ghost 6.61.0 → 6.62.0

package/core/server/services/members-custom-fields/definitions-service.js

@@ -8,6 +8,7 @@ const bson_objectid_1 = __importDefault(require("bson-objectid"));
 const errors_1 = __importDefault(require("@tryghost/errors"));
 const zod_1 = require("zod");
 const custom_field_types_1 = require("@tryghost/custom-field-types");
+const identity_1 = require("@tryghost/custom-field-types/identity");
 const codec_1 = require("./codec");
 const schema_1 = require("./schema");
 const queries_1 = require("./queries");
@@ -92,7 +93,29 @@ class CustomFieldDefinitionsService {
         // restart. Where the number comes from is the caller's business.
         this.getMaxDefinitions = getMaxDefinitions;
     }
+    async hasAnyActive() {
+        const [field] = await this.list((0, queries_1.activeFields)(this.knex).limit(1));
+        return Boolean(field);
+    }
+    /**
+     * The fields table has no namespace column: every row in it belongs to the publisher's
+     * `custom` namespace, so no other namespace can have a stored field.
+     */
+    isStored(namespace) {
+        return namespace === identity_1.CUSTOM_NAMESPACE;
+    }
+    assertDefinable(namespace) {
+        if (!this.isStored(namespace)) {
+            throw new errors_1.default.ValidationError({
+                message: `Fields cannot be defined in the "${namespace}" namespace.`,
+                property: 'namespace',
+            });
+        }
+    }
     async browse(options = {}) {
+        if (options.namespace !== undefined && !this.isStored(options.namespace)) {
+            return [];
+        }
         // Archived fields are hidden by default: most surfaces (member details, the
         // filter picker, the importer) only ever want active fields. A caller-
         // supplied `filter` can widen that — Settings pulls active and archived
@@ -115,8 +138,8 @@ class CustomFieldDefinitionsService {
         const rows = await (0, queries_1.inFieldOrder)(query).select('*');
         return rows.map((row) => zod_1.z.decode(codec_1.customFieldCodec, row));
     }
-    async read(key) {
-        const [field] = await this.list((0, queries_1.fieldByKey)(this.knex, key));
+    async read(namespace, key) {
+        const [field] = this.isStored(namespace) ? await this.list((0, queries_1.fieldByKey)(this.knex, key)) : [];
         if (!field) {
             throw new errors_1.default.NotFoundError({ message: 'Custom field not found.' });
         }
@@ -132,7 +155,8 @@ class CustomFieldDefinitionsService {
      * batch, so two items sharing a name are caught and two items deriving the same
      * key get distinct ones, exactly as if they had arrived as separate requests.
      */
-    async add(context, input) {
+    async add(context, namespace, input) {
+        this.assertDefinable(namespace);
         const requestedCount = Array.isArray(input) ? input.length : 0;
         const parsed = AddFieldsInput.safeParse(input);
         if (!parsed.success) {
@@ -310,7 +334,8 @@ class CustomFieldDefinitionsService {
      * fresh rank, so a move is well-defined even where every rank is still the default.
      * Returns every definition, archived included, matching what the request named.
      */
-    async reorder(context, input) {
+    async reorder(context, namespace, input) {
+        this.assertDefinable(namespace);
         const parsed = ReorderInput.safeParse(input);
         if (!parsed.success) {
             const issue = parsed.error.issues[0];
@@ -429,7 +454,10 @@ class CustomFieldDefinitionsService {
             });
         }
     }
-    async edit(context, key, input) {
+    async edit(context, namespace, key, input) {
+        if (!this.isStored(namespace)) {
+            throw new errors_1.default.NotFoundError({ message: 'Custom field not found.' });
+        }
         const parsed = EditFieldInput.safeParse(input);
         if (!parsed.success) {
             throw new errors_1.default.ValidationError({
@@ -438,7 +466,7 @@ class CustomFieldDefinitionsService {
             });
         }
         const patch = parsed.data;
-        const existing = await this.read(key);
+        const existing = await this.read(identity_1.CUSTOM_NAMESPACE, key);
         // Key and type are immutable after creation: values are addressed by key
         // and interpreted by type, so changing either would silently orphan or
         // corrupt stored values. Reject a differing value rather than ignore it.
@@ -492,7 +520,7 @@ class CustomFieldDefinitionsService {
                 details: { primary_name: patch.name ?? existing.name, key },
             });
         }
-        return this.read(key);
+        return this.read(identity_1.CUSTOM_NAMESPACE, key);
     }
     /**
      * Permanently delete a field and every member value attached to it (the FK
@@ -501,7 +529,10 @@ class CustomFieldDefinitionsService {
      * which makes accidental data loss a deliberate two-step. Archiving is the
      * reversible soft state (see `edit` with a status change).
      */
-    async destroy(context, key) {
+    async destroy(context, namespace, key) {
+        if (!this.isStored(namespace)) {
+            throw new errors_1.default.NotFoundError({ message: 'Custom field not found.' });
+        }
         const field = await this.knex(TABLE).where('key', key).first();
         if (!field) {
             throw new errors_1.default.NotFoundError({ message: 'Custom field not found.' });
@@ -581,6 +612,24 @@ function applyFilter(query, filter) {
     let mongoQuery;
     try {
         mongoQuery = nql(filter).toJSON();
+    }
+    catch (err) {
+        throw new errors_1.default.BadRequestError({
+            message: 'Could not parse the filter parameter.',
+            property: 'filter',
+            err: err,
+        });
+    }
+    // The table has no `namespace` column, so mongo-knex would compile this into SQL against a
+    // column that does not exist. Refuse it at the edge, naming the URL as the way to pick a
+    // namespace, rather than surface a database error.
+    if (filterReferencesAttribute(mongoQuery, 'namespace')) {
+        throw new errors_1.default.BadRequestError({
+            message: 'Filtering on namespace is not supported. Scope by the namespace route instead.',
+            property: 'filter',
+        });
+    }
+    try {
         knexify(query, mongoQuery, { tableName: TABLE });
     }
     catch (err) {
@@ -599,12 +648,15 @@ function applyFilter(query, filter) {
 // $and/$or/$nor combinators — so a status filter at any nesting counts as the
 // caller opting in to (or out of) archived fields.
 function filterReferencesStatus(query) {
+    return filterReferencesAttribute(query, 'status');
+}
+function filterReferencesAttribute(query, attribute) {
     return Object.entries(query).some(([key, value]) => {
-        if (key === 'status') {
+        if (key === attribute) {
             return true;
         }
         if ((key === '$and' || key === '$or' || key === '$nor') && Array.isArray(value)) {
-            return value.some((sub) => filterReferencesStatus(sub));
+            return value.some((sub) => filterReferencesAttribute(sub, attribute));
         }
         return false;
     });

package/core/server/services/members-custom-fields/filter.js

@@ -5,34 +5,27 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CUSTOM_FIELDS_RELATION = void 0;
 exports.createCustomFieldsFilterTransformer = createCustomFieldsFilterTransformer;
-// The members filter reaches custom field values through a `custom_fields` relation
-// on the Member model (the values table joined on member_id). A field is named by its
-// `key` — the stable public slug — and matched on its `value`; a composite field's
-// part is named as `value.<part>`, and a part's presence as `path.<part>`:
+// Translates the metafield clauses of a members filter into a query over the
+// values table. A metafield is a publisher-defined field on a member; it is
+// addressed as `namespace.key`, and a composite value such as an address names
+// one of its parts by appending it: `namespace.key.part`.
 //
-//   (custom_fields.key:'company'+custom_fields.value:'Ghost')               // value
-//   (custom_fields.key:'shipping_address'+custom_fields.value.country:'GB')
-//   custom_fields.key:'phone'  /  custom_fields.key:-'phone'                // field set / not set
-//   (custom_fields.key:'shipping_address'+custom_fields.path:'country')     // part set
-//   (custom_fields.key:'shipping_address'+custom_fields.path:-'country')    // part not set
+//   (metafields.key:'custom.company'+metafields.value:'Ghost')
+//   (metafields.key:'custom.shipping_address.country'+metafields.value:'GB')
+//   metafields.key:'custom.company'                     // has a value
+//   metafields.key:-'custom.shipping_address.country'   // that part is not set
 //
-// The values table stores one row per leaf: `custom_field_key` (the field's stable key),
-// `path` (empty for a scalar, the part's key for a composite), and `value_text`. A scalar
-// field is just a leaf at path ''; "the field", "a part", and "the whole field" are the
-// same thing — a set of leaf rows pinned by (custom_field_key, [path], [value]). So every
-// filter is one `$elemMatch` over those columns: positive asserts a matching leaf exists,
-// `$not` asserts none does. The public grammar is the storage vocabulary here — the key
-// sits on the row — so the transformer emits it straight, with no id lookup and no field
-// catalog read. That is what lets the Member model chain it inline on every members query,
-// rather than each call site remembering to wire it. A key that names no current field
-// matches no leaf; the admin never offers an archived or deleted field in the filter UI,
-// though the API leaves them queryable.
+// The values table holds one row per stored value: `custom_field_key`, `path`
+// (empty for a plain field, the part's name for one part of a composite) and
+// `value_text`. A filter addresses those columns directly, so each one becomes a
+// single $elemMatch over them — positive asserts a matching row exists, $not
+// asserts none does — with no lookup against the field definitions.
 const errors_1 = __importDefault(require("@tryghost/errors"));
-const RELATION = 'custom_fields';
+const identity_1 = require("@tryghost/custom-field-types/identity");
+const RELATION = 'metafields';
 const PREFIX = `${RELATION}.`;
 const KEY_ATTRIBUTE = `${PREFIX}key`;
 const VALUE_ATTRIBUTE = `${PREFIX}value`;
-const PATH_ATTRIBUTE = `${PREFIX}path`;
 const ROOT_PATH = '';
 // Only recurse into plain objects/arrays; a RegExp, Date, etc. is a leaf value that
 // must pass through by reference (recursing would strip a regex to `{}`).
@@ -42,8 +35,7 @@ function isPlainObject(value) {
         !Array.isArray(value) &&
         (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null));
 }
-// A single-clause object whose one key targets the custom_fields relation.
-function isCustomFieldClause(node) {
+function isMetafieldClause(node) {
     if (!isPlainObject(node)) {
         return false;
     }
@@ -57,100 +49,94 @@ function isCustomFieldClause(node) {
 // `key:'a'+key:'b'`, since a bare key clause needs no group of its own. That is two
 // filters — a member with a value for both — not one leaf that is somehow both fields, so
 // it has to fall through and be transformed a clause at a time.
-function isCustomFieldCompound(clauses) {
-    if (!Array.isArray(clauses) || clauses.length < 2 || !clauses.every(isCustomFieldClause)) {
+function isMetafieldCompound(clauses) {
+    if (!Array.isArray(clauses) || clauses.length < 2 || !clauses.every(isMetafieldClause)) {
         return false;
     }
     return clauses.filter((clause) => Object.keys(clause)[0] === KEY_ATTRIBUTE).length === 1;
 }
-// `custom_fields.value` addresses the scalar (root) leaf; `custom_fields.value.<part>`
-// a composite's part. Returns the row `path` the attribute selects, or null if the
-// attribute isn't a value clause.
-function pathForValueAttribute(attribute) {
-    if (attribute === VALUE_ATTRIBUTE) {
-        return ROOT_PATH;
-    }
-    if (attribute.startsWith(`${VALUE_ATTRIBUTE}.`)) {
-        return attribute.slice(`${VALUE_ATTRIBUTE}.`.length);
-    }
-    return null;
-}
-// The single `{$ne}` shape all negations arrive as (is-not-set on a key or part).
+// NQL compiles every negation in this grammar to `{$ne: <string>}`, so a negated clause
+// can arrive in no other shape.
 function negatedString(value) {
     return isPlainObject(value) && typeof value.$ne === 'string' ? value.$ne : null;
 }
+const ANY_PATH = null;
+// A stored key never contains a dot, so a full dotted identity is a key no stored
+// row can equal.
+function unmatchableLeaf(identity) {
+    return { key: (0, identity_1.formatIdentity)(identity), path: identity.partPath };
+}
+function parseLeafAddress(raw) {
+    const identity = typeof raw === 'string' ? (0, identity_1.parseIdentity)(raw) : null;
+    if (!identity) {
+        throw new errors_1.default.BadRequestError({
+            message: `A metafield filter names a field as namespace.key, for example (${KEY_ATTRIBUTE}:'custom.company'+${VALUE_ATTRIBUTE}:'Ghost').`,
+        });
+    }
+    if (identity.namespace !== identity_1.CUSTOM_NAMESPACE) {
+        return unmatchableLeaf(identity);
+    }
+    return { key: identity.key, path: identity.partPath };
+}
 function createCustomFieldsFilterTransformer() {
-    // The grammar carries the field key in the clause value; take it as a string,
-    // defaulting to one no field can hold so a malformed clause matches nothing.
-    const keyOf = (value) => (typeof value === 'string' ? value : '');
     // One (maybe-negated) $elemMatch over the leaf columns: positive is "a leaf pinned
     // by these matches", `$not` is "no leaf does".
-    function buildElemMatch(fieldKey, conditions, negate) {
-        const match = { custom_field_key: fieldKey, ...conditions };
+    function buildElemMatch(target, value, negate) {
+        const match = { custom_field_key: target.key };
+        if (value !== undefined) {
+            match.path = target.path ?? ROOT_PATH;
+            match.value_text = value;
+        }
+        else if (target.path !== ANY_PATH) {
+            match.path = target.path;
+        }
         if (negate) {
             return { [RELATION]: { $not: { $elemMatch: match } } };
         }
         return { [RELATION]: { $elemMatch: match } };
     }
-    // A `(key + value[.part] | path)` compound. A `value` clause pins the part and its
-    // value; a `path` clause pins the part's presence (no value), and a negated path is
-    // is-not-set — no such leaf — which negates the whole match.
     function toElemMatch(clauses) {
-        let fieldKey = '';
-        let hasKey = false;
-        let hasLeaf = false;
-        const conditions = {};
-        let negate = false;
-        const oneLeafOnly = () => {
-            if (hasLeaf) {
-                throw new errors_1.default.BadRequestError({
-                    message: 'A custom field filter takes one value or path clause.',
-                });
-            }
-            hasLeaf = true;
-        };
+        let target;
+        let value;
+        let hasValue = false;
         for (const clause of clauses) {
-            const [attribute, value] = Object.entries(clause)[0];
+            const [attribute, clauseValue] = Object.entries(clause)[0];
             if (attribute === KEY_ATTRIBUTE) {
-                if (hasKey) {
+                if (negatedString(clauseValue) !== null) {
                     throw new errors_1.default.BadRequestError({
-                        message: `A custom field filter takes one "${KEY_ATTRIBUTE}" clause.`,
+                        message: `A negated "${KEY_ATTRIBUTE}" stands alone; it cannot be grouped with a value.`,
                     });
                 }
-                hasKey = true;
-                fieldKey = keyOf(value);
-            }
-            else if (attribute === PATH_ATTRIBUTE) {
-                oneLeafOnly();
-                const negatedPath = negatedString(value);
-                conditions.path = negatedPath ?? value;
-                negate = negatedPath !== null;
+                target = parseLeafAddress(clauseValue);
             }
-            else {
-                const path = pathForValueAttribute(attribute);
-                if (path === null) {
-                    // Not the key, a value/value.<part>, or a path: it names no leaf
-                    // column, so dropping it would silently widen the match to the key
-                    // alone. Fail closed instead.
+            else if (attribute === VALUE_ATTRIBUTE) {
+                if (hasValue) {
                     throw new errors_1.default.BadRequestError({
-                        message: `Unsupported custom field filter clause "${attribute}".`,
+                        message: `A metafield filter takes one "${VALUE_ATTRIBUTE}" clause.`,
                     });
                 }
-                oneLeafOnly();
-                conditions.path = path;
-                conditions.value_text = value;
+                hasValue = true;
+                value = clauseValue;
             }
+            else {
+                throw new errors_1.default.BadRequestError({
+                    message: `Unsupported metafield filter clause "${attribute}".`,
+                });
+            }
+        }
+        if (!target) {
+            throw new errors_1.default.BadRequestError({
+                message: `A metafield filter needs a "${KEY_ATTRIBUTE}" clause.`,
+            });
         }
-        return buildElemMatch(fieldKey, conditions, negate);
+        return buildElemMatch(target, hasValue ? value : undefined, false);
     }
-    // A standalone `key` clause is whole-field is-set / is-not-set: a leaf for this
-    // field exists (any part), or none does.
     function fromKeyClause(value) {
         const negatedKey = negatedString(value);
         if (negatedKey !== null) {
-            return buildElemMatch(keyOf(negatedKey), {}, true);
+            return buildElemMatch(parseLeafAddress(negatedKey), undefined, true);
         }
-        return buildElemMatch(keyOf(value), {}, false);
+        return buildElemMatch(parseLeafAddress(value), undefined, false);
     }
     function transform(node) {
         if (Array.isArray(node)) {
@@ -159,7 +145,7 @@ function createCustomFieldsFilterTransformer() {
         if (!isPlainObject(node)) {
             return node;
         }
-        if (isCustomFieldCompound(node.$and)) {
+        if (isMetafieldCompound(node.$and)) {
             return toElemMatch(node.$and);
         }
         const out = {};
@@ -168,12 +154,8 @@ function createCustomFieldsFilterTransformer() {
                 Object.assign(out, fromKeyClause(value));
             }
             else if (key.startsWith(PREFIX)) {
-                // A value or path clause only means something paired with its key in one
-                // leaf, which arrives as the compound handled above. A `custom_fields.*`
-                // clause reaching here is unpaired (or its pair was not grouped), so fail
-                // closed rather than pass it to mongo-knex as a column that does not exist.
                 throw new errors_1.default.BadRequestError({
-                    message: `A "${key}" filter must be grouped with its "${KEY_ATTRIBUTE}" clause, for example (${KEY_ATTRIBUTE}:'a_field'+${VALUE_ATTRIBUTE}:'a value').`,
+                    message: `A "${key}" filter must be grouped with its "${KEY_ATTRIBUTE}" clause, for example (${KEY_ATTRIBUTE}:'custom.a_field'+${VALUE_ATTRIBUTE}:'a value').`,
                 });
             }
             else {
@@ -189,7 +171,7 @@ function createCustomFieldsFilterTransformer() {
  * rows (one per field, or per part of a composite field), and a predicate asks whether
  * one of them matches, so this joins the values table on member_id and mongo-knex emits
  * it as a correlated `members.id IN (…)` subquery — composing with every other member
- * filter. Registered only behind the `membersCustomFields` flag.
+ * filter.
  */
 exports.CUSTOM_FIELDS_RELATION = {
     tableName: 'members_custom_field_values',

package/core/server/services/members-custom-fields/key.js

@@ -2,11 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.KEY_CHARACTERS = void 0;
 exports.mintableKey = mintableKey;
+const identity_1 = require("@tryghost/custom-field-types/identity");
 // Neither package ships types.
 const { stripInvisibleChars } = require('@tryghost/string');
 const unidecode = require('unidecode');
 /** Every character a key may contain. Nothing else survives minting. */
-exports.KEY_CHARACTERS = /^[a-z0-9_]+$/;
+exports.KEY_CHARACTERS = identity_1.IDENTITY_SEGMENT;
 /**
  * Mint the key a field is addressed by, from the name a publisher chose.
  *

package/core/server/services/members-custom-fields/models.js

@@ -4,9 +4,9 @@ exports.CustomField = void 0;
 const zod_1 = require("zod");
 const custom_field_types_1 = require("@tryghost/custom-field-types");
 const schema_1 = require("./schema");
-// The domain shape of a field definition (camelCase; distinct from the DB row).
 exports.CustomField = zod_1.z.object({
     id: zod_1.z.string(),
+    namespace: zod_1.z.string(),
     key: zod_1.z.string(),
     name: zod_1.z.string(),
     type: custom_field_types_1.FieldTypeSchema,

package/core/server/services/members-custom-fields/serializers.js

@@ -4,10 +4,8 @@ exports.toCustomFieldsResponse = void 0;
 const zod_1 = require("zod");
 const case_keys_1 = require("../../lib/case-keys");
 const models_1 = require("./models");
-// Response schema — the field-definition shape the admin endpoints emit. `id` is
-// the DB primary key and deliberately never leaves the API; a field is addressed
-// by its immutable `key`. The `.pipe` below strips id from the mapped output.
 const CustomFieldResource = zod_1.z.object({
+    namespace: zod_1.z.string(),
     key: zod_1.z.string(),
     name: zod_1.z.string(),
     type: zod_1.z.string(),
@@ -15,10 +13,10 @@ const CustomFieldResource = zod_1.z.object({
     created_at: zod_1.z.date(),
     updated_at: zod_1.z.date().nullable(),
 });
-const CustomFieldsResponse = zod_1.z.object({ members_custom_fields: zod_1.z.array(CustomFieldResource) });
+const CustomFieldsResponse = zod_1.z.object({ members_metafields: zod_1.z.array(CustomFieldResource) });
 exports.toCustomFieldsResponse = zod_1.z
     .array(models_1.CustomField)
     .transform((fields) => ({
-    members_custom_fields: fields.map((field) => (0, case_keys_1.snakeKeys)(field)),
+    members_metafields: fields.map((field) => (0, case_keys_1.snakeKeys)(field)),
 }))
     .pipe(CustomFieldsResponse);

package/core/server/services/members-custom-fields/values-service.js

@@ -9,6 +9,7 @@ const errors_1 = __importDefault(require("@tryghost/errors"));
 const logging_1 = __importDefault(require("@tryghost/logging"));
 const zod_1 = require("zod");
 const custom_field_types_1 = require("@tryghost/custom-field-types");
+const identity_1 = require("@tryghost/custom-field-types/identity");
 const schema_1 = require("./schema");
 const queries_1 = require("./queries");
 const storage_1 = require("./storage");
@@ -29,9 +30,9 @@ const MAX_KEY_LENGTH = require('../../data/schema').tables[FIELDS_TABLE].key.max
  * go when that lands; until then the alternative is hand-written upsert SQL per engine.
  */
 const UPSERT_CHUNK = 400;
-// Values stay `unknown`: each is validated by its own field type, which is not known
-// until the key is resolved to a definition.
-const ValuesInput = zod_1.z.record(zod_1.z.string().max(MAX_KEY_LENGTH), zod_1.z.unknown());
+const MAX_IDENTITY_LENGTH = MAX_KEY_LENGTH * 2 + 1;
+const ValuesInput = zod_1.z.record(zod_1.z.string().max(MAX_IDENTITY_LENGTH), zod_1.z.unknown());
+const wireProperty = (identity) => [identity_1.QUALIFIER, identity].join('.');
 /**
  * What a member holds for each defined field. Separate from the definitions service
  * because a value belongs to the member and a definition belongs to the site's settings,
@@ -45,22 +46,22 @@ class CustomFieldValuesService {
         this.knex = knex;
         this.getMaxDefinitions = getMaxDefinitions;
     }
-    async activeFieldsByKey(keys) {
+    async activeFieldsByIdentity(identities) {
+        const keys = identities
+            .map((identity) => (0, identity_1.parseIdentity)(identity))
+            .filter((parsed) => parsed !== null && parsed.namespace === identity_1.CUSTOM_NAMESPACE)
+            .map((parsed) => parsed.key);
         if (keys.length === 0) {
             return new Map();
         }
         const fields = await (0, queries_1.activeFields)(this.knex)
             .whereIn('key', keys)
             .select('id', 'key', 'name', 'type');
-        return new Map(fields.map((field) => [field.key, field]));
+        return new Map(fields.map((field) => [
+            (0, identity_1.formatIdentity)({ namespace: identity_1.CUSTOM_NAMESPACE, key: field.key, partPath: null }),
+            { ...field, namespace: identity_1.CUSTOM_NAMESPACE },
+        ]));
     }
-    /**
-     * Members' values, keyed by member id then field key; anything absent is unset.
-     *
-     * Archived fields are excluded to match the definitions browse: their values stay in
-     * the database and stop being addressable. A row that will not parse is dropped and
-     * logged rather than failing the read, so one stale row cannot take down a member.
-     */
     async getValuesForMembers(memberIds) {
         if (memberIds.length === 0) {
             return new Map();
@@ -88,19 +89,43 @@ class CustomFieldValuesService {
                 }, 'Skipping an unreadable custom field value');
             }
         }
-        return (0, storage_1.valuesFromLeaves)(leaves);
+        const flat = (0, storage_1.valuesFromLeaves)(leaves);
+        return new Map(memberIds.map((memberId) => [memberId, { [identity_1.CUSTOM_NAMESPACE]: flat.get(memberId) ?? {} }]));
     }
-    /** Shared by every caller so they cannot disagree on what a values object is. */
     parseValues(input) {
         const parsed = ValuesInput.safeParse(input);
         if (!parsed.success) {
             throw new errors_1.default.ValidationError({
-                message: 'Custom field values must be an object keyed by field key.',
-                property: 'custom_fields',
+                message: 'Custom field values must be an object keyed by field identity.',
+                property: identity_1.QUALIFIER,
             });
         }
         return parsed.data;
     }
+    unwrapWire(input) {
+        if (input === undefined) {
+            return undefined;
+        }
+        if (typeof input !== 'object' || input === null || Array.isArray(input)) {
+            throw new errors_1.default.ValidationError({
+                message: 'Metafields must be an object keyed by namespace.',
+                property: identity_1.QUALIFIER,
+            });
+        }
+        const identified = {};
+        for (const [namespace, values] of Object.entries(input)) {
+            if (typeof values !== 'object' || values === null || Array.isArray(values)) {
+                throw new errors_1.default.ValidationError({
+                    message: 'Metafield values must be an object keyed by field key.',
+                    property: [identity_1.QUALIFIER, namespace].join('.'),
+                });
+            }
+            for (const [key, raw] of Object.entries(values)) {
+                identified[`${namespace}.${key}`] = raw;
+            }
+        }
+        return identified;
+    }
     /**
      * Whether input names any values. Asks the shape question alone, with no catalog
      * lookup, so it can be asked before a write is known to be permitted.
@@ -118,27 +143,24 @@ class CustomFieldValuesService {
      */
     async planWrite(input) {
         const values = this.parseValues(input);
-        const keys = Object.keys(values);
+        const identities = Object.keys(values);
         // Bounded by the definitions ceiling, which also holds the lookup below inside
         // the driver's bound-parameter limit.
         const maxKeys = this.getMaxDefinitions();
-        if (keys.length > maxKeys) {
+        if (identities.length > maxKeys) {
             throw new errors_1.default.ValidationError({
                 message: `Custom field values are limited to ${maxKeys} fields per request.`,
-                property: 'custom_fields',
+                property: identity_1.QUALIFIER,
             });
         }
-        const byKey = await this.activeFieldsByKey(keys);
+        const byIdentity = await this.activeFieldsByIdentity(identities);
         const writes = [];
-        for (const [key, raw] of Object.entries(values)) {
-            const field = byKey.get(key);
+        for (const [identity, raw] of Object.entries(values)) {
+            const field = byIdentity.get(identity);
             if (!field) {
-                // Unknown or archived. Refused rather than ignored: a typo that silently
-                // drops what somebody typed is worse than a save that fails. The catalog
-                // applies the same rule to the parts of a composite value.
                 throw new errors_1.default.ValidationError({
-                    message: `Unknown custom field: ${key}`,
-                    property: `custom_fields.${key}`,
+                    message: `Unknown custom field: ${identity}`,
+                    property: wireProperty(identity),
                 });
             }
             // `null` clears any field, and `''` clears one with no parts. For a value
@@ -157,7 +179,7 @@ class CustomFieldValuesService {
                 const issue = value.error.issues[0];
                 throw new errors_1.default.ValidationError({
                     message: issue.message,
-                    property: [`custom_fields.${key}`, ...issue.path].join('.'),
+                    property: [wireProperty(identity), ...issue.path].join('.'),
                 });
             }
             writes.push({ field, value: value.data });