ghost 6.60.0 → 6.62.0

package/core/server/services/members-custom-fields/schema.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DbCustomFieldLeaf = exports.DbCustomFieldValue = exports.DbCustomField = exports.FieldStatusSchema = exports.FIELD_STATUS = void 0;
+exports.DbBoundField = exports.DbCustomFieldBinding = exports.DbCustomFieldLeaf = exports.DbCustomFieldValue = exports.WrittenBy = exports.DbCustomField = exports.FieldStatusSchema = exports.FIELD_STATUS = void 0;
 const zod_1 = require("zod");
 const custom_field_types_1 = require("@tryghost/custom-field-types");
-const db_date_1 = require("../../lib/db-date");
+const date_1 = require("../../lib/db-types/date");
 // `archived` is soft: the field drops out of the values path but stays in the definition
 // list so it can be renamed, restored or deleted. Mirrors schema.js's `isIn` on the
 // column, which is static config and cannot import this.
@@ -17,9 +17,21 @@ exports.DbCustomField = zod_1.z.object({
     name: zod_1.z.string(),
     type: custom_field_types_1.FieldTypeSchema,
     status: exports.FieldStatusSchema,
-    created_at: db_date_1.DbDate,
-    updated_at: db_date_1.DbDate.nullable(),
+    created_at: date_1.DbDate,
+    updated_at: date_1.DbDate.nullable(),
 });
+/**
+ * How a value arrived, not who caused it: who edited a member's fields is already an
+ * action, and Stripe is not a person. `type` is the namespace that makes `id` resolvable —
+ * `users`, `integrations`, `members_custom_field_bindings` — so the one writer that
+ * resolves in no table is the one with no id to give.
+ */
+exports.WrittenBy = zod_1.z.discriminatedUnion('type', [
+    zod_1.z.object({ type: zod_1.z.literal('user'), id: zod_1.z.string() }),
+    zod_1.z.object({ type: zod_1.z.literal('integration'), id: zod_1.z.string() }),
+    zod_1.z.object({ type: zod_1.z.literal('binding'), id: zod_1.z.string() }),
+    zod_1.z.object({ type: zod_1.z.literal('import'), id: zod_1.z.null() }),
+]);
 // One part of a member's value. What a `path` means is storage.ts's business, so the row
 // carries it as a plain string.
 exports.DbCustomFieldValue = zod_1.z.object({
@@ -30,8 +42,13 @@ exports.DbCustomFieldValue = zod_1.z.object({
     // Nullable like the column, though nothing here writes a null: a part with no value
     // has no row.
     value_text: zod_1.z.string().nullable(),
-    created_at: db_date_1.DbDate,
-    updated_at: db_date_1.DbDate.nullable(),
+    // Plain columns rather than the `WrittenBy` union: the rule holds at the write
+    // boundary, so one malformed row cannot throw away a member's whole profile on read.
+    written_by_type: zod_1.z.string(),
+    // Null for the one writer that resolves nowhere: an import, until runs are tracked.
+    written_by_id: zod_1.z.string().nullable(),
+    created_at: date_1.DbDate,
+    updated_at: date_1.DbDate.nullable(),
 });
 // The field's key travels with the row so a value assembles without a second lookup.
 //
@@ -45,3 +62,17 @@ exports.DbCustomFieldLeaf = zod_1.z.object({
     path: zod_1.z.string(),
     value_text: zod_1.z.string(),
 });
+exports.DbCustomFieldBinding = zod_1.z.object({
+    id: zod_1.z.string(),
+    product_id: zod_1.z.string(),
+    port: zod_1.z.string(),
+    custom_field_key: zod_1.z.string(),
+    created_at: date_1.DbDate,
+    updated_at: date_1.DbDate.nullable(),
+});
+/** A binding joined to the field it points at, which is how a collected value is routed. */
+exports.DbBoundField = zod_1.z.object({
+    binding_id: zod_1.z.string(),
+    key: zod_1.z.string(),
+    type: custom_field_types_1.FieldTypeSchema,
+});

package/core/server/services/members-custom-fields/serializers.js

@@ -4,10 +4,8 @@ exports.toCustomFieldsResponse = void 0;
 const zod_1 = require("zod");
 const case_keys_1 = require("../../lib/case-keys");
 const models_1 = require("./models");
-// Response schema — the field-definition shape the admin endpoints emit. `id` is
-// the DB primary key and deliberately never leaves the API; a field is addressed
-// by its immutable `key`. The `.pipe` below strips id from the mapped output.
 const CustomFieldResource = zod_1.z.object({
+    namespace: zod_1.z.string(),
     key: zod_1.z.string(),
     name: zod_1.z.string(),
     type: zod_1.z.string(),
@@ -15,10 +13,10 @@ const CustomFieldResource = zod_1.z.object({
     created_at: zod_1.z.date(),
     updated_at: zod_1.z.date().nullable(),
 });
-const CustomFieldsResponse = zod_1.z.object({ members_custom_fields: zod_1.z.array(CustomFieldResource) });
+const CustomFieldsResponse = zod_1.z.object({ members_metafields: zod_1.z.array(CustomFieldResource) });
 exports.toCustomFieldsResponse = zod_1.z
     .array(models_1.CustomField)
     .transform((fields) => ({
-    members_custom_fields: fields.map((field) => (0, case_keys_1.snakeKeys)(field)),
+    members_metafields: fields.map((field) => (0, case_keys_1.snakeKeys)(field)),
 }))
     .pipe(CustomFieldsResponse);

package/core/server/services/members-custom-fields/values-service.js

@@ -9,6 +9,7 @@ const errors_1 = __importDefault(require("@tryghost/errors"));
 const logging_1 = __importDefault(require("@tryghost/logging"));
 const zod_1 = require("zod");
 const custom_field_types_1 = require("@tryghost/custom-field-types");
+const identity_1 = require("@tryghost/custom-field-types/identity");
 const schema_1 = require("./schema");
 const queries_1 = require("./queries");
 const storage_1 = require("./storage");
@@ -29,9 +30,9 @@ const MAX_KEY_LENGTH = require('../../data/schema').tables[FIELDS_TABLE].key.max
  * go when that lands; until then the alternative is hand-written upsert SQL per engine.
  */
 const UPSERT_CHUNK = 400;
-// Values stay `unknown`: each is validated by its own field type, which is not known
-// until the key is resolved to a definition.
-const ValuesInput = zod_1.z.record(zod_1.z.string().max(MAX_KEY_LENGTH), zod_1.z.unknown());
+const MAX_IDENTITY_LENGTH = MAX_KEY_LENGTH * 2 + 1;
+const ValuesInput = zod_1.z.record(zod_1.z.string().max(MAX_IDENTITY_LENGTH), zod_1.z.unknown());
+const wireProperty = (identity) => [identity_1.QUALIFIER, identity].join('.');
 /**
  * What a member holds for each defined field. Separate from the definitions service
  * because a value belongs to the member and a definition belongs to the site's settings,
@@ -45,22 +46,22 @@ class CustomFieldValuesService {
         this.knex = knex;
         this.getMaxDefinitions = getMaxDefinitions;
     }
-    async activeFieldsByKey(keys) {
+    async activeFieldsByIdentity(identities) {
+        const keys = identities
+            .map((identity) => (0, identity_1.parseIdentity)(identity))
+            .filter((parsed) => parsed !== null && parsed.namespace === identity_1.CUSTOM_NAMESPACE)
+            .map((parsed) => parsed.key);
         if (keys.length === 0) {
             return new Map();
         }
         const fields = await (0, queries_1.activeFields)(this.knex)
             .whereIn('key', keys)
             .select('id', 'key', 'name', 'type');
-        return new Map(fields.map((field) => [field.key, field]));
+        return new Map(fields.map((field) => [
+            (0, identity_1.formatIdentity)({ namespace: identity_1.CUSTOM_NAMESPACE, key: field.key, partPath: null }),
+            { ...field, namespace: identity_1.CUSTOM_NAMESPACE },
+        ]));
     }
-    /**
-     * Members' values, keyed by member id then field key; anything absent is unset.
-     *
-     * Archived fields are excluded to match the definitions browse: their values stay in
-     * the database and stop being addressable. A row that will not parse is dropped and
-     * logged rather than failing the read, so one stale row cannot take down a member.
-     */
     async getValuesForMembers(memberIds) {
         if (memberIds.length === 0) {
             return new Map();
@@ -80,22 +81,51 @@ class CustomFieldValuesService {
                 leaves.push(schema_1.DbCustomFieldLeaf.parse(row));
             }
             catch (err) {
-                logging_1.default.warn(`Skipping unreadable custom field value (field '${row.key}', path '${row.path}'): ${err instanceof Error ? err.message : String(err)}`);
+                logging_1.default.warn({
+                    event: { name: 'members.custom_fields.value_unreadable' },
+                    err,
+                    customFieldKey: row.key,
+                    path: row.path,
+                }, 'Skipping an unreadable custom field value');
             }
         }
-        return (0, storage_1.valuesFromLeaves)(leaves);
+        const flat = (0, storage_1.valuesFromLeaves)(leaves);
+        return new Map(memberIds.map((memberId) => [memberId, { [identity_1.CUSTOM_NAMESPACE]: flat.get(memberId) ?? {} }]));
     }
-    /** Shared by every caller so they cannot disagree on what a values object is. */
     parseValues(input) {
         const parsed = ValuesInput.safeParse(input);
         if (!parsed.success) {
             throw new errors_1.default.ValidationError({
-                message: 'Custom field values must be an object keyed by field key.',
-                property: 'custom_fields',
+                message: 'Custom field values must be an object keyed by field identity.',
+                property: identity_1.QUALIFIER,
             });
         }
         return parsed.data;
     }
+    unwrapWire(input) {
+        if (input === undefined) {
+            return undefined;
+        }
+        if (typeof input !== 'object' || input === null || Array.isArray(input)) {
+            throw new errors_1.default.ValidationError({
+                message: 'Metafields must be an object keyed by namespace.',
+                property: identity_1.QUALIFIER,
+            });
+        }
+        const identified = {};
+        for (const [namespace, values] of Object.entries(input)) {
+            if (typeof values !== 'object' || values === null || Array.isArray(values)) {
+                throw new errors_1.default.ValidationError({
+                    message: 'Metafield values must be an object keyed by field key.',
+                    property: [identity_1.QUALIFIER, namespace].join('.'),
+                });
+            }
+            for (const [key, raw] of Object.entries(values)) {
+                identified[`${namespace}.${key}`] = raw;
+            }
+        }
+        return identified;
+    }
     /**
      * Whether input names any values. Asks the shape question alone, with no catalog
      * lookup, so it can be asked before a write is known to be permitted.
@@ -113,27 +143,24 @@ class CustomFieldValuesService {
      */
     async planWrite(input) {
         const values = this.parseValues(input);
-        const keys = Object.keys(values);
+        const identities = Object.keys(values);
         // Bounded by the definitions ceiling, which also holds the lookup below inside
         // the driver's bound-parameter limit.
         const maxKeys = this.getMaxDefinitions();
-        if (keys.length > maxKeys) {
+        if (identities.length > maxKeys) {
             throw new errors_1.default.ValidationError({
                 message: `Custom field values are limited to ${maxKeys} fields per request.`,
-                property: 'custom_fields',
+                property: identity_1.QUALIFIER,
             });
         }
-        const byKey = await this.activeFieldsByKey(keys);
+        const byIdentity = await this.activeFieldsByIdentity(identities);
         const writes = [];
-        for (const [key, raw] of Object.entries(values)) {
-            const field = byKey.get(key);
+        for (const [identity, raw] of Object.entries(values)) {
+            const field = byIdentity.get(identity);
             if (!field) {
-                // Unknown or archived. Refused rather than ignored: a typo that silently
-                // drops what somebody typed is worse than a save that fails. The catalog
-                // applies the same rule to the parts of a composite value.
                 throw new errors_1.default.ValidationError({
-                    message: `Unknown custom field: ${key}`,
-                    property: `custom_fields.${key}`,
+                    message: `Unknown custom field: ${identity}`,
+                    property: wireProperty(identity),
                 });
             }
             // `null` clears any field, and `''` clears one with no parts. For a value
@@ -152,7 +179,7 @@ class CustomFieldValuesService {
                 const issue = value.error.issues[0];
                 throw new errors_1.default.ValidationError({
                     message: issue.message,
-                    property: [`custom_fields.${key}`, ...issue.path].join('.'),
+                    property: [wireProperty(identity), ...issue.path].join('.'),
                 });
             }
             writes.push({ field, value: value.data });
@@ -167,10 +194,13 @@ class CustomFieldValuesService {
      * them, and saying nothing about a path leaves it alone. There is no whole-value
      * replace, so a caller that does not know about a field cannot erase it.
      *
+     * `writtenBy` is required and has no default: every writer has to name itself, so a new
+     * one cannot quietly inherit the identity of whichever was written first.
+     *
      * Always transactional. Given an executor it joins that transaction, so the importer's
      * failed value write takes its member with it; given none it opens its own.
      */
-    async applyWrite(memberId, writes, { executor = this.knex } = {}) {
+    async applyWrite(memberId, writes, { writtenBy, executor = this.knex }) {
         if (writes.length === 0) {
             return;
         }
@@ -197,6 +227,8 @@ class CustomFieldValuesService {
                     custom_field_key: field.key,
                     path: leaf.path,
                     value_text: leaf.value_text,
+                    written_by_type: writtenBy.type,
+                    written_by_id: writtenBy.id,
                     created_at: now,
                     updated_at: now,
                 })));
@@ -227,7 +259,9 @@ class CustomFieldValuesService {
                     // Naming the columns rather than giving values takes each from the row
                     // that lost the conflict, so every part updates to its own value.
                     .onConflict(['member_id', 'custom_field_key', 'path'])
-                    .merge(['value_text', 'updated_at']);
+                    // The writer is merged with the value, so a leaf names who wrote what
+                    // it currently holds rather than who wrote its first value.
+                    .merge(['value_text', 'written_by_type', 'written_by_id', 'updated_at']);
             }
         };
         // knex's marker for a transactor: join it rather than nesting a savepoint under it.

package/core/server/services/mentions/mention-controller.js

@@ -1,4 +1,5 @@
 const logging = require('@tryghost/logging');
+const ProcessWebmentionJob = require('./process-webmention-job').default;
 
 /**
  * @typedef {import('./mentions-api')} MentionsAPI
@@ -22,11 +23,6 @@ const logging = require('@tryghost/logging');
  * @prop {Resource} resource
  */
 
-/**
- * @typedef {object} IJobService
- * @prop {(name: string, fn: Function) => void} addJob
- */
-
 /**
  * @typedef {object} IMentionResourceService
  * @prop {(id: import('bson-objectid').default)  => Promise<MentionResource>} getByID
@@ -36,8 +32,8 @@ module.exports = class MentionController {
   /** @type {import('./mentions-api')} */
   #api;
 
-  /** @type {IJobService} */
-  #jobService;
+  /** @type {import('../jobs-service/jobs-service').JobsService} */
+  #jobsService;
 
   /** @type {IMentionResourceService} */
   #mentionResourceService;
@@ -45,12 +41,12 @@ module.exports = class MentionController {
   /**
    * @param {object} deps
    * @param {import('./mentions-api')} deps.api
-   * @param {IJobService} deps.jobService
+   * @param {import('../jobs-service/jobs-service').JobsService} deps.jobsService
    * @param {IMentionResourceService} deps.mentionResourceService
    */
   async init(deps) {
     this.#api = deps.api;
-    this.#jobService = deps.jobService;
+    this.#jobsService = deps.jobsService;
     this.#mentionResourceService = deps.mentionResourceService;
   }
 
@@ -127,17 +123,23 @@ module.exports = class MentionController {
    */
   async receive(frame) {
     logging.info('[Webmention] ' + JSON.stringify(frame.data));
-    this.#jobService.addJob('processWebmention', async () => {
-      const { source, target, ...payload } = frame.data;
-      try {
-        await this.#api.processWebmention({
-          source: new URL(source),
-          target: new URL(target),
-          payload,
-        });
-      } catch (err) {
-        logging.error(err, '[Webmention] Failed processing webmention');
-      }
-    });
+    const { source, target, ...payload } = frame.data;
+    await this.#jobsService.dispatch(new ProcessWebmentionJob({ source, target, payload }));
+  }
+
+  /**
+   * @param {import('./process-webmention-job').default} job
+   * @returns {Promise<void>}
+   */
+  async processWebmention({ source, target, payload }) {
+    try {
+      await this.#api.processWebmention({
+        source: new URL(source),
+        target: new URL(target),
+        payload,
+      });
+    } catch (err) {
+      logging.error(err, '[Webmention] Failed processing webmention');
+    }
   }
 };

package/core/server/services/mentions/process-webmention-job.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const job_1 = require("../jobs-service/job");
+class ProcessWebmentionJob extends job_1.Job {
+    static type = 'process-webmention';
+    source;
+    target;
+    payload;
+    constructor({ source, target, payload, }) {
+        super();
+        this.source = source;
+        this.target = target;
+        this.payload = payload;
+    }
+}
+exports.default = ProcessWebmentionJob;

package/core/server/services/mentions/service.js

@@ -15,7 +15,7 @@ const urlService = require('../url');
 const settingsCache = require('../../../shared/settings-cache');
 const DomainEvents = require('@tryghost/domain-events');
 const logging = require('@tryghost/logging');
-const jobsService = require('../mentions-jobs');
+const mentionsJobService = require('../mentions-jobs');
 
 // Serializes a post model to the data the URL service needs, loading the
 // relations it reads for filtered collections (event-emitted models don't
@@ -45,7 +45,7 @@ function makeLoggingJobService() {
   return {
     async addJob(name, fn) {
       logging.info(`[Background Job] ${name} queued`);
-      jobsService.addJob({
+      mentionsJobService.addJob({
         name,
         job: async () => {
           const startedAt = Date.now();
@@ -75,7 +75,11 @@ module.exports = {
   /** @type {import('./mention-sending-service')} */
   sendingService: null,
   didInit: false,
-  async init() {
+  /**
+   * @param {object} deps
+   * @param {import('../jobs-service/jobs-service').JobsService} deps.jobsService
+   */
+  async init({ jobsService }) {
     if (this.didInit) {
       return;
     }
@@ -110,7 +114,7 @@ module.exports = {
 
     this.controller.init({
       api,
-      jobService: makeLoggingJobService(),
+      jobsService,
       mentionResourceService: {
         async getByID(id) {
           if (!id) {

package/core/server/services/public-config/config.js

@@ -86,5 +86,12 @@ module.exports = function getConfigProperties() {
     };
   }
 
+  if (config.get('docsbot')) {
+    configProperties.docsbot = {
+      enabled: config.get('docsbot:enabled'),
+      id: config.get('docsbot:id'),
+    };
+  }
+
   return configProperties;
 };

package/core/server/services/route-settings/validation-errors.js

@@ -14,7 +14,7 @@ const tpl_1 = __importDefault(require("@tryghost/tpl"));
 const messages = {
     validationError: 'The following definition "{at}" is invalid: {reason}',
 };
-const DOCS_URL = 'https://ghost.org/docs/themes/routing/';
+const DOCS_URL = 'https://docs.ghost.org/themes/routing/';
 const MAX_SHOWN_LENGTH = 40;
 /**
  * Stable, machine-readable codes describing the class of a routes.yaml failure.

package/core/server/services/route-settings/yaml-parser.js

@@ -9,7 +9,7 @@ const messages = {
   },
   invalidYamlFormat: {
     message: 'YAML input cannot be a plain string. Check the format of your YAML file.',
-    help: 'https://ghost.org/docs/themes/routing/',
+    help: 'https://docs.ghost.org/themes/routing/',
   },
 };
 

package/core/server/services/settings/settings-service.js

@@ -200,14 +200,7 @@ module.exports = {
         type: 'boolean',
         group: 'members',
         fn: settingsHelpers.allowSelfSignup.bind(settingsHelpers),
-        dependents: [
-          'members_signup_access',
-          'portal_plans',
-          'stripe_secret_key',
-          'stripe_publishable_key',
-          'stripe_connect_secret_key',
-          'stripe_connect_publishable_key',
-        ],
+        dependents: ['members_signup_access'],
       }),
     );
     fields.push(

package/core/server/services/settings-helpers/settings-helpers.js

@@ -1,7 +1,7 @@
 const net = require('net');
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
-const EmailAddressParser = require('../email-address/email-address-parser');
+const emailAddressParser = require('../email-address/email-address-parser');
 const logging = require('@tryghost/logging');
 const crypto = require('crypto');
 const debug = require('@tryghost/debug')('services:settings-helpers');
@@ -130,11 +130,9 @@ class SettingsHelpers {
     if (!supportAddress) {
       // In the new flow, we make a difference between an empty setting (= use default) and a 'noreply' setting (=use noreply @ domain)
       // Also keep the name of the default email!
-      return EmailAddressParser.stringify(this.getDefaultEmail());
+      return emailAddressParser.stringify(this.getDefaultEmail());
     }
 
-    supportAddress = supportAddress || 'noreply';
-
     // Any fromAddress without domain uses site domain, like default setting `noreply`
     if (supportAddress.indexOf('@') < 0) {
       return `${supportAddress}@${this.getDefaultEmailDomain()}`;
@@ -143,7 +141,7 @@ class SettingsHelpers {
   }
 
   /**
-   * @deprecated Use getDefaultEmail().address (without name) or EmailAddressParser.stringify(this.getDefaultEmail()) (with name) instead
+   * @deprecated Use getDefaultEmail().address (without name) or emailAddressParser.stringify(this.getDefaultEmail()) (with name) instead
    */
   getNoReplyAddress() {
     return this.getDefaultEmailAddress();
@@ -157,7 +155,7 @@ class SettingsHelpers {
     // parse the email here and remove the sender name
     // E.g. when set to "bar" <from@default.com>
     const configAddress = this.config.get('mail:from');
-    const parsed = EmailAddressParser.parse(configAddress);
+    const parsed = emailAddressParser.parse(configAddress);
     if (parsed) {
       return parsed;
     }

package/core/server/services/slack-ping/slack-ping-service.js

@@ -173,7 +173,7 @@ class SlackPingService {
                 this.logging.error(new errors_1.default.InternalServerError({
                     err: err,
                     context: (0, tpl_1.default)(constants_1.messages.requestFailedError, { service: 'slack' }),
-                    help: (0, tpl_1.default)(constants_1.messages.requestFailedHelp, { url: 'https://ghost.org/docs/' }),
+                    help: (0, tpl_1.default)(constants_1.messages.requestFailedHelp, { url: 'https://docs.ghost.org/' }),
                 }));
             });
         }

package/core/server/services/staff/staff-service-emails.js

@@ -2,7 +2,7 @@ const { promises: fs, readFileSync } = require('fs');
 const path = require('path');
 const moment = require('moment');
 const { globSync } = require('glob');
-const EmailAddressParser = require('../email-address/email-address-parser');
+const emailAddressParser = require('../email-address/email-address-parser');
 
 class StaffServiceEmails {
   constructor({
@@ -593,7 +593,7 @@ class StaffServiceEmails {
   }
 
   get fromEmailAddress() {
-    return EmailAddressParser.stringify(this.settingsHelpers.getDefaultEmail());
+    return emailAddressParser.stringify(this.settingsHelpers.getDefaultEmail());
   }
 
   extractInitials(name = '') {

package/core/server/services/stripe/config.js

@@ -4,7 +4,7 @@ const labs = require('../../../shared/labs');
 
 const messages = {
   remoteWebhooksInDevelopment:
-    'Cannot use remote webhooks in development. See https://ghost.org/docs/webhooks/#stripe-webhooks for developing with Stripe.',
+    'Cannot use remote webhooks in development. See https://docs.ghost.org/webhooks/#stripe-webhooks for developing with Stripe.',
 };
 
 // @TODO Refactor to a class w/ constructor
@@ -62,16 +62,19 @@ module.exports = {
     }
 
     const env = config.get('env');
-    let webhookSecret = process.env.WEBHOOK_SECRET;
+    const remoteWebhooks = env !== 'production' && config.get('stripeRemoteWebhooks') === true;
+    let webhookSecret = remoteWebhooks ? undefined : process.env.WEBHOOK_SECRET;
 
-    if (env !== 'production') {
-      if (!webhookSecret) {
-        webhookSecret = 'DEFAULT_WEBHOOK_SECRET';
-        logging.warn(tpl(messages.remoteWebhooksInDevelopment));
-      }
+    if (env !== 'production' && !remoteWebhooks && !webhookSecret) {
+      webhookSecret = 'DEFAULT_WEBHOOK_SECRET';
+      logging.warn(tpl(messages.remoteWebhooksInDevelopment));
     }
 
-    const webhookHandlerUrl = new URL('members/webhooks/stripe/', urlUtils.getSiteUrl());
+    // Development can tunnel the webhook URL alone while the site stays on localhost.
+    const webhookHandlerUrl = new URL(
+      config.get('stripeWebhookUrl') || 'members/webhooks/stripe/',
+      urlUtils.getSiteUrl(),
+    );
     const webhookCustomerIgnoreList = parseIgnoreCustomerList(
       config.get('stripeWebhookCustomerIgnoreList'),
     );
@@ -88,6 +91,9 @@ module.exports = {
       },
       webhookSecret: webhookSecret,
       webhookHandlerUrl: webhookHandlerUrl.href,
+      // A development registration points at a tunnel that closes with the process,
+      // so it is removed on shutdown rather than kept for the next boot.
+      ephemeralWebhook: remoteWebhooks,
       webhookCustomerIgnoreList,
       siteUrl,
     };

package/core/server/services/stripe/service.js

@@ -14,6 +14,12 @@ const giftService = require('../gifts');
 const staffService = require('../staff');
 const labs = require('../../../shared/labs');
 const settingsCache = require('../../../shared/settings-cache');
+const tpl = require('@tryghost/tpl');
+
+const messages = {
+  remoteWebhooksWithoutStripe:
+    'stripeRemoteWebhooks is set but Stripe is not connected, so no webhook endpoint was registered. Connect Stripe in Ghost Admin under Settings, then restart.',
+};
 
 async function configureApi() {
   const cfg = getConfig({ settingsHelpers, config, urlUtils });
@@ -84,7 +90,10 @@ function stripeSettingsChanged(model) {
 
 module.exports.init = async function init() {
   try {
-    await configureApi();
+    const configured = await configureApi();
+    if (!configured && config.get('stripeRemoteWebhooks') === true) {
+      logging.warn(tpl(messages.remoteWebhooksWithoutStripe));
+    }
   } catch (err) {
     logging.error(err);
   }