ghost 6.63.0 → 6.64.0

package/core/built/admin/assets/zapier-modal-BafLUO4R.js

@@ -0,0 +1 @@
+import{i as e,s as t,t as n}from"./react-BXwhMTuc.js";import{f as r,p as i}from"./hooks-DYfTEQLk.js";import{t as a}from"./jsx-runtime-BlNNh7jY.js";import{Or as o,t as s}from"./button-DvIh2Bq-.js";import{o as c,t as l}from"./use-settings-navigation-BIjI5mL3.js";import{i as u,n as d,r as f,t as p}from"./action-list-Crnh-_UI.js";import{t as ee}from"./use-host-limits-mpTkZIq8.js";import{t as m}from"./brand-icon-D3ffDYaC.js";import{n as h}from"./confirmation-context-IyqoXVk-.js";import{n as te}from"./integrations-DnJrZnHv.js";import{t as ne}from"./api-keys-CubH-7_H.js";import{t as re}from"./integration-header-CKGrXNVP.js";import{t as ie}from"./api-keys-omLA6iYn.js";var ae=``+new URL(`zapier-logo-D8a11oW_.svg`,import.meta.url).href,g=t(n(),1),_=a(),v=(e,t)=>`${e}-${t}`,y=()=>{let[e,t]=(0,g.useState)(``),[n,r]=(0,g.useState)(!1),i=(0,g.useRef)(new Map),[a,o]=(0,g.useState)(new Set),s=t=>t.length?t.some(t=>t.toLowerCase().includes(e.toLowerCase())):!0,c=(0,g.useCallback)((t,n)=>{i.current.set(t,n),(!e||n.some(t=>t.toLowerCase().includes(e.toLowerCase())))&&o(e=>new Set(e).add(t))},[e]),l=(0,g.useCallback)(e=>{i.current.delete(e),o(t=>{let n=new Set(t);return n.delete(e),n})},[]);(0,g.useEffect)(()=>{let t=new Set;i.current.forEach((n,r)=>{(!e||n.some(t=>t.toLowerCase().includes(e.toLowerCase())))&&t.add(r)}),o(t)},[e]);let u=(0,g.useCallback)(e=>a.size===1&&a.has(e),[a]),d=(0,g.useCallback)(()=>a,[a]),f=t=>{if(!e)return t;if(typeof t==`string`){let n=e.split(/\s+/).map(e=>e.toLowerCase()),r=n.map(e=>e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`)).join(`|`),i=t.split(RegExp(`(${r})`,`gi`)),a=new Map;return i.map(e=>{if(!n.includes(e.toLowerCase()))return e;let t=(a.get(e)??0)+1;return a.set(e,t),(0,_.jsx)(`span`,{className:`bg-yellow-500/40`,children:e},`${e}-${t}`)})}else if(Array.isArray(t))return t.map(e=>f(e));else if(t&&typeof t==`object`&&t)return g.Children.map(t,e=>e&&typeof e==`object`&&`props`in e?f(e.props.children):e);else return t};return{filter:e,setFilter:t,checkVisible:s,highlightKeywords:f,noResult:n,setNoResult:r,registerComponent:c,unregisterComponent:l,getVisibleComponents:d,isOnlyVisibleComponent:u}},b=``+new URL(`Alto-DoS3yH_j.png`,import.meta.url).href,x=``+new URL(`Bulletin-BUpcurG5.png`,import.meta.url).href,S=``+new URL(`Casper-ASA9Ix4v.png`,import.meta.url).href,C=``+new URL(`Dawn-aeEVEPie.png`,import.meta.url).href,w=``+new URL(`Digest-DJl0U_FG.png`,import.meta.url).href,T=``+new URL(`Dope-D_CgP0p0.png`,import.meta.url).href,E=``+new URL(`Ease-B4NuA7sj.png`,import.meta.url).href,D=``+new URL(`Edge-BPZxvKka.png`,import.meta.url).href,O=``+new URL(`Edition-cIDLjlhj.png`,import.meta.url).href,k=``+new URL(`Episode-D7bgV2bY.png`,import.meta.url).href,A=``+new URL(`Headline-BFXOunIb.png`,import.meta.url).href,j=``+new URL(`Journal-D3UW9T2b.png`,import.meta.url).href,M=``+new URL(`London-CSCVHwS0.png`,import.meta.url).href,N=``+new URL(`Ruby-DVEXVMTx.png`,import.meta.url).href,P=``+new URL(`Solo-c-yPo0gw.png`,import.meta.url).href,F=``+new URL(`Source-V-WXZXnS.png`,import.meta.url).href,I=``+new URL(`Source-Magazine-Czq1p0a_.png`,import.meta.url).href,L=``+new URL(`Source-Newsletter-CwTcfhJ-.png`,import.meta.url).href,R=``+new URL(`Taste-U2cRR2yO.png`,import.meta.url).href,z=``+new URL(`Wave-DE2aI-FM.png`,import.meta.url).href,B=[{name:`Source`,category:`News`,previewUrl:`https://source.ghost.io/`,ref:`default`,image:F,variants:[{category:`Magazine`,previewUrl:`https://source-magazine.ghost.io/`,image:I},{category:`Newsletter`,previewUrl:`https://source-newsletter.ghost.io/`,image:L}]},{name:`Casper`,category:`Blog`,previewUrl:`https://demo.ghost.io/`,ref:`TryGhost/Casper`,image:S},{name:`Edition`,category:`Newsletter`,url:`https://github.com/TryGhost/Edition`,previewUrl:`https://edition.ghost.io/`,ref:`TryGhost/Edition`,image:O},{name:`Solo`,category:`Blog`,url:`https://github.com/TryGhost/Solo`,previewUrl:`https://solo.ghost.io`,ref:`TryGhost/Solo`,image:P},{name:`Taste`,category:`Blog`,url:`https://github.com/TryGhost/Taste`,previewUrl:`https://taste.ghost.io`,ref:`TryGhost/Taste`,image:R},{name:`Episode`,category:`Podcast`,url:`https://github.com/TryGhost/Episode`,previewUrl:`https://episode.ghost.io`,ref:`TryGhost/Episode`,image:k},{name:`Digest`,category:`Newsletter`,url:`https://github.com/TryGhost/Digest`,previewUrl:`https://digest.ghost.io/`,ref:`TryGhost/Digest`,image:w},{name:`Bulletin`,category:`Newsletter`,url:`https://github.com/TryGhost/Bulletin`,previewUrl:`https://bulletin.ghost.io/`,ref:`TryGhost/Bulletin`,image:x},{name:`Alto`,category:`Blog`,url:`https://github.com/TryGhost/Alto`,previewUrl:`https://alto.ghost.io`,ref:`TryGhost/Alto`,image:b},{name:`Dope`,category:`Magazine`,url:`https://github.com/TryGhost/Dope`,previewUrl:`https://dope.ghost.io`,ref:`TryGhost/Dope`,image:T},{name:`Wave`,category:`Podcast`,url:`https://github.com/TryGhost/Wave`,previewUrl:`https://wave.ghost.io`,ref:`TryGhost/Wave`,image:z},{name:`Edge`,category:`Photography`,url:`https://github.com/TryGhost/Edge`,previewUrl:`https://edge.ghost.io`,ref:`TryGhost/Edge`,image:D},{name:`Dawn`,category:`Newsletter`,url:`https://github.com/TryGhost/Dawn`,previewUrl:`https://dawn.ghost.io/`,ref:`TryGhost/Dawn`,image:C},{name:`Ease`,category:`Documentation`,url:`https://github.com/TryGhost/Ease`,previewUrl:`https://ease.ghost.io`,ref:`TryGhost/Ease`,image:E},{name:`Headline`,category:`News`,url:`https://github.com/TryGhost/Headline`,previewUrl:`https://headline.ghost.io`,ref:`TryGhost/Headline`,image:A},{name:`Ruby`,category:`Magazine`,url:`https://github.com/TryGhost/Ruby`,previewUrl:`https://ruby.ghost.io`,ref:`TryGhost/Ruby`,image:N},{name:`London`,category:`Photography`,url:`https://github.com/TryGhost/London`,previewUrl:`https://london.ghost.io`,ref:`TryGhost/London`,image:M},{name:`Journal`,category:`Newsletter`,url:`https://github.com/TryGhost/Journal`,previewUrl:`https://journal.ghost.io/`,ref:`TryGhost/Journal`,image:j}],V=``+new URL(`orb-black-1-bYPPSSAp.png`,import.meta.url).href,H=``+new URL(`orb-black-2-C-rcujeh.png`,import.meta.url).href,U=``+new URL(`orb-black-3-DTkwRv_1.png`,import.meta.url).href,W=``+new URL(`orb-black-4-BXF3fMuE.png`,import.meta.url).href,G=``+new URL(`orb-black-5-94Eda1ek.png`,import.meta.url).href,K=`data:image/svg+xml,%3csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%201818.2%202500'%20style='enable-background:new%200%200%201818.2%202500'%20xml:space='preserve'%3e%3ctitle%3egoogle-docs%3c/title%3e%3cpath%20d='M1136.4%200h-966C79.6%200%200%2079.5%200%20170.5v2159.1c0%2090.9%2079.5%20170.5%20170.5%20170.5h1477.3c90.9%200%20170.5-79.5%20170.5-170.5V681.8l-397.7-284.1L1136.4%200z'%20style='fill:%234285f4'/%3e%3cpath%20d='M454.5%201818.2h909.1v-113.6h-909l-.1%20113.6zm0%20227.3h681.8v-113.6H454.5v113.6zm0-795.5v113.6h909.1V1250H454.5zm0%20340.9h909.1v-113.6h-909l-.1%20113.6z'%20style='fill:%23f1f1f1'/%3e%3cpath%20d='M1136.4%200v511.4c0%2090.9%2079.5%20170.4%20170.4%20170.4h511.4L1136.4%200z'%20style='fill:%23a1c2fa'/%3e%3c/svg%3e`,q=``+new URL(`mailchimp-DwTEN-tS.svg`,import.meta.url).href,J=`data:image/svg+xml,%3csvg%20height='546'%20viewBox='0%200%20569%20546'%20width='569'%20xmlns='http://www.w3.org/2000/svg'%3e%3ctitle%3epatreon%3c/title%3e%3cg%20fill='%23FF424D'%3e%3ccircle%20cx='362.59'%20cy='204.59'%20data-fill='1'%20r='204.59'/%3e%3cpath%20data-fill='1'%20d='M0%200h100v545.8H0z'/%3e%3c/g%3e%3c/svg%3e`,Y=`data:image/svg+xml,%3csvg%20width='152'%20height='179'%20viewBox='0%200%20152%20179'%20xmlns='http://www.w3.org/2000/svg'%3e%3ctitle%3epaypal%3c/title%3e%3cg%20fill='none'%20fill-rule='evenodd'%3e%3cpath%20d='M136.492%2045.453c2.179-13.894-.015-23.348-7.53-31.911C120.688%204.114%20105.741.075%2086.617.075H31.105a7.943%207.943%200%200%200-7.846%206.705L.144%20153.36a4.765%204.765%200%200%200%204.707%205.507h34.27l-2.365%2015a4.168%204.168%200%200%200%204.118%204.818H69.76a6.948%206.948%200%200%200%206.863-5.865l.283-1.468%205.442-34.507.351-1.907a6.947%206.947%200%200%201%206.862-5.865h4.322c27.984%200%2049.896-11.37%2056.299-44.25%202.675-13.74%201.292-25.208-5.783-33.27-2.14-2.439-4.802-4.455-7.907-6.1'%20fill='%23238EC2'/%3e%3cpath%20d='M136.492%2045.453c2.179-13.894-.015-23.348-7.53-31.911C120.688%204.114%20105.741.075%2086.617.075H31.105a7.943%207.943%200%200%200-7.846%206.705L.144%20153.36a4.765%204.765%200%200%200%204.707%205.507h34.27l8.609-54.588-.267%201.711c.609-3.86%203.909-6.704%207.817-6.704h16.288c31.989%200%2057.037-12.996%2064.356-50.582.217-1.113.402-2.191.568-3.251'%20fill='%2320274F'/%3e%3cpath%20d='M56.978%2045.638a6.945%206.945%200%200%201%206.863-5.866h43.514c5.155%200%209.961.337%2014.356%201.045%201.256.202%202.478.435%203.665.698a53.92%2053.92%200%200%201%203.455.885c.558.162%201.106.333%201.646.512%202.157.717%204.166%201.562%206.015%202.541%202.179-13.894-.015-23.348-7.53-31.911C120.688%204.114%20105.741.075%2086.617.075H31.105a7.943%207.943%200%200%200-7.846%206.705L.144%20153.36a4.765%204.765%200%200%200%204.707%205.507h34.27L56.978%2045.638'%20fill='%23253667'/%3e%3c/g%3e%3c/svg%3e`,oe=``+new URL(`slackicon-37ETtpm7.png`,import.meta.url).href,se=`data:image/svg+xml,%3csvg%20width='86'%20height='89'%20xmlns='http://www.w3.org/2000/svg'%3e%3ctitle%3etypeform%3c/title%3e%3cg%20fill='none'%20fill-rule='evenodd'%3e%3cpath%20d='M40.28%2087.561c12.464.154%2021.16-3.994%2030.135-12.175%208.975-8.18%2014.306-16.867%2014.741-28.73.436-11.862-3.412-21.43-12.564-30.581C63.441%206.923%2051.64.9%2039.4.899%2027.158.898%2018.967%206.252%2011.385%2016.07c-7.581%209.818-9.237%2022.212-9.894%2033.921-.657%2011.71-1.15%2017.111%206.608%2024.625%207.758%207.514%2019.718%2012.791%2032.182%2012.945z'%20stroke='%23262627'/%3e%3cpath%20d='M29.136%2037.976v-4.885h25.918v4.885H44.679v27.998H39.51V37.976z'%20fill='%23262627'%20fill-rule='nonzero'/%3e%3c/g%3e%3c/svg%3e`,ce=``+new URL(`zero-bounce-lzY95s9E.png`,import.meta.url).href,X=[{ghostImage:H,appImage:oe,title:`Share scheduled posts with your team in Slack`,url:`https://zapier.com/webintent/create-zap?template=359499`},{ghostImage:U,appImage:J,title:`Connect Patreon to your Ghost membership site`,url:`https://zapier.com/webintent/create-zap?template=75801`},{ghostImage:W,appImage:ce,title:`Protect email delivery with email verification`,url:`https://zapier.com/webintent/create-zap?template=359415`},{ghostImage:G,appImage:Y,title:`Add members for successful sales in PayPal`,url:`https://zapier.com/webintent/create-zap?template=184423`},{ghostImage:U,appImage:Y,title:`Unsubscribe members who cancel a subscription in PayPal`,url:`https://zapier.com/webintent/create-zap?template=359348`},{ghostImage:V,appImage:K,title:`Send new post drafts from Google Docs to Ghost`,url:`https://zapier.com/webintent/create-zap?template=50924`},{ghostImage:W,appImage:se,title:`Survey new members using Typeform`,url:`https://zapier.com/webintent/create-zap?template=359407`},{ghostImage:V,appImage:q,title:`Sync email subscribers in Ghost + Mailchimp`,url:`https://zapier.com/webintent/create-zap?template=359342`}],Z=(0,g.createContext)({officialThemes:B,zapierTemplates:X,search:{filter:``,setFilter:()=>{},checkVisible:()=>!0,highlightKeywords:()=>``,noResult:!1,setNoResult:()=>{},registerComponent:()=>{},unregisterComponent:()=>{},getVisibleComponents:()=>new Set,isOnlyVisibleComponent:()=>!1},sortingState:[],offersShowArchived:!1,setOffersShowArchived:()=>{}}),Q=()=>(0,g.useContext)(Z),le=()=>Q().officialThemes,$=()=>Q().search,ue=()=>Q().upgradeStatus,de=()=>{let{sortingState:e,setSortingState:t}=Q();return{sortingState:e,setSortingState:t}},fe=()=>{let{offersShowArchived:e,setOffersShowArchived:t}=Q();return{offersShowArchived:e,setOffersShowArchived:t}},pe=e({default:()=>me});function me(){let{updateRoute:e}=l(),{zapierTemplates:t}=Q(),{data:{integrations:n}={integrations:[]}}=te(),{mutateAsync:a}=ie(),v=i(),{confirm:y}=h(),[b,x]=(0,g.useState)(!1),S=ee()?.customIntegrations?.disabled,C=n.find(({slug:e})=>e===`zapier`),w=C?.api_keys?.find(e=>e.type===`admin`);return(0,g.useEffect)(()=>{S&&e(`integrations`)},[S,e]),(0,_.jsxs)(c,{cancelLabel:``,footer:(0,_.jsxs)(`div`,{className:`mx-8 flex w-full items-center justify-between`,children:[(0,_.jsxs)(`a`,{className:`mt-1 self-baseline font-bold`,href:`https://zapier.com/apps/ghost/integrations?utm_medium=partner_api&utm_source=widget&utm_campaign=Widget`,rel:`noopener noreferrer`,target:`_blank`,children:[`View more Ghost integrations powered by`,` `,(0,_.jsx)(`span`,{children:(0,_.jsx)(`img`,{alt:`Zapier`,className:`relative top-[-2px] inline-block`,src:ae})})]}),(0,_.jsx)(s,{type:`button`,onClick:()=>{e(`integrations`)},children:`Close`})]}),okLabel:`Close`,okVariant:`default`,testId:`zapier-modal`,title:``,stickyFooter:!0,onClose:()=>{e(`integrations`)},onOk:()=>{e(`integrations`)},children:[(0,_.jsx)(re,{detail:`Automation for your favorite apps`,extra:(0,_.jsx)(`div`,{className:`mt-1 -mb-4`,children:(0,_.jsx)(ne,{keys:[{id:`admin-api-key`,label:`Admin API key`,text:w?.secret,hint:b?(0,_.jsx)(`div`,{className:`text-green`,children:`Admin API Key was successfully regenerated`}):void 0,onRegenerate:()=>{!C||!w||(x(!1),y({title:`Regenerate Admin API Key`,prompt:`You will need to locate the Ghost App within your Zapier account and click on "Reconnect" to enter the new Admin API Key.`,okLabel:`Regenerate Admin API Key`,onOk:async e=>{try{await a({integrationId:C.id,apiKeyId:w.id}),x(!0),e?.remove()}catch(e){v(e)}}}))}},{id:`api-url`,label:`API URL`,text:window.location.origin+r().subdir}]})}),icon:(0,_.jsx)(m,{name:`zapier`,size:56}),title:`Zapier`}),(0,_.jsx)(p,{children:t.map(e=>(0,_.jsxs)(d,{hover:!1,children:[(0,_.jsx)(u,{className:`flex items-center gap-3 py-2 pl-3`,children:(0,_.jsxs)(`div`,{className:`flex flex-col gap-4 md:flex-row md:items-center`,children:[(0,_.jsxs)(`div`,{className:`flex shrink-0 flex-nowrap items-center gap-2`,children:[(0,_.jsx)(`img`,{className:`size-8 object-contain dark:invert`,role:`presentation`,src:e.ghostImage}),(0,_.jsx)(o,{className:`size-3`}),(0,_.jsx)(`img`,{className:`size-8 object-contain`,role:`presentation`,src:e.appImage})]}),(0,_.jsx)(`span`,{children:e.title})]})}),(0,_.jsx)(f,{visibility:`hover`,children:(0,_.jsx)(s,{className:`h-auto p-0 font-semibold whitespace-nowrap text-[#FF4A00] hover:text-[#FF4A00]`,variant:`link`,asChild:!0,children:(0,_.jsx)(`a`,{href:e.url,rel:`noopener noreferrer`,target:`_blank`,children:`Use this Zap`})})})]},e.url))})]})}export{$ as a,X as c,y as d,le as i,B as l,Z as n,de as o,fe as r,ue as s,pe as t,v as u};

package/core/built/admin/index.html

@@ -3,7 +3,7 @@
   <head>
     <link rel="stylesheet" href="./assets/vendor-3bf602dfa6463c3400ffd81697767274.css">
     <link rel="stylesheet" href="./assets/ghost-8fd5bb799356bbefb254210ba7e1236d.css">
-    <meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%226.63%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%22028fe71ec1%22%2C%22activitypubFilename%22%3A%22activitypub.js%22%2C%22activitypubHash%22%3A%226cee18d2a5%22%2C%22activitypubRemoteConfigUrl%22%3A%22%2F.ghost%2Factivitypub%2Fstable%2Fclient-config%22%7D">
+    <meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%226.64%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%2241cf10d900%22%2C%22activitypubFilename%22%3A%22activitypub.js%22%2C%22activitypubHash%22%3A%226cee18d2a5%22%2C%22activitypubRemoteConfigUrl%22%3A%22%2F.ghost%2Factivitypub%2Fstable%2Fclient-config%22%7D">
 
     <meta charset="UTF-8" />
 
@@ -20,38 +20,41 @@
 
     <link rel="shortcut icon" href="./assets/favicon-C_q1KHzv.ico" />
     <link rel="apple-touch-icon" href="./assets/apple-touch-icon-DhO18_4B.png" />
-    <script type="module" crossorigin src="./assets/index-CgMCwsxN.js"></script>
-    <link rel="modulepreload" crossorigin href="./assets/rolldown-runtime-DAXXjFlN.js">
-    <link rel="modulepreload" crossorigin href="./assets/react-Bb3IsNbi.js">
-    <link rel="modulepreload" crossorigin href="./assets/jsx-runtime-DX3WBWVO.js">
-    <link rel="modulepreload" crossorigin href="./assets/framework-provider-DqI25epG.js">
-    <link rel="modulepreload" crossorigin href="./assets/dist-Ndy-PuGN.js">
-    <link rel="modulepreload" crossorigin href="./assets/hooks-Cy_-oZ4o.js">
-    <link rel="modulepreload" crossorigin href="./assets/config-kSHvwdTG.js">
+    <script type="module" crossorigin src="./assets/index-DDd-zhNL.js"></script>
+    <link rel="modulepreload" crossorigin href="./assets/react-BXwhMTuc.js">
+    <link rel="modulepreload" crossorigin href="./assets/react-dom-CMOtJ5MH.js">
+    <link rel="modulepreload" crossorigin href="./assets/jsx-runtime-BlNNh7jY.js">
+    <link rel="modulepreload" crossorigin href="./assets/framework-provider-DB-svAju.js">
+    <link rel="modulepreload" crossorigin href="./assets/dist-DziNzWI2.js">
+    <link rel="modulepreload" crossorigin href="./assets/hooks-DYfTEQLk.js">
+    <link rel="modulepreload" crossorigin href="./assets/config-BPljH6wF.js">
     <link rel="modulepreload" crossorigin href="./assets/preload-helper-DYl5dUZ5.js">
-    <link rel="modulepreload" crossorigin href="./assets/chunk-KS7C4IRE-DCsL4i4D.js">
-    <link rel="modulepreload" crossorigin href="./assets/feature-flag-overrides-context-DQjdJFAk.js">
-    <link rel="modulepreload" crossorigin href="./assets/dist-B3keLvjj.js">
-    <link rel="modulepreload" crossorigin href="./assets/router-provider-BSvTXgZY.js">
-    <link rel="modulepreload" crossorigin href="./assets/text-BQDSDsKs.js">
-    <link rel="modulepreload" crossorigin href="./assets/heading-Dh5SFVjL.js">
+    <link rel="modulepreload" crossorigin href="./assets/chunk-KS7C4IRE-DhOcHQOU.js">
+    <link rel="modulepreload" crossorigin href="./assets/feature-flag-overrides-context-CrcQKm9Z.js">
+    <link rel="modulepreload" crossorigin href="./assets/dist-BXHrDV19.js">
+    <link rel="modulepreload" crossorigin href="./assets/router-provider-CU87qxXw.js">
+    <link rel="modulepreload" crossorigin href="./assets/text-DC-ot6u2.js">
+    <link rel="modulepreload" crossorigin href="./assets/heading-BB21QAbb.js">
     <link rel="modulepreload" crossorigin href="./assets/lazy-component-COKiVB72.js">
-    <link rel="modulepreload" crossorigin href="./assets/dist-8YJUlf3B.js">
-    <link rel="modulepreload" crossorigin href="./assets/shade-app-CcS3f8MZ-vwURazk8.js">
+    <link rel="modulepreload" crossorigin href="./assets/dist-FEQQAwTe.js">
+    <link rel="modulepreload" crossorigin href="./assets/shade-app-CcS3f8MZ-D5BnfHck.js">
     <link rel="modulepreload" crossorigin href="./assets/overlay-escape-C7XYQuvP.js">
-    <link rel="modulepreload" crossorigin href="./assets/button-Dvcv1QSR.js">
-    <link rel="modulepreload" crossorigin href="./assets/dist-Dgt2cr6a.js">
-    <link rel="modulepreload" crossorigin href="./assets/Combination-B0l4MKVh.js">
-    <link rel="modulepreload" crossorigin href="./assets/dist-Dcsslyo72.js">
-    <link rel="modulepreload" crossorigin href="./assets/input-surface-BsrIZeSF.js">
-    <link rel="modulepreload" crossorigin href="./assets/skeleton-Ce9GgUpf.js">
-    <link rel="modulepreload" crossorigin href="./assets/use-navigate-with-base-path-BkxcPj5l.js">
+    <link rel="modulepreload" crossorigin href="./assets/button-DvIh2Bq-.js">
+    <link rel="modulepreload" crossorigin href="./assets/dist-CUwte9v_.js">
+    <link rel="modulepreload" crossorigin href="./assets/Combination-DWfJPcz9.js">
+    <link rel="modulepreload" crossorigin href="./assets/dist-Bf-HQtVL.js">
+    <link rel="modulepreload" crossorigin href="./assets/input-surface-wSO5CRy5.js">
+    <link rel="modulepreload" crossorigin href="./assets/skeleton-DwCva0-b.js">
+    <link rel="modulepreload" crossorigin href="./assets/accordion-CJmRaqK7.js">
+    <link rel="modulepreload" crossorigin href="./assets/badge-qP06OT7C.js">
+    <link rel="modulepreload" crossorigin href="./assets/use-navigate-with-base-path-88EQpw2k.js">
     <link rel="modulepreload" crossorigin href="./assets/update-queries-C4CnvJaW.js">
-    <link rel="modulepreload" crossorigin href="./assets/users-DVNWrqg9.js">
-    <link rel="modulepreload" crossorigin href="./assets/onboarding-pXyct0Jm.js">
-    <link rel="modulepreload" crossorigin href="./assets/onboarding-CUuy9unR.js">
+    <link rel="modulepreload" crossorigin href="./assets/users-C60_hpn6.js">
+    <link rel="modulepreload" crossorigin href="./assets/onboarding-DV_XbHts.js">
+    <link rel="modulepreload" crossorigin href="./assets/onboarding-B4hfBi9a.js">
     <link rel="modulepreload" crossorigin href="./assets/schemas-BoYdB6YU.js">
-    <link rel="stylesheet" crossorigin href="./assets/index-BHHXtR5C.css">
+    <link rel="modulepreload" crossorigin href="./assets/themes-DtcEFQWm.js">
+    <link rel="stylesheet" crossorigin href="./assets/index-B3HZU2i8.css">
   </head>
   <body class="react-admin">
     <div id="ember-alerts-wormhole"></div>
@@ -71,9 +74,9 @@
     <div id="ember-liquid-wormhole"></div>
     <div id="ember-notifications-wormhole"></div>
     <script src="./assets/vendor-2dd263291938d407802568d3357ec69e.js"></script>
-    <script src="./assets/chunk.901.4ccc639821020230bcca.js"></script>
-    <script src="./assets/chunk.254.035b85ec456ebbd7336b.js"></script>
-    <script src="./assets/chunk.524.e6975095fccdf22d90f8.js"></script>
-    <script src="./assets/ghost-b4e8a403baba61905cd7560e30b9732d.js"></script>
+    <script src="./assets/chunk.972.4b8c97f93d66db15e751.js"></script>
+    <script src="./assets/chunk.368.22ce1b732c0b40abd3f1.js"></script>
+    <script src="./assets/chunk.524.cc9be98e44890cedc8c8.js"></script>
+    <script src="./assets/ghost-a1e6e172c6917e8ef8fa6b0007756d9b.js"></script>
   </body>
 </html>

package/core/cli/command.js

@@ -2,8 +2,23 @@
 // repl, timetravel) can require TypeScript modules directly. These commands run
 // via bare `node index.js <command>`, which — unlike `pnpm dev` (nodemon
 // --import=tsx) or the production build (tsc) — has no TS resolution otherwise.
-// They are restricted to development/local environments, where tsx is available.
-require('tsx/cjs');
+//
+// tsx is a devDependency. In a built tree (the production image, or CI after a
+// build) it is absent but also unnecessary, because tsc has already emitted a
+// .js beside every .ts - the same situation MigratorConfig.js handles. Only the
+// direct lookup is allowed to fail: resolving first and requiring outside the
+// guard means a tsx that is installed but broken still throws.
+let tsxLoader;
+try {
+  tsxLoader = require.resolve('tsx/cjs');
+} catch (err) {
+  if (err.code !== 'MODULE_NOT_FOUND') {
+    throw err;
+  }
+}
+if (tsxLoader) {
+  require(tsxLoader);
+}
 
 const cli = require('@tryghost/pretty-cli');
 const logging = cli.ui.log;

package/core/frontend/meta/asset-url.js

@@ -1,4 +1,3 @@
-const crypto = require('crypto');
 const path = require('path');
 const config = require('../../shared/config');
 const { blogIcon } = require('../services/proxy');
@@ -16,20 +15,6 @@ function getFaviconUrl() {
   return blogIcon.getIconUrl();
 }
 
-/**
- * Get the fallback global asset hash (used for non-theme assets or when file hash unavailable)
- * @returns {string}
- */
-function getGlobalAssetHash() {
-  if (!config.get('assetHash')) {
-    config.set(
-      'assetHash',
-      crypto.createHash('md5').update(Date.now().toString()).digest('hex').substring(0, 10),
-    );
-  }
-  return config.get('assetHash');
-}
-
 /**
  * Safely resolve a path within a root directory, preventing directory traversal
  * @param {string} rootPath - The root directory path
@@ -176,7 +161,7 @@ function getAssetUrl(assetPath, hasMinFile) {
 
   // Fallback to global hash if file hash unavailable
   if (!hash) {
-    hash = getGlobalAssetHash();
+    hash = assetHash.getGlobalHash();
   }
 
   // if url has # make sure the hash is at the right place

package/core/frontend/services/asset-hash/index.js

@@ -5,7 +5,9 @@ const config = require('../../../shared/config');
 /**
  * Asset Hash Service
  *
- * Provides SHA256-based hashing for theme asset files.
+ * Provides SHA256-based hashing for theme asset files, plus the global fallback
+ * hash used for assets we can't hash by content.
+ *
  * Hashes are cached in memory and invalidated when file mtime changes.
  */
 
@@ -14,9 +16,15 @@ const config = require('../../../shared/config');
 // This is longer than the legacy 10-char global hash, making it easy to distinguish
 const HASH_LENGTH = 16;
 
+// The global hash keeps its legacy 10-char hex length so existing asset URLs are unchanged
+const GLOBAL_HASH_LENGTH = 10;
+
 // Cache structure: { filePath: { hash: string, mtimeMs: number } }
 const hashCache = new Map();
 
+// Lazily generated once per boot, and reset whenever the caches are cleared
+let globalHash = null;
+
 /**
  * Calculate SHA256 hash of a file's contents
  * @param {string} filePath - Absolute path to the file
@@ -61,14 +69,36 @@ function getHashForFile(filePath) {
 }
 
 /**
- * Clear all cached hashes
+ * Get the global fallback hash, used for assets whose contents we can't hash -
+ * a missing file, or content-based hashing being turned off.
+ *
+ * Generated lazily on first use rather than at boot, so that nothing pays for it
+ * on a site that never falls back.
+ * @returns {string} - 10 character hex hash
+ */
+function getGlobalHash() {
+  if (!globalHash) {
+    globalHash = crypto
+      .createHash('md5')
+      .update(Date.now().toString())
+      .digest('hex')
+      .substring(0, GLOBAL_HASH_LENGTH);
+  }
+
+  return globalHash;
+}
+
+/**
+ * Clear all cached hashes, including the global fallback hash
  * Should be called when theme is changed/remounted
  */
 function clearCache() {
   hashCache.clear();
+  globalHash = null;
 }
 
 module.exports = {
   getHashForFile,
+  getGlobalHash,
   clearCache,
 };

package/core/frontend/services/routing/controllers/unsubscribe.js

@@ -5,6 +5,7 @@ const { settingsHelpers } = proxy;
 const urlUtils = require('../../../../shared/url-utils').default;
 const logging = require('@tryghost/logging');
 const crypto = require('crypto');
+const { timingSafeStringEqual } = require('../../../../shared/timing-safe-string-equal');
 
 module.exports = async function unsubscribeController(req, res) {
   debug('unsubscribeController');
@@ -42,7 +43,7 @@ module.exports = async function unsubscribeController(req, res) {
       }
       const membersKey = settingsHelpers.getMembersValidationKey();
       const memberHmac = crypto.createHmac('sha256', membersKey).update(query.uuid).digest('hex');
-      if (memberHmac !== query.key) {
+      if (!timingSafeStringEqual(memberHmac, query.key)) {
         logging.warn('[List-Unsubscribe] Unsubscribe failed due to invalid key for ' + query.uuid);
         return res.status(400).end();
       }

package/core/frontend/services/rss/generate-feed.js

@@ -17,7 +17,7 @@ const generateTags = function generateTags(data) {
 };
 
 const generateItem = function generateItem(post) {
-  const cheerio = require('cheerio');
+  const cheerio = require('cheerio/slim');
 
   // RSS feeds carry posts (pages don't appear in RSS), so the router-level
   // type is always 'posts'. The post object on the public API has its DB

package/core/frontend/services/theme-engine/active.js

@@ -16,7 +16,6 @@ const join = require('path').join;
 
 const _ = require('lodash');
 const themeConfig = require('./config');
-const config = require('../../../shared/config');
 const engine = require('./engine');
 const themeI18n = require('./i18n');
 const themeI18next = require('./i18next');
@@ -120,9 +119,8 @@ class ActiveTheme {
   }
 
   mount(siteApp) {
-    // Reset the global asset hash (used as fallback for non-theme assets)
-    config.set('assetHash', null);
-    // Clear the file-based asset hash cache (for theme assets)
+    // Clear the asset hash caches: the file-based cache for theme assets, and
+    // the global hash used as a fallback for everything else
     assetHash.clearCache();
     // clear the view cache
     siteApp.cache = {};

package/core/frontend/services/theme-engine/i18n/i18n.js

@@ -198,7 +198,17 @@ class I18n {
    * @param  {string} locale
    */
   _readTranslationsFile(locale) {
-    const filePath = path.join(...this._translationFileDirs(), this._translationFileName(locale));
+    const directory = path.resolve(path.join(...this._translationFileDirs()));
+    const filePath = path.resolve(directory, this._translationFileName(locale));
+
+    // A locale names one file directly inside the translations directory.
+    if (path.dirname(filePath) !== directory) {
+      throw new errors.NotFoundError({
+        message: `i18n was unable to find ${locale}.json.`,
+        code: 'ENOENT',
+      });
+    }
+
     const content = fs.readFileSync(filePath, 'utf8');
     return JSON.parse(content);
   }

package/core/frontend/services/theme-engine/i18next/theme-i18n.js

@@ -1,5 +1,5 @@
 const errors = require('@tryghost/errors');
-const i18nLib = require('@tryghost/i18n');
+const i18nLib = require('@tryghost/i18n').default;
 const path = require('path');
 const fs = require('fs-extra');
 

package/core/frontend/web/middleware/llms-discovery.js

@@ -1,48 +1,39 @@
-const onHeaders = require('on-headers');
-
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createLlmsDiscovery = createLlmsDiscovery;
+const on_headers_1 = __importDefault(require("on-headers"));
 function appendHeaderValue(existingValue, newValue) {
-  if (!existingValue) {
-    return newValue;
-  }
-
-  const raw = Array.isArray(existingValue) ? existingValue : [existingValue];
-  const values = raw.flatMap((v) => v.split(',').map((s) => s.trim()));
-
-  if (values.includes(newValue)) {
-    return raw.join(', ');
-  }
-
-  return raw.concat(newValue).join(', ');
+    if (!existingValue) {
+        return newValue;
+    }
+    const raw = Array.isArray(existingValue) ? existingValue : [String(existingValue)];
+    const values = raw.flatMap((value) => value.split(',').map((part) => part.trim()));
+    if (values.includes(newValue)) {
+        return raw.join(', ');
+    }
+    return raw.concat(newValue).join(', ');
 }
-
 function createLlmsDiscovery({ settingsCache }) {
-  function isDiscoveryEnabled() {
-    return !settingsCache.get('is_private') && settingsCache.get('llms_enabled') !== false;
-  }
-
-  return function llmsDiscovery(req, res, next) {
-    if (!isDiscoveryEnabled()) {
-      return next();
+    function isDiscoveryEnabled() {
+        return !settingsCache.get('is_private') && settingsCache.get('llms_enabled') !== false;
     }
-
-    onHeaders(res, function addLlmsDiscoveryHeaders() {
-      if (!isDiscoveryEnabled()) {
-        return;
-      }
-
-      const linkHeader = appendHeaderValue(this.getHeader('Link'), '</llms.txt>; rel="llms-txt"');
-      this.setHeader(
-        'Link',
-        appendHeaderValue(linkHeader, '</llms-full.txt>; rel="llms-full-txt"'),
-      );
-
-      if (!this.getHeader('X-Llms-Txt')) {
-        this.setHeader('X-Llms-Txt', '/llms.txt');
-      }
-    });
-
-    next();
-  };
+    return function llmsDiscovery(req, res, next) {
+        if (!isDiscoveryEnabled()) {
+            return next();
+        }
+        (0, on_headers_1.default)(res, function addLlmsDiscoveryHeaders() {
+            if (!isDiscoveryEnabled()) {
+                return;
+            }
+            const linkHeader = appendHeaderValue(this.getHeader('Link'), '</llms.txt>; rel="llms-txt"');
+            this.setHeader('Link', appendHeaderValue(linkHeader, '</llms-full.txt>; rel="llms-full-txt"'));
+            if (!this.getHeader('X-Llms-Txt')) {
+                this.setHeader('X-Llms-Txt', '/llms.txt');
+            }
+        });
+        next();
+    };
 }
-
-module.exports = { createLlmsDiscovery };

package/core/server/adapters/route-settings/S3RouteSettingsStore.js

@@ -87,7 +87,7 @@ const configSchema = zod_1.z
     return !((hasAccessKey || hasSecretKey || hasSessionToken) && !hasCredentialPair);
 }, { error: (0, tpl_1.default)(messages.partialCredentials) });
 /**
- * Remote store for route settings backed by an S3-compatible bucket (MinIO in
+ * Remote store for route settings backed by an S3-compatible bucket (VersityGW in
  * tests, GCS in production). Reads and writes the operator's original
  * `routes.yaml` verbatim.
  */

package/core/server/adapters/storage/LocalFilesStorage.js

@@ -3,10 +3,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-// # Local File System Storage module
-// The (default) module for storing media, using the local file system
 const config_1 = __importDefault(require("../../../shared/config"));
 const url_utils_1 = __importDefault(require("../../../shared/url-utils"));
+const file_type_utils_1 = require("../../services/files/file-type-utils");
 const LocalStorageBase_1 = __importDefault(require("./LocalStorageBase"));
 const messages = {
     notFound: 'File not found',
@@ -22,5 +21,16 @@ class LocalFilesStorage extends LocalStorageBase_1.default {
             errorMessages: messages,
         });
     }
+    /**
+     * The files upload endpoint resolves an inert content type for each file
+     * (e.g. .html -> text/plain, .svg -> application/octet-stream), which S3
+     * stores alongside the object. Local storage has nowhere to keep it, so
+     * resolve it again here instead of letting express.static derive a
+     * browser-executable type from the extension.
+     */
+    setServeHeaders(res, filePath) {
+        super.setServeHeaders(res, filePath);
+        res.setHeader('Content-Type', (0, file_type_utils_1.getStorageContentType)(filePath));
+    }
 }
 exports.default = LocalFilesStorage;

package/core/server/adapters/storage/LocalStorageBase.js

@@ -197,6 +197,17 @@ class LocalStorageBase extends ghost_storage_base_1.StorageBase {
             return false;
         }
     }
+    /**
+     * Sets response headers for a file about to be served from local storage.
+     * `send` only derives Content-Type from the extension when it hasn't been
+     * set yet, so subclasses can override this to enforce their own type.
+     *
+     * `nosniff` stops browsers from second-guessing the declared Content-Type
+     * based on the file's contents.
+     */
+    setServeHeaders(res, _filePath) {
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+    }
     /**
      * For some reason send divides the max age number by 1000
      * Fallthrough: false ensures that if an image isn't found, it automatically 404s
@@ -204,10 +215,12 @@ class LocalStorageBase extends ghost_storage_base_1.StorageBase {
      */
     serve() {
         const { storagePath, errorMessages } = this;
+        const setHeaders = (res, filePath) => this.setServeHeaders(res, filePath);
         return function serveStaticContent(req, res, next) {
             return serveStatic(storagePath, {
                 maxAge: 365 * 24 * 60 * 60 * 1000, // 1 year in ms
                 fallthrough: false,
+                setHeaders,
             })(req, res, (err) => {
                 if (err) {
                     if (err.statusCode === 404) {

package/core/server/api/endpoints/actions.js

@@ -1,4 +1,5 @@
 const models = require('../../models');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 
 /** @type {import('@tryghost/api-framework').Controller} */
 const controller = {
@@ -11,7 +12,7 @@ const controller = {
     options: ['page', 'limit', 'fields', 'include', 'filter'],
     permissions: true,
     query(frame) {
-      return models.Action.findPage(frame.options);
+      return models.Action.findPage(restrictAdminApiQueryOptions(frame.options));
     },
   },
 };

package/core/server/api/endpoints/automated-emails.js

@@ -8,6 +8,7 @@ const {
   DEFAULT_EMAIL_DESIGN_SETTING_SLUG,
 } = require('../../services/member-welcome-emails/constants');
 const { validateEmailSenderFields } = require('./utils/validate-email-sender-fields');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 
 const messages = {
   automatedEmailNotFound: 'Automated email not found.',
@@ -97,7 +98,7 @@ const controller = {
     permissions: true,
     async query(frame) {
       const result = await models.Automation.findPage({
-        ...frame.options,
+        ...restrictAdminApiQueryOptions(frame.options),
         withRelated: [
           'welcomeEmailAutomatedEmail',
           'welcomeEmailAutomatedEmail.emailDesignSetting',
@@ -122,7 +123,7 @@ const controller = {
     permissions: true,
     async query(frame) {
       const model = await models.Automation.findOne(frame.data, {
-        ...frame.options,
+        ...restrictAdminApiQueryOptions(frame.options),
         withRelated: [
           'welcomeEmailAutomatedEmail',
           'welcomeEmailAutomatedEmail.emailDesignSetting',