ghost 6.60.0 → 6.62.0

package/core/server/services/stripe/services/checkout/completed-session.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectedByPort = exports.CompletedSession = void 0;
+const zod_1 = require("zod");
+const checkout_1 = require("@tryghost/checkout");
+/**
+ * What Ghost reads off a completed session.
+ *
+ * `shipping` is where the address lives at Ghost's pinned Stripe API version; later
+ * versions moved it to `collected_information.shipping_details`. An Event is an immutable
+ * snapshot rendered at the account's version, so nothing in a payload would warn us if
+ * that pin ever changed.
+ *
+ * A tax number is deliberately not read: Stripe keeps it against the customer it invoices
+ * and Ghost never stores one.
+ */
+const Collected = zod_1.z
+    .string()
+    .nullish()
+    .transform((given) => (given && given.trim() !== '' ? given : undefined));
+exports.CompletedSession = zod_1.z
+    .object({
+    custom_fields: zod_1.z
+        .array(zod_1.z
+        .object({
+        key: zod_1.z.string().nullish(),
+        text: zod_1.z.object({ value: Collected }).nullish(),
+    })
+        .nullable())
+        .nullish(),
+    shipping: zod_1.z
+        .object({
+        name: Collected,
+        address: zod_1.z.record(zod_1.z.string(), Collected).nullish(),
+    })
+        .nullish(),
+    customer_details: zod_1.z.object({ phone: Collected }).nullish(),
+})
+    .loose();
+/** Our address type needs at least one part; an empty value would erase what is there. */
+function addressValue(address) {
+    const value = Object.fromEntries(Object.entries(address ?? {}).filter((entry) => entry[1] !== undefined));
+    return Object.keys(value).length > 0 ? value : undefined;
+}
+const PORT_VALUES = {
+    // Stripe returns the recipient's name alongside the address rather than as part of it,
+    // while Ghost keeps a name and an address in two separate custom fields. So the name is
+    // carried back separately here, under its own name, to be routed to its own field.
+    shipping_name: (session) => session.shipping?.name,
+    shipping_address: (session) => addressValue(session.shipping?.address),
+    phone: (session) => session.customer_details?.phone,
+};
+/**
+ * Everything a completed checkout gives back, as a list of pairs: the name Stripe used for
+ * a value, and the value itself. Answers to questions and values Stripe collected on its
+ * own both come back this way, because both are saved by the same route afterwards.
+ *
+ * Order matters. The values Stripe collected come last, so that if a question's answer and
+ * a collected value are both saved into the same custom field, the collected value is the
+ * one the field ends up holding.
+ */
+exports.collectedByPort = exports.CompletedSession.transform((session) => {
+    const answers = (session.custom_fields ?? [])
+        .filter((field) => Boolean(field?.key && field.text?.value))
+        .map((field) => ({ port: field.key, value: field.text.value }));
+    const ports = checkout_1.STRIPE_PORTS.map((port) => ({ port, value: PORT_VALUES[port](session) })).filter((entry) => entry.value !== undefined);
+    return [...answers, ...ports];
+});

package/core/server/services/stripe/services/checkout/session-options.js

@@ -0,0 +1,100 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripeCheckoutCollectionOptions = stripeCheckoutCollectionOptions;
+const logging_1 = __importDefault(require("@tryghost/logging"));
+const checkout_1 = require("@tryghost/checkout");
+/** Keyed on the eligible types, so this and the configure-time rule cannot drift apart. */
+const QUESTION_TYPES = {
+    short_text: 'text',
+};
+function askable(question) {
+    if (!(0, checkout_1.isCheckoutEligible)(question.type)) {
+        logging_1.default.warn({
+            event: { name: 'stripe.checkout.question_skipped' },
+            customFieldKey: question.key,
+            fieldType: question.type,
+            reason: 'unsupported_type',
+        }, 'Skipping a Stripe checkout question');
+        return false;
+    }
+    if (question.prompt.length > checkout_1.MAX_CHECKOUT_LABEL_LENGTH) {
+        logging_1.default.warn({
+            event: { name: 'stripe.checkout.question_skipped' },
+            customFieldKey: question.key,
+            promptLength: question.prompt.length,
+            reason: 'label_too_long',
+        }, 'Skipping a Stripe checkout question');
+        return false;
+    }
+    return true;
+}
+/**
+ * Build the collection parameters for a checkout, or nothing at all.
+ *
+ * Returns an object with no keys when a tier asks for nothing, so a caller can spread it
+ * over its session options unconditionally and change nothing.
+ */
+function stripeCheckoutCollectionOptions(checkout) {
+    const options = {};
+    if (!checkout) {
+        return options;
+    }
+    const eligible = checkout.customFields.filter(askable);
+    const questions = eligible.slice(0, checkout_1.MAX_CHECKOUT_CUSTOM_FIELDS);
+    if (questions.length < eligible.length) {
+        logging_1.default.warn({
+            event: { name: 'stripe.checkout.questions_trimmed' },
+            asked: questions.length,
+            configured: eligible.length,
+        }, 'Some Stripe checkout questions were not asked');
+    }
+    if (questions.length > 0) {
+        options.custom_fields = questions.map((question) => ({
+            // Ghost sends the custom field's own key as the question's identifier, and Stripe
+            // returns the buyer's answer labelled with that same key. Using it in both places
+            // means reading an answer is a direct lookup of the field it belongs to, with
+            // nothing in between that could map it to the wrong one.
+            key: question.key,
+            label: { type: 'custom', custom: question.prompt },
+            type: QUESTION_TYPES[question.type],
+            optional: question.optional,
+        }));
+    }
+    if (checkout.shipping) {
+        // Ghost stores "everywhere" as no list, because the set of countries moves and a
+        // stored copy of it would quietly become a restriction. Stripe has no such sentinel:
+        // `allowed_countries` is the only key `shipping_address_collection` has, so a request
+        // that omits it carries no parameter at all, and Stripe accepts it precisely because
+        // it was never asked to collect anything — a session that succeeds and collects no
+        // address. So everywhere is expanded to every country here, at the one point that
+        // builds the request.
+        //
+        // An empty list is neither everywhere nor a real restriction, and would encode to the
+        // same absent parameter. Defended here rather than trusted from the settings screen:
+        // this is the checkout path, and a malformed configuration must cost the collection
+        // rather than throw inside a session build.
+        const allowedCountries = checkout.shipping.allowedCountries ?? [...checkout_1.STRIPE_ALLOWED_COUNTRIES];
+        if (allowedCountries.length === 0) {
+            logging_1.default.warn({
+                event: { name: 'stripe.checkout.collection_skipped' },
+                port: 'shipping_address',
+                reason: 'no_allowed_countries',
+            }, 'Skipping a Stripe checkout collection');
+        }
+        else {
+            options.shipping_address_collection = { allowed_countries: allowedCountries };
+        }
+    }
+    // Unioned with whatever automatic tax asks for. Both want the same thing, so a site
+    // running the 2024 tax beta keeps collecting and a site that asked for it starts.
+    if (checkout.taxNumber) {
+        options.tax_id_collection = { enabled: true };
+    }
+    if (checkout.phone) {
+        options.phone_number_collection = { enabled: true };
+    }
+    return options;
+}

package/core/server/services/stripe/services/webhook/checkout-session-event-service.js

@@ -1,7 +1,11 @@
 const _ = require('lodash');
 const errors = require('@tryghost/errors');
 const logging = require('@tryghost/logging');
-const { canWelcomeEmailReplaceSignupPaidEmail } = require('../../../lib/member-signup-contexts');
+const {
+  SIGNUP_CONTEXTS,
+  canWelcomeEmailReplaceSignupPaidEmail,
+} = require('../../../lib/member-signup-contexts');
+const { collectedByPort } = require('../checkout/completed-session');
 /** @typedef {import('../../../lib/member-signup-contexts').SignupContext} SignupContext */
 
 function isStripeMetadataTrue(value) {
@@ -334,6 +338,7 @@ module.exports = class CheckoutSessionEventService {
       email: customer.email,
     });
 
+    const memberPreexisted = Boolean(member);
     const checkoutType = _.get(session, 'metadata.checkoutType');
 
     if (!member) {
@@ -422,6 +427,11 @@ module.exports = class CheckoutSessionEventService {
       }
     }
 
+    // After the subscription work, and deliberately not part of it: a value the member
+    // gave us for free must never be able to fail the webhook. A throw here would make
+    // Stripe retry the event and risk doing the payment work twice.
+    await this.writeCollectedFields(member.id, session, { memberPreexisted });
+
     if (checkoutType !== 'upgrade') {
       const ghostSignupContext = /** @type {SignupContext | undefined} */ (
         session.metadata?.ghostSignupContext
@@ -440,4 +450,64 @@ module.exports = class CheckoutSessionEventService {
       }
     }
   }
+
+  /**
+   * This service knows how to read a completed Stripe session. It does not know, and must
+   * not know, which custom field any of those values belongs in — that is what a binding
+   * decides, so no field key appears anywhere in this code.
+   *
+   * Nothing here may be fatal: a throw fails the webhook, which makes Stripe retry it and
+   * risks doing the payment work twice.
+   *
+   * @param {string} memberId
+   * @param {import('stripe').Stripe.Checkout.Session} session
+   * @param {object} options
+   * @param {boolean} options.memberPreexisted Whether the member's record existed before this event resolved it
+   */
+  async writeCollectedFields(memberId, session, { memberPreexisted }) {
+    // Stamped at create time. A session predating this feature carries none. Read
+    // outside the try so a failure below can name the tier whose answers were lost.
+    const tierId = session.metadata?.ghostTierId;
+
+    try {
+      if (!tierId) {
+        return;
+      }
+
+      // A checkout can be started with nothing but an email address, and typing an
+      // email is not proof of owning it. Values may land on the member this event just
+      // created — that record holds nothing the buyer didn't supply — but a record
+      // that existed before the checkout belongs to whoever verified that email, so it
+      // is only written when the session was created by a signed-in member.
+      const wasAuthenticated =
+        session.metadata?.ghostSignupContext === SIGNUP_CONTEXTS.ALREADY_AUTHENTICATED;
+      if (memberPreexisted && !wasAuthenticated) {
+        logging.warn(
+          {
+            event: { name: 'stripe_checkout.collected_fields.write_skipped' },
+            memberId,
+            tierId,
+          },
+          'Skipped storing the fields an unverified checkout collected for an existing member',
+        );
+        return;
+      }
+
+      await this.deps.customFieldBindings.writeCollected(
+        memberId,
+        tierId,
+        collectedByPort.parse(session),
+      );
+    } catch (err) {
+      logging.error(
+        {
+          event: { name: 'stripe_checkout.collected_fields.write_failed' },
+          err,
+          memberId,
+          tierId,
+        },
+        'Failed to store the fields a checkout collected',
+      );
+    }
+  }
 };

package/core/server/services/stripe/stripe-api.js

@@ -3,6 +3,7 @@ const debug = require('@tryghost/debug')('stripe');
 const ghostConfig = require('../../../shared/config');
 const stripe = require('stripe');
 const i18n = require('../i18n');
+const { stripeCheckoutCollectionOptions } = require('./services/checkout/session-options');
 
 /* Stripe has the following rate limits:
  *  - For most APIs, 100 read requests per second in live mode, 25 read requests per second in test mode
@@ -61,6 +62,8 @@ const MANAGED_PAYMENTS_DISABLED = { enabled: false };
  */
 
 module.exports = class StripeAPI {
+  static API_VERSION = STRIPE_API_VERSION;
+
   /**
    * StripeAPI
    * @param {object} deps
@@ -556,6 +559,8 @@ module.exports = class StripeAPI {
    * @param {string} options.customerEmail
    * @param {number} options.trialDays
    * @param {string} [options.coupon]
+   * @param {import('../tier-checkout-config').ResolvedCheckout} [options.checkout] What
+   *   the tier's checkout asks for beyond the payment. Absent, or empty, adds nothing.
    *
    * @returns {Promise<ICheckoutSession>}
    */
@@ -636,6 +641,32 @@ module.exports = class StripeAPI {
       hasCustomer: Boolean(customerId),
     });
 
+    // Applied after automatic tax so the two agree about `tax_id_collection`: both ask
+    // for the same thing, and a site with either reason to collect gets it. Nothing is
+    // added for a tier that has configured nothing, so an unconfigured site's request
+    // is unchanged.
+    Object.assign(stripeSessionOptions, stripeCheckoutCollectionOptions(options.checkout));
+
+    // Stripe refuses to collect a tax id for a customer it may not rename:
+    //
+    //   Tax ID collection requires updating business name on the customer. To enable tax
+    //   ID collection for an existing customer, please set `customer_update[name]`.
+    //
+    // Measured against the live API rather than read — `pnpm --filter @tryghost/e2e
+    // stripe:probe` — because the same probe shows shipping and phone collection need no
+    // such thing. Every signed-in checkout carries a customer, so without this a tier
+    // that collects a tax number cannot be bought by an existing member.
+    //
+    // Merged rather than assigned: automatic tax sets this too, and whichever ran first
+    // must not lose its keys. Still never set without a customer, which is the shape
+    // that took the tax beta down.
+    if (stripeSessionOptions.tax_id_collection && customerId) {
+      stripeSessionOptions.customer_update = {
+        ...stripeSessionOptions.customer_update,
+        name: 'auto',
+      };
+    }
+
     const session = await this._stripe.checkout.sessions.create(stripeSessionOptions);
 
     return session;

package/core/server/services/stripe/stripe-service.js

@@ -10,6 +10,7 @@ const InvoiceEventService = require('./services/webhook/invoice-event-service');
 const CheckoutSessionEventService = require('./services/webhook/checkout-session-event-service');
 const ChargeRefundedEventService = require('./services/webhook/charge-refunded-event-service');
 const memberWelcomeEmailService = require('../member-welcome-emails/service');
+const customFields = require('../members-custom-fields');
 
 /**
  * @typedef {object} IStripeServiceConfig
@@ -24,6 +25,7 @@ const memberWelcomeEmailService = require('../member-welcome-emails/service');
  * @prop {boolean} testEnv Whether this is a test environment
  * @prop {string} webhookSecret The Stripe webhook secret
  * @prop {string} webhookHandlerUrl The URL to handle Stripe webhooks
+ * @prop {boolean} [ephemeralWebhook] Whether the webhook endpoint is deleted on shutdown
  * @prop {string[]} webhookCustomerIgnoreList List of customer IDs for customer.subscription.updated webhook bypass
  * @prop {string} siteUrl The site URL for billing portal return URL
  */
@@ -133,6 +135,11 @@ module.exports = class StripeService {
         memberWelcomeEmailService.init();
         return memberWelcomeEmailService.api.isMemberWelcomeEmailActive('paid');
       },
+      // A getter because the custom field services are built during boot: reading the
+      // binding at construction would capture the empty value it had beforehand.
+      get customFieldBindings() {
+        return customFields.bindings;
+      },
     });
 
     const chargeRefundedEventService = new ChargeRefundedEventService({
@@ -155,6 +162,8 @@ module.exports = class StripeService {
     this.migrations = migrations;
     this.webhookController = webhookController;
     this.billingPortalManager = billingPortalManager;
+    /** @private */
+    this.ephemeralWebhook = false;
   }
 
   async connect() {
@@ -206,23 +215,31 @@ module.exports = class StripeService {
       webhookSecret: config.webhookSecret,
       webhookHandlerUrl: config.webhookHandlerUrl,
     });
+    this.ephemeralWebhook = config.ephemeralWebhook === true;
 
     this.billingPortalManager.configure({
       siteUrl: config.siteUrl,
     });
 
-    // webhookManager.start() already self-guards: configure() above puts it in
-    // 'local' mode whenever a webhookSecret is set, which is always true outside
-    // production (config.js defaults it to DEFAULT_WEBHOOK_SECRET), so start()
-    // returns immediately without touching Stripe. Only billingPortalManager
-    // needs an explicit test-env skip — in the test env there is no real Stripe
-    // to register against, and the mock returns 500 for billing_portal/
-    // configurations, so this network-registration call only error-logs on
-    // every boot. Tests never need a registered portal configuration. Skip it
-    // under test; prod and dev register exactly as before.
+    // webhookManager.start() registers a webhook URL with Stripe only when no webhook
+    // secret was supplied. Outside production config.js supplies a placeholder secret
+    // unless stripeRemoteWebhooks is set, so start() normally returns without touching
+    // Stripe. billingPortalManager has no such guard: in the test environment the mock
+    // Stripe answers its registration call with a 500 on every boot, and tests never
+    // need a registered portal, so skip it under test only.
     await this.webhookManager.start();
     if (!config.testEnv) {
       await this.billingPortalManager.start();
     }
   }
+
+  /**
+   * Removes the webhook registration from Stripe, but only when it was marked ephemeral.
+   * A production registration is kept and reused on the next boot.
+   */
+  async shutdown() {
+    if (this.ephemeralWebhook) {
+      await this.webhookManager.stop();
+    }
+  }
 };

package/core/server/services/stripe/webhook-controller.js

@@ -1,4 +1,5 @@
 const logging = require('@tryghost/logging');
+const StripeAPI = require('./stripe-api');
 
 module.exports = class WebhookController {
   /**
@@ -89,6 +90,15 @@ module.exports = class WebhookController {
       return res.end();
     }
 
+    // Stripe shapes each event for the API version of the URL it was sent to. A different
+    // version means this event did not come through the URL Ghost registered, and fields
+    // may not be where Ghost reads them.
+    if (event.api_version !== StripeAPI.API_VERSION) {
+      logging.error(
+        `Webhook ${event.type} was rendered at Stripe API version ${event.api_version}, Ghost expects ${StripeAPI.API_VERSION}`,
+      );
+    }
+
     const customerId = this.getEventCustomerId(event);
     if (this.shouldIgnoreEvent(event, customerId)) {
       logging.info(

package/core/server/services/tier-checkout-config/codec.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.questionRowCodec = exports.QuestionRow = exports.collectionRowCodec = exports.CollectionRow = exports.optionsCodec = void 0;
+const zod_1 = require("zod");
+const custom_field_types_1 = require("@tryghost/custom-field-types");
+const boolean_1 = require("../../lib/db-types/boolean");
+const schema_1 = require("./schema");
+const models_1 = require("./models");
+const SEPARATOR = ',';
+exports.optionsCodec = zod_1.z.codec(schema_1.DbCheckoutOptions, models_1.CheckoutOptions, {
+    // An absent list is everywhere, so the column is null rather than a copy of every
+    // country. An empty list is neither, and stays representable on purpose: nothing writes
+    // one, and the session builder refuses to collect against it rather than asking the
+    // processor for an address form it would never render.
+    decode: (columns) => ({
+        shippingAllowedCountries: columns.shipping_allowed_countries === null
+            ? null
+            : splitList(columns.shipping_allowed_countries),
+        taxNumber: columns.tax_number_collect,
+    }),
+    encode: (options) => ({
+        shipping_allowed_countries: options.shippingAllowedCountries === null ? null : joinList(options.shippingAllowedCountries),
+        tax_number_collect: options.taxNumber,
+    }),
+});
+function splitList(stored) {
+    return stored.split(SEPARATOR).filter(Boolean);
+}
+function joinList(values) {
+    return [...new Set(values)].join(SEPARATOR);
+}
+exports.CollectionRow = zod_1.z.object({
+    product_id: zod_1.z.string(),
+    config_id: zod_1.z.string().nullable(),
+    shipping_allowed_countries: zod_1.z.string().nullable(),
+    tax_number_collect: boolean_1.DbBoolean.nullable(),
+    shipping_name_key: zod_1.z.string().nullable(),
+    shipping_name_collectable: zod_1.z.string().nullable(),
+    shipping_address_key: zod_1.z.string().nullable(),
+    shipping_address_collectable: zod_1.z.string().nullable(),
+    phone_key: zod_1.z.string().nullable(),
+    phone_collectable: zod_1.z.string().nullable(),
+});
+exports.collectionRowCodec = exports.CollectionRow.transform((row) => {
+    const collection = collectedInto(row);
+    return {
+        tierId: row.product_id,
+        configured: row.config_id !== null,
+        collection,
+        collecting: {
+            // Stripe collects the recipient's name and their address under one parameter, so it
+            // asks for both or neither. Archiving one of the two destinations is the publisher
+            // saying they no longer want that half: the step is still worth asking for while the
+            // other half can land, and whatever arrives for the archived one is dropped. Only
+            // archiving both leaves nothing worth asking for.
+            shipping: row.shipping_name_collectable === null && row.shipping_address_collectable === null
+                ? null
+                : collection.shipping,
+            taxNumber: collection.taxNumber,
+            phone: row.phone_collectable === null ? null : collection.phone,
+        },
+    };
+});
+exports.QuestionRow = zod_1.z.object({
+    product_id: zod_1.z.string(),
+    port: zod_1.z.string(),
+    label: schema_1.DbCheckoutQuestion.shape.label,
+    optional: schema_1.DbCheckoutQuestion.shape.optional,
+    question_name: zod_1.z.string().nullable(),
+    question_type: custom_field_types_1.FieldTypeSchema.nullable(),
+});
+exports.questionRowCodec = exports.QuestionRow.transform((row) => ({
+    tierId: row.product_id,
+    question: {
+        key: row.port,
+        label: row.label,
+        optional: row.optional,
+    },
+    askable: row.question_type === null
+        ? null
+        : { prompt: row.label ?? row.question_name ?? row.port, type: row.question_type },
+}));
+function collectedInto(row) {
+    const { shippingAllowedCountries, taxNumber } = zod_1.z.decode(exports.optionsCodec, {
+        shipping_allowed_countries: row.shipping_allowed_countries,
+        tax_number_collect: row.tax_number_collect ?? false,
+    });
+    return {
+        shipping: row.shipping_name_key !== null && row.shipping_address_key !== null
+            ? {
+                allowedCountries: shippingAllowedCountries,
+                nameCustomFieldKey: row.shipping_name_key,
+                addressCustomFieldKey: row.shipping_address_key,
+            }
+            : null,
+        taxNumber,
+        phone: row.phone_key === null ? null : { customFieldKey: row.phone_key },
+    };
+}

package/core/server/services/tier-checkout-config/index.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toCheckoutConfigResponse = exports.TierCheckoutConfig = exports.ShippingCollection = exports.ResolvedQuestion = exports.ResolvedCheckout = exports.PhoneCollection = exports.emptyCheckoutConfig = exports.CheckoutQuestion = exports.TierCheckoutConfigService = void 0;
+/**
+ * What a tier's checkout asks and collects.
+ *
+ * A domain of its own rather than part of the Tier aggregate: a tier is loaded into memory
+ * once at boot, and these rows are read live because deleting a custom field cascades a
+ * question away without that repository ever seeing it.
+ *
+ * Constructed by the tiers service wrapper at boot, which already holds the collaborators
+ * this needs, rather than by an init() here — the custom field services are built before
+ * it, so both are ready by the time it runs.
+ */
+var service_1 = require("./service");
+Object.defineProperty(exports, "TierCheckoutConfigService", { enumerable: true, get: function () { return service_1.TierCheckoutConfigService; } });
+var models_1 = require("./models");
+Object.defineProperty(exports, "CheckoutQuestion", { enumerable: true, get: function () { return models_1.CheckoutQuestion; } });
+Object.defineProperty(exports, "emptyCheckoutConfig", { enumerable: true, get: function () { return models_1.emptyCheckoutConfig; } });
+Object.defineProperty(exports, "PhoneCollection", { enumerable: true, get: function () { return models_1.PhoneCollection; } });
+Object.defineProperty(exports, "ResolvedCheckout", { enumerable: true, get: function () { return models_1.ResolvedCheckout; } });
+Object.defineProperty(exports, "ResolvedQuestion", { enumerable: true, get: function () { return models_1.ResolvedQuestion; } });
+Object.defineProperty(exports, "ShippingCollection", { enumerable: true, get: function () { return models_1.ShippingCollection; } });
+Object.defineProperty(exports, "TierCheckoutConfig", { enumerable: true, get: function () { return models_1.TierCheckoutConfig; } });
+var serializers_1 = require("./serializers");
+Object.defineProperty(exports, "toCheckoutConfigResponse", { enumerable: true, get: function () { return serializers_1.toCheckoutConfigResponse; } });

package/core/server/services/tier-checkout-config/models.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResolvedCheckout = exports.ResolvedQuestion = exports.CheckoutOptions = exports.emptyCheckoutConfig = exports.emptyCollection = exports.TierCheckoutConfig = exports.PhoneCollection = exports.ShippingCollection = exports.CheckoutQuestion = void 0;
+const zod_1 = require("zod");
+const custom_field_types_1 = require("@tryghost/custom-field-types");
+exports.CheckoutQuestion = zod_1.z.object({
+    key: zod_1.z.string(),
+    label: zod_1.z.string().nullable(),
+    optional: zod_1.z.boolean(),
+});
+/**
+ * One toggle and two destinations: a processor returns the recipient and the address
+ * under one parameter, but a publisher keeps a name and an address in different fields.
+ */
+exports.ShippingCollection = zod_1.z.object({
+    /**
+     * ISO 3166-1 alpha-2, or null for everywhere the processor ships.
+     *
+     * Null rather than a stored enumeration of every country, because that list moves: the
+     * day the processor adds one, a saved "everywhere" would silently be a restriction that
+     * excludes it, and nothing would say so.
+     */
+    allowedCountries: zod_1.z.array(zod_1.z.string()).nullable(),
+    nameCustomFieldKey: zod_1.z.string(),
+    addressCustomFieldKey: zod_1.z.string(),
+});
+exports.PhoneCollection = zod_1.z.object({
+    customFieldKey: zod_1.z.string(),
+});
+exports.TierCheckoutConfig = zod_1.z.object({
+    tierId: zod_1.z.string(),
+    customFields: zod_1.z.array(exports.CheckoutQuestion),
+    shipping: exports.ShippingCollection.nullable(),
+    /** Stripe keeps a tax number against the customer it invoices; Ghost never stores one. */
+    taxNumber: zod_1.z.boolean(),
+    phone: exports.PhoneCollection.nullable(),
+});
+const emptyCollection = () => ({
+    shipping: null,
+    taxNumber: false,
+    phone: null,
+});
+exports.emptyCollection = emptyCollection;
+const emptyCheckoutConfig = (tierId) => ({
+    tierId,
+    customFields: [],
+    ...(0, exports.emptyCollection)(),
+});
+exports.emptyCheckoutConfig = emptyCheckoutConfig;
+exports.CheckoutOptions = zod_1.z.object({
+    shippingAllowedCountries: zod_1.z.array(zod_1.z.string()).nullable(),
+    taxNumber: zod_1.z.boolean(),
+});
+exports.ResolvedQuestion = exports.CheckoutQuestion.extend({
+    prompt: zod_1.z.string(),
+    type: custom_field_types_1.FieldTypeSchema,
+});
+exports.ResolvedCheckout = zod_1.z.object({
+    customFields: zod_1.z.array(exports.ResolvedQuestion),
+    shipping: exports.ShippingCollection.nullable(),
+    taxNumber: zod_1.z.boolean(),
+    phone: exports.PhoneCollection.nullable(),
+});