicBaseUrl }, () =>
+      instanceDid ? requestContext.withTenant(instanceDid, run) : run()
+    );
 
     await deps.flush(); // drain workerd deferred queue work before responding
     return res;
@@ -358,7 +335,13 @@ export async function createCloudflarePaymentAdapter(
   const identity: IdentityDriver = {
     resolveInstanceDidForHost: () => null,
     getAppEk: (instanceDid: string) => options.identity.getAppEk(instanceDid),
-    getInstanceAppIdentity: cfDidConnectIdentity.getInstanceAppIdentity?.bind(cfDidConnectIdentity),
+    // Prefer the host-supplied per-instance identity (arc reads connect-service
+    // settings app:sk/psk — same authority as getAppEk); fall back to the
+    // AUTH_SERVICE-backed CF driver when the host doesn't wire it (the Phase 6
+    // binding). This is what lets arc-embedded CF resolve the DID-Connect signer
+    // without an AUTH_SERVICE service binding.
+    getInstanceAppIdentity:
+      options.identity.getInstanceAppIdentity ?? cfDidConnectIdentity.getInstanceAppIdentity?.bind(cfDidConnectIdentity),
     // per-tenant business wallet (single seam); directory stays the CF alias shim
     getBusinessWallet: cfDidConnectIdentity.getBusinessWallet,
   };
@@ -366,7 +349,11 @@ export async function createCloudflarePaymentAdapter(
   const svc: EmbeddedPaymentService = createEmbeddedPaymentService({
     // Host-global csrf secret via the config boundary (payment-core's csrf reads
     // PAYMENT_CSRF_SECRET through readConfig). NO sessionSecret (decision #5).
-    config: { ...(options.config ?? {}), ...(options.csrfSecret ? { PAYMENT_CSRF_SECRET: options.csrfSecret } : {}) },
+    config: {
+      ...(options.config ?? {}),
+      PAYMENT_PUBLIC_BASE_PATH: basePath,
+      ...(options.csrfSecret ? { PAYMENT_CSRF_SECRET: options.csrfSecret } : {}),
+    },
     db: { sequelize },
     tenancy: { mode: 'multi' },
     identity,
@@ -388,6 +375,15 @@ export async function createCloudflarePaymentAdapter(
     if (typeof (globalThis as any).__flushDeferredTimers === 'function') {
       (globalThis as any).__flushDeferredTimers();
     }
+    // Embedded binding alias: the standalone worker exposes the payment D1 as `DB`,
+    // but under arc the binding is `PAYMENT_DB`. Paths that read `__CF_ENV__.DB`
+    // directly — notably the DID-Connect token store (did-connect-token-storage.ts),
+    // which mints the wallet-pay QR auth token — would otherwise find no `DB` binding
+    // and fail token creation, leaving the QR blank. Alias it to the same payment
+    // database (where `_did_connect_tokens` lives) so those paths match standalone.
+    if (env && !env.DB && env.PAYMENT_DB) {
+      env.DB = env.PAYMENT_DB;
+    }
     (globalThis as any).__CF_ENV__ = env;
     (globalThis as any).__cfHttpContext__ = httpContext;
     (globalThis as any).__cfWaitUntil__ = (p: Promise<any>) => ctx.waitUntil(p);

package/cloudflare/did-connect-runtime.ts

@@ -78,13 +78,51 @@ export function createCloudflareIdentityDriver(): IdentityDriver {
       const cached = cache.get(instanceDid);
       if (cached && cached.expires > Date.now()) return cached.value;
       const svc = authService();
-      if (!svc || typeof svc.getInstanceAppIdentity !== 'function') {
-        throw new Error('[did-connect] AUTH_SERVICE.getInstanceAppIdentity unavailable — fail-closed');
+      // Preferred: the AUTH_SERVICE RPC (multi-tenant / newer blocklet-service resolves
+      // the per-instance app:sk). Fall back to the worker's OWN APP_SK/APP_PSK when the
+      // binding does not implement the method — which is exactly what blocklet-service's
+      // own getInstanceAppIdentity returns for the deployment app (sign.js:
+      // appSk = env.BLOCKLET_APP_SK). In single-tenant mode the instance IS the
+      // deployment app (instanceDid == APP_PID), so the worker's APP_SK is the correct
+      // signer. This makes the standalone worker (and embedded arc CF, which has no
+      // getInstanceAppIdentity RPC) self-sufficient for DID-Connect QR signing.
+      // Try the AUTH_SERVICE RPC first. NOTE: `typeof svc.getInstanceAppIdentity`
+      // is 'function' even on OLD blocklet-service builds (the RPC stub exists) — it
+      // only throws "does not implement the method" at CALL time. So we must catch the
+      // call itself and fall back, not gate on typeof.
+      if (svc && typeof svc.getInstanceAppIdentity === 'function') {
+        try {
+          const value: InstanceAppIdentity = await svc.getInstanceAppIdentity(instanceDid);
+          if (value && value.appSk) {
+            cache.set(instanceDid, { value, expires: Date.now() + TTL_MS });
+            return value;
+          }
+          // RPC reachable but returned nothing usable → fall through to local APP_SK.
+        } catch (err: any) {
+          // RPC not implemented on this AUTH_SERVICE version (or transport error) →
+          // fall through to the local APP_SK identity below.
+          console.warn(
+            '[did-connect] AUTH_SERVICE.getInstanceAppIdentity failed, falling back to local APP_SK:',
+            err?.message || err
+          );
+        }
       }
-      const value: InstanceAppIdentity = await svc.getInstanceAppIdentity(instanceDid);
-      if (!value || !value.appSk) {
-        throw new Error(`[did-connect] getInstanceAppIdentity returned no appSk for "${instanceDid}" — fail-closed`);
+      // Fallback: the worker's OWN APP_SK/APP_PSK — exactly what blocklet-service's
+      // getInstanceAppIdentity returns for the deployment app (sign.js: appSk =
+      // env.BLOCKLET_APP_SK). In single-tenant mode the instance IS the deployment app
+      // (instanceDid == APP_PID), so this is the correct DID-Connect signer. Makes the
+      // standalone worker + embedded arc CF (no getInstanceAppIdentity RPC) self-sufficient.
+      const env = (globalThis as any).__CF_ENV__ || {};
+      const appSk: string | undefined = env.APP_SK;
+      if (!appSk) {
+        throw new Error(
+          '[did-connect] getInstanceAppIdentity unavailable — AUTH_SERVICE lacks the RPC and no local APP_SK to fall back on — fail-closed'
+        );
       }
+      const value: InstanceAppIdentity = {
+        appSk,
+        ...(env.APP_PSK ? { appPsk: env.APP_PSK as string } : {}),
+      };
       cache.set(instanceDid, { value, expires: Date.now() + TTL_MS });
       return value;
     },

package/cloudflare/esbuild-cf-config.cjs

@@ -280,13 +280,18 @@ const alias = {
   'mime-types': s('shims/mime-types.ts'), // 150KB — lightweight shim with common MIME types
   'mime-db': s('shims/noop.ts'),
   ws: s('shims/ws-lite.ts'), //  66KB — native WebSocket wrapper for CF Workers
-  'crypto-js': s('shims/crypto-js-warn.ts'), // 115KB — AES legacy not used, warns if called
-  'crypto-js/aes': s('shims/crypto-js-warn.ts'),
-  'crypto-js/enc-base64': s('shims/noop.ts'),
-  'crypto-js/enc-hex': s('shims/noop.ts'),
-  'crypto-js/enc-latin1': s('shims/noop.ts'),
-  'crypto-js/enc-utf8': s('shims/noop.ts'),
-  'crypto-js/enc-utf16': s('shims/noop.ts'),
+  // crypto-js previously shimmed under the assumption "AES legacy not used".
+  // FALSE since Phase 11 multi-tenant: KeyringSecretsDriver
+  // (api/src/libs/drivers/secrets.ts) uses CryptoJS.AES.encrypt/decrypt for
+  // per-tenant PaymentMethod settings encryption — shimmed-to-warn made
+  // `CryptoJS.AES` undefined at runtime, and admin-side PaymentMethod
+  // create/update crashed with "Cannot read properties of undefined (reading
+  // 'encrypt')". The real bundle is ~115 KB (pure JS, Workers compatible);
+  // shipping the real module is the only correct fix because the same
+  // ciphertext must remain decryptable across node and CF tenants. Sub-path
+  // imports are not used by the payment graph, so we don't need to re-alias
+  // each `crypto-js/...` entry — they'll just no-op-resolve through the main
+  // module if anything ever pulls them.
 
   // Force ESM-only to avoid CJS+ESM double-bundling. These packages ship an
   // exports map with separate import/require conditions, so esbuild picks the

package/cloudflare/tests/cf-adapter.spec.ts

@@ -16,7 +16,8 @@ describe('injectCaller — CF API gate caller header glue (decision #5)', () =>
     const h = new Headers();
     injectCaller(h, { did: 'zUSER', role: 'admin', authMethod: 'passkey', displayName: 'Alice' });
     expect(h.get('x-user-did')).toBe('did:abt:zUSER');
-    expect(h.get('x-user-role')).toBe('blocklet-admin');
+    // raw role — NO `blocklet-` prefix (the core strips it anyway; a prefixed role is wrong)
+    expect(h.get('x-user-role')).toBe('admin');
     expect(h.get('x-user-provider')).toBe('passkey');
     expect(h.get('x-user-fullname')).toBe(encodeURIComponent('Alice'));
   });
@@ -87,7 +88,14 @@ describe('createTenantProvisioner — lazy first-request provisioning, in-flight
 // A fake embedded service: captures what the adapter forwards (headers, raw body,
 // basePath) and the tenant context active at fetch time.
 function fakeSvc() {
-  const seen: { did?: string; role?: string; tenant?: string; basePath?: string; body?: string } = {};
+  const seen: {
+    did?: string;
+    role?: string;
+    tenant?: string;
+    publicBaseUrl?: string;
+    basePath?: string;
+    body?: string;
+  } = {};
   return {
     seen,
     http: {
@@ -95,6 +103,7 @@ function fakeSvc() {
         seen.did = req.headers.get('x-user-did') ?? undefined;
         seen.role = req.headers.get('x-user-role') ?? undefined;
         seen.tenant = requestContext.peekInstanceDid();
+        seen.publicBaseUrl = requestContext.peekPublicBaseUrl();
         seen.basePath = opts?.basePath;
         seen.body = await req.text();
         return new Response('ok', { status: 200 });
@@ -127,6 +136,7 @@ describe('buildFetch — drives the single http.fetch under the tenant context',
     expect(res.status).toBe(200);
     expect(svc.seen.did).toBe('did:abt:zREAL'); // forged stripped, real injected
     expect(svc.seen.tenant).toBe('did:abt:zTENANT'); // ran under withTenant
+    expect(svc.seen.publicBaseUrl).toBe('https://x/.well-known/payment');
     expect(svc.seen.basePath).toBe('/.well-known/payment');
     expect(svc.seen.body).toBe('raw-bytes'); // data-damage: raw body preserved
     expect(flushed).toBe(1);