ghost 6.57.1 → 6.58.0

package/core/server/services/machine-payments/README.md

@@ -0,0 +1,23 @@
+# Machine payments
+
+Accept pay-per-request access to paid-members markdown (`.md`) URLs from AI agents via Stripe [Machine Payments](https://docs.stripe.com/payments/machine).
+
+## Product fences (v1)
+
+- **Protocol:** Machine Payments Protocol (MPP) only in v1 — Tempo USDC + Shared Payment Tokens (card / Link Agent Wallet). Additional adapters (e.g. x402) may land later behind the same payment-authorization boundary; they are not shipping here and do not change membership.
+- **Access model:** One-shot unlock of markdown bytes for that request. No member session, tier grant, or change to `content-gating` / Portal.
+- **Surface:** Explicit `.md` URLs only. Accept-header markdown stays public-only. HTML theme views and the Content API stay membership-gated.
+- **Pricing:** Site-wide amount. SPT charges use the configured fiat currency (Stripe card minimum applies). Tempo charges USDC using the same minor-unit amount; publishers should treat the crypto rail as USDC, not as on-chain publisher currency.
+- **Eligibility:** `visibility: paid`, or `visibility: tiers` where every related tier is paid. Free-members-only (`visibility: members`) is out of scope.
+- **Enablement:** Labs `machinePayments` + `llms_enabled` + `machine_payments_enabled` + Stripe connected.
+
+## Publisher prerequisites
+
+- Stripe Connect (or direct keys) on the site.
+- For SPT / cards: US or Canada legal entity; Stripe business profile (`networkId` / profile id) configured.
+- For Tempo stablecoin: Stablecoins and Crypto payment method approved in Stripe. Not available for NY businesses; other countries may need Stripe to enable access.
+- `llms.txt` must remain enabled — agent discovery and `.md` routes depend on it.
+
+## Architecture boundary
+
+Membership and content gating stay frozen. Adapters only implement `canHandle` / `challenge` / `fulfill`. The orchestrator loads full post HTML and writes `machine_payment_events` only after a successful `fulfill`.

package/core/server/services/machine-payments/adapters/mpp-adapter.js

@@ -0,0 +1,195 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MppAdapter = exports.TEMPO_DECIMALS = exports.TEMPO_USDC = void 0;
+exports.parseReceipt = parseReceipt;
+const errors_1 = __importDefault(require("@tryghost/errors"));
+const logging_1 = __importDefault(require("@tryghost/logging"));
+const config_1 = __importDefault(require("../../../../shared/config"));
+const pricing_1 = require("../pricing");
+const deposit_address_store_1 = require("../stripe/deposit-address-store");
+const stripe_client_options_1 = require("../stripe/stripe-client-options");
+exports.TEMPO_USDC = '0x20c000000000000000000000b9537d11c60e8b50';
+exports.TEMPO_DECIMALS = 6;
+const SPT_DECIMALS = 2;
+const settingsCache = require('../../../../shared/settings-cache');
+/**
+ * MPP adapter (Tempo USDC + Stripe SPT/card).
+ * Implements the protocol-agnostic canHandle / challenge / fulfill contract.
+ */
+class MppAdapter {
+    depositAddressStore;
+    settingsCache;
+    pricing;
+    mppxFactory;
+    stripeClientFactory;
+    name;
+    #mppx = null;
+    #mppxKey = null;
+    #replayStore = null;
+    constructor({ depositAddressStore, settingsCache: settings = settingsCache, pricing = new pricing_1.Pricing({ settingsCache: settings }), mppxFactory, stripeClientFactory }) {
+        this.depositAddressStore = depositAddressStore;
+        this.settingsCache = settings;
+        this.pricing = pricing;
+        this.mppxFactory = mppxFactory;
+        this.stripeClientFactory = stripeClientFactory;
+        this.name = 'mpp';
+    }
+    canHandle(request) {
+        const authHeader = request.headers.get('authorization');
+        return Boolean(authHeader && /^Payment\s+/i.test(authHeader));
+    }
+    async challenge(request, terms) {
+        const payment = await this.#run(request, terms);
+        if (payment.status === 402) {
+            return payment.challenge ?? null;
+        }
+        // Unexpected success without credential — treat as challenge unavailable.
+        return null;
+    }
+    async fulfill(request, terms) {
+        const payment = await this.#run(request, terms);
+        if (payment.status === 402) {
+            throw new errors_1.default.NoPermissionError({
+                message: 'Payment required'
+            });
+        }
+        if (payment.status !== 200 || typeof payment.withReceipt !== 'function') {
+            throw new errors_1.default.NoPermissionError({
+                message: 'Machine payment credential rejected'
+            });
+        }
+        const wrapped = payment.withReceipt(new Response('', { status: 200 }));
+        const receiptHeader = wrapped.headers.get('payment-receipt');
+        const receipt = parseReceipt(receiptHeader);
+        if (!receipt.reference) {
+            throw new errors_1.default.InternalServerError({
+                message: 'Machine payment succeeded without a stable settlement reference'
+            });
+        }
+        if (typeof receipt.method !== 'string' || !receipt.method) {
+            throw new errors_1.default.InternalServerError({
+                message: 'Machine payment succeeded without a settlement method'
+            });
+        }
+        return {
+            protocol: 'mpp',
+            method: receipt.method,
+            reference: receipt.reference,
+            amount: terms.amount,
+            currency: terms.currency,
+            stripePaymentIntentId: receipt.method === 'stripe' ? receipt.reference : null,
+            receiptHeaders: receiptHeader ? { 'payment-receipt': receiptHeader } : {}
+        };
+    }
+    async #run(request, terms) {
+        const { Mppx, tempo, stripe: mppStripe, Store } = this.mppxFactory
+            ? this.mppxFactory()
+            : require('mppx/server');
+        const profileId = this.settingsCache.get('machine_payments_stripe_profile_id')
+            || config_1.default.get('machinePayments:mpp:networkId');
+        const stripeClient = this.#getStripeClient();
+        const hasStripe = Boolean(stripeClient && profileId);
+        let recipient = null;
+        try {
+            recipient = await this.depositAddressStore.getOrCreateAddress({
+                network: config_1.default.get('machinePayments:mpp:stripeNetwork') || 'tempo'
+            });
+        }
+        catch (err) {
+            logging_1.default.warn(err);
+        }
+        const hasTempo = Boolean(recipient);
+        if (!hasTempo && !hasStripe) {
+            throw new errors_1.default.InternalServerError({
+                message: 'Machine payment challenges are temporarily unavailable'
+            });
+        }
+        if (!this.#replayStore) {
+            this.#replayStore = Store.memory();
+        }
+        const secretKey = this.#getSecretKey();
+        const tempoCurrency = config_1.default.get('machinePayments:mpp:tempoCurrency') || exports.TEMPO_USDC;
+        const testnet = config_1.default.get('machinePayments:mpp:testnet') === true;
+        const key = `${secretKey}:${recipient || ''}:${hasStripe ? profileId : ''}:${tempoCurrency}:${testnet}`;
+        if (!this.#mppx || this.#mppxKey !== key) {
+            const methods = [];
+            if (hasTempo) {
+                methods.push(tempo.charge({
+                    currency: tempoCurrency,
+                    recipient,
+                    testnet,
+                    decimals: exports.TEMPO_DECIMALS,
+                    store: this.#replayStore
+                }));
+            }
+            if (hasStripe) {
+                methods.push(mppStripe.charge({
+                    client: stripeClient,
+                    networkId: profileId,
+                    paymentMethodTypes: ['card', 'link'],
+                    decimals: SPT_DECIMALS
+                }));
+            }
+            this.#mppx = Mppx.create({ methods, secretKey });
+            this.#mppxKey = key;
+        }
+        const scope = new URL(request.url).pathname;
+        const tempoCharge = hasTempo
+            ? { amount: this.pricing.forTempoUsdc(terms).majorAmount, recipient, scope }
+            : null;
+        const sptTerms = hasStripe ? this.pricing.forSpt(terms) : null;
+        const stripeCharge = sptTerms
+            ? { amount: sptTerms.majorAmount, currency: sptTerms.currency, scope }
+            : null;
+        if (tempoCharge && stripeCharge) {
+            return await this.#mppx.compose(['tempo/charge', tempoCharge], ['stripe/charge', stripeCharge])(request);
+        }
+        if (stripeCharge) {
+            return await this.#mppx.stripe.charge(stripeCharge)(request);
+        }
+        return await this.#mppx.tempo.charge(tempoCharge)(request);
+    }
+    #getSecretKey() {
+        return config_1.default.get('machinePayments:mpp:secretKey')
+            || this.settingsCache.get('machine_payments_secret');
+    }
+    #getStripeClient() {
+        if (this.stripeClientFactory) {
+            return this.stripeClientFactory();
+        }
+        try {
+            const settingsHelpers = require('../../settings-helpers');
+            const keys = settingsHelpers.getActiveStripeKeys();
+            if (!keys?.secretKey) {
+                return null;
+            }
+            const { Stripe } = require('stripe');
+            return new Stripe(keys.secretKey, {
+                ...(0, stripe_client_options_1.getMachinePaymentsStripeOptions)(deposit_address_store_1.STRIPE_MACHINE_PAYMENTS_API_VERSION)
+            });
+        }
+        catch {
+            return null;
+        }
+    }
+}
+exports.MppAdapter = MppAdapter;
+/**
+ * mppx serializes Payment-Receipt as unpadded base64url JSON
+ * `{method, reference, status, timestamp}`.
+ */
+function parseReceipt(header) {
+    if (!header) {
+        return {};
+    }
+    try {
+        const parsed = JSON.parse(Buffer.from(header, 'base64url').toString('utf8'));
+        return parsed && typeof parsed === 'object' ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}

package/core/server/services/machine-payments/content-loader.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContentLoader = void 0;
+const eligibility_1 = require("./eligibility");
+/**
+ * Loads full post/page HTML only after payment has been verified.
+ * Bypasses Content API member gating intentionally — this is the privileged
+ * unlock path for machine payments, not a membership grant.
+ */
+class ContentLoader {
+    _postModel;
+    urlService;
+    constructor({ postModel, urlServiceFacade } = {}) {
+        this._postModel = postModel;
+        this.urlService = urlServiceFacade;
+    }
+    get postModel() {
+        if (!this._postModel) {
+            this._postModel = require('../../models').Post;
+        }
+        return this._postModel;
+    }
+    /**
+     * Raw-model eligibility check. Use this before issuing a 402 so Content API
+     * tier stripping cannot mark a mixed free+paid post as purchasable.
+     * Includes the same URL deliverability gate as loadFullEntry so we never
+     * challenge/charge for content we cannot serve.
+     */
+    async isPurchasable(resourceType, id) {
+        const model = await this.#findPublished(resourceType, id, ['tiers']);
+        if (!model) {
+            return false;
+        }
+        const entry = model.toJSON();
+        if (!(0, eligibility_1.isPurchasableEntry)(entry)) {
+            return false;
+        }
+        return this.#hasDeliverableUrl(entry, resourceType);
+    }
+    async loadFullEntry(resourceType, id) {
+        const type = resourceType === 'pages' ? 'page' : 'post';
+        const model = await this.#findPublished(resourceType, id, ['authors', 'tags', 'tiers']);
+        if (!model) {
+            return null;
+        }
+        const entry = model.toJSON();
+        if (!(0, eligibility_1.isPurchasableEntry)(entry)) {
+            return null;
+        }
+        entry.type = type;
+        const url = this.#resolveAbsoluteUrl(entry, resourceType);
+        if (url === null) {
+            return null;
+        }
+        if (url !== undefined) {
+            entry.url = url;
+        }
+        return entry;
+    }
+    /**
+     * @returns `undefined` when no url service is configured, `null` when the
+     * resource is not deliverable, otherwise the absolute URL.
+     */
+    #resolveAbsoluteUrl(entry, resourceType) {
+        if (!this.urlService) {
+            return undefined;
+        }
+        const url = this.urlService.getUrlForResource({
+            ...entry,
+            type: resourceType === 'pages' ? 'pages' : 'posts'
+        }, { absolute: true });
+        if (!url || String(url).endsWith('/404/')) {
+            return null;
+        }
+        return url;
+    }
+    #hasDeliverableUrl(entry, resourceType) {
+        return this.#resolveAbsoluteUrl(entry, resourceType) !== null;
+    }
+    async #findPublished(resourceType, id, withRelated) {
+        const type = resourceType === 'pages' ? 'page' : 'post';
+        return await this.postModel.findOne({
+            id,
+            type,
+            status: 'published'
+        }, { withRelated });
+    }
+}
+exports.ContentLoader = ContentLoader;

package/core/server/services/machine-payments/eligibility.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isMachinePaymentsEnabled = exports.isPurchasableEntry = void 0;
+var machine_payments_1 = require("../../../shared/machine-payments");
+Object.defineProperty(exports, "isPurchasableEntry", { enumerable: true, get: function () { return machine_payments_1.isPurchasableEntry; } });
+Object.defineProperty(exports, "isMachinePaymentsEnabled", { enumerable: true, get: function () { return machine_payments_1.isMachinePaymentsEnabled; } });

package/core/server/services/machine-payments/events/machine-payment-event-repository.js

@@ -0,0 +1,58 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MachinePaymentEventRepository = void 0;
+const errors_1 = __importDefault(require("@tryghost/errors"));
+const machine_payment_event_1 = require("./machine-payment-event");
+const isUniqueConstraintError = (err) => {
+    const code = err?.code;
+    return code === 'ER_DUP_ENTRY' || Boolean(code?.startsWith?.('SQLITE_CONSTRAINT'));
+};
+class MachinePaymentEventRepository {
+    #Model;
+    constructor({ MachinePaymentEventModel }) {
+        this.#Model = MachinePaymentEventModel;
+    }
+    /**
+     * @returns Promise resolving to the event and whether it was newly created
+     */
+    async save(data) {
+        const event = machine_payment_event_1.MachinePaymentEvent.create(data);
+        const existing = await this.#findByProtocolReference(event.protocol, event.reference);
+        if (existing) {
+            return { event: existing, created: false };
+        }
+        try {
+            const created = await this.#Model.add({
+                post_id: event.postId,
+                amount: event.amount,
+                currency: event.currency,
+                protocol: event.protocol,
+                method: event.method,
+                stripe_payment_intent_id: event.stripePaymentIntentId,
+                reference: event.reference,
+                created_at: event.timestamp
+            }, { context: { internal: true } });
+            return { event: created, created: true };
+        }
+        catch (err) {
+            if (!isUniqueConstraintError(err)) {
+                throw err;
+            }
+            const raced = await this.#findByProtocolReference(event.protocol, event.reference);
+            if (raced) {
+                return { event: raced, created: false };
+            }
+            throw new errors_1.default.InternalServerError({
+                err: err instanceof Error ? err : undefined,
+                message: 'Failed to persist machine payment event after unique constraint conflict'
+            });
+        }
+    }
+    async #findByProtocolReference(protocol, reference) {
+        return await this.#Model.findOne({ protocol, reference });
+    }
+}
+exports.MachinePaymentEventRepository = MachinePaymentEventRepository;

package/core/server/services/machine-payments/events/machine-payment-event.js

@@ -0,0 +1,46 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MachinePaymentEvent = void 0;
+const errors_1 = __importDefault(require("@tryghost/errors"));
+class MachinePaymentEvent {
+    timestamp;
+    postId;
+    amount;
+    currency;
+    protocol;
+    method;
+    stripePaymentIntentId;
+    reference;
+    constructor(data, timestamp) {
+        this.timestamp = timestamp;
+        this.postId = data.postId;
+        this.amount = data.amount;
+        this.currency = data.currency;
+        this.protocol = data.protocol;
+        this.method = data.method;
+        this.stripePaymentIntentId = data.stripePaymentIntentId ?? null;
+        this.reference = data.reference;
+    }
+    static create(data, timestamp) {
+        const required = [
+            'postId',
+            'amount',
+            'currency',
+            'protocol',
+            'method',
+            'reference'
+        ];
+        for (const key of required) {
+            if (data?.[key] === undefined || data?.[key] === null || data?.[key] === '') {
+                throw new errors_1.default.ValidationError({
+                    message: `MachinePaymentEvent.${key} is required`
+                });
+            }
+        }
+        return new MachinePaymentEvent(data, timestamp ?? new Date());
+    }
+}
+exports.MachinePaymentEvent = MachinePaymentEvent;

package/core/server/services/machine-payments/index.js

@@ -0,0 +1,87 @@
+const logging = require('@tryghost/logging');
+const config = require('../../../shared/config');
+const settingsCache = require('../../../shared/settings-cache');
+const labs = require('../../../shared/labs');
+const settingsHelpers = require('../settings-helpers');
+const models = require('../../models');
+
+const {MachinePaymentsService, getDefaultTiersCurrency} = require('./service');
+const {DepositAddressStore} = require('./stripe/deposit-address-store');
+const {PaymentRecorder} = require('./stripe/payment-recorder');
+const {MppAdapter} = require('./adapters/mpp-adapter');
+const {MachinePaymentEventRepository} = require('./events/machine-payment-event-repository');
+const {ContentLoader} = require('./content-loader');
+const {Pricing} = require('./pricing');
+
+class MachinePaymentsServiceWrapper {
+    /** @type {MachinePaymentsService|null} */
+    service = null;
+
+    #initialized = false;
+
+    init() {
+        if (this.#initialized) {
+            return this.service;
+        }
+
+        const depositAddressStore = new DepositAddressStore();
+        const paymentRecorder = new PaymentRecorder();
+        const eventRepository = new MachinePaymentEventRepository({
+            MachinePaymentEventModel: models.MachinePaymentEvent
+        });
+
+        const urlService = require('../url');
+        const contentLoader = new ContentLoader({
+            urlServiceFacade: urlService
+        });
+
+        const pricing = new Pricing({
+            settingsCache,
+            defaultCurrencyProvider: getDefaultTiersCurrency
+        });
+
+        const adapters = [
+            new MppAdapter({depositAddressStore, settingsCache, pricing})
+        ];
+
+        this.service = new MachinePaymentsService({
+            settingsCache,
+            labsService: labs,
+            pricing,
+            contentLoader,
+            adapters,
+            eventRepository,
+            paymentRecorder,
+            isStripeConnected: () => settingsHelpers.isStripeConnected(),
+            defaultCurrencyProvider: getDefaultTiersCurrency
+        });
+
+        // Mint Tempo deposit addresses off the request path (Stripe guidance).
+        // Only when machine payments is enabled — otherwise every Stripe-connected
+        // boot (incl. E2E) would call Stripe. Failures leave SPT-only challenges.
+        if (this.service.isEnabled()) {
+            const network = config.get('machinePayments:mpp:stripeNetwork') || 'tempo';
+            depositAddressStore.getOrCreateAddress({network}).catch((err) => {
+                logging.warn(err);
+            });
+        }
+
+        this.#initialized = true;
+        return this.service;
+    }
+
+    isEnabled() {
+        return this.init().isEnabled();
+    }
+
+    isPurchasable(entry) {
+        return this.init().isPurchasable(entry);
+    }
+
+    async challengeOrFulfill(request, options) {
+        return await this.init().challengeOrFulfill(request, options);
+    }
+}
+
+module.exports = new MachinePaymentsServiceWrapper();
+module.exports.MachinePaymentsServiceWrapper = MachinePaymentsServiceWrapper;

package/core/server/services/machine-payments/pricing.js

@@ -0,0 +1,54 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Pricing = exports.DEFAULT_CURRENCY = exports.DEFAULT_AMOUNT = void 0;
+const errors_1 = __importDefault(require("@tryghost/errors"));
+exports.DEFAULT_AMOUNT = 100;
+exports.DEFAULT_CURRENCY = 'USD';
+class Pricing {
+    settingsCache;
+    defaultCurrencyProvider;
+    constructor({ settingsCache, defaultCurrencyProvider }) {
+        this.settingsCache = settingsCache;
+        this.defaultCurrencyProvider = defaultCurrencyProvider;
+    }
+    async getTerms() {
+        const configuredAmount = this.settingsCache.get('machine_payments_amount');
+        const amount = Number(configuredAmount === null || configuredAmount === undefined
+            ? exports.DEFAULT_AMOUNT
+            : configuredAmount);
+        this.assertValidAmount(amount);
+        const configuredCurrency = this.settingsCache.get('machine_payments_currency');
+        const currency = String(configuredCurrency
+            || (await this.defaultCurrencyProvider?.())
+            || exports.DEFAULT_CURRENCY).toUpperCase();
+        return { amount, currency };
+    }
+    /**
+     * SPT/card rails use configured fiat. Tempo USDC uses the same minor-unit
+     * amount as a USDC charge (documented product fence — not FX conversion).
+     */
+    forSpt(terms) {
+        return {
+            amount: terms.amount,
+            currency: terms.currency.toLowerCase(),
+            majorAmount: (terms.amount / 100).toFixed(2)
+        };
+    }
+    forTempoUsdc(terms) {
+        return {
+            amount: terms.amount,
+            majorAmount: (terms.amount / 100).toFixed(2)
+        };
+    }
+    assertValidAmount(amount) {
+        if (!Number.isSafeInteger(amount) || amount < 1) {
+            throw new errors_1.default.ValidationError({
+                message: 'Machine payments amount must be an integer greater than 0'
+            });
+        }
+    }
+}
+exports.Pricing = Pricing;