ghost 6.58.0 → 6.59.0

package/core/server/services/mail/ghost-mailer.js

@@ -68,6 +68,7 @@ function createMessage(message) {
     delete cleanMessage.tags;
     delete cleanMessage.forceTextContent;
     delete cleanMessage.trackOpens;
+    delete cleanMessage.disableTracking;
 
     const addresses = getFromAddress(message.from, message.replyTo);
 
@@ -132,6 +133,7 @@ module.exports = class GhostMailer {
      * @param {string} [message.text] - text version of this message
      * @param {string[]} [message.tags] - optional additional Mailgun tags
      * @param {boolean} [message.trackOpens] - per-message override for Mailgun open tracking
+     * @param {boolean} [message.disableTracking] - explicitly disable Mailgun open and click tracking
      * @param {Record<string, string>} [message.headers] - optional additional email headers (merged with defaults)
      * @param {boolean} [message.forceTextContent] - maps to generateTextFromHTML nodemailer option
      * which is: "if set to true uses HTML to generate plain text body part from the HTML if the text is not defined"
@@ -155,7 +157,13 @@ module.exports = class GhostMailer {
             const trackOpens = typeof message.trackOpens === 'boolean' ?
                 message.trackOpens :
                 settingsCache.get('email_track_opens');
-            if (trackOpens) {
+            // nodemailer-mailgun-transport drops falsy option values, so an explicit
+            // opt-out must be Mailgun's string form rather than boolean false
+            if (message.disableTracking === true) {
+                messageToSend['o:tracking'] = 'no';
+                messageToSend['o:tracking-opens'] = 'no';
+                messageToSend['o:tracking-clicks'] = 'no';
+            } else if (trackOpens) {
                 messageToSend['o:tracking-opens'] = true;
             }
             if (messageToSend.headers) {

package/core/server/services/member-welcome-emails/service.js

@@ -420,10 +420,15 @@ class MemberWelcomeEmailService {
             tags = [MEMBER_WELCOME_EMAIL_TAG];
             sendEmail = this.#sendTransactionalEmail.bind(this);
             break;
-        case 'automation':
+        case 'automation': {
             tags = [AUTOMATION_EMAIL_TAG];
+            const mailgunTagFromConfig = config.get('bulkEmail:mailgun:tag');
+            if (typeof mailgunTagFromConfig === 'string' && mailgunTagFromConfig.length > 0) {
+                tags.push(mailgunTagFromConfig);
+            }
             sendEmail = this.#sendBulkEmail.bind(this);
             break;
+        }
         default: {
             /** @type {never} */ const _exhaustive = emailType;
             throw new errors.InternalServerError({

package/core/server/services/members/members-api/controllers/router-controller.js

@@ -67,6 +67,7 @@ function extractGiftToken(input) {
 const RESERVED_CHECKOUT_METADATA_KEYS = new Set([
     'ghost_donation',
     'ghost_gift',
+    'ghost_gift_id',
     'ghostSignupContext',
     'gift_token',
     'tier_id',
@@ -684,10 +685,14 @@ module.exports = class RouterController {
      * @param {string} [options.offerId]
      * @param {string} [options.cadence]
      * @param {number} [options.duration]
+     * @param {'link'|'email'} [options.deliveryMethod]
+     * @param {string} [options.recipientEmail]
+     * @param {string} [options.recipientName]
+     * @param {string} [options.buyerName]
+     * @param {string} [options.personalMessage]
      * @param {string} [options.email]
      * @param {string} options.successUrl
      * @param {string} options.cancelUrl
-     * @param {object} options.metadata
      * @param {object} [options.member]
      * @param {boolean} options.isAuthenticated
      * @returns
@@ -705,7 +710,11 @@ module.exports = class RouterController {
                 offerId: options.offerId,
                 cadence: options.cadence,
                 duration: options.duration,
-                metadata: options.metadata,
+                deliveryMethod: options.deliveryMethod,
+                recipientEmail: options.recipientEmail,
+                recipientName: options.recipientName,
+                buyerName: options.buyerName,
+                personalMessage: options.personalMessage,
                 successUrl: options.successUrl,
                 cancelUrl: options.cancelUrl,
                 buyer: {
@@ -857,6 +866,11 @@ module.exports = class RouterController {
                 offerId: req.body.offerId,
                 cadence: req.body.cadence,
                 duration: req.body.duration,
+                deliveryMethod: req.body.deliveryMethod,
+                recipientEmail: req.body.recipientEmail,
+                recipientName: req.body.recipientName,
+                buyerName: req.body.buyerName,
+                personalMessage: req.body.personalMessage,
                 successUrl: siteUrl,
                 cancelUrl: options.cancelUrl || siteUrl
             });
@@ -1261,20 +1275,24 @@ module.exports = class RouterController {
     }
 };
 
+// Stripe's limit on `custom_fields[].label.custom` — longer labels make session creation fail
+const STRIPE_CUSTOM_FIELD_LABEL_MAX_LENGTH = 50;
+
 function parsePersonalNote(rawText) {
     if (rawText && typeof rawText !== 'string') {
         logging.warn('Donation personal note is not a string, ignoring');
         return '';
     }
-    if (rawText && rawText.length > 255) {
-        logging.warn('Donation personal note is too long, ignoring:', rawText);
-        return '';
-    }
 
-    const safeInput = sanitizeHtml(rawText, {
+    // Bounded twice, for two different reasons. Before sanitising because this is a
+    // public endpoint and nothing past the limit can survive anyway, so there is no
+    // reason to sanitise more than that. After, because sanitising can lengthen the
+    // string (`&` becomes `&`), and the second bound is the one Stripe measures.
+    const bounded = (rawText ?? '').slice(0, STRIPE_CUSTOM_FIELD_LABEL_MAX_LENGTH);
+    const safeInput = sanitizeHtml(bounded, {
         allowedTags: [],
         allowedAttributes: {}
     });
 
-    return safeInput;
+    return safeInput.slice(0, STRIPE_CUSTOM_FIELD_LABEL_MAX_LENGTH);
 }

package/core/server/services/stripe/services/webhook/checkout-session-event-service.js

@@ -14,8 +14,18 @@ function hasStripeMetadataKey(metadata, key) {
     return Object.prototype.hasOwnProperty.call(metadata || {}, key);
 }
 
-function hasConflictingCheckoutFlowMetadata(metadata) {
-    return hasStripeMetadataKey(metadata, 'ghost_donation') && hasStripeMetadataKey(metadata, 'ghost_gift');
+function isGiftCheckoutSession(session) {
+    return hasStripeMetadataKey(session.metadata, 'ghost_gift_id') || isStripeMetadataTrue(session.metadata?.ghost_gift);
+}
+
+function isDonationCheckoutSession(session) {
+    return isStripeMetadataTrue(session.metadata?.ghost_donation);
+}
+
+// Matches the donation marker on key presence, not truthiness, so an ill-formed
+// donation marker alongside a true gift marker still counts as a conflict.
+function hasConflictingCheckoutFlowMetadata(session) {
+    return hasStripeMetadataKey(session.metadata, 'ghost_donation') && isGiftCheckoutSession(session);
 }
 
 function getStripeResourceId(resource) {
@@ -30,6 +40,18 @@ function getStripeResourceId(resource) {
     return null;
 }
 
+function getGiftBuyerEmailFromSession(session) {
+    if (session.customer_details?.email) {
+        return session.customer_details.email;
+    }
+
+    if (session.customer && typeof session.customer === 'object' && !session.customer.deleted && session.customer.email) {
+        return session.customer.email;
+    }
+
+    return null;
+}
+
 /**
  * Handles `checkout.session.completed` webhook events
  *
@@ -65,8 +87,20 @@ module.exports = class CheckoutSessionEventService {
      * Handles a `checkout.session.completed` event
      * Delegates to the appropriate handler based on the session mode and metadata
      * @param {import('stripe').Stripe.Checkout.Session} session
+     * @param {import('stripe').Stripe.Event.Type} [eventType]
      */
-    async handleEvent(session) {
+    async handleEvent(session, eventType = 'checkout.session.completed') {
+        if (eventType === 'checkout.session.async_payment_failed') {
+            return;
+        }
+
+        if (eventType === 'checkout.session.async_payment_succeeded') {
+            if (session.mode === 'payment' && isGiftCheckoutSession(session)) {
+                await this.handlePaymentEvent(session);
+            }
+            return;
+        }
+
         if (session.mode === 'setup') {
             await this.handleSetupEvent(session);
         }
@@ -76,16 +110,33 @@ module.exports = class CheckoutSessionEventService {
         }
 
         if (session.mode === 'payment') {
-            if (hasConflictingCheckoutFlowMetadata(session.metadata)) {
-                logging.warn('Ignoring checkout session with conflicting payment flow metadata');
+            await this.handlePaymentEvent(session);
+        }
+    }
+
+    /**
+     * Routes a `payment` mode session to the donation or gift handler. Gift purchases
+     * may complete asynchronously, so their handler only runs once Stripe reports the
+     * session as paid, whichever event carried it.
+     *
+     * @param {import('stripe').Stripe.Checkout.Session} session
+     */
+    async handlePaymentEvent(session) {
+        if (hasConflictingCheckoutFlowMetadata(session)) {
+            logging.warn('Ignoring checkout session with conflicting payment flow metadata');
+            return;
+        }
+
+        if (isGiftCheckoutSession(session)) {
+            if (session.payment_status !== 'paid') {
                 return;
             }
+            await this.handleGiftEvent(session);
+            return;
+        }
 
-            if (isStripeMetadataTrue(session.metadata?.ghost_donation)) {
-                await this.handleDonationEvent(session);
-            } else if (isStripeMetadataTrue(session.metadata?.ghost_gift)) {
-                await this.handleGiftEvent(session);
-            }
+        if (isDonationCheckoutSession(session)) {
+            await this.handleDonationEvent(session);
         }
     }
 
@@ -95,10 +146,24 @@ module.exports = class CheckoutSessionEventService {
      * @param {import('stripe').Stripe.Checkout.Session} session
      */
     async handleGiftEvent(session) {
+        const stripeCustomerId = getStripeResourceId(session.customer);
+
+        if (session.metadata?.ghost_gift_id) {
+            await this.deps.giftService.completePurchase({
+                giftId: session.metadata.ghost_gift_id,
+                buyerEmail: getGiftBuyerEmailFromSession(session),
+                stripeCustomerId,
+                stripeCheckoutSessionId: session.id,
+                stripePaymentIntentId: getStripeResourceId(session.payment_intent)
+            });
+            return;
+        }
+
+        const buyerEmail = await this.getGiftBuyerEmail(session, stripeCustomerId);
         await this.deps.giftService.completePurchase({
             token: session.metadata?.gift_token,
-            buyerEmail: session.customer_details?.email,
-            stripeCustomerId: getStripeResourceId(session.customer),
+            buyerEmail,
+            stripeCustomerId,
             tierId: session.metadata?.tier_id,
             cadence: session.metadata?.cadence,
             duration: Number(session.metadata?.duration),
@@ -109,6 +174,29 @@ module.exports = class CheckoutSessionEventService {
         });
     }
 
+    /**
+     * Legacy gift Checkout sessions predate persisted buyer details. If their
+     * webhook snapshot has no customer details, recover the required buyer email
+     * from the Customer associated with the session.
+     *
+     * @param {import('stripe').Stripe.Checkout.Session} session
+     * @param {string|null} stripeCustomerId
+     * @returns {Promise<string|null>}
+     */
+    async getGiftBuyerEmail(session, stripeCustomerId) {
+        const sessionEmail = getGiftBuyerEmailFromSession(session);
+        if (sessionEmail) {
+            return sessionEmail;
+        }
+
+        if (!stripeCustomerId) {
+            return null;
+        }
+
+        const customer = await this.api.getCustomer(stripeCustomerId);
+        return customer.deleted ? null : customer.email ?? null;
+    }
+
     /**
      * Handles a `checkout.session.completed` event for a donation
      * @param {import('stripe').Stripe.Checkout.Session} session

package/core/server/services/stripe/stripe-api.js

@@ -706,10 +706,11 @@ module.exports = class StripeAPI {
      * @param {string} options.cancelUrl
      * @param {ICustomer|null} options.customer
      * @param {string} [options.customerEmail]
+     * @param {string} options.idempotencyKey
      *
      * @returns {Promise<ICheckoutSession>}
      */
-    async createGiftCheckoutSession({amount, currency, tierName, cadence, duration, metadata, successUrl, cancelUrl, customer, customerEmail}) {
+    async createGiftCheckoutSession({amount, currency, tierName, cadence, duration, metadata, successUrl, cancelUrl, customer, customerEmail, idempotencyKey}) {
         await this._rateLimitBucket.throttle();
 
         const cadenceLabel = cadence === 'year' ?
@@ -745,7 +746,7 @@ module.exports = class StripeAPI {
 
         this._applyAutomaticTaxSessionOptions(stripeSessionOptions, {hasCustomer: Boolean(customer)});
 
-        const session = await this._stripe.checkout.sessions.create(stripeSessionOptions);
+        const session = await this._stripe.checkout.sessions.create(stripeSessionOptions, {idempotencyKey});
 
         return session;
     }

package/core/server/services/stripe/webhook-controller.js

@@ -21,6 +21,8 @@ module.exports = class WebhookController {
             'customer.subscription.created': this.subscriptionEvent,
             'invoice.payment_succeeded': this.invoiceEvent,
             'checkout.session.completed': this.checkoutSessionEvent,
+            'checkout.session.async_payment_succeeded': this.checkoutSessionEvent,
+            'checkout.session.async_payment_failed': this.checkoutSessionEvent,
             'charge.refunded': this.chargeRefundedEvent
         };
     }
@@ -119,7 +121,7 @@ module.exports = class WebhookController {
             return;
         }
 
-        await this.handlers[event.type].call(this, event.data.object);
+        await this.handlers[event.type].call(this, event.data.object, event.type);
     }
 
     /**
@@ -143,10 +145,11 @@ module.exports = class WebhookController {
     /**
      * Delegates any `checkout.session.*` events to the `checkoutSessionEventService`
      * @param {import('stripe').Stripe.Checkout.Session} session
+     * @param {import('stripe').Stripe.Event.Type} eventType
      * @private
      */
-    async checkoutSessionEvent(session) {
-        await this.checkoutSessionEventService.handleEvent(session);
+    async checkoutSessionEvent(session, eventType) {
+        await this.checkoutSessionEventService.handleEvent(session, eventType);
     }
 
     /**

package/core/server/services/stripe/webhook-manager.js

@@ -43,6 +43,8 @@ module.exports = class WebhookManager {
     /** @type {WebhookEvent[]} */
     static events = [
         'checkout.session.completed',
+        'checkout.session.async_payment_succeeded',
+        'checkout.session.async_payment_failed',
         'customer.subscription.deleted',
         'customer.subscription.updated',
         'customer.subscription.created',

package/core/shared/labs.js

@@ -51,6 +51,7 @@ const PRIVATE_FEATURES = [
     'themeTranslation',
     'pictureImageFormats',
     'getHelperDeduplication',
+    'navigationIcons',
     'membersCustomFields',
     'paywallImprovements',
     'giftSubCustomization',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "6.58.0",
+  "version": "6.59.0",
   "description": "The professional publishing platform",
   "author": "Ghost Foundation",
   "homepage": "https://ghost.org",
@@ -184,6 +184,7 @@
     "simple-dom": "1.4.0",
     "stoppable": "1.1.0",
     "stripe": "8.222.0",
+    "temporal-polyfill": "0.3.2",
     "terser": "5.48.0",
     "tiny-glob": "0.2.9",
     "tldts": "^7.4.4",
@@ -192,24 +193,24 @@
     "unidecode": "1.1.0",
     "xml": "1.0.1",
     "zod": "4.4.3",
-    "@tryghost/adapter-base-redirects": "file:components/tryghost-adapter-base-redirects-0.0.0.tgz",
     "@tryghost/adapter-base-cache": "file:components/tryghost-adapter-base-cache-0.2.0.tgz",
+    "@tryghost/adapter-base-jobs": "file:components/tryghost-adapter-base-jobs-0.0.0.tgz",
+    "@tryghost/adapter-base-redirects": "file:components/tryghost-adapter-base-redirects-0.0.0.tgz",
     "@tryghost/adapter-base-route-settings": "file:components/tryghost-adapter-base-route-settings-0.0.0.tgz",
     "@tryghost/adapter-base-scheduling": "file:components/tryghost-adapter-base-scheduling-0.2.2.tgz",
     "@tryghost/adapter-base-sso": "file:components/tryghost-adapter-base-sso-0.1.2.tgz",
     "@tryghost/admin-api-schema": "file:components/tryghost-admin-api-schema-0.0.0.tgz",
-    "@tryghost/custom-field-types": "file:components/tryghost-custom-field-types-0.0.0.tgz",
     "@tryghost/i18n": "file:components/tryghost-i18n-0.0.0.tgz",
+    "@tryghost/custom-field-types": "file:components/tryghost-custom-field-types-0.0.0.tgz",
     "@tryghost/kg-card-factory": "file:components/tryghost-kg-card-factory-5.2.4.tgz",
+    "@tryghost/kg-converters": "file:components/tryghost-kg-converters-1.2.5.tgz",
     "@tryghost/kg-default-cards": "file:components/tryghost-kg-default-cards-10.3.5.tgz",
+    "@tryghost/kg-default-nodes": "file:components/tryghost-kg-default-nodes-2.2.0.tgz",
     "@tryghost/kg-html-to-lexical": "file:components/tryghost-kg-html-to-lexical-1.4.0.tgz",
     "@tryghost/kg-lexical-html-renderer": "file:components/tryghost-kg-lexical-html-renderer-1.5.0.tgz",
-    "@tryghost/kg-converters": "file:components/tryghost-kg-converters-1.2.5.tgz",
-    "@tryghost/kg-default-nodes": "file:components/tryghost-kg-default-nodes-2.2.0.tgz",
+    "@tryghost/nql-string": "file:components/tryghost-nql-string-0.0.0.tgz",
     "@tryghost/parse-email-address": "file:components/tryghost-parse-email-address-0.0.0.tgz",
-    "ghost-storage-base": "file:components/ghost-storage-base-3.0.0.tgz",
-    "@tryghost/adapter-base-jobs": "file:components/tryghost-adapter-base-jobs-0.0.0.tgz",
-    "@tryghost/nql-string": "file:components/tryghost-nql-string-0.0.0.tgz"
+    "ghost-storage-base": "file:components/ghost-storage-base-3.0.0.tgz"
   },
   "overrides": {
     "cron-validate": "1.4.5"

package/pnpm-lock.yaml

@@ -68,24 +68,24 @@ overrides:
   '@tryghost/adapter-base-cache': file:components/tryghost-adapter-base-cache-0.2.0.tgz
   '@tryghost/adapter-base-route-settings': file:components/tryghost-adapter-base-route-settings-0.0.0.tgz
   '@tryghost/adapter-base-jobs': file:components/tryghost-adapter-base-jobs-0.0.0.tgz
+  '@tryghost/adapter-base-sso': file:components/tryghost-adapter-base-sso-0.1.2.tgz
+  '@tryghost/adapter-base-scheduling': file:components/tryghost-adapter-base-scheduling-0.2.2.tgz
   '@tryghost/custom-field-types': file:components/tryghost-custom-field-types-0.0.0.tgz
   '@tryghost/admin-api-schema': file:components/tryghost-admin-api-schema-0.0.0.tgz
   '@tryghost/i18n': file:components/tryghost-i18n-0.0.0.tgz
-  '@tryghost/adapter-base-scheduling': file:components/tryghost-adapter-base-scheduling-0.2.2.tgz
-  '@tryghost/adapter-base-sso': file:components/tryghost-adapter-base-sso-0.1.2.tgz
-  '@tryghost/kg-card-factory': file:components/tryghost-kg-card-factory-5.2.4.tgz
+  '@tryghost/kg-utils': file:components/tryghost-kg-utils-1.1.4.tgz
   '@tryghost/nql-string': file:components/tryghost-nql-string-0.0.0.tgz
   '@tryghost/parse-email-address': file:components/tryghost-parse-email-address-0.0.0.tgz
-  '@tryghost/kg-utils': file:components/tryghost-kg-utils-1.1.4.tgz
   ghost-storage-base: file:components/ghost-storage-base-3.0.0.tgz
   '@tryghost/kg-converters': file:components/tryghost-kg-converters-1.2.5.tgz
+  '@tryghost/kg-card-factory': file:components/tryghost-kg-card-factory-5.2.4.tgz
   '@tryghost/kg-clean-basic-html': file:components/tryghost-kg-clean-basic-html-4.3.4.tgz
   '@tryghost/kg-markdown-html-renderer': file:components/tryghost-kg-markdown-html-renderer-7.2.4.tgz
   '@tryghost/kg-default-nodes': file:components/tryghost-kg-default-nodes-2.2.0.tgz
   '@tryghost/kg-default-cards': file:components/tryghost-kg-default-cards-10.3.5.tgz
   '@tryghost/kg-default-transforms': file:components/tryghost-kg-default-transforms-1.3.4.tgz
-  '@tryghost/kg-lexical-html-renderer': file:components/tryghost-kg-lexical-html-renderer-1.5.0.tgz
   '@tryghost/kg-html-to-lexical': file:components/tryghost-kg-html-to-lexical-1.4.0.tgz
+  '@tryghost/kg-lexical-html-renderer': file:components/tryghost-kg-lexical-html-renderer-1.5.0.tgz
 
 packageExtensionsChecksum: sha256-gFsvptlcVXY90ntXWh9ANUP1/LYyeqXjWoDGw6BCfOY=
 
@@ -558,6 +558,9 @@ importers:
       stripe:
         specifier: 8.222.0
         version: 8.222.0
+      temporal-polyfill:
+        specifier: 0.3.2
+        version: 0.3.2
       terser:
         specifier: 5.48.0
         version: 5.48.0
@@ -1391,11 +1394,11 @@ packages:
     version: 0.0.0
 
   '@tryghost/adapter-base-scheduling@file:components/tryghost-adapter-base-scheduling-0.2.2.tgz':
-    resolution: {integrity: sha512-CD40gLA91netEC58r5wnPwQzcpbzYpgWJmpf+xvtDWDM7KsWybsfPz503RluPbF52tAMjOCPYvj+I8ZXNL8eUw==, tarball: file:components/tryghost-adapter-base-scheduling-0.2.2.tgz}
+    resolution: {integrity: sha512-i1kaVr13yLTqciCZCUtHatxOf0yCG6Fc2lZb+O9nZzxV2P3torpvhInZRz0qZ4czNh9X5c8KUQygzsVeWRZNqw==, tarball: file:components/tryghost-adapter-base-scheduling-0.2.2.tgz}
     version: 0.2.2
 
   '@tryghost/adapter-base-sso@file:components/tryghost-adapter-base-sso-0.1.2.tgz':
-    resolution: {integrity: sha512-CE5TpgSrYnP3n4eNKuQ4OJdweyU0tRNvnlfmuwZ56a4ZYNksLcTYWY6b/Sg0oMC94g/aBoXxwx+eXCEuVONHQw==, tarball: file:components/tryghost-adapter-base-sso-0.1.2.tgz}
+    resolution: {integrity: sha512-kRcMtxlPyGd1AfJOAIRS5/norqLTBs5oHwQlTr4kONvCN7dOGZqk0Woi5tuyMbdkILmwjOnRAVmamIyZGpV63A==, tarball: file:components/tryghost-adapter-base-sso-0.1.2.tgz}
     version: 0.1.2
 
   '@tryghost/admin-api-schema@file:components/tryghost-admin-api-schema-0.0.0.tgz':
@@ -1507,7 +1510,7 @@ packages:
     resolution: {integrity: sha512-ffxWIJ8bGBZS2d/NkFfOgqWEkd1LoqT9AIEqdBTvlDm3jDMqu585IbIluTddrnZIIGgKJNi5+lyFfjBj5z1CAg==}
 
   '@tryghost/i18n@file:components/tryghost-i18n-0.0.0.tgz':
-    resolution: {integrity: sha512-Oub2nUWVghw6gfdWVp6LN+qzR0zzMEJqHlEIKb/zxv+VoLL4cevTavbV0fjFGLR0SwHKSEEG0YxJrKDlkBu6Rg==, tarball: file:components/tryghost-i18n-0.0.0.tgz}
+    resolution: {integrity: sha512-rxWoxVT0AWBe09hb5OJwOoCaajAGeSBAOPoYozrDKEbWdiq+VYbW5wQRt2+1YJhufz9vuKJlWy5fs/J2PcpZlg==, tarball: file:components/tryghost-i18n-0.0.0.tgz}
     version: 0.0.0
 
   '@tryghost/image-transform@1.4.17':
@@ -1536,7 +1539,7 @@ packages:
     engines: {node: ^22.13.1 || ^24.0.0}
 
   '@tryghost/kg-default-nodes@file:components/tryghost-kg-default-nodes-2.2.0.tgz':
-    resolution: {integrity: sha512-+7HiqaLukYeGKqMnt/d15lzPnlfwvt94V2ID/NSplzxi8V6FjlcAnpTr56AaRE8+6eafAMWy+N7RBKSIFV2fMA==, tarball: file:components/tryghost-kg-default-nodes-2.2.0.tgz}
+    resolution: {integrity: sha512-M+hCAHuNw+qP9P/FpbUp/4eVG49tNR2LT4k9RMfPEvRzColewitY4Xq/BKsNGhTqXlR4pV2TOr9PtLL9XEwWTA==, tarball: file:components/tryghost-kg-default-nodes-2.2.0.tgz}
     version: 2.2.0
     engines: {node: ^22.22.2 || ^24.15.0}
 
@@ -1545,12 +1548,12 @@ packages:
     version: 1.3.4
 
   '@tryghost/kg-html-to-lexical@file:components/tryghost-kg-html-to-lexical-1.4.0.tgz':
-    resolution: {integrity: sha512-oWAF0rtIZMU2i1cZz83GhJwIt/bc2TJh+VKpCo0MU0l1yhlQo1UcW7XWxTUKWR0d/iM7cqL+lRhCBHFe8Fm1nw==, tarball: file:components/tryghost-kg-html-to-lexical-1.4.0.tgz}
+    resolution: {integrity: sha512-ZzRiFk6hE0WJerp7pa6pMSp4vDRKWLnviRuisnb7rcEdh1hQwq7zRcaSxMJk6lp/KVF6+uwgkeeNcIl3UDTzFQ==, tarball: file:components/tryghost-kg-html-to-lexical-1.4.0.tgz}
     version: 1.4.0
     engines: {node: ^22.22.2 || ^24.15.0}
 
   '@tryghost/kg-lexical-html-renderer@file:components/tryghost-kg-lexical-html-renderer-1.5.0.tgz':
-    resolution: {integrity: sha512-+JGxNt0ktsrCje6kBvbwzcVuaNTbUaJ7Ia3rTaCJd0qk614BWLZmr9dhT2G6KtRWaMo5SXIr+MnwRmmkH9mw+w==, tarball: file:components/tryghost-kg-lexical-html-renderer-1.5.0.tgz}
+    resolution: {integrity: sha512-zjeo3FjPEil+TLE635IicGBbjsA8qbv1JGlpO5GL7mFf7jH7OVnBJEdNzWOh2WIjJIBXagivb4UPgFzU8fFtEg==, tarball: file:components/tryghost-kg-lexical-html-renderer-1.5.0.tgz}
     version: 1.5.0
     engines: {node: ^22.22.2 || ^24.15.0}
 
@@ -4987,6 +4990,12 @@ packages:
   teex@1.0.1:
     resolution: {integrity: sha512-eYE6iEI62Ni1H8oIa7KlDU6uQBtqr4Eajni3wX7rpfXD8ysFx8z0+dri+KWEPWpBsxXfxu58x/0jvTVT1ekOSg==}
 
+  temporal-polyfill@0.3.2:
+    resolution: {integrity: sha512-TzHthD/heRK947GNiSu3Y5gSPpeUDH34+LESnfsq8bqpFhsB79HFBX8+Z834IVX68P3EUyRPZK5bL/1fh437Eg==}
+
+  temporal-spec@0.3.1:
+    resolution: {integrity: sha512-B4TUhezh9knfSIMwt7RVggApDRJZo73uZdj8AacL2mZ8RP5KtLianh2MXxL06GN9ESYiIsiuoLQhgVfwe55Yhw==}
+
   terser@5.48.0:
     resolution: {integrity: sha512-J/9An6vs9Us6wKRriSFXBWdRZapREHqFzdNUKk0pmu804EMR6dr6winwo7e5JDxN4xahxQsuysyYFwlwj4XN/Q==}
     engines: {node: '>=10'}
@@ -10566,6 +10575,12 @@ snapshots:
       - bare-abort-controller
       - react-native-b4a
 
+  temporal-polyfill@0.3.2:
+    dependencies:
+      temporal-spec: 0.3.1
+
+  temporal-spec@0.3.1: {}
+
   terser@5.48.0:
     dependencies:
       '@jridgewell/source-map': 0.3.11

package/pnpm-workspace.yaml

@@ -12,7 +12,6 @@ catalog:
   '@codemirror/state': 6.7.1
   '@codemirror/theme-one-dark': 6.1.3
   '@codemirror/view': 6.43.6
-  '@ebay/nice-modal-react': 1.2.13
   '@eslint/compat': 2.1.0
   '@eslint/js': 9.39.5
   '@faker-js/faker': 10.5.0
@@ -258,24 +257,24 @@ overrides:
   '@tryghost/adapter-base-cache': file:components/tryghost-adapter-base-cache-0.2.0.tgz
   '@tryghost/adapter-base-route-settings': file:components/tryghost-adapter-base-route-settings-0.0.0.tgz
   '@tryghost/adapter-base-jobs': file:components/tryghost-adapter-base-jobs-0.0.0.tgz
+  '@tryghost/adapter-base-sso': file:components/tryghost-adapter-base-sso-0.1.2.tgz
+  '@tryghost/adapter-base-scheduling': file:components/tryghost-adapter-base-scheduling-0.2.2.tgz
   '@tryghost/custom-field-types': file:components/tryghost-custom-field-types-0.0.0.tgz
   '@tryghost/admin-api-schema': file:components/tryghost-admin-api-schema-0.0.0.tgz
   '@tryghost/i18n': file:components/tryghost-i18n-0.0.0.tgz
-  '@tryghost/adapter-base-scheduling': file:components/tryghost-adapter-base-scheduling-0.2.2.tgz
-  '@tryghost/adapter-base-sso': file:components/tryghost-adapter-base-sso-0.1.2.tgz
-  '@tryghost/kg-card-factory': file:components/tryghost-kg-card-factory-5.2.4.tgz
+  '@tryghost/kg-utils': file:components/tryghost-kg-utils-1.1.4.tgz
   '@tryghost/nql-string': file:components/tryghost-nql-string-0.0.0.tgz
   '@tryghost/parse-email-address': file:components/tryghost-parse-email-address-0.0.0.tgz
-  '@tryghost/kg-utils': file:components/tryghost-kg-utils-1.1.4.tgz
   ghost-storage-base: file:components/ghost-storage-base-3.0.0.tgz
   '@tryghost/kg-converters': file:components/tryghost-kg-converters-1.2.5.tgz
+  '@tryghost/kg-card-factory': file:components/tryghost-kg-card-factory-5.2.4.tgz
   '@tryghost/kg-clean-basic-html': file:components/tryghost-kg-clean-basic-html-4.3.4.tgz
   '@tryghost/kg-markdown-html-renderer': file:components/tryghost-kg-markdown-html-renderer-7.2.4.tgz
   '@tryghost/kg-default-nodes': file:components/tryghost-kg-default-nodes-2.2.0.tgz
   '@tryghost/kg-default-cards': file:components/tryghost-kg-default-cards-10.3.5.tgz
   '@tryghost/kg-default-transforms': file:components/tryghost-kg-default-transforms-1.3.4.tgz
-  '@tryghost/kg-lexical-html-renderer': file:components/tryghost-kg-lexical-html-renderer-1.5.0.tgz
   '@tryghost/kg-html-to-lexical': file:components/tryghost-kg-html-to-lexical-1.4.0.tgz
+  '@tryghost/kg-lexical-html-renderer': file:components/tryghost-kg-lexical-html-renderer-1.5.0.tgz
 packageExtensions:
   '@doist/react-interpolate@2.2.1':
     dependencies: