ghost 6.62.0 → 6.64.0

package/core/server/services/{members-custom-fields → members-metafields}/values-service.js

@@ -3,21 +3,22 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CustomFieldValuesService = void 0;
+exports.MetafieldValuesService = void 0;
 const bson_objectid_1 = __importDefault(require("bson-objectid"));
 const errors_1 = __importDefault(require("@tryghost/errors"));
 const logging_1 = __importDefault(require("@tryghost/logging"));
 const zod_1 = require("zod");
-const custom_field_types_1 = require("@tryghost/custom-field-types");
-const identity_1 = require("@tryghost/custom-field-types/identity");
+const metafield_types_1 = require("@tryghost/metafield-types");
+const identity_1 = require("@tryghost/metafield-types/identity");
 const schema_1 = require("./schema");
 const queries_1 = require("./queries");
+const access_1 = require("./access");
 const storage_1 = require("./storage");
-const FIELDS_TABLE = 'members_custom_fields';
-const VALUES_TABLE = 'members_custom_field_values';
+const FIELDS_TABLE = 'members_metafields';
+const VALUES_TABLE = 'members_metafield_values';
 /**
  * From the canonical schema, the same source definitions-service reads, so no key a site
- * could hold is refused and this cannot drift from the `members_custom_fields.key` column.
+ * could hold is refused and this cannot drift from the `members_metafields.key` column.
  */
 const MAX_KEY_LENGTH = require('../../data/schema').tables[FIELDS_TABLE].key.maxlength;
 /**
@@ -38,7 +39,7 @@ const wireProperty = (identity) => [identity_1.QUALIFIER, identity].join('.');
  * because a value belongs to the member and a definition belongs to the site's settings,
  * which are different aggregates rather than different layers.
  */
-class CustomFieldValuesService {
+class MetafieldValuesService {
     knex;
     /** A getter, not a number: the ceiling is an operator setting that changes between requests. */
     getMaxDefinitions;
@@ -46,7 +47,11 @@ class CustomFieldValuesService {
         this.knex = knex;
         this.getMaxDefinitions = getMaxDefinitions;
     }
-    async activeFieldsByIdentity(identities) {
+    // The query is scoped to the audience, so a field they may not see is absent from
+    // the map and the caller reports it as unknown. Looking up unscoped and rejecting
+    // afterwards would let a member tell a hidden field from an undefined one by the
+    // reply they got.
+    async allowedFieldsByIdentity(identities, audience) {
         const keys = identities
             .map((identity) => (0, identity_1.parseIdentity)(identity))
             .filter((parsed) => parsed !== null && parsed.namespace === identity_1.CUSTOM_NAMESPACE)
@@ -54,23 +59,29 @@ class CustomFieldValuesService {
         if (keys.length === 0) {
             return new Map();
         }
-        const fields = await (0, queries_1.activeFields)(this.knex)
+        const fields = await (0, queries_1.definitions)(this.knex, { audience, status: queries_1.ACTIVE_ONLY })
             .whereIn('key', keys)
-            .select('id', 'key', 'name', 'type');
+            .select('id', 'key', 'name', 'type', 'member_access');
         return new Map(fields.map((field) => [
             (0, identity_1.formatIdentity)({ namespace: identity_1.CUSTOM_NAMESPACE, key: field.key, partPath: null }),
-            { ...field, namespace: identity_1.CUSTOM_NAMESPACE },
+            {
+                id: field.id,
+                key: field.key,
+                name: field.name,
+                type: field.type,
+                namespace: identity_1.CUSTOM_NAMESPACE,
+                memberAccess: field.member_access,
+            },
         ]));
     }
-    async getValuesForMembers(memberIds) {
+    async getValuesForMembers(memberIds, audience) {
         if (memberIds.length === 0) {
             return new Map();
         }
         // Not ordered by field: these rows become an object keyed by field, and an object
         // cannot carry an order. `path` is ordered so composite parts assemble the same
         // way every time.
-        const rows = await this.knex(VALUES_TABLE)
-            .join(FIELDS_TABLE, `${VALUES_TABLE}.custom_field_key`, `${FIELDS_TABLE}.key`)
+        const rows = await (0, queries_1.readableBy)(this.knex(VALUES_TABLE).join(FIELDS_TABLE, `${VALUES_TABLE}.metafield_key`, `${FIELDS_TABLE}.key`), audience)
             .whereIn(`${VALUES_TABLE}.member_id`, memberIds)
             .where(`${FIELDS_TABLE}.status`, schema_1.FIELD_STATUS.active)
             .orderBy(`${VALUES_TABLE}.path`, 'asc')
@@ -78,15 +89,15 @@ class CustomFieldValuesService {
         const leaves = [];
         for (const row of rows) {
             try {
-                leaves.push(schema_1.DbCustomFieldLeaf.parse(row));
+                leaves.push(schema_1.DbMetafieldLeaf.parse(row));
             }
             catch (err) {
                 logging_1.default.warn({
-                    event: { name: 'members.custom_fields.value_unreadable' },
+                    event: { name: 'members.metafields.value_unreadable' },
                     err,
-                    customFieldKey: row.key,
+                    metafieldKey: row.key,
                     path: row.path,
-                }, 'Skipping an unreadable custom field value');
+                }, 'Skipping an unreadable metafield value');
             }
         }
         const flat = (0, storage_1.valuesFromLeaves)(leaves);
@@ -141,7 +152,7 @@ class CustomFieldValuesService {
      * validate before opening a transaction it would otherwise have to unwind, then apply
      * the same plan without re-resolving it.
      */
-    async planWrite(input) {
+    async planWrite(input, audience) {
         const values = this.parseValues(input);
         const identities = Object.keys(values);
         // Bounded by the definitions ceiling, which also holds the lookup below inside
@@ -153,7 +164,7 @@ class CustomFieldValuesService {
                 property: identity_1.QUALIFIER,
             });
         }
-        const byIdentity = await this.activeFieldsByIdentity(identities);
+        const byIdentity = await this.allowedFieldsByIdentity(identities, audience);
         const writes = [];
         for (const [identity, raw] of Object.entries(values)) {
             const field = byIdentity.get(identity);
@@ -163,10 +174,18 @@ class CustomFieldValuesService {
                     property: wireProperty(identity),
                 });
             }
+            // A different refusal from the unknown-field one above: this audience can
+            // already see the field, so naming it discloses nothing.
+            if (!(0, access_1.canWrite)(audience, field)) {
+                throw new errors_1.default.ValidationError({
+                    message: `Cannot set custom field: ${identity}`,
+                    property: wireProperty(identity),
+                });
+            }
             // `null` clears any field, and `''` clears one with no parts. For a value
             // with parts `''` names nothing, so it is left to fail validation rather than
             // being read as a silent delete.
-            if (raw === null || (raw === '' && (0, custom_field_types_1.subFieldsOf)(field.type) === null)) {
+            if (raw === null || (raw === '' && (0, metafield_types_1.subFieldsOf)(field.type) === null)) {
                 writes.push({ field });
                 continue;
             }
@@ -174,7 +193,7 @@ class CustomFieldValuesService {
             // `context` when `context` is empty and prepends it when it is not, so
             // anything added here reaches the client glued to the front of the reason.
             // Which field failed rides in `property`.
-            const value = custom_field_types_1.FIELD_TYPES[field.type].value.safeParse(raw);
+            const value = metafield_types_1.FIELD_TYPES[field.type].value.safeParse(raw);
             if (!value.success) {
                 const issue = value.error.issues[0];
                 throw new errors_1.default.ValidationError({
@@ -224,7 +243,7 @@ class CustomFieldValuesService {
                 rows.push(...set.map((leaf) => ({
                     id: new bson_objectid_1.default().toHexString(),
                     member_id: memberId,
-                    custom_field_key: field.key,
+                    metafield_key: field.key,
                     path: leaf.path,
                     value_text: leaf.value_text,
                     written_by_type: writtenBy.type,
@@ -236,7 +255,7 @@ class CustomFieldValuesService {
             if (clearedKeys.length > 0) {
                 await trx(VALUES_TABLE)
                     .where('member_id', memberId)
-                    .whereIn('custom_field_key', clearedKeys)
+                    .whereIn('metafield_key', clearedKeys)
                     .del();
             }
             if (clearedPaths.length > 0) {
@@ -245,7 +264,7 @@ class CustomFieldValuesService {
                     .where('member_id', memberId)
                     .where((builder) => {
                     for (const { fieldKey, paths } of clearedPaths) {
-                        builder.orWhere((pair) => pair.where('custom_field_key', fieldKey).whereIn('path', paths));
+                        builder.orWhere((pair) => pair.where('metafield_key', fieldKey).whereIn('path', paths));
                     }
                 })
                     .del();
@@ -258,7 +277,7 @@ class CustomFieldValuesService {
                     .insert(rows.slice(from, from + UPSERT_CHUNK))
                     // Naming the columns rather than giving values takes each from the row
                     // that lost the conflict, so every part updates to its own value.
-                    .onConflict(['member_id', 'custom_field_key', 'path'])
+                    .onConflict(['member_id', 'metafield_key', 'path'])
                     // The writer is merged with the value, so a leaf names who wrote what
                     // it currently holds rather than who wrote its first value.
                     .merge(['value_text', 'written_by_type', 'written_by_id', 'updated_at']);
@@ -273,4 +292,4 @@ class CustomFieldValuesService {
         }
     }
 }
-exports.CustomFieldValuesService = CustomFieldValuesService;
+exports.MetafieldValuesService = MetafieldValuesService;

package/core/server/services/mentions/mention-discovery-service.js

@@ -63,7 +63,7 @@ module.exports = class MentionDiscoveryService {
       return null;
     }
 
-    const cheerio = require('cheerio');
+    const cheerio = require('cheerio/slim');
     const $ = cheerio.load(response.body);
 
     // must be first <link> OR <a> element with rel=webmention

package/core/server/services/mentions/mention-sending-service.js

@@ -1,5 +1,6 @@
 const errors = require('@tryghost/errors');
 const logging = require('@tryghost/logging');
+const SendWebmentionsJob = require('./send-webmentions-job').default;
 
 module.exports = class MentionSendingService {
   #discoveryService;
@@ -8,8 +9,12 @@ module.exports = class MentionSendingService {
   #getPostData;
   #getPostUrl;
   #isEnabled;
-  #jobService;
+  #jobsService;
 
+  /**
+   * @param {object} deps
+   * @param {import('../jobs-service/jobs-service').JobsService} deps.jobsService
+   */
   constructor({
     discoveryService,
     externalRequest,
@@ -17,7 +22,7 @@ module.exports = class MentionSendingService {
     getPostData,
     getPostUrl,
     isEnabled,
-    jobService,
+    jobsService,
   }) {
     this.#discoveryService = discoveryService;
     this.#externalRequest = externalRequest;
@@ -25,7 +30,7 @@ module.exports = class MentionSendingService {
     this.#getPostData = getPostData;
     this.#getPostUrl = getPostUrl;
     this.#isEnabled = isEnabled;
-    this.#jobService = jobService;
+    this.#jobsService = jobsService;
   }
 
   get siteUrl() {
@@ -82,13 +87,13 @@ module.exports = class MentionSendingService {
         // Capture the source URL now, from the event's data, rather than
         // deferring the model into the job.
         const url = new URL(await this.#resolvePostUrl(post));
-        await this.#jobService.addJob('sendWebmentions', async () => {
-          await this.sendForHTMLResource({
-            url,
+        await this.#jobsService.dispatch(
+          new SendWebmentionsJob({
+            sourceUrl: url.href,
             html: html,
             previousHtml: previousHtml,
-          });
-        });
+          }),
+        );
       }
     } catch (e) {
       logging.error('Error in webmention sending service post update event handler:');
@@ -157,11 +162,23 @@ module.exports = class MentionSendingService {
     });
   }
 
+  /**
+   * Send the webmentions for a delivered job.
+   * @param {import('./send-webmentions-job').default} job
+   */
+  async sendWebmentions(job) {
+    await this.sendForHTMLResource({
+      url: new URL(job.sourceUrl),
+      html: job.html,
+      previousHtml: job.previousHtml,
+    });
+  }
+
   /**
    * Send a webmention call for the links in a resource.
    * @param {object} resource
    * @param {URL} resource.url
-   * @param {string} resource.html
+   * @param {string|null} resource.html
    * @param {string|null} [resource.previousHtml]
    */
   async sendForHTMLResource(resource) {
@@ -225,7 +242,7 @@ module.exports = class MentionSendingService {
    * @returns {URL[]}
    */
   getLinks(html) {
-    const cheerio = require('cheerio');
+    const cheerio = require('cheerio/slim');
     const $ = cheerio.load(html);
     const urls = [];
     const siteUrl = this.siteUrl;

package/core/server/services/mentions/mention.js

@@ -61,7 +61,7 @@ module.exports = class Mention {
 
     if (contentType.includes('text/html')) {
       try {
-        const cheerio = require('cheerio');
+        const cheerio = require('cheerio/slim');
         const $ = cheerio.load(html);
         const hasTargetUrl =
           $(

package/core/server/services/mentions/send-webmentions-job.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const job_1 = require("../jobs-service/job");
+// Carries the post's full html twice - the largest job payload in the system;
+// revisit if a durable backend puts size limits on envelopes.
+class SendWebmentionsJob extends job_1.Job {
+    static type = 'send-webmentions';
+    sourceUrl;
+    html;
+    previousHtml;
+    constructor({ sourceUrl, html, previousHtml, }) {
+        super();
+        this.sourceUrl = sourceUrl;
+        this.html = html ?? null;
+        this.previousHtml = previousHtml ?? null;
+    }
+}
+exports.default = SendWebmentionsJob;

package/core/server/services/mentions/service.js

@@ -14,8 +14,6 @@ const outputSerializerUrlUtil = require('../../../server/api/endpoints/utils/ser
 const urlService = require('../url');
 const settingsCache = require('../../../shared/settings-cache');
 const DomainEvents = require('@tryghost/domain-events');
-const logging = require('@tryghost/logging');
-const mentionsJobService = require('../mentions-jobs');
 
 // Serializes a post model to the data the URL service needs, loading the
 // relations it reads for filtered collections (event-emitted models don't
@@ -38,33 +36,6 @@ function getPostUrl(id, postData) {
   return jsonModel.url;
 }
 
-// Reports the same queued/started/finished/failed lifecycle for every mentions
-// background job. The wrapped callback's result and errors pass through unchanged,
-// so job manager outcomes and retries are unaffected.
-function makeLoggingJobService() {
-  return {
-    async addJob(name, fn) {
-      logging.info(`[Background Job] ${name} queued`);
-      mentionsJobService.addJob({
-        name,
-        job: async () => {
-          const startedAt = Date.now();
-          logging.info(`[Background Job] ${name} started`);
-          try {
-            const result = await fn();
-            logging.info(`[Background Job] ${name} completed in ${Date.now() - startedAt}ms`);
-            return result;
-          } catch (err) {
-            logging.error(err, `[Background Job] ${name} failed after ${Date.now() - startedAt}ms`);
-            throw err;
-          }
-        },
-        offloaded: false,
-      });
-    },
-  };
-}
-
 module.exports = {
   /** @type {import('./mentions-api')} */
   api: null,
@@ -141,7 +112,7 @@ module.exports = {
       getPostData: (post) => getPostData(post),
       getPostUrl: (id, data) => getPostUrl(id, data),
       isEnabled: () => !settingsCache.get('is_private'),
-      jobService: makeLoggingJobService(),
+      jobsService,
     });
     sendingService.listen(events);
 
@@ -152,4 +123,3 @@ module.exports = {
 // exposed for testing
 module.exports.getPostData = getPostData;
 module.exports.getPostUrl = getPostUrl;
-module.exports.makeLoggingJobService = makeLoggingJobService;

package/core/server/services/oembed/oembed-service.js

@@ -42,6 +42,7 @@ const messages = {
   unableToFetchOembed: 'Unable to fetch requested embed.',
   unauthorized: 'URL contains a private resource.',
   unconvertibleSvg: 'SVG image is too large or compressed to convert.',
+  unsupportedImage: 'Image is not a supported file type.',
 };
 
 const SVG_RASTER_SIZE = 256;
@@ -68,6 +69,16 @@ const shouldRasterize = (buffer, ext) => {
   return head.startsWith('<') && /<svg[\s:>]/i.test(head);
 };
 
+let fileTypeFromBuffer;
+
+const detectFileType = async (buffer) => {
+  if (!fileTypeFromBuffer) {
+    ({ fileTypeFromBuffer } = await import('file-type'));
+  }
+
+  return fileTypeFromBuffer(buffer);
+};
+
 /**
  * @param {string} url
  * @returns {{url: string, provider: boolean}}
@@ -234,6 +245,20 @@ class OEmbedService {
       });
 
       ext = '.png';
+    } else {
+      // The URL's extension is attacker-controlled and decides the
+      // Content-Type the stored file is later served with, so name the
+      // file after its contents and hold it to the same allowlist as image
+      // uploads. `file-type` never reports SVG, which is handled above.
+      const fileType = await detectFileType(imageBuffer);
+      ext = fileType ? `.${fileType.ext}` : '';
+
+      if (!this.config.get('uploads').images.extensions.includes(ext)) {
+        throw new errors.ValidationError({
+          message: tpl(messages.unsupportedImage),
+          context: imageUrl,
+        });
+      }
     }
 
     const uniqueFileName = `${name}-${crypto.randomUUID()}${ext}`;
@@ -561,12 +586,12 @@ class OEmbedService {
    */
   async fetchOembedData(url, html, cardType) {
     // Lazy require the library to keep boot quick
-    const cheerio = require('cheerio');
+    const cheerio = require('cheerio/slim');
 
     // check for <link rel="alternate" type="application/json+oembed"> element
     let oembedUrl;
     try {
-      oembedUrl = cheerio('link[type="application/json+oembed"]', html).attr('href');
+      oembedUrl = cheerio.load(html)('link[type="application/json+oembed"]').attr('href');
     } catch (e) {
       return this.unknownProvider(url);
     }
@@ -622,15 +647,15 @@ class OEmbedService {
           return;
         }
 
-        // `rich` and `video` responses ship provider-supplied HTML that gets
-        // stored in the post's Lexical payload and rendered into the admin
-        // editor preview (via srcdoc) and into public themes (via innerHTML).
-        // Known providers (YouTube, Twitter, etc.) go through `knownProvider`
-        // with @extractus/oembed-extractor's allowlist — anything reaching
-        // here is an arbitrary site's self-declared oEmbed endpoint, which we
-        // must not trust. Drop the response and let the caller fall back to
-        // a bookmark card.
-        if (oembed.type === 'video' || oembed.type === 'rich') {
+        // `rich`, `video` and `photo` responses can all ship provider-supplied
+        // HTML that gets stored in the post's Lexical payload and rendered
+        // into the admin editor preview (via srcdoc) and into public themes
+        // and emails (via innerHTML). Known providers (YouTube, Twitter, etc.)
+        // go through `knownProvider` with @extractus/oembed-extractor's
+        // allowlist — anything reaching here is an arbitrary site's
+        // self-declared oEmbed endpoint, which we must not trust. Drop the
+        // response and let the caller fall back to a bookmark card.
+        if (oembed.type === 'video' || oembed.type === 'rich' || oembed.type === 'photo') {
           return;
         }
 

package/core/server/services/posts/post-scheduling.js

@@ -16,6 +16,10 @@ const messages = {
 // retrying a publish that will never happen.
 const NO_OP = { scheduledResource: null, preScheduledResource: null };
 
+// Ignore overlapping deliveries for the same resource. The scheduler owns
+// retries if the active publish fails; always release the guard when it settles.
+const inFlight = new Set();
+
 /**
  * Publishes scheduled resource (a post or a page at the moment of writing)
  *
@@ -27,6 +31,22 @@ const NO_OP = { scheduledResource: null, preScheduledResource: null };
  *   `scheduledResource: null` when there was nothing to publish yet
  */
 exports.publish = async (resourceType, id, force, options) => {
+  const key = `${resourceType}:${id}`;
+
+  if (inFlight.has(key)) {
+    return NO_OP;
+  }
+
+  inFlight.add(key);
+
+  try {
+    return await publishNow(resourceType, id, force, options);
+  } finally {
+    inFlight.delete(key);
+  }
+};
+
+const publishNow = async (resourceType, id, force, options) => {
   const publishAPostBySchedulerToleranceInMinutes =
     config.get('times').publishAPostBySchedulerToleranceInMinutes;
 

package/core/server/services/staff/staff-service-emails.js

@@ -669,7 +669,11 @@ class StaffServiceEmails {
 
     const juice = require('juice');
 
-    return juice(html, { inlinePseudoElements: true, removeStyleTags: true });
+    return juice(html, {
+      inlinePseudoElements: true,
+      removeStyleTags: true,
+      resolveCSSVariables: false,
+    });
   }
 
   async renderText(templateName, data) {

package/core/server/services/stats/stats-service.js

@@ -246,10 +246,19 @@ class StatsService {
     const request = deps.request || require('../../lib/request-external');
     const settingsCache = deps.settingsCache || require('../../../shared/settings-cache');
 
-    if (settingsCache.get('web_analytics_enabled')) {
-      // TODO: move the tinybird client to the tinybird service
-      const TinybirdServiceWrapper = require('../tinybird');
+    const labs = deps.labs || require('../../../shared/labs');
+    const webAnalyticsEnabled = settingsCache.get('web_analytics_enabled');
+    const TinybirdServiceWrapper = require('../tinybird');
+
+    if (
+      webAnalyticsEnabled ||
+      (labs.isSet('automationsTinybirdSync') && config.get('tinybird:stats'))
+    ) {
       TinybirdServiceWrapper.init();
+    }
+
+    if (webAnalyticsEnabled) {
+      // TODO: move the tinybird client to the tinybird service
       tinybirdClient = require('./utils/tinybird').create({
         config,
         request,

package/core/server/services/stripe/services/webhook/checkout-session-event-service.js

@@ -453,7 +453,7 @@ module.exports = class CheckoutSessionEventService {
 
   /**
    * This service knows how to read a completed Stripe session. It does not know, and must
-   * not know, which custom field any of those values belongs in — that is what a binding
+   * not know, which metafield any of those values belongs in — that is what a binding
    * decides, so no field key appears anywhere in this code.
    *
    * Nothing here may be fatal: a throw fails the webhook, which makes Stripe retry it and
@@ -493,7 +493,7 @@ module.exports = class CheckoutSessionEventService {
         return;
       }
 
-      await this.deps.customFieldBindings.writeCollected(
+      await this.deps.metafieldBindings.writeCollected(
         memberId,
         tierId,
         collectedByPort.parse(session),

package/core/server/services/stripe/stripe-service.js

@@ -10,7 +10,7 @@ const InvoiceEventService = require('./services/webhook/invoice-event-service');
 const CheckoutSessionEventService = require('./services/webhook/checkout-session-event-service');
 const ChargeRefundedEventService = require('./services/webhook/charge-refunded-event-service');
 const memberWelcomeEmailService = require('../member-welcome-emails/service');
-const customFields = require('../members-custom-fields');
+const metafields = require('../members-metafields');
 
 /**
  * @typedef {object} IStripeServiceConfig
@@ -135,10 +135,10 @@ module.exports = class StripeService {
         memberWelcomeEmailService.init();
         return memberWelcomeEmailService.api.isMemberWelcomeEmailActive('paid');
       },
-      // A getter because the custom field services are built during boot: reading the
+      // A getter because the metafields services are built during boot: reading the
       // binding at construction would capture the empty value it had beforehand.
-      get customFieldBindings() {
-        return customFields.bindings;
+      get metafieldBindings() {
+        return metafields.bindings;
       },
     });
 

package/core/server/services/tier-checkout-config/codec.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.questionRowCodec = exports.QuestionRow = exports.collectionRowCodec = exports.CollectionRow = exports.optionsCodec = void 0;
 const zod_1 = require("zod");
-const custom_field_types_1 = require("@tryghost/custom-field-types");
+const metafield_types_1 = require("@tryghost/metafield-types");
 const boolean_1 = require("../../lib/db-types/boolean");
 const schema_1 = require("./schema");
 const models_1 = require("./models");
@@ -67,7 +67,7 @@ exports.QuestionRow = zod_1.z.object({
     label: schema_1.DbCheckoutQuestion.shape.label,
     optional: schema_1.DbCheckoutQuestion.shape.optional,
     question_name: zod_1.z.string().nullable(),
-    question_type: custom_field_types_1.FieldTypeSchema.nullable(),
+    question_type: metafield_types_1.FieldTypeSchema.nullable(),
 });
 exports.questionRowCodec = exports.QuestionRow.transform((row) => ({
     tierId: row.product_id,

package/core/server/services/tier-checkout-config/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.toCheckoutConfigResponse = exports.TierCheckoutConfig = exports.ShippingCollection = exports.ResolvedQuestion = exports.ResolvedCheckout = exports.PhoneCollection = exports.emptyCheckoutConfig = exports.CheckoutQuestion = exports.TierCheckoutConfigService = void 0;
+exports.requirementsByTier = exports.toCheckoutConfigResponse = exports.TierCheckoutConfig = exports.ShippingCollection = exports.ResolvedQuestion = exports.ResolvedCheckout = exports.PhoneCollection = exports.emptyCheckoutConfig = exports.CheckoutQuestion = exports.TierCheckoutConfigService = void 0;
 /**
  * What a tier's checkout asks and collects.
  *
@@ -24,3 +24,4 @@ Object.defineProperty(exports, "ShippingCollection", { enumerable: true, get: fu
 Object.defineProperty(exports, "TierCheckoutConfig", { enumerable: true, get: function () { return models_1.TierCheckoutConfig; } });
 var serializers_1 = require("./serializers");
 Object.defineProperty(exports, "toCheckoutConfigResponse", { enumerable: true, get: function () { return serializers_1.toCheckoutConfigResponse; } });
+Object.defineProperty(exports, "requirementsByTier", { enumerable: true, get: function () { return serializers_1.requirementsByTier; } });

package/core/server/services/tier-checkout-config/models.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ResolvedCheckout = exports.ResolvedQuestion = exports.CheckoutOptions = exports.emptyCheckoutConfig = exports.emptyCollection = exports.TierCheckoutConfig = exports.PhoneCollection = exports.ShippingCollection = exports.CheckoutQuestion = void 0;
 const zod_1 = require("zod");
-const custom_field_types_1 = require("@tryghost/custom-field-types");
+const metafield_types_1 = require("@tryghost/metafield-types");
 exports.CheckoutQuestion = zod_1.z.object({
     key: zod_1.z.string(),
     label: zod_1.z.string().nullable(),
@@ -53,7 +53,7 @@ exports.CheckoutOptions = zod_1.z.object({
 });
 exports.ResolvedQuestion = exports.CheckoutQuestion.extend({
     prompt: zod_1.z.string(),
-    type: custom_field_types_1.FieldTypeSchema,
+    type: metafield_types_1.FieldTypeSchema,
 });
 exports.ResolvedCheckout = zod_1.z.object({
     customFields: zod_1.z.array(exports.ResolvedQuestion),