ghost 6.61.0 → 6.62.0

package/core/server/services/mentions/mention-controller.js

@@ -1,4 +1,5 @@
 const logging = require('@tryghost/logging');
+const ProcessWebmentionJob = require('./process-webmention-job').default;
 
 /**
  * @typedef {import('./mentions-api')} MentionsAPI
@@ -22,11 +23,6 @@ const logging = require('@tryghost/logging');
  * @prop {Resource} resource
  */
 
-/**
- * @typedef {object} IJobService
- * @prop {(name: string, fn: Function) => void} addJob
- */
-
 /**
  * @typedef {object} IMentionResourceService
  * @prop {(id: import('bson-objectid').default)  => Promise<MentionResource>} getByID
@@ -36,8 +32,8 @@ module.exports = class MentionController {
   /** @type {import('./mentions-api')} */
   #api;
 
-  /** @type {IJobService} */
-  #jobService;
+  /** @type {import('../jobs-service/jobs-service').JobsService} */
+  #jobsService;
 
   /** @type {IMentionResourceService} */
   #mentionResourceService;
@@ -45,12 +41,12 @@ module.exports = class MentionController {
   /**
    * @param {object} deps
    * @param {import('./mentions-api')} deps.api
-   * @param {IJobService} deps.jobService
+   * @param {import('../jobs-service/jobs-service').JobsService} deps.jobsService
    * @param {IMentionResourceService} deps.mentionResourceService
    */
   async init(deps) {
     this.#api = deps.api;
-    this.#jobService = deps.jobService;
+    this.#jobsService = deps.jobsService;
     this.#mentionResourceService = deps.mentionResourceService;
   }
 
@@ -127,17 +123,23 @@ module.exports = class MentionController {
    */
   async receive(frame) {
     logging.info('[Webmention] ' + JSON.stringify(frame.data));
-    this.#jobService.addJob('processWebmention', async () => {
-      const { source, target, ...payload } = frame.data;
-      try {
-        await this.#api.processWebmention({
-          source: new URL(source),
-          target: new URL(target),
-          payload,
-        });
-      } catch (err) {
-        logging.error(err, '[Webmention] Failed processing webmention');
-      }
-    });
+    const { source, target, ...payload } = frame.data;
+    await this.#jobsService.dispatch(new ProcessWebmentionJob({ source, target, payload }));
+  }
+
+  /**
+   * @param {import('./process-webmention-job').default} job
+   * @returns {Promise<void>}
+   */
+  async processWebmention({ source, target, payload }) {
+    try {
+      await this.#api.processWebmention({
+        source: new URL(source),
+        target: new URL(target),
+        payload,
+      });
+    } catch (err) {
+      logging.error(err, '[Webmention] Failed processing webmention');
+    }
   }
 };

package/core/server/services/mentions/process-webmention-job.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const job_1 = require("../jobs-service/job");
+class ProcessWebmentionJob extends job_1.Job {
+    static type = 'process-webmention';
+    source;
+    target;
+    payload;
+    constructor({ source, target, payload, }) {
+        super();
+        this.source = source;
+        this.target = target;
+        this.payload = payload;
+    }
+}
+exports.default = ProcessWebmentionJob;

package/core/server/services/mentions/service.js

@@ -15,7 +15,7 @@ const urlService = require('../url');
 const settingsCache = require('../../../shared/settings-cache');
 const DomainEvents = require('@tryghost/domain-events');
 const logging = require('@tryghost/logging');
-const jobsService = require('../mentions-jobs');
+const mentionsJobService = require('../mentions-jobs');
 
 // Serializes a post model to the data the URL service needs, loading the
 // relations it reads for filtered collections (event-emitted models don't
@@ -45,7 +45,7 @@ function makeLoggingJobService() {
   return {
     async addJob(name, fn) {
       logging.info(`[Background Job] ${name} queued`);
-      jobsService.addJob({
+      mentionsJobService.addJob({
         name,
         job: async () => {
           const startedAt = Date.now();
@@ -75,7 +75,11 @@ module.exports = {
   /** @type {import('./mention-sending-service')} */
   sendingService: null,
   didInit: false,
-  async init() {
+  /**
+   * @param {object} deps
+   * @param {import('../jobs-service/jobs-service').JobsService} deps.jobsService
+   */
+  async init({ jobsService }) {
     if (this.didInit) {
       return;
     }
@@ -110,7 +114,7 @@ module.exports = {
 
     this.controller.init({
       api,
-      jobService: makeLoggingJobService(),
+      jobsService,
       mentionResourceService: {
         async getByID(id) {
           if (!id) {

package/core/server/services/route-settings/validation-errors.js

@@ -14,7 +14,7 @@ const tpl_1 = __importDefault(require("@tryghost/tpl"));
 const messages = {
     validationError: 'The following definition "{at}" is invalid: {reason}',
 };
-const DOCS_URL = 'https://ghost.org/docs/themes/routing/';
+const DOCS_URL = 'https://docs.ghost.org/themes/routing/';
 const MAX_SHOWN_LENGTH = 40;
 /**
  * Stable, machine-readable codes describing the class of a routes.yaml failure.

package/core/server/services/route-settings/yaml-parser.js

@@ -9,7 +9,7 @@ const messages = {
   },
   invalidYamlFormat: {
     message: 'YAML input cannot be a plain string. Check the format of your YAML file.',
-    help: 'https://ghost.org/docs/themes/routing/',
+    help: 'https://docs.ghost.org/themes/routing/',
   },
 };
 

package/core/server/services/settings/settings-service.js

@@ -200,14 +200,7 @@ module.exports = {
         type: 'boolean',
         group: 'members',
         fn: settingsHelpers.allowSelfSignup.bind(settingsHelpers),
-        dependents: [
-          'members_signup_access',
-          'portal_plans',
-          'stripe_secret_key',
-          'stripe_publishable_key',
-          'stripe_connect_secret_key',
-          'stripe_connect_publishable_key',
-        ],
+        dependents: ['members_signup_access'],
       }),
     );
     fields.push(

package/core/server/services/settings-helpers/settings-helpers.js

@@ -1,7 +1,7 @@
 const net = require('net');
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
-const EmailAddressParser = require('../email-address/email-address-parser');
+const emailAddressParser = require('../email-address/email-address-parser');
 const logging = require('@tryghost/logging');
 const crypto = require('crypto');
 const debug = require('@tryghost/debug')('services:settings-helpers');
@@ -130,11 +130,9 @@ class SettingsHelpers {
     if (!supportAddress) {
       // In the new flow, we make a difference between an empty setting (= use default) and a 'noreply' setting (=use noreply @ domain)
       // Also keep the name of the default email!
-      return EmailAddressParser.stringify(this.getDefaultEmail());
+      return emailAddressParser.stringify(this.getDefaultEmail());
     }
 
-    supportAddress = supportAddress || 'noreply';
-
     // Any fromAddress without domain uses site domain, like default setting `noreply`
     if (supportAddress.indexOf('@') < 0) {
       return `${supportAddress}@${this.getDefaultEmailDomain()}`;
@@ -143,7 +141,7 @@ class SettingsHelpers {
   }
 
   /**
-   * @deprecated Use getDefaultEmail().address (without name) or EmailAddressParser.stringify(this.getDefaultEmail()) (with name) instead
+   * @deprecated Use getDefaultEmail().address (without name) or emailAddressParser.stringify(this.getDefaultEmail()) (with name) instead
    */
   getNoReplyAddress() {
     return this.getDefaultEmailAddress();
@@ -157,7 +155,7 @@ class SettingsHelpers {
     // parse the email here and remove the sender name
     // E.g. when set to "bar" <from@default.com>
     const configAddress = this.config.get('mail:from');
-    const parsed = EmailAddressParser.parse(configAddress);
+    const parsed = emailAddressParser.parse(configAddress);
     if (parsed) {
       return parsed;
     }

package/core/server/services/slack-ping/slack-ping-service.js

@@ -173,7 +173,7 @@ class SlackPingService {
                 this.logging.error(new errors_1.default.InternalServerError({
                     err: err,
                     context: (0, tpl_1.default)(constants_1.messages.requestFailedError, { service: 'slack' }),
-                    help: (0, tpl_1.default)(constants_1.messages.requestFailedHelp, { url: 'https://ghost.org/docs/' }),
+                    help: (0, tpl_1.default)(constants_1.messages.requestFailedHelp, { url: 'https://docs.ghost.org/' }),
                 }));
             });
         }

package/core/server/services/staff/staff-service-emails.js

@@ -2,7 +2,7 @@ const { promises: fs, readFileSync } = require('fs');
 const path = require('path');
 const moment = require('moment');
 const { globSync } = require('glob');
-const EmailAddressParser = require('../email-address/email-address-parser');
+const emailAddressParser = require('../email-address/email-address-parser');
 
 class StaffServiceEmails {
   constructor({
@@ -593,7 +593,7 @@ class StaffServiceEmails {
   }
 
   get fromEmailAddress() {
-    return EmailAddressParser.stringify(this.settingsHelpers.getDefaultEmail());
+    return emailAddressParser.stringify(this.settingsHelpers.getDefaultEmail());
   }
 
   extractInitials(name = '') {

package/core/server/services/stripe/config.js

@@ -4,7 +4,7 @@ const labs = require('../../../shared/labs');
 
 const messages = {
   remoteWebhooksInDevelopment:
-    'Cannot use remote webhooks in development. See https://ghost.org/docs/webhooks/#stripe-webhooks for developing with Stripe.',
+    'Cannot use remote webhooks in development. See https://docs.ghost.org/webhooks/#stripe-webhooks for developing with Stripe.',
 };
 
 // @TODO Refactor to a class w/ constructor
@@ -62,16 +62,19 @@ module.exports = {
     }
 
     const env = config.get('env');
-    let webhookSecret = process.env.WEBHOOK_SECRET;
+    const remoteWebhooks = env !== 'production' && config.get('stripeRemoteWebhooks') === true;
+    let webhookSecret = remoteWebhooks ? undefined : process.env.WEBHOOK_SECRET;
 
-    if (env !== 'production') {
-      if (!webhookSecret) {
-        webhookSecret = 'DEFAULT_WEBHOOK_SECRET';
-        logging.warn(tpl(messages.remoteWebhooksInDevelopment));
-      }
+    if (env !== 'production' && !remoteWebhooks && !webhookSecret) {
+      webhookSecret = 'DEFAULT_WEBHOOK_SECRET';
+      logging.warn(tpl(messages.remoteWebhooksInDevelopment));
     }
 
-    const webhookHandlerUrl = new URL('members/webhooks/stripe/', urlUtils.getSiteUrl());
+    // Development can tunnel the webhook URL alone while the site stays on localhost.
+    const webhookHandlerUrl = new URL(
+      config.get('stripeWebhookUrl') || 'members/webhooks/stripe/',
+      urlUtils.getSiteUrl(),
+    );
     const webhookCustomerIgnoreList = parseIgnoreCustomerList(
       config.get('stripeWebhookCustomerIgnoreList'),
     );
@@ -88,6 +91,9 @@ module.exports = {
       },
       webhookSecret: webhookSecret,
       webhookHandlerUrl: webhookHandlerUrl.href,
+      // A development registration points at a tunnel that closes with the process,
+      // so it is removed on shutdown rather than kept for the next boot.
+      ephemeralWebhook: remoteWebhooks,
       webhookCustomerIgnoreList,
       siteUrl,
     };

package/core/server/services/stripe/service.js

@@ -14,6 +14,12 @@ const giftService = require('../gifts');
 const staffService = require('../staff');
 const labs = require('../../../shared/labs');
 const settingsCache = require('../../../shared/settings-cache');
+const tpl = require('@tryghost/tpl');
+
+const messages = {
+  remoteWebhooksWithoutStripe:
+    'stripeRemoteWebhooks is set but Stripe is not connected, so no webhook endpoint was registered. Connect Stripe in Ghost Admin under Settings, then restart.',
+};
 
 async function configureApi() {
   const cfg = getConfig({ settingsHelpers, config, urlUtils });
@@ -84,7 +90,10 @@ function stripeSettingsChanged(model) {
 
 module.exports.init = async function init() {
   try {
-    await configureApi();
+    const configured = await configureApi();
+    if (!configured && config.get('stripeRemoteWebhooks') === true) {
+      logging.warn(tpl(messages.remoteWebhooksWithoutStripe));
+    }
   } catch (err) {
     logging.error(err);
   }

package/core/server/services/stripe/services/checkout/completed-session.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.collectedByPort = exports.CompletedSession = void 0;
 const zod_1 = require("zod");
-const field_ports_1 = require("./field-ports");
+const checkout_1 = require("@tryghost/checkout");
 /**
  * What Ghost reads off a completed session.
  *
@@ -63,6 +63,6 @@ exports.collectedByPort = exports.CompletedSession.transform((session) => {
     const answers = (session.custom_fields ?? [])
         .filter((field) => Boolean(field?.key && field.text?.value))
         .map((field) => ({ port: field.key, value: field.text.value }));
-    const ports = field_ports_1.STRIPE_PORTS.map((port) => ({ port, value: PORT_VALUES[port](session) })).filter((entry) => entry.value !== undefined);
+    const ports = checkout_1.STRIPE_PORTS.map((port) => ({ port, value: PORT_VALUES[port](session) })).filter((entry) => entry.value !== undefined);
     return [...answers, ...ports];
 });

package/core/server/services/stripe/services/checkout/session-options.js

@@ -5,13 +5,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.stripeCheckoutCollectionOptions = stripeCheckoutCollectionOptions;
 const logging_1 = __importDefault(require("@tryghost/logging"));
-const field_ports_1 = require("./field-ports");
+const checkout_1 = require("@tryghost/checkout");
 /** Keyed on the eligible types, so this and the configure-time rule cannot drift apart. */
 const QUESTION_TYPES = {
     short_text: 'text',
 };
 function askable(question) {
-    if (!(0, field_ports_1.isCheckoutEligible)(question.type)) {
+    if (!(0, checkout_1.isCheckoutEligible)(question.type)) {
         logging_1.default.warn({
             event: { name: 'stripe.checkout.question_skipped' },
             customFieldKey: question.key,
@@ -20,7 +20,7 @@ function askable(question) {
         }, 'Skipping a Stripe checkout question');
         return false;
     }
-    if (question.prompt.length > field_ports_1.MAX_CHECKOUT_LABEL_LENGTH) {
+    if (question.prompt.length > checkout_1.MAX_CHECKOUT_LABEL_LENGTH) {
         logging_1.default.warn({
             event: { name: 'stripe.checkout.question_skipped' },
             customFieldKey: question.key,
@@ -43,7 +43,7 @@ function stripeCheckoutCollectionOptions(checkout) {
         return options;
     }
     const eligible = checkout.customFields.filter(askable);
-    const questions = eligible.slice(0, field_ports_1.MAX_CHECKOUT_CUSTOM_FIELDS);
+    const questions = eligible.slice(0, checkout_1.MAX_CHECKOUT_CUSTOM_FIELDS);
     if (questions.length < eligible.length) {
         logging_1.default.warn({
             event: { name: 'stripe.checkout.questions_trimmed' },
@@ -64,15 +64,20 @@ function stripeCheckoutCollectionOptions(checkout) {
         }));
     }
     if (checkout.shipping) {
-        // The country list is what makes this reach Stripe at all. An empty
-        // `shipping_address_collection` form-encodes to nothing, so a request built that
-        // way carries no parameter and Stripe accepts it precisely because it was never
-        // asked to collect anything — which reads as success and collects no addresses.
+        // Ghost stores "everywhere" as no list, because the set of countries moves and a
+        // stored copy of it would quietly become a restriction. Stripe has no such sentinel:
+        // `allowed_countries` is the only key `shipping_address_collection` has, so a request
+        // that omits it carries no parameter at all, and Stripe accepts it precisely because
+        // it was never asked to collect anything — a session that succeeds and collects no
+        // address. So everywhere is expanded to every country here, at the one point that
+        // builds the request.
         //
-        // Defended again here rather than trusted from the settings screen: this is the
-        // checkout path, and a malformed configuration must cost the collection rather than
-        // throw inside a session build.
-        if (checkout.shipping.allowedCountries.length === 0) {
+        // An empty list is neither everywhere nor a real restriction, and would encode to the
+        // same absent parameter. Defended here rather than trusted from the settings screen:
+        // this is the checkout path, and a malformed configuration must cost the collection
+        // rather than throw inside a session build.
+        const allowedCountries = checkout.shipping.allowedCountries ?? [...checkout_1.STRIPE_ALLOWED_COUNTRIES];
+        if (allowedCountries.length === 0) {
             logging_1.default.warn({
                 event: { name: 'stripe.checkout.collection_skipped' },
                 port: 'shipping_address',
@@ -80,9 +85,7 @@ function stripeCheckoutCollectionOptions(checkout) {
             }, 'Skipping a Stripe checkout collection');
         }
         else {
-            options.shipping_address_collection = {
-                allowed_countries: checkout.shipping.allowedCountries,
-            };
+            options.shipping_address_collection = { allowed_countries: allowedCountries };
         }
     }
     // Unioned with whatever automatic tax asks for. Both want the same thing, so a site

package/core/server/services/stripe/services/webhook/checkout-session-event-service.js

@@ -1,7 +1,10 @@
 const _ = require('lodash');
 const errors = require('@tryghost/errors');
 const logging = require('@tryghost/logging');
-const { canWelcomeEmailReplaceSignupPaidEmail } = require('../../../lib/member-signup-contexts');
+const {
+  SIGNUP_CONTEXTS,
+  canWelcomeEmailReplaceSignupPaidEmail,
+} = require('../../../lib/member-signup-contexts');
 const { collectedByPort } = require('../checkout/completed-session');
 /** @typedef {import('../../../lib/member-signup-contexts').SignupContext} SignupContext */
 
@@ -335,6 +338,7 @@ module.exports = class CheckoutSessionEventService {
       email: customer.email,
     });
 
+    const memberPreexisted = Boolean(member);
     const checkoutType = _.get(session, 'metadata.checkoutType');
 
     if (!member) {
@@ -426,7 +430,7 @@ module.exports = class CheckoutSessionEventService {
     // After the subscription work, and deliberately not part of it: a value the member
     // gave us for free must never be able to fail the webhook. A throw here would make
     // Stripe retry the event and risk doing the payment work twice.
-    await this.writeCollectedFields(member.id, session);
+    await this.writeCollectedFields(member.id, session, { memberPreexisted });
 
     if (checkoutType !== 'upgrade') {
       const ghostSignupContext = /** @type {SignupContext | undefined} */ (
@@ -457,18 +461,35 @@ module.exports = class CheckoutSessionEventService {
    *
    * @param {string} memberId
    * @param {import('stripe').Stripe.Checkout.Session} session
+   * @param {object} options
+   * @param {boolean} options.memberPreexisted Whether the member's record existed before this event resolved it
    */
-  async writeCollectedFields(memberId, session) {
+  async writeCollectedFields(memberId, session, { memberPreexisted }) {
     // Stamped at create time. A session predating this feature carries none. Read
     // outside the try so a failure below can name the tier whose answers were lost.
     const tierId = session.metadata?.ghostTierId;
 
     try {
-      if (!this.deps.labsService.isSet('membersCustomFields')) {
+      if (!tierId) {
         return;
       }
 
-      if (!tierId) {
+      // A checkout can be started with nothing but an email address, and typing an
+      // email is not proof of owning it. Values may land on the member this event just
+      // created — that record holds nothing the buyer didn't supply — but a record
+      // that existed before the checkout belongs to whoever verified that email, so it
+      // is only written when the session was created by a signed-in member.
+      const wasAuthenticated =
+        session.metadata?.ghostSignupContext === SIGNUP_CONTEXTS.ALREADY_AUTHENTICATED;
+      if (memberPreexisted && !wasAuthenticated) {
+        logging.warn(
+          {
+            event: { name: 'stripe_checkout.collected_fields.write_skipped' },
+            memberId,
+            tierId,
+          },
+          'Skipped storing the fields an unverified checkout collected for an existing member',
+        );
         return;
       }
 

package/core/server/services/stripe/stripe-api.js

@@ -62,6 +62,8 @@ const MANAGED_PAYMENTS_DISABLED = { enabled: false };
  */
 
 module.exports = class StripeAPI {
+  static API_VERSION = STRIPE_API_VERSION;
+
   /**
    * StripeAPI
    * @param {object} deps

package/core/server/services/stripe/stripe-service.js

@@ -25,6 +25,7 @@ const customFields = require('../members-custom-fields');
  * @prop {boolean} testEnv Whether this is a test environment
  * @prop {string} webhookSecret The Stripe webhook secret
  * @prop {string} webhookHandlerUrl The URL to handle Stripe webhooks
+ * @prop {boolean} [ephemeralWebhook] Whether the webhook endpoint is deleted on shutdown
  * @prop {string[]} webhookCustomerIgnoreList List of customer IDs for customer.subscription.updated webhook bypass
  * @prop {string} siteUrl The site URL for billing portal return URL
  */
@@ -134,7 +135,6 @@ module.exports = class StripeService {
         memberWelcomeEmailService.init();
         return memberWelcomeEmailService.api.isMemberWelcomeEmailActive('paid');
       },
-      labsService: labs,
       // A getter because the custom field services are built during boot: reading the
       // binding at construction would capture the empty value it had beforehand.
       get customFieldBindings() {
@@ -162,6 +162,8 @@ module.exports = class StripeService {
     this.migrations = migrations;
     this.webhookController = webhookController;
     this.billingPortalManager = billingPortalManager;
+    /** @private */
+    this.ephemeralWebhook = false;
   }
 
   async connect() {
@@ -213,23 +215,31 @@ module.exports = class StripeService {
       webhookSecret: config.webhookSecret,
       webhookHandlerUrl: config.webhookHandlerUrl,
     });
+    this.ephemeralWebhook = config.ephemeralWebhook === true;
 
     this.billingPortalManager.configure({
       siteUrl: config.siteUrl,
     });
 
-    // webhookManager.start() already self-guards: configure() above puts it in
-    // 'local' mode whenever a webhookSecret is set, which is always true outside
-    // production (config.js defaults it to DEFAULT_WEBHOOK_SECRET), so start()
-    // returns immediately without touching Stripe. Only billingPortalManager
-    // needs an explicit test-env skip — in the test env there is no real Stripe
-    // to register against, and the mock returns 500 for billing_portal/
-    // configurations, so this network-registration call only error-logs on
-    // every boot. Tests never need a registered portal configuration. Skip it
-    // under test; prod and dev register exactly as before.
+    // webhookManager.start() registers a webhook URL with Stripe only when no webhook
+    // secret was supplied. Outside production config.js supplies a placeholder secret
+    // unless stripeRemoteWebhooks is set, so start() normally returns without touching
+    // Stripe. billingPortalManager has no such guard: in the test environment the mock
+    // Stripe answers its registration call with a 500 on every boot, and tests never
+    // need a registered portal, so skip it under test only.
     await this.webhookManager.start();
     if (!config.testEnv) {
       await this.billingPortalManager.start();
     }
   }
+
+  /**
+   * Removes the webhook registration from Stripe, but only when it was marked ephemeral.
+   * A production registration is kept and reused on the next boot.
+   */
+  async shutdown() {
+    if (this.ephemeralWebhook) {
+      await this.webhookManager.stop();
+    }
+  }
 };

package/core/server/services/stripe/webhook-controller.js

@@ -1,4 +1,5 @@
 const logging = require('@tryghost/logging');
+const StripeAPI = require('./stripe-api');
 
 module.exports = class WebhookController {
   /**
@@ -89,6 +90,15 @@ module.exports = class WebhookController {
       return res.end();
     }
 
+    // Stripe shapes each event for the API version of the URL it was sent to. A different
+    // version means this event did not come through the URL Ghost registered, and fields
+    // may not be where Ghost reads them.
+    if (event.api_version !== StripeAPI.API_VERSION) {
+      logging.error(
+        `Webhook ${event.type} was rendered at Stripe API version ${event.api_version}, Ghost expects ${StripeAPI.API_VERSION}`,
+      );
+    }
+
     const customerId = this.getEventCustomerId(event);
     if (this.shouldIgnoreEvent(event, customerId)) {
       logging.info(

package/core/server/services/tier-checkout-config/codec.js

@@ -8,19 +8,23 @@ const schema_1 = require("./schema");
 const models_1 = require("./models");
 const SEPARATOR = ',';
 exports.optionsCodec = zod_1.z.codec(schema_1.DbCheckoutOptions, models_1.CheckoutOptions, {
+    // An absent list is everywhere, so the column is null rather than a copy of every
+    // country. An empty list is neither, and stays representable on purpose: nothing writes
+    // one, and the session builder refuses to collect against it rather than asking the
+    // processor for an address form it would never render.
     decode: (columns) => ({
-        shippingAllowedCountries: splitList(columns.shipping_allowed_countries),
+        shippingAllowedCountries: columns.shipping_allowed_countries === null
+            ? null
+            : splitList(columns.shipping_allowed_countries),
         taxNumber: columns.tax_number_collect,
     }),
     encode: (options) => ({
-        shipping_allowed_countries: options.shippingAllowedCountries.length
-            ? joinList(options.shippingAllowedCountries)
-            : null,
+        shipping_allowed_countries: options.shippingAllowedCountries === null ? null : joinList(options.shippingAllowedCountries),
         tax_number_collect: options.taxNumber,
     }),
 });
 function splitList(stored) {
-    return stored ? stored.split(SEPARATOR).filter(Boolean) : [];
+    return stored.split(SEPARATOR).filter(Boolean);
 }
 function joinList(values) {
     return [...new Set(values)].join(SEPARATOR);

package/core/server/services/tier-checkout-config/models.js

@@ -13,8 +13,14 @@ exports.CheckoutQuestion = zod_1.z.object({
  * under one parameter, but a publisher keeps a name and an address in different fields.
  */
 exports.ShippingCollection = zod_1.z.object({
-    /** ISO 3166-1 alpha-2. A processor will not render an address form without them. */
-    allowedCountries: zod_1.z.array(zod_1.z.string()),
+    /**
+     * ISO 3166-1 alpha-2, or null for everywhere the processor ships.
+     *
+     * Null rather than a stored enumeration of every country, because that list moves: the
+     * day the processor adds one, a saved "everywhere" would silently be a restriction that
+     * excludes it, and nothing would say so.
+     */
+    allowedCountries: zod_1.z.array(zod_1.z.string()).nullable(),
     nameCustomFieldKey: zod_1.z.string(),
     addressCustomFieldKey: zod_1.z.string(),
 });
@@ -42,7 +48,7 @@ const emptyCheckoutConfig = (tierId) => ({
 });
 exports.emptyCheckoutConfig = emptyCheckoutConfig;
 exports.CheckoutOptions = zod_1.z.object({
-    shippingAllowedCountries: zod_1.z.array(zod_1.z.string()),
+    shippingAllowedCountries: zod_1.z.array(zod_1.z.string()).nullable(),
     taxNumber: zod_1.z.boolean(),
 });
 exports.ResolvedQuestion = exports.CheckoutQuestion.extend({