fix(web): restore user-wallet payment preparation

[SuPuHe]

Summary

Restore the Privy browser-wallet wiring in the authenticated web console. Without this wiring, the approval UI fell back to POST /v1/jobs and never exposed the user-wallet prepare/submit flow.

Scope and acceptance criteria

• The change is limited to the web payment approval wiring and its context record.
• Privy-authenticated console passes usePrivyUserWallet() into App.
• Connected-wallet approval uses /v1/jobs/user-wallet/prepare, wallet confirmation, then /v1/jobs/{jobId}/user-wallet/submit.
• No-wallet/server-wallet composition remains unchanged.
• No unrelated product cleanup is included.

Product and security invariants

• Tenant isolation remains fail-closed.
• Sponsor authorization, auditability, and daily caps remain enforced where applicable.
• Recipients cannot modify sponsor controls or access sponsor-only data.
• No secret, token, production identifier, or personal data is committed or pasted into review prompts.
• Settlement and idempotency boundaries are unchanged; this is web-only wiring.

Invariant notes:

The existing prepare, durable payment identity, hash recording, receipt verification, UNKNOWN handling, and no-replacement-transfer logic are unchanged. This diff only restores the wallet session prop at the Privy console boundary.

Validation

Commands and results:

pnpm test: PASS (76 files / 1032 tests, as reported by Gate A)
pnpm test:browser: PASS (8/8 Chromium, as reported by Gate A)
pnpm typecheck: PASS
pnpm lint: PASS
pnpm format:check: PASS
pnpm check:generated: PASS
git diff --cached --check: PASS
git show HEAD tree: d5dbda69e6d552b4fbd5dd2a4b613086da203f1a
PostgreSQL-gated tests: NOT RUN locally; no container runtime available

Independent review evidence

Gate A — exact candidate tree before push

• Base commit SHA: 94f2438fd2032a0cfa28699b0515c8ce6ed5300f

• Candidate tree SHA: d5dbda69e6d552b4fbd5dd2a4b613086da203f1a

• Candidate commit SHA: 3860c76802cdd7311f007e11faffe0daa1dd8117

• Reviewer tool: free-pi-cli

• Reviewer model: not exposed by platform

• Verdict: VERDICT: PASS

• Findings or residual risks: no blocking findings; unconnected-admin UX and PostgreSQL-gated validation remain noted by the reviewer.

• The reviewed tree equals the committed tree.

Gate B — exact remote PR head

• Pull request URL/number: pending draft PR creation

• Remote head commit SHA: pending

• Remote head tree SHA: pending

• Reviewer tool: free-pi-cli

• Reviewer model: pending

• Verdict: pending

• Findings or residual risks: pending

• Gate B reviewed the current remote head and matches Gate A's approved tree, or a fresh Gate A was run for the changed tree.

• Agent policy / repository-policy and all applicable CI checks pass.

Risk and rollback

• Residual risks: An administrator with no wallet connected now receives the existing connect/no-payment prompt rather than silently falling back to the server-wallet path in the Privy console.
• Rollback or recovery plan: revert commit 3860c76802cdd7311f007e11faffe0daa1dd8117.

Human merge

• A human owner has reviewed the evidence and will perform the merge.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	oneshot	3860c76	Sep 13 2026, 03:36 AM