payment-kit 1.29.8 → 1.29.9

package/api/src/host-node/serve-static-arc.ts

@@ -42,6 +42,7 @@ export function createNodeStaticHandler(webRoot: string): (app: Hono) => void {
     const { serveStatic } = require('@hono/node-server/serve-static');
 
     // SPA fallback FIRST — html navigations (not assets) get index.html VERBATIM.
+    // eslint-disable-next-line require-await -- Hono's app.use overload requires a Promise-returning handler
     app.use('*', async (c, next) => {
       const method = c.req.method.toUpperCase();
       if (

package/api/src/integrations/app-store/native-asn1.ts

@@ -12,6 +12,7 @@
 // is the chain-to-pinned-Apple-root (native-jws.ts §5.3–5.4). A spoofed cert could
 // embed these public OID bytes, but it cannot forge the chain signature.
 
+/* eslint-disable no-bitwise -- DER base-128 OID encoding requires 7-bit-group bitwise ops (ASN.1) */
 import type { X509Certificate } from 'node:crypto';
 
 /**

package/api/src/integrations/app-store/signed-data-verifier.ts

@@ -43,6 +43,10 @@ export function isSignatureVerificationSkipped(): boolean {
   return true;
 }
 
+/* eslint-disable require-await, @typescript-eslint/no-unused-vars --
+   async: the skip-verify branch returns a sync decodeUnsafe<T>(), so async keeps the
+   signature Promise<T>; _bundleId/_environment stay in the signature for caller-layer
+   enforcement (client.ts) + Apple API parity. */
 export async function verifySignedTransaction(
   signedTransaction: string,
   _bundleId: string,
@@ -69,6 +73,7 @@ export async function verifySignedNotification(
   }
   return verifyAppleJws<JwsNotificationPayload>(signedPayload);
 }
+/* eslint-enable require-await, @typescript-eslint/no-unused-vars */
 
 /** Decode-only fallback for when signature verification is intentionally bypassed. */
 function decodeUnsafe<T>(jws: string): T {
@@ -104,7 +109,7 @@ export type AppStoreApiCredentials = {
  * StatusResponse, whose `signedTransactionInfo` JWS strings are verified by the
  * caller (client.ts) with verifyAppleJws.
  */
-export async function getAllSubscriptionStatuses(
+export function getAllSubscriptionStatuses(
   originalTransactionId: string,
   creds: AppStoreApiCredentials
 ): Promise<StatusResponse> {

package/api/src/integrations/stripe/setup.ts

@@ -4,7 +4,7 @@ import { env } from '@blocklet/sdk/lib/env';
 
 import Stripe from 'stripe';
 import logger from '../../libs/logger';
-import { STRIPE_API_VERSION, STRIPE_ENDPOINT, STRIPE_EVENTS } from '../../libs/util';
+import { STRIPE_API_VERSION, stripeEndpoint, STRIPE_EVENTS } from '../../libs/util';
 import { PaymentMethod } from '../../store/models';
 
 // register stripe webhooks on start/create if there are any stripe payment methods
@@ -23,7 +23,7 @@ export async function ensureWebhookRegistered() {
     const exist = data.find((webhook) => webhook.metadata?.appPid === env.appPid);
     if (exist) {
       await stripe.webhookEndpoints.update(exist.id, {
-        url: STRIPE_ENDPOINT,
+        url: stripeEndpoint(),
         description: env.appName,
         enabled_events: STRIPE_EVENTS,
         disabled: false,
@@ -31,7 +31,7 @@ export async function ensureWebhookRegistered() {
       logger.info('stripe webhook updated');
     } else {
       const result = await stripe.webhookEndpoints.create({
-        url: STRIPE_ENDPOINT,
+        url: stripeEndpoint(),
         description: env.appName,
         enabled_events: STRIPE_EVENTS,
         api_version: STRIPE_API_VERSION,

package/api/src/libs/arcblock-transfer.ts

@@ -0,0 +1,27 @@
+import type { Transaction } from '@ocap/client';
+import { encodeTx, fetchContext } from '@ocap/client/encode';
+
+type TransferWallet = {
+  address: string;
+  publicKey?: string;
+  pk?: string;
+};
+
+export async function encodeArcblockTransfer({
+  chainHost,
+  tx,
+  wallet,
+}: {
+  chainHost: string;
+  tx: Partial<Transaction>;
+  wallet: TransferWallet;
+}) {
+  const context = await fetchContext(chainHost);
+  return encodeTx({
+    type: 'TransferV3Tx',
+    tx: tx as any,
+    wallet,
+    chainId: context.chainId,
+    feeConfig: context.txFee,
+  });
+}

package/api/src/libs/context.ts

@@ -14,6 +14,7 @@ interface RequestContext {
   requestedBy?: string;
   requestId?: string;
   instanceDid?: string;
+  publicBaseUrl?: string;
 }
 
 class RequestContextManager {
@@ -74,6 +75,11 @@ class RequestContextManager {
     return this.storage.getStore()?.instanceDid;
   }
 
+  /** Request-scoped externally reachable payment base URL, when supplied by an embedded host. */
+  peekPublicBaseUrl(): string | undefined {
+    return this.storage.getStore()?.publicBaseUrl;
+  }
+
   /**
    * Run fn as a system operation: TenantModel scoping is bypassed for the span
    * of fn so legitimate cross-tenant reads can load rows regardless of tenant.
@@ -92,17 +98,19 @@ class RequestContextManager {
 
   run<T>(context: RequestContext, fn: () => Promise<T> | T): Promise<T> {
     const requestId = context.requestId || `req_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
-    // inherit tenant from the enclosing scope unless explicitly provided
+    // inherit host-established request fields unless explicitly provided
     const instanceDid = context.instanceDid ?? this.storage.getStore()?.instanceDid;
+    const publicBaseUrl = context.publicBaseUrl ?? this.storage.getStore()?.publicBaseUrl;
 
     this.contexts.set(requestId, {
       ...context,
       instanceDid,
+      publicBaseUrl,
       requestId,
     });
 
     return new Promise((resolve, reject) => {
-      this.storage.run({ ...context, instanceDid, requestId }, async () => {
+      this.storage.run({ ...context, instanceDid, publicBaseUrl, requestId }, async () => {
         const resource = new AsyncResource('RequestContext');
         try {
           const result = await resource.runInAsyncScope(fn);

package/api/src/libs/did-connect/tenant-identity.ts

@@ -22,6 +22,7 @@ import type { WalletObject } from '@ocap/wallet';
 import { getInstanceDid } from '../context';
 import { getIdentityDriver, type InstanceAppInfo, type BlockletDirectory } from '../drivers';
 import logger from '../logger';
+import { warmupSecrets } from '../secrets';
 
 const walletType = {
   role: Mcrypto.types.RoleType.ROLE_APPLICATION,
@@ -165,10 +166,27 @@ export function getCachedTenantIdentity(instanceDidArg?: string): ResolvedTenant
  */
 export async function warmTenantIdentity(instanceDidArg?: string): Promise<void> {
   if (!hasDynamicIdentity()) return;
+  // The wallet signing identity (getInstanceAppIdentity) and the secrets keyring EK
+  // (getAppEk) are INDEPENDENT host concerns. Warm them in SEPARATE try blocks: a
+  // wallet-identity failure (e.g. an AUTH_SERVICE that does not implement
+  // getInstanceAppIdentity) must NOT also skip the secrets warm. Coupling them left
+  // the keyring cold whenever wallet identity was unavailable, so every PaymentMethod
+  // settings/Stripe decrypt 500'd on an undefined crypto key — even though the
+  // Stripe/USD path never needs the wallet identity.
   try {
     await resolveTenantIdentity(instanceDidArg);
   } catch (err: unknown) {
-    logger.warn('[tenant-identity] warm failed — wallet access will fail-closed', {
+    logger.warn('[tenant-identity] wallet identity warm failed — wallet access will fail-closed', {
+      error: err instanceof Error ? err.message : String(err),
+    });
+  }
+  // The keyring secrets driver warms the tenant EK so PaymentMethod settings
+  // encrypt/decrypt + getStripeClient resolve on the sync hot path (else "secrets:
+  // key for tenant <did> is not warmed"). No-op for the default single-key driver.
+  try {
+    await warmupSecrets(instanceDidArg);
+  } catch (err: unknown) {
+    logger.warn('[tenant-identity] secrets warm failed — settings/Stripe decrypt will fail-closed', {
       error: err instanceof Error ? err.message : String(err),
     });
   }

package/api/src/libs/env.ts

@@ -178,6 +178,7 @@ export const googlePubsubAllowUnverifiedSender = (): boolean =>
   parseBool(readConfig('GOOGLE_PUBSUB_ALLOW_UNVERIFIED_SENDER'));
 export const googlePlayWebhookUrl = (): string | undefined => readConfig('GOOGLE_PLAY_WEBHOOK_URL');
 export const stripeWebhookSecret = (): string | undefined => readConfig('STRIPE_WEBHOOK_SECRET');
+export const stripeWebhookUrl = (): string | undefined => readConfig('STRIPE_WEBHOOK_URL');
 export const iapReconcileBatchSize = (): number => Number(readConfig('IAP_RECONCILE_BATCH_SIZE') ?? '100');
 
 // -- payment params --

package/api/src/libs/notification/index.ts

@@ -12,10 +12,11 @@ let blockletSdkTransportGuarded = false;
 
 /** Replace `fns` with no-ops on both the module namespace and its `default` export. */
 function noopSdkTransport(mod: any, fns: string[]): void {
-  const noop = async (): Promise<undefined> => undefined;
+  const noop = (): Promise<undefined> => Promise.resolve(undefined);
   for (const target of [mod, mod?.default]) {
-    if (!target) continue;
-    for (const fn of fns) target[fn] = noop;
+    if (target) {
+      for (const fn of fns) target[fn] = noop;
+    }
   }
 }
 

package/api/src/libs/util.ts

@@ -13,7 +13,16 @@ import axios from 'axios';
 import { fromUnitToToken } from '@ocap/util';
 import get from 'lodash/get';
 import trimEnd from 'lodash/trimEnd';
-import { googlePlayWebhookUrl, blockletAppUrl, blockletMountPoints, blockletAppId, blockletAppName } from './env';
+import {
+  googlePlayWebhookUrl,
+  stripeWebhookUrl,
+  blockletAppUrl,
+  blockletMountPoints,
+  blockletAppId,
+  blockletAppName,
+  readConfig,
+} from './env';
+import { context } from './context';
 import dayjs from './dayjs';
 import { blocklet, wallet } from './auth';
 import type { PaymentCurrency, PaymentMethod, Subscription } from '../store/models';
@@ -29,7 +38,19 @@ export const MIN_RETRY_MAIL = 13; // total retry time before sending first mail:
 export const CHECKOUT_SESSION_TTL = 6 * 60 * 60; // expires in 6 hours, then removed after 12 hours
 
 export const STRIPE_API_VERSION = '2023-08-16';
-export const STRIPE_ENDPOINT: string = getUrl('/api/integrations/stripe/webhook');
+// Stripe webhook must be an ABSOLUTE https URL. In the embedded (arc-node) runtime
+// getUrl() returns a relative path (no host) which Stripe rejects — registration
+// then fails (and is currently swallowed) so payments never reconcile (session
+// stuck unpaid). Mirror googlePlayEndpoint: prefer the STRIPE_WEBHOOK_URL override,
+// fall back to getUrl. Lazy-eval (function) because dotenv loads env AFTER this
+// module is imported — a module-load constant would only ever see the relative path.
+export const stripeEndpoint = (): string => {
+  const override = stripeWebhookUrl();
+  if (override) return override;
+  const publicBaseUrl = context.peekPublicBaseUrl();
+  if (publicBaseUrl) return joinURL(publicBaseUrl, '/api/integrations/stripe/webhook');
+  return getUrl('/api/integrations/stripe/webhook');
+};
 // Pub/Sub OIDC tokens carry the push-subscription endpoint as `aud` claim. When
 // the dev server is reached via a custom domain (e.g. a Cloudflare tunnel), the
 // BLOCKLET_APP_URL-derived default won't match the URL Google signs against.
@@ -95,6 +116,14 @@ export const api = axios.create({
   timeout: 10 * 1000,
 });
 
+export function getPublicAssetUrl(assetUrl: string): string {
+  if (!assetUrl || !assetUrl.startsWith('/') || assetUrl.startsWith('//')) return assetUrl;
+  const basePath = readConfig('PAYMENT_PUBLIC_BASE_PATH');
+  if (!basePath) return getUrl(assetUrl);
+  if (assetUrl === basePath || assetUrl.startsWith(`${basePath}/`)) return assetUrl;
+  return joinURL(basePath, assetUrl);
+}
+
 export function md5(input: string) {
   return crypto.createHash('md5').update(input).digest('hex');
 }

package/api/src/middlewares/hono/csrf.ts

@@ -48,6 +48,12 @@ export function csrf(): MiddlewareHandler {
   // type to the MiddlewareHandler contract.
   // eslint-disable-next-line require-await
   return async (c, next) => {
+    // Escape hatch (TEST / STAGING ONLY): PAYMENT_DISABLE_CSRF=true bypasses CSRF
+    // verification entirely. This removes cross-site request forgery protection on
+    // ALL mutating payment routes — NEVER set it in production. Defaults off, so the
+    // standard secure behavior is unchanged unless a deployment opts out explicitly.
+    if (readConfig('PAYMENT_DISABLE_CSRF') === 'true') return next();
+
     const method = c.req.method.toUpperCase();
     const loginToken = getCookie(c, 'login_token');
     const existingCsrf = getCookie(c, 'x-csrf-token');

package/api/src/middlewares/hono/session.ts

@@ -104,6 +104,28 @@ export function sessionMiddleware(options: SessionOptions = {}): MiddlewareHandl
       return c.json({ error: err.message }, 401);
     }
 
+    // Embedded / blocklet-server PRIMARY auth path. The host adapter (arc-node CF
+    // gate via cf-adapter.injectCaller, or blocklet-server) verifies the caller
+    // upstream, STRIPS any client-forged `x-user-*`, then injects the real caller as
+    // `x-user-*` headers — exactly what authenticate() (security.ts) already trusts.
+    // sessionMiddleware historically only checked the login_token cookie, so under
+    // embedded (where the login_token is arc's, NOT verifiable by payment's
+    // @blocklet/sdk verifyLoginToken) session-scoped routes like /customers/me saw
+    // no user and 403'd even for a logged-in caller — which left the checkout
+    // customer form unpopulated. Honor the injected identity as a fallback.
+    if (!result) {
+      const injectedDid = c.req.header('x-user-did');
+      if (injectedDid) {
+        result = {
+          did: injectedDid,
+          role: c.req.header('x-user-role'),
+          provider: c.req.header('x-user-provider'),
+          fullName: decodeURIComponent(c.req.header('x-user-fullname') || ''),
+          walletOS: c.req.header('x-user-wallet-os') || '',
+        };
+      }
+    }
+
     if (result) {
       c.set('user', result);
     }

package/api/src/routes/connect/pay.ts

@@ -5,6 +5,7 @@ import { fromAddress } from '@ocap/wallet';
 import { encodeTransferItx } from '../../integrations/ethereum/token';
 import { executeEvmTransaction, waitForEvmTxConfirm } from '../../integrations/ethereum/tx';
 import { CallbackArgs, ethWallet } from '../../libs/auth';
+import { encodeArcblockTransfer } from '../../libs/arcblock-transfer';
 import logger from '../../libs/logger';
 import { parseChainError } from '../../libs/chain-error';
 import { getGasPayerExtra } from '../../libs/payment';
@@ -127,25 +128,36 @@ export default {
 
     if (paymentMethod.type === 'arcblock') {
       try {
-        await paymentIntent.update({ status: 'processing' });
         const client = paymentMethod.getOcapClient();
         const claim = claims.find((x) => x.type === 'prepareTx');
 
-        // Warm up chain context cache to avoid setTimeout(resolve,0) hang in workerd
-        await client.getContext();
-
         const tx: Partial<Transaction> = client.decodeTx(claim.finalTx);
         if (claim.delegator && claim.from) {
           tx.delegator = claim.delegator;
           tx.from = claim.from;
         }
 
-        // @ts-ignore
-        const { buffer } = await client.encodeTransferV3Tx({ tx });
+        const chainHost = paymentMethod.settings.arcblock?.api_host;
+        if (!chainHost) {
+          throw new Error('ArcBlock payment method API host is missing');
+        }
+        const signingWallet = fromAddress(userDid);
+        const { object: encodedTx, buffer } = await encodeArcblockTransfer({
+          chainHost,
+          tx,
+          wallet: signingWallet,
+        });
+        const gasPayerExtra = await getGasPayerExtra(buffer, client.pickGasPayerHeaders(request), client);
+
+        // Only expose processing after all cold-start preparation has completed.
+        // If context fetching/encoding is canceled by workerd, the intent remains
+        // retryable instead of being stranded in processing without a tx hash.
+        await paymentIntent.update({ status: 'processing' });
         const txHash = await client.sendTransferV3Tx(
-          // @ts-ignore
-          { tx, wallet: fromAddress(userDid) },
-          await getGasPayerExtra(buffer, client.pickGasPayerHeaders(request), client)
+          // Passing the already-encoded signature skips the client's timer-backed
+          // encodeTransferV3Tx/getContext path in Cloudflare Workers.
+          { tx: encodedTx as any, wallet: signingWallet, signature: encodedTx.signature },
+          gasPayerExtra
         );
 
         const quoteValidation = await validateQuoteForPayment({

package/api/src/routes/hono/entitlements.ts

@@ -26,7 +26,14 @@ import { PaymentMethod } from '../../store/models';
 const app = new Hono();
 // component+owner/admin for cross-blocklet calls; ensureLogin for end users —
 // handler then enforces that non-admin users can only query their own DID.
-const auth = authenticate<PaymentMethod>({ component: true, roles: ['owner', 'admin'], ensureLogin: true });
+// Any signed-in user can query their OWN entitlements (the handler bodies
+// below already gate cross-customer reads via isSelf(...) + isAdminUser).
+// A roles-list here would block normal wallet users at the middleware (their
+// role is "user", not owner/admin) before isSelf ever runs, so the IAP
+// "Subscribe + check my own entitlement" loop returned 403 for every real
+// end user. Keep `component: true` so server-to-server signed calls bypass
+// auth as before; keep `ensureLogin` so unauthenticated requests still 401.
+const auth = authenticate<PaymentMethod>({ component: true, ensureLogin: true });
 
 function isAdminUser(role?: string): boolean {
   return role === 'owner' || role === 'admin';

package/api/src/routes/hono/payment-methods.ts

@@ -109,7 +109,9 @@ app.post('/', auth, async (c) => {
 
     await method.update({ default_currency_id: currency.id });
 
-    ensureWebhookRegistered().catch(console.error);
+    ensureWebhookRegistered().catch((err) =>
+      logger.error('ensureWebhookRegistered failed (payments may not reconcile in real-time)', err)
+    );
 
     return c.json({ ...method.toJSON(), payment_currencies: [currency.toJSON()] });
   }
@@ -532,7 +534,9 @@ app.put('/:id', auth, async (c) => {
 
     const updatedMethod = await method.update(updateData);
     if (method.type === 'stripe') {
-      ensureWebhookRegistered().catch(console.error);
+      ensureWebhookRegistered().catch((err) =>
+        logger.error('ensureWebhookRegistered failed (payments may not reconcile in real-time)', err)
+      );
     }
     return c.json(updatedMethod);
   } catch (err) {

package/api/src/service.ts

@@ -275,10 +275,30 @@ export function buildConnectRoutesHono(): Hono {
   // withTenant) we pass through; otherwise we resolve Host→tenant once and wrap.
   connectApp.use('*', async (c, next) => {
     const { context: requestCtx } = require('./libs/context');
-    if (requestCtx.peekInstanceDid()) return next();
+    const { warmTenantIdentity } = require('./libs/did-connect/tenant-identity');
+    // Warm the tenant's signing identity + secrets keyring BEFORE the DID handler so
+    // the synchronous secrets hot path (connect/pay → getStripeClient →
+    // PaymentMethod.decryptSettings) resolves — else it throws "secrets: key for
+    // tenant <did> is not warmed". Mirrors contextMiddleware (context.ts); the native
+    // resource group warms there, but connectApp is mounted ALONGSIDE it (no shared
+    // pipeline), so DID routes must warm themselves. Best-effort + no-op on
+    // blocklet-server (hasDynamicIdentity() === false).
+    const preResolved = requestCtx.peekInstanceDid();
+    if (preResolved) {
+      // Host already scoped this request (e.g. the CF worker wrapped /api/* in
+      // withTenant before the core ran) — run inside that context; warm is idempotent
+      // (cache hit if the host already warmed).
+      await warmTenantIdentity(preResolved);
+      return next();
+    }
+    // arc-node embedded (svc.http.fetch) never pre-wraps: resolve Host→tenant once,
+    // run inside the tenant context, and warm before the handler.
     const { resolveTenantForHost } = require('./libs/drivers/identity');
     const instanceDid = await resolveTenantForHost(c.req.header('host'));
-    return requestCtx.withTenant(instanceDid, () => next());
+    return requestCtx.withTenant(instanceDid, async () => {
+      await warmTenantIdentity(instanceDid);
+      return next();
+    });
   });
 
   for (const h of connectHandlerModules()) handlers.attach(Object.assign({ app: connectApp }, h));
@@ -455,8 +475,20 @@ async function provisionTenant(instanceDid: string): Promise<void> {
   const { PaymentMethod, PaymentCurrency } = require('./store/models');
 
   const CHAINS = [
-    { chainId: 'main', livemode: true, symbol: 'ABT', label: 'ArcBlock Main', contract: 'z35nNRvYxBoHitx9yZ5ATS88psfShzPPBLxYD' },
-    { chainId: 'beta', livemode: false, symbol: 'TBA', label: 'ArcBlock Beta', contract: 'z35n6UoHSi9MED4uaQy6ozFgKPaZj2UKrurBG' },
+    {
+      chainId: 'main',
+      livemode: true,
+      symbol: 'ABT',
+      label: 'ArcBlock Main',
+      contract: 'z35nNRvYxBoHitx9yZ5ATS88psfShzPPBLxYD',
+    },
+    {
+      chainId: 'beta',
+      livemode: false,
+      symbol: 'TBA',
+      label: 'ArcBlock Beta',
+      contract: 'z35n6UoHSi9MED4uaQy6ozFgKPaZj2UKrurBG',
+    },
   ];
 
   await requestContext.withTenant(instanceDid, async () => {
@@ -464,6 +496,11 @@ async function provisionTenant(instanceDid: string): Promise<void> {
     const existing = await PaymentMethod.findOne({ where: { type: 'arcblock' } });
     if (existing) return;
 
+    // Sequential by design: only 2 chains, and within each the currency needs the
+    // method id and the method's default_currency_id needs the currency id — no
+    // intra-chain parallelism is possible, and inter-chain ordering is irrelevant
+    // for two one-time seed inserts.
+    /* eslint-disable no-await-in-loop */
     for (const chain of CHAINS) {
       const logo = '/methods/arcblock.png';
       const method = await PaymentMethod.create({
@@ -507,6 +544,7 @@ async function provisionTenant(instanceDid: string): Promise<void> {
       });
       await method.update({ default_currency_id: currency.id });
     }
+    /* eslint-enable no-await-in-loop */
     logger.info('provisionTenant: seeded arcblock payment methods + currencies', { instanceDid });
   });
 }

package/api/src/store/models/payment-currency.ts

@@ -19,7 +19,7 @@ import type { LiteralUnion } from 'type-fest';
 import { fromTokenToUnit } from '@ocap/util';
 import { TenantModel } from '../tenant-model';
 import { getInstanceDid } from '../../libs/context';
-import { createIdGenerator } from '../../libs/util';
+import { createIdGenerator, getPublicAssetUrl } from '../../libs/util';
 import { RechargeConfig, VaultConfig } from './types';
 
 const nextId = createIdGenerator('pc', 12);
@@ -57,6 +57,12 @@ export class PaymentCurrency extends TenantModel<InferAttributes<PaymentCurrency
   declare recharge_config?: RechargeConfig;
   declare token_config?: Record<string, any> | null;
 
+  public override toJSON(): any {
+    const data = super.toJSON() as any;
+    if (data.logo) data.logo = getPublicAssetUrl(data.logo);
+    return data;
+  }
+
   public static readonly GENESIS_ATTRIBUTES = {
     id: {
       type: DataTypes.STRING(15),

package/api/src/store/models/payment-method.ts

@@ -16,7 +16,7 @@ import { encryptSecret, decryptSecret } from '../../libs/secrets';
 
 import { AppStoreClient } from '../../integrations/app-store/client';
 import { GooglePlayClient } from '../../integrations/google-play/client';
-import { STRIPE_API_VERSION, createIdGenerator } from '../../libs/util';
+import { STRIPE_API_VERSION, createIdGenerator, getPublicAssetUrl } from '../../libs/util';
 import { sequelize } from '../sequelize';
 import type { PaymentMethodSettings } from './types';
 import { CHARGE_SUPPORTED_CHAIN_TYPES, EVM_CHAIN_TYPES } from '../../libs/constants';
@@ -73,6 +73,12 @@ export class PaymentMethod extends TenantModel<InferAttributes<PaymentMethod>, I
   declare created_at: CreationOptional<Date>;
   declare updated_at: CreationOptional<Date>;
 
+  public override toJSON(): any {
+    const data = super.toJSON() as any;
+    if (data.logo) data.logo = getPublicAssetUrl(data.logo);
+    return data;
+  }
+
   public static readonly GENESIS_ATTRIBUTES = {
     id: {
       type: DataTypes.STRING(30),
@@ -170,11 +176,21 @@ export class PaymentMethod extends TenantModel<InferAttributes<PaymentMethod>, I
 
   public static encryptSettings(settings: PaymentMethodSettings) {
     const tmp = cloneDeep(settings);
-    if (tmp.stripe) {
+    // Per-field truthy guards: admin UI submits *all* channel stubs (empty
+    // strings for the ones the user is not configuring), so a parent-level
+    // `if (tmp.stripe)` would gladly enter the branch and call
+    // encryptSecret('') for every empty stub. Under the multi-tenant
+    // KeyringSecretsDriver, CryptoJS.AES.encrypt(undefined, …) throws
+    // "Cannot read properties of undefined (reading 'encrypt')" — the
+    // single-tenant DefaultSecretsDriver swallowed it silently. Field-level
+    // guards make the function robust to either caller shape.
+    if (tmp.stripe?.secret_key) {
       tmp.stripe.secret_key = encryptSecret(tmp.stripe.secret_key);
+    }
+    if (tmp.stripe?.webhook_signing_secret) {
       tmp.stripe.webhook_signing_secret = encryptSecret(tmp.stripe.webhook_signing_secret);
     }
-    if (tmp.google_play) {
+    if (tmp.google_play?.service_account_json) {
       tmp.google_play.service_account_json = encryptSecret(tmp.google_play.service_account_json);
     }
     if (tmp.app_store?.private_key_pem) {
@@ -189,11 +205,16 @@ export class PaymentMethod extends TenantModel<InferAttributes<PaymentMethod>, I
 
   public static decryptSettings(settings: PaymentMethodSettings) {
     const tmp = cloneDeep(settings);
-    if (tmp.stripe) {
+    // Same per-field guard as encryptSettings — empty stubs from the admin
+    // UI roundtrip would otherwise hit decryptSecret('') and explode under
+    // the keyring driver.
+    if (tmp.stripe?.secret_key) {
       tmp.stripe.secret_key = decryptSecret(tmp.stripe.secret_key);
+    }
+    if (tmp.stripe?.webhook_signing_secret) {
       tmp.stripe.webhook_signing_secret = decryptSecret(tmp.stripe.webhook_signing_secret);
     }
-    if (tmp.google_play) {
+    if (tmp.google_play?.service_account_json) {
       tmp.google_play.service_account_json = decryptSecret(tmp.google_play.service_account_json);
     }
     if (tmp.app_store?.private_key_pem) {
@@ -250,7 +271,10 @@ export class PaymentMethod extends TenantModel<InferAttributes<PaymentMethod>, I
       // wallets only decode protobuf-encoded tx bytes. Use `@ocap/client/legacy`
       // (protobuf client) so encode / decode / broadcast all stay protobuf,
       // matching the wallet signatures and what the chain node expects to hash.
-      const created = new OcapClient(host);
+      // Disable the client's implicit getContext() warmup. Its zero-delay timer
+      // can be classified as a permanently hung request by workerd. Callers that
+      // need chain context fetch it explicitly through Worker-safe I/O.
+      const created = new OcapClient(host, false);
       ocapClients.set(host, created);
       return created;
     }

package/api/tests/libs/arcblock-transfer.spec.ts

@@ -0,0 +1,58 @@
+const fetchContext = jest.fn();
+const encodeTx = jest.fn();
+
+jest.mock('@ocap/client/encode', () => ({
+  fetchContext,
+  encodeTx,
+}));
+
+import { encodeArcblockTransfer } from '../../src/libs/arcblock-transfer';
+
+describe('encodeArcblockTransfer', () => {
+  beforeEach(() => {
+    fetchContext.mockReset();
+    encodeTx.mockReset();
+  });
+
+  it('uses the worker-safe context fetcher instead of the OCAP client context timer', async () => {
+    fetchContext.mockResolvedValue({
+      chainId: 'beta',
+      txFee: [{ typeUrl: 'fg:t:transfer_v3', fee: '0' }],
+    });
+    const encoded = {
+      object: { signature: Buffer.from('signed') },
+      buffer: Buffer.from('encoded'),
+    };
+    encodeTx.mockReturnValue(encoded);
+
+    const client = {
+      getContext: jest.fn(() => {
+        throw new Error('must not call timer-backed getContext');
+      }),
+      encodeTransferV3Tx: jest.fn(() => {
+        throw new Error('must not call timer-backed client encoder');
+      }),
+    };
+    const tx = { chainId: '', itx: { typeUrl: 'fg:t:transfer_v3', value: { outputs: [] } } };
+    const wallet = { address: 'zUser', publicKey: 'zPk' };
+
+    await expect(
+      encodeArcblockTransfer({
+        chainHost: 'https://beta.abtnetwork.io/api/',
+        tx,
+        wallet,
+      })
+    ).resolves.toBe(encoded);
+
+    expect(fetchContext).toHaveBeenCalledWith('https://beta.abtnetwork.io/api/');
+    expect(encodeTx).toHaveBeenCalledWith({
+      type: 'TransferV3Tx',
+      tx,
+      wallet,
+      chainId: 'beta',
+      feeConfig: [{ typeUrl: 'fg:t:transfer_v3', fee: '0' }],
+    });
+    expect(client.getContext).not.toHaveBeenCalled();
+    expect(client.encodeTransferV3Tx).not.toHaveBeenCalled();
+  });
+});

package/api/tests/libs/util.spec.ts

@@ -19,12 +19,63 @@ import {
   resolveAddressChainTypes,
   formatCurrencyInfo,
   getExplorerTxUrl,
+  getPublicAssetUrl,
+  stripeEndpoint,
 } from '../../src/libs/util';
+import { setCoreConfig } from '../../src/libs/env';
 import type { Subscription, PaymentMethod, PaymentCurrency } from '../../src/store/models';
 
 import { blocklet } from '../../src/libs/auth';
+import { context } from '../../src/libs/context';
 import logger from '../../src/libs/logger';
 
+describe('stripeEndpoint', () => {
+  afterEach(() => setCoreConfig(undefined));
+
+  it('uses the request-scoped embedded payment public base URL', async () => {
+    const endpoint = await context.run(
+      { publicBaseUrl: 'https://cf-aside.ofind.cn/.well-known/payment' },
+      async () => stripeEndpoint()
+    );
+
+    expect(endpoint).toBe(
+      'https://cf-aside.ofind.cn/.well-known/payment/api/integrations/stripe/webhook'
+    );
+  });
+
+  it('prefers the explicit webhook URL override', async () => {
+    setCoreConfig({ STRIPE_WEBHOOK_URL: 'https://hooks.example.com/stripe' });
+
+    const endpoint = await context.run(
+      { publicBaseUrl: 'https://cf-aside.ofind.cn/.well-known/payment' },
+      async () => stripeEndpoint()
+    );
+
+    expect(endpoint).toBe('https://hooks.example.com/stripe');
+  });
+});
+
+describe('getPublicAssetUrl', () => {
+  afterEach(() => setCoreConfig(undefined));
+
+  it('prefixes root-relative assets with the embedded payment mount', () => {
+    setCoreConfig({ PAYMENT_PUBLIC_BASE_PATH: '/.well-known/payment' });
+    expect(getPublicAssetUrl('/methods/arcblock.png')).toBe('/.well-known/payment/methods/arcblock.png');
+  });
+
+  it('keeps external asset URLs unchanged', () => {
+    setCoreConfig({ PAYMENT_PUBLIC_BASE_PATH: '/.well-known/payment' });
+    expect(getPublicAssetUrl('https://cdn.example.com/arcblock.png')).toBe('https://cdn.example.com/arcblock.png');
+  });
+
+  it('does not duplicate an existing embedded payment mount', () => {
+    setCoreConfig({ PAYMENT_PUBLIC_BASE_PATH: '/.well-known/payment' });
+    expect(getPublicAssetUrl('/.well-known/payment/methods/arcblock.png')).toBe(
+      '/.well-known/payment/methods/arcblock.png'
+    );
+  });
+});
+
 describe('createIdGenerator', () => {
   it('should return a function that generates an ID with the specified prefix and size', () => {
     const generateId = createIdGenerator('test', 10);

package/blocklet.yml

@@ -14,7 +14,7 @@ repository:
   type: git
   url: git+https://github.com/blocklet/payment-kit.git
 specVersion: 1.2.8
-version: 1.29.8
+version: 1.29.9
 logo: logo.png
 files:
   - dist

package/cloudflare/cf-adapter.ts

@@ -47,7 +47,7 @@ import {
   createCronRegistry,
   applyPaymentCoreMigrations,
 } from '../api/src/libs/drivers';
-import type { IdentityDriver } from '../api/src/libs/drivers';
+import type { IdentityDriver, InstanceAppIdentity } from '../api/src/libs/drivers';
 import { flushQueueWork, dispatchDueJobs, getQueueHandler } from '../api/src/libs/queue/runtime';
 import { Sequelize } from './shims/sequelize-d1/sequelize-class';
 import { setDB } from './shims/sequelize-d1/model';
@@ -111,6 +111,14 @@ export interface CloudflarePaymentAdapterOptions {
   /** Per-tenant EK source (semantics aligned with arc-node: connect-service `app:ek` else derive). */
   identity: {
     getAppEk: (instanceDid: string) => Promise<string> | string;
+    /**
+     * Per-instance app signing identity (S3-CF). When the host provides it — arc
+     * reads connect-service settings `app:sk`/`app:psk`, the SAME authority as
+     * getAppEk — it is the authoritative DID-Connect signer source. Optional: when
+     * the host doesn't wire it, the adapter falls back to the AUTH_SERVICE-backed
+     * CF driver (which fails closed if AUTH_SERVICE is also absent).
+     */
+    getInstanceAppIdentity?: (instanceDid: string) => Promise<InstanceAppIdentity> | InstanceAppIdentity;
   };
   /**
    * Host-resolved caller (CF API gate). The adapter injects it as `x-user-did`
@@ -210,7 +218,11 @@ export function buildFetch(deps: FetchDeps) {
       if (instanceDid) await warmTenantIdentity(instanceDid);
       return deps.svc.http.fetch(forwarded, { basePath: deps.basePath });
     };
-    const res = instanceDid ? await requestContext.withTenant(instanceDid, run) : await run();
+    const requestOrigin = new URL(request.url).origin;
+    const publicBaseUrl = new URL(deps.basePath, `${requestOrigin}/`).href.replace(/\/$/, '');
+    const res = await requestContext.run({ publicBaseUrl }, () =>
+      instanceDid ? requestContext.withTenant(instanceDid, run) : run()
+    );
 
     await deps.flush(); // drain workerd deferred queue work before responding
     return res;
@@ -323,7 +335,13 @@ export async function createCloudflarePaymentAdapter(
   const identity: IdentityDriver = {
     resolveInstanceDidForHost: () => null,
     getAppEk: (instanceDid: string) => options.identity.getAppEk(instanceDid),
-    getInstanceAppIdentity: cfDidConnectIdentity.getInstanceAppIdentity?.bind(cfDidConnectIdentity),
+    // Prefer the host-supplied per-instance identity (arc reads connect-service
+    // settings app:sk/psk — same authority as getAppEk); fall back to the
+    // AUTH_SERVICE-backed CF driver when the host doesn't wire it (the Phase 6
+    // binding). This is what lets arc-embedded CF resolve the DID-Connect signer
+    // without an AUTH_SERVICE service binding.
+    getInstanceAppIdentity:
+      options.identity.getInstanceAppIdentity ?? cfDidConnectIdentity.getInstanceAppIdentity?.bind(cfDidConnectIdentity),
     // per-tenant business wallet (single seam); directory stays the CF alias shim
     getBusinessWallet: cfDidConnectIdentity.getBusinessWallet,
   };
@@ -331,7 +349,11 @@ export async function createCloudflarePaymentAdapter(
   const svc: EmbeddedPaymentService = createEmbeddedPaymentService({
     // Host-global csrf secret via the config boundary (payment-core's csrf reads
     // PAYMENT_CSRF_SECRET through readConfig). NO sessionSecret (decision #5).
-    config: { ...(options.config ?? {}), ...(options.csrfSecret ? { PAYMENT_CSRF_SECRET: options.csrfSecret } : {}) },
+    config: {
+      ...(options.config ?? {}),
+      PAYMENT_PUBLIC_BASE_PATH: basePath,
+      ...(options.csrfSecret ? { PAYMENT_CSRF_SECRET: options.csrfSecret } : {}),
+    },
     db: { sequelize },
     tenancy: { mode: 'multi' },
     identity,
@@ -353,6 +375,15 @@ export async function createCloudflarePaymentAdapter(
     if (typeof (globalThis as any).__flushDeferredTimers === 'function') {
       (globalThis as any).__flushDeferredTimers();
     }
+    // Embedded binding alias: the standalone worker exposes the payment D1 as `DB`,
+    // but under arc the binding is `PAYMENT_DB`. Paths that read `__CF_ENV__.DB`
+    // directly — notably the DID-Connect token store (did-connect-token-storage.ts),
+    // which mints the wallet-pay QR auth token — would otherwise find no `DB` binding
+    // and fail token creation, leaving the QR blank. Alias it to the same payment
+    // database (where `_did_connect_tokens` lives) so those paths match standalone.
+    if (env && !env.DB && env.PAYMENT_DB) {
+      env.DB = env.PAYMENT_DB;
+    }
     (globalThis as any).__CF_ENV__ = env;
     (globalThis as any).__cfHttpContext__ = httpContext;
     (globalThis as any).__cfWaitUntil__ = (p: Promise<any>) => ctx.waitUntil(p);

package/cloudflare/did-connect-runtime.ts

@@ -78,13 +78,51 @@ export function createCloudflareIdentityDriver(): IdentityDriver {
       const cached = cache.get(instanceDid);
       if (cached && cached.expires > Date.now()) return cached.value;
       const svc = authService();
-      if (!svc || typeof svc.getInstanceAppIdentity !== 'function') {
-        throw new Error('[did-connect] AUTH_SERVICE.getInstanceAppIdentity unavailable — fail-closed');
+      // Preferred: the AUTH_SERVICE RPC (multi-tenant / newer blocklet-service resolves
+      // the per-instance app:sk). Fall back to the worker's OWN APP_SK/APP_PSK when the
+      // binding does not implement the method — which is exactly what blocklet-service's
+      // own getInstanceAppIdentity returns for the deployment app (sign.js:
+      // appSk = env.BLOCKLET_APP_SK). In single-tenant mode the instance IS the
+      // deployment app (instanceDid == APP_PID), so the worker's APP_SK is the correct
+      // signer. This makes the standalone worker (and embedded arc CF, which has no
+      // getInstanceAppIdentity RPC) self-sufficient for DID-Connect QR signing.
+      // Try the AUTH_SERVICE RPC first. NOTE: `typeof svc.getInstanceAppIdentity`
+      // is 'function' even on OLD blocklet-service builds (the RPC stub exists) — it
+      // only throws "does not implement the method" at CALL time. So we must catch the
+      // call itself and fall back, not gate on typeof.
+      if (svc && typeof svc.getInstanceAppIdentity === 'function') {
+        try {
+          const value: InstanceAppIdentity = await svc.getInstanceAppIdentity(instanceDid);
+          if (value && value.appSk) {
+            cache.set(instanceDid, { value, expires: Date.now() + TTL_MS });
+            return value;
+          }
+          // RPC reachable but returned nothing usable → fall through to local APP_SK.
+        } catch (err: any) {
+          // RPC not implemented on this AUTH_SERVICE version (or transport error) →
+          // fall through to the local APP_SK identity below.
+          console.warn(
+            '[did-connect] AUTH_SERVICE.getInstanceAppIdentity failed, falling back to local APP_SK:',
+            err?.message || err
+          );
+        }
       }
-      const value: InstanceAppIdentity = await svc.getInstanceAppIdentity(instanceDid);
-      if (!value || !value.appSk) {
-        throw new Error(`[did-connect] getInstanceAppIdentity returned no appSk for "${instanceDid}" — fail-closed`);
+      // Fallback: the worker's OWN APP_SK/APP_PSK — exactly what blocklet-service's
+      // getInstanceAppIdentity returns for the deployment app (sign.js: appSk =
+      // env.BLOCKLET_APP_SK). In single-tenant mode the instance IS the deployment app
+      // (instanceDid == APP_PID), so this is the correct DID-Connect signer. Makes the
+      // standalone worker + embedded arc CF (no getInstanceAppIdentity RPC) self-sufficient.
+      const env = (globalThis as any).__CF_ENV__ || {};
+      const appSk: string | undefined = env.APP_SK;
+      if (!appSk) {
+        throw new Error(
+          '[did-connect] getInstanceAppIdentity unavailable — AUTH_SERVICE lacks the RPC and no local APP_SK to fall back on — fail-closed'
+        );
       }
+      const value: InstanceAppIdentity = {
+        appSk,
+        ...(env.APP_PSK ? { appPsk: env.APP_PSK as string } : {}),
+      };
       cache.set(instanceDid, { value, expires: Date.now() + TTL_MS });
       return value;
     },

package/cloudflare/esbuild-cf-config.cjs

@@ -280,13 +280,18 @@ const alias = {
   'mime-types': s('shims/mime-types.ts'), // 150KB — lightweight shim with common MIME types
   'mime-db': s('shims/noop.ts'),
   ws: s('shims/ws-lite.ts'), //  66KB — native WebSocket wrapper for CF Workers
-  'crypto-js': s('shims/crypto-js-warn.ts'), // 115KB — AES legacy not used, warns if called
-  'crypto-js/aes': s('shims/crypto-js-warn.ts'),
-  'crypto-js/enc-base64': s('shims/noop.ts'),
-  'crypto-js/enc-hex': s('shims/noop.ts'),
-  'crypto-js/enc-latin1': s('shims/noop.ts'),
-  'crypto-js/enc-utf8': s('shims/noop.ts'),
-  'crypto-js/enc-utf16': s('shims/noop.ts'),
+  // crypto-js previously shimmed under the assumption "AES legacy not used".
+  // FALSE since Phase 11 multi-tenant: KeyringSecretsDriver
+  // (api/src/libs/drivers/secrets.ts) uses CryptoJS.AES.encrypt/decrypt for
+  // per-tenant PaymentMethod settings encryption — shimmed-to-warn made
+  // `CryptoJS.AES` undefined at runtime, and admin-side PaymentMethod
+  // create/update crashed with "Cannot read properties of undefined (reading
+  // 'encrypt')". The real bundle is ~115 KB (pure JS, Workers compatible);
+  // shipping the real module is the only correct fix because the same
+  // ciphertext must remain decryptable across node and CF tenants. Sub-path
+  // imports are not used by the payment graph, so we don't need to re-alias
+  // each `crypto-js/...` entry — they'll just no-op-resolve through the main
+  // module if anything ever pulls them.
 
   // Force ESM-only to avoid CJS+ESM double-bundling. These packages ship an
   // exports map with separate import/require conditions, so esbuild picks the

package/cloudflare/tests/cf-adapter.spec.ts

@@ -88,7 +88,14 @@ describe('createTenantProvisioner — lazy first-request provisioning, in-flight
 // A fake embedded service: captures what the adapter forwards (headers, raw body,
 // basePath) and the tenant context active at fetch time.
 function fakeSvc() {
-  const seen: { did?: string; role?: string; tenant?: string; basePath?: string; body?: string } = {};
+  const seen: {
+    did?: string;
+    role?: string;
+    tenant?: string;
+    publicBaseUrl?: string;
+    basePath?: string;
+    body?: string;
+  } = {};
   return {
     seen,
     http: {
@@ -96,6 +103,7 @@ function fakeSvc() {
         seen.did = req.headers.get('x-user-did') ?? undefined;
         seen.role = req.headers.get('x-user-role') ?? undefined;
         seen.tenant = requestContext.peekInstanceDid();
+        seen.publicBaseUrl = requestContext.peekPublicBaseUrl();
         seen.basePath = opts?.basePath;
         seen.body = await req.text();
         return new Response('ok', { status: 200 });
@@ -128,6 +136,7 @@ describe('buildFetch — drives the single http.fetch under the tenant context',
     expect(res.status).toBe(200);
     expect(svc.seen.did).toBe('did:abt:zREAL'); // forged stripped, real injected
     expect(svc.seen.tenant).toBe('did:abt:zTENANT'); // ran under withTenant
+    expect(svc.seen.publicBaseUrl).toBe('https://x/.well-known/payment');
     expect(svc.seen.basePath).toBe('/.well-known/payment');
     expect(svc.seen.body).toBe('raw-bytes'); // data-damage: raw body preserved
     expect(flushed).toBe(1);

package/cloudflare/worker.ts

@@ -10,6 +10,11 @@ import { Client as PgClient } from 'pg';
 import postgres from 'postgres';
 import { Hono } from 'hono';
 import { cors } from 'hono/cors';
+import { getCookie } from 'hono/cookie';
+// Worker-safe CSRF crypto (the SAME module the csrf middleware verifies with —
+// util/csrf passes through to the real package in the CF bundle, see build.ts).
+// eslint-disable-next-line import/no-extraneous-dependencies
+import { sign as signCsrf, getCsrfSecret } from '@blocklet/sdk/lib/util/csrf';
 import { setDB } from './shims/sequelize-d1/model';
 import { initialize } from '../api/src/store/models';
 import { Sequelize } from './shims/sequelize-d1/sequelize-class';
@@ -386,6 +391,20 @@ function buildApp(env: Env): Hono<HonoEnv> {
     // Flag: HTTP request context. createEvent uses waitUntil (non-blocking).
     // In queue consumer/cron, this flag is absent — createEvent uses __cfPendingJobs__ (blocking).
     (globalThis as any).__cfHttpContext__ = true;
+    // The @blocklet/sdk CSRF util reads its signing secret DIRECTLY from
+    // process.env (`BLOCKLET_APP_ASK || BLOCKLET_APP_SK`), not the config slot. The
+    // Phase-12a removal of the per-request process.env mirror left it undefined, so
+    // every CSRF-signed response hit `createHmac(<undefined key>)` → 500 (e.g.
+    // GET /api/settings). Restore just that one var from the APP_SK binding (the
+    // standalone worker's app secret key). Idempotent within the isolate.
+    if (c.env.APP_SK && !process.env.BLOCKLET_APP_SK) {
+      process.env.BLOCKLET_APP_SK = c.env.APP_SK;
+    }
+    // Test/staging escape hatch: forward PAYMENT_DISABLE_CSRF to the config boundary
+    // so the csrf middleware (readConfig) can honor it. Default-absent → CSRF stays on.
+    if ((c.env as any).PAYMENT_DISABLE_CSRF && !process.env.PAYMENT_DISABLE_CSRF) {
+      process.env.PAYMENT_DISABLE_CSRF = (c.env as any).PAYMENT_DISABLE_CSRF;
+    }
     setDB(withD1Retry(c.env.DB.withSession('first-primary')));
     ensureModelsInit();
 
@@ -496,6 +515,28 @@ function buildApp(env: Env): Hono<HonoEnv> {
   // Health check
   app.get('/health', (c) => c.json({ status: 'ok' }));
 
+  // did/csrfToken — the @blocklet/js-sdk axios adapter fetches its CSRF header from
+  // THIS endpoint (getCSRFTokenByLoginToken), not from the cookie. The shared
+  // blocklet-service (AUTH_SERVICE) only implements it on newer versions, so the
+  // catch-all proxy below 404s on older AUTH_SERVICE — leaving the SDK with no CSRF
+  // header and every mutating request 403'ing ("csrf token mismatch"). Sign it
+  // LOCALLY with the SAME secret + algorithm the payment csrf middleware verifies
+  // with (util/csrf sign over login_token), so token == cookie == what verify()
+  // expects. Must be registered BEFORE the /.well-known/service/* catch-all. This
+  // also makes the embedded arc-node CF runtime self-sufficient (no AUTH_SERVICE
+  // csrfToken endpoint required).
+  app.get('/.well-known/service/api/did/csrfToken', (c) => {
+    const loginToken = getCookie(c, 'login_token');
+    if (!loginToken) return c.json({ loginToken: null, csrfToken: null });
+    // Same secret resolution as the csrf middleware's csrfSecret() (PAYMENT_CSRF_SECRET
+    // override else the app secret key). Read APP_SK from the binding directly so we
+    // do not depend on the process.env.BLOCKLET_APP_SK mirror timing; getCsrfSecret()
+    // is the final fallback.
+    const secret = (c.env as any).PAYMENT_CSRF_SECRET || c.env.APP_SK || getCsrfSecret();
+    if (!secret) return c.json({ loginToken, csrfToken: null });
+    return c.json({ loginToken, csrfToken: signCsrf(secret, loginToken) });
+  });
+
   // user-session under /.well-known/service — proxy to blocklet-service session API
   // Returns full session data including connectedAccounts (needed by @arcblock/ux SessionUser)
   app.get('/.well-known/service/api/user-session', async (c) => {
@@ -691,7 +732,6 @@ function buildApp(env: Env): Hono<HonoEnv> {
       startsWithZ: sk.startsWith('z'),
     });
   });
-
   // === DID Auth Login routes ===
   // Only proxy login-related /api/did/* paths to blocklet-service.
   // Other /api/did/* paths (subscription, pay, collect, etc.) are Payment Kit's own

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "payment-kit",
-  "version": "1.29.8",
+  "version": "1.29.9",
   "scripts": {
     "dev": "blocklet dev --open",
     "prelint": "npm run types",
@@ -48,7 +48,7 @@
   "dependencies": {
     "@abtnode/cron": "^1.17.13-beta-20260613-094425-b81920c8",
     "@arcblock/did": "^1.30.24",
-    "@arcblock/did-connect-js": "^4.1.0",
+    "@arcblock/did-connect-js": "^4.1.2",
     "@arcblock/did-connect-react": "^3.5.4",
     "@arcblock/did-connect-storage-nedb": "^1.8.0",
     "@arcblock/did-util": "^1.30.24",
@@ -60,13 +60,13 @@
     "@blocklet/error": "^0.3.5",
     "@blocklet/js-sdk": "^1.17.13-beta-20260613-094425-b81920c8",
     "@blocklet/logger": "^1.17.13-beta-20260613-094425-b81920c8",
-    "@blocklet/payment-broker-client": "1.29.8",
-    "@blocklet/payment-react": "1.29.8",
-    "@blocklet/payment-vendor": "1.29.8",
+    "@blocklet/payment-broker-client": "1.29.9",
+    "@blocklet/payment-react": "1.29.9",
+    "@blocklet/payment-vendor": "1.29.9",
     "@blocklet/sdk": "^1.17.13-beta-20260613-094425-b81920c8",
     "@blocklet/ui-react": "^3.5.4",
-    "@blocklet/uploader": "^0.3.20",
-    "@blocklet/xss": "^0.3.16",
+    "@blocklet/uploader": "^0.15.4",
+    "@blocklet/xss": "^0.15.4",
     "@hono/node-server": "2.0.4",
     "@mui/icons-material": "^7.1.2",
     "@mui/lab": "7.0.0-beta.14",
@@ -133,7 +133,7 @@
   "devDependencies": {
     "@abtnode/types": "^1.17.13-beta-20260613-094425-b81920c8",
     "@arcblock/eslint-config-ts": "^0.3.3",
-    "@blocklet/payment-types": "1.29.8",
+    "@blocklet/payment-types": "1.29.9",
     "@types/connect": "^3.4.38",
     "@types/debug": "^4.1.12",
     "@types/dotenv-flow": "^3.3.3",
@@ -180,5 +180,5 @@
       "parser": "typescript"
     }
   },
-  "gitHead": "547c0614f1f83abad80ea08452d2f5a9f4f5aa07"
+  "gitHead": "249bd9bf3c6cc54f77c260edb4b4d3c0be60f126"
 }

package/src/components/layout/user.tsx

@@ -34,7 +34,13 @@ export default function UserLayout(props: any) {
     return (
       <PaymentProvider session={session} connect={connectApi}>
         <UserCenter
-          currentTab={`${window.blocklet.prefix}customer`}
+          // Must match the userCenter nav link declared in blocklet.yml (`link: /customer`).
+          // UserCenter resolves both this prop and the nav link via `new URL(x, origin).pathname`,
+          // which strips any mount prefix — so the nav tab always resolves to the bare `/customer`.
+          // Prefixing here (e.g. `${prefix}customer`) makes the active tab fail to match, which
+          // triggers UserCenter's auto-redirect to the bare nav link and 404s the embedded mount
+          // (#1394). The bare path also works in the non-embedded form, where prefix is `/`.
+          currentTab="/customer"
           hideFooter
           embed={embed === '1'}
           notLoginContent="undefined">

package/vite.arc.config.ts

@@ -29,6 +29,25 @@ export default defineConfig({
   root: coreDir,
   base: `${UI_PREFIX}/`,
   plugins: [
+    // Inject the Buffer polyfill at the top of the entry — the did-connect
+    // SessionProvider.refresh path serializes request bodies with Buffer, which is
+    // undefined in the browser, so without this the arc-embedded payment SPA throws
+    // "ReferenceError: Buffer is not defined" on session refresh and never renders.
+    // The standalone cloudflare/vite.config.ts already does this (cf-buffer-polyfill);
+    // the arc build was missing it. Reuses the same shim.
+    {
+      name: 'arc-buffer-polyfill',
+      enforce: 'pre' as const,
+      transform(code: string, id: string) {
+        if (id.endsWith('/src/index.tsx')) {
+          const shim = path
+            .resolve(coreDir, 'cloudflare/frontend-shims/buffer-polyfill.ts')
+            .replace(/\\/g, '/');
+          return `import '${shim}';\n` + code;
+        }
+        return undefined;
+      },
+    },
     tsconfigPaths({ root: coreDir }),
     react(),
     // Build-time window.blocklet bootstrap (P2 helper, single source). The