ghost 6.57.1 → 6.58.0

package/core/server/adapters/redirects/S3RedirectsStore.js

@@ -48,7 +48,8 @@ const messages = {
     missingBucket: 'S3RedirectsStore requires a bucket name',
     missingStaticFileURLPrefix: 'S3RedirectsStore requires a staticFileURLPrefix',
     partialCredentials: 'S3RedirectsStore requires both accessKeyId and secretAccessKey when either is provided',
-    missingResponseBody: 'S3 GetObject returned no body'
+    missingResponseBody: 'S3 GetObject returned no body',
+    requestFailed: 'Something went wrong, please try again.'
 };
 const stripLeadingAndTrailingSlashes = (value = '') => value.replace(/^\/+|\/+$/g, '');
 // Validates and normalises the config: the slash-trimmed fields
@@ -148,25 +149,30 @@ class S3RedirectsStore extends adapter_base_redirects_1.RedirectsStoreBase {
             if (this._isNotFound(err)) {
                 return [];
             }
-            throw err;
+            throw this._requestError(err);
         }
         return (0, redirect_config_parser_1.parseJson)(body);
     }
     async replaceAll(redirects) {
         const key = this.buildKey();
-        if (await this._canonicalExists()) {
-            await this.client.send(new client_s3_1.CopyObjectCommand({
+        try {
+            if (await this._canonicalExists()) {
+                await this.client.send(new client_s3_1.CopyObjectCommand({
+                    Bucket: this.bucket,
+                    Key: (0, utils_1.getBackupRedirectsFilePath)(key),
+                    CopySource: `${this.bucket}/${key}`
+                }));
+            }
+            await this.client.send(new client_s3_1.PutObjectCommand({
                 Bucket: this.bucket,
-                Key: (0, utils_1.getBackupRedirectsFilePath)(key),
-                CopySource: `${this.bucket}/${key}`
+                Key: key,
+                Body: JSON.stringify(redirects),
+                ContentType: 'application/json'
             }));
         }
-        await this.client.send(new client_s3_1.PutObjectCommand({
-            Bucket: this.bucket,
-            Key: key,
-            Body: JSON.stringify(redirects),
-            ContentType: 'application/json'
-        }));
+        catch (err) {
+            throw this._requestError(err);
+        }
     }
     buildKey() {
         const parts = [this.tenantPrefix, this.staticFileURLPrefix, DEFAULT_FILENAME].filter(Boolean);
@@ -184,8 +190,22 @@ class S3RedirectsStore extends adapter_base_redirects_1.RedirectsStoreBase {
             if (this._isNotFound(err)) {
                 return false;
             }
-            throw err;
+            throw this._requestError(err);
+        }
+    }
+    _requestError(err) {
+        // The only Ghost errors reaching here are this store's own, which are
+        // already safe to render — re-wrapping them would hide the reason.
+        if (err instanceof errors.InternalServerError) {
+            return err;
+        }
+        const requestError = new errors.InternalServerError({
+            message: (0, tpl_1.default)(messages.requestFailed)
+        });
+        if (typeof err?.stack === 'string') {
+            requestError.stack = `${requestError.stack}\n\nCaused by: ${err.stack}`;
         }
+        return requestError;
     }
     _isNotFound(err) {
         return err instanceof client_s3_1.NotFound || err instanceof client_s3_1.NoSuchKey;

package/core/server/adapters/route-settings/S3RouteSettingsStore.js

@@ -55,7 +55,8 @@ const messages = {
     missingDefaultSettingsBasePath: 'S3RouteSettingsStore requires a defaultSettingsBasePath',
     partialCredentials: 'S3RouteSettingsStore requires both accessKeyId and secretAccessKey when either is provided',
     missingResponseBody: 'S3 GetObject returned no body',
-    ensureDefaults: 'Error trying to access the default settings file in {path}.'
+    ensureDefaults: 'Error trying to access the default settings file in {path}.',
+    requestFailed: 'Something went wrong, please try again.'
 };
 const stripLeadingAndTrailingSlashes = (value = '') => value.replace(/^\/+|\/+$/g, '');
 const configSchema = zod_1.z.object({
@@ -147,25 +148,30 @@ class S3RouteSettingsStore extends adapter_base_route_settings_1.RouteSettingsSt
                 const defaultContent = await this.readDefaultSettings();
                 return (0, route_settings_parser_1.parseRouteSettings)((0, yaml_parser_1.default)(defaultContent), defaultContent);
             }
-            throw err;
+            throw this._requestError(err);
         }
         return (0, route_settings_parser_1.parseRouteSettings)((0, yaml_parser_1.default)(body), body);
     }
     async replace(settings) {
         const key = this.buildKey();
-        if (await this._canonicalExists()) {
-            await this.client.send(new client_s3_1.CopyObjectCommand({
+        try {
+            if (await this._canonicalExists()) {
+                await this.client.send(new client_s3_1.CopyObjectCommand({
+                    Bucket: this.bucket,
+                    Key: (0, utils_1.getBackupRouteSettingsFilePath)(key),
+                    CopySource: `${this.bucket}/${key}`
+                }));
+            }
+            await this.client.send(new client_s3_1.PutObjectCommand({
                 Bucket: this.bucket,
-                Key: (0, utils_1.getBackupRouteSettingsFilePath)(key),
-                CopySource: `${this.bucket}/${key}`
+                Key: key,
+                Body: settings.yamlSource,
+                ContentType: CONTENT_TYPE
             }));
         }
-        await this.client.send(new client_s3_1.PutObjectCommand({
-            Bucket: this.bucket,
-            Key: key,
-            Body: settings.yamlSource,
-            ContentType: CONTENT_TYPE
-        }));
+        catch (err) {
+            throw this._requestError(err);
+        }
     }
     buildKey() {
         const parts = [this.tenantPrefix, this.staticFileURLPrefix, YAML_FILENAME].filter(Boolean);
@@ -183,8 +189,22 @@ class S3RouteSettingsStore extends adapter_base_route_settings_1.RouteSettingsSt
             if (this._isNotFound(err)) {
                 return false;
             }
-            throw err;
+            throw this._requestError(err);
+        }
+    }
+    _requestError(err) {
+        // The only Ghost errors reaching here are this store's own, which are
+        // already safe to render — re-wrapping them would hide the reason.
+        if (err instanceof errors.InternalServerError) {
+            return err;
+        }
+        const requestError = new errors.InternalServerError({
+            message: (0, tpl_1.default)(messages.requestFailed)
+        });
+        if (typeof err?.stack === 'string') {
+            requestError.stack = `${requestError.stack}\n\nCaused by: ${err.stack}`;
         }
+        return requestError;
     }
     async readDefaultSettings() {
         const defaultFilePath = path_1.default.join(this.defaultSettingsBasePath, DEFAULT_SETTINGS_FILENAME);

package/core/server/adapters/scheduling/scheduling-default.js

@@ -30,10 +30,10 @@ class SchedulingDefault extends adapter_base_scheduling_1.SchedulingBase {
     // under nock + shared workers — into the unit-test path.
     request = request_1.default;
     _addJob(job) {
-        let timestamp = (0, moment_1.default)(job.time).valueOf();
+        const timestamp = (0, moment_1.default)(job.time).valueOf();
         let keys = [];
-        let sortedJobs = {};
-        let instantJob = {};
+        const sortedJobs = {};
+        const instantJob = {};
         let i = 0;
         // CASE: should have been already pinged or should be pinged soon
         if ((0, moment_1.default)(timestamp).diff((0, moment_1.default)(), 'minutes') < this.offsetInMinutes) {
@@ -71,13 +71,12 @@ class SchedulingDefault extends adapter_base_scheduling_1.SchedulingBase {
         const keys = Object.keys(jobs);
         const self = this; // eslint-disable-line @typescript-eslint/no-this-alias
         keys.forEach(function (timestamp) {
-            let timeout;
-            let diff = (0, moment_1.default)(Number(timestamp)).diff((0, moment_1.default)());
+            const diff = (0, moment_1.default)(Number(timestamp)).diff((0, moment_1.default)());
             // NOTE: awake a little before...
-            timeout = setTimeout(function () {
+            const timeout = setTimeout(function () {
                 clearTimeout(timeout);
                 (function retry() {
-                    let immediate = setImmediate(function () {
+                    const immediate = setImmediate(function () {
                         clearImmediate(immediate);
                         // CASE: It's not the time yet...
                         if ((0, moment_1.default)().diff((0, moment_1.default)(Number(timestamp))) <= self.beforePingInMs) {

package/core/server/adapters/storage/LocalStorageBase.js

@@ -99,12 +99,10 @@ class LocalStorageBase extends ghost_storage_base_1.StorageBase {
      * - returns a promise which ultimately returns the full url to the uploaded file
      */
     async save(file, targetDir) {
-        let targetFilename;
         targetDir = targetDir
             ? this._resolveAndValidateStoragePath(targetDir)
             : this.getTargetDir(this.storagePath);
-        const filename = await this.getUniqueFileName(file, targetDir);
-        targetFilename = filename;
+        const targetFilename = await this.getUniqueFileName(file, targetDir);
         // Verify that we are saving directly under `targetDir` and not outside of it.
         const expectedPrefix = path_1.default.join(path_1.default.resolve(targetDir), '/');
         if (!path_1.default.resolve(targetFilename).startsWith(expectedPrefix)) {

package/core/server/api/endpoints/index.js

@@ -172,10 +172,6 @@ module.exports = {
         return apiFramework.pipeline(require('./config'), localUtils);
     },
 
-    get explore() {
-        return apiFramework.pipeline(require('./explore'), localUtils);
-    },
-
     get themes() {
         return apiFramework.pipeline(require('./themes'), localUtils);
     },

package/core/server/api/endpoints/member-custom-fields.js

@@ -24,10 +24,10 @@ const controller = {
     browse: {
         headers: noCacheInvalidation,
         // `filter` narrows by status (the definition list is otherwise small and
-        // global, returned whole in a fixed order). Archived fields are hidden by
-        // default; Settings passes `filter=status:[active,archived]` to see both.
-        // No pagination/order options — a future sort_order column would change the
-        // order server-side, not add a client option.
+        // global, returned whole). Archived fields are hidden by default; Settings
+        // passes `filter=status:[active,archived]` to see both. No pagination or order
+        // options: the list comes back in the publisher's own order, which is changed
+        // by reordering it rather than by asking for it differently.
         options: ['filter'],
         permissions(frame) {
             return canThis(frame).browse.member_custom_field();
@@ -60,6 +60,17 @@ const controller = {
             return members_custom_fields_1.definitions.add(requestContextFromFrame(frame), frame.data.members_custom_fields);
         }
     },
+    // Order belongs to the list, so it is set by PUTting the list. No `/order` sub-route:
+    // `order` is a key a publisher could mint, and the route would shadow it.
+    reorder: {
+        headers: noCacheInvalidation,
+        permissions(frame) {
+            return canThis(frame).edit.member_custom_field();
+        },
+        query(frame) {
+            return members_custom_fields_1.definitions.reorder(requestContextFromFrame(frame), frame.data.members_custom_fields);
+        }
+    },
     edit: {
         headers: noCacheInvalidation,
         options: ['key'],

package/core/server/api/endpoints/pages.js

@@ -226,20 +226,12 @@ const controller = {
             method: 'destroy'
         },
         async query(frame) {
-            const pagesToDelete = await models.Post.findAll({
-                filter: frame.options.filter,
-                status: 'all',
-                columns: ['status']
-            });
-
-            const allDraft = pagesToDelete.length > 0 && pagesToDelete.every((page) => {
-                return page.get('status') === 'draft';
-            });
-            if (allDraft) {
+            const result = await postsService.bulkDestroy(frame.options);
+            if (result.allDraft) {
                 frame.setHeader('X-Cache-Invalidate', '');
             }
 
-            return await postsService.bulkDestroy(frame.options);
+            return result;
         }
     },
 

package/core/server/api/endpoints/posts.js

@@ -303,20 +303,12 @@ const controller = {
             method: 'destroy'
         },
         async query(frame) {
-            const postsToDelete = await models.Post.findAll({
-                filter: frame.options.filter,
-                status: 'all',
-                columns: ['status']
-            });
-
-            const allDraft = postsToDelete.length > 0 && postsToDelete.every((post) => {
-                return post.get('status') === 'draft';
-            });
-            if (allDraft) {
+            const result = await postsService.bulkDestroy(frame.options);
+            if (result.allDraft) {
                 frame.setHeader('X-Cache-Invalidate', '');
             }
 
-            return await postsService.bulkDestroy(frame.options);
+            return result;
         }
     },
 

package/core/server/api/endpoints/utils/api-filter-utils.js

@@ -1,6 +1,10 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.rejectAdminApiRestrictedFieldsTransformer = exports.rejectContentApiRestrictedFieldsTransformer = void 0;
+exports.validateAdminApiBulkFilterTransformer = exports.rejectAdminApiRestrictedFieldsTransformer = exports.rejectContentApiRestrictedFieldsTransformer = void 0;
+const errors_1 = __importDefault(require("@tryghost/errors"));
 const mongo_utils_1 = require("@tryghost/mongo-utils");
 const CONTENT_API_RESTRICTED_FIELDS = new Set([
     'password',
@@ -20,3 +24,13 @@ const rejectAdminApiRestrictedFieldsTransformer = (input) => {
     return (0, mongo_utils_1.rejectStatements)(input, (key) => hasRestrictedSegment(key, ADMIN_API_RESTRICTED_FIELDS));
 };
 exports.rejectAdminApiRestrictedFieldsTransformer = rejectAdminApiRestrictedFieldsTransformer;
+const validateAdminApiBulkFilterTransformer = (input) => {
+    const restrictedField = (0, mongo_utils_1.getUsedKeys)(input).find((key) => hasRestrictedSegment(key, ADMIN_API_RESTRICTED_FIELDS));
+    if (restrictedField) {
+        throw new errors_1.default.BadRequestError({
+            message: 'Restricted fields cannot be used in bulk operation filters.'
+        });
+    }
+    return input;
+};
+exports.validateAdminApiBulkFilterTransformer = validateAdminApiBulkFilterTransformer;

package/core/server/api/endpoints/utils/serializers/input/settings.js

@@ -28,6 +28,10 @@ const EDITABLE_SETTINGS = [
     'meta_title',
     'meta_description',
     'llms_enabled',
+    'machine_payments_enabled',
+    'machine_payments_currency',
+    'machine_payments_amount',
+    'machine_payments_stripe_profile_id',
     'og_image',
     'og_title',
     'og_description',

package/core/server/api/endpoints/utils/serializers/output/index.js

@@ -28,10 +28,6 @@ module.exports = {
         return require('./db');
     },
 
-    get explore() {
-        return require('./explore');
-    },
-
     get pages() {
         return require('./pages');
     },

package/core/server/api/endpoints/utils/serializers/output/mappers/email-batches.js

@@ -2,7 +2,7 @@ const _ = require('lodash');
 
 const batchFields = [
     'id',
-    'provider_id',
+    'mailgun_message_id',
     'status',
     'member_segment',
     'created_at',

package/core/server/api/endpoints/utils/serializers/output/mappers/snippets.js

@@ -10,7 +10,6 @@ module.exports = (snippet, frame) => {
     return {
         id: json.id,
         name: json.name,
-        // @ts-ignore
         mobiledoc: json.mobiledoc,
         lexical: json.lexical,
         created_at: json.created_at,

package/core/server/api/endpoints/utils/serializers/output/member-custom-fields.js

@@ -15,5 +15,6 @@ module.exports = {
     // Create is a batch, so it returns every definition it made. The response is
     // already an array, so a one-item create looks exactly as it did before.
     add: serializeMany,
+    reorder: serializeMany,
     edit: serializeOne
 };

package/core/server/data/exporter/table-lists.js

@@ -10,6 +10,7 @@ const BACKUP_TABLES = [
     'integrations',
     'invites',
     'labels',
+    'machine_payment_events',
     'members',
     'members_labels',
     'members_products',
@@ -110,7 +111,9 @@ const SETTING_KEYS_BLOCKLIST = [
     'members_stripe_webhook_id',
     'members_stripe_webhook_secret',
     'email_verification_required',
-    'indexnow_api_key'
+    'indexnow_api_key',
+    'machine_payments_secret',
+    'machine_payments_deposit_address'
 ];
 
 module.exports = {

package/core/server/data/migrations/utils/schema.js

@@ -210,17 +210,19 @@ function createAddIndexMigration(table, columns, options = {}) {
  * @param {string} table
  * @param {string} from
  * @param {string} to
+ * @param {object} [options]
+ * @param {'instant'|'inplace'|'copy'|'auto'} [options.algorithm] - MySQL only
  *
  * @returns {Migration}
  */
-function createRenameColumnMigration(table, from, to) {
+function createRenameColumnMigration(table, from, to, options = {}) {
     return createNonTransactionalMigration(
         async function up(knex) {
             const hasColumn = await knex.schema.hasColumn(table, to);
             if (hasColumn) {
                 logging.warn(`Renaming ${table}.${from} to ${table}.${to} column - skipping as column ${table}.${to} already exists`);
             } else {
-                await commands.renameColumn(table, from, to, knex);
+                await commands.renameColumn(table, from, to, knex, options);
             }
         },
         async function down(knex) {
@@ -228,7 +230,7 @@ function createRenameColumnMigration(table, from, to) {
             if (hasColumn) {
                 logging.warn(`Renaming ${table}.${to} to ${table}.${from} column - skipping as column ${table}.${from} already exists`);
             } else {
-                await commands.renameColumn(table, to, from, knex);
+                await commands.renameColumn(table, to, from, knex, options);
             }
         }
     );

package/core/server/data/migrations/versions/6.57/2026-08-04-18-00-00-store-custom-field-values-as-leaf-rows.js

@@ -39,18 +39,30 @@ module.exports = createNonTransactionalMigration(
             await addColumn(TABLE, 'path', knex, undefined, {algorithm: 'auto'});
         }
 
-        // `member_id` stays leftmost, covering that foreign key the moment this exists.
-        await addUnique(TABLE, ['member_id', 'custom_field_id', 'path'], knex, LEAF_UNIQUE);
-        await dropUnique(TABLE, ['member_id', 'custom_field_id'], knex);
+        // A later 6.58 migration re-keys this table onto `custom_field_key`, dropping
+        // `custom_field_id`. The idempotency check re-runs every up against that final
+        // schema, so guard these on the column: gone, they are a no-op here rather than an
+        // error on the missing column (MySQL raises it; SQLite swallows it). A forward run
+        // always sees the column present, so this changes nothing an install ever applies.
+        const hasFieldId = await knex.schema.hasColumn(TABLE, 'custom_field_id');
+
+        if (hasFieldId) {
+            // `member_id` stays leftmost, covering that foreign key the moment this exists.
+            await addUnique(TABLE, ['member_id', 'custom_field_id', 'path'], knex, LEAF_UNIQUE);
+            await dropUnique(TABLE, ['member_id', 'custom_field_id'], knex);
+        }
 
         if (await knex.schema.hasColumn(TABLE, 'value_json')) {
             await dropColumn(TABLE, 'value_json', knex, {}, {algorithm: 'auto'});
         }
-        await addIndex(TABLE, ['custom_field_id', 'path'], knex);
 
-        // Only present after a rollback, where `down` adds it to keep a foreign key
-        // covered. Leaving it would be drift against a fresh install.
-        await dropIndex(TABLE, ['custom_field_id'], knex);
+        if (hasFieldId) {
+            await addIndex(TABLE, ['custom_field_id', 'path'], knex);
+
+            // Only present after a rollback, where `down` adds it to keep a foreign key
+            // covered. Leaving it would be drift against a fresh install.
+            await dropIndex(TABLE, ['custom_field_id'], knex);
+        }
     },
     async function down(knex) {
         // Rebuilding a composite would need the field-type catalog, which a migration must

package/core/server/data/migrations/versions/6.58/2026-08-10-08-20-50-add-machine-payments-settings.js

@@ -0,0 +1,41 @@
+const crypto = require('crypto');
+const {combineTransactionalMigrations, addSetting} = require('../../utils');
+
+module.exports = combineTransactionalMigrations(
+    addSetting({
+        key: 'machine_payments_enabled',
+        value: 'false',
+        type: 'boolean',
+        group: 'site'
+    }),
+    addSetting({
+        key: 'machine_payments_currency',
+        value: null,
+        type: 'string',
+        group: 'site'
+    }),
+    addSetting({
+        key: 'machine_payments_amount',
+        value: 100,
+        type: 'number',
+        group: 'site'
+    }),
+    addSetting({
+        key: 'machine_payments_secret',
+        value: crypto.randomBytes(64).toString('hex'),
+        type: 'string',
+        group: 'core'
+    }),
+    addSetting({
+        key: 'machine_payments_deposit_address',
+        value: null,
+        type: 'string',
+        group: 'core'
+    }),
+    addSetting({
+        key: 'machine_payments_stripe_profile_id',
+        value: null,
+        type: 'string',
+        group: 'site'
+    })
+);

package/core/server/data/migrations/versions/6.58/2026-08-10-08-21-00-add-machine-payment-events-table.js

@@ -0,0 +1,18 @@
+// For information on writing migrations, see https://www.notion.so/ghost/Database-migrations-eb5b78c435d741d2b34a582d57c24253
+
+const {addTable} = require('../../utils');
+
+module.exports = addTable('machine_payment_events', {
+    id: {type: 'string', maxlength: 24, nullable: false, primary: true},
+    post_id: {type: 'string', maxlength: 24, nullable: false, references: 'posts.id', cascadeDelete: true},
+    amount: {type: 'integer', nullable: false},
+    currency: {type: 'string', maxlength: 50, nullable: false},
+    protocol: {type: 'string', maxlength: 50, nullable: false},
+    method: {type: 'string', maxlength: 50, nullable: false},
+    stripe_payment_intent_id: {type: 'string', maxlength: 255, nullable: true, unique: true},
+    reference: {type: 'string', maxlength: 255, nullable: false},
+    created_at: {type: 'dateTime', nullable: false},
+    '@@UNIQUE_CONSTRAINTS@@': [
+        ['protocol', 'reference']
+    ]
+});

package/core/server/data/migrations/versions/6.58/2026-08-10-15-24-09-reset-custom-field-definitions-for-underscored-keys.js

@@ -0,0 +1,66 @@
+const logging = require('@tryghost/logging');
+const {createTransactionalMigration} = require('../../utils');
+
+const FIELDS_TABLE = 'members_custom_fields';
+const VALUES_TABLE = 'members_custom_field_values';
+
+// The shape this release mints: alphanumeric runs joined by single underscores, with no
+// separator at either end. Written out here rather than imported from the service, so a
+// later change to how keys are minted cannot change what this migration did.
+const MINTED_KEY_SHAPE = /^[a-z0-9]+(?:_[a-z0-9]+)*$/;
+
+// A key naming an inherited property reads back as that property wherever a member's
+// values are indexed, so it goes too, whatever its shape. Minting has refused these
+// since 6.53, but the definitions endpoint shipped four days before that guard did.
+const INHERITED_PROPERTY_NAMES = Object.getOwnPropertyNames(Object.prototype);
+
+function isUnmintable(key) {
+    return !MINTED_KEY_SHAPE.test(key) || INHERITED_PROPERTY_NAMES.includes(key);
+}
+
+// A key is minted once and never changes, so a definition created before this release
+// keeps whatever shape it was given. Those definitions are discarded rather than
+// rewritten: custom fields sit behind a private flag and have never been released, so
+// only a site deliberately opted in can hold one, and re-creating a field re-mints it.
+//
+// Only the keys this release could not produce go. Hyphens are what changed, but they
+// are not the whole set: the previous minting passed underscores through untouched, so
+// a leading, trailing or doubled one survived it too.
+//
+// Every definition is read rather than filtered in SQL. The table is small, the rule is
+// a regular expression neither engine agrees on, and `_` is a wildcard in LIKE, so the
+// pattern that looks obvious is not the one that runs.
+//
+// Values are deleted explicitly rather than left to the foreign key: it cascades on
+// MySQL, but SQLite only enforces one when `foreign_keys` is on, which knex-migrator
+// does not guarantee.
+module.exports = createTransactionalMigration(
+    async function up(knex) {
+        const definitions = await knex(FIELDS_TABLE).select('id', 'key');
+        const discarded = definitions.filter(definition => isUnmintable(definition.key));
+
+        if (discarded.length === 0) {
+            logging.info('No custom field definitions to discard: every key is one this release can mint');
+            return;
+        }
+
+        const ids = discarded.map(definition => definition.id);
+
+        // A later 6.58 migration re-keys this table off `custom_field_id`. On the idempotency
+        // re-run the column is gone, but so are these definitions (deleted on the first run,
+        // and minting will not re-create them), so this branch is unreachable then. Guarding
+        // on the column keeps the query shape-proof rather than erroring on a MySQL install.
+        const hasFieldId = await knex.schema.hasColumn(VALUES_TABLE, 'custom_field_id');
+        const discardedValues = hasFieldId
+            ? await knex(VALUES_TABLE).whereIn('custom_field_id', ids).del()
+            : 0;
+        const discardedFields = await knex(FIELDS_TABLE).whereIn('id', ids).del();
+
+        logging.info(`Discarded ${discardedFields} custom field definition(s) this release cannot mint, and ${discardedValues} value(s): ${discarded.map(definition => definition.key).join(', ')}`);
+    },
+    async function down() {
+        // Nothing to undo: an underscored key is a key the previous release can read and
+        // address, it is only one it would not have minted.
+        logging.info('Leaving underscored custom field keys in place: the previous release reads them unchanged');
+    }
+);