payment-kit 1.29.11 → 1.29.13

package/api/src/libs/logger.ts

@@ -9,7 +9,7 @@
 // The blocklet server (BLOCKLET_LOG_DIR set) and the CF worker (aliased shim)
 // still get the real logger on first call — behavior unchanged for them.
 
-interface Logger {
+export interface Logger {
   debug: (...args: any[]) => void;
   info: (...args: any[]) => void;
   error: (...args: any[]) => void;
@@ -18,6 +18,15 @@ interface Logger {
 
 let resolved: Logger | undefined;
 
+// Host-injection seam: an embedding host (e.g. arc) can supply its own structured
+// logger so payment's lines join the host's unified log stream instead of the lazy
+// @blocklet/logger / console fallback. MUST be set before the first log call (the
+// embedded factory does this from its `logger` slot as its first action) so it wins
+// over `resolveLogger()`'s lazy default.
+export function setResolvedLogger(l: Logger): void {
+  resolved = l;
+}
+
 function resolveLogger(): Logger {
   if (resolved) return resolved;
   try {

package/api/src/routes/hono/checkout-sessions.ts

@@ -1243,7 +1243,18 @@ export async function startCheckoutSessionFromPaymentLink(id: string, c: any) {
   const body = c.get('sanitizedBody') ?? {};
   const { metadata, needShortUrl = false } = body;
   try {
-    const link = await PaymentLink.findByPk(id);
+    let link = await PaymentLink.findByPk(id);
+    // Preview-draft ids are `plink_<did>` (create page). The frontend builds them from the
+    // BARE login_token did (e.g. z1cxgj7…), but /stash persisted the link with the
+    // auth-normalized `did:abt:` prefix (or vice versa) — a bare/prefixed DID shape
+    // mismatch. Fall back to the other shape so the preview iframe resolves its own draft.
+    if (!link && id.startsWith('plink_')) {
+      const didPart = id.slice('plink_'.length);
+      const altId = didPart.startsWith('did:abt:')
+        ? `plink_${didPart.slice('did:abt:'.length)}`
+        : `plink_did:abt:${didPart}`;
+      link = await PaymentLink.findByPk(altId);
+    }
     if (!link) {
       return c.json({ error: 'Payment link not found, please contact the source of the payment link.' }, 400);
     }

package/api/src/routes/hono/tax-rates.ts

@@ -77,10 +77,13 @@ app.get('/', auth, async (c) => {
       attributes: {
         include: [
           [
+            // Sequelize aliases the primary table to its modelName (`TaxRate`)
+            // in findAndCountAll, so the bare table name `tax_rates.id` is not a
+            // valid column in the emitted SQL (#1395). Reference the alias.
             literal(`(
               SELECT COUNT(DISTINCT ii.invoice_id)
               FROM invoice_items AS ii
-              WHERE ii.tax_rate_id = tax_rates.id
+              WHERE ii.tax_rate_id = \`TaxRate\`.id
             )`),
             'invoice_count',
           ],

package/api/src/service.ts

@@ -5,7 +5,7 @@ import { Hono } from 'hono';
 import type { ContentfulStatusCode } from 'hono/utils/http-status';
 import { isProduction } from './libs/env';
 
-import logger from './libs/logger';
+import logger, { type Logger, setResolvedLogger } from './libs/logger';
 import { context as requestContext } from './libs/context';
 import { TENANT_CONTEXT_MISSING, TenantError, getTenantMode, getDefaultInstanceDid } from './libs/tenant';
 import type { LocksDriver, QueueHostHooks, CronDriver, IdentityDriver, SecretsDriver } from './libs/drivers';
@@ -79,6 +79,14 @@ export interface PaymentCoreSlots {
    * keeping the runtime-neutral `http.fetch` free of node:fs.
    */
   staticHandler?: (app: Hono) => void;
+  /**
+   * Host-injected logger (e.g. arc's structured `ns:"payment"` logger). When set,
+   * payment's lines join the host's unified log stream instead of the lazy
+   * @blocklet/logger / console fallback. Applied via `setResolvedLogger` as the
+   * factory's first action, before any core module logs. Omit on blocklet-server
+   * (keeps the @blocklet/logger default).
+   */
+  logger?: Logger;
 }
 
 export interface PaymentCoreLifecycle {
@@ -661,6 +669,9 @@ async function stopBackgroundServices(): Promise<void> {
  */
 export function createEmbeddedPaymentService(slots: PaymentCoreSlots): EmbeddedPaymentService {
   if (!slots || typeof slots !== 'object') throw new PaymentCoreSlotError('config');
+  // Host-injected logger wins over the lazy @blocklet/logger / console fallback.
+  // Set FIRST so even slot-validation/init logging routes to the host stream.
+  if (slots.logger) setResolvedLogger(slots.logger);
   if (!slots.config) throw new PaymentCoreSlotError('config');
   if (!slots.db || !slots.db.sequelize) throw new PaymentCoreSlotError('db');
   // D1 (S3.0): validate the tenancy slot and derive the effective config BEFORE

package/api/tests/routes/hono/tax-rates.spec.ts

@@ -0,0 +1,48 @@
+// Regression test for #1395 — GET /api/tax-rates returned 400
+// `SQLITE_ERROR: no such column: tax_rates.id`.
+//
+// The list handler's `invoice_count` subquery used `literal()` with the bare
+// table name `tax_rates.id`, but Sequelize aliases the primary table to its
+// modelName (`TaxRate`) in findAndCountAll, so that qualifier doesn't exist in
+// the emitted SQL. The error is in the compiled subquery itself, so it throws
+// even on an empty table — which is exactly what makes a tiny DB-backed test
+// (real sqlite, like store/tenant-model.spec.ts) enough to pin it.
+//
+// auth is stubbed to pass-through (gating is covered by
+// middlewares/hono/security.spec.ts).
+jest.mock('../../../src/middlewares/hono/security', () => ({
+  authenticate: () => (_c: any, next: any) => next(),
+}));
+
+import { Hono } from 'hono';
+import { Sequelize } from 'sequelize';
+
+import { withTenant } from '../../../src/libs/context';
+import { initialize } from '../../../src/store/models';
+import { TENANT_A } from '../../fixtures/tenants';
+import taxRates from '../../../src/routes/hono/tax-rates';
+
+const sequelize = new Sequelize('sqlite::memory:', { logging: false });
+initialize(sequelize);
+
+const app = new Hono();
+app.route('/api/tax-rates', taxRates);
+
+beforeAll(async () => {
+  await sequelize.sync({ force: true });
+});
+afterAll(() => sequelize.close());
+
+describe('GET /api/tax-rates — list (regression #1395)', () => {
+  it('the invoice_count subquery alias resolves — 200, not 400 no-such-column', async () => {
+    const r = await withTenant(TENANT_A, () =>
+      app.fetch(new Request('http://app.local/api/tax-rates', { headers: { host: 'app.local' } })),
+    );
+
+    // pre-fix: 400 { error: "SQLITE_ERROR: no such column: tax_rates.id" }
+    expect(r.status).toBe(200);
+    const body = (await r.json()) as { count: number; list: unknown[] };
+    expect(body.count).toBe(0);
+    expect(Array.isArray(body.list)).toBe(true);
+  });
+});

package/blocklet.yml

@@ -14,7 +14,7 @@ repository:
   type: git
   url: git+https://github.com/blocklet/payment-kit.git
 specVersion: 1.2.8
-version: 1.29.11
+version: 1.29.13
 logo: logo.png
 files:
   - dist

package/cloudflare/cf-adapter.ts

@@ -347,6 +347,9 @@ export async function createCloudflarePaymentAdapter(
   };
 
   const svc: EmbeddedPaymentService = createEmbeddedPaymentService({
+    // Forward the host-injected logger so CF payment lines join the worker's
+    // unified log stream (omit → lazy @blocklet/logger / console fallback).
+    logger: options.logger,
     // Host-global csrf secret via the config boundary (payment-core's csrf reads
     // PAYMENT_CSRF_SECRET through readConfig). NO sessionSecret (decision #5).
     config: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "payment-kit",
-  "version": "1.29.11",
+  "version": "1.29.13",
   "scripts": {
     "dev": "blocklet dev --open",
     "prelint": "npm run types",
@@ -48,7 +48,7 @@
   "dependencies": {
     "@abtnode/cron": "^1.17.13-beta-20260613-094425-b81920c8",
     "@arcblock/did": "^1.30.24",
-    "@arcblock/did-connect-js": "^4.1.3",
+    "@arcblock/did-connect-js": "^4.1.5",
     "@arcblock/did-connect-react": "^3.5.4",
     "@arcblock/did-connect-storage-nedb": "^1.8.0",
     "@arcblock/did-util": "^1.30.24",
@@ -60,9 +60,9 @@
     "@blocklet/error": "^0.3.5",
     "@blocklet/js-sdk": "^1.17.13-beta-20260613-094425-b81920c8",
     "@blocklet/logger": "^1.17.13-beta-20260613-094425-b81920c8",
-    "@blocklet/payment-broker-client": "1.29.11",
-    "@blocklet/payment-react": "1.29.11",
-    "@blocklet/payment-vendor": "1.29.11",
+    "@blocklet/payment-broker-client": "1.29.13",
+    "@blocklet/payment-react": "1.29.13",
+    "@blocklet/payment-vendor": "1.29.13",
     "@blocklet/sdk": "^1.17.13-beta-20260613-094425-b81920c8",
     "@blocklet/ui-react": "^3.5.4",
     "@blocklet/uploader": "^0.15.4",
@@ -133,7 +133,7 @@
   "devDependencies": {
     "@abtnode/types": "^1.17.13-beta-20260613-094425-b81920c8",
     "@arcblock/eslint-config-ts": "^0.3.3",
-    "@blocklet/payment-types": "1.29.11",
+    "@blocklet/payment-types": "1.29.13",
     "@types/connect": "^3.4.38",
     "@types/debug": "^4.1.12",
     "@types/dotenv-flow": "^3.3.3",
@@ -180,5 +180,5 @@
       "parser": "typescript"
     }
   },
-  "gitHead": "775c2d6b9624e70d12a3872f46f7b2deb52591ba"
+  "gitHead": "e023f83ecfb07c0782e138a2802b5dec746fd7c6"
 }

package/src/components/payment-link/preview.tsx

@@ -1,5 +1,6 @@
 import { useEffect, useImperativeHandle, useRef, useState } from 'react';
 import { useFullscreen, useSize } from 'ahooks';
+import { joinURL } from 'ufo';
 import IframeResizer from 'iframe-resizer-react';
 import { useTheme } from '@mui/material';
 import Chrome from './chrome';
@@ -30,7 +31,11 @@ export default function PaymentLinkPreview({
     }
   }, [theme.palette.mode, mode]);
 
-  const iframeSrc = `${window.blocklet.prefix}checkout/pay/${id}?preview=1&version=${version}&theme=${mode}`;
+  // joinURL (not string concat) so the payment prefix joins the path with exactly one
+  // slash. window.blocklet.prefix has NO trailing slash on embedded hosts
+  // (/.well-known/payment), so `${prefix}checkout/...` produced `/.well-known/paymentcheckout/...`
+  // → 404. Every other payment-link URL already uses joinURL; this was the lone hard-concat.
+  const iframeSrc = `${joinURL(window.blocklet.prefix, 'checkout/pay', id)}?preview=1&version=${version}&theme=${mode}`;
   return (
     <div ref={innerRef}>
       {fullscreen ? (