ghost 6.62.0 → 6.64.0

package/core/server/lib/public-jwk.js

@@ -0,0 +1,77 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPublicKeyInfo = getPublicKeyInfo;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const errors = __importStar(require("@tryghost/errors"));
+// Parsing a PEM and thumbprinting it costs real CPU, so results are shared
+// across every consumer of the same key. Keyed by digest so the cache never
+// holds another reference to private key material.
+const cache = new Map();
+async function parse(privateKeyPem) {
+    // jose 6 is ESM-only. tsc emits this as `require('jose')` under module: commonjs,
+    // which resolves via Node's require(esm) - available on every Node in `engines`.
+    const { calculateJwkThumbprint } = await Promise.resolve().then(() => __importStar(require('jose')));
+    // Node handles both PKCS#1 and PKCS#8 PEMs, and exports public fields only.
+    const publicKey = node_crypto_1.default.createPublicKey(node_crypto_1.default.createPrivateKey(privateKeyPem));
+    const { kty, n, e } = publicKey.export({ format: 'jwk' });
+    if (kty !== 'RSA' || !n || !e) {
+        throw new errors.IncorrectUsageError({
+            message: 'Expected an RSA private key',
+        });
+    }
+    const jwk = { kty, n, e };
+    return { kid: await calculateJwkThumbprint(jwk, 'sha256'), jwk };
+}
+/**
+ * Public JWK and `kid` for a PEM-encoded RSA private key. Never returns private
+ * parameters.
+ */
+function getPublicKeyInfo(privateKeyPem) {
+    const digest = node_crypto_1.default.createHash('sha256').update(privateKeyPem).digest('hex');
+    let info = cache.get(digest);
+    if (!info) {
+        info = parse(privateKeyPem).catch((err) => {
+            // Don't pin a failure forever - a later caller should retry.
+            cache.delete(digest);
+            throw err;
+        });
+        cache.set(digest, info);
+    }
+    return info;
+}

package/core/server/lib/validate-password.js

@@ -1,131 +1,92 @@
-const _ = require('lodash');
-
-const validator = require('@tryghost/validator');
-
-const tpl = require('@tryghost/tpl');
-const settingsCache = require('../../shared/settings-cache');
-const urlUtils = require('../../shared/url-utils').default;
-
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validatePassword = validatePassword;
+const tpl_1 = __importDefault(require("@tryghost/tpl"));
+// @ts-expect-error This module lacks type definitions.
+const validator_1 = __importDefault(require("@tryghost/validator"));
+// @ts-expect-error This module lacks type definitions.
+const settings_cache_1 = __importDefault(require("../../shared/settings-cache"));
+const url_utils_1 = __importDefault(require("../../shared/url-utils"));
 const messages = {
-  passwordDoesNotComplyLength: 'Your password must be at least {minLength} characters long.',
-  passwordDoesNotComplySecurity: 'Sorry, you cannot use an insecure password.',
+    passwordTooShort: 'Your password must be at least {minLength} characters long.',
+    passwordTooLong: 'Your password is too long.',
+    passwordDoesNotComplySecurity: 'Sorry, you cannot use an insecure password.',
 };
-
 /**
  * Counts repeated characters in a string. When 50% or more characters are the same,
  * we return false and therefore invalidate the string.
- * @param {string} stringToTest The password string to check.
- * @return {boolean}
  */
-function characterOccurance(stringToTest) {
-  const chars = {};
-  let allowedOccurancy;
-  let valid = true;
-
-  stringToTest = _.toString(stringToTest);
-  allowedOccurancy = stringToTest.length / 2;
-
-  // Loop through string and accumulate character counts
-  _.each(stringToTest, function (char) {
-    if (!chars[char]) {
-      chars[char] = 1;
-    } else {
-      chars[char] += 1;
-    }
-  });
-
-  // check if any of the accumulated chars exceed the allowed occurancy
-  // of 50% of the words' length.
-  _.forIn(chars, function (charCount) {
-    if (charCount >= allowedOccurancy) {
-      valid = false;
+function characterOccurrence(stringToTest) {
+    const limit = stringToTest.length / 2;
+    const counts = new Map();
+    for (let i = 0; i < stringToTest.length; i++) {
+        const char = stringToTest[i];
+        const count = (counts.get(char) || 0) + 1;
+        if (count >= limit) {
+            return false;
+        }
+        counts.set(char, count);
     }
-  });
-
-  return valid;
+    return true;
 }
-
-/**
- * Validation against simple password rules
- * Returns false when validation fails and true for a valid password
- * @param {string} password The password string to check.
- * @param {string} email The users email address to validate agains password.
- * @param {string} [blogTitle] Optional blogTitle value, when blog title is not set yet, e. g. in setup process.
- * @return {Object} example for returned validation Object:
- * invalid password: `validationResult: {isValid: false, message: 'Sorry, you cannot use an insecure password.'}`
- * valid password: `validationResult: {isValid: true}`
- */
-function validatePassword(password, email, blogTitle) {
-  const validationResult = { isValid: true };
-  const disallowedPasswords = ['password', 'ghost', 'passw0rd'];
-  let blogUrl = urlUtils.urlFor('home', true);
-
-  const badPasswords = [
-    '1234567890',
-    'qwertyuiop',
-    'qwertzuiop',
-    'asdfghjkl;',
-    'abcdefghij',
-    '0987654321',
-    '1q2w3e4r5t',
-    '12345asdfg',
-  ];
-
-  blogTitle = blogTitle ? blogTitle : settingsCache.get('title');
-  blogUrl = blogUrl.replace(/^http(s?):\/\//, '');
-
-  // password must be longer than 10 characters
-  if (!validator.isLength(password, 10)) {
-    validationResult.isValid = false;
-    validationResult.message = tpl(messages.passwordDoesNotComplyLength, { minLength: 10 });
-
-    return validationResult;
-  }
-
-  // dissallow password from badPasswords list (e. g. '1234567890')
-  _.each(badPasswords, function (badPassword) {
-    if (badPassword === password) {
-      validationResult.isValid = false;
+/** Validation against simple password rules. */
+function validatePassword(password, email, siteTitle) {
+    // password cannot be longer than 256 code units, for performance
+    if (password.length > 256) {
+        return { isValid: false, message: (0, tpl_1.default)(messages.passwordTooLong) };
+    }
+    // password must be longer than 10 characters
+    if (!validator_1.default.isLength(password, 10)) {
+        return { isValid: false, message: (0, tpl_1.default)(messages.passwordTooShort, { minLength: 10 }) };
+    }
+    const invalidValidationResult = {
+        isValid: false,
+        message: (0, tpl_1.default)(messages.passwordDoesNotComplySecurity),
+    };
+    // password must not match with users' email
+    if (email && email.toLowerCase() === password.toLowerCase()) {
+        return invalidValidationResult;
+    }
+    // password must not match with site title
+    siteTitle = siteTitle || settings_cache_1.default.get('title');
+    if (siteTitle && siteTitle.toLowerCase() === password.toLowerCase()) {
+        return invalidValidationResult;
+    }
+    // password must not match with site URL (without protocol, with or without trailing slash)
+    let siteUrl = url_utils_1.default.urlFor('home', true);
+    siteUrl = siteUrl.replace(/^http(s?):\/\//, '');
+    if (siteUrl &&
+        (siteUrl.toLowerCase() === password.toLowerCase() ||
+            siteUrl.toLowerCase().replace(/\/$/, '') === password.toLowerCase())) {
+        return invalidValidationResult;
+    }
+    // disallow password from badPasswords list (e. g. '1234567890')
+    const badPasswords = [
+        '1234567890',
+        'qwertyuiop',
+        'qwertzuiop',
+        'asdfghjkl;',
+        'abcdefghij',
+        '0987654321',
+        '1q2w3e4r5t',
+        '12345asdfg',
+    ];
+    if (badPasswords.includes(password)) {
+        return invalidValidationResult;
+    }
+    // password must not contain the words 'ghost', 'password', or 'passw0rd'
+    const disallowedPasswords = ['password', 'ghost', 'passw0rd'];
+    for (const disallowedPassword of disallowedPasswords) {
+        if (password.toLowerCase().includes(disallowedPassword)) {
+            return invalidValidationResult;
+        }
     }
-  });
-
-  // password must not match with users' email
-  if (email && email.toLowerCase() === password.toLowerCase()) {
-    validationResult.isValid = false;
-  }
-
-  // password must not contain the words 'ghost', 'password', or 'passw0rd'
-  _.each(disallowedPasswords, function (disallowedPassword) {
-    if (password.toLowerCase().indexOf(disallowedPassword) >= 0) {
-      validationResult.isValid = false;
+    // dissallow passwords where 50% or more of characters are the same
+    if (!characterOccurrence(password)) {
+        return invalidValidationResult;
     }
-  });
-
-  // password must not match with blog title
-  if (blogTitle && blogTitle.toLowerCase() === password.toLowerCase()) {
-    validationResult.isValid = false;
-  }
-
-  // password must not match with blog URL (without protocol, with or without trailing slash)
-  if (
-    blogUrl &&
-    (blogUrl.toLowerCase() === password.toLowerCase() ||
-      blogUrl.toLowerCase().replace(/\/$/, '') === password.toLowerCase())
-  ) {
-    validationResult.isValid = false;
-  }
-
-  // dissallow passwords where 50% or more of characters are the same
-  if (!characterOccurance(password)) {
-    validationResult.isValid = false;
-  }
-
-  // Generic error message for the rules where no dedicated error massage is set
-  if (!validationResult.isValid && !validationResult.message) {
-    validationResult.message = tpl(messages.passwordDoesNotComplySecurity);
-  }
-
-  return validationResult;
+    return { isValid: true };
 }
-
-module.exports = validatePassword;

package/core/server/models/action.js

@@ -1,10 +1,10 @@
 const ghostBookshelf = require('./base');
 
-// Member custom fields are owned by a raw-knex service rather than the Bookshelf
+// Member metafields are owned by a raw-knex service rather than the Bookshelf
 // registry. Actions still need a read model for `include=resource` to recognise
 // their polymorphic resource type and load the current field definition.
-const MemberCustomFieldResource = ghostBookshelf.Model.extend({
-  tableName: 'members_custom_fields',
+const MemberMetafieldResource = ghostBookshelf.Model.extend({
+  tableName: 'members_metafields',
 });
 
 const Action = ghostBookshelf.Model.extend(
@@ -26,7 +26,7 @@ const Action = ghostBookshelf.Model.extend(
         candidates.push([User, 'security_action']);
       }
 
-      candidates.push([MemberCustomFieldResource, 'member_custom_field']);
+      candidates.push([MemberMetafieldResource, 'member_custom_field']);
 
       return candidates;
     },

package/core/server/models/base/plugins/filtered-collection.js

@@ -1,3 +1,6 @@
+const _ = require('lodash');
+const { hasPosts } = require('@tryghost/bookshelf-plugins');
+
 /**
  * @param {import('bookshelf')} Bookshelf
  */
@@ -17,6 +20,19 @@ module.exports = function (Bookshelf) {
         // Apply model-specific search behavior
         filteredCollection.applySearchQuery(options);
 
+        // Authors are hidden unless they have posts. Apply that constraint before
+        // fetchPage clones its count query so pagination cannot reveal hidden staff.
+        // Keep this author-specific: tags have separate, established count semantics.
+        if (filteredCollection.shouldHavePosts?.joinTable === 'posts_authors') {
+          filteredCollection.query(
+            hasPosts.addHasPostsWhere(
+              _.result(filteredCollection, 'tableName'),
+              filteredCollection.shouldHavePosts,
+            ),
+          );
+          filteredCollection.shouldHavePosts = null;
+        }
+
         return filteredCollection;
       },
 

package/core/server/models/member.js

@@ -5,9 +5,9 @@ const { chainTransformers } = require('@tryghost/mongo-utils');
 const config = require('../../shared/config');
 const { MemberCommentingCodec } = require('../services/members/commenting');
 const {
-  CUSTOM_FIELDS_RELATION,
-  createCustomFieldsFilterTransformer,
-} = require('../services/members-custom-fields/filter');
+  METAFIELDS_RELATION,
+  createMetafieldsFilterTransformer,
+} = require('../services/members-metafields/filter');
 
 const DEEP_OFFSET_THRESHOLD = 1000;
 
@@ -195,8 +195,8 @@ const Member = ghostBookshelf.Model.extend(
     // getFilteredCollectionQuery. Chaining the metafield filter transformer here covers them
     // all without any call site wiring it.
     applyDefaultAndCustomFilters(options) {
-      if (options.filter && options.filter.includes(`${CUSTOM_FIELDS_RELATION.tableNameAs}.`)) {
-        const transformer = createCustomFieldsFilterTransformer();
+      if (options.filter && options.filter.includes(`${METAFIELDS_RELATION.tableNameAs}.`)) {
+        const transformer = createMetafieldsFilterTransformer();
         options.mongoTransformer = options.mongoTransformer
           ? chainTransformers(options.mongoTransformer, transformer)
           : transformer;
@@ -206,7 +206,7 @@ const Member = ghostBookshelf.Model.extend(
 
     filterRelations() {
       return {
-        metafields: CUSTOM_FIELDS_RELATION,
+        metafields: METAFIELDS_RELATION,
         labels: {
           tableName: 'labels',
           type: 'manyToMany',

package/core/server/models/user.js

@@ -6,7 +6,8 @@ const limitService = require('../services/limits');
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const security = require('@tryghost/security');
-const validatePassword = require('../lib/validate-password');
+const { validatePassword } = require('../lib/validate-password');
+const { generatePassword } = require('../lib/generate-password');
 const permissions = require('../services/permissions');
 const urlUtils = require('../../shared/url-utils').default;
 const { setIsRoles } = require('./role-utils');
@@ -66,8 +67,7 @@ User = ghostBookshelf.Model.extend(
 
     defaults: function defaults() {
       return {
-        // secretlint-disable-next-line @secretlint/secretlint-rule-pattern
-        password: security.identifier.uid(50),
+        password: generatePassword(''),
         visibility: 'public',
         status: 'active',
         comment_notifications: true,
@@ -208,8 +208,7 @@ User = ghostBookshelf.Model.extend(
      */
     lock: function lock(options) {
       const update = {
-        // secretlint-disable-next-line @secretlint/secretlint-rule-pattern
-        password: security.identifier.uid(50),
+        password: generatePassword(this.get('email') || ''),
       };
       if (this.get('status') !== 'inactive') {
         update.status = 'locked';
@@ -306,8 +305,8 @@ User = ghostBookshelf.Model.extend(
         }
 
         if (options.importing) {
-          // always set password to a random uid when importing
-          this.set('password', security.identifier.uid(50));
+          // generate a random password when importing
+          this.set('password', generatePassword(this.get('email') || ''));
 
           // lock users so they have to follow the password reset flow
           if (this.get('status') !== 'inactive') {
@@ -1037,10 +1036,13 @@ User = ghostBookshelf.Model.extend(
                 }),
               );
             }
-          } else if (roleId !== contextRoleId) {
+          } else if (roleId !== contextRoleId || editedUserId !== context.user) {
             // CASE: you are trying to change a role, but you are not owner
-            // @NOTE: your role is not the same than the role you try to change (!)
-            // e.g. admin can assign admin role to a user, but not owner
+            // @NOTE: assigning any role to *another* user must always go through
+            // the assign check, including your own role. Otherwise an Editor could
+            // promote an Author to Editor, which the role hierarchy disallows.
+            // The only case that skips the check is a self-edit that leaves your
+            // own role untouched, e.g. a profile update that echoes back `roles`.
 
             return permissions
               .canThis(context)

package/core/server/services/adapter-manager/base-classes.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.baseClasses = void 0;
+exports.baseClassPackages = exports.baseClasses = void 0;
 const ghost_storage_base_1 = require("ghost-storage-base");
 const adapter_base_scheduling_1 = require("@tryghost/adapter-base-scheduling");
 const adapter_base_sso_1 = require("@tryghost/adapter-base-sso");
@@ -10,8 +10,7 @@ const adapter_base_route_settings_1 = require("@tryghost/adapter-base-route-sett
 const adapter_base_jobs_1 = require("@tryghost/adapter-base-jobs");
 /**
  * The base class every adapter of a given type must extend. Also read by
- * bin/validate-adapters.js, which checks adapter implementations at build time -
- * keep this the only place the mapping is declared.
+ * bin/validate-adapters.js, so keep this the only place the mapping is declared.
  */
 exports.baseClasses = {
     storage: ghost_storage_base_1.StorageBase,
@@ -22,3 +21,22 @@ exports.baseClasses = {
     'route-settings': adapter_base_route_settings_1.RouteSettingsStoreBase,
     jobs: adapter_base_jobs_1.JobsBackendBase,
 };
+/**
+ * The package each base class above is imported from. An adapter that installs
+ * one of these itself gets a second copy of the base class - a different function
+ * object, so `instanceof` fails and Ghost falls back to comparing class names.
+ * bin/validate-adapters.js fails a build on such a duplicate, where a duplicate
+ * of any other package is only reported.
+ *
+ * Keyed by adapter type so `satisfies` demands an entry per type in
+ * `baseClasses`; a unit test keeps the names matching the imports above.
+ */
+exports.baseClassPackages = {
+    storage: 'ghost-storage-base',
+    scheduling: '@tryghost/adapter-base-scheduling',
+    sso: '@tryghost/adapter-base-sso',
+    cache: '@tryghost/adapter-base-cache',
+    redirects: '@tryghost/adapter-base-redirects',
+    'route-settings': '@tryghost/adapter-base-route-settings',
+    jobs: '@tryghost/adapter-base-jobs',
+};

package/core/server/services/automations/automations-api.js

@@ -18,16 +18,22 @@ exports.getAutomatedEmailRecipientsByMailgunIds = getAutomatedEmailRecipientsByM
 exports.trackEmailDeliveredAndOpened = trackEmailDeliveredAndOpened;
 exports.trackEmailClicked = trackEmailClicked;
 const errors_1 = __importDefault(require("@tryghost/errors"));
+const logging_1 = __importDefault(require("@tryghost/logging"));
 const tpl_1 = __importDefault(require("@tryghost/tpl"));
 const bson_objectid_1 = __importDefault(require("bson-objectid"));
 const zod_1 = require("zod");
 const database_automations_repository_1 = require("./database-automations-repository");
 const fake_wait_hours_multiplier_1 = require("./fake-wait-hours-multiplier");
+const tinybird_automation_stats_1 = require("./tinybird-automation-stats");
 const start_automations_poll_event_1 = require("./events/start-automations-poll-event");
 const { knex } = require('../../data/db');
 const domainEvents = require('@tryghost/domain-events');
 const labs = require('../../../shared/labs');
 const config = require('../../../shared/config');
+const settingsCache = require('../../../shared/settings-cache');
+const requestExternal = require('../../lib/request-external');
+const TinybirdServiceWrapper = require('../tinybird');
+const { create: createTinybirdClient } = require('../stats/utils/tinybird');
 const lexicalLib = require('../../lib/lexical');
 const MAX_AUTOMATION_ACTIONS = 20;
 const messages = {
@@ -77,8 +83,47 @@ const repository = (0, database_automations_repository_1.createDatabaseAutomatio
     knex,
     fakeWaitHoursMultiplier: (0, fake_wait_hours_multiplier_1.parseFakeWaitHoursMultiplier)(config.get('automations:fakeWaitHoursMultiplier')),
 });
+function getTinybirdClient() {
+    if (!labs.isSet('automationsTinybirdSync') || !config.get('tinybird:stats')) {
+        return null;
+    }
+    try {
+        const tinybirdService = TinybirdServiceWrapper.instance;
+        if (!tinybirdService?.getToken()?.token) {
+            return null;
+        }
+        return createTinybirdClient({
+            config,
+            // Fall back to MySQL after the first failed attempt.
+            request: requestExternal.extend({ retry: { limit: 0 } }),
+            settingsCache,
+            tinybirdService,
+        });
+    }
+    catch (error) {
+        logging_1.default.error('Error preparing Tinybird automation stats client:', error);
+        return null;
+    }
+}
 async function browse() {
-    return await repository.browse();
+    const tinybirdClient = getTinybirdClient();
+    if (!tinybirdClient) {
+        return await repository.browse({ includeStats: true });
+    }
+    const [browseResult, stats] = await Promise.all([
+        repository.browse({ includeStats: false }),
+        (0, tinybird_automation_stats_1.fetchAutomationStats)(tinybirdClient),
+    ]);
+    if (stats === null) {
+        return await repository.browse({ includeStats: true });
+    }
+    return {
+        ...browseResult,
+        data: browseResult.data.map((automation) => ({
+            ...automation,
+            stats: stats.get(automation.id) ?? { ...tinybird_automation_stats_1.EMPTY_AUTOMATION_STATS },
+        })),
+    };
 }
 async function read(automationId) {
     const automation = await repository.getById(automationId);

package/core/server/services/automations/database-automations-repository.js

@@ -35,14 +35,16 @@ const messages = {
 const DEFAULT_EMAIL_DESIGN_SETTING_REFERENCE = constants_1.DEFAULT_EMAIL_DESIGN_SETTING_SLUG;
 function createDatabaseAutomationsRepository({ knex, fakeWaitHoursMultiplier, }) {
     return {
-        async browse() {
+        async browse({ includeStats }) {
             return await knex.transaction(async (trx) => {
                 await ensureDefaultAutomations(trx);
-                const rows = await loadAutomations(trx);
+                const data = includeStats
+                    ? (await loadAutomationsWithStats(trx)).map((row) => buildAutomationBrowseResult(row))
+                    : (await loadAutomations(trx)).map((row) => buildAutomationSummary(row));
                 return {
-                    data: rows.map((row) => buildAutomationBrowseResult(row)),
+                    data,
                     meta: {
-                        pagination: buildPagination(rows.length),
+                        pagination: buildPagination(data.length),
                     },
                 };
             });
@@ -671,6 +673,11 @@ async function loadAutomationBySlug(trx, slug) {
     return row ?? null;
 }
 async function loadAutomations(trx) {
+    return await trx('automations')
+        .select('id', 'slug', 'name', 'status', 'created_at', 'updated_at')
+        .orderBy('name');
+}
+async function loadAutomationsWithStats(trx) {
     const inProgressRuns = trx('automation_run_steps')
         .distinct('automation_run_id')
         .where('status', 'pending')

package/core/server/services/automations/tinybird-automation-stats.js

@@ -0,0 +1,56 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EMPTY_AUTOMATION_STATS = void 0;
+exports.fetchAutomationStats = fetchAutomationStats;
+const logging_1 = __importDefault(require("@tryghost/logging"));
+const zod_1 = require("zod");
+exports.EMPTY_AUTOMATION_STATS = {
+    last_run_created_at: null,
+    total_run_count: 0,
+    in_progress_run_count: 0,
+};
+const runCountSchema = zod_1.z
+    .union([zod_1.z.number(), zod_1.z.string().regex(/^\d+$/)])
+    .pipe(zod_1.z.coerce.number().int().nonnegative());
+const statsRowSchema = zod_1.z.object({
+    automation_id: zod_1.z.string(),
+    last_run_created_at: zod_1.z.iso
+        .datetime()
+        .transform((value) => new Date(value))
+        .nullable(),
+    total_run_count: runCountSchema,
+    in_progress_run_count: runCountSchema,
+});
+async function fetchAutomationStats(client) {
+    let rows;
+    try {
+        // Override the traffic analytics version: this pipe has no version suffix.
+        rows = await client.fetch('api_automation_browse_stats', { version: '' });
+    }
+    catch (error) {
+        logging_1.default.error('Error fetching Tinybird automation stats:', error);
+        return null;
+    }
+    if (rows === null) {
+        return null;
+    }
+    const parsed = zod_1.z.array(statsRowSchema).safeParse(rows);
+    if (!parsed.success) {
+        logging_1.default.error({
+            system: { event: 'automations.stats.invalid_tinybird_response' },
+            issues: parsed.error.issues,
+        }, 'Unexpected response from the Tinybird automation stats pipe');
+        return null;
+    }
+    return new Map(parsed.data.map((row) => [
+        row.automation_id,
+        {
+            last_run_created_at: row.last_run_created_at,
+            total_run_count: row.total_run_count,
+            in_progress_run_count: row.in_progress_run_count,
+        },
+    ]));
+}

package/core/server/services/content-import/import/media.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PostMediaInliner = exports.MediaInliningFailure = void 0;
 exports.isBlockedMediaUrl = isBlockedMediaUrl;
-const cheerio = require('cheerio');
+const cheerio = require('cheerio/slim');
 class MediaInliningFailure extends Error {
     failures;
     constructor(failures) {