update

src/app/qiwei-skill-install.component.ts

@@ -934,7 +934,8 @@ export class QiweiSkillInstallComponent implements OnInit, OnDestroy {
         seats: pending.seats,
         months: pending.months,
         expectedAmount: pending.amount,
-        idempotencyKey: pending.tradeNo
+        idempotencyKey: pending.tradeNo,
+        paymentMethod: pending.paymentMethod
       }, pending.tradeNo);
       if (result.code !== 200 || result.data?.state !== 'active') throw new Error(result.mess || '订阅激活失败');
       await this.loadStatus();
@@ -944,7 +945,12 @@ export class QiweiSkillInstallComponent implements OnInit, OnDestroy {
       await this.requestInstallPromptAfterBusy();
       return true;
     } catch (error: any) {
-      if (Number(error?.status) !== 402) this.paymentMessage.set(error?.message || '订阅激活失败，请刷新重试。');
+      const message = error?.message || '订阅激活失败，请刷新重试。';
+      if (pending.paymentMethod === 'wechat' && /回调正在确认/.test(message)) {
+        this.paymentMessage.set('微信支付已确认，支付回调正在核销，将继续自动重试。');
+      } else {
+        this.paymentMessage.set(message);
+      }
       return false;
     } finally {
       if (!preserveBusy) this.busy.set(false);
@@ -1018,6 +1024,10 @@ export class QiweiSkillInstallComponent implements OnInit, OnDestroy {
       method,
       headers,
       cache: 'no-store',
+      // Qiwei routes authenticate with the Authorization header and do not
+      // require cross-origin cookies. Keeping credentials omitted also avoids
+      // wildcard-origin CORS responses being rejected by the browser.
+      credentials: 'omit',
       body: method === 'GET' ? undefined : JSON.stringify(body || {})
     });
     const result = await response.json().catch(() => ({}));