payment-kit 1.29.8 → 1.29.10

package/api/src/middlewares/hono/session.ts

@@ -104,6 +104,28 @@ export function sessionMiddleware(options: SessionOptions = {}): MiddlewareHandl
       return c.json({ error: err.message }, 401);
     }
 
+    // Embedded / blocklet-server PRIMARY auth path. The host adapter (arc-node CF
+    // gate via cf-adapter.injectCaller, or blocklet-server) verifies the caller
+    // upstream, STRIPS any client-forged `x-user-*`, then injects the real caller as
+    // `x-user-*` headers — exactly what authenticate() (security.ts) already trusts.
+    // sessionMiddleware historically only checked the login_token cookie, so under
+    // embedded (where the login_token is arc's, NOT verifiable by payment's
+    // @blocklet/sdk verifyLoginToken) session-scoped routes like /customers/me saw
+    // no user and 403'd even for a logged-in caller — which left the checkout
+    // customer form unpopulated. Honor the injected identity as a fallback.
+    if (!result) {
+      const injectedDid = c.req.header('x-user-did');
+      if (injectedDid) {
+        result = {
+          did: injectedDid,
+          role: c.req.header('x-user-role'),
+          provider: c.req.header('x-user-provider'),
+          fullName: decodeURIComponent(c.req.header('x-user-fullname') || ''),
+          walletOS: c.req.header('x-user-wallet-os') || '',
+        };
+      }
+    }
+
     if (result) {
       c.set('user', result);
     }

package/api/src/routes/connect/pay.ts

@@ -5,6 +5,7 @@ import { fromAddress } from '@ocap/wallet';
 import { encodeTransferItx } from '../../integrations/ethereum/token';
 import { executeEvmTransaction, waitForEvmTxConfirm } from '../../integrations/ethereum/tx';
 import { CallbackArgs, ethWallet } from '../../libs/auth';
+import { encodeArcblockTransfer } from '../../libs/arcblock-transfer';
 import logger from '../../libs/logger';
 import { parseChainError } from '../../libs/chain-error';
 import { getGasPayerExtra } from '../../libs/payment';
@@ -127,25 +128,36 @@ export default {
 
     if (paymentMethod.type === 'arcblock') {
       try {
-        await paymentIntent.update({ status: 'processing' });
         const client = paymentMethod.getOcapClient();
         const claim = claims.find((x) => x.type === 'prepareTx');
 
-        // Warm up chain context cache to avoid setTimeout(resolve,0) hang in workerd
-        await client.getContext();
-
         const tx: Partial<Transaction> = client.decodeTx(claim.finalTx);
         if (claim.delegator && claim.from) {
           tx.delegator = claim.delegator;
           tx.from = claim.from;
         }
 
-        // @ts-ignore
-        const { buffer } = await client.encodeTransferV3Tx({ tx });
+        const chainHost = paymentMethod.settings.arcblock?.api_host;
+        if (!chainHost) {
+          throw new Error('ArcBlock payment method API host is missing');
+        }
+        const signingWallet = fromAddress(userDid);
+        const { object: encodedTx, buffer } = await encodeArcblockTransfer({
+          chainHost,
+          tx,
+          wallet: signingWallet,
+        });
+        const gasPayerExtra = await getGasPayerExtra(buffer, client.pickGasPayerHeaders(request), client);
+
+        // Only expose processing after all cold-start preparation has completed.
+        // If context fetching/encoding is canceled by workerd, the intent remains
+        // retryable instead of being stranded in processing without a tx hash.
+        await paymentIntent.update({ status: 'processing' });
         const txHash = await client.sendTransferV3Tx(
-          // @ts-ignore
-          { tx, wallet: fromAddress(userDid) },
-          await getGasPayerExtra(buffer, client.pickGasPayerHeaders(request), client)
+          // Passing the already-encoded signature skips the client's timer-backed
+          // encodeTransferV3Tx/getContext path in Cloudflare Workers.
+          { tx: encodedTx as any, wallet: signingWallet, signature: encodedTx.signature },
+          gasPayerExtra
         );
 
         const quoteValidation = await validateQuoteForPayment({

package/api/src/routes/hono/checkout-sessions.ts

@@ -21,13 +21,18 @@ import { Hono } from 'hono';
 import { CustomError, formatError, getStatusFromError } from '@blocklet/error';
 import pAll from 'p-all';
 import { withQuery } from 'ufo';
-import { paymentRateVolatilityThreshold, updateDataConcurrency, stopAcceptingOrders } from '../../libs/env';
+import {
+  paymentRateVolatilityThreshold,
+  updateDataConcurrency,
+  stopAcceptingOrders,
+  isBlockletServer,
+} from '../../libs/env';
 import { MetadataSchema } from '../../libs/api';
 import { checkPassportForPaymentLink } from '../../integrations/blocklet/passport';
 import dayjs from '../../libs/dayjs';
 import logger from '../../libs/logger';
 import { trimDecimals } from '../../libs/math-utils';
-import { authenticate } from '../../middlewares/hono/security';
+import { authenticate, isSameDid } from '../../middlewares/hono/security';
 import {
   buildSlippageSnapshot,
   DEFAULT_SLIPPAGE_PERCENT,
@@ -131,6 +136,7 @@ import { getExchangeRateService } from '../../libs/exchange-rate/service';
 import { getExchangeRateSymbol } from '../../libs/exchange-rate/token-address-mapping';
 import { sequelize } from '../../store/sequelize';
 import { sessionMiddleware } from '../../middlewares/hono/session';
+import { reconcileStripeCheckoutSession } from '../../integrations/stripe/reconcile-checkout';
 
 const app = new Hono();
 
@@ -1475,6 +1481,29 @@ app.get('/status/:id', user, async (c) => {
   });
 });
 
+app.post('/:id/stripe-reconcile', user, async (c) => {
+  const currentUser = c.get('user');
+  if (!currentUser) {
+    return c.json({ error: 'Unauthorized' }, 403);
+  }
+  const doc = await CheckoutSession.findByPk(c.req.param('id'), {
+    attributes: ['id', 'customer_did'],
+  });
+  if (!doc) {
+    return c.json({ error: 'Checkout session not found' }, 404);
+  }
+  if (!['owner', 'admin'].includes(currentUser.role) && !isSameDid(doc.customer_did, currentUser.did)) {
+    return c.json({ error: 'Not authorized to reconcile this checkout session' }, 403);
+  }
+
+  try {
+    return c.json(await reconcileStripeCheckoutSession(doc.id));
+  } catch (err: any) {
+    logger.error('stripe checkout reconciliation failed', { checkoutSessionId: doc.id, error: err });
+    return c.json({ error: err.message }, 502);
+  }
+});
+
 // Static prefix /retrieve/:id registered before /:id to avoid shadowing.
 app.get('/retrieve/:id', user, async (c) => {
   const doc = await CheckoutSession.findByPk(c.req.param('id'));
@@ -2808,21 +2837,27 @@ app.put('/:id/submit', user, ensureCheckoutSessionOpen, async (c) => {
         invoice_prefix: Customer.getInvoicePrefix(),
       });
       logger.info('customer created on checkout session submit', { did: c.get('user').did, id: customer.id });
-      try {
-        await blocklet.updateUserAddress(
-          {
-            did: customer.did,
-            address: Customer.formatAddressFromCustomer(customer),
-          },
-          {
-            headers: {
-              cookie: c.req.header('cookie') || '',
+      // Sync address to the blocklet-server user service ONLY on blocklet-server.
+      // arc/CF embedded has no such service — `blocklet.updateUserAddress` is undefined
+      // there. The address is already persisted on the payment Customer model above,
+      // so embedded hosts simply skip this (was a swallowed "is not a function" error).
+      if (isBlockletServer()) {
+        try {
+          await blocklet.updateUserAddress(
+            {
+              did: customer.did,
+              address: Customer.formatAddressFromCustomer(customer),
             },
-          }
-        );
-        logger.info('updateUserAddress success', { did: customer.did });
-      } catch (err) {
-        logger.error('updateUserAddress failed', { error: err, customerId: customer.id });
+            {
+              headers: {
+                cookie: c.req.header('cookie') || '',
+              },
+            }
+          );
+          logger.info('updateUserAddress success', { did: customer.did });
+        } catch (err) {
+          logger.error('updateUserAddress failed', { error: err, customerId: customer.id });
+        }
       }
     } else {
       const updates: Record<string, any> = {};
@@ -2850,23 +2885,27 @@ app.put('/:id/submit', user, ensureCheckoutSessionOpen, async (c) => {
         await customer.update(updates);
         logger.info('customer updated', { did: customer.did });
 
-        try {
-          await blocklet.updateUserAddress(
-            {
-              did: customer.did,
-              address: Customer.formatAddressFromCustomer(customer),
-              // @ts-ignore
-              phone: customer.phone,
-            },
-            {
-              headers: {
-                cookie: c.req.header('cookie') || '',
+        // Blocklet-server only (see note above); embedded hosts already have the
+        // address on the payment Customer model and have no user service to sync to.
+        if (isBlockletServer()) {
+          try {
+            await blocklet.updateUserAddress(
+              {
+                did: customer.did,
+                address: Customer.formatAddressFromCustomer(customer),
+                // @ts-ignore
+                phone: customer.phone,
               },
-            }
-          );
-          logger.info('updateUserAddress success', { did: customer.did });
-        } catch (err) {
-          logger.error('updateUserAddress failed', { error: err, customerId: customer.id });
+              {
+                headers: {
+                  cookie: c.req.header('cookie') || '',
+                },
+              }
+            );
+            logger.info('updateUserAddress success', { did: customer.did });
+          } catch (err) {
+            logger.error('updateUserAddress failed', { error: err, customerId: customer.id });
+          }
         }
       }
     }

package/api/src/routes/hono/entitlements.ts

@@ -26,7 +26,14 @@ import { PaymentMethod } from '../../store/models';
 const app = new Hono();
 // component+owner/admin for cross-blocklet calls; ensureLogin for end users —
 // handler then enforces that non-admin users can only query their own DID.
-const auth = authenticate<PaymentMethod>({ component: true, roles: ['owner', 'admin'], ensureLogin: true });
+// Any signed-in user can query their OWN entitlements (the handler bodies
+// below already gate cross-customer reads via isSelf(...) + isAdminUser).
+// A roles-list here would block normal wallet users at the middleware (their
+// role is "user", not owner/admin) before isSelf ever runs, so the IAP
+// "Subscribe + check my own entitlement" loop returned 403 for every real
+// end user. Keep `component: true` so server-to-server signed calls bypass
+// auth as before; keep `ensureLogin` so unauthenticated requests still 401.
+const auth = authenticate<PaymentMethod>({ component: true, ensureLogin: true });
 
 function isAdminUser(role?: string): boolean {
   return role === 'owner' || role === 'admin';

package/api/src/routes/hono/payment-methods.ts

@@ -109,7 +109,9 @@ app.post('/', auth, async (c) => {
 
     await method.update({ default_currency_id: currency.id });
 
-    ensureWebhookRegistered().catch(console.error);
+    ensureWebhookRegistered().catch((err) =>
+      logger.error('ensureWebhookRegistered failed (payments may not reconcile in real-time)', err)
+    );
 
     return c.json({ ...method.toJSON(), payment_currencies: [currency.toJSON()] });
   }
@@ -532,7 +534,9 @@ app.put('/:id', auth, async (c) => {
 
     const updatedMethod = await method.update(updateData);
     if (method.type === 'stripe') {
-      ensureWebhookRegistered().catch(console.error);
+      ensureWebhookRegistered().catch((err) =>
+        logger.error('ensureWebhookRegistered failed (payments may not reconcile in real-time)', err)
+      );
     }
     return c.json(updatedMethod);
   } catch (err) {

package/api/src/service.ts

@@ -275,10 +275,30 @@ export function buildConnectRoutesHono(): Hono {
   // withTenant) we pass through; otherwise we resolve Host→tenant once and wrap.
   connectApp.use('*', async (c, next) => {
     const { context: requestCtx } = require('./libs/context');
-    if (requestCtx.peekInstanceDid()) return next();
+    const { warmTenantIdentity } = require('./libs/did-connect/tenant-identity');
+    // Warm the tenant's signing identity + secrets keyring BEFORE the DID handler so
+    // the synchronous secrets hot path (connect/pay → getStripeClient →
+    // PaymentMethod.decryptSettings) resolves — else it throws "secrets: key for
+    // tenant <did> is not warmed". Mirrors contextMiddleware (context.ts); the native
+    // resource group warms there, but connectApp is mounted ALONGSIDE it (no shared
+    // pipeline), so DID routes must warm themselves. Best-effort + no-op on
+    // blocklet-server (hasDynamicIdentity() === false).
+    const preResolved = requestCtx.peekInstanceDid();
+    if (preResolved) {
+      // Host already scoped this request (e.g. the CF worker wrapped /api/* in
+      // withTenant before the core ran) — run inside that context; warm is idempotent
+      // (cache hit if the host already warmed).
+      await warmTenantIdentity(preResolved);
+      return next();
+    }
+    // arc-node embedded (svc.http.fetch) never pre-wraps: resolve Host→tenant once,
+    // run inside the tenant context, and warm before the handler.
     const { resolveTenantForHost } = require('./libs/drivers/identity');
     const instanceDid = await resolveTenantForHost(c.req.header('host'));
-    return requestCtx.withTenant(instanceDid, () => next());
+    return requestCtx.withTenant(instanceDid, async () => {
+      await warmTenantIdentity(instanceDid);
+      return next();
+    });
   });
 
   for (const h of connectHandlerModules()) handlers.attach(Object.assign({ app: connectApp }, h));
@@ -455,8 +475,20 @@ async function provisionTenant(instanceDid: string): Promise<void> {
   const { PaymentMethod, PaymentCurrency } = require('./store/models');
 
   const CHAINS = [
-    { chainId: 'main', livemode: true, symbol: 'ABT', label: 'ArcBlock Main', contract: 'z35nNRvYxBoHitx9yZ5ATS88psfShzPPBLxYD' },
-    { chainId: 'beta', livemode: false, symbol: 'TBA', label: 'ArcBlock Beta', contract: 'z35n6UoHSi9MED4uaQy6ozFgKPaZj2UKrurBG' },
+    {
+      chainId: 'main',
+      livemode: true,
+      symbol: 'ABT',
+      label: 'ArcBlock Main',
+      contract: 'z35nNRvYxBoHitx9yZ5ATS88psfShzPPBLxYD',
+    },
+    {
+      chainId: 'beta',
+      livemode: false,
+      symbol: 'TBA',
+      label: 'ArcBlock Beta',
+      contract: 'z35n6UoHSi9MED4uaQy6ozFgKPaZj2UKrurBG',
+    },
   ];
 
   await requestContext.withTenant(instanceDid, async () => {
@@ -464,6 +496,11 @@ async function provisionTenant(instanceDid: string): Promise<void> {
     const existing = await PaymentMethod.findOne({ where: { type: 'arcblock' } });
     if (existing) return;
 
+    // Sequential by design: only 2 chains, and within each the currency needs the
+    // method id and the method's default_currency_id needs the currency id — no
+    // intra-chain parallelism is possible, and inter-chain ordering is irrelevant
+    // for two one-time seed inserts.
+    /* eslint-disable no-await-in-loop */
     for (const chain of CHAINS) {
       const logo = '/methods/arcblock.png';
       const method = await PaymentMethod.create({
@@ -507,6 +544,7 @@ async function provisionTenant(instanceDid: string): Promise<void> {
       });
       await method.update({ default_currency_id: currency.id });
     }
+    /* eslint-enable no-await-in-loop */
     logger.info('provisionTenant: seeded arcblock payment methods + currencies', { instanceDid });
   });
 }

package/api/src/store/models/payment-currency.ts

@@ -19,7 +19,7 @@ import type { LiteralUnion } from 'type-fest';
 import { fromTokenToUnit } from '@ocap/util';
 import { TenantModel } from '../tenant-model';
 import { getInstanceDid } from '../../libs/context';
-import { createIdGenerator } from '../../libs/util';
+import { createIdGenerator, getPublicAssetUrl } from '../../libs/util';
 import { RechargeConfig, VaultConfig } from './types';
 
 const nextId = createIdGenerator('pc', 12);
@@ -57,6 +57,12 @@ export class PaymentCurrency extends TenantModel<InferAttributes<PaymentCurrency
   declare recharge_config?: RechargeConfig;
   declare token_config?: Record<string, any> | null;
 
+  public override toJSON(): any {
+    const data = super.toJSON() as any;
+    if (data.logo) data.logo = getPublicAssetUrl(data.logo);
+    return data;
+  }
+
   public static readonly GENESIS_ATTRIBUTES = {
     id: {
       type: DataTypes.STRING(15),

package/api/src/store/models/payment-method.ts

@@ -16,7 +16,7 @@ import { encryptSecret, decryptSecret } from '../../libs/secrets';
 
 import { AppStoreClient } from '../../integrations/app-store/client';
 import { GooglePlayClient } from '../../integrations/google-play/client';
-import { STRIPE_API_VERSION, createIdGenerator } from '../../libs/util';
+import { STRIPE_API_VERSION, createIdGenerator, getPublicAssetUrl } from '../../libs/util';
 import { sequelize } from '../sequelize';
 import type { PaymentMethodSettings } from './types';
 import { CHARGE_SUPPORTED_CHAIN_TYPES, EVM_CHAIN_TYPES } from '../../libs/constants';
@@ -73,6 +73,12 @@ export class PaymentMethod extends TenantModel<InferAttributes<PaymentMethod>, I
   declare created_at: CreationOptional<Date>;
   declare updated_at: CreationOptional<Date>;
 
+  public override toJSON(): any {
+    const data = super.toJSON() as any;
+    if (data.logo) data.logo = getPublicAssetUrl(data.logo);
+    return data;
+  }
+
   public static readonly GENESIS_ATTRIBUTES = {
     id: {
       type: DataTypes.STRING(30),
@@ -170,11 +176,21 @@ export class PaymentMethod extends TenantModel<InferAttributes<PaymentMethod>, I
 
   public static encryptSettings(settings: PaymentMethodSettings) {
     const tmp = cloneDeep(settings);
-    if (tmp.stripe) {
+    // Per-field truthy guards: admin UI submits *all* channel stubs (empty
+    // strings for the ones the user is not configuring), so a parent-level
+    // `if (tmp.stripe)` would gladly enter the branch and call
+    // encryptSecret('') for every empty stub. Under the multi-tenant
+    // KeyringSecretsDriver, CryptoJS.AES.encrypt(undefined, …) throws
+    // "Cannot read properties of undefined (reading 'encrypt')" — the
+    // single-tenant DefaultSecretsDriver swallowed it silently. Field-level
+    // guards make the function robust to either caller shape.
+    if (tmp.stripe?.secret_key) {
       tmp.stripe.secret_key = encryptSecret(tmp.stripe.secret_key);
+    }
+    if (tmp.stripe?.webhook_signing_secret) {
       tmp.stripe.webhook_signing_secret = encryptSecret(tmp.stripe.webhook_signing_secret);
     }
-    if (tmp.google_play) {
+    if (tmp.google_play?.service_account_json) {
       tmp.google_play.service_account_json = encryptSecret(tmp.google_play.service_account_json);
     }
     if (tmp.app_store?.private_key_pem) {
@@ -189,11 +205,16 @@ export class PaymentMethod extends TenantModel<InferAttributes<PaymentMethod>, I
 
   public static decryptSettings(settings: PaymentMethodSettings) {
     const tmp = cloneDeep(settings);
-    if (tmp.stripe) {
+    // Same per-field guard as encryptSettings — empty stubs from the admin
+    // UI roundtrip would otherwise hit decryptSecret('') and explode under
+    // the keyring driver.
+    if (tmp.stripe?.secret_key) {
       tmp.stripe.secret_key = decryptSecret(tmp.stripe.secret_key);
+    }
+    if (tmp.stripe?.webhook_signing_secret) {
       tmp.stripe.webhook_signing_secret = decryptSecret(tmp.stripe.webhook_signing_secret);
     }
-    if (tmp.google_play) {
+    if (tmp.google_play?.service_account_json) {
       tmp.google_play.service_account_json = decryptSecret(tmp.google_play.service_account_json);
     }
     if (tmp.app_store?.private_key_pem) {
@@ -250,7 +271,10 @@ export class PaymentMethod extends TenantModel<InferAttributes<PaymentMethod>, I
       // wallets only decode protobuf-encoded tx bytes. Use `@ocap/client/legacy`
       // (protobuf client) so encode / decode / broadcast all stay protobuf,
       // matching the wallet signatures and what the chain node expects to hash.
-      const created = new OcapClient(host);
+      // Disable the client's implicit getContext() warmup. Its zero-delay timer
+      // can be classified as a permanently hung request by workerd. Callers that
+      // need chain context fetch it explicitly through Worker-safe I/O.
+      const created = new OcapClient(host, false);
       ocapClients.set(host, created);
       return created;
     }

package/api/src/store/models/subscription.ts

@@ -105,7 +105,9 @@ export class Subscription extends TenantModel<InferAttributes<Subscription>, Inf
   declare schedule_id?: string;
 
   // If the subscription has ended, the date the subscription ended.
-  declare ended_at?: number;
+  // Column name in DB is `end_at` (see init below). Historical phantom
+  // attribute `ended_at` silently dropped writes — never name-drift again.
+  declare end_at?: number;
   declare start_date: number;
   declare trial_end?: number;
   declare trial_start?: number;

package/api/tests/integrations/app-store/handlers.spec.ts

@@ -278,7 +278,7 @@ describe('ingestVerifiedAppStorePurchase', () => {
     );
   });
 
-  it('does NOT reactivate a canceled subscription when the new transaction is also expired', async () => {
+  it('marks a fully-lapsed subscription as incomplete_expired when the new transaction is also expired', async () => {
     const update = jest.fn();
     const existing = { id: 'sub_existing', status: 'canceled', customer_id: 'cus_1', payment_details: { app_store: {} }, update };
     mockSubscriptionFindOne.mockResolvedValue(existing);
@@ -292,7 +292,18 @@ describe('ingestVerifiedAppStorePurchase', () => {
     });
 
     expect(result.subscription).toBe(existing);
-    expect(update).not.toHaveBeenCalled();
+    // Stored + replay both expired (Sandbox steady state after Apple's
+    // max-renewals cap) — converge the row to incomplete_expired so the
+    // worker's Transaction.updates replay loop stops and entitlement.check
+    // converges to inactive. Without this terminal write the verify route
+    // would silently `return existing` on every replay and the SDK would
+    // never see the lapsed state.
+    expect(update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        status: 'incomplete_expired',
+        cancel_at_period_end: false,
+      })
+    );
     expect(mockSubscriptionCreate).not.toHaveBeenCalled();
   });
 

package/api/tests/integrations/stripe/reconcile-checkout.spec.ts

@@ -0,0 +1,80 @@
+import { reconcileStripeCheckoutSessionWithDeps } from '../../../src/integrations/stripe/reconcile-checkout-core';
+
+describe('reconcileStripeCheckoutSession', () => {
+  it('syncs an unfinished one-time Stripe payment and returns the updated checkout status', async () => {
+    const checkoutSession = {
+      id: 'cs_1',
+      status: 'open',
+      payment_status: 'unpaid',
+      payment_intent_id: 'pi_local',
+      mode: 'payment',
+      reload: jest.fn(function reload() {
+        this.status = 'complete';
+        this.payment_status = 'paid';
+        return Promise.resolve();
+      }),
+    };
+    const paymentIntent = { id: 'pi_local', status: 'processing' };
+    const syncPayment = jest.fn().mockResolvedValue(undefined);
+
+    const result = await reconcileStripeCheckoutSessionWithDeps('cs_1', {
+      findCheckoutSession: jest.fn().mockResolvedValue(checkoutSession),
+      findPaymentIntent: jest.fn().mockResolvedValue(paymentIntent),
+      getSubscriptionIds: jest.fn().mockReturnValue([]),
+      findSubscriptions: jest.fn().mockResolvedValue([]),
+      syncPayment,
+      syncSubscription: jest.fn(),
+    });
+
+    expect(syncPayment).toHaveBeenCalledWith(paymentIntent);
+    expect(checkoutSession.reload).toHaveBeenCalled();
+    expect(result).toEqual({ status: 'complete', paymentStatus: 'paid', reconciled: true });
+  });
+
+  it('syncs only incomplete subscriptions so repeated reconciliation stays idempotent', async () => {
+    const checkoutSession = {
+      id: 'cs_1',
+      status: 'open',
+      payment_status: 'unpaid',
+      mode: 'subscription',
+      reload: jest.fn(),
+    };
+    const incomplete = { id: 'sub_1', status: 'incomplete' };
+    const active = { id: 'sub_2', status: 'active' };
+    const syncSubscription = jest.fn().mockResolvedValue(undefined);
+
+    await reconcileStripeCheckoutSessionWithDeps('cs_1', {
+      findCheckoutSession: jest.fn().mockResolvedValue(checkoutSession),
+      findPaymentIntent: jest.fn(),
+      getSubscriptionIds: jest.fn().mockReturnValue(['sub_1', 'sub_2']),
+      findSubscriptions: jest.fn().mockResolvedValue([incomplete, active]),
+      syncPayment: jest.fn(),
+      syncSubscription,
+    });
+
+    expect(syncSubscription).toHaveBeenCalledTimes(1);
+    expect(syncSubscription).toHaveBeenCalledWith(incomplete);
+  });
+
+  it('does not call Stripe for an already completed checkout session', async () => {
+    const syncPayment = jest.fn();
+    const syncSubscription = jest.fn();
+
+    const result = await reconcileStripeCheckoutSessionWithDeps('cs_1', {
+      findCheckoutSession: jest.fn().mockResolvedValue({
+        id: 'cs_1',
+        status: 'complete',
+        payment_status: 'paid',
+      }),
+      findPaymentIntent: jest.fn(),
+      getSubscriptionIds: jest.fn(),
+      findSubscriptions: jest.fn(),
+      syncPayment,
+      syncSubscription,
+    });
+
+    expect(syncPayment).not.toHaveBeenCalled();
+    expect(syncSubscription).not.toHaveBeenCalled();
+    expect(result).toEqual({ status: 'complete', paymentStatus: 'paid', reconciled: false });
+  });
+});

package/api/tests/libs/arcblock-transfer.spec.ts

@@ -0,0 +1,58 @@
+const fetchContext = jest.fn();
+const encodeTx = jest.fn();
+
+jest.mock('@ocap/client/encode', () => ({
+  fetchContext,
+  encodeTx,
+}));
+
+import { encodeArcblockTransfer } from '../../src/libs/arcblock-transfer';
+
+describe('encodeArcblockTransfer', () => {
+  beforeEach(() => {
+    fetchContext.mockReset();
+    encodeTx.mockReset();
+  });
+
+  it('uses the worker-safe context fetcher instead of the OCAP client context timer', async () => {
+    fetchContext.mockResolvedValue({
+      chainId: 'beta',
+      txFee: [{ typeUrl: 'fg:t:transfer_v3', fee: '0' }],
+    });
+    const encoded = {
+      object: { signature: Buffer.from('signed') },
+      buffer: Buffer.from('encoded'),
+    };
+    encodeTx.mockReturnValue(encoded);
+
+    const client = {
+      getContext: jest.fn(() => {
+        throw new Error('must not call timer-backed getContext');
+      }),
+      encodeTransferV3Tx: jest.fn(() => {
+        throw new Error('must not call timer-backed client encoder');
+      }),
+    };
+    const tx = { chainId: '', itx: { typeUrl: 'fg:t:transfer_v3', value: { outputs: [] } } };
+    const wallet = { address: 'zUser', publicKey: 'zPk' };
+
+    await expect(
+      encodeArcblockTransfer({
+        chainHost: 'https://beta.abtnetwork.io/api/',
+        tx,
+        wallet,
+      })
+    ).resolves.toBe(encoded);
+
+    expect(fetchContext).toHaveBeenCalledWith('https://beta.abtnetwork.io/api/');
+    expect(encodeTx).toHaveBeenCalledWith({
+      type: 'TransferV3Tx',
+      tx,
+      wallet,
+      chainId: 'beta',
+      feeConfig: [{ typeUrl: 'fg:t:transfer_v3', fee: '0' }],
+    });
+    expect(client.getContext).not.toHaveBeenCalled();
+    expect(client.encodeTransferV3Tx).not.toHaveBeenCalled();
+  });
+});