ghost 6.61.0 → 6.63.0

package/core/server/services/members/middleware.js

@@ -2,11 +2,10 @@ const crypto = require('crypto');
 const _ = require('lodash');
 const logging = require('@tryghost/logging');
 const membersService = require('./service');
-const emailSuppressionList = require('../email-suppression-list');
 const models = require('../../models');
 const urlUtils = require('../../../shared/url-utils').default;
 const spamPrevention = require('../../web/shared/middleware/api/spam-prevention');
-const { formattedMemberResponse, formatNewsletterResponse } = require('./utils');
+const { formatNewsletterResponse } = require('./utils');
 const errors = require('@tryghost/errors');
 const tpl = require('@tryghost/tpl');
 const onHeaders = require('on-headers');
@@ -18,6 +17,9 @@ const messages = {
   missingUuid: 'Missing uuid.',
   invalidUuid: 'Invalid uuid.',
   invalidKey: 'Invalid key.',
+  // Says that nobody is signed in, without naming the cookie that would have said
+  // so. Which cookie carries a session is Ghost's business, not the caller's.
+  noMemberSession: 'You must be signed in to do this.',
 };
 
 const getFreeTier = async function getFreeTier() {
@@ -116,6 +118,94 @@ const getRedirectUrl = function getRedirectUrl({ action, referrer, searchParams,
   return redirectUrl.href;
 };
 
+/**
+ * Establish who is signed in, without loading them.
+ *
+ * Sets `req.identity` to an id and an email address, or to null when nobody is
+ * signed in. One lookup against an indexed column, with no relations attached and
+ * nothing fetched from outside Ghost.
+ *
+ * Deliberately not the member's record. Most endpoints that serve a member need to
+ * act on one rather than describe one, and the one that describes a member reads
+ * it again after writing anyway, because the response has to say what Ghost now
+ * holds rather than what was sent. What to load is the endpoint's own business.
+ *
+ * Distinct from `loadMemberSession`, which loads the whole member and is what a
+ * themed page renders from.
+ */
+const loadMemberIdentity = async function loadMemberIdentity(req, res, next) {
+  try {
+    Object.assign(req, {
+      identity: await membersService.ssr.getMemberIdentityFromSession(req, res),
+    });
+  } catch (err) {
+    // Only a missing or unreadable cookie means nobody is signed in. Establishing
+    // an identity also reaches the database, and answering "you are not signed in"
+    // to that failing would tell a signed-in member something false and leave the
+    // real fault unreported.
+    if (!errors.utils.isGhostError(err) || err.errorType !== 'BadRequestError') {
+      return next(err);
+    }
+    Object.assign(req, { identity: null });
+  }
+
+  return next();
+};
+
+/**
+ * Hand the identity to whatever comes next, in the place the API framework reads.
+ *
+ * The framework takes whoever is acting from `req.member` and nowhere else, so a
+ * controller behind either gate below finds the identity there.
+ */
+const carryIdentity = function carryIdentity(req, res) {
+  Object.assign(req, { member: req.identity });
+  res.locals.member = req.member;
+};
+
+/**
+ * Refuse a request that `loadMemberIdentity` could not put a name to.
+ *
+ * For endpoints where an unknown caller is asking for something they have no right
+ * to: changing a member's record, or reading what a publisher collects.
+ *
+ * Reads only `req.identity`, so a route using this must register
+ * `loadMemberIdentity` first. It looks nothing up itself: what a route needs is
+ * declared by the middleware it lists, rather than depending on what some earlier
+ * one happened to leave behind.
+ */
+const rejectWhenAnonymous = function rejectWhenAnonymous(req, res, next) {
+  if (!req.identity) {
+    return next(
+      new errors.UnauthorizedError({
+        message: tpl(messages.noMemberSession),
+      }),
+    );
+  }
+
+  carryIdentity(req, res);
+  return next();
+};
+
+/**
+ * Answer with nothing when `loadMemberIdentity` could not put a name to the request.
+ *
+ * For reading who you are, where not knowing is an ordinary answer rather than a
+ * failure: a themed page asks on every view and most of those views have no member.
+ *
+ * The counterpart to `rejectWhenAnonymous`, and separate from it because which of
+ * the two applies is a fact about the endpoint, not a setting on a shared one.
+ */
+const emptyWhenAnonymous = function emptyWhenAnonymous(req, res, next) {
+  if (!req.identity) {
+    res.writeHead(204);
+    return res.end();
+  }
+
+  carryIdentity(req, res);
+  return next();
+};
+
 /**
  * Require member authentication, and make it possible to authenticate via uuid + hashed key.
  * You can chain this after loadMemberSession to make it possible to authenticate via both the uuid and the session.
@@ -243,42 +333,6 @@ const deleteSession = async function deleteSession(req, res) {
   }
 };
 
-const getMemberData = async function getMemberData(req, res) {
-  try {
-    const member = await membersService.ssr.getMemberDataFromSession(req, res);
-    if (member) {
-      res.json(formattedMemberResponse(member));
-    } else {
-      res.json(null);
-    }
-  } catch (err) {
-    res.writeHead(204);
-    res.end();
-  }
-};
-
-const deleteSuppression = async function deleteSuppression(req, res) {
-  try {
-    const member = await membersService.ssr.getMemberDataFromSession(req, res);
-    const options = {
-      id: member.id,
-    };
-    await emailSuppressionList.removeEmail(member.email);
-    await membersService.api.members.update({ email_disabled: false }, options);
-
-    res.writeHead(204);
-    res.end();
-  } catch (err) {
-    if (!err.statusCode) {
-      logging.error(err);
-    }
-    res.writeHead(err.statusCode ?? 500, {
-      'Content-Type': 'text/plain;charset=UTF-8',
-    });
-    res.end(err.message);
-  }
-};
-
 const getMemberNewsletters = async function getMemberNewsletters(req, res) {
   try {
     const memberData = req.member; // validation assumed
@@ -351,46 +405,6 @@ const updateMemberNewsletters = async function updateMemberNewsletters(req, res)
   }
 };
 
-const updateMemberData = async function updateMemberData(req, res) {
-  try {
-    const data = _.pick(
-      req.body,
-      'name',
-      'expertise',
-      'subscribed',
-      'newsletters',
-      'enable_comment_notifications',
-      'enable_updates_and_announcements',
-    );
-    const member = await membersService.ssr.getMemberDataFromSession(req, res);
-    if (member) {
-      const options = {
-        id: member.id,
-        withRelated: [
-          'stripeSubscriptions',
-          'stripeSubscriptions.customer',
-          'stripeSubscriptions.stripePrice',
-          'newsletters',
-        ],
-      };
-      await membersService.api.members.update(data, options);
-      const updatedMember = await membersService.ssr.getMemberDataFromSession(req, res);
-
-      res.json(formattedMemberResponse(updatedMember));
-    } else {
-      res.json(null);
-    }
-  } catch (err) {
-    if (!err.statusCode) {
-      logging.error(err);
-    }
-    res.writeHead(err.statusCode ?? 500, {
-      'Content-Type': 'text/plain;charset=UTF-8',
-    });
-    res.end(err.message);
-  }
-};
-
 const createSessionFromMagicLink = async function createSessionFromMagicLink(req, res, next) {
   if (!req.url.includes('token=')) {
     return next();
@@ -500,17 +514,17 @@ const createSessionFromMagicLink = async function createSessionFromMagicLink(req
 // Set req.member & res.locals.member if a cookie is set
 module.exports = {
   loadMemberSession,
+  loadMemberIdentity,
+  rejectWhenAnonymous,
+  emptyWhenAnonymous,
   authMemberByUuid,
   createSessionFromMagicLink,
   getIdentityToken,
   getEntitlementToken,
   getMemberNewsletters,
-  getMemberData,
-  updateMemberData,
   updateMemberNewsletters,
   deleteSession,
   accessInfoSession,
-  deleteSuppression,
   createIntegrityToken,
   verifyIntegrityToken,
 };

package/core/server/services/members/service.js

@@ -7,7 +7,6 @@ const MembersConfigProvider = require('./members-config-provider');
 const { makeImporter, makeExporter } = require('./import-export');
 const { resolveInlineThreshold } = require('./import-export/config');
 const MembersStats = require('./stats/members-stats');
-const memberJobs = require('./jobs');
 const logging = require('@tryghost/logging');
 const urlUtils = require('../../../shared/url-utils').default;
 const settingsCache = require('../../../shared/settings-cache');
@@ -29,7 +28,7 @@ const messages = {
   sslRequiredForStripe:
     'Cannot run Ghost without SSL when Stripe is connected. Please update your url config to use "https://".',
   remoteWebhooksInDevelopment:
-    'Cannot use remote webhooks in development. See https://ghost.org/docs/webhooks/#stripe-webhooks for developing with Stripe.',
+    'Cannot use remote webhooks in development. See https://docs.ghost.org/webhooks/#stripe-webhooks for developing with Stripe.',
 };
 
 const ghostMailer = new GhostMailer();
@@ -50,9 +49,9 @@ let membersApi;
 let verificationTrigger;
 
 const buildImporterDeps = ({ stripeAPIService }) => {
-  // Required here, not statically: boot builds the custom fields services before this
+  // Required here, not statically: boot builds the metafields services before this
   // one (the exporter below relies on the same).
-  const customFields = require('../members-custom-fields');
+  const metafields = require('../members-metafields');
   return {
     getTimezone: () => settingsCache.get('timezone'),
     // A getter rather than a value because the threshold is an operator
@@ -89,9 +88,9 @@ const buildImporterDeps = ({ stripeAPIService }) => {
     urlFor: urlUtils.urlFor.bind(urlUtils),
     stripeAPIService,
     productRepository: membersApi.productRepository,
-    customFields: {
-      definitions: customFields.definitions,
-      values: customFields.values,
+    metafields: {
+      definitions: metafields.definitions,
+      values: metafields.values,
     },
   };
 };
@@ -116,6 +115,66 @@ const initVerificationTrigger = () => {
   });
 };
 
+const membersMigrationJobName = 'members-migrations';
+
+/**
+ * Runs the historical Stripe backfills once per site, retried only after a
+ * failed run.
+ *
+ * The `jobs` row named `members-migrations` is the only guard: any status other
+ * than `failed` means the run was already attempted and is skipped forever. The
+ * row is written after the run, so a boot that dies mid-way retries next time.
+ * The row is written even when Stripe is not configured, matching the job-based
+ * version: a site that connects Stripe later never runs these 2021-era backfills.
+ * Two processes booting a site with no row will both run the backfills, where the
+ * job-based version claimed the row first. Accepted: every site that has booted
+ * since Ghost 5.6 has the row, and the backfills do nothing without Stripe.
+ *
+ * @TODO: Delete the backfills, this runner and the `jobs` rows in the next major
+ *
+ * @param {import('../stripe')} stripeService
+ */
+async function runStripeMigrations(stripeService) {
+  const existingJob = await models.Job.findOne({ name: membersMigrationJobName });
+
+  if (existingJob && existingJob.get('status') !== 'failed') {
+    logging.info(`Stripe ${membersMigrationJobName} skipped because it has already run`);
+    return;
+  }
+
+  const startedAt = Date.now();
+  logging.info(`Stripe ${membersMigrationJobName} started`);
+
+  let status = 'finished';
+  try {
+    await stripeService.migrations.execute();
+    logging.info(`Stripe ${membersMigrationJobName} completed in ${Date.now() - startedAt}ms`);
+  } catch (err) {
+    status = 'failed';
+    logging.error(
+      err,
+      `Stripe ${membersMigrationJobName} failed after ${Date.now() - startedAt}ms`,
+    );
+  }
+
+  const attrs = { status, started_at: new Date(startedAt), finished_at: new Date() };
+  if (existingJob) {
+    await models.Job.edit(attrs, { id: existingJob.id });
+    return;
+  }
+
+  try {
+    await models.Job.add({ name: membersMigrationJobName, ...attrs });
+  } catch (err) {
+    // Two processes booting a site with no row yet both get here, and the unique
+    // index on jobs.name rejects the second insert. The row exists, so move on.
+    if (!(await models.Job.findOne({ name: membersMigrationJobName }))) {
+      throw err;
+    }
+    logging.warn(`Stripe ${membersMigrationJobName} row was already written by another process`);
+  }
+}
+
 module.exports = {
   async init() {
     const stripeService = require('../stripe');
@@ -176,49 +235,14 @@ module.exports = {
       membersCSVImporter.importInline(request, verificationTrigger);
 
     // Constructed here rather than required statically: the exporter needs the
-    // custom fields services, which boot builds before this one.
-    const customFields = require('../members-custom-fields');
+    // metafields services, which boot builds before this one.
+    const metafields = require('../members-metafields');
     module.exports.export = makeExporter({
-      definitions: customFields.definitions,
-      values: customFields.values,
+      definitions: metafields.definitions,
+      values: metafields.values,
     });
 
-    if (!env?.startsWith('testing')) {
-      const membersMigrationJobName = 'members-migrations';
-      if (!(await jobsService.hasExecutedSuccessfully(membersMigrationJobName))) {
-        logging.info(`[Background Job] ${membersMigrationJobName} queued`);
-        jobsService.addOneOffJob({
-          name: membersMigrationJobName,
-          offloaded: false,
-          job: async () => {
-            const startedAt = Date.now();
-            logging.info(`[Background Job] ${membersMigrationJobName} started`);
-            try {
-              const result = await stripeService.migrations.execute();
-              logging.info(
-                `[Background Job] ${membersMigrationJobName} completed in ${Date.now() - startedAt}ms`,
-              );
-              return result;
-            } catch (err) {
-              logging.error(
-                err,
-                `[Background Job] ${membersMigrationJobName} failed after ${Date.now() - startedAt}ms`,
-              );
-              throw err;
-            }
-          },
-        });
-
-        await jobsService.awaitOneOffCompletion(membersMigrationJobName);
-      } else {
-        logging.info(
-          `[Background Job] ${membersMigrationJobName} skipped because it has already run`,
-        );
-      }
-    }
-
-    // Schedule daily cron job to clean expired comp subs
-    memberJobs.scheduleExpiredCompCleanupJob();
+    await runStripeMigrations(stripeService);
   },
   contentGating: require('./content-gating'),
 

package/core/server/services/members/utils.js

@@ -41,5 +41,14 @@ module.exports.formattedMemberResponse = function formattedMemberResponse(member
     data.email_suppression = member.email_suppression;
   }
 
+  // Absent rather than empty on a site that has defined no extra fields, which is
+  // most of them, so those members' accounts read exactly as they did before this
+  // existed. Present but empty means the publisher has defined fields and this
+  // member has answered none, which a client renders as blank inputs rather than
+  // as nothing to fill in.
+  if (member.metafields) {
+    data.metafields = member.metafields;
+  }
+
   return data;
 };

package/core/server/services/members-metafields/access.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTERNAL = exports.MEMBERS = exports.ADMIN = void 0;
+exports.readableFields = readableFields;
+exports.canWrite = canWrite;
+exports.ADMIN = { entry: 'admin' };
+exports.MEMBERS = { entry: 'members' };
+exports.INTERNAL = { entry: 'internal' };
+/**
+ * Which of the site's fields this audience may see.
+ *
+ * Every field, whichever door they came through. Written as a function rather than
+ * left unwritten so that when a publisher can mark a field as staff only, one
+ * function changes and every caller is already asking.
+ */
+function readableFields(_audience, fields) {
+    return fields;
+}
+/**
+ * Whether this audience may write this field.
+ *
+ * Also total today. Kept separate from `readableFields` because the asymmetry to
+ * expect is a field a member may read but not change, which one combined
+ * permission could not express.
+ */
+function canWrite(_audience, _field) {
+    return true;
+}

package/core/server/services/{members-custom-fields → members-metafields}/actions.js

@@ -4,12 +4,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.actingContext = actingContext;
-exports.recordCustomFieldAction = recordCustomFieldAction;
+exports.recordMetafieldAction = recordMetafieldAction;
 const logging_1 = __importDefault(require("@tryghost/logging"));
 /**
  * Who is acting, read off an API frame's context.
  *
- * Here rather than in each endpoint, because two resources now record custom field history
+ * Here rather than in each endpoint, because two resources now record metafield history
  * and a second reading of the same shape is a second chance to disagree about it. An
  * integration and a user are both actors; a request that is neither — a webhook, a job —
  * has none, and the history says so rather than guessing.
@@ -36,7 +36,7 @@ const COMMANDS = {
     delete: 'deleted',
 };
 // Best-effort action-log write: a failed action must never fail the command that triggered it.
-async function recordCustomFieldAction({ Action, context, verb, subject, details, }) {
+async function recordMetafieldAction({ Action, context, verb, subject, details, }) {
     if (!context.actor) {
         return;
     }
@@ -55,12 +55,12 @@ async function recordCustomFieldAction({ Action, context, verb, subject, details
     }
     catch (err) {
         logging_1.default.error({
-            event: { name: 'members.custom_fields.action_log_failed' },
+            event: { name: 'members.metafields.action_log_failed' },
             err,
             verb,
             subject,
             actorType: context.actor.type,
             actorId: context.actor.id,
-        }, 'Failed to record a member custom field action');
+        }, 'Failed to record a member metafield action');
     }
 }

package/core/server/services/members-metafields/bindings-service.js

@@ -0,0 +1,147 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MetafieldBindingsService = void 0;
+const bson_objectid_1 = __importDefault(require("bson-objectid"));
+const logging_1 = __importDefault(require("@tryghost/logging"));
+const access_1 = require("./access");
+const schema_1 = require("./schema");
+const FIELDS_TABLE = 'members_metafields';
+const { CUSTOM_NAMESPACE } = require('@tryghost/metafield-types/identity');
+const BINDINGS_TABLE = 'members_metafield_bindings';
+/**
+ * Where a source sends what it collected: a `port` is the name that source uses for a
+ * thing, and the binding resolves it to one of the publisher's fields.
+ */
+class MetafieldBindingsService {
+    knex;
+    values;
+    constructor({ knex, values }) {
+        this.knex = knex;
+        this.values = values;
+    }
+    async bind(db, productId, port, metafieldKey, now) {
+        const existing = await db(BINDINGS_TABLE).where({ product_id: productId, port }).first();
+        if (existing?.metafield_key === metafieldKey) {
+            await db(BINDINGS_TABLE).where('id', existing.id).update({ updated_at: now });
+            return existing.id;
+        }
+        if (existing) {
+            await db(BINDINGS_TABLE).where('id', existing.id).del();
+        }
+        const bindingId = new bson_objectid_1.default().toHexString();
+        await db(BINDINGS_TABLE).insert({
+            id: bindingId,
+            product_id: productId,
+            port,
+            metafield_key: metafieldKey,
+            created_at: now,
+            updated_at: now,
+        });
+        return bindingId;
+    }
+    /** Stops the writing. Whatever hangs off the binding cascades with it. */
+    async remove(db, productId, port) {
+        await db(BINDINGS_TABLE).where({ product_id: productId, port }).del();
+    }
+    /**
+     * Values a processor collected on Ghost's behalf and sent back.
+     *
+     * Nobody supplied these in a sense the site can name — a payment page asked, and a
+     * machine reported the answers — so what is recorded against them is the binding that
+     * routed each one. That resolves back to the tier that asked, what it was collected
+     * as, and the field it landed in, which is everything worth knowing about how the
+     * value arrived.
+     */
+    async writeCollected(memberId, productId, collected) {
+        return this.writeThrough(memberId, productId, collected, (binding) => ({
+            type: 'binding',
+            id: binding.bindingId,
+        }));
+    }
+    /**
+     * Values a member supplied about themselves, through the same ports a checkout uses.
+     *
+     * A member typing their own address into a form is answerable for it in a way no
+     * routing is, and a record saying a binding wrote it would be wrong. The member is the
+     * one whose record this is, so there is nobody else it could be.
+     */
+    async writeSuppliedByMember(memberId, productId, supplied) {
+        return this.writeThrough(memberId, productId, supplied, () => ({
+            type: 'member',
+            id: memberId,
+        }));
+    }
+    /**
+     * Values arrive in the order they are to be applied: where two land in one field, the
+     * last of them is what the field holds.
+     *
+     * Every value is attempted, and then the first failure is raised. Attempting them all
+     * is this method's business: one refused answer must not cost a publisher the address
+     * a courier needs, and the values have nothing to do with each other beyond arriving
+     * together. Whether the failure is worth acting on is the caller's, which is why it
+     * leaves here rather than being logged and forgotten — a checkout webhook has already
+     * taken the money and must never fail, while a member filling in a form is owed the
+     * news.
+     */
+    async writeThrough(memberId, productId, values, attribute) {
+        let failure;
+        for (const { port, value } of values) {
+            try {
+                // Inside, because working out where a value goes can fail the same way storing
+                // it can, and a value nobody could place is no more reason to abandon the rest
+                // than one nobody could store.
+                const destination = await this.resolve(productId, port);
+                if (!destination) {
+                    continue;
+                }
+                await this.writeOne(memberId, destination, value, attribute);
+            }
+            catch (err) {
+                failure = failure ?? err;
+            }
+        }
+        if (failure) {
+            throw failure;
+        }
+    }
+    async writeOne(memberId, into, value, attribute) {
+        // Internal: what may be set is bounded by the binding rather than by who is
+        // looking. A port exists because a publisher pointed it at a field, and that
+        // decision is what admits the value, whoever supplied it.
+        const planned = await this.values.planWrite({ [`${CUSTOM_NAMESPACE}.${into.key}`]: value }, access_1.INTERNAL);
+        await this.values.applyWrite(memberId, planned, { writtenBy: attribute(into) });
+    }
+    async resolve(productId, port) {
+        const row = await this.knex(BINDINGS_TABLE)
+            .join(FIELDS_TABLE, `${BINDINGS_TABLE}.metafield_key`, `${FIELDS_TABLE}.key`)
+            .where(`${BINDINGS_TABLE}.product_id`, productId)
+            .where(`${BINDINGS_TABLE}.port`, port)
+            // An archived destination is still where this goes, and still not somewhere a value
+            // can land, so the write drops rather than waiting.
+            .where(`${FIELDS_TABLE}.status`, schema_1.FIELD_STATUS.active)
+            .select(`${BINDINGS_TABLE}.id as binding_id`, `${FIELDS_TABLE}.key`, `${FIELDS_TABLE}.type`)
+            .first();
+        if (!row) {
+            return null;
+        }
+        // Decoded rather than trusted: a join is a read boundary, and `type` is what decides
+        // how the collected value is read. Unreadable counts as unresolved rather than
+        // throwing, so one bad row skips its value the way an unbound port does instead of
+        // failing everything else the same checkout collected.
+        const bound = schema_1.DbBoundField.safeParse(row);
+        if (!bound.success) {
+            logging_1.default.warn({
+                event: { name: 'members.metafields.binding_unreadable' },
+                err: bound.error,
+                productId,
+                port,
+            }, 'A binding could not be read');
+            return null;
+        }
+        return { bindingId: bound.data.binding_id, key: bound.data.key, type: bound.data.type };
+    }
+}
+exports.MetafieldBindingsService = MetafieldBindingsService;

package/core/server/services/members-metafields/codec.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.metafieldCodec = void 0;
+const zod_1 = require("zod");
+const identity_1 = require("@tryghost/metafield-types/identity");
+const case_keys_1 = require("../../lib/case-keys");
+const schema_1 = require("./schema");
+const models_1 = require("./models");
+exports.metafieldCodec = zod_1.z.codec(schema_1.DbMetafield, models_1.Metafield, {
+    // DbMetafield validates `type` as the field-type enum, so the decoded row
+    // already carries a FieldType and camelKeys preserves it — no cast needed.
+    decode: (row) => ({ ...(0, case_keys_1.camelKeys)(row), namespace: identity_1.CUSTOM_NAMESPACE }),
+    encode: ({ namespace: _namespace, ...field }) => (0, case_keys_1.snakeKeys)(field),
+});

package/core/server/services/{members-custom-fields → members-metafields}/config.js

@@ -22,7 +22,7 @@ const Ceiling = zod_1.z
 // rather than restated. Parsed eagerly because a missing or malformed value
 // there is our bug rather than an operator's, and should fail loudly at boot
 // instead of quietly becoming the fallback for everything below.
-const shippedCeiling = Ceiling.parse(require('../../../shared/config/defaults.json').members.customFields.maxDefinitions);
+const shippedCeiling = Ceiling.parse(require('../../../shared/config/defaults.json').members.metafields.maxDefinitions);
 // A higher layer can override the shipped value with anything. Something
 // unreadable falls back to the shipped ceiling rather than throwing, because an
 // operator can correct this live and a bad value must not take the feature down