ghost 6.64.0 → 6.65.0

package/core/server/services/members/members-api/repositories/member-repository.js

@@ -717,7 +717,7 @@ module.exports = class MemberRepository {
     }
 
     // Fetch the member
-    let initialMember = await this._Member.findOne(
+    const initialMember = await this._Member.findOne(
       {
         id: options.id,
       },
@@ -1335,7 +1335,7 @@ module.exports = class MemberRepository {
       logging.error(e);
     }
 
-    let stripeCouponId = stripeSubscriptionData.discount?.coupon?.id;
+    const stripeCouponId = stripeSubscriptionData.discount?.coupon?.id;
 
     // For trial offers, offer id is passed from metadata as there is no stripe coupon
     let offerId = data.offerId || null;
@@ -1432,7 +1432,11 @@ module.exports = class MemberRepository {
 
       return 'inactive';
     };
-    let eventData = {};
+    const eventData = {};
+    const isIncomplete = ['incomplete', 'incomplete_expired'].includes(
+      stripeSubscriptionData.status,
+    );
+    let subscriptionToRecord = null;
 
     // A cancellation (or reactivation) changes no `members` column, so the member
     // model event would be suppressed by `wasChanged()`. Remember the pre-update
@@ -1482,10 +1486,34 @@ module.exports = class MemberRepository {
         },
       );
 
+      if (
+        stripeCustomerSubscriptionModel.get('status') === 'incomplete' &&
+        this.isActiveSubscriptionStatus(stripeSubscriptionData.status)
+      ) {
+        // Older Ghost versions recorded incomplete subscriptions as conversions. Avoid
+        // recording them twice when a checkout already in progress completes.
+        const createdEvent = await this._MemberPaidSubscriptionEvent.findOne(
+          {
+            member_id: memberModel.id,
+            subscription_id: stripeCustomerSubscriptionModel.id,
+            type: 'created',
+          },
+          options,
+        );
+        if (!createdEvent) {
+          subscriptionToRecord = updatedStripeCustomerSubscriptionModel;
+        }
+      }
+
       // CASE: Record offer redemption when offer_id changes to a new non-null value
       // This covers: null→new (free member upgrade), old→new (retention offer replacing expired signup offer)
       // The OfferRedemptionEvent handler has a dedup check for repeated webhook deliveries
-      if (previousOfferId !== subscriptionData.offer_id && subscriptionData.offer_id) {
+      if (
+        !isIncomplete &&
+        !subscriptionToRecord &&
+        previousOfferId !== subscriptionData.offer_id &&
+        subscriptionData.offer_id
+      ) {
         const redemptionTimestamp =
           subscriptionData.discount_start ||
           updatedStripeCustomerSubscriptionModel.get('created_at');
@@ -1508,14 +1536,16 @@ module.exports = class MemberRepository {
       }
 
       if (
-        stripeCustomerSubscriptionModel.get('mrr') !==
+        !isIncomplete &&
+        !subscriptionToRecord &&
+        (stripeCustomerSubscriptionModel.get('mrr') !==
           updatedStripeCustomerSubscriptionModel.get('mrr') ||
-        stripeCustomerSubscriptionModel.get('plan_id') !==
-          updatedStripeCustomerSubscriptionModel.get('plan_id') ||
-        stripeCustomerSubscriptionModel.get('status') !==
-          updatedStripeCustomerSubscriptionModel.get('status') ||
-        stripeCustomerSubscriptionModel.get('cancel_at_period_end') !==
-          updatedStripeCustomerSubscriptionModel.get('cancel_at_period_end')
+          stripeCustomerSubscriptionModel.get('plan_id') !==
+            updatedStripeCustomerSubscriptionModel.get('plan_id') ||
+          stripeCustomerSubscriptionModel.get('status') !==
+            updatedStripeCustomerSubscriptionModel.get('status') ||
+          stripeCustomerSubscriptionModel.get('cancel_at_period_end') !==
+            updatedStripeCustomerSubscriptionModel.get('cancel_at_period_end'))
       ) {
         const originalMrrDelta = stripeCustomerSubscriptionModel.get('mrr');
         const updatedMrrDelta = updatedStripeCustomerSubscriptionModel.get('mrr');
@@ -1607,16 +1637,24 @@ module.exports = class MemberRepository {
         subscriptionData,
         options,
       );
+      if (!isIncomplete) {
+        subscriptionToRecord = newStripeCustomerSubscriptionModel;
+      }
+    }
+
+    // A checkout attempt is not a paid conversion. Record the start only once
+    // the subscription leaves incomplete, retaining attribution from Stripe metadata.
+    if (subscriptionToRecord) {
       await this._MemberPaidSubscriptionEvent.add(
         {
           member_id: memberModel.id,
-          subscription_id: newStripeCustomerSubscriptionModel.id,
+          subscription_id: subscriptionToRecord.id,
           type: 'created',
           source: 'stripe',
           from_plan: null,
           to_plan: subscriptionPriceData.id,
           currency: subscriptionPriceData.currency,
-          mrr_delta: newStripeCustomerSubscriptionModel.get('mrr'),
+          mrr_delta: subscriptionToRecord.get('mrr'),
           ...eventData,
         },
         options,
@@ -1653,7 +1691,7 @@ module.exports = class MemberRepository {
         source,
         tierId: ghostProduct?.get('id'),
         memberId: memberModel.id,
-        subscriptionId: newStripeCustomerSubscriptionModel.get('id'),
+        subscriptionId: subscriptionToRecord.get('id'),
         offerId: offerId,
         attribution: attribution,
         batchId: options.batch_id,
@@ -1665,17 +1703,17 @@ module.exports = class MemberRepository {
         const offerRedemptionEvent = OfferRedemptionEvent.create({
           memberId: memberModel.id,
           offerId: offerId,
-          subscriptionId: newStripeCustomerSubscriptionModel.get('id'),
+          subscriptionId: subscriptionToRecord.get('id'),
         });
         this.dispatchEvent(offerRedemptionEvent, options);
       }
 
-      if (getStatus(newStripeCustomerSubscriptionModel) === 'active') {
+      if (getStatus(subscriptionToRecord) === 'active') {
         const subscriptionActivatedEvent = SubscriptionActivatedEvent.create({
           source,
           tierId: ghostProduct?.get('id'),
           memberId: memberModel.id,
-          subscriptionId: newStripeCustomerSubscriptionModel.get('id'),
+          subscriptionId: subscriptionToRecord.get('id'),
           offerId: offerId,
           attribution: attribution,
           batchId: options.batch_id,

package/core/server/services/members/members-api/repositories/product-repository.js

@@ -418,7 +418,7 @@ class ProductRepository {
 
     const existingProduct = await this._Product.findOne({ id: productId }, options);
 
-    let productData = {
+    const productData = {
       name: data.name,
       visibility: data.visibility,
       description: data.description,

package/core/server/services/members/members-api/services/member-bread-service.js

@@ -1,5 +1,5 @@
 const errors = require('@tryghost/errors');
-const { ADMIN } = require('../../../members-metafields');
+const { ADMIN, adminWriteOrigin } = require('../../../members-metafields');
 const logging = require('@tryghost/logging');
 const tpl = require('@tryghost/tpl');
 const moment = require('moment');
@@ -641,16 +641,13 @@ module.exports = class MemberBREADService {
       // The only route to this branch is the authenticated Admin API, so an anonymous
       // request is a mistake somewhere upstream rather than a writer to invent a name
       // for. Refusing keeps every stored writer resolvable.
-      const context = options.context || {};
-      if (!context.integration && !context.user) {
+      const origin = adminWriteOrigin(options.context);
+      if (!origin) {
         throw new errors.IncorrectUsageError({
           message: tpl(messages.metafieldsWithoutWriter),
         });
       }
-      const writtenBy = context.integration
-        ? { type: 'integration', id: context.integration.id }
-        : { type: 'user', id: context.user };
-      await this.metafieldValues.applyWrite(model.id, plannedMetafields, { writtenBy });
+      await this.metafieldValues.applyWrite(model.id, plannedMetafields, origin);
 
       // Metafields aren't a member column or relation, so an edit touching
       // only them leaves `model._changed` empty and the save fires nothing.

package/core/server/services/members/service.js

@@ -13,7 +13,7 @@ const settingsCache = require('../../../shared/settings-cache');
 const config = require('../../../shared/config');
 const models = require('../../models');
 const { GhostMailer } = require('../mail');
-const jobsService = require('../jobs');
+const jobsService = require('../jobs-service');
 const tiersService = require('../tiers');
 const giftService = require('../gifts');
 const VerificationTrigger = require('../verification-trigger');
@@ -83,7 +83,9 @@ const buildImporterDeps = ({ stripeAPIService }) => {
     },
     getGiftService: () => giftService.service,
     sendEmail: ghostMailer.send.bind(ghostMailer),
-    addJob: jobsService.addJob.bind(jobsService),
+    // Resolved per dispatch rather than here: init() also runs where nothing has
+    // initialised the jobs service.
+    dispatchJob: (job) => jobsService.getInstance().dispatch(job),
     knex: db.knex,
     urlFor: urlUtils.urlFor.bind(urlUtils),
     stripeAPIService,
@@ -233,6 +235,8 @@ module.exports = {
       membersCSVImporter.importCSV(request, verificationTrigger);
     module.exports.importInline = (request) =>
       membersCSVImporter.importInline(request, verificationTrigger);
+    // The members-import job handler, registered by boot with the jobs service.
+    module.exports.handleImportJob = (job) => membersCSVImporter.handle(job, verificationTrigger);
 
     // Constructed here rather than required statically: the exporter needs the
     // metafields services, which boot builds before this one.
@@ -265,6 +269,7 @@ module.exports = {
 
   importCSV: null,
   importInline: null,
+  handleImportJob: null,
 
   stats: membersStats,
   export: null,

package/core/server/services/members/stats/members-stats.js

@@ -135,11 +135,11 @@ class MembersStats {
       currentRangeDate = moment.tz(siteTimezone).subtract(days - 1, 'days');
     }
 
-    let endDate = moment.tz(siteTimezone).add(1, 'hour');
+    const endDate = moment.tz(siteTimezone).add(1, 'hour');
     const output = {};
 
     while (currentRangeDate.isBefore(endDate)) {
-      let dateStr = currentRangeDate.format('YYYY-MM-DD');
+      const dateStr = currentRangeDate.format('YYYY-MM-DD');
       runningTotal += resultObject[dateStr] || 0;
       output[dateStr] = runningTotal;
 

package/core/server/services/members-events/event-storage.js

@@ -23,7 +23,7 @@ class EventStorage {
    */
   subscribe(domainEvents) {
     domainEvents.subscribe(MemberCreatedEvent, async (event) => {
-      let attribution = event.data.attribution;
+      const attribution = event.data.attribution;
 
       await this.models.MemberCreatedEvent.add({
         member_id: event.data.memberId,
@@ -45,7 +45,7 @@ class EventStorage {
     });
 
     domainEvents.subscribe(SubscriptionCreatedEvent, async (event) => {
-      let attribution = event.data.attribution;
+      const attribution = event.data.attribution;
 
       await this.models.SubscriptionCreatedEvent.add({
         member_id: event.data.memberId,

package/core/server/services/members-metafields/actions.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.actingContext = actingContext;
+exports.adminWriteOrigin = adminWriteOrigin;
 exports.recordMetafieldAction = recordMetafieldAction;
 const logging_1 = __importDefault(require("@tryghost/logging"));
 /**
@@ -16,14 +17,34 @@ const logging_1 = __importDefault(require("@tryghost/logging"));
  */
 function actingContext(context) {
     const frame = (context ?? {});
+    const viaApiKey = Boolean(frame.api_key);
     if (frame.integration) {
-        return { actor: { id: frame.integration.id, type: 'integration' } };
+        return { actor: { id: frame.integration.id, type: 'integration', viaApiKey } };
     }
     if (frame.user) {
-        return { actor: { id: frame.user, type: 'user' } };
+        return { actor: { id: frame.user, type: 'user', viaApiKey } };
     }
     return { actor: null };
 }
+/**
+ * Who made a write through the Admin API and where, read off the same context as
+ * `actingContext`, so the values a request writes and the history it records name the
+ * same writer. Null when nobody is acting, which no Admin API write should be.
+ */
+function adminWriteOrigin(context) {
+    const { actor } = actingContext(context);
+    if (!actor) {
+        return null;
+    }
+    if (actor.type === 'integration') {
+        return { writtenBy: { type: 'integration', id: actor.id }, source: 'admin_api' };
+    }
+    // A staff token authenticates as its user but is a call to the API, not a visit to Admin.
+    return {
+        writtenBy: { type: 'user', id: actor.id },
+        source: actor.viaApiKey ? 'admin_api' : 'admin',
+    };
+}
 // Field-definition changes map to activity-feed events. A field's timeline reads
 // added -> edited -> archived -> restored, and a permanent delete (only from the
 // archived state) ends it with deleted.

package/core/server/services/members-metafields/bindings-service.js

@@ -57,8 +57,8 @@ class MetafieldBindingsService {
      */
     async writeCollected(memberId, productId, collected) {
         return this.writeThrough(memberId, productId, collected, (binding) => ({
-            type: 'binding',
-            id: binding.bindingId,
+            writtenBy: { type: 'binding', id: binding.bindingId },
+            source: 'checkout',
         }));
     }
     /**
@@ -70,8 +70,8 @@ class MetafieldBindingsService {
      */
     async writeSuppliedByMember(memberId, productId, supplied) {
         return this.writeThrough(memberId, productId, supplied, () => ({
-            type: 'member',
-            id: memberId,
+            writtenBy: { type: 'member', id: memberId },
+            source: 'checkout',
         }));
     }
     /**
@@ -112,7 +112,7 @@ class MetafieldBindingsService {
         // looking. A port exists because a publisher pointed it at a field, and that
         // decision is what admits the value, whoever supplied it.
         const planned = await this.values.planWrite({ [`${CUSTOM_NAMESPACE}.${into.key}`]: value }, access_1.INTERNAL);
-        await this.values.applyWrite(memberId, planned, { writtenBy: attribute(into) });
+        await this.values.applyWrite(memberId, planned, attribute(into));
     }
     async resolve(productId, port) {
         const row = await this.knex(BINDINGS_TABLE)

package/core/server/services/members-metafields/definitions-service.js

@@ -15,11 +15,6 @@ const schema_1 = require("./schema");
 const access_1 = require("./access");
 const queries_1 = require("./queries");
 const key_1 = require("./key");
-// The same NQL -> knex bridge Bookshelf's filter plugin uses, applied directly to
-// our raw-knex query: nql parses the `filter` string to a Mongo query, mongo-knex
-// turns that into parametrised WHERE clauses. Neither needs a Bookshelf model.
-const nql = require('@tryghost/nql');
-const knexify = require('@tryghost/mongo-knex');
 const TABLE = 'members_metafields';
 // Column limits come from the canonical schema — the same source the migration and
 // Bookshelf models read — so the service can never drift from the database. The
@@ -125,7 +120,7 @@ class MetafieldDefinitionsService {
             return this.list((0, queries_1.definitions)(this.knex, {
                 audience,
                 status: filterReferencesStatus(parsed) ? queries_1.ANY_STATUS : queries_1.ACTIVE_ONLY,
-                filter: (query) => knexify(query, parsed, { tableName: TABLE }),
+                filter: (query) => (0, queries_1.knexify)(query, parsed, { tableName: TABLE }),
             }));
         }
         return this.list((0, queries_1.definitions)(this.knex, { audience, status: queries_1.ACTIVE_ONLY }));
@@ -628,7 +623,7 @@ function isUniqueConstraintViolation(error) {
 function parseFilter(filter) {
     let mongoQuery;
     try {
-        mongoQuery = nql(filter).toJSON();
+        mongoQuery = (0, queries_1.nql)(filter).toJSON();
     }
     catch (err) {
         throw new errors_1.default.BadRequestError({

package/core/server/services/members-metafields/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.bindings = exports.values = exports.definitions = exports.canWrite = exports.MEMBER_ACCESS = exports.MEMBERS = exports.INTERNAL = exports.ADMIN = exports.actingContext = void 0;
+exports.bindings = exports.values = exports.definitions = exports.canWrite = exports.MEMBER_ACCESS = exports.MEMBERS = exports.INTERNAL = exports.ADMIN = exports.adminWriteOrigin = exports.actingContext = void 0;
 exports.init = init;
 const definitions_service_1 = require("./definitions-service");
 const values_service_1 = require("./values-service");
@@ -9,6 +9,7 @@ const actions_1 = require("./actions");
 const config_1 = require("./config");
 var actions_2 = require("./actions");
 Object.defineProperty(exports, "actingContext", { enumerable: true, get: function () { return actions_2.actingContext; } });
+Object.defineProperty(exports, "adminWriteOrigin", { enumerable: true, get: function () { return actions_2.adminWriteOrigin; } });
 // Which door a request came through, which is what decides how much of a member's
 // answers it may see or change. Required wherever that is asked, so a new caller
 // has to name itself rather than inherit an answer by default.

package/core/server/services/members-metafields/queries.js

@@ -1,12 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ANY_STATUS = exports.ACTIVE_ONLY = void 0;
+exports.ANY_STATUS = exports.ACTIVE_ONLY = exports.knexify = exports.nql = void 0;
 exports.readableBy = readableBy;
 exports.definitions = definitions;
 exports.inFieldOrder = inFieldOrder;
 const access_1 = require("./access");
 const schema_1 = require("./schema");
 const FIELDS_TABLE = 'members_metafields';
+// The same NQL -> knex bridge Bookshelf's filter plugin uses, applied directly to our
+// raw-knex queries: nql parses a `filter` string to a Mongo query, mongo-knex turns that
+// into parametrised WHERE clauses. Neither needs a Bookshelf model. Typed once here, since
+// neither package ships types.
+exports.nql = require('@tryghost/nql');
+exports.knexify = require('@tryghost/mongo-knex');
 // Nothing in the database keeps an archived or hidden field out of a read: no
 // constraint stops a value row referencing one. Both filters are therefore applied in
 // code, and a query that forgets either is a silent bug.

package/core/server/services/members-metafields/schema.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DbBoundField = exports.DbMetafieldBinding = exports.DbMetafieldLeaf = exports.DbMetafieldValue = exports.WrittenBy = exports.DbMetafield = exports.FieldStatusSchema = exports.FIELD_STATUS = void 0;
+exports.DbMetafieldChangeEventWithMember = exports.DbChangeEventMember = exports.DbMetafieldChangeEvent = exports.StoredFieldList = exports.MetafieldChangeEventFields = exports.DbBoundField = exports.DbMetafieldBinding = exports.DbMetafieldLeaf = exports.DbMetafieldValue = exports.WrittenBy = exports.DbMetafield = exports.FieldStatusSchema = exports.FIELD_STATUS = void 0;
 const zod_1 = require("zod");
 const metafield_types_1 = require("@tryghost/metafield-types");
 const date_1 = require("../../lib/db-types/date");
@@ -82,3 +82,51 @@ exports.DbBoundField = zod_1.z.object({
     key: zod_1.z.string(),
     type: metafield_types_1.FieldTypeSchema,
 });
+/** The fields an entry names. */
+exports.MetafieldChangeEventFields = zod_1.z.array(metafield_types_1.MetafieldChangeEventFieldSchema);
+/**
+ * The field list as the table holds it, JSON text, against the list itself. A codec rather
+ * than a parse on the way out, so the write stores what the read accepts. Zod validates
+ * JSON-compatible values (`z.json()`) but has no built-in for parsing JSON text, so decoding
+ * the text is this codec's job.
+ */
+exports.StoredFieldList = zod_1.z.codec(zod_1.z.string(), exports.MetafieldChangeEventFields, {
+    decode: (text, ctx) => {
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            ctx.issues.push({
+                code: 'custom',
+                message: 'The stored field list is not JSON.',
+                input: text,
+            });
+            return zod_1.z.NEVER;
+        }
+    },
+    encode: (fields) => JSON.stringify(fields),
+});
+/** An entry as the table holds it. Writer and source are plain strings, as on the values table. */
+exports.DbMetafieldChangeEvent = zod_1.z.object({
+    id: zod_1.z.string(),
+    member_id: zod_1.z.string(),
+    written_by_type: zod_1.z.string(),
+    written_by_id: zod_1.z.string().nullable(),
+    source: zod_1.z.string(),
+    metafields: exports.StoredFieldList,
+    created_at: date_1.DbDate,
+});
+/** The member columns an entry is shown with: only what a feed row needs. */
+exports.DbChangeEventMember = zod_1.z.object({
+    id: zod_1.z.string(),
+    uuid: zod_1.z.string(),
+    name: zod_1.z.string().nullable(),
+    email: zod_1.z.string(),
+});
+/**
+ * An entry and its member read back together. Parses and nothing else: what to do with an
+ * entry that doesn't parse is the reading service's decision.
+ */
+exports.DbMetafieldChangeEventWithMember = zod_1.z
+    .object({ event: exports.DbMetafieldChangeEvent, member: exports.DbChangeEventMember })
+    .transform(({ event, member }) => ({ ...event, member }));

package/core/server/services/members-metafields/values-service.js

@@ -11,11 +11,14 @@ const zod_1 = require("zod");
 const metafield_types_1 = require("@tryghost/metafield-types");
 const identity_1 = require("@tryghost/metafield-types/identity");
 const schema_1 = require("./schema");
+const date_1 = require("../../lib/db-types/date");
 const queries_1 = require("./queries");
 const access_1 = require("./access");
 const storage_1 = require("./storage");
 const FIELDS_TABLE = 'members_metafields';
 const VALUES_TABLE = 'members_metafield_values';
+const CHANGE_EVENTS_TABLE = 'members_metafield_change_events';
+const MEMBERS_TABLE = 'members';
 /**
  * From the canonical schema, the same source definitions-service reads, so no key a site
  * could hold is refused and this cannot drift from the `members_metafields.key` column.
@@ -34,6 +37,24 @@ const UPSERT_CHUNK = 400;
 const MAX_IDENTITY_LENGTH = MAX_KEY_LENGTH * 2 + 1;
 const ValuesInput = zod_1.z.record(zod_1.z.string().max(MAX_IDENTITY_LENGTH), zod_1.z.unknown());
 const wireProperty = (identity) => [identity_1.QUALIFIER, identity].join('.');
+/**
+ * Every refusal in one error.
+ *
+ * The API renders a single error, so the first still fills `message` and `property` and
+ * a client that reads only those sees exactly what it saw before. The whole set rides in
+ * `errorDetails`, which the renderer already passes through as `details`, so a client
+ * that wants to mark every refused input can have them all from one attempt.
+ */
+function refusalError(refusals) {
+    const [first, ...rest] = refusals;
+    return new errors_1.default.ValidationError({
+        message: first.message,
+        property: first.property,
+        // Omitted when there is nothing more to say, so the common single refusal keeps the
+        // shape it has always had rather than growing a one-element list.
+        ...(rest.length > 0 ? { errorDetails: refusals } : {}),
+    });
+}
 /**
  * What a member holds for each defined field. Separate from the definitions service
  * because a value belongs to the member and a definition belongs to the site's settings,
@@ -166,21 +187,27 @@ class MetafieldValuesService {
         }
         const byIdentity = await this.allowedFieldsByIdentity(identities, audience);
         const writes = [];
+        // Gathered rather than thrown as they are found. A write names several values, and
+        // a composite is several again, so refusing at the first leaves someone correcting
+        // one part per round trip to learn what was wrong with the rest.
+        const refusals = [];
         for (const [identity, raw] of Object.entries(values)) {
             const field = byIdentity.get(identity);
             if (!field) {
-                throw new errors_1.default.ValidationError({
+                refusals.push({
                     message: `Unknown custom field: ${identity}`,
                     property: wireProperty(identity),
                 });
+                continue;
             }
             // A different refusal from the unknown-field one above: this audience can
             // already see the field, so naming it discloses nothing.
             if (!(0, access_1.canWrite)(audience, field)) {
-                throw new errors_1.default.ValidationError({
+                refusals.push({
                     message: `Cannot set custom field: ${identity}`,
                     property: wireProperty(identity),
                 });
+                continue;
             }
             // `null` clears any field, and `''` clears one with no parts. For a value
             // with parts `''` names nothing, so it is left to fail validation rather than
@@ -195,14 +222,21 @@ class MetafieldValuesService {
             // Which field failed rides in `property`.
             const value = metafield_types_1.FIELD_TYPES[field.type].value.safeParse(raw);
             if (!value.success) {
-                const issue = value.error.issues[0];
-                throw new errors_1.default.ValidationError({
-                    message: issue.message,
-                    property: [wireProperty(identity), ...issue.path].join('.'),
-                });
+                // Every issue, not the first: a value with parts fails once per part, and each
+                // names the part it belongs to, which is what lets a client mark them all.
+                for (const issue of value.error.issues) {
+                    refusals.push({
+                        message: issue.message,
+                        property: [wireProperty(identity), ...issue.path].join('.'),
+                    });
+                }
+                continue;
             }
             writes.push({ field, value: value.data });
         }
+        if (refusals.length > 0) {
+            throw refusalError(refusals);
+        }
         return writes;
     }
     /**
@@ -213,13 +247,19 @@ class MetafieldValuesService {
      * them, and saying nothing about a path leaves it alone. There is no whole-value
      * replace, so a caller that does not know about a field cannot erase it.
      *
-     * `writtenBy` is required and has no default: every writer has to name itself, so a new
-     * one cannot quietly inherit the identity of whichever was written first.
+     * `writtenBy` and `source` are required and have no default: every writer has to name
+     * itself and where it wrote, so a new one cannot quietly inherit the identity of
+     * whichever was written first.
      *
      * Always transactional. Given an executor it joins that transaction, so the importer's
      * failed value write takes its member with it; given none it opens its own.
+     *
+     * Every write also puts an entry on the member's activity feed, naming the fields it
+     * touched and who wrote them where, in the same transaction, so the feed cannot name a
+     * change that was not stored or miss one that was. A value has more than one author,
+     * and the feed is where a publisher finds out which of them changed it.
      */
-    async applyWrite(memberId, writes, { writtenBy, executor = this.knex }) {
+    async applyWrite(memberId, writes, { writtenBy, source, executor = this.knex }) {
         if (writes.length === 0) {
             return;
         }
@@ -282,6 +322,22 @@ class MetafieldValuesService {
                     // it currently holds rather than who wrote its first value.
                     .merge(['value_text', 'written_by_type', 'written_by_id', 'updated_at']);
             }
+            const fields = writes.map(({ field }) => ({
+                namespace: field.namespace,
+                key: field.key,
+                name: field.name,
+            }));
+            await trx(CHANGE_EVENTS_TABLE).insert({
+                id: new bson_objectid_1.default().toHexString(),
+                member_id: memberId,
+                written_by_type: writtenBy.type,
+                written_by_id: writtenBy.id,
+                source,
+                metafields: schema_1.StoredFieldList.encode(fields),
+                // A string rather than the Date the value rows take: SQLite stores a bound Date
+                // as a number, which sorts before every string the feed pages through time with.
+                created_at: (0, date_1.toDatabaseDate)(now),
+            });
         };
         // knex's marker for a transactor: join it rather than nesting a savepoint under it.
         if (executor.isTransaction) {
@@ -291,5 +347,51 @@ class MetafieldValuesService {
             await executor.transaction(apply);
         }
     }
+    /**
+     * Entries from members' activity feeds, newest first, each with its member, as one page
+     * of the members events endpoint reads them.
+     *
+     * `filter` is a parsed NQL filter over this table's own columns: mapping the feed's
+     * names onto them is the feed's business, and applying them is this table's.
+     */
+    async browseChangeEvents({ limit, filter, }) {
+        const filtered = () => {
+            const query = this.knex(CHANGE_EVENTS_TABLE);
+            return filter ? (0, queries_1.knexify)(query, filter, { tableName: CHANGE_EVENTS_TABLE }) : query;
+        };
+        // Joined rather than looked up afterwards: an entry cannot outlive its member, whose
+        // delete cascades to it, so every entry has one to join.
+        const newestFirst = filtered()
+            .join(MEMBERS_TABLE, `${MEMBERS_TABLE}.id`, `${CHANGE_EVENTS_TABLE}.member_id`)
+            .orderBy([
+            { column: `${CHANGE_EVENTS_TABLE}.created_at`, order: 'desc' },
+            { column: `${CHANGE_EVENTS_TABLE}.id`, order: 'desc' },
+        ]);
+        const page = limit === undefined ? newestFirst : newestFirst.limit(limit);
+        const [rows, counted] = await Promise.all([
+            page.select(`${CHANGE_EVENTS_TABLE}.id`, `${CHANGE_EVENTS_TABLE}.member_id`, `${CHANGE_EVENTS_TABLE}.written_by_type`, `${CHANGE_EVENTS_TABLE}.written_by_id`, `${CHANGE_EVENTS_TABLE}.source`, `${CHANGE_EVENTS_TABLE}.metafields`, `${CHANGE_EVENTS_TABLE}.created_at`, { member_uuid: `${MEMBERS_TABLE}.uuid` }, { member_name: `${MEMBERS_TABLE}.name` }, { member_email: `${MEMBERS_TABLE}.email` }),
+            filtered().count({ total: '*' }).first(),
+        ]);
+        // What to do with an entry whose field list can't be read is decided here, not in the
+        // parser: it is still shown, naming no fields. The feed pages through time a page per
+        // event type, so dropping an entry would push a valid one off the end of its page for
+        // good. Anything else a row can't be read for, the table's constraints rule out, so it
+        // throws rather than being hidden.
+        const events = rows.map(({ member_uuid: uuid, member_name: name, member_email: email, ...event }) => {
+            const fields = schema_1.StoredFieldList.safeParse(event.metafields);
+            if (!fields.success) {
+                logging_1.default.warn({
+                    event: { name: 'members.metafields.change_event_unreadable' },
+                    err: fields.error,
+                    changeEventId: event.id,
+                }, 'Reading an unreadable metafield change entry as naming no fields');
+            }
+            return schema_1.DbMetafieldChangeEventWithMember.parse({
+                event: fields.success ? event : { ...event, metafields: schema_1.StoredFieldList.encode([]) },
+                member: { id: event.member_id, uuid, name, email },
+            });
+        });
+        return { events, total: Number(counted?.total ?? 0) };
+    }
 }
 exports.MetafieldValuesService = MetafieldValuesService;