ghost 6.61.0 → 6.63.0

package/core/server/services/{members-custom-fields → members-metafields}/definitions-service.js

@@ -3,13 +3,16 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CustomFieldDefinitionsService = void 0;
+exports.MetafieldDefinitionsService = void 0;
 const bson_objectid_1 = __importDefault(require("bson-objectid"));
 const errors_1 = __importDefault(require("@tryghost/errors"));
 const zod_1 = require("zod");
-const custom_field_types_1 = require("@tryghost/custom-field-types");
+const metafield_types_1 = require("@tryghost/metafield-types");
+const identity_1 = require("@tryghost/metafield-types/identity");
 const codec_1 = require("./codec");
+const namespaces_1 = require("./namespaces");
 const schema_1 = require("./schema");
+const access_1 = require("./access");
 const queries_1 = require("./queries");
 const key_1 = require("./key");
 // The same NQL -> knex bridge Bookshelf's filter plugin uses, applied directly to
@@ -17,7 +20,7 @@ const key_1 = require("./key");
 // turns that into parametrised WHERE clauses. Neither needs a Bookshelf model.
 const nql = require('@tryghost/nql');
 const knexify = require('@tryghost/mongo-knex');
-const TABLE = 'members_custom_fields';
+const TABLE = 'members_metafields';
 // Column limits come from the canonical schema — the same source the migration and
 // Bookshelf models read — so the service can never drift from the database. The
 // name cap turns an over-long input into a clean 422 (not a DB error), and the key
@@ -47,7 +50,7 @@ const FieldName = zod_1.z
 // The backend mints the key from the name, so create takes just a name and type.
 const AddFieldInput = zod_1.z.object({
     name: FieldName,
-    type: custom_field_types_1.FieldTypeSchema,
+    type: metafield_types_1.FieldTypeSchema,
 });
 // A bound on the work one request can ask for, separate from how many definitions
 // a site may hold in total. Every definition in a batch costs several queries
@@ -76,9 +79,9 @@ const EditFieldInput = zod_1.z.object({
     name: FieldName.optional(),
     status: schema_1.FieldStatusSchema.optional(),
     key: zod_1.z.string().optional(),
-    type: custom_field_types_1.FieldTypeSchema.optional(),
+    type: metafield_types_1.FieldTypeSchema.optional(),
 });
-class CustomFieldDefinitionsService {
+class MetafieldDefinitionsService {
     knex;
     recordAction;
     getMaxDefinitions;
@@ -92,7 +95,21 @@ class CustomFieldDefinitionsService {
         // restart. Where the number comes from is the caller's business.
         this.getMaxDefinitions = getMaxDefinitions;
     }
-    async browse(options = {}) {
+    async hasAnyActive() {
+        const [field] = await this.list((0, queries_1.activeFields)(this.knex).limit(1));
+        return Boolean(field);
+    }
+    /**
+     * The fields table has no namespace column: every row in it belongs to the publisher's
+     * `custom` namespace, so no other namespace can have a stored field.
+     */
+    isStored(namespace) {
+        return namespace === identity_1.CUSTOM_NAMESPACE;
+    }
+    async browse(options = {}, audience = access_1.ADMIN) {
+        if (options.namespace !== undefined && !this.isStored(options.namespace)) {
+            return [];
+        }
         // Archived fields are hidden by default: most surfaces (member details, the
         // filter picker, the importer) only ever want active fields. A caller-
         // supplied `filter` can widen that — Settings pulls active and archived
@@ -103,7 +120,7 @@ class CustomFieldDefinitionsService {
         const query = options.filter
             ? applyFilter(this.knex(TABLE), options.filter)
             : (0, queries_1.activeFields)(this.knex);
-        return this.list(query);
+        return (0, access_1.readableFields)(audience, await this.list(query));
     }
     /**
      * Decode a definition query into the domain, in the publisher's order.
@@ -113,10 +130,10 @@ class CustomFieldDefinitionsService {
      */
     async list(query) {
         const rows = await (0, queries_1.inFieldOrder)(query).select('*');
-        return rows.map((row) => zod_1.z.decode(codec_1.customFieldCodec, row));
+        return rows.map((row) => zod_1.z.decode(codec_1.metafieldCodec, row));
     }
-    async read(key) {
-        const [field] = await this.list((0, queries_1.fieldByKey)(this.knex, key));
+    async read(namespace, key) {
+        const [field] = this.isStored(namespace) ? await this.list((0, queries_1.fieldByKey)(this.knex, key)) : [];
         if (!field) {
             throw new errors_1.default.NotFoundError({ message: 'Custom field not found.' });
         }
@@ -132,7 +149,8 @@ class CustomFieldDefinitionsService {
      * batch, so two items sharing a name are caught and two items deriving the same
      * key get distinct ones, exactly as if they had arrived as separate requests.
      */
-    async add(context, input) {
+    async add(context, namespace, input) {
+        (0, namespaces_1.assertDefinable)(namespace);
         const requestedCount = Array.isArray(input) ? input.length : 0;
         const parsed = AddFieldsInput.safeParse(input);
         if (!parsed.success) {
@@ -252,7 +270,7 @@ class CustomFieldDefinitionsService {
     /** `read` for a caller that is deciding rather than serving: absent is an answer. */
     async findByKey(key, { executor = this.knex } = {}) {
         const row = await executor(TABLE).where('key', key).first();
-        return row ? zod_1.z.decode(codec_1.customFieldCodec, row) : null;
+        return row ? zod_1.z.decode(codec_1.metafieldCodec, row) : null;
     }
     /** The same entry `add` writes. Only the caller knows its transaction committed. */
     async recordCreated(context, fields) {
@@ -310,7 +328,8 @@ class CustomFieldDefinitionsService {
      * fresh rank, so a move is well-defined even where every rank is still the default.
      * Returns every definition, archived included, matching what the request named.
      */
-    async reorder(context, input) {
+    async reorder(context, namespace, input) {
+        (0, namespaces_1.assertDefinable)(namespace);
         const parsed = ReorderInput.safeParse(input);
         if (!parsed.success) {
             const issue = parsed.error.issues[0];
@@ -374,7 +393,7 @@ class CustomFieldDefinitionsService {
     async readMany(db, keys) {
         const rows = await db(TABLE).whereIn('key', keys).select('*');
         const byKey = new Map(rows.map((row) => [row.key, row]));
-        return keys.map((key) => zod_1.z.decode(codec_1.customFieldCodec, byKey.get(key)));
+        return keys.map((key) => zod_1.z.decode(codec_1.metafieldCodec, byKey.get(key)));
     }
     /**
      * Pick a free key from the name's base: `base`, then `base_2`, `base_3`, ...
@@ -429,7 +448,10 @@ class CustomFieldDefinitionsService {
             });
         }
     }
-    async edit(context, key, input) {
+    async edit(context, namespace, key, input) {
+        if (!this.isStored(namespace)) {
+            throw new errors_1.default.NotFoundError({ message: 'Custom field not found.' });
+        }
         const parsed = EditFieldInput.safeParse(input);
         if (!parsed.success) {
             throw new errors_1.default.ValidationError({
@@ -438,7 +460,7 @@ class CustomFieldDefinitionsService {
             });
         }
         const patch = parsed.data;
-        const existing = await this.read(key);
+        const existing = await this.read(identity_1.CUSTOM_NAMESPACE, key);
         // Key and type are immutable after creation: values are addressed by key
         // and interpreted by type, so changing either would silently orphan or
         // corrupt stored values. Reject a differing value rather than ignore it.
@@ -492,7 +514,7 @@ class CustomFieldDefinitionsService {
                 details: { primary_name: patch.name ?? existing.name, key },
             });
         }
-        return this.read(key);
+        return this.read(identity_1.CUSTOM_NAMESPACE, key);
     }
     /**
      * Permanently delete a field and every member value attached to it (the FK
@@ -501,7 +523,10 @@ class CustomFieldDefinitionsService {
      * which makes accidental data loss a deliberate two-step. Archiving is the
      * reversible soft state (see `edit` with a status change).
      */
-    async destroy(context, key) {
+    async destroy(context, namespace, key) {
+        if (!this.isStored(namespace)) {
+            throw new errors_1.default.NotFoundError({ message: 'Custom field not found.' });
+        }
         const field = await this.knex(TABLE).where('key', key).first();
         if (!field) {
             throw new errors_1.default.NotFoundError({ message: 'Custom field not found.' });
@@ -520,7 +545,7 @@ class CustomFieldDefinitionsService {
         });
     }
 }
-exports.CustomFieldDefinitionsService = CustomFieldDefinitionsService;
+exports.MetafieldDefinitionsService = MetafieldDefinitionsService;
 /**
  * The shape a stated key has to have. Minting derives one that is usable by
  * construction, so this is the check that path never needed: a caller stating its own
@@ -581,6 +606,24 @@ function applyFilter(query, filter) {
     let mongoQuery;
     try {
         mongoQuery = nql(filter).toJSON();
+    }
+    catch (err) {
+        throw new errors_1.default.BadRequestError({
+            message: 'Could not parse the filter parameter.',
+            property: 'filter',
+            err: err,
+        });
+    }
+    // The table has no `namespace` column, so mongo-knex would compile this into SQL against a
+    // column that does not exist. Refuse it at the edge, naming the URL as the way to pick a
+    // namespace, rather than surface a database error.
+    if (filterReferencesAttribute(mongoQuery, 'namespace')) {
+        throw new errors_1.default.BadRequestError({
+            message: 'Filtering on namespace is not supported. Scope by the namespace route instead.',
+            property: 'filter',
+        });
+    }
+    try {
         knexify(query, mongoQuery, { tableName: TABLE });
     }
     catch (err) {
@@ -599,12 +642,15 @@ function applyFilter(query, filter) {
 // $and/$or/$nor combinators — so a status filter at any nesting counts as the
 // caller opting in to (or out of) archived fields.
 function filterReferencesStatus(query) {
+    return filterReferencesAttribute(query, 'status');
+}
+function filterReferencesAttribute(query, attribute) {
     return Object.entries(query).some(([key, value]) => {
-        if (key === 'status') {
+        if (key === attribute) {
             return true;
         }
         if ((key === '$and' || key === '$or' || key === '$nor') && Array.isArray(value)) {
-            return value.some((sub) => filterReferencesStatus(sub));
+            return value.some((sub) => filterReferencesAttribute(sub, attribute));
         }
         return false;
     });

package/core/server/services/members-metafields/filter.js

@@ -0,0 +1,181 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.METAFIELDS_RELATION = void 0;
+exports.createMetafieldsFilterTransformer = createMetafieldsFilterTransformer;
+// Translates the metafield clauses of a members filter into a query over the
+// values table. A metafield is a publisher-defined field on a member; it is
+// addressed as `namespace.key`, and a composite value such as an address names
+// one of its parts by appending it: `namespace.key.part`.
+//
+//   (metafields.key:'custom.company'+metafields.value:'Ghost')
+//   (metafields.key:'custom.shipping_address.country'+metafields.value:'GB')
+//   metafields.key:'custom.company'                     // has a value
+//   metafields.key:-'custom.shipping_address.country'   // that part is not set
+//
+// The values table holds one row per stored value: `metafield_key`, `path`
+// (empty for a plain field, the part's name for one part of a composite) and
+// `value_text`. A filter addresses those columns directly, so each one becomes a
+// single $elemMatch over them — positive asserts a matching row exists, $not
+// asserts none does — with no lookup against the field definitions.
+const errors_1 = __importDefault(require("@tryghost/errors"));
+const identity_1 = require("@tryghost/metafield-types/identity");
+const RELATION = 'metafields';
+const PREFIX = `${RELATION}.`;
+const KEY_ATTRIBUTE = `${PREFIX}key`;
+const VALUE_ATTRIBUTE = `${PREFIX}value`;
+const ROOT_PATH = '';
+// Only recurse into plain objects/arrays; a RegExp, Date, etc. is a leaf value that
+// must pass through by reference (recursing would strip a regex to `{}`).
+function isPlainObject(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        !Array.isArray(value) &&
+        (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null));
+}
+function isMetafieldClause(node) {
+    if (!isPlainObject(node)) {
+        return false;
+    }
+    const keys = Object.keys(node);
+    return keys.length === 1 && keys[0].startsWith(PREFIX);
+}
+// A grouped compound: an $and whose clauses all target the relation and name exactly one
+// `key`. Its clauses describe one leaf row.
+//
+// Exactly one, not at least one: two whole-field filters ANDed together arrive as a flat
+// `key:'a'+key:'b'`, since a bare key clause needs no group of its own. That is two
+// filters — a member with a value for both — not one leaf that is somehow both fields, so
+// it has to fall through and be transformed a clause at a time.
+function isMetafieldCompound(clauses) {
+    if (!Array.isArray(clauses) || clauses.length < 2 || !clauses.every(isMetafieldClause)) {
+        return false;
+    }
+    return clauses.filter((clause) => Object.keys(clause)[0] === KEY_ATTRIBUTE).length === 1;
+}
+// NQL compiles every negation in this grammar to `{$ne: <string>}`, so a negated clause
+// can arrive in no other shape.
+function negatedString(value) {
+    return isPlainObject(value) && typeof value.$ne === 'string' ? value.$ne : null;
+}
+const ANY_PATH = null;
+// A stored key never contains a dot, so a full dotted identity is a key no stored
+// row can equal.
+function unmatchableLeaf(identity) {
+    return { key: (0, identity_1.formatIdentity)(identity), path: identity.partPath };
+}
+function parseLeafAddress(raw) {
+    const identity = typeof raw === 'string' ? (0, identity_1.parseIdentity)(raw) : null;
+    if (!identity) {
+        throw new errors_1.default.BadRequestError({
+            message: `A metafield filter names a field as namespace.key, for example (${KEY_ATTRIBUTE}:'custom.company'+${VALUE_ATTRIBUTE}:'Ghost').`,
+        });
+    }
+    if (identity.namespace !== identity_1.CUSTOM_NAMESPACE) {
+        return unmatchableLeaf(identity);
+    }
+    return { key: identity.key, path: identity.partPath };
+}
+function createMetafieldsFilterTransformer() {
+    // One (maybe-negated) $elemMatch over the leaf columns: positive is "a leaf pinned
+    // by these matches", `$not` is "no leaf does".
+    function buildElemMatch(target, value, negate) {
+        const match = { metafield_key: target.key };
+        if (value !== undefined) {
+            match.path = target.path ?? ROOT_PATH;
+            match.value_text = value;
+        }
+        else if (target.path !== ANY_PATH) {
+            match.path = target.path;
+        }
+        if (negate) {
+            return { [RELATION]: { $not: { $elemMatch: match } } };
+        }
+        return { [RELATION]: { $elemMatch: match } };
+    }
+    function toElemMatch(clauses) {
+        let target;
+        let value;
+        let hasValue = false;
+        for (const clause of clauses) {
+            const [attribute, clauseValue] = Object.entries(clause)[0];
+            if (attribute === KEY_ATTRIBUTE) {
+                if (negatedString(clauseValue) !== null) {
+                    throw new errors_1.default.BadRequestError({
+                        message: `A negated "${KEY_ATTRIBUTE}" stands alone; it cannot be grouped with a value.`,
+                    });
+                }
+                target = parseLeafAddress(clauseValue);
+            }
+            else if (attribute === VALUE_ATTRIBUTE) {
+                if (hasValue) {
+                    throw new errors_1.default.BadRequestError({
+                        message: `A metafield filter takes one "${VALUE_ATTRIBUTE}" clause.`,
+                    });
+                }
+                hasValue = true;
+                value = clauseValue;
+            }
+            else {
+                throw new errors_1.default.BadRequestError({
+                    message: `Unsupported metafield filter clause "${attribute}".`,
+                });
+            }
+        }
+        if (!target) {
+            throw new errors_1.default.BadRequestError({
+                message: `A metafield filter needs a "${KEY_ATTRIBUTE}" clause.`,
+            });
+        }
+        return buildElemMatch(target, hasValue ? value : undefined, false);
+    }
+    function fromKeyClause(value) {
+        const negatedKey = negatedString(value);
+        if (negatedKey !== null) {
+            return buildElemMatch(parseLeafAddress(negatedKey), undefined, true);
+        }
+        return buildElemMatch(parseLeafAddress(value), undefined, false);
+    }
+    function transform(node) {
+        if (Array.isArray(node)) {
+            return node.map(transform);
+        }
+        if (!isPlainObject(node)) {
+            return node;
+        }
+        if (isMetafieldCompound(node.$and)) {
+            return toElemMatch(node.$and);
+        }
+        const out = {};
+        for (const [key, value] of Object.entries(node)) {
+            if (key === KEY_ATTRIBUTE) {
+                Object.assign(out, fromKeyClause(value));
+            }
+            else if (key.startsWith(PREFIX)) {
+                throw new errors_1.default.BadRequestError({
+                    message: `A "${key}" filter must be grouped with its "${KEY_ATTRIBUTE}" clause, for example (${KEY_ATTRIBUTE}:'custom.a_field'+${VALUE_ATTRIBUTE}:'a value').`,
+                });
+            }
+            else {
+                out[key] = transform(value);
+            }
+        }
+        return out;
+    }
+    return (query) => transform(query);
+}
+/**
+ * The Member filter relation that exposes metafield values. A member has many leaf
+ * rows (one per field, or per part of a composite field), and a predicate asks whether
+ * one of them matches, so this joins the values table on member_id and mongo-knex emits
+ * it as a correlated `members.id IN (…)` subquery — composing with every other member
+ * filter.
+ */
+exports.METAFIELDS_RELATION = {
+    tableName: 'members_metafield_values',
+    tableNameAs: RELATION,
+    type: 'oneToOne',
+    joinFrom: 'member_id',
+};

package/core/server/services/{members-custom-fields → members-metafields}/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.bindings = exports.values = exports.definitions = exports.actingContext = void 0;
+exports.bindings = exports.values = exports.definitions = exports.readableFields = exports.canWrite = exports.MEMBERS = exports.INTERNAL = exports.ADMIN = exports.actingContext = void 0;
 exports.init = init;
 const definitions_service_1 = require("./definitions-service");
 const values_service_1 = require("./values-service");
@@ -9,6 +9,15 @@ const actions_1 = require("./actions");
 const config_1 = require("./config");
 var actions_2 = require("./actions");
 Object.defineProperty(exports, "actingContext", { enumerable: true, get: function () { return actions_2.actingContext; } });
+// Which door a request came through, which is what decides how much of a member's
+// answers it may see or change. Required wherever that is asked, so a new caller
+// has to name itself rather than inherit an answer by default.
+var access_1 = require("./access");
+Object.defineProperty(exports, "ADMIN", { enumerable: true, get: function () { return access_1.ADMIN; } });
+Object.defineProperty(exports, "INTERNAL", { enumerable: true, get: function () { return access_1.INTERNAL; } });
+Object.defineProperty(exports, "MEMBERS", { enumerable: true, get: function () { return access_1.MEMBERS; } });
+Object.defineProperty(exports, "canWrite", { enumerable: true, get: function () { return access_1.canWrite; } });
+Object.defineProperty(exports, "readableFields", { enumerable: true, get: function () { return access_1.readableFields; } });
 function init() {
     // The three are constructed together below, so checking all of them keeps the "all or
     // none" invariant explicit rather than trusting one to stand in for the rest.
@@ -17,25 +26,25 @@ function init() {
     }
     const { knex } = require('../../data/db');
     const models = require('../../models');
-    const recordAction = ({ context, verb, subject, details }) => (0, actions_1.recordCustomFieldAction)({ Action: models.Action, context, verb, subject, details });
+    const recordAction = ({ context, verb, subject, details }) => (0, actions_1.recordMetafieldAction)({ Action: models.Action, context, verb, subject, details });
     // Resolved here, not in the service: reading config is this module's job, and
     // the service is handed a number. A getter rather than a value because the
     // ceiling is an operator setting that can change between requests, and a Ghost
     // container holds no state across them.
     const config = require('../../../shared/config');
-    exports.definitions = new definitions_service_1.CustomFieldDefinitionsService({
+    exports.definitions = new definitions_service_1.MetafieldDefinitionsService({
         knex,
         recordAction,
-        getMaxDefinitions: () => (0, config_1.resolveMaxDefinitions)(config.get('members:customFields:maxDefinitions')),
+        getMaxDefinitions: () => (0, config_1.resolveMaxDefinitions)(config.get('members:metafields:maxDefinitions')),
     });
     // The values service reads the field definitions straight from the table, so
     // it needs knex and the same ceiling — no handle on the definitions service.
-    exports.values = new values_service_1.CustomFieldValuesService({
+    exports.values = new values_service_1.MetafieldValuesService({
         knex,
-        getMaxDefinitions: () => (0, config_1.resolveMaxDefinitions)(config.get('members:customFields:maxDefinitions')),
+        getMaxDefinitions: () => (0, config_1.resolveMaxDefinitions)(config.get('members:metafields:maxDefinitions')),
     });
     // Built after the values, which is what a binding routes into. It has no handle on the
     // definitions: making a field is not part of binding to one, so a caller that needs both
     // asks for both.
-    exports.bindings = new bindings_service_1.CustomFieldBindingsService({ knex, values: exports.values });
+    exports.bindings = new bindings_service_1.MetafieldBindingsService({ knex, values: exports.values });
 }

package/core/server/services/{members-custom-fields → members-metafields}/key.js

@@ -2,11 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.KEY_CHARACTERS = void 0;
 exports.mintableKey = mintableKey;
+const identity_1 = require("@tryghost/metafield-types/identity");
 // Neither package ships types.
 const { stripInvisibleChars } = require('@tryghost/string');
 const unidecode = require('unidecode');
 /** Every character a key may contain. Nothing else survives minting. */
-exports.KEY_CHARACTERS = /^[a-z0-9_]+$/;
+exports.KEY_CHARACTERS = identity_1.IDENTITY_SEGMENT;
 /**
  * Mint the key a field is addressed by, from the name a publisher chose.
  *

package/core/server/services/{members-custom-fields → members-metafields}/models.js

@@ -1,15 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CustomField = void 0;
+exports.Metafield = void 0;
 const zod_1 = require("zod");
-const custom_field_types_1 = require("@tryghost/custom-field-types");
+const metafield_types_1 = require("@tryghost/metafield-types");
 const schema_1 = require("./schema");
-// The domain shape of a field definition (camelCase; distinct from the DB row).
-exports.CustomField = zod_1.z.object({
+exports.Metafield = zod_1.z.object({
     id: zod_1.z.string(),
+    namespace: zod_1.z.string(),
     key: zod_1.z.string(),
     name: zod_1.z.string(),
-    type: custom_field_types_1.FieldTypeSchema,
+    type: metafield_types_1.FieldTypeSchema,
     status: schema_1.FieldStatusSchema,
     createdAt: zod_1.z.date(),
     updatedAt: zod_1.z.date().nullable(),

package/core/server/services/members-metafields/namespaces.js

@@ -0,0 +1,34 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.definableByPublisher = definableByPublisher;
+exports.assertDefinable = assertDefinable;
+const errors_1 = __importDefault(require("@tryghost/errors"));
+const identity_1 = require("@tryghost/metafield-types/identity");
+/**
+ * Who may define fields in a namespace.
+ *
+ * This is a property of the namespace, not of whoever is asking, so it is settled before
+ * any question about the caller. Asking the caller first gets the order wrong in a way
+ * that shows: a request to define a field in a namespace nobody owns would be refused for
+ * want of a permission, telling the caller to go and get one, when no permission would
+ * have helped.
+ *
+ * The publisher owns `custom` and nothing owns anything else yet. An app owning its own
+ * namespace resolves here too, and will not resolve to a permission at all: the caller
+ * has to *be* that app rather than hold a role, which is why the staff permission stays
+ * named after the publisher's fields rather than after metafields at large.
+ */
+function definableByPublisher(namespace) {
+    return namespace === identity_1.CUSTOM_NAMESPACE;
+}
+function assertDefinable(namespace) {
+    if (!definableByPublisher(namespace)) {
+        throw new errors_1.default.ValidationError({
+            message: `Fields cannot be defined in the "${namespace}" namespace.`,
+            property: 'namespace',
+        });
+    }
+}

package/core/server/services/{members-custom-fields → members-metafields}/queries.js

@@ -4,7 +4,7 @@ exports.activeFields = activeFields;
 exports.fieldByKey = fieldByKey;
 exports.inFieldOrder = inFieldOrder;
 const schema_1 = require("./schema");
-const FIELDS_TABLE = 'members_custom_fields';
+const FIELDS_TABLE = 'members_metafields';
 // Archived fields must stay out of every read and write, and nothing in the database
 // enforces that — no constraint stops a value row referencing an archived field. A query
 // that forgets the filter is a silent bug, so the filter lives in one place.

package/core/server/services/{members-custom-fields → members-metafields}/schema.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DbBoundField = exports.DbCustomFieldBinding = exports.DbCustomFieldLeaf = exports.DbCustomFieldValue = exports.WrittenBy = exports.DbCustomField = exports.FieldStatusSchema = exports.FIELD_STATUS = void 0;
+exports.DbBoundField = exports.DbMetafieldBinding = exports.DbMetafieldLeaf = exports.DbMetafieldValue = exports.WrittenBy = exports.DbMetafield = exports.FieldStatusSchema = exports.FIELD_STATUS = void 0;
 const zod_1 = require("zod");
-const custom_field_types_1 = require("@tryghost/custom-field-types");
+const metafield_types_1 = require("@tryghost/metafield-types");
 const date_1 = require("../../lib/db-types/date");
 // `archived` is soft: the field drops out of the values path but stays in the definition
 // list so it can be renamed, restored or deleted. Mirrors schema.js's `isIn` on the
@@ -11,11 +11,11 @@ exports.FIELD_STATUS = { active: 'active', archived: 'archived' };
 exports.FieldStatusSchema = zod_1.z.enum([exports.FIELD_STATUS.active, exports.FIELD_STATUS.archived]);
 // The single source for the read projection and the knex table type below. `type` parses
 // as the field-type enum, so the row carries the narrow type and no codec needs a cast.
-exports.DbCustomField = zod_1.z.object({
+exports.DbMetafield = zod_1.z.object({
     id: zod_1.z.string(),
     key: zod_1.z.string(),
     name: zod_1.z.string(),
-    type: custom_field_types_1.FieldTypeSchema,
+    type: metafield_types_1.FieldTypeSchema,
     status: exports.FieldStatusSchema,
     created_at: date_1.DbDate,
     updated_at: date_1.DbDate.nullable(),
@@ -23,7 +23,7 @@ exports.DbCustomField = zod_1.z.object({
 /**
  * How a value arrived, not who caused it: who edited a member's fields is already an
  * action, and Stripe is not a person. `type` is the namespace that makes `id` resolvable —
- * `users`, `integrations`, `members_custom_field_bindings` — so the one writer that
+ * `users`, `integrations`, `members_metafield_bindings` — so the one writer that
  * resolves in no table is the one with no id to give.
  */
 exports.WrittenBy = zod_1.z.discriminatedUnion('type', [
@@ -31,12 +31,16 @@ exports.WrittenBy = zod_1.z.discriminatedUnion('type', [
     zod_1.z.object({ type: zod_1.z.literal('integration'), id: zod_1.z.string() }),
     zod_1.z.object({ type: zod_1.z.literal('binding'), id: zod_1.z.string() }),
     zod_1.z.object({ type: zod_1.z.literal('import'), id: zod_1.z.null() }),
+    // A member writing their own answers. Resolvable in `members`, like the others,
+    // and the only writer whose changes leave nothing in the staff action log: that
+    // log records what staff did.
+    zod_1.z.object({ type: zod_1.z.literal('member'), id: zod_1.z.string() }),
 ]);
 // One part of a member's value. What a `path` means is storage.ts's business, so the row
 // carries it as a plain string.
-exports.DbCustomFieldValue = zod_1.z.object({
+exports.DbMetafieldValue = zod_1.z.object({
     id: zod_1.z.string(),
-    custom_field_key: zod_1.z.string(),
+    metafield_key: zod_1.z.string(),
     member_id: zod_1.z.string(),
     path: zod_1.z.string(),
     // Nullable like the column, though nothing here writes a null: a part with no value
@@ -55,18 +59,18 @@ exports.DbCustomFieldValue = zod_1.z.object({
 // `type` takes no part in the assembly and is here as a gate: a value whose type has left
 // the catalog is one the definitions list no longer returns either, so failing to parse
 // is what drops it.
-exports.DbCustomFieldLeaf = zod_1.z.object({
+exports.DbMetafieldLeaf = zod_1.z.object({
     member_id: zod_1.z.string(),
     key: zod_1.z.string(),
-    type: custom_field_types_1.FieldTypeSchema,
+    type: metafield_types_1.FieldTypeSchema,
     path: zod_1.z.string(),
     value_text: zod_1.z.string(),
 });
-exports.DbCustomFieldBinding = zod_1.z.object({
+exports.DbMetafieldBinding = zod_1.z.object({
     id: zod_1.z.string(),
     product_id: zod_1.z.string(),
     port: zod_1.z.string(),
-    custom_field_key: zod_1.z.string(),
+    metafield_key: zod_1.z.string(),
     created_at: date_1.DbDate,
     updated_at: date_1.DbDate.nullable(),
 });
@@ -74,5 +78,5 @@ exports.DbCustomFieldBinding = zod_1.z.object({
 exports.DbBoundField = zod_1.z.object({
     binding_id: zod_1.z.string(),
     key: zod_1.z.string(),
-    type: custom_field_types_1.FieldTypeSchema,
+    type: metafield_types_1.FieldTypeSchema,
 });

package/core/server/services/members-metafields/serializers.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toMetafieldsResponse = void 0;
+const zod_1 = require("zod");
+const case_keys_1 = require("../../lib/case-keys");
+const models_1 = require("./models");
+const MetafieldResource = zod_1.z.object({
+    namespace: zod_1.z.string(),
+    key: zod_1.z.string(),
+    name: zod_1.z.string(),
+    type: zod_1.z.string(),
+    status: zod_1.z.string(),
+    created_at: zod_1.z.date(),
+    updated_at: zod_1.z.date().nullable(),
+});
+const MetafieldsResponse = zod_1.z.object({ members_metafields: zod_1.z.array(MetafieldResource) });
+exports.toMetafieldsResponse = zod_1.z
+    .array(models_1.Metafield)
+    .transform((fields) => ({
+    members_metafields: fields.map((field) => (0, case_keys_1.snakeKeys)(field)),
+}))
+    .pipe(MetafieldsResponse);