payment-kit 1.29.8 → 1.29.10

package/api/tests/libs/util.spec.ts

@@ -19,12 +19,63 @@ import {
   resolveAddressChainTypes,
   formatCurrencyInfo,
   getExplorerTxUrl,
+  getPublicAssetUrl,
+  stripeEndpoint,
 } from '../../src/libs/util';
+import { setCoreConfig } from '../../src/libs/env';
 import type { Subscription, PaymentMethod, PaymentCurrency } from '../../src/store/models';
 
 import { blocklet } from '../../src/libs/auth';
+import { context } from '../../src/libs/context';
 import logger from '../../src/libs/logger';
 
+describe('stripeEndpoint', () => {
+  afterEach(() => setCoreConfig(undefined));
+
+  it('uses the request-scoped embedded payment public base URL', async () => {
+    const endpoint = await context.run(
+      { publicBaseUrl: 'https://cf-aside.ofind.cn/.well-known/payment' },
+      async () => stripeEndpoint()
+    );
+
+    expect(endpoint).toBe(
+      'https://cf-aside.ofind.cn/.well-known/payment/api/integrations/stripe/webhook'
+    );
+  });
+
+  it('prefers the explicit webhook URL override', async () => {
+    setCoreConfig({ STRIPE_WEBHOOK_URL: 'https://hooks.example.com/stripe' });
+
+    const endpoint = await context.run(
+      { publicBaseUrl: 'https://cf-aside.ofind.cn/.well-known/payment' },
+      async () => stripeEndpoint()
+    );
+
+    expect(endpoint).toBe('https://hooks.example.com/stripe');
+  });
+});
+
+describe('getPublicAssetUrl', () => {
+  afterEach(() => setCoreConfig(undefined));
+
+  it('prefixes root-relative assets with the embedded payment mount', () => {
+    setCoreConfig({ PAYMENT_PUBLIC_BASE_PATH: '/.well-known/payment' });
+    expect(getPublicAssetUrl('/methods/arcblock.png')).toBe('/.well-known/payment/methods/arcblock.png');
+  });
+
+  it('keeps external asset URLs unchanged', () => {
+    setCoreConfig({ PAYMENT_PUBLIC_BASE_PATH: '/.well-known/payment' });
+    expect(getPublicAssetUrl('https://cdn.example.com/arcblock.png')).toBe('https://cdn.example.com/arcblock.png');
+  });
+
+  it('does not duplicate an existing embedded payment mount', () => {
+    setCoreConfig({ PAYMENT_PUBLIC_BASE_PATH: '/.well-known/payment' });
+    expect(getPublicAssetUrl('/.well-known/payment/methods/arcblock.png')).toBe(
+      '/.well-known/payment/methods/arcblock.png'
+    );
+  });
+});
+
 describe('createIdGenerator', () => {
   it('should return a function that generates an ID with the specified prefix and size', () => {
     const generateId = createIdGenerator('test', 10);

package/blocklet.yml

@@ -14,7 +14,7 @@ repository:
   type: git
   url: git+https://github.com/blocklet/payment-kit.git
 specVersion: 1.2.8
-version: 1.29.8
+version: 1.29.10
 logo: logo.png
 files:
   - dist

package/cloudflare/cf-adapter.ts

@@ -47,7 +47,7 @@ import {
   createCronRegistry,
   applyPaymentCoreMigrations,
 } from '../api/src/libs/drivers';
-import type { IdentityDriver } from '../api/src/libs/drivers';
+import type { IdentityDriver, InstanceAppIdentity } from '../api/src/libs/drivers';
 import { flushQueueWork, dispatchDueJobs, getQueueHandler } from '../api/src/libs/queue/runtime';
 import { Sequelize } from './shims/sequelize-d1/sequelize-class';
 import { setDB } from './shims/sequelize-d1/model';
@@ -111,6 +111,14 @@ export interface CloudflarePaymentAdapterOptions {
   /** Per-tenant EK source (semantics aligned with arc-node: connect-service `app:ek` else derive). */
   identity: {
     getAppEk: (instanceDid: string) => Promise<string> | string;
+    /**
+     * Per-instance app signing identity (S3-CF). When the host provides it — arc
+     * reads connect-service settings `app:sk`/`app:psk`, the SAME authority as
+     * getAppEk — it is the authoritative DID-Connect signer source. Optional: when
+     * the host doesn't wire it, the adapter falls back to the AUTH_SERVICE-backed
+     * CF driver (which fails closed if AUTH_SERVICE is also absent).
+     */
+    getInstanceAppIdentity?: (instanceDid: string) => Promise<InstanceAppIdentity> | InstanceAppIdentity;
   };
   /**
    * Host-resolved caller (CF API gate). The adapter injects it as `x-user-did`
@@ -210,7 +218,11 @@ export function buildFetch(deps: FetchDeps) {
       if (instanceDid) await warmTenantIdentity(instanceDid);
       return deps.svc.http.fetch(forwarded, { basePath: deps.basePath });
     };
-    const res = instanceDid ? await requestContext.withTenant(instanceDid, run) : await run();
+    const requestOrigin = new URL(request.url).origin;
+    const publicBaseUrl = new URL(deps.basePath, `${requestOrigin}/`).href.replace(/\/$/, '');
+    const res = await requestContext.run({ publicBaseUrl }, () =>
+      instanceDid ? requestContext.withTenant(instanceDid, run) : run()
+    );
 
     await deps.flush(); // drain workerd deferred queue work before responding
     return res;
@@ -323,7 +335,13 @@ export async function createCloudflarePaymentAdapter(
   const identity: IdentityDriver = {
     resolveInstanceDidForHost: () => null,
     getAppEk: (instanceDid: string) => options.identity.getAppEk(instanceDid),
-    getInstanceAppIdentity: cfDidConnectIdentity.getInstanceAppIdentity?.bind(cfDidConnectIdentity),
+    // Prefer the host-supplied per-instance identity (arc reads connect-service
+    // settings app:sk/psk — same authority as getAppEk); fall back to the
+    // AUTH_SERVICE-backed CF driver when the host doesn't wire it (the Phase 6
+    // binding). This is what lets arc-embedded CF resolve the DID-Connect signer
+    // without an AUTH_SERVICE service binding.
+    getInstanceAppIdentity:
+      options.identity.getInstanceAppIdentity ?? cfDidConnectIdentity.getInstanceAppIdentity?.bind(cfDidConnectIdentity),
     // per-tenant business wallet (single seam); directory stays the CF alias shim
     getBusinessWallet: cfDidConnectIdentity.getBusinessWallet,
   };
@@ -331,7 +349,11 @@ export async function createCloudflarePaymentAdapter(
   const svc: EmbeddedPaymentService = createEmbeddedPaymentService({
     // Host-global csrf secret via the config boundary (payment-core's csrf reads
     // PAYMENT_CSRF_SECRET through readConfig). NO sessionSecret (decision #5).
-    config: { ...(options.config ?? {}), ...(options.csrfSecret ? { PAYMENT_CSRF_SECRET: options.csrfSecret } : {}) },
+    config: {
+      ...(options.config ?? {}),
+      PAYMENT_PUBLIC_BASE_PATH: basePath,
+      ...(options.csrfSecret ? { PAYMENT_CSRF_SECRET: options.csrfSecret } : {}),
+    },
     db: { sequelize },
     tenancy: { mode: 'multi' },
     identity,
@@ -353,6 +375,15 @@ export async function createCloudflarePaymentAdapter(
     if (typeof (globalThis as any).__flushDeferredTimers === 'function') {
       (globalThis as any).__flushDeferredTimers();
     }
+    // Embedded binding alias: the standalone worker exposes the payment D1 as `DB`,
+    // but under arc the binding is `PAYMENT_DB`. Paths that read `__CF_ENV__.DB`
+    // directly — notably the DID-Connect token store (did-connect-token-storage.ts),
+    // which mints the wallet-pay QR auth token — would otherwise find no `DB` binding
+    // and fail token creation, leaving the QR blank. Alias it to the same payment
+    // database (where `_did_connect_tokens` lives) so those paths match standalone.
+    if (env && !env.DB && env.PAYMENT_DB) {
+      env.DB = env.PAYMENT_DB;
+    }
     (globalThis as any).__CF_ENV__ = env;
     (globalThis as any).__cfHttpContext__ = httpContext;
     (globalThis as any).__cfWaitUntil__ = (p: Promise<any>) => ctx.waitUntil(p);

package/cloudflare/did-connect-runtime.ts

@@ -78,13 +78,51 @@ export function createCloudflareIdentityDriver(): IdentityDriver {
       const cached = cache.get(instanceDid);
       if (cached && cached.expires > Date.now()) return cached.value;
       const svc = authService();
-      if (!svc || typeof svc.getInstanceAppIdentity !== 'function') {
-        throw new Error('[did-connect] AUTH_SERVICE.getInstanceAppIdentity unavailable — fail-closed');
+      // Preferred: the AUTH_SERVICE RPC (multi-tenant / newer blocklet-service resolves
+      // the per-instance app:sk). Fall back to the worker's OWN APP_SK/APP_PSK when the
+      // binding does not implement the method — which is exactly what blocklet-service's
+      // own getInstanceAppIdentity returns for the deployment app (sign.js:
+      // appSk = env.BLOCKLET_APP_SK). In single-tenant mode the instance IS the
+      // deployment app (instanceDid == APP_PID), so the worker's APP_SK is the correct
+      // signer. This makes the standalone worker (and embedded arc CF, which has no
+      // getInstanceAppIdentity RPC) self-sufficient for DID-Connect QR signing.
+      // Try the AUTH_SERVICE RPC first. NOTE: `typeof svc.getInstanceAppIdentity`
+      // is 'function' even on OLD blocklet-service builds (the RPC stub exists) — it
+      // only throws "does not implement the method" at CALL time. So we must catch the
+      // call itself and fall back, not gate on typeof.
+      if (svc && typeof svc.getInstanceAppIdentity === 'function') {
+        try {
+          const value: InstanceAppIdentity = await svc.getInstanceAppIdentity(instanceDid);
+          if (value && value.appSk) {
+            cache.set(instanceDid, { value, expires: Date.now() + TTL_MS });
+            return value;
+          }
+          // RPC reachable but returned nothing usable → fall through to local APP_SK.
+        } catch (err: any) {
+          // RPC not implemented on this AUTH_SERVICE version (or transport error) →
+          // fall through to the local APP_SK identity below.
+          console.warn(
+            '[did-connect] AUTH_SERVICE.getInstanceAppIdentity failed, falling back to local APP_SK:',
+            err?.message || err
+          );
+        }
       }
-      const value: InstanceAppIdentity = await svc.getInstanceAppIdentity(instanceDid);
-      if (!value || !value.appSk) {
-        throw new Error(`[did-connect] getInstanceAppIdentity returned no appSk for "${instanceDid}" — fail-closed`);
+      // Fallback: the worker's OWN APP_SK/APP_PSK — exactly what blocklet-service's
+      // getInstanceAppIdentity returns for the deployment app (sign.js: appSk =
+      // env.BLOCKLET_APP_SK). In single-tenant mode the instance IS the deployment app
+      // (instanceDid == APP_PID), so this is the correct DID-Connect signer. Makes the
+      // standalone worker + embedded arc CF (no getInstanceAppIdentity RPC) self-sufficient.
+      const env = (globalThis as any).__CF_ENV__ || {};
+      const appSk: string | undefined = env.APP_SK;
+      if (!appSk) {
+        throw new Error(
+          '[did-connect] getInstanceAppIdentity unavailable — AUTH_SERVICE lacks the RPC and no local APP_SK to fall back on — fail-closed'
+        );
       }
+      const value: InstanceAppIdentity = {
+        appSk,
+        ...(env.APP_PSK ? { appPsk: env.APP_PSK as string } : {}),
+      };
       cache.set(instanceDid, { value, expires: Date.now() + TTL_MS });
       return value;
     },

package/cloudflare/esbuild-cf-config.cjs

@@ -280,13 +280,18 @@ const alias = {
   'mime-types': s('shims/mime-types.ts'), // 150KB — lightweight shim with common MIME types
   'mime-db': s('shims/noop.ts'),
   ws: s('shims/ws-lite.ts'), //  66KB — native WebSocket wrapper for CF Workers
-  'crypto-js': s('shims/crypto-js-warn.ts'), // 115KB — AES legacy not used, warns if called
-  'crypto-js/aes': s('shims/crypto-js-warn.ts'),
-  'crypto-js/enc-base64': s('shims/noop.ts'),
-  'crypto-js/enc-hex': s('shims/noop.ts'),
-  'crypto-js/enc-latin1': s('shims/noop.ts'),
-  'crypto-js/enc-utf8': s('shims/noop.ts'),
-  'crypto-js/enc-utf16': s('shims/noop.ts'),
+  // crypto-js previously shimmed under the assumption "AES legacy not used".
+  // FALSE since Phase 11 multi-tenant: KeyringSecretsDriver
+  // (api/src/libs/drivers/secrets.ts) uses CryptoJS.AES.encrypt/decrypt for
+  // per-tenant PaymentMethod settings encryption — shimmed-to-warn made
+  // `CryptoJS.AES` undefined at runtime, and admin-side PaymentMethod
+  // create/update crashed with "Cannot read properties of undefined (reading
+  // 'encrypt')". The real bundle is ~115 KB (pure JS, Workers compatible);
+  // shipping the real module is the only correct fix because the same
+  // ciphertext must remain decryptable across node and CF tenants. Sub-path
+  // imports are not used by the payment graph, so we don't need to re-alias
+  // each `crypto-js/...` entry — they'll just no-op-resolve through the main
+  // module if anything ever pulls them.
 
   // Force ESM-only to avoid CJS+ESM double-bundling. These packages ship an
   // exports map with separate import/require conditions, so esbuild picks the

package/cloudflare/tests/cf-adapter.spec.ts

@@ -88,7 +88,14 @@ describe('createTenantProvisioner — lazy first-request provisioning, in-flight
 // A fake embedded service: captures what the adapter forwards (headers, raw body,
 // basePath) and the tenant context active at fetch time.
 function fakeSvc() {
-  const seen: { did?: string; role?: string; tenant?: string; basePath?: string; body?: string } = {};
+  const seen: {
+    did?: string;
+    role?: string;
+    tenant?: string;
+    publicBaseUrl?: string;
+    basePath?: string;
+    body?: string;
+  } = {};
   return {
     seen,
     http: {
@@ -96,6 +103,7 @@ function fakeSvc() {
         seen.did = req.headers.get('x-user-did') ?? undefined;
         seen.role = req.headers.get('x-user-role') ?? undefined;
         seen.tenant = requestContext.peekInstanceDid();
+        seen.publicBaseUrl = requestContext.peekPublicBaseUrl();
         seen.basePath = opts?.basePath;
         seen.body = await req.text();
         return new Response('ok', { status: 200 });
@@ -128,6 +136,7 @@ describe('buildFetch — drives the single http.fetch under the tenant context',
     expect(res.status).toBe(200);
     expect(svc.seen.did).toBe('did:abt:zREAL'); // forged stripped, real injected
     expect(svc.seen.tenant).toBe('did:abt:zTENANT'); // ran under withTenant
+    expect(svc.seen.publicBaseUrl).toBe('https://x/.well-known/payment');
     expect(svc.seen.basePath).toBe('/.well-known/payment');
     expect(svc.seen.body).toBe('raw-bytes'); // data-damage: raw body preserved
     expect(flushed).toBe(1);

package/cloudflare/worker.ts

@@ -10,6 +10,11 @@ import { Client as PgClient } from 'pg';
 import postgres from 'postgres';
 import { Hono } from 'hono';
 import { cors } from 'hono/cors';
+import { getCookie } from 'hono/cookie';
+// Worker-safe CSRF crypto (the SAME module the csrf middleware verifies with —
+// util/csrf passes through to the real package in the CF bundle, see build.ts).
+// eslint-disable-next-line import/no-extraneous-dependencies
+import { sign as signCsrf, getCsrfSecret } from '@blocklet/sdk/lib/util/csrf';
 import { setDB } from './shims/sequelize-d1/model';
 import { initialize } from '../api/src/store/models';
 import { Sequelize } from './shims/sequelize-d1/sequelize-class';
@@ -386,6 +391,20 @@ function buildApp(env: Env): Hono<HonoEnv> {
     // Flag: HTTP request context. createEvent uses waitUntil (non-blocking).
     // In queue consumer/cron, this flag is absent — createEvent uses __cfPendingJobs__ (blocking).
     (globalThis as any).__cfHttpContext__ = true;
+    // The @blocklet/sdk CSRF util reads its signing secret DIRECTLY from
+    // process.env (`BLOCKLET_APP_ASK || BLOCKLET_APP_SK`), not the config slot. The
+    // Phase-12a removal of the per-request process.env mirror left it undefined, so
+    // every CSRF-signed response hit `createHmac(<undefined key>)` → 500 (e.g.
+    // GET /api/settings). Restore just that one var from the APP_SK binding (the
+    // standalone worker's app secret key). Idempotent within the isolate.
+    if (c.env.APP_SK && !process.env.BLOCKLET_APP_SK) {
+      process.env.BLOCKLET_APP_SK = c.env.APP_SK;
+    }
+    // Test/staging escape hatch: forward PAYMENT_DISABLE_CSRF to the config boundary
+    // so the csrf middleware (readConfig) can honor it. Default-absent → CSRF stays on.
+    if ((c.env as any).PAYMENT_DISABLE_CSRF && !process.env.PAYMENT_DISABLE_CSRF) {
+      process.env.PAYMENT_DISABLE_CSRF = (c.env as any).PAYMENT_DISABLE_CSRF;
+    }
     setDB(withD1Retry(c.env.DB.withSession('first-primary')));
     ensureModelsInit();
 
@@ -496,6 +515,28 @@ function buildApp(env: Env): Hono<HonoEnv> {
   // Health check
   app.get('/health', (c) => c.json({ status: 'ok' }));
 
+  // did/csrfToken — the @blocklet/js-sdk axios adapter fetches its CSRF header from
+  // THIS endpoint (getCSRFTokenByLoginToken), not from the cookie. The shared
+  // blocklet-service (AUTH_SERVICE) only implements it on newer versions, so the
+  // catch-all proxy below 404s on older AUTH_SERVICE — leaving the SDK with no CSRF
+  // header and every mutating request 403'ing ("csrf token mismatch"). Sign it
+  // LOCALLY with the SAME secret + algorithm the payment csrf middleware verifies
+  // with (util/csrf sign over login_token), so token == cookie == what verify()
+  // expects. Must be registered BEFORE the /.well-known/service/* catch-all. This
+  // also makes the embedded arc-node CF runtime self-sufficient (no AUTH_SERVICE
+  // csrfToken endpoint required).
+  app.get('/.well-known/service/api/did/csrfToken', (c) => {
+    const loginToken = getCookie(c, 'login_token');
+    if (!loginToken) return c.json({ loginToken: null, csrfToken: null });
+    // Same secret resolution as the csrf middleware's csrfSecret() (PAYMENT_CSRF_SECRET
+    // override else the app secret key). Read APP_SK from the binding directly so we
+    // do not depend on the process.env.BLOCKLET_APP_SK mirror timing; getCsrfSecret()
+    // is the final fallback.
+    const secret = (c.env as any).PAYMENT_CSRF_SECRET || c.env.APP_SK || getCsrfSecret();
+    if (!secret) return c.json({ loginToken, csrfToken: null });
+    return c.json({ loginToken, csrfToken: signCsrf(secret, loginToken) });
+  });
+
   // user-session under /.well-known/service — proxy to blocklet-service session API
   // Returns full session data including connectedAccounts (needed by @arcblock/ux SessionUser)
   app.get('/.well-known/service/api/user-session', async (c) => {
@@ -691,7 +732,6 @@ function buildApp(env: Env): Hono<HonoEnv> {
       startsWithZ: sk.startsWith('z'),
     });
   });
-
   // === DID Auth Login routes ===
   // Only proxy login-related /api/did/* paths to blocklet-service.
   // Other /api/did/* paths (subscription, pay, collect, etc.) are Payment Kit's own

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "payment-kit",
-  "version": "1.29.8",
+  "version": "1.29.10",
   "scripts": {
     "dev": "blocklet dev --open",
     "prelint": "npm run types",
@@ -48,7 +48,7 @@
   "dependencies": {
     "@abtnode/cron": "^1.17.13-beta-20260613-094425-b81920c8",
     "@arcblock/did": "^1.30.24",
-    "@arcblock/did-connect-js": "^4.1.0",
+    "@arcblock/did-connect-js": "^4.1.2",
     "@arcblock/did-connect-react": "^3.5.4",
     "@arcblock/did-connect-storage-nedb": "^1.8.0",
     "@arcblock/did-util": "^1.30.24",
@@ -60,13 +60,13 @@
     "@blocklet/error": "^0.3.5",
     "@blocklet/js-sdk": "^1.17.13-beta-20260613-094425-b81920c8",
     "@blocklet/logger": "^1.17.13-beta-20260613-094425-b81920c8",
-    "@blocklet/payment-broker-client": "1.29.8",
-    "@blocklet/payment-react": "1.29.8",
-    "@blocklet/payment-vendor": "1.29.8",
+    "@blocklet/payment-broker-client": "1.29.10",
+    "@blocklet/payment-react": "1.29.10",
+    "@blocklet/payment-vendor": "1.29.10",
     "@blocklet/sdk": "^1.17.13-beta-20260613-094425-b81920c8",
     "@blocklet/ui-react": "^3.5.4",
-    "@blocklet/uploader": "^0.3.20",
-    "@blocklet/xss": "^0.3.16",
+    "@blocklet/uploader": "^0.15.4",
+    "@blocklet/xss": "^0.15.4",
     "@hono/node-server": "2.0.4",
     "@mui/icons-material": "^7.1.2",
     "@mui/lab": "7.0.0-beta.14",
@@ -133,7 +133,7 @@
   "devDependencies": {
     "@abtnode/types": "^1.17.13-beta-20260613-094425-b81920c8",
     "@arcblock/eslint-config-ts": "^0.3.3",
-    "@blocklet/payment-types": "1.29.8",
+    "@blocklet/payment-types": "1.29.10",
     "@types/connect": "^3.4.38",
     "@types/debug": "^4.1.12",
     "@types/dotenv-flow": "^3.3.3",
@@ -180,5 +180,5 @@
       "parser": "typescript"
     }
   },
-  "gitHead": "547c0614f1f83abad80ea08452d2f5a9f4f5aa07"
+  "gitHead": "18c831f5dbdfb271a96640befb06f589adbeeab0"
 }

package/src/components/layout/user.tsx

@@ -34,7 +34,13 @@ export default function UserLayout(props: any) {
     return (
       <PaymentProvider session={session} connect={connectApi}>
         <UserCenter
-          currentTab={`${window.blocklet.prefix}customer`}
+          // Must match the userCenter nav link declared in blocklet.yml (`link: /customer`).
+          // UserCenter resolves both this prop and the nav link via `new URL(x, origin).pathname`,
+          // which strips any mount prefix — so the nav tab always resolves to the bare `/customer`.
+          // Prefixing here (e.g. `${prefix}customer`) makes the active tab fail to match, which
+          // triggers UserCenter's auto-redirect to the bare nav link and 404s the embedded mount
+          // (#1394). The bare path also works in the non-embedded form, where prefix is `/`.
+          currentTab="/customer"
           hideFooter
           embed={embed === '1'}
           notLoginContent="undefined">

package/src/libs/did.ts

@@ -0,0 +1,27 @@
+// DID comparison helpers shared by the customer portal pages.
+//
+// A single ArcBlock identity shows up in two string shapes across the stack:
+//   - bare base58 address (e.g. `z1xxx`)
+//   - canonical URI form  (e.g. `did:abt:z1xxx`)
+//
+// On CF Workers the host AUTH_SERVICE hands the frontend a bare address while
+// the backend canonicalizes login-token DIDs to the `did:abt:` form before it
+// stores `customer.did` (see api/src/middlewares/hono/security.ts and
+// api/src/routes/hono/entitlements.ts `canonicalDid`/`isSelf`). A raw `!==`
+// between `session.user.did` and `customer.did` therefore flags the very owner
+// of the record as "another customer". Normalize both sides before comparing.
+
+const DID_PREFIX = 'did:abt:';
+
+export function canonicalizeDid(did: string | undefined | null): string {
+  if (!did) return '';
+  return did.startsWith(DID_PREFIX) ? did.slice(DID_PREFIX.length) : did;
+}
+
+// True when both DIDs resolve to the same identity, ignoring the `did:abt:`
+// prefix difference. Empty/missing inputs are never considered a match.
+export function isSameDid(a: string | undefined | null, b: string | undefined | null): boolean {
+  const x = canonicalizeDid(a);
+  const y = canonicalizeDid(b);
+  return !!x && x === y;
+}

package/src/pages/customer/credit-grant/detail.tsx

@@ -24,6 +24,7 @@ import CreditGrantItemList from '../../../components/customer/credit-grant-item-
 import InfoRow from '../../../components/info-row';
 import InfoRowGroup from '../../../components/info-row-group';
 import { useArcsphere } from '../../../hooks/browser';
+import { isSameDid } from '../../../libs/did';
 
 const fetchData = (id: string | undefined): Promise<TCreditGrantExpanded> => {
   return api.get(`/api/credit-grants/${id}`).then((res: any) => res.data);
@@ -41,7 +42,7 @@ export default function CustomerCreditGrantDetail() {
     navigate('/customer', { replace: true });
   }, [navigate]);
 
-  if (data?.customer?.did && session?.user?.did && data.customer.did !== session.user.did) {
+  if (data?.customer?.did && session?.user?.did && !isSameDid(data.customer.did, session.user.did)) {
     return <Alert severity="error">{t('common.accessDenied')}</Alert>;
   }
   if (error) {

package/src/pages/customer/credit-transaction/detail.tsx

@@ -21,6 +21,7 @@ import SectionHeader from '../../../components/section/header';
 import InfoRow from '../../../components/info-row';
 import InfoRowGroup from '../../../components/info-row-group';
 import { useArcsphere } from '../../../hooks/browser';
+import { isSameDid } from '../../../libs/did';
 
 const fetchData = (id: string | undefined): Promise<TCreditTransactionExpanded> => {
   return api.get(`/api/credit-transactions/${id}`).then((res: any) => res.data);
@@ -38,7 +39,7 @@ export default function CustomerCreditTransactionDetail() {
     navigate('/customer', { replace: true });
   }, [navigate]);
 
-  if (data?.customer?.did && session?.user?.did && data.customer.did !== session.user.did) {
+  if (data?.customer?.did && session?.user?.did && !isSameDid(data.customer.did, session.user.did)) {
     return <Alert severity="error">{t('common.accessDenied')}</Alert>;
   }
 

package/src/pages/customer/invoice/detail.tsx

@@ -34,6 +34,7 @@ import InfoRow from '../../../components/info-row';
 import { Download } from '../../../components/invoice-pdf/pdf';
 import InvoiceTable from '../../../components/invoice/table';
 import { goBackOrFallback } from '../../../libs/util';
+import { isSameDid } from '../../../libs/did';
 import CustomerRefundList from '../refund/list';
 import InfoMetric from '../../../components/info-metric';
 import InfoRowGroup from '../../../components/info-row-group';
@@ -121,7 +122,7 @@ export default function CustomerInvoiceDetail() {
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [error]);
 
-  if (data?.customer?.did && session?.user?.did && data.customer.did !== session.user.did) {
+  if (data?.customer?.did && session?.user?.did && !isSameDid(data.customer.did, session.user.did)) {
     return <Alert severity="error">{t('common.accessDenied')}</Alert>;
   }
 

package/src/pages/customer/recharge/subscription.tsx

@@ -36,6 +36,7 @@ import InfoRow from '../../../components/info-row';
 import Currency from '../../../components/currency';
 import SubscriptionMetrics from '../../../components/subscription/metrics';
 import { goBackOrFallback, MAX_SAFE_AMOUNT } from '../../../libs/util';
+import { isSameDid } from '../../../libs/did';
 import CustomerLink from '../../../components/customer/link';
 import { useSessionContext } from '../../../contexts/session';
 import { formatSmartDuration, TimeUnit } from '../../../libs/dayjs';
@@ -227,7 +228,7 @@ export default function RechargePage() {
     return <Alert severity="info">{t('common.dataNotFound')}</Alert>;
   }
 
-  if (subscription?.customer?.did && session?.user?.did && subscription.customer.did !== session.user.did) {
+  if (subscription?.customer?.did && session?.user?.did && !isSameDid(subscription.customer.did, session.user.did)) {
     return <Alert severity="error">{t('common.accessDenied')}</Alert>;
   }
   const currentBalance = formatBNStr(payerValue?.token || '0', paymentCurrency?.decimal, 6, false);

package/src/pages/customer/subscription/detail.tsx

@@ -67,6 +67,7 @@ import {
 } from '../../../hooks/subscription';
 import { formatSmartDuration, TimeUnit } from '../../../libs/dayjs';
 import { canChangePaymentMethod } from '../../../libs/util';
+import { isSameDid } from '../../../libs/did';
 import PaymentMethodInfo from '../../../components/subscription/payment-method-info';
 import { useArcsphere } from '../../../hooks/browser';
 
@@ -260,7 +261,7 @@ export default function CustomerSubscriptionDetail() {
     }
   };
 
-  if (data?.customer?.did && session?.user?.did && data.customer.did !== session.user.did) {
+  if (data?.customer?.did && session?.user?.did && !isSameDid(data.customer.did, session.user.did)) {
     return <Alert severity="error">{t('common.accessDenied')}</Alert>;
   }
   if (error) {

package/tests/libs/did.spec.ts

@@ -0,0 +1,43 @@
+import { canonicalizeDid, isSameDid } from '../../src/libs/did';
+
+describe('canonicalizeDid', () => {
+  it('strips the did:abt: prefix', () => {
+    expect(canonicalizeDid('did:abt:z1xyz')).toBe('z1xyz');
+  });
+
+  it('leaves bare addresses untouched', () => {
+    expect(canonicalizeDid('z1xyz')).toBe('z1xyz');
+  });
+
+  it('returns empty string for nullish input', () => {
+    expect(canonicalizeDid(undefined)).toBe('');
+    expect(canonicalizeDid(null)).toBe('');
+    expect(canonicalizeDid('')).toBe('');
+  });
+});
+
+describe('isSameDid', () => {
+  // The regression: CF stores customer.did canonical while the host session
+  // reports a bare address. The old `data.customer.did !== session.user.did`
+  // check wrongly denied the owner. isSameDid must treat these as equal.
+  it('matches a canonical DID against the same bare address', () => {
+    expect(isSameDid('did:abt:z1xyz', 'z1xyz')).toBe(true);
+    expect(isSameDid('z1xyz', 'did:abt:z1xyz')).toBe(true);
+  });
+
+  it('matches identical shapes', () => {
+    expect(isSameDid('z1xyz', 'z1xyz')).toBe(true);
+    expect(isSameDid('did:abt:z1xyz', 'did:abt:z1xyz')).toBe(true);
+  });
+
+  it('rejects genuinely different identities', () => {
+    expect(isSameDid('did:abt:z1xyz', 'z1abc')).toBe(false);
+    expect(isSameDid('z1xyz', 'z1abc')).toBe(false);
+  });
+
+  it('never matches when either side is missing', () => {
+    expect(isSameDid('', 'z1xyz')).toBe(false);
+    expect(isSameDid('z1xyz', undefined)).toBe(false);
+    expect(isSameDid(null, null)).toBe(false);
+  });
+});

package/vite.arc.config.ts

@@ -29,6 +29,25 @@ export default defineConfig({
   root: coreDir,
   base: `${UI_PREFIX}/`,
   plugins: [
+    // Inject the Buffer polyfill at the top of the entry — the did-connect
+    // SessionProvider.refresh path serializes request bodies with Buffer, which is
+    // undefined in the browser, so without this the arc-embedded payment SPA throws
+    // "ReferenceError: Buffer is not defined" on session refresh and never renders.
+    // The standalone cloudflare/vite.config.ts already does this (cf-buffer-polyfill);
+    // the arc build was missing it. Reuses the same shim.
+    {
+      name: 'arc-buffer-polyfill',
+      enforce: 'pre' as const,
+      transform(code: string, id: string) {
+        if (id.endsWith('/src/index.tsx')) {
+          const shim = path
+            .resolve(coreDir, 'cloudflare/frontend-shims/buffer-polyfill.ts')
+            .replace(/\\/g, '/');
+          return `import '${shim}';\n` + code;
+        }
+        return undefined;
+      },
+    },
     tsconfigPaths({ root: coreDir }),
     react(),
     // Build-time window.blocklet bootstrap (P2 helper, single source). The